@agentshouse/mdruntime 0.1.0-c3903a68dcbbf → 0.1.0-c4478f1a5ac2a

package/dist/connection.js

@@ -1,95 +1,101 @@
-import { verify } from '@agentshouse/mdmodel';
+import { attachedModel } from './attached-model.js';
 import { cached, modelTypes, NO_MODEL, sameModel, } from './model.js';
-import { opened } from './observation.js';
+import { observing } from './observation.js';
 import { filterOf, identityOf, planOf, } from './query.js';
 import { createReadSide } from './read-side.js';
+import { markdownPath, roomOfKey } from './rows.js';
 import { createSearchIndex, searchPlanOf, } from './search.js';
-import { ROOM_CONTRACT_VERSION, VERSION_1_CAPABILITIES, } from './adapter.js';
 import { bootstrapRoom } from './bootstrap.js';
-import { changeSet, mergeChangeSets } from './change-set.js';
+import { changeSet, entering, mergeChangeSets } from './change-set.js';
 import { createConversationStore, } from './conversation.js';
-import { MD_MODEL, parseCollection, validRoot } from './collection.js';
+import { queuedFile } from './change.js';
+import { indexReferrers, referencesIndexed, validRoot, } from './collection.js';
+import { runtimeError } from './failure.js';
 import { createLog } from './log.js';
+import { binaryRecord } from './binary.js';
+import { absentBinary, binaryAnswer, calledResult, failure, historyAnswer, undeclared, UNCERTAIN, } from './outcome.js';
+import { createRecovery } from './recovery.js';
 import { refreshRoom } from './refresh.js';
-import { buildBatch } from './save.js';
-import { applyReturned, compositionOf, landed, readConfirmed, readReclassified, replicaOf, sameMembership, withdrawals, } from './replica.js';
-import { changedParts, changesOf, held, readParts, returnedInto, underneath, } from './room-draft.js';
-import { settled, same, saving, STARTING, transferring, } from './status.js';
+import { buildBatch, joined, limitedIn, requeued } from './save.js';
+import { applyReturned, compositionOf, confirmedOf, landed, readReclassified, replicaOf, sameMembership, withdrawals, } from './replica.js';
+import { binaryBase, changedParts, changesOf, held, heldFile, joinedDraft, readParts, returnedBy, returnedInto, staleWrite, underneath, withdrawnDrafts, } from './room-draft.js';
+import { same, saving, STARTING, transferring, } from './status.js';
 import { detectStorageLoss, nextGeneration } from './durability.js';
-import { roomDraftRevision } from './identity.js';
+import { FencedMap } from './fence.js';
+import { tally } from './shared.js';
+import { inChunks, ROW_WEIGHT, yielded } from './turn.js';
+import { identityTime, roomDraftRevision } from './identity.js';
 import { beneath, normalize } from './paths.js';
 import { openRuntimeStore, } from './store.js';
 import { unconfirmed } from './transfer.js';
-// Discovery repeats each minute so a Room the stream stopped serving stays unrefreshed no longer.
-const DEFAULT_DISCOVERY_INTERVAL_MS = 60_000;
-const EMPTY_SCHEMA = { verdict: 'accept', model: { types: {} } };
-const knownCapabilities = new Set(VERSION_1_CAPABILITIES);
+import { governs, holds, narrowed, planReach, } from './reach.js';
 function within(root, path) {
     return root === '' || beneath(root, path);
 }
-function declaredIdentity(model) {
-    if (model === undefined)
-        return false;
-    if (model === null)
-        return true;
-    return (typeof model.identity === 'string' &&
-        model.identity.length > 0 &&
-        typeof model.version === 'string' &&
-        model.version.length > 0);
-}
 function declaredSelection(room) {
     const selection = room.typedSelection;
     if (selection === undefined)
         return true;
     if (!Array.isArray(selection.roots) || selection.roots.length === 0)
         return false;
-    if (!declaredIdentity(selection.attachedModel))
-        return false;
     return selection.roots.every((root, index) => validRoot(root) &&
         root !== '' &&
         selection.roots.every((other, at) => at === index || !within(other, root)));
 }
-function declaredUntypedFolders(room) {
-    const roots = room.untypedFolders;
-    if (roots === undefined)
-        return true;
-    if (!Array.isArray(roots) || roots.length === 0)
-        return false;
-    const selected = room.typedSelection?.roots ?? [];
-    return roots.every((root, index) => validRoot(root) &&
-        root !== '' &&
-        roots.every((other, at) => at === index || !within(other, root)) &&
-        selected.every((other) => !within(other, root) && !within(root, other)));
+const OPENING_LANE = 'opening';
+const CONVERSATION_LANE = 'conversations';
+const ROOM_READS = 256;
+const ROOM_ATTEMPTS = 16;
+const outside = new Map();
+function outsideOf(roots) {
+    const key = JSON.stringify(roots);
+    const held = outside.get(key);
+    if (held !== undefined)
+        return held;
+    const counted = (path) => (roots.some((root) => beneath(root, path)) ? 0 : 1);
+    const made = {
+        documents: (path) => (markdownPath(path) ? counted(path) : 0),
+        binaries: counted,
+    };
+    outside.set(key, made);
+    return made;
 }
-export function createMdRuntime(options) {
-    return composeRuntime(options).md;
+function abandonedOn(signal) {
+    return new Promise((resolve) => {
+        if (signal.aborted)
+            resolve(null);
+        else
+            signal.addEventListener('abort', () => resolve(null), { once: true });
+    });
+}
+function roomLane(locator) {
+    return `room ${locator}`;
 }
 export function composeRuntime(options) {
-    const period = options.discoveryIntervalMs ?? DEFAULT_DISCOVERY_INTERVAL_MS;
+    const localSaves = options.adapter.localSaves === true;
     let authorization = options.authorization;
     let opening;
     let store;
-    const replicas = new Map();
+    const fences = new Map();
+    const isFenced = (locator) => fences.has(locator);
+    let fencings = 0;
+    const lastFenced = new Map();
+    const fencedSince = (locator, since) => fences.has(locator) || (lastFenced.get(locator) ?? 0) > since;
+    let discoveries = 0;
+    const replicas = new FencedMap(isFenced);
+    const queuesWithoutReplica = new FencedMap(isFenced);
     const pendings = new Map();
-    const roomDrafts = new Map();
+    const roomDrafts = new FencedMap(isFenced);
     const presentations = new Map();
-    const outcomes = new Map();
-    const outcomeRooms = new Map();
-    const wanted = new Map();
     let limits = [];
-    let slots = [];
     let capabilities = [];
-    function rewriting() {
-        return capabilities.some((capability) => capability.name === 'move-reference-rewrites')
-            ? 'provider'
-            : 'runtime';
-    }
-    const rooms = new Map();
+    const rooms = new FencedMap(isFenced);
+    const counted = new Map();
     const unreadable = new Set();
-    const models = new Map();
-    const liveModels = new Map();
+    const isModelFenced = (key) => isFenced(key.slice(key.indexOf(' ') + 1));
+    const models = new FencedMap(isModelFenced);
+    const liveModels = new FencedMap(isModelFenced);
     const invalidModels = new Set();
-    const modelEpoch = new Map();
     const discovered = new Map();
     let roomsListed = false;
     const scopedRefusals = new Map();
@@ -118,16 +124,29 @@ export function composeRuntime(options) {
     let status = STARTING;
     let shown = STARTING;
     let discoveryPaused = false;
-    let timer;
     let closed = false;
     let stopping = false;
-    let withdrawNotifications;
-    let handed;
-    const notices = new Map();
-    let chain = Promise.resolve();
+    let withdrawStream;
+    const announced = new Map();
+    let underway = null;
+    let streamed = null;
+    let handed = false;
+    const recovery = (options.recovery ?? createRecovery()).scope(ROOM_ATTEMPTS);
+    const repairing = new Set();
+    const repairable = new Map();
+    let outcomeRetention = null;
+    const answering = new Map();
+    let complete = false;
+    let recorded = false;
+    const stale = new Set();
+    let generation = 0;
+    let discovering = null;
+    let opened = null;
+    const owed = new Set();
+    const lanes = new Map();
+    let roomReads = { generation, free: ROOM_READS, waiting: [] };
+    const working = new Set();
     let mutations = Promise.resolve();
-    let inflight = false;
-    let queued = false;
     const roomListeners = new Set();
     const refusalListeners = new Set();
     const storageLossListeners = new Set();
@@ -137,26 +156,39 @@ export function composeRuntime(options) {
     const presentationListeners = new Set();
     const readSide = createReadSide();
     let withdrawConversations;
-    let currencyQueued = false;
+    let currencyQueued = null;
+    let socketOpen = false;
     let serviceMode = 'open';
     let haltedRefusal = false;
     let openSignals = 0;
     const serviceModeListeners = new Set();
+    let member = null;
+    const memberListeners = new Set();
+    const prepared = new Set();
+    const projecting = new Set();
+    const demanded = new Set();
+    let preparing = false;
+    const catching = new Set();
+    const transfers = new FencedMap(isFenced);
     const conversations = createConversationStore({
-        cards: declaredCards,
-        documents: (locator) => readSide.query(planOf({ rooms: [locator], select: 'all' }, roomFacts())),
+        agents: declaredAgents,
+        documents: ({ locator }) => rowsQuery(planOf({ rooms: [locator], select: { fields: 'all' } }, roomFacts())),
         call: (name, input) => invokeAction(name, input),
         durably,
         stream: () => options.adapter.conversations,
         publish: publishChangeSet,
+        online: () => !status.providerUnreachable && refusal === null,
         closed: () => closed,
+        unanswered: resendLater,
+        expired: (operation) => pastHorizon(operation),
     });
     const searchIndex = createSearchIndex({
-        documents: () => readSide.documents(),
+        room: (room) => readSide.room(room),
         document: (room, path) => readSide.document(room, path),
-        messages: () => conversations.messages(),
-        message: (conversation, identity) => conversations.message(conversation, identity),
     });
+    const roomsToIndex = new Set();
+    const conversationsToIndex = new Set();
+    let indexing = false;
     const journal = createLog();
     let notifyReady = () => { };
     const ready = new Promise((resolve) => {
@@ -220,7 +252,9 @@ export function composeRuntime(options) {
         }
     }
     function pending() {
-        return [...replicas.values()].some((replica) => replica.queue.length > 0);
+        return (!localSaves &&
+            (queuesWithoutReplica.size > 0 ||
+                [...replicas.values()].some((replica) => replica.queue.length > 0)));
     }
     function attention() {
         const attentionRequired = [];
@@ -249,23 +283,30 @@ export function composeRuntime(options) {
         }
         return { attentionRequired, reset };
     }
+    function documentsIn(locator) {
+        const replica = replicas.get(locator);
+        if (replica === undefined)
+            return 0;
+        const roots = replica.confirmed.record.typedSelection?.roots ?? [];
+        const weighed = outsideOf(roots);
+        return (tally(replica.visible.documents, weighed.documents) +
+            tally(replica.visible.binaries, weighed.binaries));
+    }
     function listed() {
-        return structuredClone([...rooms.values()]);
-    }
-    function slotted() {
-        return structuredClone(slots.map(({ slot, entries }) => ({
-            slot,
-            entries: entries.flatMap(({ locator, segment }) => {
-                const room = rooms.get(locator);
-                return room === undefined ? [] : [{ room, segment }];
-            }),
-        })));
+        return structuredClone([...rooms.values()].map((room) => {
+            const documents = documentsIn(room.locator);
+            counted.set(room.locator, documents);
+            return { ...room, documents };
+        }));
     }
-    function roomFacts() {
-        const held = [...rooms.values()].map((room) => {
+    function roomFacts(reach = null) {
+        const held = [...rooms.values()]
+            .filter((room) => holds(reach, room.locator))
+            .map((room) => {
+            const governed = governs(reach, room);
             const attached = [
-                modelOf(room.locator),
-                ...(room.typedSelection === null ? [] : [modelOf(room.locator, 'typed-selection')]),
+                ...(governed.collection ? [modelOf(room.locator)] : []),
+                ...(governed.selection ? [modelOf(room.locator, 'typed-selection')] : []),
             ];
             return {
                 locator: room.locator,
@@ -276,6 +317,7 @@ export function composeRuntime(options) {
         return { listed: roomsListed, rooms: held };
     }
     function emitRooms() {
+        readSide.recover();
         const value = listed();
         for (const listener of roomListeners)
             listener(value);
@@ -288,6 +330,10 @@ export function composeRuntime(options) {
         for (const listener of storageLossListeners)
             listener(storageLoss);
     }
+    function emitMember() {
+        for (const listener of memberListeners)
+            listener(member);
+    }
     function moveTo(next) {
         if (closed)
             return;
@@ -306,14 +352,17 @@ export function composeRuntime(options) {
         for (const listener of statusListeners)
             listener(shown);
     }
-    function submissionOf(batch) {
-        return pendings.get(batch.id)?.submission ?? { state: 'waiting' };
+    function entryOf(batch) {
+        if (localSaves)
+            return Object.freeze({ batch, state: 'local' });
+        const state = pendings.get(batch.id);
+        if (state?.accepted !== undefined) {
+            return Object.freeze({ batch, state: 'accepted', roomVersion: state.accepted });
+        }
+        return Object.freeze({ batch, ...(state?.submission ?? { state: 'waiting' }) });
     }
     function entriesOf(locator) {
-        const replica = replicas.get(locator);
-        if (replica === undefined)
-            return [];
-        return replica.queue.map((batch) => Object.freeze({ batch, ...submissionOf(batch) }));
+        return (replicas.get(locator)?.queue ?? queuesWithoutReplica.get(locator) ?? []).map(entryOf);
     }
     function emitQueue(locator) {
         const entries = entriesOf(locator);
@@ -323,12 +372,191 @@ export function composeRuntime(options) {
         }
     }
     function applyChangeSet(set) {
-        readSide.apply(set);
-        searchIndex.changed(set);
+        const held = {
+            ...set,
+            documents: set.documents.filter(({ locator }) => prepared.has(locator) || projecting.has(locator)),
+        };
+        readSide.apply(held);
+        searchIndex.changed(held);
+    }
+    async function referenced(locator) {
+        for (;;) {
+            const record = replicas.get(locator)?.confirmed.record;
+            if (record === undefined || closed)
+                return;
+            const held = { text: record.documents, binaries: record.binaries };
+            const composition = compositionOf(record);
+            if (referencesIndexed(held, composition))
+                return;
+            await indexReferrers(held, composition);
+        }
+    }
+    async function prepareReplica(locator) {
+        await referenced(locator);
+        const replica = replicas.get(locator);
+        if (replica === undefined || closed || prepared.has(locator))
+            return;
+        const visible = replica.visible;
+        const paths = [
+            ...new Set([...Object.keys(visible.documents), ...Object.keys(visible.binaries)]),
+        ];
+        const entered = [];
+        projecting.add(locator);
+        try {
+            await inChunks(paths, (path) => ROW_WEIGHT + (visible.documents[path]?.length ?? 0), (chunk) => {
+                const current = replicas.get(locator);
+                if (current === undefined || closed)
+                    return;
+                const set = entering(locator, current, chunk);
+                readSide.apply(set);
+                entered.push(set);
+            });
+            if (!replicas.has(locator) || closed)
+                return;
+            prepared.add(locator);
+        }
+        finally {
+            projecting.delete(locator);
+        }
+        conversations.changed(mergeChangeSets(entered));
+        readSide.recover();
+    }
+    function unprepared() {
+        return [...demanded, ...replicas.keys()].find((locator) => !prepared.has(locator));
+    }
+    function prepare(locators = []) {
+        for (const locator of locators)
+            demanded.add(locator);
+        if (preparing)
+            return;
+        preparing = true;
+        void (async () => {
+            try {
+                for (let waiting = unprepared(); waiting !== undefined; waiting = unprepared()) {
+                    await yielded();
+                    if (closed)
+                        return;
+                    demanded.delete(waiting);
+                    await prepareReplica(waiting);
+                }
+            }
+            finally {
+                preparing = false;
+            }
+        })();
+    }
+    function reachedRooms(plan) {
+        const reach = plan.reach;
+        const reached = reach === null ? null : new Set([...reach.rooms, ...reach.documents.map(roomOfKey)]);
+        const named = plan.rooms ??
