@agentshouse/mdruntime 0.1.0-c56daf494ecb4 → 0.1.0-c59a5a6bd2f31

package/dist/connection.js

@@ -1,30 +1,35 @@
-import { attachedModel } from './attached-model.js';
-import { cached, modelTypes, NO_MODEL, sameModel, } from './model.js';
+import { identityOf, roomTarget, target, } from '@agentshouse/mdmodel';
+import { builtInModel, roomTypesOf } from './attached-model.js';
+import { modelTypes, NO_MODEL } from './model.js';
 import { observing } from './observation.js';
-import { filterOf, identityOf, planOf, } from './query.js';
-import { createReadSide } from './read-side.js';
-import { markdownPath, roomOfKey } from './rows.js';
-import { createSearchIndex, searchPlanOf, } from './search.js';
-import { bootstrapRoom } from './bootstrap.js';
+import { planWithin, } from './query.js';
+import { createFigures, ROOM_TOTALS } from './figures.js';
+import { createLiveQueries } from './live.js';
+import { keepEntrySeed, seedApplies, seededResult, watchSeeded, } from './seed.js';
+import { documentKey, roomOfKey } from './rows.js';
+import { searchPlanOf } from './search.js';
+import { capped, MAXIMUM_WINDOW } from './windows.js';
+import { behind, catching, caughtUpTo, forgetInstall, installationOf, publish, pullBootstrap, pullRefresh, reachedBy, replaced, roomInFlight, standingAt, writtenAfter, } from './install.js';
 import { changeSet, mergeChangeSets } from './change-set.js';
 import { createConversationStore, } from './conversation.js';
-import { queuedFile } from './change.js';
-import { validRoot } from './collection.js';
-import { runtimeError } from './failure.js';
+import { composedOf, validRoot } from './collection.js';
 import { createLog } from './log.js';
-import { binaryRecord } from './binary.js';
-import { absentBinary, binaryAnswer, calledResult, historyAnswer, undeclared, UNCERTAIN, } from './outcome.js';
-import { refreshRoom } from './refresh.js';
-import { buildBatch, joined, limitedIn, requeued } from './save.js';
-import { applyReturned, compositionOf, confirmedOf, landed, readReclassified, replicaOf, sameMembership, withdrawals, } from './replica.js';
-import { binaryBase, changedParts, changesOf, held, heldFile, joinedDraft, readParts, returnedBy, returnedInto, staleWrite, underneath, withdrawnDrafts, } from './room-draft.js';
-import { same, saving, STARTING, transferring, } from './status.js';
-import { detectStorageLoss, nextGeneration } from './durability.js';
-import { roomDraftRevision } from './identity.js';
-import { beneath, normalize } from './paths.js';
-import { openRuntimeStore, } from './store.js';
+import { ABSENT_TARGET, calledResult, failure, historyAnswer, LOCKED_UNREADABLE, lockedRoom, OFFLINE, undeclared, UNCERTAIN, UNREADABLE, } from './outcome.js';
+import { readAnswers } from './reads.js';
+import { createRecovery } from './recovery.js';
+import { storedRecord } from './replica.js';
+import { same, STARTING, } from './status.js';
+import { detectStorageLoss, nextGeneration, refusedForSpace, } from './durability.js';
+import { readinessOf, } from './readiness.js';
+import { yielded } from './turn.js';
+import { beneath } from './paths.js';
+import { createStore, } from './store.js';
+import { emitPresentation, presentationSurface, publishRoomDrafts, roomDraftSurface, watchPresentation, watchRoomDrafts, } from './room-drafts.js';
+import { createSocket } from './socket.js';
 import { unconfirmed } from './transfer.js';
 import { governs, holds, narrowed, planReach, } from './reach.js';
+import { binaryFileSurface, overlayDiff, preparedAfter, replayed, saveParts, saveRoomDrafts, settle, sliceAt, } from './saves.js';
+import { submitAll, submitLater, unpair } from './acceptance.js';
 function within(root, path) {
     return root === '' || beneath(root, path);
 }
@@ -38,222 +43,448 @@ function declaredSelection(room) {
         root !== '' &&
         selection.roots.every((other, at) => at === index || !within(other, root)));
 }
+const OPENING_LANE = 'opening';
+const CONVERSATION_LANE = 'conversations';
+const ROOM_READS = 256;
+const ROOM_ATTEMPTS = 16;
+const ERASE_BATCH = 512;
+const QUERY_BYTES = 1 << 20;
+// A Room the Provider answers not ready is asked again after these waits, the last repeating, so a chunk build that catches up within seconds installs at once and a long one is asked every 15 seconds.
+const NOT_READY_MS = [1_000, 2_000, 3_000, 5_000, 8_000, 11_000, 15_000];
+// A Room that locks offline stays readable this long after the connection drops, so a laptop waking or changing network keeps working while a disconnected device locks soon after.
+const LOCK_GRACE_MS = 120_000;
+function operationOf(input) {
+    const operation = input?.operation_id;
+    return typeof operation === 'string' ? operation : null;
+}
 export function composeRuntime(options) {
     const localSaves = options.adapter.localSaves === true;
+    const roomTypes = roomTypesOf(options.adapter.roomTypes, options.adapter.nameableRoomTypes);
     let authorization = options.authorization;
-    let opening;
-    let store;
-    const replicas = new Map();
-    const queuesWithoutReplica = new Map();
-    const pendings = new Map();
-    const roomDrafts = new Map();
-    const presentations = new Map();
-    let limits = [];
-    let capabilities = [];
-    const rooms = new Map();
-    const counted = new Map();
+    let discoveries = 0;
+    const usableWhenHeld = options.usableWhenHeld ?? [];
+    const build = options.build ?? '';
+    const declared = new Map();
+    const unheldModels = new Map();
     const unreadable = new Set();
-    const models = new Map();
-    const liveModels = new Map();
-    const invalidModels = new Set();
+    const builtIn = builtInModel(roomTypes);
+    const typedPaths = options.adapter.typedPaths ?? [];
     const discovered = new Map();
+    const journal = createLog();
+    const database = {
+        async ask(request) {
+            try {
+                return await options.database.ask(request);
+            }
+            catch (error) {
+                if (refusedForSpace(error))
+                    filled();
+                throw error;
+            }
+        },
+    };
+    const socket = createSocket(options.adapter);
+    const store = createStore({
+        database,
+        roomTypes,
+        builtIn,
+        typedPaths,
+        opening: open,
+        unpublished,
+    });
+    const { covering, durably, exclusive, composed, publication } = store;
+    const openLocal = store.open;
+    const isFenced = store.fences.has;
+    const storedRooms = store.rooms;
+    const recordAt = store.record;
+    const workOf = store.work;
+    const replicaOf = store.replica;
+    const draftsOf = store.drafts;
+    const draftOf = store.draft;
+    const reads = socket.reads;
     let roomsListed = false;
     const scopedRefusals = new Map();
-    const sourceRefusals = new Map();
-    const declarationRefusals = new Set();
-    function modelKey(locator, attached) {
-        return `${attached} ${locator}`;
-    }
-    function modelOf(locator, attached = 'collection') {
-        return models.get(modelKey(locator, attached)) ?? NO_MODEL;
-    }
-    function savedModel(locator, attached) {
-        return invalidModels.has(modelKey(locator, attached))
-            ? { status: 'unavailable', reason: 'revoked' }
-            : modelOf(locator, attached);
+    function modelIn(locator, stored) {
+        if (refusal?.code === 'revoked-authorization')
+            return { status: 'unavailable', reason: 'revoked' };
+        return stored?.record.model ?? unheldModels.get(locator) ?? NO_MODEL;
     }
     function compositionFor(record) {
-        return compositionOf({
+        return composed({
             ...record,
-            model: savedModel(record.locator, 'collection'),
-            selectionModel: savedModel(record.locator, 'typed-selection'),
+            model: modelIn(record.locator, { record, indexed: true, documents: 0 }),
         });
     }
     let refusal = null;
     let storageLoss = null;
-    let status = STARTING;
+    let status = { state: 'syncing', providerUnreachable: false, resting: false };
     let shown = STARTING;
     let discoveryPaused = false;
-    let resetTimer;
     let closed = false;
     let stopping = false;
-    let withdrawStream;
-    const announced = new Map();
     let underway = null;
     let streamed = null;
-    let handed = false;
-    const submitting = new Map();
-    const answering = new Map();
+    const recovery = (options.recovery ?? createRecovery()).scope(ROOM_ATTEMPTS);
+    const repairing = new Set();
+    const calling = new Set();
+    const repairable = new Map();
+    const unready = new Map();
     let complete = false;
     let recorded = false;
     const stale = new Set();
-    let chain = Promise.resolve();
-    let mutations = Promise.resolve();
+    const reloadsDue = new Set();
+    const lanes = new Map();
+    const roomLanes = new Map();
+    let roomWork = 0;
+    const roomReads = { free: ROOM_READS, waiting: [] };
+    const working = new Set();
     const roomListeners = new Set();
+    const unlistedRooms = new Set();
     const refusalListeners = new Set();
     const storageLossListeners = new Set();
     const statusListeners = new Set();
     const queueSubscriptions = new Set();
-    const roomDraftListeners = new Set();
-    const presentationListeners = new Set();
-    const readSide = createReadSide();
-    let withdrawConversations;
-    let currencyQueued = false;
-    let socketOpen = false;
+    const liveQueries = createLiveQueries((plan, cover) => answeredPlan(plan, cover), () => covering());
+    const figures = createFigures({
+        cover: figuresCover,
+        rooms: async (rooms, since) => database.ask({
+            kind: 'replica.tallies',
+            totals: { ...(await planned(ROOM_TOTALS, null)), limit: null },
+            rooms,
+            since,
+        }),
+        conversations: (conversations, since) => database.ask({ kind: 'conversation.tallies', conversations, since }),
+    });
+    let currencyQueued = null;
+    const confirmed = new Set();
+    let lockGrace = null;
+    const lockListeners = new Set();
     let serviceMode = 'open';
     let haltedRefusal = false;
     let openSignals = 0;
     const serviceModeListeners = new Set();
-    let member = null;
     const memberListeners = new Set();
-    const materialized = new Set();
-    let everyRoom = false;
-    const transfers = new Map();
+    let authorityChanges = 0;
+    const authorityChangeListeners = new Set();
+    const unpreparedDemand = new Set();
+    const unpreparable = new Set();
+    let preparing = false;
+    let persistence = options.shell.persistence;
+    let heldWhenOpened = false;
+    let full = false;
+    let probing = null;
+    let testing = null;
+    const readinessWatches = new Set();
+    let readinessQueued = false;
     const conversations = createConversationStore({
-        agents: declaredAgents,
-        documents: (locator) => rowsQuery(planOf({ rooms: [locator], select: 'all' }, roomFacts())),
         call: (name, input) => invokeAction(name, input),
+        history: (request) => readConversationHistory(request),
         durably,
+        local: () => openLocal(),
+        again: () => {
+            void ready.then(scheduleCurrency);
+        },
+        settled: () => {
+            show();
+        },
         stream: () => options.adapter.conversations,
         publish: publishChangeSet,
+        online: providerReached,
+        full: () => full,
         closed: () => closed,
+        unanswered: resendLater,
     });
-    const searchIndex = createSearchIndex({
-        documents: () => readSide.documents(),
-        document: (room, path) => readSide.document(room, path),
-        messages: () => conversations.messages(),
-        message: (conversation, identity) => conversations.message(conversation, identity),
+    const lastAnswers = readAnswers({
+        database,
+        build,
+        unkept: options.adapter.unkeptReads ?? [],
+        recovery: recovery.scope(),
+        call: (name, input) => md.call(name, input),
+        online: providerReached,
+        closed: () => closed,
+        full: () => full,
+        filled,
     });
-    const journal = createLog();
-    let notifyReady = () => { };
+    let readyFromStore = () => { };
     const ready = new Promise((resolve) => {
-        notifyReady = resolve;
+        readyFromStore = resolve;
     });
-    function rememberRoomDraft(record) {
-        const room = roomDrafts.get(record.locator) ?? new Map();
-        room.set(record.path, record);
-        roomDrafts.set(record.locator, room);
-    }
-    function forgetRoomDraft(locator, path) {
-        const room = roomDrafts.get(locator);
-        if (room === undefined)
-            return;
-        room.delete(path);
-        if (room.size === 0)
-            roomDrafts.delete(locator);
-    }
-    function roomDraftOf(record) {
-        return structuredClone({
-            room: record.locator,
-            path: record.path,
-            revision: record.revision,
-            parts: record.parts,
-            changedUnderneath: underneath(record.parts, record.path, replicas.get(record.locator)?.visible),
-            returned: record.returned,
-        });
-    }
-    function snapshotRoomDrafts() {
-        const records = [...roomDrafts.values()].flatMap((room) => [...room.values()]);
-        records.sort((left, right) => {
-            if (left.locator !== right.locator)
-                return left.locator < right.locator ? -1 : 1;
+    let notifyDiscovered = () => { };
+    const firstDiscovery = new Promise((resolve) => {
+        notifyDiscovered = resolve;
+    });
+    let roomsNamed = false;
+    const seeding = {
+        store,
+        reached: reads.reached,
+        listed: () => roomsListed,
+        declares: (room) => declared.has(room),
+    };
+    const drafting = {
+        store,
+        closed: () => closed,
+        publishChangeSet,
+        statusShown: () => moveTo(status),
+    };
+    const saver = {
+        store,
+        socket,
+        journal,
+        localSaves,
+        ready,
+        firstDiscovery,
+        full: () => full,
+        closed: () => closed,
+        refused: () => refusal !== null,
+        roomsNamed: () => roomsNamed,
+        authorized: () => authorization,
+        ensureAuthorization,
+        connectionNow,
+        scoped,
+        refuse,
+        compositionFor,
+        prepare,
+        publishChangeSet,
+        pendingShown,
+        submitLater: (locator) => submitLater(accepting, locator),
+    };
+    const accepting = {
+        ...saver,
+        recovery,
+        stopping: () => stopping,
+        paused: () => discoveryPaused,
+        continuing,
+        discovered: (locator) => discovered.get(locator),
+        readable(room) {
+            unreadable.delete(room.locator);
+            list(room, true);
+        },
+        unreadable: roomUnreadable,
+        advanced,
+        withhold,
+        writesHeld,
+        openSignals: () => openSignals,
+        haltedSince,
+        rest,
+        statusShown: () => moveTo(status),
+    };
+    const installer = {
+        store,
+        socket,
+        journal,
+        roomTypes,
+        builtIn,
+        typedPaths,
+        unheldModel: (locator) => unheldModels.get(locator),
+        recover: recoverReads,
+        queueReadiness,
+        sweep,
+        settle: (local, locator, work, record, queue, settling) => settle(saver, local, locator, work, record, queue, settling),
+        readied,
+        modelKept: (locator) => {
+            unheldModels.delete(locator);
+        },
+        name,
+        usable(room) {
+            stale.delete(room.locator);
+            unpreparable.delete(room.locator);
+            if (unreadable.delete(room.locator))
+                scopedRefusals.delete(room.locator);
+            list(room, true);
+        },
+        publishChangeSet,
+        unpair: (local) => unpair(accepting, local),