+            (reached === null
+                ? [...new Set([...rooms.keys(), ...replicas.keys(), ...queuesWithoutReplica.keys()])]
+                : [...reached]);
+        return [...new Set(named)].filter((locator) => reached === null || reached.has(locator)).sort();
+    }
+    function awaited(locator) {
+        return rooms.has(locator) || !roomsListed;
+    }
+    function covered(plan) {
+        const locators = reachedRooms(plan);
+        if (locators.length === 0 && plan.rooms === null && plan.reach === null && !roomsListed) {
+            return { pending: [] };
+        }
+        const pending = [];
+        const coverage = [];
+        const overlay = [];
+        for (const locator of locators) {
+            const replica = replicas.get(locator);
+            if (replica === undefined) {
+                if (awaited(locator))
+                    pending.push({ room: locator, awaits: 'acquisition' });
+                continue;
+            }
+            if (!prepared.has(locator)) {
+                pending.push({ room: locator, awaits: 'preparation' });
+                continue;
+            }
+            coverage.push({
+                room: locator,
+                generation: replica.confirmed.record.transfer,
+                current: !(catching.has(locator) || owed.has(locator) || transfers.has(locator)),
+            });
+            for (const batch of replica.queue)
+                overlay.push(batch.id);
+        }
+        if (pending.length > 0)
+            return { pending };
+        return { coverage: { rooms: coverage, indexes: [], overlay } };
+    }
+    function awaitPreparation(cover) {
+        if (!('pending' in cover))
+            return;
+        const waiting = cover.pending.filter(({ awaits }) => awaits === 'preparation');
+        if (waiting.length > 0)
+            prepare(waiting.map(({ room }) => room));
+    }
+    async function rowsQuery(plan) {
+        const before = covered(plan);
+        awaitPreparation(before);
+        if ('pending' in before)
+            return before;
+        const { rows, at: cover } = await readSide.query(plan, () => covered(plan));
+        awaitPreparation(cover);
+        if ('pending' in cover)
+            return cover;
+        return 'groups' in rows
+            ? { groups: rows.groups, coverage: cover.coverage }
+            : { documents: rows.documents, coverage: cover.coverage };
+    }
+    async function indexConversation(conversation) {
+        searchIndex.indexMessages(conversation, [], false);
+        let after = null;
+        for (;;) {
+            const batch = await durably((local) => local.messagesAfter(conversation, after));
+            if (closed)
+                return;
+            searchIndex.indexMessages(conversation, batch.map(({ identity, text }) => ({ conversation, identity, text })), batch.length === 0);
+            if (batch.length === 0)
+                return;
+            after = batch[batch.length - 1].identity;
+        }
+    }
+    function indexNext() {
+        const room = [...roomsToIndex].find((locator) => !searchIndex.rooms().has(locator));
+        if (room !== undefined) {
+            roomsToIndex.delete(room);
+            return () => (prepared.has(room) ? searchIndex.indexRoom(room) : undefined);
+        }
+        const conversation = [...conversationsToIndex].find((one) => !searchIndex.conversations().has(one));
+        if (conversation === undefined)
+            return null;
+        conversationsToIndex.delete(conversation);
+        return () => indexConversation(conversation);
+    }
+    function index(rooms, named) {
+        for (const room of rooms)
+            roomsToIndex.add(room);
+        for (const conversation of named)
+            conversationsToIndex.add(conversation);
+        if (indexing)
+            return;
+        indexing = true;
+        void (async () => {
+            try {
+                for (let unit = indexNext(); unit !== null && !closed; unit = indexNext()) {
+                    await yielded();
+                    await unit();
+                }
+            }
+            finally {
+                indexing = false;
+            }
+        })().catch(() => { });
     }
     function publishChangeSet(set) {
         applyChangeSet(set);
-        if (set.rooms.length > 0)
+        if (set.rooms.length > 0 ||
+            [...new Set(set.documents.map(({ locator }) => locator))].some((locator) => rooms.has(locator) && counted.get(locator) !== documentsIn(locator)))
             emitRooms();
         for (const locator of set.queues)
             emitQueue(locator);
@@ -339,26 +567,8 @@ export function composeRuntime(options) {
         for (const app of set.presentations)
             emitPresentation(app);
         conversations.changed(set);
-        const cards = declaredCards();
-        if (cards !== undefined && set.documents.some((change) => change.locator === cards.locator)) {
-            scheduleCurrency();
-        }
-    }
-    function stopTimer() {
-        if (timer === undefined)
-            return;
-        clearInterval(timer);
-        timer = undefined;
-    }
-    function startTimer() {
-        if (timer !== undefined)
-            return;
-        timer = setInterval(() => {
-            void enqueue();
-        }, period);
     }
     async function refuse(reason, provider = null) {
-        stopTimer();
         discoveryPaused = true;
         try {
             if (reason === 'revoked-authorization') {
@@ -366,10 +576,7 @@ export function composeRuntime(options) {
                     const revoked = { status: 'unavailable', reason: 'revoked' };
                     try {
                         const local = await openLocal();
-                        await local.revokeModels([...replicas.values()].map((replica) => ({
-                            record: replica.confirmed.record,
-                            queue: replica.queue,
-                        })));
+                        await local.revokeModels([...replicas.values()].map((replica) => replica.confirmed.record));
                     }
                     catch {
                         journal.record('model revocation persistence failed');
@@ -381,7 +588,6 @@ export function composeRuntime(options) {
                     }
                     for (const key of keys) {
                         invalidModels.add(key);
-                        modelEpoch.set(key, (modelEpoch.get(key) ?? 0) + 1);
                         models.set(key, revoked);
                         liveModels.delete(key);
                     }
@@ -394,10 +600,7 @@ export function composeRuntime(options) {
                                 model: revoked,
                                 selectionModel: revoked,
                             };
-                            const read = readConfirmed(record, before.confirmed);
-                            replicas.set(locator, read.kind === 'staged'
-                                ? replicaOf(read.confirmed, before.queue, rewriting(), before)
-                                : { ...before, confirmed: { ...before.confirmed, record } });
+                            replicas.set(locator, replicaOf(confirmedOf(record, before.confirmed), before.queue, before));
                         }
                         rooms.set(locator, {
                             ...room,
@@ -414,7 +617,8 @@ export function composeRuntime(options) {
         }
         finally {
             refusal = {
-                reason,
+                code: reason,
+                retryable: false,
                 reauthorizationOffered: reason === 'revoked-authorization',
                 refusal: provider,
             };
@@ -427,36 +631,40 @@ export function composeRuntime(options) {
         rooms.set(room.locator, {
             name: room.name,
             locator: room.locator,
+            handle: room.handle,
             operations: room.operations,
             replica: room.replica,
-            attachedModel: room.attachedModel,
             model: modelTypes(modelOf(room.locator)),
             typedSelection: selection === null
                 ? null
                 : {
                     roots: selection.roots,
-                    attachedModel: selection.attachedModel,
                     model: modelTypes(modelOf(room.locator, 'typed-selection')),
                 },
-            untypedFolders: room.untypedFolders ?? [],
             providerOwnedPaths: room.providerOwnedPaths,
             roomVersion: replicas.get(room.locator)?.confirmed.record.roomVersion ?? null,
-            attachments: replicas.get(room.locator)?.confirmed.record.attachments ?? [],
             synchronizationAvailable,
             refusal: scopedRefusals.get(room.locator) ?? sourceRefusals.get(room.locator) ?? null,
         });
     }
-    async function applyDiscovery(listed, local) {
+    async function applyDiscovery(found, started) {
+        for (const room of found) {
+            const fence = fences.get(room.locator);
+            if (fence !== undefined && fence.erased && fence.at < started)
+                fences.delete(room.locator);
+        }
+        const listed = found.filter((room) => !fences.has(room.locator));
         const listedLocators = new Set(listed.map((room) => room.locator));
         for (const locator of listedLocators)
             scopedRefusals.delete(locator);
         discovered.clear();
         for (const room of listed)
             discovered.set(room.locator, room);
-        for (const locator of wanted.keys())
-            if (!listedLocators.has(locator))
-                wanted.delete(locator);
-        await dropUnlisted(listedLocators, local);
+        const unlisted = unlistedHeld(new Set(found.map((room) => room.locator)));
+        if (options.adapter.exhaustiveDiscovery === true)
+            await loseRooms(unlisted);
+        else
+            unlistedKept(unlisted);
         for (const room of listed) {
             const held = replicas.get(room.locator)?.confirmed.record;
             if (held !== undefined && held.replica.selection !== room.replica.selection) {
@@ -467,56 +675,89 @@ export function composeRuntime(options) {
         }
         roomsListed = true;
         emitRooms();
+        return listed;
     }
     function unlistedHeld(listed) {
-        return [...new Set([...rooms.keys(), ...roomDrafts.keys()])].filter((locator) => !listed.has(locator));
-    }
-    async function dropUnlisted(listed, local) {
-        if (unlistedHeld(listed).length === 0)
-            return;
-        await exclusive(async () => {
-            const unlisted = unlistedHeld(listed);
-            await local.dropRooms(unlisted);
-            for (const [batch, locator] of outcomeRooms) {
-                if (listed.has(locator))
-                    continue;
-                outcomeRooms.delete(batch);
-                outcomes.delete(batch);
-            }
-            const removed = unlisted.map((locator) => changeSet(locator, replicas.get(locator) ?? null, null, {
-                room: true,
-                queue: true,
-                drafts: [...(roomDrafts.get(locator)?.keys() ?? [])],
-            }));
-            for (const locator of unlisted) {
-                for (const batch of replicas.get(locator)?.queue ?? [])
-                    pendings.delete(batch.id);
-                replicas.delete(locator);
+        return [
+            ...new Set([
+                ...rooms.keys(),
+                ...roomDrafts.keys(),
+                ...transfers.keys(),
+                ...queuesWithoutReplica.keys(),
+            ]),
+        ].filter((locator) => !listed.has(locator));
+    }
+    function unlistedKept(unlisted) {
+        for (const locator of unlisted) {
+            const held = replicas.get(locator)?.confirmed.record;
+            if (held !== undefined)
+                list(held, false);
+            else
                 rooms.delete(locator);
-                roomDrafts.delete(locator);
-                unreadable.delete(locator);
-                scopedRefusals.delete(locator);
-                sourceRefusals.delete(locator);
-                declarationRefusals.delete(locator);
-                for (const attached of ['collection', 'typed-selection']) {
-                    const key = modelKey(locator, attached);
-                    models.delete(key);
-                    liveModels.delete(key);
-                    invalidModels.delete(key);
-                    modelEpoch.delete(key);
-                }
-                journal.record(`room unlisted ${locator}`);
+        }
+    }
+    function fence(locators) {
+        const fresh = [...new Set(locators)].filter((locator) => !fences.has(locator));
+        const removed = fresh.map((locator) => changeSet(locator, replicas.get(locator) ?? null, null, {
+            room: true,
+            queue: true,
+            drafts: [...(roomDrafts.get(locator)?.keys() ?? [])],
+        }));
+        for (const locator of fresh) {
+            fences.set(locator, { at: discoveries, erased: false });
+            lastFenced.set(locator, ++fencings);
+            for (const batch of replicas.get(locator)?.queue ?? queuesWithoutReplica.get(locator) ?? [])
+                pendings.delete(batch.id);
+            replicas.delete(locator);
+            queuesWithoutReplica.delete(locator);
+            rooms.delete(locator);
+            roomDrafts.delete(locator);
+            transfers.delete(locator);
+            catching.delete(locator);
+            discovered.delete(locator);
+            announced.delete(locator);
+            unreadable.delete(locator);
+            stale.delete(locator);
+            repairable.delete(locator);
+            scopedRefusals.delete(locator);
+            sourceRefusals.delete(locator);
+            declarationRefusals.delete(locator);
+            for (const attached of ['collection', 'typed-selection']) {
+                const key = modelKey(locator, attached);
+                models.delete(key);
+                liveModels.delete(key);
+                invalidModels.delete(key);
             }
-            publishChangeSet(mergeChangeSets(removed));
-            moveTo({ ...status, ...attention() });
-        });
+            journal.record(`room lost ${locator}`);
+        }
+        if (fresh.length === 0)
+            return fresh;
+        publishChangeSet(mergeChangeSets(removed));
+        for (const locator of fresh)
+            prepared.delete(locator);
+        searchIndex.forget(fresh);
+        readSide.recover();
+        moveTo({ ...status, ...attention() });
+        return fresh;
+    }
+    async function erased(local, locators) {
+        await local.erase(locators);
+        for (const locator of locators) {
+            const held = fences.get(locator);
+            if (held !== undefined)
+                held.erased = true;
+        }
+    }
+    async function loseRooms(locators) {
+        const fresh = fence(locators);
+        if (fresh.length > 0)
+            await durably((local) => erased(local, fresh));
     }
     function restored(key, persisted) {
         const prior = models.get(key);
         if (prior !== undefined &&
             prior.status !== 'unavailable' &&
             (persisted.status === 'unavailable' || !sameModel(prior.snapshot, persisted.snapshot))) {
-            modelEpoch.set(key, (modelEpoch.get(key) ?? 0) + 1);
             invalidModels.add(key);
         }
         const model = persisted.status === 'unavailable' ||
@@ -531,10 +772,9 @@ export function composeRuntime(options) {
         return model;
     }
     async function hydrate(opened) {
-        const [records, queues, recordedOutcomes, kept, presented, held, chatDrafts, lastCompleted, declared, named, listedSlots,] = await Promise.all([
+        const [records, queues, kept, presented, held, chatDrafts, lastCompleted, declared, named, known, staged,] = await Promise.all([
             opened.all(),
             opened.queues(),
-            opened.outcomes(),
             opened.roomDrafts(),
             opened.presentation(),
             opened.conversations(),
@@ -542,11 +782,15 @@ export function composeRuntime(options) {
             opened.lastCompleted(),
             opened.providerLimits(),
             opened.capabilities(),
-            opened.slots(),
+            opened.member(),
+            opened.transfers(),
         ]);
+        transfers.clear();
+        for (const record of staged)
+            transfers.set(record.locator, record);
         limits = declared;
         capabilities = named;
-        slots = listedSlots;
+        member = known;
         roomDrafts.clear();
         for (const record of kept)
             rememberRoomDraft(record);
@@ -560,27 +804,20 @@ export function composeRuntime(options) {
             for (const { batch, state } of queue.pending)
                 pendings.set(batch.id, state);
         }
-        outcomes.clear();
-        outcomeRooms.clear();
-        for (const record of recordedOutcomes) {
-            outcomes.set(record.id, record.outcome);
-            outcomeRooms.set(record.id, record.locator);
-        }
         const previousReplicas = new Map(replicas);
         replicas.clear();
+        queuesWithoutReplica.clear();
+        const replicated = new Set(records.map((record) => record.locator));
+        for (const [locator, queue] of queuedBatches) {
+            if (!replicated.has(locator))
+                queuesWithoutReplica.set(locator, queue);
+        }
         for (const record of records) {
             const model = restored(modelKey(record.locator, 'collection'), record.model);
             const selectionModel = restored(modelKey(record.locator, 'typed-selection'), record.selectionModel);
             const prior = previousReplicas.get(record.locator);
-            const retyped = { ...record, model, selectionModel };
-            const read = readConfirmed(retyped, prior?.confirmed);
-            const confirmed = read.kind === 'staged'
-                ? read.confirmed
-                : {
-                    record: retyped,
-                    collection: parseCollection(retyped.documents, compositionOf(retyped)),
-                };
-            replicas.set(record.locator, replicaOf(confirmed, queuedBatches.get(record.locator) ?? [], rewriting(), prior));
+            const confirmed = confirmedOf({ ...record, model, selectionModel }, prior?.confirmed);
+            replicas.set(record.locator, replicaOf(confirmed, queuedBatches.get(record.locator) ?? [], prior));
             const existing = rooms.get(record.locator);
             if (existing === undefined)
                 list(record, false);
@@ -588,25 +825,17 @@ export function composeRuntime(options) {
                 rooms.set(record.locator, {
                     ...existing,
                     roomVersion: record.roomVersion,
-                    attachments: record.attachments,
                     operations: record.operations,
                     replica: record.replica,
-                    attachedModel: record.attachedModel,
                     model: modelTypes(model),