+        statusShown: () => moveTo(status),
+        submitLater: (locator) => submitLater(accepting, locator),
+    };
+    function notifyReady() {
+        notifyDiscovered();
+        readyFromStore();
+    }
+    async function attended() {
+        const held = await (await openLocal()).status();
+        const attentionRequired = held.returned.flatMap((record) => record.returned === null || isFenced(record.locator)
+            ? []
+            : [{ room: record.locator, path: record.path, returned: structuredClone(record.returned) }]);
+        attentionRequired.sort((left, right) => {
+            if (left.room !== right.room)
+                return left.room < right.room ? -1 : 1;
             if (left.path !== right.path)
                 return left.path < right.path ? -1 : 1;
             return 0;
         });
-        return records.map(roomDraftOf);
-    }
-    function publishRoomDrafts(waitingOnly) {
-        if (closed)
-            return;
-        const value = snapshotRoomDrafts();
-        for (const listener of roomDraftListeners) {
-            if (waitingOnly && listener.ready)
-                continue;
-            listener.ready = true;
-            listener.notify(value);
+        const changed = new Map();
+        if (!localSaves) {
+            for (const change of held.unsent) {
+                if (!isFenced(change.room))
+                    changed.set(`${change.room}\u0000${change.path}`, change);
+            }
         }
+        const unsent = [...changed]
+            .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0))
+            .map(([, change]) => change);
+        return {
+            queued: !localSaves && held.queued.some((locator) => !isFenced(locator)),
+            lastCompleted: held.lastCompleted,
+            attentionRequired,
+            unsent,
+            reset: held.resets.reduce((earliest, { locator, reset }) => isFenced(locator) || (earliest !== null && earliest <= reset) ? earliest : reset, null),
+        };
     }
-    function presentationOf(app) {
-        const value = presentations.get(app);
-        return value === undefined ? null : structuredClone(value);
+    async function queuedWork() {
+        const held = await (await openLocal()).queued();
+        return !localSaves && held.some((locator) => !isFenced(locator));
     }
-    function emitPresentation(app) {
-        if (closed)
-            return;
-        for (const listener of presentationListeners) {
-            if (listener.app === app && listener.ready)
-                listener.notify(presentationOf(app));
+    function declarationOf(locator, stored) {
+        const held = declared.get(locator);
+        const room = stored?.record ?? held?.room ?? discovered.get(locator);
+        return room === undefined ? undefined : { room, available: held?.available ?? true };
+    }
+    function listedLocators(held) {
+        return [
+            ...declared.keys(),
+            ...[...held.keys()].filter((locator) => !declared.has(locator)),
+        ].filter((locator) => !isFenced(locator));
+    }
+    function selectionModel() {
+        return refusal?.code === 'revoked-authorization'
+            ? { status: 'unavailable', reason: 'revoked' }
+            : builtIn;
+    }
+    function listedRoom(locator, stored) {
+        const declaration = declarationOf(locator, stored);
+        if (declaration === undefined)
+            return undefined;
+        const { room, available } = declaration;
+        const selection = room.typedSelection ?? null;
+        return {
+            name: room.name,
+            locator,
+            handle: room.handle,
+            operations: room.operations,
+            replica: room.replica,
+            model: modelTypes(modelIn(locator, stored)),
+            typedSelection: selection === null ? null : { roots: selection.roots, model: modelTypes(selectionModel()) },
+            providerOwnedPaths: room.providerOwnedPaths,
+            roomVersion: stored?.record.roomVersion ?? null,
+            synchronizationAvailable: available,
+            refusal: scopedRefusals.get(locator) ?? null,
+            documents: stored?.documents ?? 0,
+        };
+    }
+    function listingOf(held) {
+        const listing = new Map();
+        for (const locator of listedLocators(held)) {
+            const room = listedRoom(locator, held.get(locator));
+            if (room !== undefined)
+                listing.set(locator, room);
+        }
+        return listing;
+    }
+    async function patchedListing(changed) {
+        if (roomsShown === null)
+            return null;
+        const held = await storedRooms([...changed]);
+        const listing = new Map(roomsShown);
+        for (const locator of changed) {
+            const room = isFenced(locator) ? undefined : listedRoom(locator, held.get(locator));
+            if (room === undefined || !listing.has(locator))
+                return null;
+            listing.set(locator, room);
         }
+        return listing;
     }
-    function pending() {
-        return (!localSaves &&
-            (queuesWithoutReplica.size > 0 ||
-                [...replicas.values()].some((replica) => replica.queue.length > 0)));
+    async function listingNow() {
+        return listingOf(await storedRooms());
     }
-    function attention() {
-        const attentionRequired = [];
-        for (const record of [...roomDrafts.values()].flatMap((room) => [...room.values()])) {
-            if (record.returned === null)
-                continue;
-            attentionRequired.push({
-                room: record.locator,
-                path: record.path,
-                returned: structuredClone(record.returned),
-            });
+    function lockedIn(listing, locator) {
+        return listing.get(locator)?.replica.offline === 'locked' && !confirmed.has(locator);
+    }
+    function shownRooms(listing) {
+        return structuredClone([...listing.values()].map(({ documents, ...room }) => lockedIn(listing, room.locator)
+            ? {
+                ...room,
+                model: modelTypes(NO_MODEL),
+                typedSelection: null,
+                documents: 0,
+                locked: true,
+            }
+            : { ...room, documents, locked: false }));
+    }
+    async function offlineModes() {
+        const modes = new Map();
+        for (const [locator, { room }] of declared) {
+            const declaration = room ?? discovered.get(locator);
+            if (declaration !== undefined)
+                modes.set(locator, declaration.replica.offline);
         }
-        attentionRequired.sort((left, right) => {
-            if (left.room !== right.room)
-                return left.room < right.room ? -1 : 1;
-            if (left.path !== right.path)
-                return left.path < right.path ? -1 : 1;
-            return 0;
-        });
-        let reset = null;
-        for (const { submission } of pendings.values()) {
-            if (submission.state !== 'reset')
-                continue;
-            if (reset === null || submission.reset < reset)
-                reset = submission.reset;
+        for (const [locator, { offline }] of (await covering()).rooms)
+            modes.set(locator, offline);
+        return modes;
+    }
+    async function locked(locator) {
+        if (isFenced(locator) || confirmed.has(locator))
+            return false;
+        const held = declared.get(locator)?.room ?? discovered.get(locator);
+        const mode = (await (await openLocal()).offline(locator)) ?? held?.replica.offline;
+        return mode === 'locked';
+    }
+    async function lockedRooms() {
+        return [...(await offlineModes())]
+            .filter(([locator, mode]) => mode === 'locked' && !confirmed.has(locator) && !isFenced(locator))
+            .map(([locator]) => locator)
+            .sort();
+    }
+    async function relocked(before) {
+        const after = await lockedRooms();
+        if (JSON.stringify(after) === JSON.stringify(before))
+            return;
+        journal.record(`locked ${after.length}`);
+        emitRooms();
+        for (const notify of [...lockListeners])
+            notify();
+    }
+    function confirmLocks(listed) {
+        if (!socket.isOpen())
+            return;
+        for (const room of listed) {
+            if (room.replica.admission === 'admitted')
+                confirmed.add(room.locator);
         }
-        return { attentionRequired, reset };
     }
-    function documentsIn(locator) {
-        const replica = replicas.get(locator);
-        if (replica === undefined)
-            return 0;
-        const roots = replica.confirmed.record.typedSelection?.roots ?? [];
-        const paths = [
-            ...Object.keys(replica.visible.documents).filter(markdownPath),
-            ...Object.keys(replica.visible.binaries),
-        ];
-        return paths.filter((path) => !roots.some((root) => beneath(root, path))).length;
-    }
-    function listed() {
-        return structuredClone([...rooms.values()].map((room) => {
-            const documents = documentsIn(room.locator);
-            counted.set(room.locator, documents);
-            return { ...room, documents };
-        }));
-    }
-    function roomFacts(reach = null) {
-        const held = [...rooms.values()]
+    function connectionLost() {
+        if (lockGrace !== null || closed)
+            return;
+        lockGrace = setTimeout(() => {
+            lockGrace = null;
+            if (socket.isOpen() || closed)
+                return;
+            void lockedRooms().then((before) => {
+                confirmed.clear();
+                return relocked(before);
+            }, () => { });
+        }, LOCK_GRACE_MS);
+    }
+    function connectionLive() {
+        if (lockGrace !== null)
+            clearTimeout(lockGrace);
+        lockGrace = null;
+    }
+    function watchLocks(notify) {
+        lockListeners.add(notify);
+        return () => {
+            lockListeners.delete(notify);
+        };
+    }
+    async function roomFacts(reach = null) {
+        const held = await storedRooms();
+        const rooms = [...listingOf(held).values()]
             .filter((room) => holds(reach, room.locator))
             .map((room) => {
             const governed = governs(reach, room);
             const attached = [
-                ...(governed.collection ? [modelOf(room.locator)] : []),
-                ...(governed.selection ? [modelOf(room.locator, 'typed-selection')] : []),
+                ...(governed.collection ? [modelIn(room.locator, held.get(room.locator))] : []),
+                ...(governed.selection ? [builtIn] : []),
             ];
             return {
                 locator: room.locator,
@@ -261,186 +492,658 @@ export function composeRuntime(options) {
                 types: attached.flatMap((model) => model.status === 'unavailable' ? [] : Object.values(model.types)),
             };
         });
-        return { listed: roomsListed, rooms: held };
+        return { listed: roomsListed, rooms };
+    }
+    function emitRooms(changed) {
+        recoverReads();
+        queueReadiness();
+        return changed === undefined ? publishRooms('all') : publishRooms('changed', changed);
     }
-    function emitRooms() {
-        const value = listed();
-        for (const listener of roomListeners)
-            listener(value);
+    function emitKnownRooms() {
+        conversations.learned();
+        if (unlistedRooms.size === 0)
+            return;
+        void publishRooms('known');
+    }
+    let roomsOwed = null;
+    let roomsShown = null;
+    function publishRooms(mode, touched = []) {
+        if (closed)
+            return Promise.resolve();
+        if (roomsOwed !== null) {
+            roomsOwed.all ||= mode === 'all';
+            for (const locator of touched) {
+                (mode === 'changed' ? roomsOwed.changed : roomsOwed.counted).add(locator);
+            }
+            return roomsOwed.shown;
+        }
+        const owing = {
+            all: mode === 'all',
+            changed: new Set(mode === 'changed' ? touched : []),
+            counted: new Set(mode === 'changed' ? [] : touched),
+            shown: Promise.resolve(),
+        };
+        roomsOwed = owing;
+        owing.shown = publication(async () => {
+            const owed = owing;
+            if (roomsOwed === owing)
+                roomsOwed = null;
+            if (closed || (roomListeners.size === 0 && unlistedRooms.size === 0))
+                return;
+            const patched = owed.all || owed.changed.size === 0 || unlistedRooms.size > 0
+                ? null
+                : await patchedListing(new Set([...owed.changed, ...owed.counted]));
+            if (patched === null && owed.changed.size > 0)
+                owed.all = true;
+            if (patched === null && !owed.all && owed.counted.size > 0) {
+                const held = await covering().catch(() => null);
+                if (held === null)
+                    return;
+                owed.all = [...owed.counted].some((locator) => held.rooms.has(locator) &&
+                    roomsShown?.get(locator)?.documents !== held.rooms.get(locator).documents);
+                if (owed.all) {
+                    recoverReads();
+                    queueReadiness();
+                }
+                else if (unlistedRooms.size === 0)
+                    return;
+            }
+            const listing = patched ?? (await listingNow().catch(() => null));
+            if (listing === null || closed)
+                return;
+            const value = shownRooms(listing);
+            const joining = unlistedRooms.size > 0 &&
+                (roomsListed || listing.size > 0 || refusal !== null || status.providerUnreachable);
+            if (!owed.all && patched === null && !joining)
+                return;
+            const moved = owed.all ||
+                patched !== null ||
+                (roomsShown !== null && JSON.stringify(shownRooms(roomsShown)) !== JSON.stringify(value));
+            if (moved)
+                for (const listener of roomListeners)
+                    listener(value);
+            if (joining) {
+                for (const listener of [...unlistedRooms]) {
+                    unlistedRooms.delete(listener);
+                    roomListeners.add(listener);
+                    listener(value);
+                }
+            }
+            roomsShown = roomListeners.size === 0 ? null : listing;
+        });
+        return owing.shown;
     }
     function emitRefusal() {
+        queueReadiness();
         for (const listener of refusalListeners)
             listener(refusal);
+        emitKnownRooms();
     }
     function emitStorageLoss() {
+        queueReadiness();
         for (const listener of storageLossListeners)
             listener(storageLoss);
     }
-    function emitMember() {
+    function emitMember(member) {
         for (const listener of memberListeners)
             listener(member);
     }
     function moveTo(next) {
         if (closed)
-            return;
+            return Promise.resolve();
         status = next;
-        show();
+        return show();
+    }
+    function transferring() {
+        return { ...status, state: 'syncing', resting: false };
     }
+    let statusOwed = null;
+    let statusShown = Promise.resolve();
     function show() {
         if (closed)
-            return;
-        const next = status.state === 'synced' && !conversations.current()
-            ? { ...status, state: 'syncing' }
-            : status;
-        if (same(shown, next))
-            return;
-        shown = next;
-        for (const listener of statusListeners)
-            listener(shown);
+            return Promise.resolve();
+        queueReadiness();
+        emitKnownRooms();
+        const moved = { moving: status, current: conversations.current() };
+        if (statusOwed !== null) {
+            statusOwed.push(moved);
+            return statusShown;
+        }
+        const owed = [moved];
+        statusOwed = owed;
+        statusShown = publication(async () => {
+            if (statusOwed === owed)
+                statusOwed = null;
+            const held = await attended();
+            if (closed)
+                return;
+            for (const { moving, current } of owed) {
+                const state = moving.resting && held.queued ? 'pending' : moving.state;
+                const next = {
+                    state: state === 'synced' && !current ? 'syncing' : state,
+                    lastCompleted: held.lastCompleted,
+                    providerUnreachable: moving.providerUnreachable,
+                    attentionRequired: held.attentionRequired,
+                    unsent: held.unsent,
+                    reset: held.reset,
+                };
+                if (same(shown, next))
+                    continue;
+                shown = next;
+                for (const listener of statusListeners)
+                    listener(shown);
+            }
+        });
+        return statusShown;
     }
-    function entryOf(batch) {
+    function entryOf(states, batch) {
         if (localSaves)
             return Object.freeze({ batch, state: 'local' });
-        const state = pendings.get(batch.id);
-        if (state?.accepted !== undefined) {
-            return Object.freeze({ batch, state: 'accepted', roomVersion: state.accepted });
-        }
+        const state = states.get(batch.id);
         return Object.freeze({ batch, ...(state?.submission ?? { state: 'waiting' }) });
     }
-    function entriesOf(locator) {
-        return (replicas.get(locator)?.queue ?? queuesWithoutReplica.get(locator) ?? []).map(entryOf);
+    async function entriesOf(locator) {
+        if (isFenced(locator))
+            return [];
+        const { queue, states } = await workOf(locator);
+        return queue.map((batch) => entryOf(states, batch));
     }
     function emitQueue(locator) {
-        const entries = entriesOf(locator);
-        for (const subscription of queueSubscriptions) {
-            if (subscription.locator === locator)
+        const listening = () => [...queueSubscriptions].filter((subscription) => subscription.locator === locator);
+        if (closed || listening().length === 0)
+            return Promise.resolve();
+        return publication(async () => {
+            if (closed || listening().length === 0)
+                return;
+            const entries = await entriesOf(locator);
+            if (closed)
+                return;
+            for (const subscription of listening())
                 subscription.notify(entries);
-        }
+        });
     }
     function applyChangeSet(set) {
-        const held = everyRoom
-            ? set
-            : { ...set, documents: set.documents.filter(({ locator }) => materialized.has(locator)) };
-        readSide.apply(held);
-        searchIndex.changed(held);
-    }
-    function materialize(locators) {
-        if (everyRoom)
+        liveQueries.touched(set);
+        figures.touched(set);
+    }
+    function recoverReads() {
+        liveQueries.recover();
+        figures.recover();
+    }
+    function unpublished(error) {
+        journal.record(`publication failed ${error instanceof Error ? error.name : 'unknown'}`);
+    }
+    async function prepareReplica(locator) {
+        for (;;) {
+            const held = (await storedRooms([locator])).get(locator);
+            if (held === undefined || closed || held.indexed)
+                return;
+            const key = held.record.key;
+            const done = await exclusive(async () => {
+                const local = await openLocal();
+                return store.rederive(local, key, composed(held.record));
+            });
+            if (!done.done)
+                continue;
+            if ((await storedRooms([locator])).get(locator)?.record.key !== key)
+                continue;
+            publishChangeSet(changeSet(locator, { documents: null }));
+            recoverReads();
+            queueReadiness();
             return;
-        if (locators === null)
-            everyRoom = true;
-        const sets = [];
-        for (const locator of locators ?? [...replicas.keys()]) {
-            if (materialized.has(locator))
+        }
+    }
+    async function unprepared() {
+        const held = (await covering()).rooms;
+        return [...unpreparedDemand, ...held.keys()].find((locator) => !(held.get(locator)?.indexed ?? false) && !unpreparable.has(locator));
+    }
+    function unpreparedBy(locator, error) {
+        unpreparable.add(locator);
+        journal.record(`preparation failed ${locator} ${error instanceof Error ? error.name : 'unknown'}`);
+        queueReadiness();
+    }
+    function prepare(locators = []) {
+        for (const locator of locators)
+            unpreparedDemand.add(locator);
+        if (preparing)
+            return;
+        preparing = true;
+        void (async () => {
+            try {
+                for (let waiting = await unprepared(); waiting !== undefined; waiting = await unprepared()) {
+                    await yielded();
+                    if (closed)
+                        return;
+                    unpreparedDemand.delete(waiting);
+                    await prepareReplica(waiting).catch((error) => unpreparedBy(waiting, error));
+                }
+            }
+            catch {
+                journal.record('preparation failed');
+            }
+            finally {
+                preparing = false;
+            }
+        })();
+    }
+    function roomsOfReach(reach) {
+        return new Set([...reach.rooms, ...reach.documents.map(roomOfKey)]);
+    }
+    function everyRoom(held) {
+        return [...new Set([...declared.keys(), ...held.rooms.keys(), ...held.queues.keys()])];
+    }
+    function reachedRooms(plan, held) {
+        const reached = plan.reach === null ? null : roomsOfReach(plan.reach);
+        const named = plan.rooms ?? (reached === null ? everyRoom(held) : [...reached]);
+        return [...new Set(named)]
+            .filter((locator) => (reached === null || reached.has(locator)) && !plan.locked.includes(locator))
+            .sort();
+    }
+    function awaited(locator) {
+        return (!roomsListed ||
+            (declared.has(locator) && discovered.get(locator)?.replica.admission === 'admitted'));
+    }
+    function covered(plan, held) {
+        return coveredRooms(reachedRooms(plan, held), plan.rooms === null && plan.reach === null, held);
+    }
+    async function figuresCover() {
+        const held = await covering();
+        const locked = await lockedRooms();
+        const cover = coveredRooms(everyRoom(held)
+            .filter((locator) => !locked.includes(locator))
+            .sort(), true, held);
+        awaitPreparation(cover);
+        return 'pending' in cover ? cover : { rooms: cover.rooms };
+    }
+    function coveredRooms(locators, whole, held) {
+        if (locators.length === 0 && whole && !roomsListed)
+            return { pending: [] };
+        const pending = [];
+        const coverage = [];
+        const overlay = [];
+        const read = [];
+        for (const locator of locators) {
+            const replica = held.rooms.get(locator);
+            if (replica === undefined) {
+                if (awaited(locator))
+                    pending.push({ room: locator, awaits: 'acquisition' });
                 continue;
-            materialized.add(locator);
-            const replica = replicas.get(locator);
-            if (replica !== undefined)
-                sets.push(changeSet(locator, null, replica));
+            }
+            if (!replica.indexed) {
+                pending.push({ room: locator, awaits: 'preparation' });
+                continue;
+            }
+            coverage.push({
+                room: locator,
+                generation: replica.transfer,
+                current: !roomInFlight(store, locator),
+            });
+            read.push({ locator, key: replica.key });
+            for (const id of held.queues.get(locator) ?? [])
+                overlay.push(id);
         }
-        if (sets.length === 0)
+        if (pending.length > 0)
+            return { pending };
+        return { coverage: { rooms: coverage, indexes: [], overlay }, rooms: read };
+    }
+    function awaitPreparation(cover) {
+        if (!('pending' in cover))
             return;
-        const set = mergeChangeSets(sets);
-        readSide.apply(set);
-        searchIndex.changed(set);
-    }
-    function reachedRooms(plan) {
-        if (plan.rooms !== null)
-            return plan.rooms;
-        if (plan.reach === null)
-            return null;
-        return [...plan.reach.rooms, ...plan.reach.documents.map(roomOfKey)];
+        const waiting = cover.pending.filter(({ awaits }) => awaits === 'preparation');
+        if (waiting.length > 0)
+            prepare(waiting.map(({ room }) => room));
+    }
+    function requiredRooms(given, held) {
+        const reach = planReach(given);
+        const listed = new Set(listedLocators(held));
+        if (reach === null)
+            return { listed: roomsListed, rooms: [...listed].sort() };
+        const named = [...roomsOfReach(reach)].sort();
+        if (roomsListed)
+            return { listed: true, rooms: named.filter((room) => listed.has(room)) };
+        return { listed: named.every((room) => held.has(room)), rooms: named };
+    }
+    function roomState(locator, held) {
+        const listedRoom = discovered.get(locator);
+        if (roomsListed &&
+            (listedRoom === undefined ||
+                listedRoom.replica.admission !== 'admitted' ||
+                unreadable.has(locator)))
+            return 'unadmitted';
+        const stored = held.get(locator);
+        if (stored === undefined)
+            return 'acquiring';
+        if (!stored.indexed)
+            return 'preparing';
+        return 'complete';
+    }
+    function conversationCoverage(reach) {
+        const declaredConversations = reach === null || reach.conversations;
+        if (!declaredConversations || options.adapter.conversations === undefined)
+            return 'undeclared';
+        if (!conversations.known() || !conversations.current())
+            return 'acquiring';
+        return 'complete';
+    }
+    function connectionOf(lastCompleted) {
+        if (socket.isOpen())
+            return 'connected';
+        if (status.providerUnreachable)
+            return 'unreachable';
+        return options.adapter.roomStream === undefined && lastCompleted !== null
+            ? 'connected'
+            : 'connecting';
+    }
+    async function connectionNow() {
+        if (socket.isOpen() || status.providerUnreachable || options.adapter.roomStream !== undefined) {
+            return connectionOf(null);
+        }
+        return connectionOf((await (await openLocal()).facts()).lastCompleted);
+    }
+    async function readinessHeld() {
+        const local = await openLocal();
+        const [held, facts] = await Promise.all([covering(), local.facts()]);
+        return { held: held.rooms, facts };
+    }
+    function readinessFor(port, reach, { held, facts }) {
+        const required = requiredRooms(reach, held);
+        const coverage = required.rooms.map((room) => ({ room, state: roomState(room, held) }));
+        const preparing = coverage
+            .filter((room) => room.state === 'preparing' && !unpreparable.has(room.room))
+            .map(({ room }) => room);
+        if (preparing.length > 0)
+            prepare(preparing);
+        return readinessOf({
+            code: port.code,
+            coverage: {
+                listed: required.listed,
+                rooms: coverage,
+                conversations: conversationCoverage(reach),
+            },
+            persistence,
+            connection: connectionOf(facts.lastCompleted),
+            house: refusal !== null ? 'refused' : writesHeld() ? 'write-halted' : 'open',
+            space: full ? 'full' : null,
+            installation: installationOf(store, coverage, held),
+            lost: storageLoss !== null,
+            established: facts.targets[port.target]?.established === true ||
+                (heldWhenOpened && usableWhenHeld.includes(port.target)),
+        });
+    }
+    const establishing = new Set();
+    function establish(name) {
+        if (establishing.has(name))
+            return;
+        establishing.add(name);
+        void durably(async (local) => {
+            const { targets } = await local.facts();
+            await local.fact('targets', { ...targets, [name]: { established: true } });
+        })
+            .then(() => {
+            queueReadiness();
+            void probeEachMinute();
+        }, () => {
+            journal.record(`target record failed ${name}`);
+        })
+            .finally(() => establishing.delete(name));
+    }
+    function deliverReadiness(watch, held) {
+        if (!readinessWatches.has(watch))
+            return;
+        const readiness = readinessFor(watch.port, watch.reach, held);
+        if (readiness.ready && held.facts.targets[watch.port.target]?.established !== true) {
+            establish(watch.port.target);
+        }
+        const shownReadiness = JSON.stringify(readiness);
+        if (shownReadiness === watch.last)
+            return;
+        watch.last = shownReadiness;
+        watch.deliver(structuredClone(readiness));
+    }
+    let readinessShown = Promise.resolve();
+    const readinessOwed = new Set();
+    function deliverAll(watches) {
+        const queued = readinessOwed.size > 0;
+        for (const watch of watches)
+            readinessOwed.add(watch);
+        if (queued)
+            return;
+        readinessShown = readinessShown
+            .then(async () => {
+            const owed = [...readinessOwed];
+            readinessOwed.clear();
+            const held = await readinessHeld();
+            if (closed)
+                return;
+            for (const watch of owed)
+                deliverReadiness(watch, held);
+        })
+            .catch(unpublished);
     }
-    function rowsQuery(plan) {
-        materialize(reachedRooms(plan));
-        return readSide.query(plan);
+    function queueReadiness() {
+        if (readinessQueued || closed || readinessWatches.size === 0)
+            return;
+        readinessQueued = true;
+        queueMicrotask(() => {
+            readinessQueued = false;
+            if (closed)
+                return;
+            deliverAll([...readinessWatches]);
+        });
+    }
+    function watchReadiness(port, reach, deliver) {
+        const watch = { port, reach, deliver, last: null };
+        readinessWatches.add(watch);
+        void openLocal().then(() => deliverAll([watch]), () => deliverAll([watch]));
+        return () => {
+            readinessWatches.delete(watch);
+        };
+    }
+    function providerReached() {
+        return (socket.isOpen() || !status.providerUnreachable) && refusal === null;
+    }
+    function filled() {
+        if (full || closed)
+            return;
+        full = true;
+        journal.record('space full');
+        queueReadiness();
+        void probeEachMinute();
+    }
+    async function installedTarget() {
+        if (heldWhenOpened && usableWhenHeld.length > 0)
+            return true;
+        const { targets } = await (await openLocal()).facts();
+        return Object.values(targets).some((target) => target.established);
+    }
+    async function probeEachMinute() {
+        if (!full || probing !== null || closed)
+            return;
+        if (!(await installedTarget().catch(() => false)))
+            return;
+        if (!full || probing !== null || closed)
+            return;
+        // A device whose storage filled after its install tries a write each minute, so space freed elsewhere ends its read-only mode without a Retry.