                     typedSelection: record.typedSelection === null
                         ? null
                         : {
                             roots: record.typedSelection.roots,
-                            attachedModel: record.typedSelection.attachedModel,
                             model: modelTypes(selectionModel),
                         },
-                    untypedFolders: record.untypedFolders,
                 });
             }
-            if (read.kind === 'refused') {
-                refusedSource(record, read);
-                declarationRefusals.add(record.locator);
-            }
         }
         return {
             lastCompleted,
@@ -617,16 +846,26 @@ export function composeRuntime(options) {
     async function readState(opened) {
         const { lastCompleted, locators, read } = await hydrate(opened);
         applyChangeSet(read);
+        prepare();
         if (replicas.size > 0)
             emitRooms();
+        if (member !== null)
+            emitMember();
         for (const locator of locators)
             emitQueue(locator);
         publishRoomDrafts(false);
         return lastCompleted;
     }
     async function open() {
-        const opened = await openRuntimeStore();
+        if (closed)
+            throw new Error('runtime closed');
+        const opened = await openRuntimeStore(isFenced);
         store = opened;
+        const interrupted = await opened.fences();
+        for (const locator of interrupted) {
+            fences.set(locator, { at: discoveries, erased: false });
+            lastFenced.set(locator, ++fencings);
+        }
         const kept = options.shell.generation;
         const storedGeneration = await opened.generation();
         const loss = detectStorageLoss(storedGeneration, kept);
@@ -640,6 +879,8 @@ export function composeRuntime(options) {
             emitStorageLoss();
         }
         const lastCompleted = await readState(opened);
+        if (interrupted.length > 0)
+            await erased(opened, interrupted);
         moveTo({ ...status, lastCompleted, ...attention() });
         return opened;
     }
@@ -666,10 +907,15 @@ export function composeRuntime(options) {
         return state !== undefined && state.submission.state !== 'submitted' && !state.lost;
     }
     async function settle(local, locator, before, confirmed, queue, settling = {}) {
-        const withdrawn = withdrawals(confirmed, queue, withdrawable, rewriting());
+        const previousQueue = before?.queue ?? queuesWithoutReplica.get(locator) ?? [];
+        const withdrawn = withdrawals(confirmed, queue, withdrawable, localSaves);
         const kept = queue.filter((batch) => !withdrawn.includes(batch));
+        const unqueued = withdrawn.map((batch) => ({
+            batch,
+            returned: localSaves || landed(batch, confirmed) ? null : returnedBy('withdrawn'),
+        }));
         const returning = [
-            ...withdrawn.map((batch) => ({ batch, returned: { kind: 'withdrawn' } })).reverse(),
+            ...[...unqueued].reverse(),
             ...(settling.leaving === undefined ? [] : [settling.leaving]),
         ];
         const written = new Map();
@@ -687,131 +933,271 @@ export function composeRuntime(options) {
                 });
             }
         }
-        const settledOutcomes = [
-            ...(settling.accepted === undefined ? [] : [settling.accepted]),
-            ...(settling.leaving === undefined
-                ? []
-                : [{ id: settling.leaving.batch.id, outcome: settling.leaving.outcome }]),
-            ...withdrawn.map((batch) => ({ id: batch.id, outcome: { kind: 'withdrawn' } })),
-        ];
-        await local.write({
-            next: confirmed.record,
-            previous: before?.confirmed.record ?? null,
-            queue: kept,
-            previousQueue: before?.queue ?? [],
-            outcomes: settledOutcomes,
-            roomDrafts: [...written.values()],
-        });
-        for (const { id, outcome } of settledOutcomes) {
-            outcomes.set(id, outcome);
-            outcomeRooms.set(id, locator);
-            pendings.delete(id);
+        await local.keepAuthored({ locator, queue: kept, roomDrafts: [...written.values()] });
+        for (const batch of previousQueue) {
+            if (!kept.includes(batch))
+                pendings.delete(batch.id);
         }
         for (const record of written.values())
             rememberRoomDraft(record);
-        for (const batch of withdrawn)
-            journal.record(`outcome ${locator} ${batch.id} withdrawn`);
-        replicas.set(locator, replicaOf(confirmed, kept, rewriting(), before));
-        return changeSet(locator, before ?? null, replicas.get(locator) ?? null, {
-            room: settling.room,
-            queue: kept.length !== (before?.queue.length ?? 0),
-            drafts: [...written.keys()],
-        });
+        try {
+            await local.write({
+                next: confirmed.record,
+                previous: before?.confirmed.record ?? null,
+                ...(settling.stored === undefined ? {} : { stored: settling.stored }),
+            });
+        }
+        catch (error) {
+            const held = before === undefined ? null : replicaOf(before.confirmed, kept, before);
+            if (held !== null)
+                replicas.set(locator, held);
+            else if (kept.length > 0)
+                queuesWithoutReplica.set(locator, kept);
+            else
+                queuesWithoutReplica.delete(locator);
+            publishChangeSet(changeSet(locator, before ?? null, held, {
+                queue: kept.length !== previousQueue.length,
+                drafts: [...written.keys()],
+            }));
+            moveTo({ ...status, ...attention() });
+            throw error;
+        }
+        return () => {
+            queuesWithoutReplica.delete(locator);
+            for (const { batch, returned } of unqueued) {
+                const outcome = localSaves ? 'dropped' : returned === null ? 'landed' : 'withdrawn';
+                journal.record(`outcome ${locator} ${batch.id} ${outcome}`);
+            }
+            replicas.set(locator, replicaOf(confirmed, kept, before));
+            return changeSet(locator, before ?? null, replicas.get(locator) ?? null, {
+                room: settling.room,
+                queue: kept.length !== previousQueue.length,
+                drafts: [...written.keys()],
+            });
+        };
+    }
+    function adoptModels(locator, record) {
+        for (const [attached, model] of [
+            ['collection', record.model],
+            ['typed-selection', record.selectionModel],
+        ]) {
+            const key = modelKey(locator, attached);
+            models.set(key, model);
+            invalidModels.delete(key);
+            if (model.status === 'current')
+                liveModels.set(key, JSON.stringify(model.snapshot));
+            else if (model.status === 'unavailable')
+                liveModels.delete(key);
+        }
+    }
+    function remodel(locator, answers, held) {
+        const taken = (answer, previous, attached) => {
+            if (answer === undefined)
+                return previous;
+            const { state, refused } = attachedModel(answer, previous);
+            if (refused !== null) {
+                const where = refused.location === undefined ? '' : ` ${refused.location}`;
+                journal.record(`model invalid ${locator} ${attached} ${refused.identity} ${refused.rule}${where}`);
+            }
+            models.set(modelKey(locator, attached), state);
+            return state;
+        };
+        return {
+            collection: taken(answers?.collection, held.collection, 'collection'),
+            selection: taken(answers?.selection, held.selection, 'typed-selection'),
+        };
     }
-    function publish(local, room, confirmed) {
+    function publish(local, room, confirmed, landing, live) {
+        const { base, stored } = landing;
         return exclusive(async () => {
-            if (!continuing())
-                return;
+            if (stored !== undefined) {
+                await indexReferrers({ text: confirmed.record.documents, binaries: confirmed.record.binaries }, compositionOf(confirmed.record));
+            }
+            if (!live()) {
+                caughtUpTo(room.locator);
+                return true;
+            }
             const prior = replicas.get(room.locator);
-            const retained = readConfirmed({
-                ...confirmed.record,
-                model: modelOf(room.locator),
-                selectionModel: modelOf(room.locator, 'typed-selection'),
-            }, prior?.confirmed);
-            if (retained.kind !== 'staged')
-                throw new Error(`Cannot retype staged Room ${room.locator}`);
-            const queue = prior?.queue ?? [];
-            const roomVersion = retained.confirmed.record.roomVersion;
+            if (base !== undefined &&
+                (prior?.confirmed.record.roomVersion !== base.record.roomVersion ||
+                    prior.confirmed.record.revisions !== base.record.revisions)) {
+                return false;
+            }
+            adoptModels(room.locator, confirmed.record);
+            const queue = prior?.queue ?? queuesWithoutReplica.get(room.locator) ?? [];
+            const roomVersion = confirmed.record.roomVersion;
             const accepted = queue.filter((batch) => {
-                const outcome = outcomes.get(batch.id);
-                return (outcome?.kind === 'accepted' &&
-                    options.adapter.reached(room.locator, roomVersion, outcome.roomVersion));
+                const accepted = pendings.get(batch.id)?.accepted;
+                return (accepted !== undefined && options.adapter.reached(room.locator, roomVersion, accepted));
             });
-            const set = await settle(local, room.locator, prior, retained.confirmed, queue.filter((batch) => !accepted.includes(batch)), { room: true });
+            const set = (await settle(local, room.locator, prior, confirmed, queue.filter((batch) => !accepted.includes(batch)), { room: true, ...(stored === undefined ? {} : { stored }) }))();
+            if (stored !== undefined) {
+                transfers.delete(room.locator);
+                catching.delete(room.locator);
+            }
             for (const batch of accepted)
                 pendings.delete(batch.id);
-            const target = wanted.get(room.locator);
-            if (target !== undefined && options.adapter.reached(room.locator, roomVersion, target)) {
-                wanted.delete(room.locator);
-            }
-            unreadable.delete(room.locator);
+            stale.delete(room.locator);
+            if (unreadable.delete(room.locator))
+                scopedRefusals.delete(room.locator);
             sourceRefusals.delete(room.locator);
             declarationRefusals.delete(room.locator);
             list(room, true);
+            if (prior === undefined)
+                prepared.add(room.locator);
             publishChangeSet(set);
             moveTo({ ...status, ...attention() });
+            options.adapter.roomStream?.published(room.locator, roomVersion);
+            return true;
         });
     }
     async function saveRoomDrafts(locator, named, writtenBy) {
         const local = await openLocal();
+        await referenced(locator);
         const replica = replicas.get(locator);
         const room = rooms.get(locator);
         if (replica === undefined || room === undefined) {
-            throw new Error(`No Local Replica for ${locator}`);
+            throw runtimeError('room-not-held', `No Local Replica for ${locator}`);
         }
         const saved = [];
         for (const { path, revision } of named) {
             const record = roomDrafts.get(locator)?.get(path);
             if (record === undefined || record.revision !== revision) {
-                return { outcome: 'refused', rule: 'stale', file: path };
+                return { outcome: 'refused', code: 'stale', retryable: false, file: path };
             }
             if (!saved.some((draft) => draft.path === path))
                 saved.push({ path, parts: record.parts });
         }
         const changed = saved.flatMap(({ path, parts }) => changedParts(path, underneath(parts, path, replica.visible)));
         if (changed.length > 0)
-            return { outcome: 'refused', rule: 'changed-underneath', parts: changed };
+            return { outcome: 'refused', code: 'changed-underneath', retryable: false, parts: changed };
         const parts = saved.map(({ path, parts }) => changesOf(path, parts));
-        const built = buildBatch({
+        const changes = parts.flatMap(({ changes }) => changes);
+        const requeue = requeued(replica.queue, changes, replica.visible, withdrawable, (queue) => replicaOf(replica.confirmed, queue, replica).visible);
+        if (requeue.kind === 'refused')
+            return { outcome: 'refused', ...requeue.refusal };
+        const foreign = [...requeue.withdrawn.keys()].some((origin) => {
+            const writer = replica.queue.find((batch) => batch.id === origin)?.writtenBy;
+            return writer?.app !== writtenBy?.app || writer?.release !== writtenBy?.release;
+        });
+        if (foreign) {
+            return {
+                outcome: 'refused',
+                code: 'unknown-revision',
+                retryable: false,
+                file: [...requeue.queued].at(-1),
+            };
+        }
+        const withdrawing = requeue.withdrawn.size > 0;
+        const input = {
+            local: localSaves,
             baseRoomVersion: replica.confirmed.record.roomVersion,
             composition: compositionFor(replica.confirmed.record),
             operations: room.operations,
             providerOwnedPaths: room.providerOwnedPaths,
             providerLimits: limits,
-            rewriting: rewriting(),
+            handle: room.handle,
             visible: replica.visible,
-            changes: parts.flatMap(({ changes }) => changes),
+            changes,
             bases: parts.flatMap(({ bases }) => bases),
             writtenBy,
+            clean: {
+                text: replica.confirmed.record.documents,
+                binaries: replica.confirmed.record.binaries,
+                composition: compositionOf(replica.confirmed.record),
+            },
+        };
+        const checked = withdrawing ? buildBatch({ ...input, queued: requeue.queued }) : null;
+        if (checked?.kind === 'refused')
+            return { outcome: 'refused', ...checked.refusal };
+        const owners = [...requeue.owners].flatMap((origin) => {
+            const batch = requeue.withdrawn.get(origin);
+            return batch === undefined || batch === null ? [] : [{ origin, batch }];
         });
-        if (built.kind === 'refused')
+        if (owners.length > 1) {
+            return {
+                outcome: 'refused',
+                code: 'unknown-revision',
+                retryable: false,
+                file: [...requeue.queued].at(-1),
+            };
+        }
+        const built = !withdrawing
+            ? buildBatch(input)
+            : requeue.changes.length === 0
+                ? null
+                : buildBatch({
+                    ...input,
+                    visible: replicaOf(replica.confirmed, requeue.queue, replica).visible,
+                    changes: requeue.changes,
+                });
+        if (built?.kind === 'refused')
             return { outcome: 'refused', ...built.refusal };
-        const batches = [...replica.queue, built.batch];
+        const [owner] = owners;
+        const join = built === null || owner === undefined
+            ? null
+            : joined(requeue.queue, owner.batch, built.batch);
+        if (join?.kind === 'refused')
+            return { outcome: 'refused', ...join.refusal };
+        const withdrawn = new Map(requeue.withdrawn);
+        if (join !== null && owner !== undefined)
+            withdrawn.set(owner.origin, join.batch);
+        const drafted = new Map();
+        for (const [origin, replaced] of withdrawn) {
+            if (replaced === null)
+                continue;
+            const carried = withdrawnDrafts(pendings.get(origin)?.drafts ?? [], changes);
+            drafted.set(replaced.id, replaced === join?.batch
+                ? [
+                    ...carried.map((held) => joinedDraft(held, saved)),
+                    ...saved.filter((draft) => !carried.some((held) => held.path === draft.path)),
+                ]
+                : carried);
+        }
+        if (built !== null && join === null)
+            drafted.set(built.batch.id, saved);
+        const batches = join !== null ? join.queue : built === null ? requeue.queue : [...requeue.queue, built.batch];
+        for (const replaced of withdrawn.values()) {
+            if (replaced === null || !batches.includes(replaced))
+                continue;
+            const limited = limitedIn(batches, replaced, limits, (queue) => replicaOf(replica.confirmed, queue, replica).visible);
+            if (limited !== null)
+                return { outcome: 'refused', ...limited };
+        }
         const consumed = saved.map(({ path }) => path);
         try {
-            await local.write({
-                next: replica.confirmed.record,
-                previous: replica.confirmed.record,
+            await local.keepAuthored({
+                locator,
                 queue: batches,
-                previousQueue: replica.queue,
-                saved,
+                saved: drafted,
                 consumedRoomDrafts: consumed,
             });
         }
         catch {
-            return { outcome: 'refused', rule: 'durable-write' };
+            return { outcome: 'refused', code: 'durable-write', retryable: true };
         }
-        pendings.set(built.batch.id, { drafts: saved, submission: { state: 'waiting' }, lost: false });
+        if (fences.has(locator))
+            throw runtimeError('room-not-held', `No Local Replica for ${locator}`);
+        for (const origin of withdrawn.keys())
+            pendings.delete(origin);
+        for (const [id, drafts] of drafted) {
+            pendings.set(id, { drafts, submission: { state: 'waiting' }, lost: false });
+        }
+        if (!localSaves)
+            recorded = false;
         for (const path of consumed)
             forgetRoomDraft(locator, path);
-        replicas.set(locator, replicaOf(replica.confirmed, batches, rewriting(), replica));
+        replicas.set(locator, replicaOf(replica.confirmed, batches, replica));
         publishChangeSet(changeSet(locator, replica, replicas.get(locator) ?? null, {
             queue: true,
             drafts: consumed,
         }));
-        moveTo({ ...saving(status), ...attention() });
-        void enqueue();
-        return { outcome: 'saved', identifier: built.batch.id };
+        moveTo({ ...(localSaves ? status : saving(status)), ...attention() });
+        submitLater(locator);
+        const identifier = join?.batch.id ??
+            built?.batch.id ??
+            [...requeue.withdrawn].map(([origin, replaced]) => replaced?.id ?? origin).at(-1);
+        return { outcome: 'saved', identifier };
     }
     async function mark(local, locator, identifier, submission, lost) {
         const state = pendings.get(identifier);
@@ -821,6 +1207,8 @@ export function composeRuntime(options) {
             return;
         }
         await local.submit(locator, identifier, submission, lost);
+        if (fences.has(locator))
+            return;
         pendings.set(identifier, { ...state, submission, lost });
         const replica = replicas.get(locator);
         if (replica !== undefined)
@@ -831,22 +1219,24 @@ export function composeRuntime(options) {
         if (!continuing())
             throw new Error('connection refused');
         await local.keepUpload(locator, identifier, upload);
+        if (fences.has(locator))
+            throw runtimeError('room-not-held', `No Local Replica for ${locator}`);
         pendings.set(identifier, { ...pendings.get(identifier), upload });
         if (!continuing())
             throw new Error('connection refused');
     }
     async function readHistory(locator, path, query = {}) {
         if (closed || refusal !== null)
-            return { kind: 'transport-uncertainty' };
+            return UNCERTAIN;
         try {
             await ensureAuthorization();
         }
         catch {
-            return { kind: 'transport-uncertainty' };
-        }
-        if (closed || authorization === undefined || refusal !== null) {
-            return { kind: 'transport-uncertainty' };
+            return UNCERTAIN;
         }
+        if (closed || authorization === undefined || refusal !== null)
+            return UNCERTAIN;
+        const since = fencings;
         const transfer = ['transfer', 'history', locator, path];
         if (query.revision !== undefined)
             transfer.push(query.revision);
@@ -861,6 +1251,8 @@ export function composeRuntime(options) {
                 ...(query.pageToken === undefined ? {} : { pageToken: query.pageToken }),
             });
             journal.record(`outcome history ${result.kind}`);
+            if (fencedSince(locator, since))
+                return failure({ kind: 'room-not-readable', locator });
             if (result.kind === 'scoped-refusal') {
                 const room = replicas.get(result.locator)?.confirmed.record;
                 if (room !== undefined)
@@ -868,17 +1260,111 @@ export function composeRuntime(options) {
             }
             if (result.kind === 'revoked-authorization')
                 await refuse('revoked-authorization');
-            return result;
+            return historyAnswer(result);
         }
         catch {
             journal.record('outcome history transport-uncertainty');
-            return { kind: 'transport-uncertainty' };
+            return UNCERTAIN;
         }
     }
-    function declaredCards() {
+    function queuedBlob(locator, path, localId) {
+        for (const batch of replicas.get(locator)?.queue ?? []) {
+            const change = batch.changes[queuedFile(batch, path, localId)];
+            if (change?.kind === 'binary')
+                return change.blob;
+        }
+        return null;
+    }
+    function binaryRoom(request) {
+        if (request.kind === 'path')
+            return request.locator;
+        const scope = options.adapter.referrerScope(request.referrer);
+        return scope?.kind === 'room' ? scope.locator : null;
+    }
+    async function readBinary(request) {
+        if (closed || refusal !== null)
+            return UNCERTAIN;
+        try {
+            await ensureAuthorization();
+        }
+        catch {
+            return UNCERTAIN;
+        }
+        if (closed || authorization === undefined || refusal !== null)
+            return UNCERTAIN;
+        const since = fencings;
+        journal.record(request.kind === 'path'
+            ? `transfer binary ${request.locator} ${request.path}`
+            : `transfer binary ${request.fileRef}`);
+        try {
+            const result = await options.adapter.binary(authorization, request);
+            journal.record(`outcome binary ${result.kind}`);
+            const locator = binaryRoom(request);
+            if (locator !== null && fencedSince(locator, since))
+                return failure({ kind: 'room-not-readable', locator });
+            if (result.kind === 'scoped-refusal') {
+                const room = replicas.get(result.locator)?.confirmed.record;
+                if (room !== undefined)
+                    await scoped(result, room, await openLocal());
+            }
+            if (result.kind === 'revoked-authorization')
+                await refuse('revoked-authorization');
+            return binaryAnswer(result);
+        }
+        catch {
+            journal.record('outcome binary transport-uncertainty');
+            return UNCERTAIN;
+        }
+    }
+    async function readBinaryPath(locator, path, revision) {
+        await ready;
+        if (revision !== undefined)
+            return readBinary({ kind: 'path', locator, path, revision });
+        const visible = replicas.get(locator)?.visible;
+        const held = visible?.binaries[path];
+        if (visible === undefined || held === undefined)
+            return absentBinary(path);
+        if (held.state === 'pending') {
+            const blob = queuedBlob(locator, path, held.localId);
+            return blob === null ? absentBinary(path) : { kind: 'binary', blob };
+        }
+        const record = binaryRecord(path, held, visible.revisions[path]);
+        if (record.state !== 'accepted')
+            return absentBinary(path);
+        const replica = replicas.get(locator);
+        const queued = (replica?.queue ?? []).flatMap((batch) => batch.changes);
+        const holds = (at) => {
+            const kept = replica?.confirmed.record.binaries[at];
+            return (kept?.state === 'accepted' &&
+                kept.fileRef === record.fileRef &&
+                replica?.confirmed.record.revisions[at] === record.revision);
+        };
+        let confirmed = path;
+        for (let index = queued.length - 1; index >= 0 && !holds(confirmed); index -= 1) {
+            const change = queued[index];
+            if (change.kind === 'move' && change.to === confirmed)
+                confirmed = change.path;
+        }
+        return readBinary({
+            kind: 'path',
+            locator,
+            path: confirmed,
+            revision: record.revision,
+            fileRef: record.fileRef,
+        });
+    }
+    async function readBinaryReference(reference) {
+        await ready;
+        return readBinary({
+            kind: 'reference',
+            fileRef: reference.fileRef,
+            referrer: reference.referrer,
+        });
+    }
+    function declaredAgents() {
         for (const capability of capabilities) {
-            if (capability.conversationCards !== undefined)
-                return capability.conversationCards;
+            if (capability.conversationAgents !== undefined)
+                return capability.conversationAgents;
         }
         return undefined;
     }
@@ -894,23 +1380,20 @@ export function composeRuntime(options) {
     async function invokeAction(name, input) {
         await ready;
         if (closed || refusal !== null)
-            return { kind: 'transport-uncertainty' };
+            return UNCERTAIN;
         if (declaredAction(name) === undefined)
-            return { kind: 'undeclared' };
+            return undeclared(name);
         try {
             await ensureAuthorization();
         }
         catch {
-            return { kind: 'transport-uncertainty' };
-        }
-        if (closed || authorization === undefined || refusal !== null) {
-            return { kind: 'transport-uncertainty' };
+            return UNCERTAIN;
         }
+        if (closed || authorization === undefined || refusal !== null)
+            return UNCERTAIN;
         journal.record(`transfer action ${name}`);
         try {
             const result = await options.adapter.action(authorization, { name, input });
-            if (result.kind === 'action' && result.at !== undefined)
-                want(result.at);
             if (result.kind === 'scoped-refusal') {
                 const room = replicas.get(result.locator)?.confirmed.record;
                 if (room !== undefined)
@@ -921,11 +1404,11 @@ export function composeRuntime(options) {
             journal.record(`outcome action ${result.kind}`);
             if (result.kind === 'rejected')
                 journal.record(`refusal rejected ${result.code}`);
-            return result;
+            return calledResult(result);
         }
         catch {
             journal.record('outcome action transport-uncertainty');
-            return { kind: 'transport-uncertainty' };
+            return UNCERTAIN;
         }
     }
     function continuing() {
@@ -942,32 +1425,11 @@ export function composeRuntime(options) {
             options.adapter.reached(locator, written, roomVersion) &&
             !options.adapter.reached(locator, roomVersion, written));
     }
-    function want({ locator, roomVersion }) {
-        if (reachedBy(locator, roomVersion))
-            return;
-        const held = wanted.get(locator);
-        if (held === undefined || options.adapter.reached(locator, roomVersion, held)) {
-            wanted.set(locator, roomVersion);
-        }
-    }
-    function reachOf(locator) {
-        let target = wanted.get(locator);
-        const versions = (replicas.get(locator)?.queue ?? []).flatMap((batch) => {
-            const outcome = outcomes.get(batch.id);
-            return outcome?.kind === 'accepted' ? [outcome.roomVersion] : [];
-        });
-        for (const version of versions) {
-            if (target === undefined || options.adapter.reached(locator, version, target)) {
-                target = version;
-            }
-        }
-        return target === undefined || reachedBy(locator, target) ? undefined : target;
-    }
-    async function pullRefresh(authorized, confirmed, minPosition) {
-        if (!continuing())
+    async function pullRefresh(authorized, confirmed, live) {
+        if (!live())
             return unconfirmed;
         try {
-            const result = await refreshRoom(options.adapter, authorized, confirmed, continuing, minPosition);
+            const result = await refreshRoom(options.adapter, authorized, confirmed, (models, held) => (live() ? remodel(confirmed.record.locator, models, held) : held), live);
             const detail = result.kind === 'advanced' ? result.confirmed.record.roomVersion : result.kind;
             journal.record(`transfer refresh ${confirmed.record.locator} ${detail}`);
             return result;
@@ -977,55 +1439,121 @@ export function composeRuntime(options) {
             throw error;
         }
     }
-    async function pullBootstrap(authorized, room) {
-        if (!continuing())
+    function staging(local, live) {
+        return {
+            held: (locator) => transfers.get(locator) ?? null,
+            staged: (record) => local.staged(record),
+            stage: (record, page) => exclusive(async () => {
+                if (!live())
+                    return false;
+                await local.stage(record, page);
+                transfers.set(record.locator, record);
+                readSide.recover();
+                return true;
+            }),
+            abandon: (locator) => exclusive(async () => {
+                if (!live())
+                    return;
+                await local.abandon(locator);
+                transfers.delete(locator);
+                readSide.recover();
+            }),
+        };
+    }
+    function reusable(room) {
+        const record = replicas.get(room.locator)?.confirmed.record;
+        if (record === undefined || record.replica.selection !== room.replica.selection)
+            return null;
+        return { documents: record.documents, revisions: record.revisions };
+    }
+    async function pullBootstrap(authorized, room, local, live) {
+        if (!live())
             return unconfirmed;
+        if (replicas.has(room.locator)) {
+            catching.add(room.locator);
+            readSide.recover();
+        }
         try {
             const result = await bootstrapRoom(options.adapter, authorized, room, {
                 collection: modelOf(room.locator),
                 selection: modelOf(room.locator, 'typed-selection'),
-            }, continuing);
+            }, (models, held) => (live() ? remodel(room.locator, models, held) : held), live, staging(local, live), reusable(room));
             const detail = result.kind === 'staged' ? result.confirmed.record.roomVersion : result.kind;
             journal.record(`transfer bootstrap ${room.locator} ${detail}`);
+            if (result.kind !== 'staged')
+                caughtUpTo(room.locator);
             return result;
         }
         catch (error) {
             journal.record(`transfer bootstrap ${room.locator} transport-uncertainty`);
+            caughtUpTo(room.locator);
             throw error;
         }
     }
-    async function advance(room, local, authorized) {
+    function caughtUpTo(locator) {
+        if (catching.delete(locator))
+            readSide.recover();
+    }
+    async function advance(room, local, authorized, live) {
+        await referenced(room.locator);
+        if (!live())
+            return unconfirmed;
         const held = replicas.get(room.locator);
         if (held !== undefined) {
-            const refreshed = await pullRefresh(authorized, held.confirmed, reachOf(room.locator));
-            if (!continuing())
+            const refreshed = await pullRefresh(authorized, held.confirmed, live);
+            if (!live())
                 return unconfirmed;
             if (refreshed.kind === 'still-current') {
+                stale.delete(room.locator);
                 if (sourceRefusals.has(room.locator))
-                    return unconfirmed;
+                    return null;
                 if (unreadable.delete(room.locator)) {
+                    scopedRefusals.delete(room.locator);
                     list(room, true);
                     emitRooms();
                 }
                 return null;
             }
             if (refreshed.kind === 'advanced') {
-                await publish(local, room, refreshed.confirmed);
+                if (!(await publish(local, room, refreshed.confirmed, { base: held.confirmed }, live))) {
+                    const now = replicas.get(room.locator)?.confirmed.record.roomVersion;
+                    const reached = now !== undefined &&
+                        options.adapter.reached(room.locator, now, refreshed.confirmed.record.roomVersion);
+                    return reached ? null : advance(room, local, authorized, live);
+                }
+                await retainModel(local, room, 'collection', modelOf(room.locator));
                 return null;
             }
             if (refreshed.kind !== 'beyond-horizon')
                 return refreshed;
+            if (opened !== null) {
+                owed.add(room.locator);
+                readSide.recover();
+                return unconfirmed;
+            }
         }
-        const bootstrapped = await pullBootstrap(authorized, room);
-        if (!continuing())
+        const bootstrapped = await pullBootstrap(authorized, room, local, live);
+        if (!live())
             return unconfirmed;
         if (bootstrapped.kind !== 'staged')
             return bootstrapped;
-        await publish(local, room, bootstrapped.confirmed);
+        await publish(local, room, bootstrapped.confirmed, { stored: bootstrapped.stored }, live);
         return null;
     }
     async function withhold(withheld, room, local, progress) {
-        progress.complete = false;
+        if (withheld.kind === 'unconfirmed')
+            return;
+        if (withheld.kind === 'refused')
+            stale.delete(room.locator);
+        else
+            stale.add(room.locator);
+        if (withheld.kind === 'transport-uncertainty' || withheld.kind === 'retryable-refusal') {
+            const reset = withheld.kind === 'retryable-refusal' ? withheld.reset : undefined;
+            repairable.set(room.locator, reset);
+            repairLater(room.locator, reset === undefined ? { again: true } : { at: Date.parse(reset) });
+        }
+        else
+            repairable.delete(room.locator);
         if (withheld.kind === 'scoped-refusal') {
             await scoped(withheld, room, local);
         }
@@ -1050,6 +1578,7 @@ export function composeRuntime(options) {
     function refusedSource(room, { refusal }) {
         sourceRefusals.set(room.locator, {
             code: refusal.rule,
+            retryable: false,
             fields: {
                 file: refusal.file,
                 ...(refusal.location === undefined ? {} : { location: refusal.location }),
@@ -1063,34 +1592,16 @@ export function composeRuntime(options) {
         journal.record(`source refused ${room.locator} ${refusal.rule} ${refusal.file}`);
     }
     function leaving(batch, result) {
-        if (result.kind === 'expired') {
-            return { batch, outcome: { kind: 'expired' }, returned: { kind: 'expired' } };
-        }
-        const refusal = { code: result.code, fields: result.fields };
-        if (result.kind === 'conflicted') {
-            return {
-                batch,
-                outcome: {
-                    kind: 'conflicted',
-                    ...(result.roomVersion === undefined ? {} : { roomVersion: result.roomVersion }),
-                    affected: result.affected,
-                    ...refusal,
-                },
-                returned: { kind: 'conflicted', ...refusal },
-            };
-        }
+        if (result.kind === 'expired')
+            return { batch, returned: returnedBy('expired') };
         return {