+        probing = setInterval(() => {
+            void probed();
+        }, 60_000);
+    }
+    function probed() {
+        testing ??= database.ask({ kind: 'space.probe' }).then(() => {
+            testing = null;
+            spaceFreed();
+            return true;
+        }, () => {
+            testing = null;
+            return false;
+        });
+        return testing;
+    }
+    function spaceFreed() {
+        if (!full)
+            return;
+        full = false;
+        if (probing !== null)
+            clearInterval(probing);
+        probing = null;
+        unpreparable.clear();
+        journal.record('space freed');
+        queueReadiness();
+        if (closed || authorization === undefined)
+            return;
+        if (options.adapter.roomStream === undefined)
+            void sync('unstreamed', null);
+        else
+            void resynchronize();
+    }
+    function sameCover(left, right) {
+        return JSON.stringify(left) === JSON.stringify(right);
+    }
+    async function coveredRows(plan, cover) {
+        for (;;) {
+            const before = await cover();
+            if ('pending' in before)
+                return { pending: before };
+            const local = await openLocal();
+            const keys = before.rooms.map(({ key }) => key);
+            const changes = local.changes(keys);
+            const current = () => local.changes(keys) === changes;
+            const rows = await windowRows(local, plan, before.rooms, current);
+            const after = await cover();
+            if (rows !== null && sameCover(before, after))
+                return { rows, cover: before, current };
+        }
+    }
+    async function windowRows(local, plan, rooms, unchanged) {
+        const first = await local.query(plan, rooms, QUERY_BYTES);
+        if (first.more === undefined || !('documents' in first)) {
+            const { more: _more, ...rows } = first;
+            return rows;
+        }
+        const documents = [...first.documents];
+        for (let more = first.more; more !== undefined;) {
+            if (!unchanged())
+                return null;
+            const page = await local.query({
+                ...plan,
+                after: { text: more, values: JSON.parse(more) },
+                limit: plan.limit === null ? null : plan.limit - documents.length,
+                total: false,
+            }, rooms, QUERY_BYTES);
+            if (!('documents' in page))
+                return null;
+            documents.push(...page.documents);
+            more = page.more;
+            if (more === undefined) {
+                return {
+                    documents,
+                    ...(page.next === undefined ? {} : { next: page.next }),
+                    ...(first.total === undefined ? {} : { total: first.total }),
+                };
+            }
+        }
+        return null;
+    }
+    function keyedOf(rows, coverage) {
+        if ('groups' in rows) {
+            return {
+                result: { ...rows, coverage },
+                keys: rows.groups.map((group) => JSON.stringify(group.key)),
+            };
+        }
+        return {
+            result: { ...rows, coverage },
+            keys: rows.documents.map((document) => documentKey(document.room, document.path)),
+        };
+    }
+    async function answeredPlan(plan, cover) {
+        const answered = await coveredRows(plan, cover);
+        if ('pending' in answered) {
+            const pending = answered.pending;
+            return { result: pending, keys: [], current: () => true };
+        }
+        const held = answered.cover;
+        return { ...keyedOf(answered.rows, held.coverage), current: answered.current };
+    }
+    async function coverNow(plan) {
+        const cover = covered(plan, await covering());
+        awaitPreparation(cover);
+        return cover;
+    }
+    async function rowsQuery(plan) {
+        const held = await covering();
+        const before = covered(plan, held);
+        awaitPreparation(before);
+        const seeded = seedApplies(seeding, plan, held);
+        if (seeded !== null)
+            return seededResult(seeded).result;
+        if ('pending' in before)
+            return before;
+        const answered = await coveredRows(plan, () => coverNow(plan));
+        if ('pending' in answered)
+            return answered.pending;
+        const shownCover = answered.cover;
+        return { ...answered.rows, coverage: shownCover.coverage };
     }
     function publishChangeSet(set) {
         applyChangeSet(set);
-        if (set.rooms.length > 0 ||
-            [...new Set(set.documents.map(({ locator }) => locator))].some((locator) => rooms.has(locator) && counted.get(locator) !== documentsIn(locator)))
-            emitRooms();
+        for (const { locator, path } of set.documents) {
+            if (path !== null)
+                store.attached.drop(locator, path);
+        }
+        const shownNow = [];
+        if (set.queues.length > 0 || set.drafts.length > 0)
+            shownNow.push(show());
+        if (set.rooms.length > 0)
+            shownNow.push(emitRooms(set.rooms));
+        else if (set.documents.length > 0) {
+            shownNow.push(publishRooms('counted', [...new Set(set.documents.map(({ locator }) => locator))]));
+        }
         for (const locator of set.queues)
-            emitQueue(locator);
-        if (set.drafts.length > 0 ||
-            set.documents.some((change) => roomDrafts.get(change.locator)?.has(change.path) === true)) {
-            publishRoomDrafts(false);
+            shownNow.push(emitQueue(locator));
+        if (set.drafts.length > 0)
+            shownNow.push(publishRoomDrafts(drafting, false));
+        else if (set.documents.length > 0) {
+            shownNow.push(publishRoomDrafts(drafting, false, set.documents));
         }
         for (const app of set.presentations)
-            emitPresentation(app);
+            shownNow.push(emitPresentation(drafting, app));
         conversations.changed(set);
-    }
-    function stopTimer() {
-        if (resetTimer === undefined)
-            return;
-        clearTimeout(resetTimer);
-        resetTimer = undefined;
-    }
-    function armTimer() {
-        stopTimer();
-        if (closed || stopping)
-            return;
-        let earliest = null;
-        for (const { submission } of pendings.values()) {
-            if (submission.state !== 'reset')
-                continue;
-            const at = Date.parse(submission.reset);
-            if (earliest === null || at < earliest)
-                earliest = at;
-        }
-        if (earliest === null)
-            return;
-        // A Save House held back goes again only once the reset its answer named has passed.
-        resetTimer = setTimeout(() => {
-            resetTimer = undefined;
-            submitAll();
-        }, Math.max(0, earliest - Date.now()));
+        return Promise.all(shownNow).then(() => undefined);
     }
     async function refuse(reason, provider = null) {
-        stopTimer();
         discoveryPaused = true;
+        socket.abortReads();
         try {
             if (reason === 'revoked-authorization') {
                 await exclusive(async () => {
                     const revoked = { status: 'unavailable', reason: 'revoked' };
+                    let held = new Map();
                     try {
                         const local = await openLocal();
-                        await local.revokeModels([...replicas.values()].map((replica) => replica.confirmed.record));
+                        held = await storedRooms();
+                        await local.commit({
+                            rooms: [...held.values()].map(({ record: kept }) => {
+                                const record = { ...kept, model: revoked };
+                                return {
+                                    locator: record.locator,
+                                    key: record.key,
+                                    record: storedRecord(record),
+                                    composed: composedOf(composed(record)),
+                                };
+                            }),
+                        });
                     }
                     catch {
                         journal.record('model revocation persistence failed');
                     }
-                    const keys = new Set(models.keys());
-                    for (const locator of rooms.keys()) {
-                        keys.add(modelKey(locator, 'collection'));
-                        keys.add(modelKey(locator, 'typed-selection'));
-                    }
-                    for (const key of keys) {
-                        invalidModels.add(key);
-                        models.set(key, revoked);
-                        liveModels.delete(key);
+                    const listedNow = listedLocators(held);
+                    for (const locator of listedNow) {
+                        if (!held.has(locator))
+                            unheldModels.set(locator, revoked);
                     }
-                    const changed = [];
-                    for (const [locator, room] of rooms) {
-                        const before = replicas.get(locator) ?? null;
-                        if (before !== null) {
-                            const record = {
-                                ...before.confirmed.record,
-                                model: revoked,
-                                selectionModel: revoked,
-                            };
-                            replicas.set(locator, replicaOf(confirmedOf(record, before.confirmed), before.queue, before));
-                        }
-                        rooms.set(locator, {
-                            ...room,
-                            model: modelTypes(revoked),
-                            typedSelection: room.typedSelection === null
-                                ? null
-                                : { ...room.typedSelection, model: modelTypes(revoked) },
-                        });
-                        changed.push(changeSet(locator, before, replicas.get(locator) ?? null, { room: true }));
-                    }
-                    publishChangeSet(mergeChangeSets(changed));
+                    publishChangeSet(mergeChangeSets(listedNow.map((locator) => changeSet(locator, { documents: null, room: true }))));
+                    prepare();
                 });
             }
         }
@@ -456,196 +1159,162 @@ export function composeRuntime(options) {
         }
     }
     function list(room, synchronizationAvailable) {
-        const selection = room.typedSelection ?? null;
-        rooms.set(room.locator, {
-            name: room.name,
-            locator: room.locator,
-            handle: room.handle,
-            operations: room.operations,
-            replica: room.replica,
-            model: modelTypes(modelOf(room.locator)),
-            typedSelection: selection === null
-                ? null
-                : {
-                    roots: selection.roots,
-                    model: modelTypes(modelOf(room.locator, 'typed-selection')),
-                },
-            providerOwnedPaths: room.providerOwnedPaths,
-            roomVersion: replicas.get(room.locator)?.confirmed.record.roomVersion ?? null,
-            synchronizationAvailable,
-            refusal: scopedRefusals.get(room.locator) ?? sourceRefusals.get(room.locator) ?? null,
+        if (isFenced(room.locator))
+            return;
+        declared.set(room.locator, {
+            room: {
+                name: room.name,
+                locator: room.locator,
+                handle: room.handle,
+                operations: room.operations,
+                replica: room.replica,
+                typedSelection: room.typedSelection ?? null,
+                providerOwnedPaths: room.providerOwnedPaths,
+            },
+            available: synchronizationAvailable,
         });
     }
-    async function applyDiscovery(listed, local) {
-        const listedLocators = new Set(listed.map((room) => room.locator));
-        for (const locator of listedLocators)
+    function listHeld(locator) {
+        if (isFenced(locator))
+            return;
+        declared.set(locator, { room: null, available: false });
+    }
+    async function applyDiscovery(found, started, left) {
+        const lockedBefore = await lockedRooms();
+        const local = await openLocal();
+        const stillFenced = new Set(await local.fences());
+        const relisting = found
+            .map(({ locator }) => locator)
+            .filter((locator) => {
+            const fence = store.fences.of(locator);
+            return stillFenced.has(locator) && (fence === undefined || fence.at < started);
+        });
+        const relisted = relisting.length === 0 ? new Set() : await durably((held) => held.unfence(relisting));
+        for (const { locator } of found) {
+            const fence = store.fences.of(locator);
+            if (fence === undefined || fence.at >= started)
+                continue;
+            if (relisted.has(locator) || (!stillFenced.has(locator) && !fence.written)) {
+                store.fences.lift(locator);
+            }
+        }
+        const kept = await local.held();
+        await loseRooms(found
+            .filter((room) => room.replica.admission !== 'admitted' &&
+            (kept.held.has(room.locator) || store.installs.of(room.locator).transfer !== null))
+            .map((room) => room.locator));
+        const listed = found.filter(({ locator }) => !isFenced(locator) && (!stillFenced.has(locator) || relisted.has(locator)));
+        const listedLocatorsNow = new Set(listed.map((room) => room.locator));
+        for (const locator of listedLocatorsNow)
             scopedRefusals.delete(locator);
-        discovered.clear();
+        if (left === undefined)
+            discovered.clear();
         for (const room of listed)
             discovered.set(room.locator, room);
-        await dropUnlisted(listedLocators, local);
+        const named = new Set(found.map((room) => room.locator));
+        await loseRooms(left ??