             batch,
-            outcome: { kind: 'rejected', affected: result.affected, ...refusal },
-            returned: { kind: 'rejected', ...refusal },
-        };
-    }
-    function acceptedOf(accepted) {
-        return {
-            kind: 'accepted',
-            roomVersion: accepted.roomVersion,
-            ...(accepted.author === undefined ? {} : { author: accepted.author }),
-            ...(accepted.time === undefined ? {} : { time: accepted.time }),
+            returned: {
+                kind: result.kind,
+                code: result.code,
+                fields: result.fields,
+                retryable: result.retryable,
+            },
         };
     }
     function logAccepted(locator, submitted, accepted) {
@@ -1098,84 +1609,56 @@ export function composeRuntime(options) {
             (accepted.author === undefined ? '' : ` author ${accepted.author}`) +
             (accepted.time === undefined ? '' : ` time ${accepted.time}`));
     }
-    async function recordAccepted(room, local, submitted, accepted) {
-        await exclusive(async () => {
-            if (!continuing())
-                return;
-            const current = replicas.get(room.locator);
-            if (current === undefined || !current.queue.some((batch) => batch.id === submitted.id)) {
-                return;
-            }
-            const outcome = acceptedOf(accepted);
-            await local.write({
-                next: current.confirmed.record,
-                previous: current.confirmed.record,
-                queue: current.queue,
-                previousQueue: current.queue,
-                outcomes: [{ id: submitted.id, outcome }],
-            });
-            outcomes.set(submitted.id, outcome);
-            outcomeRooms.set(submitted.id, room.locator);
-            logAccepted(room.locator, submitted, accepted);
-        });
-    }
-    async function commitAccept(room, local, submitted, accepted, base, overlay) {
+    async function adoptAccepted(room, local, submitted, accepted) {
+        await referenced(room.locator);
         if (!continuing())
             return unconfirmed;
         const current = replicas.get(room.locator);
         if (current === undefined || !current.queue.some((batch) => batch.id === submitted.id)) {
             return null;
         }
-        const remaining = current.queue.filter((batch) => batch.id !== submitted.id);
-        const retainedBase = readConfirmed({
-            ...base.record,
-            model: modelOf(room.locator),
-            selectionModel: modelOf(room.locator, 'typed-selection'),
-        }, base);
-        const applied = overlay && retainedBase.kind === 'staged'
-            ? applyReturned(retainedBase.confirmed, accepted.documents, accepted.revisions, accepted.removals, accepted.roomVersion)
-            : retainedBase;
-        if (applied.kind !== 'staged')
+        const held = current.confirmed.record.roomVersion;
+        logAccepted(room.locator, submitted, accepted);
+        const applied = options.adapter.reached(room.locator, held, accepted.roomVersion)
+            ? { kind: 'staged', confirmed: current.confirmed }
+            : applyReturned(current.confirmed, submitted, accepted, options.adapter.follows(room.locator, held, accepted.roomVersion)
+                ? accepted.roomVersion
+                : held, accepted.roomVersion);
+        if (applied.kind !== 'staged') {
+            const state = pendings.get(submitted.id);
+            await local.accept(room.locator, submitted.id, accepted.roomVersion);
+            if (state !== undefined && !fences.has(room.locator))
+                pendings.set(submitted.id, { ...state, accepted: accepted.roomVersion });
+            emitQueue(room.locator);
             return applied;
-        const set = await settle(local, room.locator, current, applied.confirmed, remaining, {
-            accepted: { id: submitted.id, outcome: acceptedOf(accepted) },
-            room: true,
-        });
+        }
+        const settled = await settle(local, room.locator, current, applied.confirmed, current.queue.filter((batch) => batch.id !== submitted.id), { room: true });
+        pendings.delete(submitted.id);
         unreadable.delete(room.locator);
         sourceRefusals.delete(room.locator);
         declarationRefusals.delete(room.locator);
+        const set = settled();
         list(room, true);
         publishChangeSet(set);
         moveTo({ ...status, ...attention() });
         return null;
     }
-    async function accepting(room, local, submitted, accepted, pulled, fresh) {
-        const roomVersion = pulled.record.roomVersion;
-        if (options.adapter.reached(room.locator, roomVersion, accepted.roomVersion)) {
-            return committed(room, local, submitted, accepted, pulled, roomVersion === accepted.roomVersion);
-        }
-        if (fresh && continuing())
-            await publish(local, room, pulled);
-        return false;
-    }
-    async function committed(room, local, submitted, accepted, base, overlay) {
-        const failed = await exclusive(() => commitAccept(room, local, submitted, accepted, base, overlay));
+    async function adopted(room, local, submitted, accepted) {
+        const failed = await exclusive(() => adoptAccepted(room, local, submitted, accepted));
         if (failed === null)
             return true;
         if (failed.kind === 'refused' && continuing())
             refusedSource(room, failed);
         return false;
     }
-    async function submitRoom(room, local, authorized, progress) {
-        while (continuing() && authorization !== undefined) {
+    async function submitRoom(room, local, authorized, progress, signal) {
+        while (continuing() && authorization !== undefined && !signal.aborted) {
             const replica = replicas.get(room.locator);
             const head = replica?.queue[0];
             if (replica === undefined || head === undefined)
-                return;
-            if (outcomes.get(head.id)?.kind === 'accepted') {
-                progress.complete = false;
-                return;
-            }
+                return 'done';
+            if (pendings.get(head.id)?.accepted !== undefined)
+                return 'done';
             const state = pendings.get(head.id);
             const { submission, lost: earlier } = state ?? {
                 submission: { state: 'waiting' },
@@ -1183,26 +1666,33 @@ export function composeRuntime(options) {
             };
             if (submission.state === 'reset' && Date.now() < Date.parse(submission.reset)) {
                 progress.complete = false;
-                return;
+                return { at: Date.parse(submission.reset) };
             }
             if (writesHeld()) {
                 progress.complete = false;
                 journal.record(`submission ${room.locator} ${head.id} held`);
-                return;
+                return 'done';
             }
             const lost = earlier || submission.state === 'submitted';
+            if (lost && pastHorizon(head.id)) {
+                await discardPending(room, local, signal);
+                return 'done';
+            }
             let result;
             journal.record(`submission ${room.locator} ${head.id}`);
             await exclusive(() => mark(local, room.locator, head.id, { state: 'submitted' }, lost));
-            if (discoveryPaused)
-                return;
-            if (writesHeld()) {
+            if (discoveryPaused || fences.has(room.locator))
+                return 'done';
+            if (signal.aborted || writesHeld()) {
                 await exclusive(() => mark(local, room.locator, head.id, submission, earlier));
+                if (signal.aborted)
+                    return 'done';
                 progress.complete = false;
                 journal.record(`submission ${room.locator} ${head.id} held`);
-                return;
+                return 'done';
             }
             const opensBefore = openSignals;
+            const answered = awaitingAnswer(room.locator);
             try {
                 result = await options.adapter.mutate(authorized, {
                     locator: room.locator,
@@ -1211,33 +1701,40 @@ export function composeRuntime(options) {
                 }, (upload) => exclusive(() => keepUpload(local, room.locator, head.id, upload)));
             }
             catch {
+                answered();
                 progress.complete = false;
                 if (continuing())
                     progress.reachable = false;
-                return;
+                return 'again';
+            }
+            if (signal.aborted) {
+                answered();
+                return 'done';
             }
+            if (result.kind !== 'accepted' || !continuing())
+                answered();
             if (!continuing())
-                return;
+                return 'done';
             if (result.kind === 'transport-uncertainty') {
                 progress.complete = false;
                 progress.reachable = false;
-                return;
+                return 'again';
             }
             if (result.kind === 'room-not-readable') {
                 progress.complete = false;
                 unreadable.add(room.locator);
                 list(room, false);
                 emitRooms();
-                return;
+                return 'done';
             }
             if (result.kind === 'revoked-authorization') {
                 await refuse('revoked-authorization');
-                return;
+                return 'done';
             }
             if (result.kind === 'scoped-refusal') {
                 await scoped(result, room, local);
                 progress.complete = false;
-                return;
+                return 'done';
             }
             if (result.kind === 'write-halted') {
                 journal.record(`outcome ${room.locator} ${head.id} write-halted`);
@@ -1246,16 +1743,24 @@ export function composeRuntime(options) {
                     continue;
                 haltedRefusal = true;
                 progress.complete = false;
-                return;
+                return 'done';
             }
             if (result.kind === 'conflicted' ||
                 result.kind === 'rejected' ||
                 result.kind === 'expired' ||
                 result.kind === 'retryable-refusal') {
+                if (result.kind === 'expired' && lost && result.restored !== true) {
+                    journal.record(`outcome ${room.locator} ${head.id} expired`);
+                    await discardPending(room, local, signal);
+                    return 'done';
+                }
                 if (result.kind === 'expired') {
-                    const withheld = await advance(room, local, authorized);
-                    if (withheld !== null)
-                        return withhold(withheld, room, local, progress);
+                    await exclusive(() => mark(local, room.locator, head.id, { state: 'waiting' }, false));
+                    const withheld = await advance(room, local, authorized, continuing);
+                    if (withheld !== null) {
+                        await withhold(withheld, room, local, progress);
+                        return 'done';
+                    }
                 }
                 journal.record(`outcome ${room.locator} ${head.id} ${result.kind}` +
                     (result.kind === 'conflicted' && result.roomVersion !== undefined
@@ -1268,7 +1773,7 @@ export function composeRuntime(options) {
                 const reset = result.reset;
                 progress.complete = false;
                 await exclusive(() => mark(local, room.locator, head.id, reset === undefined ? { state: 'waiting' } : { state: 'reset', reset }, lost));
-                return;
+                return reset === undefined ? 'again' : { at: Date.parse(reset) };
             }
             if (result.kind === 'conflicted' || result.kind === 'rejected' || result.kind === 'expired') {
                 const left = leaving(head, result);
@@ -1279,113 +1784,96 @@ export function composeRuntime(options) {
                     if (current === undefined || !current.queue.some((batch) => batch.id === head.id)) {
                         return;
                     }
-                    const set = await settle(local, room.locator, current, current.confirmed, current.queue.filter((batch) => batch.id !== head.id), {
-                        leaving: result.kind === 'expired' && landed(head, current.confirmed)
+                    const settled = await settle(local, room.locator, current, current.confirmed, current.queue.filter((batch) => batch.id !== head.id), {
+                        leaving: (result.kind === 'expired' && landed(head, current.confirmed)) ||
+                            (result.kind === 'conflicted' && landed(head, current.confirmed, result.affected))
                             ? { ...left, returned: null }
                             : left,
                     });
-                    publishChangeSet(set);
+                    publishChangeSet(settled());
                     moveTo({ ...status, ...attention() });
                 });
                 if (result.kind === 'expired')
                     continue;
-                const withheld = await advance(room, local, authorized);
-                if (withheld !== null)
-                    return withhold(withheld, room, local, progress);
-                continue;
-            }
-            await recordAccepted(room, local, head, result);
-            const from = replicas.get(room.locator)?.confirmed;
-            if (from === undefined)
-                return;
-            const pulled = await pullRefresh(authorized, from, reachOf(room.locator));
-            if (!continuing())
-                return;
-            if (pulled.kind === 'revoked-authorization') {
-                await refuse('revoked-authorization');
-                return;
-            }
-            if (pulled.kind === 'scoped-refusal') {
-                await scoped(pulled, room, local);
-                progress.complete = false;
-                return;
-            }
-            if (pulled.kind === 'still-current' || pulled.kind === 'advanced') {
-                const fresh = pulled.kind === 'advanced';
-                if (!(await accepting(room, local, head, result, fresh ? pulled.confirmed : from, fresh))) {
-                    progress.complete = false;
-                    return;
+                const withheld = await advance(room, local, authorized, continuing);
+                if (withheld !== null) {
+                    await withhold(withheld, room, local, progress);
+                    return 'done';
                 }
                 continue;
             }
-            if (pulled.kind === 'beyond-horizon') {
-                const bootstrapped = await pullBootstrap(authorized, room);
-                if (!continuing())
-                    return;
-                if (bootstrapped.kind === 'revoked-authorization') {
-                    await refuse('revoked-authorization');
-                    return;
-                }
-                if (bootstrapped.kind === 'scoped-refusal') {
-                    await scoped(bootstrapped, room, local);
-                    progress.complete = false;
-                    return;
-                }
-                if (bootstrapped.kind === 'staged') {
-                    if (!(await accepting(room, local, head, result, bootstrapped.confirmed, true))) {
-                        progress.complete = false;
-                        return;
-                    }
-                    continue;
-                }
+            const kept = await adopted(room, local, head, result).finally(answered);
+            if (!kept) {
                 progress.complete = false;
-                if (bootstrapped.kind === 'transport-uncertainty') {
-                    progress.reachable = false;
-                }
-                else if (bootstrapped.kind === 'room-not-readable') {
-                    unreadable.add(room.locator);
-                    list(room, false);
-                    emitRooms();
-                }
-                else if (bootstrapped.kind === 'refused') {
-                    refusedSource(room, bootstrapped);
-                }
-                return;
-            }
-            progress.complete = false;
-            if (pulled.kind === 'transport-uncertainty') {
-                progress.reachable = false;
+                return 'done';
             }
-            else if (pulled.kind === 'room-not-readable') {
-                unreadable.add(room.locator);
-                list(room, false);
-                emitRooms();
-            }
-            else if (pulled.kind === 'retryable-refusal') {
-                journal.record(`refusal ${pulled.kind} ${pulled.code}`);
+        }
+        return 'done';
+    }
+    function pastHorizon(identity) {
+        return (outcomeRetention !== null && identityTime(identity) + outcomeRetention * 1000 <= Date.now());
+    }
+    async function discardPending(room, local, signal) {
+        const { locator } = room;
+        const discarded = await exclusive(async () => {
+            if (fences.has(locator))
+                return false;
+            const before = replicas.get(locator);
+            const queue = before?.queue ?? queuesWithoutReplica.get(locator) ?? [];
+            fences.set(locator, { at: discoveries, erased: false });
+            lastFenced.set(locator, ++fencings);
+            try {
+                await local.discard(locator);
             }
-            else if (pulled.kind === 'refused') {
-                refusedSource(room, pulled);
+            finally {
+                fences.delete(locator);
             }
+            for (const batch of queue)
+                pendings.delete(batch.id);
+            queuesWithoutReplica.delete(locator);
+            const after = before === undefined ? null : replicaOf(before.confirmed, [], before);