+            [...new Set([...declared.keys(), ...kept.held, ...store.installs.transferring()])].filter((locator) => !named.has(locator)));
+        const held = await storedRooms(listed.map((room) => room.locator));
         for (const room of listed) {
-            const held = replicas.get(room.locator)?.confirmed.record;
-            if (held !== undefined && held.replica.selection !== room.replica.selection) {
-                list(held, false);
+            const record = held.get(room.locator)?.record;
+            if (record !== undefined && record.replica.selection !== room.replica.selection) {
+                listHeld(room.locator);
                 continue;
             }
             list(room, room.replica.admission === 'admitted' && !unreadable.has(room.locator));
         }
+        confirmLocks(listed);
         roomsListed = true;
         emitRooms();
-    }
-    function unlistedHeld(listed) {
-        return [
-            ...new Set([
-                ...rooms.keys(),
-                ...roomDrafts.keys(),
-                ...transfers.keys(),
-                ...queuesWithoutReplica.keys(),
-            ]),
-        ].filter((locator) => !listed.has(locator));
-    }
-    async function dropUnlisted(listed, local) {
-        if (unlistedHeld(listed).length === 0)
+        await relocked(lockedBefore);
+        return listed;
+    }
+    function forget(locator) {
+        confirmed.delete(locator);
+        forgetInstall(store, locator);
+        declared.delete(locator);
+        discovered.delete(locator);
+        unreadable.delete(locator);
+        stale.delete(locator);
+        repairable.delete(locator);
+        unpreparable.delete(locator);
+        scopedRefusals.delete(locator);
+        unheldModels.delete(locator);
+        store.forget(locator);
+    }
+    async function eraseFenced(locators) {
+        for (const locator of locators) {
+            while (await durably((local) => local.erase(locator, ERASE_BATCH)))
+                await yielded();
+        }
+    }
+    let sweeping = false;
+    function sweep() {
+        if (sweeping || closed)
             return;
-        await exclusive(async () => {
-            const unlisted = unlistedHeld(listed);
-            await local.dropRooms(unlisted);
-            const removed = unlisted.map((locator) => changeSet(locator, replicas.get(locator) ?? null, null, {
-                room: true,
-                queue: true,
-                drafts: [...(roomDrafts.get(locator)?.keys() ?? [])],
-            }));
-            for (const locator of unlisted) {
-                for (const batch of replicas.get(locator)?.queue ?? queuesWithoutReplica.get(locator) ?? [])
-                    pendings.delete(batch.id);
-                replicas.delete(locator);
-                queuesWithoutReplica.delete(locator);
-                rooms.delete(locator);
-                roomDrafts.delete(locator);
-                transfers.delete(locator);
-                unreadable.delete(locator);
-                stale.delete(locator);
-                scopedRefusals.delete(locator);
-                sourceRefusals.delete(locator);
-                declarationRefusals.delete(locator);
-                for (const attached of ['collection', 'typed-selection']) {
-                    const key = modelKey(locator, attached);
-                    models.delete(key);
-                    liveModels.delete(key);
-                    invalidModels.delete(key);
+        sweeping = true;
+        void (async () => {
+            try {
+                while (!closed && (await durably((local) => local.erase(null, ERASE_BATCH)))) {
+                    await yielded();
                 }
-                journal.record(`room unlisted ${locator}`);
             }
-            publishChangeSet(mergeChangeSets(removed));
-            moveTo({ ...status, ...attention() });
-        });
-    }
-    function restored(key, persisted) {
-        const prior = models.get(key);
-        if (prior !== undefined &&
-            prior.status !== 'unavailable' &&
-            (persisted.status === 'unavailable' || !sameModel(prior.snapshot, persisted.snapshot))) {
-            invalidModels.add(key);
-        }
-        const model = persisted.status === 'unavailable' ||
-            liveModels.get(key) === JSON.stringify(persisted.snapshot)
-            ? persisted
-            : cached(persisted);
-        models.set(key, model);
-        if (model.status === 'unavailable') {
-            liveModels.delete(key);
-            invalidModels.delete(key);
-        }
-        return model;
-    }
-    async function hydrate(opened) {
-        const [records, queues, kept, presented, held, chatDrafts, lastCompleted, declared, named, known, staged,] = await Promise.all([
-            opened.all(),
-            opened.queues(),
-            opened.roomDrafts(),
-            opened.presentation(),
-            opened.conversations(),
-            opened.chatDrafts(),
-            opened.lastCompleted(),
-            opened.providerLimits(),
-            opened.capabilities(),
-            opened.member(),
-            opened.transfers(),
-        ]);
-        transfers.clear();
-        for (const record of staged)
-            transfers.set(record.locator, record);
-        limits = declared;
-        capabilities = named;
-        member = known;
-        roomDrafts.clear();
-        for (const record of kept)
-            rememberRoomDraft(record);
-        presentations.clear();
-        for (const record of presented)
-            presentations.set(record.app, record.value);
-        conversations.hydrate(held, chatDrafts);
-        const queuedBatches = new Map(queues.map((queue) => [queue.locator, queue.pending.map(({ batch }) => batch)]));
-        pendings.clear();
-        for (const queue of queues) {
-            for (const { batch, state } of queue.pending)
-                pendings.set(batch.id, state);
-        }
-        const previousReplicas = new Map(replicas);
-        replicas.clear();
-        queuesWithoutReplica.clear();
-        const replicated = new Set(records.map((record) => record.locator));
-        for (const [locator, queue] of queuedBatches) {
-            if (!replicated.has(locator))
-                queuesWithoutReplica.set(locator, queue);
-        }
-        for (const record of records) {
-            const model = restored(modelKey(record.locator, 'collection'), record.model);
-            const selectionModel = restored(modelKey(record.locator, 'typed-selection'), record.selectionModel);
-            const prior = previousReplicas.get(record.locator);
-            const confirmed = confirmedOf({ ...record, model, selectionModel }, prior?.confirmed);
-            replicas.set(record.locator, replicaOf(confirmed, queuedBatches.get(record.locator) ?? [], prior));
-            const existing = rooms.get(record.locator);
-            if (existing === undefined)
-                list(record, false);
-            else {
-                rooms.set(record.locator, {
-                    ...existing,
-                    roomVersion: record.roomVersion,
-                    operations: record.operations,
-                    replica: record.replica,
-                    model: modelTypes(model),
-                    typedSelection: record.typedSelection === null
-                        ? null
-                        : {
-                            roots: record.typedSelection.roots,
-                            model: modelTypes(selectionModel),
-                        },
-                });
+            catch {
+                journal.record('erasure failed');
+            }
+            finally {
+                sweeping = false;
             }
+        })();
+    }
+    function fenceLive(locators) {
+        for (const locator of new Set(locators)) {
+            if (!store.fences.raise(locator, discoveries))
+                continue;
+            forget(locator);
+            journal.record(`room lost ${locator}`);
         }
-        return {
-            lastCompleted,
-            locators: new Set([...queuedBatches.keys(), ...replicas.keys()]),
-            read: mergeChangeSets([...new Set([...previousReplicas.keys(), ...replicas.keys()])].map((locator) => changeSet(locator, previousReplicas.get(locator) ?? null, replicas.get(locator) ?? null))),
-        };
     }
-    async function readState(opened) {
-        const { lastCompleted, locators, read } = await hydrate(opened);
-        applyChangeSet(read);
-        if (replicas.size > 0)
-            emitRooms();
-        if (member !== null)
-            emitMember();
-        for (const locator of locators)
-            emitQueue(locator);
-        publishRoomDrafts(false);
-        return lastCompleted;
+    async function loseRooms(locators) {
+        fenceLive(locators);
+        const fresh = [...new Set(locators)].filter((locator) => {
+            const fence = store.fences.of(locator);
+            if (fence === undefined || fence.written)
+                return false;
+            store.fences.mark(locator, true);
+            return true;
+        });
+        if (fresh.length === 0)
+            return;
+        let held = [];
+        try {
+            await durably(async (local) => {
+                held = await local.roomDrafts();
+                await local.fence(fresh);
+            });
+        }
+        catch (error) {
+            for (const locator of fresh)
+                store.fences.mark(locator, false);
+            throw error;
+        }
+        finally {
+            publishChangeSet(mergeChangeSets(fresh.map((locator) => changeSet(locator, {
+                documents: null,
+                room: true,
+                queue: true,
+                drafts: held.filter((draft) => draft.locator === locator).map(({ path }) => path),
+            }))));
+            recoverReads();
+            moveTo(status);
+        }
+        await durably((local) => unpair(accepting, local));
+        await eraseFenced(fresh);
     }
-    async function open() {
-        const opened = await openRuntimeStore();
-        store = opened;
+    async function open(opened) {
+        if (closed)
+            throw new Error('runtime closed');
+        const interrupted = await opened.fences();
         const kept = options.shell.generation;
         const storedGeneration = await opened.generation();
         const loss = detectStorageLoss(storedGeneration, kept);
@@ -658,330 +1327,42 @@ export function composeRuntime(options) {
             storageLoss = loss;
             emitStorageLoss();
         }
-        const lastCompleted = await readState(opened);
-        moveTo({ ...status, lastCompleted, ...attention() });
-        return opened;
-    }
-    function durably(work) {
-        return exclusive(async () => {
-            const local = await openLocal();
-            return work(local);
-        });
-    }
-    function openLocal() {
-        opening ??= open().catch((error) => {
-            opening = undefined;
-            throw error;
-        });
-        return opening;
-    }
-    function exclusive(work) {
-        const next = mutations.then(work, work);
-        mutations = next.then(() => undefined, () => undefined);
-        return next;
-    }
-    function withdrawable(batch) {
-        const state = pendings.get(batch.id);
-        return state !== undefined && state.submission.state !== 'submitted' && !state.lost;
-    }
-    async function settle(local, locator, before, confirmed, queue, settling = {}) {
-        const previousQueue = before?.queue ?? queuesWithoutReplica.get(locator) ?? [];
-        const withdrawn = withdrawals(confirmed, queue, withdrawable, localSaves);
-        const kept = queue.filter((batch) => !withdrawn.includes(batch));
-        const unqueued = withdrawn.map((batch) => ({
-            batch,
-            returned: localSaves || landed(batch, confirmed) ? null : returnedBy('withdrawn'),
-        }));
-        const returning = [
-            ...[...unqueued].reverse(),
-            ...(settling.leaving === undefined ? [] : [settling.leaving]),
-        ];
-        const written = new Map();
-        for (const { batch, returned } of returning) {
-            if (returned === null)
-                continue;
-            for (const saved of pendings.get(batch.id)?.drafts ?? []) {
-                const existing = written.get(saved.path) ?? roomDrafts.get(locator)?.get(saved.path);
-                written.set(saved.path, {
-                    locator,
-                    path: saved.path,
-                    revision: roomDraftRevision(),
-                    parts: returnedInto(existing?.parts, saved.parts),
-                    returned,
-                });
-            }
-        }
-        await local.keepAuthored({ locator, queue: kept, roomDrafts: [...written.values()] });
-        for (const batch of previousQueue) {
-            if (!kept.includes(batch))
-                pendings.delete(batch.id);
-        }
-        for (const record of written.values())
-            rememberRoomDraft(record);
+        const held = await opened.opened();
+        heldWhenOpened = usableWhenHeld.length > 0 && (await opened.covering()).rooms.size > 0;
         try {
-            await local.write({
-                next: confirmed.record,
-                previous: before?.confirmed.record ?? null,
-                ...(settling.stored === undefined ? {} : { stored: settling.stored }),
-            });
+            await opened.demote();
+            await database.ask({ kind: 'read.builds', build });
+            for (const key of held.orphans)
+                await opened.release(key);
         }
         catch (error) {
-            const held = before === undefined ? null : replicaOf(before.confirmed, kept, before);
-            if (held !== null)
-                replicas.set(locator, held);
-            else if (kept.length > 0)
-                queuesWithoutReplica.set(locator, kept);
-            else
-                queuesWithoutReplica.delete(locator);
-            publishChangeSet(changeSet(locator, before ?? null, held, {
-                queue: kept.length !== previousQueue.length,
-                drafts: [...written.keys()],
-            }));
-            moveTo({ ...status, ...attention() });
-            throw error;
-        }
-        queuesWithoutReplica.delete(locator);
-        for (const { batch, returned } of unqueued) {
-            const outcome = localSaves ? 'dropped' : returned === null ? 'landed' : 'withdrawn';
-            journal.record(`outcome ${locator} ${batch.id} ${outcome}`);
-        }
-        replicas.set(locator, replicaOf(confirmed, kept, before));
-        return changeSet(locator, before ?? null, replicas.get(locator) ?? null, {
-            room: settling.room,
-            queue: kept.length !== previousQueue.length,
-            drafts: [...written.keys()],
-        });
-    }
-    function adoptModels(locator, record) {
-        for (const [attached, model] of [
-            ['collection', record.model],
-            ['typed-selection', record.selectionModel],
-        ]) {
-            const key = modelKey(locator, attached);
-            models.set(key, model);
-            invalidModels.delete(key);
-            if (model.status === 'current')
-                liveModels.set(key, JSON.stringify(model.snapshot));
-            else if (model.status === 'unavailable')
-                liveModels.delete(key);
-        }
-    }
-    function remodel(locator, answers, held) {
-        const taken = (answer, previous, attached) => {
-            if (answer === undefined)
-                return previous;
-            const { state, refused } = attachedModel(answer, previous);
-            if (refused !== null) {
-                const where = refused.location === undefined ? '' : ` ${refused.location}`;
-                journal.record(`model invalid ${locator} ${attached} ${refused.identity} ${refused.rule}${where}`);
-            }
-            models.set(modelKey(locator, attached), state);
-            return state;
-        };
-        return {
-            collection: taken(answers?.collection, held.collection, 'collection'),
-            selection: taken(answers?.selection, held.selection, 'typed-selection'),
-        };
-    }
-    function publish(local, room, confirmed, landing = {}) {
-        const { base, stored } = landing;
-        return exclusive(async () => {
-            if (!continuing())
-                return true;
-            const prior = replicas.get(room.locator);
-            if (base !== undefined &&
-                (prior?.confirmed.record.roomVersion !== base.record.roomVersion ||
-                    prior.confirmed.record.revisions !== base.record.revisions)) {
-                return false;
-            }
-            adoptModels(room.locator, confirmed.record);
-            const queue = prior?.queue ?? queuesWithoutReplica.get(room.locator) ?? [];
-            const roomVersion = confirmed.record.roomVersion;
-            const accepted = queue.filter((batch) => {
-                const accepted = pendings.get(batch.id)?.accepted;
-                return (accepted !== undefined && options.adapter.reached(room.locator, roomVersion, accepted));
-            });
-            const set = await settle(local, room.locator, prior, confirmed, queue.filter((batch) => !accepted.includes(batch)), { room: true, ...(stored === undefined ? {} : { stored }) });
-            if (stored !== undefined)
-                transfers.delete(room.locator);
-            for (const batch of accepted)
-                pendings.delete(batch.id);
-            stale.delete(room.locator);
-            if (unreadable.delete(room.locator))
-                scopedRefusals.delete(room.locator);
-            sourceRefusals.delete(room.locator);
-            declarationRefusals.delete(room.locator);
-            list(room, true);
-            publishChangeSet(set);
-            moveTo({ ...status, ...attention() });
-            return true;
-        });
-    }
-    async function saveRoomDrafts(locator, named, writtenBy) {
-        const local = await openLocal();
-        const replica = replicas.get(locator);
-        const room = rooms.get(locator);
-        if (replica === undefined || room === undefined) {
-            throw runtimeError('room-not-held', `No Local Replica for ${locator}`);
-        }
-        const saved = [];
-        for (const { path, revision } of named) {
-            const record = roomDrafts.get(locator)?.get(path);
-            if (record === undefined || record.revision !== revision) {
-                return { outcome: 'refused', code: 'stale', retryable: false, file: path };
-            }
-            if (!saved.some((draft) => draft.path === path))
-                saved.push({ path, parts: record.parts });
-        }
-        const changed = saved.flatMap(({ path, parts }) => changedParts(path, underneath(parts, path, replica.visible)));
-        if (changed.length > 0)
-            return { outcome: 'refused', code: 'changed-underneath', retryable: false, parts: changed };
-        const parts = saved.map(({ path, parts }) => changesOf(path, parts));
-        const changes = parts.flatMap(({ changes }) => changes);
-        const requeue = requeued(replica.queue, changes, replica.visible, withdrawable, (queue) => replicaOf(replica.confirmed, queue, replica).visible);
-        if (requeue.kind === 'refused')
-            return { outcome: 'refused', ...requeue.refusal };
-        const foreign = [...requeue.withdrawn.keys()].some((origin) => {
-            const writer = replica.queue.find((batch) => batch.id === origin)?.writtenBy;
-            return writer?.app !== writtenBy?.app || writer?.release !== writtenBy?.release;
-        });
-        if (foreign) {
-            return {
-                outcome: 'refused',
-                code: 'unknown-revision',
-                retryable: false,
-                file: [...requeue.queued].at(-1),
-            };
-        }
-        const withdrawing = requeue.withdrawn.size > 0;
-        const input = {
-            local: localSaves,
-            baseRoomVersion: replica.confirmed.record.roomVersion,
-            composition: compositionFor(replica.confirmed.record),
-            operations: room.operations,
-            providerOwnedPaths: room.providerOwnedPaths,
-            providerLimits: limits,
-            handle: room.handle,
-            visible: replica.visible,
-            changes,
-            bases: parts.flatMap(({ bases }) => bases),
-            writtenBy,
-        };
-        const checked = withdrawing ? buildBatch({ ...input, queued: requeue.queued }) : null;
-        if (checked?.kind === 'refused')
-            return { outcome: 'refused', ...checked.refusal };
-        const owners = [...requeue.owners].flatMap((origin) => {
-            const batch = requeue.withdrawn.get(origin);
-            return batch === undefined || batch === null ? [] : [{ origin, batch }];
-        });
-        if (owners.length > 1) {
-            return {
-                outcome: 'refused',
-                code: 'unknown-revision',
-                retryable: false,
-                file: [...requeue.queued].at(-1),
-            };
-        }
-        const built = !withdrawing
-            ? buildBatch(input)
-            : requeue.changes.length === 0
-                ? null
-                : buildBatch({
-                    ...input,
-                    visible: replicaOf(replica.confirmed, requeue.queue, replica).visible,
-                    changes: requeue.changes,
-                });
-        if (built?.kind === 'refused')
-            return { outcome: 'refused', ...built.refusal };
-        const [owner] = owners;
-        const join = built === null || owner === undefined
-            ? null
-            : joined(requeue.queue, owner.batch, built.batch);
-        if (join?.kind === 'refused')
-            return { outcome: 'refused', ...join.refusal };
-        const withdrawn = new Map(requeue.withdrawn);
-        if (join !== null && owner !== undefined)
-            withdrawn.set(owner.origin, join.batch);
-        const drafted = new Map();
-        for (const [origin, replaced] of withdrawn) {
-            if (replaced === null)
-                continue;
-            const carried = withdrawnDrafts(pendings.get(origin)?.drafts ?? [], changes);
-            drafted.set(replaced.id, replaced === join?.batch
-                ? [
-                    ...carried.map((held) => joinedDraft(held, saved)),
-                    ...saved.filter((draft) => !carried.some((held) => held.path === draft.path)),
-                ]
-                : carried);
-        }
-        if (built !== null && join === null)
-            drafted.set(built.batch.id, saved);
-        const batches = join !== null ? join.queue : built === null ? requeue.queue : [...requeue.queue, built.batch];
-        for (const replaced of withdrawn.values()) {
-            if (replaced === null || !batches.includes(replaced))
-                continue;
-            const limited = limitedIn(batches, replaced, limits, (queue) => replicaOf(replica.confirmed, queue, replica).visible);
-            if (limited !== null)
-                return { outcome: 'refused', ...limited };
-        }
-        const consumed = saved.map(({ path }) => path);
-        try {
-            await local.keepAuthored({
-                locator,
-                queue: batches,
-                saved: drafted,
-                consumedRoomDrafts: consumed,
-            });
-        }
-        catch {
-            return { outcome: 'refused', code: 'durable-write', retryable: true };
-        }
-        for (const origin of withdrawn.keys())
-            pendings.delete(origin);
-        for (const [id, drafts] of drafted) {
-            pendings.set(id, { drafts, submission: { state: 'waiting' }, lost: false });
-        }
-        if (!localSaves)
-            recorded = false;
-        for (const path of consumed)
-            forgetRoomDraft(locator, path);
-        replicas.set(locator, replicaOf(replica.confirmed, batches, replica));
-        publishChangeSet(changeSet(locator, replica, replicas.get(locator) ?? null, {
-            queue: true,
-            drafts: consumed,
-        }));
-        moveTo({ ...(localSaves ? status : saving(status)), ...attention() });
-        submitLater(locator);
-        const identifier = join?.batch.id ??
-            built?.batch.id ??
-            [...requeue.withdrawn].map(([origin, replaced]) => replaced?.id ?? origin).at(-1);
-        return { outcome: 'saved', identifier };
-    }
-    async function mark(local, locator, identifier, submission, lost) {
-        const state = pendings.get(identifier);
-        if (!continuing() ||
-            state === undefined ||
-            (JSON.stringify(state.submission) === JSON.stringify(submission) && state.lost === lost)) {
-            return;
+            if (!refusedForSpace(error))
+                throw error;
+        }
+        if (held.erasing || held.orphans.length > 0)
+            queueMicrotask(sweep);
+        await conversations.opened(opened);
+        if (interrupted.length > 0) {
+            queueMicrotask(() => {
+                void eraseFenced(interrupted).catch(() => {
+                    journal.record('erasure failed');
+                });
+            });
         }
-        await local.submit(locator, identifier, submission, lost);
-        pendings.set(identifier, { ...state, submission, lost });
-        const replica = replicas.get(locator);
-        if (replica !== undefined)
-            publishChangeSet(changeSet(locator, replica, replica, { queue: true }));
-        moveTo({ ...status, ...attention() });
-    }
-    async function keepUpload(local, locator, identifier, upload) {
-        if (!continuing())
-            throw new Error('connection refused');
-        await local.keepUpload(locator, identifier, upload);
-        pendings.set(identifier, { ...pendings.get(identifier), upload });
-        if (!continuing())
-            throw new Error('connection refused');
+        moveTo(status);
+        prepare();
+        emitRooms();
+        void exclusive(() => unpair(accepting, opened)).catch(() => {
+            journal.record('unpair failed');
+        });
+        return opened;
     }
     async function readHistory(locator, path, query = {}) {
         if (closed || refusal !== null)
             return UNCERTAIN;
+        await firstDiscovery;
+        if (!roomsNamed)
+            return UNCERTAIN;
         try {
             await ensureAuthorization();
         }
@@ -990,6 +1371,7 @@ export function composeRuntime(options) {
         }
         if (closed || authorization === undefined || refusal !== null)
             return UNCERTAIN;
+        const since = store.fences.count();
         const transfer = ['transfer', 'history', locator, path];
         if (query.revision !== undefined)
             transfer.push(query.revision);
@@ -1004,8 +1386,10 @@ export function composeRuntime(options) {
                 ...(query.pageToken === undefined ? {} : { pageToken: query.pageToken }),
             });
             journal.record(`outcome history ${result.kind}`);
+            if (store.fences.since(locator, since))
+                return failure({ kind: 'room-not-readable', locator });
             if (result.kind === 'scoped-refusal') {
-                const room = replicas.get(result.locator)?.confirmed.record;
+                const room = await recordAt(result.locator);
                 if (room !== undefined)
                     await scoped(result, room, await openLocal());
             }
@@ -1018,99 +1402,48 @@ export function composeRuntime(options) {
             return UNCERTAIN;
         }
     }
-    function queuedBlob(locator, path, localId) {
-        for (const batch of replicas.get(locator)?.queue ?? []) {
-            const change = batch.changes[queuedFile(batch, path, localId)];
-            if (change?.kind === 'binary')
-                return change.blob;
-        }
-        return null;
-    }
-    async function readBinary(request) {
-        if (closed || refusal !== null)
-            return UNCERTAIN;
-        try {
-            await ensureAuthorization();
-        }
-        catch {
-            return UNCERTAIN;
-        }
-        if (closed || authorization === undefined || refusal !== null)
-            return UNCERTAIN;
-        journal.record(request.kind === 'path'
-            ? `transfer binary ${request.locator} ${request.path}`
-            : `transfer binary ${request.fileRef}`);
-        try {
-            const result = await options.adapter.binary(authorization, request);
-            journal.record(`outcome binary ${result.kind}`);
-            if (result.kind === 'scoped-refusal') {
-                const room = replicas.get(result.locator)?.confirmed.record;
-                if (room !== undefined)
-                    await scoped(result, room, await openLocal());
-            }
-            if (result.kind === 'revoked-authorization')
-                await refuse('revoked-authorization');
-            return binaryAnswer(result);
-        }
-        catch {
-            journal.record('outcome binary transport-uncertainty');
-            return UNCERTAIN;
-        }
-    }
-    async function readBinaryPath(locator, path, revision) {
-        await ready;
-        if (revision !== undefined)
-            return readBinary({ kind: 'path', locator, path, revision });
-        const visible = replicas.get(locator)?.visible;
-        const held = visible?.binaries[path];
-        if (visible === undefined || held === undefined)
-            return absentBinary(path);
-        if (held.state === 'pending') {
-            const blob = queuedBlob(locator, path, held.localId);
-            return blob === null ? absentBinary(path) : { kind: 'binary', blob };
-        }
-        const record = binaryRecord(path, held, visible.revisions[path]);
-        if (record.state !== 'accepted')
-            return absentBinary(path);
-        const replica = replicas.get(locator);
-        const queued = (replica?.queue ?? []).flatMap((batch) => batch.changes);
-        const holds = (at) => {
-            const kept = replica?.confirmed.record.binaries[at];
-            return (kept?.state === 'accepted' &&
-                kept.fileRef === record.fileRef &&
-                replica?.confirmed.record.revisions[at] === record.revision);
-        };
-        let confirmed = path;
-        for (let index = queued.length - 1; index >= 0 && !holds(confirmed); index -= 1) {
-            const change = queued[index];
-            if (change.kind === 'move' && change.to === confirmed)
-                confirmed = change.path;
-        }
-        return readBinary({
-            kind: 'path',
-            locator,
-            path: confirmed,
-            revision: record.revision,
-            fileRef: record.fileRef,
-        });
-    }
-    async function readBinaryReference(reference) {
-        await ready;
-        return readBinary({
-            kind: 'reference',
-            fileRef: reference.fileRef,
-            referrer: reference.referrer,
-        });
-    }
-    function declaredAgents() {
-        for (const capability of capabilities) {
-            if (capability.conversationAgents !== undefined)
-                return capability.conversationAgents;
-        }
-        return undefined;
-    }
-    function declaredAction(name) {
-        for (const capability of capabilities) {
+    async function located(room, path, destination) {
+        const crossing = roomTarget(destination);
+        const listing = await listingNow();
+        if (crossing === null) {
+            const named = target(path, destination);
+            return named === null || !listing.has(room) ? null : { room, path: named };
+        }
+        const held = [...listing.values()].find((listed) => listed.handle === crossing.handle);
+        return held === undefined ? null : { room: held.locator, path: crossing.path };
+    }
+    async function resolveReference(room, path, destination) {
+        if (roomTarget(destination) === null && target(path, destination) === null) {
+            return ABSENT_TARGET;
+        }
+        const at = await located(room, path, destination);
+        if (at === null)
+            return UNREADABLE;
+        if (await locked(at.room))
+            return LOCKED_UNREADABLE;
+        const held = await recordAt(at.room);
+        if (held !== undefined &&
+            (await (await openLocal()).entries(held.key, 'visible', [at.path])).length > 0) {
+            return { kind: 'document', ...at };
+        }
+        const history = await readHistory(at.room, at.path);
+        if (history.kind === 'no-history' || history.kind === 'revision')
+            return ABSENT_TARGET;