+            if (after !== null)
+                replicas.set(locator, after);
+            journal.record(`room discarded ${locator}`);
+            publishChangeSet(changeSet(locator, before ?? null, after, { queue: true }));
+            moveTo({ ...status, ...attention() });
+            return true;
+        });
+        if (!discarded)
             return;
-        }
-        return;
+        const progress = { complete: true, reachable: true };
+        await roomTask(locator, async (live) => {
+            await Promise.race([
+                reload(room, local, progress, () => live() && !signal.aborted),
+                abandonedOn(signal),
+            ]);
+        });
+        if (signal.aborted)
+            return;
+        await rest(progress);
+    }
+    function awaitingAnswer(locator) {
+        let release = () => { };
+        const awaited = new Promise((resolve) => {
+            release = resolve;
+        });
+        answering.set(locator, { generation, answered: awaited });
+        return () => {
+            if (answering.get(locator)?.answered === awaited)
+                answering.delete(locator);
+            release();
+        };
     }
     async function retainModel(local, room, attached, next) {
         const key = modelKey(room.locator, attached);
-        if (next.status === 'unavailable')
-            modelEpoch.set(key, (modelEpoch.get(key) ?? 0) + 1);
-        const epoch = modelEpoch.get(key) ?? 0;
         const previous = modelOf(room.locator, attached);
         const heldBefore = replicas.get(room.locator)?.confirmed.record;
         if (JSON.stringify(previous) === JSON.stringify(next) &&
             (heldBefore === undefined ||
                 (JSON.stringify(heldBefore.operations) === JSON.stringify(room.operations) &&
                     JSON.stringify(heldBefore.replica) === JSON.stringify(room.replica) &&
-                    JSON.stringify(heldBefore.attachedModel) === JSON.stringify(room.attachedModel) &&
                     JSON.stringify(heldBefore.typedSelection) ===
-                        JSON.stringify(room.typedSelection ?? null) &&
-                    JSON.stringify(heldBefore.untypedFolders) === JSON.stringify(room.untypedFolders ?? []))))
+                        JSON.stringify(room.typedSelection ?? null))))
             return;
         if (next.status === 'unavailable') {
             invalidModels.add(key);
@@ -1394,37 +1882,30 @@ export function composeRuntime(options) {
         await exclusive(async () => {
             if (!continuing())
                 return;
-            if (next.status !== 'unavailable' && epoch !== (modelEpoch.get(key) ?? 0))
-                return;
             const held = replicas.get(room.locator);
             if (held !== undefined) {
                 const declared = {
                     ...held.confirmed.record,
                     operations: room.operations,
                     replica: room.replica,
-                    attachedModel: room.attachedModel,
                     typedSelection: room.typedSelection ?? null,
-                    untypedFolders: room.untypedFolders ?? [],
                     ...(attached === 'collection' ? { model: next } : { selectionModel: next }),
                 };
                 const reclassified = sameMembership(declared, held.confirmed.record)
-                    ? readConfirmed(declared, held.confirmed)
+                    ? { kind: 'staged', confirmed: confirmedOf(declared, held.confirmed) }
                     : readReclassified(declared, held.confirmed);
                 const record = reclassified.kind === 'staged'
                     ? declared
                     : {
                         ...declared,
                         typedSelection: held.confirmed.record.typedSelection,
-                        untypedFolders: held.confirmed.record.untypedFolders,
                     };
-                const read = reclassified.kind === 'deferred' ? readConfirmed(record, held.confirmed) : reclassified;
-                await local.write({
-                    next: record,
-                    previous: held.confirmed.record,
-                    queue: held.queue,
-                });
+                const read = reclassified.kind === 'deferred'
+                    ? { kind: 'staged', confirmed: confirmedOf(record, held.confirmed) }
+                    : reclassified;
+                await local.write({ next: record, previous: held.confirmed.record });
                 if (read.kind === 'staged') {
-                    replicas.set(room.locator, replicaOf(read.confirmed, held.queue, rewriting(), held));
+                    replicas.set(room.locator, replicaOf(read.confirmed, held.queue, held));
                     if (declarationRefusals.delete(room.locator)) {
                         sourceRefusals.delete(room.locator);
                         unreadable.delete(room.locator);
@@ -1448,79 +1929,12 @@ export function composeRuntime(options) {
                 publishChangeSet(changeSet(room.locator, held, replicas.get(room.locator) ?? null, { room: true }));
         });
     }
-    async function acquireModel(local, room, authorized, selection) {
-        const attached = selection === null ? 'collection' : 'typed-selection';
-        const key = modelKey(room.locator, attached);
-        const declared = selection === null ? room.attachedModel : selection.attachedModel;
-        let previous = modelOf(room.locator, attached);
-        if (previous.status !== 'unavailable' &&
-            (declared === null || !sameModel(previous.snapshot, declared))) {
-            previous = { status: 'unavailable', reason: 'version-changed' };
-            await retainModel(local, room, attached, previous);
-            if (discoveryPaused)
-                return;
-        }
-        const epoch = modelEpoch.get(key) ?? 0;
-        let answer;
-        try {
-            answer = await options.adapter.model(authorized, selection === null
-                ? { locator: room.locator, attached: 'collection', model: declared }
-                : {
-                    locator: room.locator,
-                    attached: 'typed-selection',
-                    roots: selection.roots,
-                    model: declared,
-                });
-        }
-        catch {
-            answer = { kind: 'transport-uncertainty' };
-        }
-        if (discoveryPaused || epoch !== (modelEpoch.get(key) ?? 0))
-            return;
-        if (answer.kind === 'revoked-authorization') {
-            await refuse('revoked-authorization');
-            return;
-        }
-        if (answer.kind === 'transport-uncertainty') {
-            await retainModel(local, room, attached, cached(previous));
-            return;
-        }
-        if (answer.kind === 'model-unavailable') {
-            await retainModel(local, room, attached, {
-                status: 'unavailable',
-                reason: answer.reason,
-            });
-            return;
-        }
-        if (declared === null || !sameModel(answer.snapshot, declared)) {
-            await retainModel(local, room, attached, {
-                status: 'unavailable',
-                reason: 'version-changed',
-            });
-            return;
-        }
-        if (previous.status !== 'unavailable' &&
-            sameModel(previous.snapshot, answer.snapshot) &&
-            previous.snapshot.schema !== answer.snapshot.schema) {
-            await retainModel(local, room, attached, { status: 'unavailable', reason: 'invalid' });
-            return;
-        }
-        const verified = answer.snapshot.schema === null ? EMPTY_SCHEMA : verify(answer.snapshot.schema);
-        if (verified.verdict === 'refuse') {
-            const where = verified.location === undefined ? '' : ` ${verified.location}`;
-            journal.record(`model invalid ${room.locator} ${attached} ${answer.snapshot.identity} ${verified.rule}${where}`);
-        }
-        await retainModel(local, room, attached, verified.verdict === 'accept'
-            ? {
-                status: 'current',
-                snapshot: structuredClone(answer.snapshot),
-                verifiedWith: MD_MODEL,
-                types: verified.model.types,
-            }
-            : { status: 'unavailable', reason: 'invalid' });
-    }
     async function scoped(result, room, local) {
-        scopedRefusals.set(room.locator, { code: result.code, fields: result.fields });
+        scopedRefusals.set(room.locator, {
+            code: result.code,
+            fields: result.fields,
+            retryable: result.retryable,
+        });
         let scopedAway = room;
         if (result.scope === 'model')
             await retainModel(local, room, 'collection', {
@@ -1546,14 +1960,38 @@ export function composeRuntime(options) {
         emitRooms();
         journal.record(`scoped refusal ${room.locator} ${result.scope} ${result.code}`);
     }
-    async function synchronize(discovered, local, progress) {
-        const prepared = await Promise.allSettled(discovered.map((room) => prepareRoom(room, local, progress)));
-        const ready = discovered.filter((_, index) => {
+    function heldRooms(listed) {
+        return listed.flatMap((room) => {
+            const record = replicas.get(room.locator)?.confirmed.record;
+            if (record === undefined || record.replica.selection !== room.replica.selection)
+                return [];
+            return [
+                {
+                    locator: room.locator,
+                    roomVersion: record.roomVersion,
+                    documents: record.documents,
+                    revisions: record.revisions,
+                },
+            ];
+        });
+    }
+    async function synchronize(listed, local, progress, attempt, live) {
+        const prepared = await Promise.allSettled(listed.map((room) => prepareRoom(room, local, progress)));
+        if (!live())
+            return;
+        const ready = listed.filter((_, index) => {
             const outcome = prepared[index];
             return outcome?.status === 'fulfilled' && outcome.value;
         });
-        const rooms = await Promise.allSettled(ready.map((room) => synchronizeRoom(room, local, progress)));
-        const failed = [...prepared, ...rooms].find((room) => room.status === 'rejected');
+        if (attempt === 'opened') {
+            options.adapter.roomStream?.hold(heldRooms(ready));
+            handed = true;
+        }
+        discovering?.release();
+        const loaded = await Promise.allSettled(ready
+            .filter((room) => attempt === 'unstreamed' || !replicas.has(room.locator))
+            .map((room) => roomTask(room.locator, (held) => loadRoom(room, local, progress, held))));
+        const failed = [...prepared, ...loaded].find((room) => room.status === 'rejected');
         if (failed !== undefined)
             throw failed.reason;
     }
@@ -1570,11 +2008,8 @@ export function composeRuntime(options) {
             progress.complete = false;
             return false;
         }
-        const selection = room.typedSelection;
-        await Promise.all([
-            acquireModel(local, room, authorization, null),
-            ...(selection === undefined ? [] : [acquireModel(local, room, authorization, selection)]),
-        ]);
+        if (prior !== undefined)
+            await retainModel(local, room, 'collection', modelOf(room.locator));
         if (discoveryPaused || authorization === undefined)
             return false;
         if (room.replica.admission !== 'admitted') {
@@ -1582,29 +2017,65 @@ export function composeRuntime(options) {
                 progress.complete = false;
             return false;
         }
-        const held = replicas.get(room.locator);
-        if (held !== undefined && held.confirmed.record.replica.selection !== room.replica.selection) {
-            progress.complete = false;
-            return false;
-        }
         return true;
     }
-    async function synchronizeRoom(room, local, progress) {
-        if (discoveryPaused || authorization === undefined)
+    async function caughtUp(room, local, progress, live) {
+        const held = replicas.get(room.locator)?.confirmed.record.roomVersion;
+        if (held === undefined || authorization === undefined || !live())
+            return;
+        const behind = [announced.get(room.locator), room.roomVersion].some((later) => later !== undefined && !options.adapter.reached(room.locator, held, later));
+        if (!behind)
+            return;
+        const withheld = await advance(room, local, authorization, live);
+        if (withheld !== null)
+            await withhold(withheld, room, local, progress);
+    }
+    function revoked(locator) {
+        return ['collection', 'typed-selection'].some((attached) => {
+            const model = modelOf(locator, attached);
+            return model.status === 'unavailable' && model.reason === 'revoked';
+        });
+    }
+    async function loadRoom(room, local, progress, live) {
+        if (!live() || authorization === undefined)
+            return;
+        if (replicas.has(room.locator) && revoked(room.locator)) {
+            await reload(room, local, progress, live);
             return;
-        const withheld = await advance(room, local, authorization);
+        }
+        const withheld = await advance(room, local, authorization, live);
         if (withheld !== null) {
             await withhold(withheld, room, local, progress);
             return;
         }
-        await submitRoom(room, local, authorization, progress);
+        await caughtUp(room, local, progress, live);
+    }
+    async function reload(room, local, progress, live) {
+        try {
+            if (!live() || authorization === undefined)
+                return;
+            const bootstrapped = await pullBootstrap(authorization, room, local, live);
+            if (!live())
+                return;
+            if (bootstrapped.kind !== 'staged') {
+                await withhold(bootstrapped, room, local, progress);
+                return;
+            }
+            await publish(local, room, bootstrapped.confirmed, { stored: bootstrapped.stored }, live);
+            await caughtUp(room, local, progress, live);
+        }
+        finally {
+            caughtUpTo(room.locator);
+        }
     }
-    async function cycle(local, progress) {
+    async function discoverRooms(local, progress, attempt, live) {
         if (closed || authorization === undefined) {
             notifyReady();
             return;
         }
         moveTo(transferring(status));
+        discoveries += 1;
+        const started = discoveries;
         let result;
         try {
             result = await options.adapter.discover(authorization);
@@ -1612,7 +2083,8 @@ export function composeRuntime(options) {
         catch {
             result = { kind: 'transport-uncertainty' };
         }
-        if (closed) {
+        if (!live()) {
+            progress.complete = false;
             notifyReady();
             return;
         }
@@ -1625,12 +2097,17 @@ export function composeRuntime(options) {
                 }
             }
             progress.reachable = false;
+            progress.complete = false;
             notifyReady();
             return;
         }
         if (result.kind === 'contract-unavailable') {
             journal.record(`connection contract unavailable ${result.code}`);
-            await refuse('missing-required-guarantee', { code: result.code, fields: result.fields });
+            await refuse('missing-required-guarantee', {
+                code: result.code,
+                fields: result.fields,
+                retryable: result.retryable,
+            });
             notifyReady();
             return;
         }
@@ -1639,17 +2116,6 @@ export function composeRuntime(options) {
             notifyReady();
             return;
         }
-        if (!result.supportedVersions.includes(ROOM_CONTRACT_VERSION)) {
-            await refuse('no-matching-version');
-            notifyReady();
-            return;
-        }
-        if (result.mdModel.identity !== MD_MODEL.identity ||
-            result.mdModel.version !== MD_MODEL.version) {
-            await refuse('md-model-version-mismatch');
-            notifyReady();
-            return;
-        }
         for (const room of result.rooms) {
             if (room.operations === undefined ||
                 !['read', 'sync', 'write', 'delete'].every((operation) => Array.isArray(room.operations[operation]) &&
@@ -1657,8 +2123,7 @@ export function composeRuntime(options) {
                 room.replica === undefined ||
                 typeof room.replica.selection !== 'string' ||
                 room.replica.selection.length === 0 ||
-                !['admitted', 'unavailable'].includes(room.replica.admission) ||
-                !declaredIdentity(room.attachedModel)) {
+                !['admitted', 'unavailable'].includes(room.replica.admission)) {
                 journal.record(`invalid model or replica declaration ${room.locator}`);
                 await refuse('missing-required-guarantee');
                 notifyReady();
@@ -1670,20 +2135,6 @@ export function composeRuntime(options) {
                 notifyReady();
                 return;
             }
-            if (!declaredUntypedFolders(room)) {
-                journal.record(`invalid untyped folder declaration ${room.locator}`);
-                await refuse('missing-required-guarantee');
-                notifyReady();
-                return;
-            }
-        }
-        const declared = new Set(result.capabilities.map((capability) => capability.name));
-        for (const required of options.requiredGuarantees) {
-            if (!knownCapabilities.has(required) || !declared.has(required)) {
-                await refuse('missing-required-guarantee');
-                notifyReady();
-                return;
-            }
         }
         if (refusal !== null) {
             refusal = null;