+        if (history.kind !== 'history')
+            return history;
+        const [last] = history.revisions;
+        if (last === undefined)
+            return ABSENT_TARGET;
+        return history.deleted === true
+            ? { kind: 'deleted', ...at, revision: last }
+            : { kind: 'document', ...at };
+    }
+    async function cleanUp() {
+        const freed = await database.ask({ kind: 'opened.clean' });
+        return freed + ((await options.shell.cleanUp?.()) ?? 0);
+    }
+    async function declaredAction(name) {
+        for (const capability of (await (await openLocal()).facts()).capabilities) {
             for (const action of capability.actions ?? []) {
                 if (action.name === name)
                     return action;
@@ -1118,11 +1451,18 @@ export function composeRuntime(options) {
         }
         return undefined;
     }
-    async function invokeAction(name, input) {
+    async function calledRooms(name, input) {
+        const member = (await declaredAction(name))?.room;
+        if (member === undefined || input === null || typeof input !== 'object')
+            return [];
+        const named = input[member];
+        return (Array.isArray(named) ? named : [named]).filter((room) => typeof room === 'string');
+    }
+    async function invokeAction(name, input, dispatching) {
         await ready;
         if (closed || refusal !== null)
             return UNCERTAIN;
-        if (declaredAction(name) === undefined)
+        if ((await declaredAction(name)) === undefined)
             return undeclared(name);
         try {
             await ensureAuthorization();
@@ -1132,11 +1472,12 @@ export function composeRuntime(options) {
         }
         if (closed || authorization === undefined || refusal !== null)
             return UNCERTAIN;
+        await dispatching?.();
         journal.record(`transfer action ${name}`);
         try {
             const result = await options.adapter.action(authorization, { name, input });
             if (result.kind === 'scoped-refusal') {
-                const room = replicas.get(result.locator)?.confirmed.record;
+                const room = await recordAt(result.locator);
                 if (room !== undefined)
                     await scoped(result, room, await openLocal());
             }
@@ -1152,113 +1493,158 @@ export function composeRuntime(options) {
             return UNCERTAIN;
         }
     }
-    function continuing() {
-        return !closed && !discoveryPaused;
-    }
-    function reachedBy(locator, roomVersion) {
-        const held = replicas.get(locator);
-        return (held !== undefined &&
-            options.adapter.reached(locator, held.confirmed.record.roomVersion, roomVersion));
-    }
-    function writtenAfter(locator, roomVersion, path) {
-        const written = replicas.get(locator)?.confirmed.record.written[path];
-        return (written !== undefined &&
-            options.adapter.reached(locator, written, roomVersion) &&
-            !options.adapter.reached(locator, roomVersion, written));
-    }
-    async function pullRefresh(authorized, confirmed) {
-        if (!continuing())
-            return unconfirmed;
+    async function readConversationHistory(request) {
+        await ready;
+        const stream = options.adapter.conversations;
+        if (closed || refusal !== null || stream?.history === undefined)
+            return UNCERTAIN;
+        journal.record('transfer conversation history');
         try {
-            const result = await refreshRoom(options.adapter, authorized, confirmed, (models, held) => remodel(confirmed.record.locator, models, held), continuing);
-            const detail = result.kind === 'advanced' ? result.confirmed.record.roomVersion : result.kind;
-            journal.record(`transfer refresh ${confirmed.record.locator} ${detail}`);
-            return result;
+            const result = await stream.history(request);
+            if (result.kind === 'revoked-authorization')
+                await refuse('revoked-authorization');
+            journal.record(`outcome conversation history ${result.kind}`);
+            return calledResult(result);
         }
-        catch (error) {
-            journal.record(`transfer refresh ${confirmed.record.locator} transport-uncertainty`);
-            throw error;
+        catch {
+            journal.record('outcome conversation history transport-uncertainty');
+            return UNCERTAIN;
         }
     }
-    function staging(local) {
-        return {
-            held: (locator) => transfers.get(locator) ?? null,
-            staged: (record) => local.staged(record),
-            stage: (record, page) => exclusive(async () => {
-                if (!continuing())
-                    return false;
-                await local.stage(record, page);
-                transfers.set(record.locator, record);
-                return true;
-            }),
-            abandon: (locator) => exclusive(async () => {
-                if (!continuing())
-                    return;
-                await local.abandon(locator);
-                transfers.delete(locator);
-            }),
-        };
+    function unsettled(result) {
+        return result.kind !== 'action' && result.retryable;
     }
-    async function pullBootstrap(authorized, room, local) {
-        if (!continuing())
-            return unconfirmed;
+    async function recoveredAction(name, input) {
+        const operation = operationOf(input);
+        if (operation === null)
+            return invokeAction(name, input);
+        const kept = async () => (await openLocal()).keepCall({ operation, name, input });
+        calling.add(operation);
         try {
-            const result = await bootstrapRoom(options.adapter, authorized, room, {
-                collection: modelOf(room.locator),
-                selection: modelOf(room.locator, 'typed-selection'),
-            }, (models, held) => remodel(room.locator, models, held), continuing, staging(local));
-            const detail = result.kind === 'staged' ? result.confirmed.record.roomVersion : result.kind;
-            journal.record(`transfer bootstrap ${room.locator} ${detail}`);
+            let result = await invokeAction(name, input, kept);
+            if (unsettled(result)) {
+                await recovery.attempt(`action ${operation}`, async () => {
+                    if (closed || refusal !== null)
+                        return 'done';
+                    if (!socket.isOpen())
+                        return 'again';
+                    result = await invokeAction(name, input, kept);
+                    return unsettled(result) ? 'again' : 'done';
+                }, { again: true });
+            }
+            if (!unsettled(result))
+                await (await openLocal()).dropCall(operation);
             return result;
         }
-        catch (error) {
-            journal.record(`transfer bootstrap ${room.locator} transport-uncertainty`);
-            throw error;
+        finally {
+            calling.delete(operation);
         }
     }
-    async function advance(room, local, authorized) {
-        const held = replicas.get(room.locator);
-        if (held !== undefined) {
-            const refreshed = await pullRefresh(authorized, held.confirmed);
-            if (!continuing())
-                return unconfirmed;
-            if (refreshed.kind === 'still-current') {
-                stale.delete(room.locator);
-                if (sourceRefusals.has(room.locator))
-                    return null;
-                if (unreadable.delete(room.locator)) {
-                    scopedRefusals.delete(room.locator);
-                    list(room, true);
-                    emitRooms();
-                }
-                return null;
+    async function resendCalls(signal) {
+        if (!socket.isOpen() || closed || stopping)
+            return 'done';
+        const local = await openLocal();
+        for (const held of await local.calls()) {
+            if (calling.has(held.operation))
+                continue;
+            if (closed || signal.aborted)
+                return 'done';
+            calling.add(held.operation);
+            try {
+                if (unsettled(await invokeAction(held.name, held.input)))
+                    return 'again';
+                await local.dropCall(held.operation);
             }
-            if (refreshed.kind === 'advanced') {
-                if (!(await publish(local, room, refreshed.confirmed, { base: held.confirmed }))) {
-                    const now = replicas.get(room.locator)?.confirmed.record.roomVersion;
-                    const reached = now !== undefined &&
-                        options.adapter.reached(room.locator, now, refreshed.confirmed.record.roomVersion);
-                    return reached ? null : advance(room, local, authorized);
-                }
-                await retainModel(local, room, 'collection', modelOf(room.locator));
-                return null;
+            finally {
+                calling.delete(held.operation);
             }
-            if (refreshed.kind !== 'beyond-horizon')
-                return refreshed;
         }
-        const bootstrapped = await pullBootstrap(authorized, room, local);
-        if (!continuing())
+        return 'done';
+    }
+    function continuing() {
+        return !closed && !discoveryPaused;
+    }
+    async function advance(room, local, authorized, running, unheld) {
+        const live = () => running() && !full;
+        if (!live())
             return unconfirmed;
+        const held = unheld === undefined ? await recordAt(room.locator) : undefined;
+        if (options.adapter.roomStream !== undefined &&
+            (held !== undefined || !store.installs.of(room.locator).beyondHorizon)) {
+            stale.delete(room.locator);
+            await name(room.locator);
+            return null;
+        }
+        const refresh = reads.refresh;
+        if (held !== undefined && refresh !== undefined) {
+            const refreshed = await store.ahead((hold) => refreshedRoom(room, local, authorized, held, live, hold, refresh));
+            if (refreshed === 'behind')
+                return advance(room, local, authorized, live);
+            if (refreshed !== 'beyond-horizon')
+                return refreshed;
+            if (reloadsDue.has(room.locator))
+                return unconfirmed;
+            replaced(store, [room.locator]);
+        }
+        const prior = held === undefined ? undefined : await recordAt(room.locator);
+        const from = standingAt(store, room.locator, prior);
+        const bootstrapped = await pullBootstrap(installer, authorized, room, local, live, prior, reads, unheld);
         if (bootstrapped.kind !== 'staged')
-            return bootstrapped;
-        await publish(local, room, bootstrapped.confirmed, { stored: bootstrapped.stored });
-        return null;
+            return live() ? bootstrapped : unconfirmed;
+        const landing = { kind: 'bootstrapped', refreshed: bootstrapped.refreshed, from };
+        if (await publish(installer, local, room, bootstrapped.record, landing, live)) {
+            return live() ? null : unconfirmed;
+        }
+        return (await reachedBy(installer, room.locator, bootstrapped.record.roomVersion))
+            ? null
+            : advance(room, local, authorized, live);
     }
-    async function withhold(withheld, room, local, progress) {
-        if (withheld.kind === 'refused')
+    async function refreshedRoom(room, local, authorized, held, live, hold, refresh) {
+        const refreshed = await pullRefresh(installer, authorized, held, live, hold, refresh);
+        if (!live())
+            return unconfirmed;
+        if (refreshed.kind === 'still-current') {
             stale.delete(room.locator);
+            if (unreadable.delete(room.locator)) {
+                scopedRefusals.delete(room.locator);
+                list(room, true);
+                emitRooms();
+            }
+            return null;
+        }
+        if (refreshed.kind === 'advanced') {
+            const landing = {
+                kind: 'refreshed',
+                from: refreshed.from,
+                remodelled: refreshed.remodelled,
+            };
+            if (!(await publish(installer, local, room, refreshed.record, landing, live))) {
+                const now = (await recordAt(room.locator))?.roomVersion;
+                const reached = now !== undefined &&
+                    options.adapter.reached(room.locator, now, refreshed.record.roomVersion);
+                return reached ? null : 'behind';
+            }
+            await retainModel(local, room, null);
+            return null;
+        }
+        return refreshed.kind === 'beyond-horizon' ? 'beyond-horizon' : refreshed;
+    }
+    async function withhold(withheld, room, local, progress) {
+        if (withheld.kind === 'unconfirmed' || isFenced(room.locator))
+            return;
+        if (withheld.kind === 'not-ready') {
+            progress.complete = false;
+            askAgain(room.locator);
+            return;
+        }
+        stale.add(room.locator);
+        if (withheld.kind === 'transport-uncertainty' || withheld.kind === 'retryable-refusal') {
+            const reset = withheld.kind === 'retryable-refusal' ? withheld.reset : undefined;
+            repairable.set(room.locator, reset);
+            repairLater(room.locator, reset === undefined ? { again: true } : { at: Date.parse(reset) });
+        }
         else
-            stale.add(room.locator);
+            repairable.delete(room.locator);
         if (withheld.kind === 'scoped-refusal') {
             await scoped(withheld, room, local);
         }
@@ -1269,308 +1655,141 @@ export function composeRuntime(options) {
             journal.record(`refusal ${withheld.kind} ${withheld.code}`);
         }
         else if (withheld.kind === 'room-not-readable') {
-            unreadable.add(room.locator);
-            list(room, false);
-            emitRooms();
-        }
-        else if (withheld.kind === 'refused') {
-            refusedSource(room, withheld);
+            roomUnreadable(room);
         }
         else if (withheld.kind === 'revoked-authorization') {
             await refuse('revoked-authorization');
         }
     }
-    function refusedSource(room, { refusal }) {
-        sourceRefusals.set(room.locator, {
-            code: refusal.rule,
-            retryable: false,
-            fields: {
-                file: refusal.file,
-                ...(refusal.location === undefined ? {} : { location: refusal.location }),
-                ...(refusal.referrers === undefined ? {} : { referrers: refusal.referrers }),
-            },
-        });
-        declarationRefusals.delete(room.locator);
+    function roomUnreadable(room) {
         unreadable.add(room.locator);
         list(room, false);
         emitRooms();
-        journal.record(`source refused ${room.locator} ${refusal.rule} ${refusal.file}`);
-    }
-    function leaving(batch, result) {
-        if (result.kind === 'expired')
-            return { batch, returned: returnedBy('expired') };
-        return {
-            batch,
-            returned: {
-                kind: result.kind,
-                code: result.code,
-                fields: result.fields,
-                retryable: result.retryable,
-            },
-        };
-    }
-    function logAccepted(locator, submitted, accepted) {
-        journal.record(`outcome ${locator} ${submitted.id} accepted ${accepted.roomVersion}` +
-            (accepted.author === undefined ? '' : ` author ${accepted.author}`) +
-            (accepted.time === undefined ? '' : ` time ${accepted.time}`));
-    }
-    async function adoptAccepted(room, local, submitted, accepted) {
-        if (!continuing())
-            return unconfirmed;
-        const current = replicas.get(room.locator);
-        if (current === undefined || !current.queue.some((batch) => batch.id === submitted.id)) {
-            return null;
-        }
-        const held = current.confirmed.record.roomVersion;
-        logAccepted(room.locator, submitted, accepted);
-        const applied = options.adapter.reached(room.locator, held, accepted.roomVersion)
-            ? { kind: 'staged', confirmed: current.confirmed }
-            : applyReturned(current.confirmed, submitted, accepted, options.adapter.follows(room.locator, held, accepted.roomVersion)