@@ -1691,30 +2142,20 @@ export function composeRuntime(options) {
         }
         const previousCapabilities = capabilities;
         capabilities = result.capabilities;
+        outcomeRetention = result.retention.outcome;
         notifyReady();
-        if (declared.has('room-version-notifications'))
-            observeRoomVersions();
-        const discoveredSlots = result.slots ?? [];
         if (JSON.stringify(result.providerLimits) !== JSON.stringify(limits) ||
-            JSON.stringify(result.capabilities) !== JSON.stringify(previousCapabilities) ||
-            JSON.stringify(discoveredSlots) !== JSON.stringify(slots)) {
+            JSON.stringify(result.capabilities) !== JSON.stringify(previousCapabilities)) {
             limits = result.providerLimits;
-            slots = discoveredSlots;
-            await local.declare(limits, capabilities, slots);
-        }
-        await applyDiscovery(result.rooms, local);
-        handSelected(result.rooms
-            .filter((room) => room.replica.admission === 'admitted')
-            .map((room) => room.locator)
-            .sort());
-        progress.complete = true;
-        await synchronize(result.rooms, local, progress);
-        if (closed || discoveryPaused)
-            return;
-        await conversations.reconcile();
-        if (status.providerUnreachable)
-            conversations.reconnected();
-        await conversations.catchUp(progress);
+            await local.declare(limits, capabilities);
+        }
+        const signedIn = result.member ?? null;
+        if (JSON.stringify(signedIn) !== JSON.stringify(member)) {
+            await local.keepMember(signedIn);
+            member = signedIn;
+            emitMember();
+        }
+        await synchronize(await applyDiscovery(result.rooms, started), local, progress, attempt, live);
     }
     async function ensureAuthorization() {
         if (authorization !== undefined)
@@ -1728,66 +2169,413 @@ export function composeRuntime(options) {
             throw error;
         }
     }
-    async function connect() {
-        if (closed || stopping || discoveryPaused) {
-            notifyReady();
-            return;
+    async function admittedRead(work) {
+        if (roomReads.generation !== generation) {
+            roomReads = { generation, free: ROOM_READS, waiting: [] };
         }
-        startTimer();
-        const progress = { complete: false, reachable: true };
-        let completedAt = new Date().toISOString();
+        const reads = roomReads;
+        while (reads.free === 0)
+            await new Promise((admit) => reads.waiting.push(admit));
+        reads.free -= 1;
         try {
-            const local = await openLocal();
-            if (closed)
+            await work();
+        }
+        finally {
+            reads.free += 1;
+            reads.waiting.shift()?.();
+        }
+    }
+    function roomTask(locator, work) {
+        return task(roomLane(locator), (live) => admittedRead(() => work(live)));
+    }
+    function task(lane, work) {
+        if (stopping)
+            return Promise.resolve();
+        const held = lanes.get(lane);
+        const current = held?.generation === generation ? held : { generation, chain: Promise.resolve() };
+        const turn = current.generation;
+        const live = () => turn === generation && continuing();
+        const run = current.chain.then(() => work(live)).catch(() => undefined);
+        current.chain = run;
+        lanes.set(lane, current);
+        working.add(run);
+        void run.finally(() => working.delete(run));
+        return run;
+    }
+    function sync(attempt) {
+        return task(OPENING_LANE, async (live) => {
+            if (!live()) {
+                notifyReady();
                 return;
-            await ensureAuthorization();
-            if (closed)
+            }
+            const progress = { complete: true, reachable: true };
+            const gate = discover();
+            if (attempt === 'opened')
+                opened = generation;
+            underway = attempt === 'opened' ? { generation, progress } : null;
+            if (attempt === 'opened')
+                streamed = progress;
+            complete = false;
+            recorded = false;
+            moveTo(transferring(status));
+            handed = false;
+            try {
+                const local = await openLocal();
+                if (!live())
+                    return;
+                await ensureAuthorization();
+                if (!live())
+                    return;
+                await discoverRooms(local, progress, attempt, live);
+            }
+            catch {
+                progress.complete = false;
+                if (attempt === 'opened' && !handed)
+                    progress.reachable = false;
+            }
+            finally {
+                gate.release();
+                notifyReady();
+            }
+            if (!live())
                 return;
-            await cycle(local, progress);
-            if (closed)
+            if (attempt !== 'opened') {
+                await finishOpening(progress, live);
                 return;
-            if (progress.complete) {
-                completedAt = new Date().toISOString();
-                await local.complete(completedAt);
             }
+            if (handed || closed || progress.reachable)
+                return;
+            underway = null;
+            opened = null;
+            journal.record('connection reopen');
+            await rest(progress, live);
+            options.adapter.roomStream?.reopen();
+        });
+    }
+    function closedSocket(revoked) {
+        const opened = socketOpen;
+        socketOpen = false;
+        if (revoked) {
+            void refuse('revoked-authorization');
+            return;
+        }
+        complete = false;
+        if (streamed !== null)
+            streamed.complete = false;
+        moveTo({
+            ...status,
+            state: status.state === 'synced' ? 'syncing' : status.state,
+            providerUnreachable: status.providerUnreachable || !opened,
+        });
+    }
+    function applyOpening(expired) {
+        const progress = underway?.generation === generation ? underway.progress : null;
+        const cycle = progress ?? { complete: true, reachable: true };
+        const replacing = reloadNow((room) => expired.includes(room.locator), cycle);
+        if (opened === generation)
+            opened = null;
+        return task(OPENING_LANE, async (live) => {
+            underway = null;
+            if (!live())
+                return;
+            if (progress === null) {
+                await replacing;
+                await rest(cycle, live);
+                return;
+            }
+            await roomsCarried(expired);
+            if (!live())
+                return;
+            const replaced = new Set(owed);
+            owed.clear();
+            try {
+                const local = await openLocal();
+                const held = [...discovered.values()].filter((room) => replicas.has(room.locator));
+                const reloading = held.filter((room) => !expired.includes(room.locator) &&
+                    (replaced.has(room.locator) || revoked(room.locator)));
+                for (const room of reloading)
+                    catching.add(room.locator);
+                readSide.recover();
+                const reloads = Promise.allSettled(reloading.map((room) => roomTask(room.locator, (current) => reload(room, local, progress, current))));
+                const reloaded = [...(await reloads), ...(await replacing)];
+                if (progress.reachable) {
+                    for (const room of held) {
+                        if (!expired.includes(room.locator) && !reloading.includes(room)) {
+                            await confirmModels(room, local);
+                        }
+                    }
+                }
+                const failed = reloaded.find((outcome) => outcome.status === 'rejected');
+                if (failed !== undefined)
+                    throw failed.reason;
+            }
+            catch {
+                progress.complete = false;
+                progress.reachable = false;
+            }
+            if (live())
+                await finishOpening(progress, live);
+        });
+    }
+    async function reloadNow(replaced, progress) {
+        try {
+            const local = await openLocal();
+            return await Promise.allSettled([...discovered.values()]
+                .filter((room) => replicas.has(room.locator) && replaced(room))
+                .map((room) => roomTask(room.locator, (live) => reload(room, local, progress, live))));
         }
         catch {
-            progress.complete = false;
-            notifyReady();
+            progress.reachable = false;
+            return [];
+        }
+    }
+    async function confirmModels(room, local) {
+        for (const attached of ['collection', 'typed-selection']) {
+            const model = modelOf(room.locator, attached);
+            if (model.status === 'cached') {
+                await retainModel(local, room, attached, { ...model, status: 'current' });
+            }
+        }
+    }
+    function submitLater(locator) {
+        if (localSaves)
             return;
+        void recovery.attempt(`submit ${locator}`, (signal) => submitPass(locator, signal));
+    }
+    async function submitPass(locator, signal) {
+        const room = discovered.get(locator);
+        if (closed || stopping || discoveryPaused || room === undefined)
+            return 'done';
+        const progress = { complete: true, reachable: true };
+        let next;
+        try {
+            await ensureAuthorization();
+            if (authorization === undefined)
+                return 'done';
+            next = await submitRoom(room, await openLocal(), authorization, progress, signal);
+        }
+        catch {
+            progress.reachable = false;
+            next = 'again';
+        }
+        if (signal.aborted)
+            return 'done';
+        await rest(progress);
+        return next === 'again' && !socketOpen ? 'done' : next;
+    }
+    function repairLater(locator, when) {
+        if (!socketOpen || repairing.has(locator))
+            return;
+        void recovery.attempt(`repair ${locator}`, (signal) => repairPass(locator, signal), when);
+    }
+    async function repairPass(locator, signal) {
+        const room = discovered.get(locator);
+        if (!socketOpen || closed || stopping || discoveryPaused || !stale.has(locator))
+            return 'done';
+        if (room === undefined || room.replica.admission !== 'admitted')
+            return 'done';
+        const progress = { complete: true, reachable: true };
+        repairing.add(locator);
+        try {
+            const local = await openLocal();
+            await roomTask(locator, async (live) => {
+                const current = () => live() && !signal.aborted;
+                if (!current() || authorization === undefined)
+                    return;
+                const withheld = await Promise.race([
+                    advance(room, local, authorization, current),
+                    abandonedOn(signal),
+                ]);
+                if (withheld !== null && current())
+                    await withhold(withheld, room, local, progress);
+            });
+        }
+        catch {
+            stale.add(locator);
+            progress.reachable = false;
         }
         finally {
-            notifyReady();
-            moveTo(settled(status, progress, completedAt, pending(), attention()));
+            repairing.delete(locator);
+        }
+        if (signal.aborted)
+            return 'done';
+        await rest(progress);
+        if (!stale.has(locator)) {
+            if ((replicas.get(locator)?.queue.length ?? 0) > 0)
+                submitLater(locator);
+            return 'done';
+        }
+        if (!repairable.has(locator))
+            return 'done';
+        const reset = repairable.get(locator);
+        return reset === undefined ? 'again' : { at: Date.parse(reset) };
+    }
+    function resendLater() {
+        if (!socketOpen)
+            return;
+        void recovery.attempt('resend', resendPass, { again: true });
+    }
+    async function resendPass(signal) {
+        if (!socketOpen || closed || stopping || discoveryPaused)
+            return 'done';
+        const reading = { complete: true, reachable: true };
+        try {
+            await conversations.resend(reading);
+        }
+        catch {
+            reading.reachable = false;
+        }
+        if (signal.aborted)
+            return 'done';
+        return reading.reachable && reading.complete ? 'done' : 'again';
+    }
+    function submitAll() {
+        for (const [locator, replica] of replicas) {
+            if (replica.queue.length > 0)
+                submitLater(locator);
         }
     }
-    async function run() {
+    async function finishOpening(progress, live) {
         try {
-            await connect();
+            if (!live()) {
+                progress.complete = false;
+                return;
+            }
+            submitAll();
+            for (const locator of stale)
+                if (repairable.has(locator))
+                    repairLater(locator, {});
+            await conversations.reconcile();
+            if (status.providerUnreachable)
+                conversations.reconnected();
+            const reading = { complete: true, reachable: true };
+            await conversations.catchUp(reading);
+            if (progress.reachable && reading.reachable)
+                await conversations.resend(reading);
+            if (!reading.reachable) {
+                progress.reachable = false;
+                resendLater();
+            }
+        }
+        catch {
+            progress.complete = false;
         }
         finally {
-            inflight = false;
-            if (queued && !closed) {
-                queued = false;
-                void enqueue();
+            if (live()) {
+                complete = progress.complete;
+                await rest(progress, live);
             }
         }
     }
-    function observeRoomVersions() {
-        const path = options.adapter.roomVersions;
-        if (path === undefined || withdrawNotifications !== undefined)
+    async function rest(progress, live = () => !closed) {
+        if (!live())
             return;
-        withdrawNotifications = path.observe((notification) => {
-            if (closed || stopping || discoveryPaused)
+        let lastCompleted = status.lastCompleted;
+        let synced = complete && stale.size === 0 && !pending();
+        if (synced && !recorded) {
+            const completedAt = new Date().toISOString();
+            try {
+                await (await openLocal()).complete(completedAt);
+                if (!live())
+                    return;
+                recorded = true;
+                lastCompleted = completedAt;
+            }
+            catch {
+                synced = false;
+            }
+        }
+        moveTo({
+            state: pending() ? 'pending' : synced && complete ? 'synced' : 'syncing',
+            lastCompleted,
+            providerUnreachable: !progress.reachable,
+            ...attention(),
+        });
+    }
+    function discover() {
+        let release = () => { };
+        const done = new Promise((resolve) => {
+            release = resolve;
+        });
+        discovering = { generation, done, release };
+        return discovering;
+    }
+    function applyRoom(locator, roomVersion) {
+        announced.set(locator, roomVersion);
+        return task(roomLane(locator), async (live) => {
+            if (discovering?.generation === generation)
+                await discovering.done;
+            const saving = answering.get(locator);
+            if (saving?.generation === generation)
+                await saving.answered;
+            if (!live() || authorization === undefined)
                 return;
-            if (notification.modelChanged === true && handed?.includes(notification.locator) === true) {
-                void enqueue();
+            const room = discovered.get(locator);
+            const held = replicas.get(locator);
+            if (room === undefined || room.replica.admission !== 'admitted')
+                return;
+            if (held !== undefined &&
+                (held.confirmed.record.replica.selection !== room.replica.selection ||
+                    options.adapter.reached(locator, held.confirmed.record.roomVersion, roomVersion))) {
                 return;
             }
-            notices.set(notification.locator, notification.roomVersion);
-            chain = chain.then(runNotified, runNotified);
+            const during = underway?.generation === generation ? underway.progress : null;
+            const progress = during ?? { complete: true, reachable: true };
+            if (during === null)
+                moveTo(transferring(status));
+            try {
+                const local = await openLocal();
+                await admittedRead(async () => {
+                    if (!live() || authorization === undefined)
+                        return;
+                    const withheld = await advance(room, local, authorization, live);
+                    if (withheld !== null)
+                        await withhold(withheld, room, local, progress);
+                });
+            }
+            catch {
+                stale.add(locator);
+            }
+            finally {
+                if (during === null)
+                    await rest(progress, live);
+            }
         });
     }
+    function roomsCarried(replacing) {
+        const replaced = new Set(replacing.map(roomLane));
+        return Promise.all([...lanes]
+            .filter(([lane, held]) => lane !== OPENING_LANE && !replaced.has(lane) && held.generation === generation)
+            .map(([, held]) => held.chain));
+    }
+    const receipts = {
+        heads: async () => (await openLocal()).receivedHeads(),
+        parts: async (key, count) => (await openLocal()).receivedParts(key, count),
+        keep: async (key, head, part) => (await openLocal()).keepReceived(key, head, part),
+        drop: async (keys) => (await openLocal()).dropReceived(keys),
+    };
+    function observeStream() {
+        const stream = options.adapter.roomStream;
+        if (stream === undefined || withdrawStream !== undefined)
+            return;
+        withdrawStream = stream.observe((event) => {
+            if (closed || stopping)
+                return;
+            if (event.kind === 'opened') {
+                socketOpen = true;
+                generation += 1;
+                conversations.reopened();
+                recovery.resume();
+                void sync('opened');
+            }
+            else if (event.kind === 'closed')
+                closedSocket(event.revoked);
+            else if (event.kind === 'opening')
+                void applyOpening(event.expired);
+            else
+                void applyRoom(event.locator, event.roomVersion);
+        }, receipts);
+    }
     function writesHeld() {
         return serviceMode === 'write-halted' || haltedRefusal;
     }
@@ -1806,14 +2594,17 @@ export function composeRuntime(options) {
                 listener(mode);
         }
         if (releasing)
-            void enqueue();
+            submitAll();
     }
     function observeConversations() {
         const stream = options.adapter.conversations;
         if (stream === undefined || withdrawConversations !== undefined)
             return;
         withdrawConversations = stream.observe((event) => {
-            conversations.receive(event);
+            if (conversations.receive(event)) {
+                void ready.then(scheduleCurrency);
+                return;
+            }
             if (event.kind !== 'gap' || conversations.current())
                 return;
             show();
@@ -1821,129 +2612,42 @@ export function composeRuntime(options) {
         });
     }
     function scheduleCurrency() {
-        if (currencyQueued || closed || stopping)
+        if (currencyQueued === generation || closed || stopping)
             return;
-        currencyQueued = true;
-        chain = chain.then(runCurrency, runCurrency);
+        currencyQueued = generation;
+        void task(CONVERSATION_LANE, runCurrency);
     }
-    async function runCurrency() {
-        currencyQueued = false;
-        if (closed || stopping || discoveryPaused)
+    async function runCurrency(live) {
+        if (currencyQueued === generation)
+            currencyQueued = null;
+        if (!live())
             return;
         await conversations.reconcile();
         if (conversations.current()) {
             show();
             return;
         }
-        const resting = status;
-        const progress = { complete: false, reachable: !resting.providerUnreachable };
-        moveTo(transferring(resting));
+        const progress = { complete: false, reachable: !status.providerUnreachable };
+        moveTo(transferring(status));
         try {
             await conversations.catchUp(progress);
         }
         catch {
             progress.reachable = false;
         }
-        finally {
-            if (!closed) {
-                moveTo(settled(resting, progress, resting.lastCompleted, pending(), attention()));
-            }
-        }
-    }
-    function handSelected(locators) {
-        const path = options.adapter.roomVersions;
-        if (path === undefined || withdrawNotifications === undefined)
-            return;
-        if (handed !== undefined && JSON.stringify(locators) === JSON.stringify(handed))
-            return;
-        handed = locators;
-        path.select(locators);
-    }
-    async function runNotified() {
-        const announced = [...notices];
-        notices.clear();
-        if (announced.length === 0 || closed || stopping || discoveryPaused)
-            return;
-        const resting = status;
-        const progress = { complete: false, reachable: !resting.providerUnreachable };
-        moveTo(transferring(resting));
-        try {
-            const local = await openLocal();
-            for (const [locator, roomVersion] of announced) {
-                if (closed || discoveryPaused || authorization === undefined)
-                    return;
-                if (handed?.includes(locator) !== true)
-                    continue;
-                const room = discovered.get(locator);
-                const held = replicas.get(locator);
-                if (room === undefined)
-                    continue;
-                if (sourceRefusals.has(locator)) {
-                    void enqueue();
-                    continue;
-                }
-                if (held === undefined)
-                    continue;
-                if (held.confirmed.record.roomVersion === roomVersion)
-                    continue;
-                const withheld = await advance(room, local, authorization);
-                if (withheld === null)
-                    continue;
-                if (withheld.kind === 'refused') {
-                    void enqueue();
-                    continue;
-                }
-                if (withheld.kind === 'scoped-refusal') {
-                    await scoped(withheld, room, local);
-                    continue;
-                }
-                if (withheld.kind === 'transport-uncertainty') {
-                    progress.reachable = false;
-                    continue;
-                }
-                if (withheld.kind === 'room-not-readable') {
-                    unreadable.add(locator);
-                    list(room, false);
-                    emitRooms();
-                    continue;
-                }
-                if (withheld.kind === 'revoked-authorization') {
-                    await refuse('revoked-authorization');
-                    return;
-                }
-            }
-        }
-        catch {
-            progress.reachable = false;
-        }
-        finally {
-            if (!closed) {
-                moveTo(settled(resting, progress, resting.lastCompleted, pending(), attention()));
-            }
-        }
-    }
-    function enqueue() {
-        if (stopping)
-            return chain;
-        if (inflight) {
-            queued = true;
-            return chain;
-        }
-        inflight = true;
-        chain = chain.then(run, run);
-        return chain;
+        await rest(progress, live);
     }
     function close() {
         if (closed)
             return;
         closed = true;
-        withdrawNotifications?.();
-        withdrawNotifications = undefined;
+        withdrawStream?.();
+        withdrawStream = undefined;
         withdrawConversations?.();
         withdrawConversations = undefined;
         withdrawServiceMode?.();
         conversations.close();
-        stopTimer();
+        void recovery.retire();
         store?.close();
         void opening?.then((opened) => {
             opened.close();
@@ -1953,6 +2657,7 @@ export function composeRuntime(options) {
         storageLossListeners.clear();
         statusListeners.clear();
         serviceModeListeners.clear();
+        memberListeners.clear();
         readSide.close();
         queueSubscriptions.clear();
         roomDraftListeners.clear();
@@ -1960,8 +2665,8 @@ export function composeRuntime(options) {
     }
     async function stop() {
         stopping = true;
-        stopTimer();
-        await chain.catch(() => undefined);
+        await recovery.retire();
+        await Promise.all(working);
         await mutations;
         close();
     }
@@ -1970,11 +2675,69 @@ export function composeRuntime(options) {
     options.signal?.addEventListener('abort', close, { once: true });
     if (options.signal?.aborted)
         close();
-    void openLocal().catch(() => {
+    observeStream();
+    void openLocal().then(() => {
+        if (capabilities.length > 0)
+            notifyReady();
+    }, () => {
         notifyReady();
     });
-    void enqueue();
-    function watch(topic, input, deliver) {
+    if (options.adapter.roomStream === undefined)
+        void sync('unstreamed');
+    function planned(input, reach) {
+        return planOf(input, roomFacts(reach), planReach(reach));
+    }
+    function watchPlan(plan, deliver) {
+        return readSide.watch(plan, identityOf(plan), () => {
+            const cover = covered(plan);
+            awaitPreparation(cover);
+            return cover;
+        }, deliver);
+    }
+    async function searched(input, reach) {
+        const plan = searchPlanOf(input);
+        const filter = filterOf(plan.documents ?? {}, roomFacts(reach), planReach(reach));
+        for (;;) {
+            const cover = covered(filter);
+            awaitPreparation(cover);
+            const pending = 'pending' in cover ? [...cover.pending] : [];
+            const covering = 'pending' in cover ? [] : cover.coverage.rooms;
+            const unindexed = covering
+                .filter(({ room }) => !searchIndex.rooms().has(room))
+                .map(({ room }) => room);
+            for (const room of unindexed)
+                pending.push({ room, awaits: 'index' });
+            const held = conversations.searchable();
+            const named = reach !== null && !reach.conversations
+                ? []
+                : (plan.conversations ?? held).filter((one) => held.includes(one) && conversations.acquired(one));
+            const waiting = named.filter((one) => !searchIndex.conversations().has(one));
+            for (const conversation of waiting)
+                pending.push({ conversation, awaits: 'index' });
+            if (unindexed.length > 0 || waiting.length > 0)
+                index(unindexed, waiting);
+            if (pending.length > 0 || 'pending' in cover)
+                return { pending };
+            const seen = searchIndex.changes();
+            await searchIndex.caughtUp();
+            const selected = plan.documents === undefined && reach === null ? null : await rowsQuery(filter);
+            if (selected !== null && 'pending' in selected)
+                return selected;
+            if (searchIndex.changes() !== seen ||
+                JSON.stringify(covered(filter)) !== JSON.stringify(cover))
+                continue;
+            return {
+                ...searchIndex.search(plan, selected === null ? null : selected.documents, named),
+                coverage: {
+                    rooms: covering,
+                    conversations: named,
+                    index: searchIndex.generation(),
+                    overlay: cover.coverage.overlay,
+                },
+            };
+        }
+    }
+    const watch = (topic, input, deliver) => {
         if (topic === 'room-drafts') {
             const listener = { notify: deliver, ready: false };
             roomDraftListeners.add(listener);
@@ -1995,6 +2758,10 @@ export function composeRuntime(options) {
         if (topic === 'conversation') {
             return conversations.watch(input[0], input[1], deliver);
         }
+        if (topic === 'conversations')
+            return conversations.watchList(deliver);
+        if (topic === 'agents')
+            return conversations.watchAgents(deliver);
         if (topic === 'presentation') {
             const listener = {
                 app: input[0],
@@ -2049,6 +2816,13 @@ export function composeRuntime(options) {
                 serviceModeListeners.delete(deliver);
             };
         }
+        if (topic === 'member') {
+            memberListeners.add(deliver);
+            deliver(member);
+            return () => {
+                memberListeners.delete(deliver);
+            };
+        }
         if (topic === 'queue') {
             const queue = { locator: input[0], notify: deliver };
             queueSubscriptions.add(queue);
@@ -2057,9 +2831,8 @@ export function composeRuntime(options) {
                 queueSubscriptions.delete(queue);
             };
         }
-        const plan = planOf(input[0], roomFacts());
-        return readSide.watch(plan, identityOf(plan), deliver);
-    }
+        return watchPlan(planned(input[0], null), deliver);
+    };
     const md = {
         loaded() {
             return openLocal().then(() => undefined);
@@ -2067,18 +2840,8 @@ export function composeRuntime(options) {
         rooms() {
             return listed();
         },
-        slots() {
-            return slotted();
-        },
-        query: ((input) => readSide.query(planOf(input, roomFacts()))),
-        async search(input) {
-            const plan = searchPlanOf(input);
-            const selected = plan.documents === undefined
-                ? null
-                : (await readSide.query(filterOf(plan.documents, roomFacts())))
-                    .documents;
-            return searchIndex.search(plan, selected);
-        },
+        query: ((input) => rowsQuery(planned(input, null))),
+        search: (input) => searched(input, null),
         types(locator) {
             return {
                 collection: modelTypes(modelOf(locator)),
@@ -2088,12 +2851,6 @@ export function composeRuntime(options) {
                     : modelTypes(modelOf(locator, 'typed-selection')),
             };
         },
-        syncStatus() {
-            return shown;
-        },
-        serviceMode() {
-            return serviceMode;
-        },
         roomDraft: {
             list() {
                 return exclusive(async () => {
@@ -2112,20 +2869,20 @@ export function composeRuntime(options) {
                 return exclusive(async () => {
                     const parts = readParts(input);
                     if (path === '' || normalize(path) !== path)
-                        throw new Error('room-draft-malformed');
+                        throw runtimeError('room-draft-malformed');
                     const local = await openLocal();
                     const current = roomDrafts.get(room)?.get(path);
                     if ((current?.revision ?? null) !== revision) {
-                        return {
-                            outcome: 'stale',
-                            current: current === undefined ? null : roomDraftOf(current),
-                        };
+                        return staleWrite(current === undefined ? null : roomDraftOf(current));
                     }
+                    const file = parts.file === undefined
+                        ? undefined
+                        : await heldFile(parts.file.blob, binaryBase(replicas.get(room)?.visible, path));
                     const record = {
                         locator: room,
                         path,
                         revision: roomDraftRevision(),
-                        parts: held(current?.parts, parts),
+                        parts: held(current?.parts, parts, file),
                         returned: current?.returned ?? null,
                     };
                     await local.keepRoomDraft(record);
@@ -2139,10 +2896,7 @@ export function composeRuntime(options) {
                     const local = await openLocal();
                     const current = roomDrafts.get(room)?.get(path);
                     if (current === undefined || current.revision !== revision) {
-                        return {
-                            outcome: 'stale',
-                            current: current === undefined ? null : roomDraftOf(current),
-                        };
+                        return staleWrite(current === undefined ? null : roomDraftOf(current));
                     }
                     await local.discardRoomDraft(room, path);
                     forgetRoomDraft(room, path);
@@ -2174,12 +2928,13 @@ export function composeRuntime(options) {
         save(room, named, writtenBy) {
             return exclusive(() => saveRoomDrafts(room, named, writtenBy));
         },
-        outcome(identifier) {
-            return outcomes.get(identifier) ?? null;
-        },
         history(locator, path, query) {
             return readHistory(locator, path, query);
         },
+        binaryFile: {
+            read: readBinaryPath,
+            readReference: readBinaryReference,
+        },
         call(name, input) {
             return invokeAction(name, input);
         },
@@ -2191,25 +2946,34 @@ export function composeRuntime(options) {
         log() {
             return journal.export();
         },
-        storageLoss() {
-            return storageLoss;
-        },
         persistence() {
             return options.shell.persistentStorage;
         },
-        observe: ((topic, ...input) => opened((deliver) => watch(topic, input, (message) => {
-            deliver(structuredClone(message));
-        }), topic === 'query')),
+        observe: observing(watch),
         async reauthorize() {
             if (refusal === null || !refusal.reauthorizationOffered)
                 return;
             journal.record('connection reauthorize');
-            await chain.catch(() => undefined);
+            await Promise.all([...lanes.values()]
+                .filter((held) => held.generation === generation)
+                .map((held) => held.chain));
             await mutations;
             authorization = undefined;
             discoveryPaused = false;
-            await enqueue();
+            if (options.adapter.roomStream === undefined)
+                await sync('unstreamed');
+            else
+                await task(OPENING_LANE, ensureAuthorization);
         },
     };
-    return { md, stop, watch };
+    const reachable = {
+        md,
+        watch,
+        referrerScope: (referrer) => options.adapter.referrerScope(referrer),
+        plan: planned,
+        query: (plan) => rowsQuery(plan),
+        watchPlan,
+        search: searched,
+    };
+    return { md, stop, lose: loseRooms, watch, within: (reach) => narrowed(reachable, reach) };
 }