-                ? accepted.roomVersion
-                : held, accepted.roomVersion);
-        if (applied.kind !== 'staged') {
-            const state = pendings.get(submitted.id);
-            await local.accept(room.locator, submitted.id, accepted.roomVersion);
-            if (state !== undefined)
-                pendings.set(submitted.id, { ...state, accepted: accepted.roomVersion });
-            emitQueue(room.locator);
-            return applied;
-        }
-        const set = await settle(local, room.locator, current, applied.confirmed, current.queue.filter((batch) => batch.id !== submitted.id), { room: true });
-        pendings.delete(submitted.id);
-        unreadable.delete(room.locator);
-        sourceRefusals.delete(room.locator);
-        declarationRefusals.delete(room.locator);
-        list(room, true);
-        publishChangeSet(set);
-        moveTo({ ...status, ...attention() });
-        return null;
-    }
-    async function adopted(room, local, submitted, accepted) {
-        const failed = await exclusive(() => adoptAccepted(room, local, submitted, accepted));
-        if (failed === null)
-            return true;
-        if (failed.kind === 'refused' && continuing())
-            refusedSource(room, failed);
-        return false;
     }
-    async function submitRoom(room, local, authorized, progress) {
-        while (continuing() && authorization !== undefined) {
-            const replica = replicas.get(room.locator);
-            const head = replica?.queue[0];
-            if (replica === undefined || head === undefined)
-                return;
-            if (pendings.get(head.id)?.accepted !== undefined)
-                return;
-            const state = pendings.get(head.id);
-            const { submission, lost: earlier } = state ?? {
-                submission: { state: 'waiting' },
-                lost: false,
-            };
-            if (submission.state === 'reset' && Date.now() < Date.parse(submission.reset)) {
-                progress.complete = false;
-                return;
-            }
-            if (writesHeld()) {
-                progress.complete = false;
-                journal.record(`submission ${room.locator} ${head.id} held`);
-                return;
-            }
-            const lost = earlier || submission.state === 'submitted';
-            let result;
-            journal.record(`submission ${room.locator} ${head.id}`);
-            await exclusive(() => mark(local, room.locator, head.id, { state: 'submitted' }, lost));
-            if (discoveryPaused)
-                return;
-            if (writesHeld()) {
-                await exclusive(() => mark(local, room.locator, head.id, submission, earlier));
-                progress.complete = false;
-                journal.record(`submission ${room.locator} ${head.id} held`);
-                return;
-            }
-            const opensBefore = openSignals;
-            const answered = awaitingAnswer(room.locator);
-            try {
-                result = await options.adapter.mutate(authorized, {
-                    locator: room.locator,
-                    changeBatch: head,
-                    ...(state?.upload === undefined ? {} : { upload: state.upload }),
-                }, (upload) => exclusive(() => keepUpload(local, room.locator, head.id, upload)));
-            }
-            catch {
-                answered();
-                progress.complete = false;
-                if (continuing())
-                    progress.reachable = false;
+    function askAgain(locator) {
+        const held = unready.get(locator) ?? { tries: 0, timer: null };
+        unready.set(locator, held);
+        if (held.timer !== null)
+            return;
+        const wait = NOT_READY_MS[Math.min(held.tries, NOT_READY_MS.length - 1)];
+        held.tries += 1;
+        held.timer = setTimeout(() => {
+            held.timer = null;
+            const room = discovered.get(locator);
+            const unstreamed = options.adapter.roomStream === undefined;
+            if (closed || stopping || (!unstreamed && !socket.isOpen()) || room === undefined)
                 return;
-            }
-            if (result.kind !== 'accepted' || !continuing())
-                answered();
+            const progress = { complete: true, reachable: true };
+            void openLocal()
+                .then((local) => roomTask(locator, (live) => loadRoom(room, local, progress, live)))
+                .then(() => rest(progress), () => undefined);
+        }, wait);
+    }
+    function readied(locator) {
+        const held = unready.get(locator);
+        if (held === undefined)
+            return;
+        if (held.timer !== null)
+            clearTimeout(held.timer);
+        unready.delete(locator);
+    }
+    function unreadied() {
+        for (const locator of [...unready.keys()])
+            readied(locator);
+    }
+    function declaredAsHeld(held, room) {
+        return (held === undefined ||
+            (JSON.stringify(held.operations) === JSON.stringify(room.operations) &&
+                JSON.stringify(held.replica) === JSON.stringify(room.replica) &&
+                JSON.stringify(held.providerOwnedPaths) === JSON.stringify(room.providerOwnedPaths) &&
+                JSON.stringify(held.typedSelection) === JSON.stringify(room.typedSelection ?? null)));
+    }
+    async function keepNaming(local, room) {
+        const held = await recordAt(room.locator);
+        if (held === undefined || (held.name === room.name && held.handle === room.handle))
+            return;
+        await exclusive(async () => {
             if (!continuing())
                 return;
-            if (result.kind === 'transport-uncertainty') {
-                progress.complete = false;
-                progress.reachable = false;
-                return;
-            }
-            if (result.kind === 'room-not-readable') {
-                progress.complete = false;
-                unreadable.add(room.locator);
-                list(room, false);
-                emitRooms();
-                return;
-            }
-            if (result.kind === 'revoked-authorization') {
-                await refuse('revoked-authorization');
-                return;
-            }
-            if (result.kind === 'scoped-refusal') {
-                await scoped(result, room, local);
-                progress.complete = false;
-                return;
-            }
-            if (result.kind === 'write-halted') {
-                journal.record(`outcome ${room.locator} ${head.id} write-halted`);
-                await exclusive(() => mark(local, room.locator, head.id, { state: 'waiting' }, lost));
-                if (serviceMode === 'open' && openSignals !== opensBefore)
-                    continue;
-                haltedRefusal = true;
-                progress.complete = false;
-                return;
-            }
-            if (result.kind === 'conflicted' ||
-                result.kind === 'rejected' ||
-                result.kind === 'expired' ||
-                result.kind === 'retryable-refusal') {
-                if (result.kind === 'expired') {
-                    const withheld = await advance(room, local, authorized);
-                    if (withheld !== null)
-                        return withhold(withheld, room, local, progress);
-                }
-                journal.record(`outcome ${room.locator} ${head.id} ${result.kind}` +
-                    (result.kind === 'conflicted' && result.roomVersion !== undefined
-                        ? ` ${result.roomVersion}`
-                        : ''));
-                if (result.kind !== 'expired')
-                    journal.record(`refusal ${result.kind} ${result.code}`);
-            }
-            if (result.kind === 'retryable-refusal') {
-                const reset = result.reset;
-                progress.complete = false;
-                await exclusive(() => mark(local, room.locator, head.id, reset === undefined ? { state: 'waiting' } : { state: 'reset', reset }, lost));
-                armTimer();
-                return;
-            }
-            if (result.kind === 'conflicted' || result.kind === 'rejected' || result.kind === 'expired') {
-                const left = leaving(head, result);
-                await exclusive(async () => {
-                    if (!continuing())
-                        return;
-                    const current = replicas.get(room.locator);
-                    if (current === undefined || !current.queue.some((batch) => batch.id === head.id)) {
-                        return;
-                    }
-                    const set = await settle(local, room.locator, current, current.confirmed, current.queue.filter((batch) => batch.id !== head.id), {
-                        leaving: (result.kind === 'expired' && landed(head, current.confirmed)) ||
-                            (result.kind === 'conflicted' && landed(head, current.confirmed, result.affected))
-                            ? { ...left, returned: null }
-                            : left,
-                    });
-                    publishChangeSet(set);
-                    moveTo({ ...status, ...attention() });
-                });
-                if (result.kind === 'expired')
-                    continue;
-                const withheld = await advance(room, local, authorized);
-                if (withheld !== null)
-                    return withhold(withheld, room, local, progress);
-                continue;
-            }
-            const kept = await adopted(room, local, head, result).finally(answered);
-            if (!kept) {
-                progress.complete = false;
+            const current = await recordAt(room.locator);
+            if (current === undefined)
                 return;
-            }
-        }
-    }
-    function awaitingAnswer(locator) {
-        let release = () => { };
-        const awaited = new Promise((resolve) => {
-            release = resolve;
+            const record = { ...current, name: room.name, handle: room.handle };
+            await local.commit({
+                rooms: [
+                    {
+                        locator: room.locator,
+                        key: record.key,
+                        record: storedRecord(record),
+                        composed: composedOf(composed(record)),
+                    },
+                ],
+            });
+            emitRooms();
         });
-        answering.set(locator, awaited);
-        return () => {
-            if (answering.get(locator) === awaited)
-                answering.delete(locator);
-            release();
-        };
     }
-    async function retainModel(local, room, attached, next) {
-        const key = modelKey(room.locator, attached);
-        const previous = modelOf(room.locator, attached);
-        const heldBefore = replicas.get(room.locator)?.confirmed.record;
-        if (JSON.stringify(previous) === JSON.stringify(next) &&
-            (heldBefore === undefined ||
-                (JSON.stringify(heldBefore.operations) === JSON.stringify(room.operations) &&
-                    JSON.stringify(heldBefore.replica) === JSON.stringify(room.replica) &&
-                    JSON.stringify(heldBefore.typedSelection) ===
-                        JSON.stringify(room.typedSelection ?? null))))
+    async function modelNow(locator) {
+        return (await recordAt(locator))?.model ?? unheldModels.get(locator) ?? NO_MODEL;
+    }
+    async function retainModel(local, room, given) {
+        const held = await recordAt(room.locator);
+        const previous = held?.model ?? unheldModels.get(room.locator) ?? NO_MODEL;
+        const next = given ?? previous;
+        if (JSON.stringify(previous) === JSON.stringify(next) && declaredAsHeld(held, room))
             return;
-        if (next.status === 'unavailable') {
-            invalidModels.add(key);
-            liveModels.delete(key);
-        }
         await exclusive(async () => {
             if (!continuing())
                 return;
-            const held = replicas.get(room.locator);
-            if (held !== undefined) {
-                const declared = {
-                    ...held.confirmed.record,
+            const work = await workOf(room.locator);
+            const current = work.replica;
+            let changed = null;
+            if (current !== undefined) {
+                const record = {
+                    ...current.record,
+                    name: room.name,
+                    handle: room.handle,
                     operations: room.operations,
                     replica: room.replica,
+                    providerOwnedPaths: room.providerOwnedPaths,
                     typedSelection: room.typedSelection ?? null,
-                    ...(attached === 'collection' ? { model: next } : { selectionModel: next }),
+                    model: next,
                 };
-                const reclassified = sameMembership(declared, held.confirmed.record)
-                    ? { kind: 'staged', confirmed: confirmedOf(declared, held.confirmed) }
-                    : readReclassified(declared, held.confirmed);
-                const record = reclassified.kind === 'staged'
-                    ? declared
-                    : {
-                        ...declared,
-                        typedSelection: held.confirmed.record.typedSelection,
-                    };
-                const read = reclassified.kind === 'deferred'
-                    ? { kind: 'staged', confirmed: confirmedOf(record, held.confirmed) }
-                    : reclassified;
-                await local.write({ next: record, previous: held.confirmed.record });
-                if (read.kind === 'staged') {
-                    replicas.set(room.locator, replicaOf(read.confirmed, held.queue, held));
-                    if (declarationRefusals.delete(room.locator)) {
-                        sourceRefusals.delete(room.locator);
-                        unreadable.delete(room.locator);
-                    }
-                }
-                else if (read.kind === 'refused') {
-                    replicas.set(room.locator, { ...held, confirmed: { ...held.confirmed, record } });
-                    refusedSource(room, read);
-                    declarationRefusals.add(room.locator);
-                }
-            }
-            models.set(key, next);
-            if (next.status === 'current') {
-                liveModels.set(key, JSON.stringify(next.snapshot));
-                invalidModels.delete(key);
+                const confirmedLayer = await sliceAt(store, record, 'confirmed', current.queue, current.overlaid);
+                const replayedLayer = await replayed(store, record, confirmedLayer, current.queue);
+                const diff = await overlayDiff(record, current, replayedLayer.visible, replayedLayer.touched);
+                const answer = await local.commit({
+                    rooms: [
+                        {
+                            locator: room.locator,
+                            key: record.key,
+                            record: storedRecord(record),
+                            roots: record.typedSelection?.roots ?? [],
+                            composed: composedOf(composed(record)),
+                            overlay: diff.overlay,
+                        },
+                    ],
+                });
+                preparedAfter(saver, room.locator, answer);
+                changed = changeSet(room.locator, {
+                    documents: answer.changed[room.locator] ?? [],
+                    room: true,
+                });
             }
+            else
+                unheldModels.set(room.locator, next);
             list(room, room.replica.admission === 'admitted' && !unreadable.has(room.locator));
-            if (held === undefined)
+            if (changed === null)
                 emitRooms();
             else
-                publishChangeSet(changeSet(room.locator, held, replicas.get(room.locator) ?? null, { room: true }));
+                publishChangeSet(changed);
         });
     }
     async function scoped(result, room, local) {
+        if (result.scope === 'content' && !result.retryable) {
+            journal.record(`scoped refusal ${room.locator} ${result.scope} ${result.code}`);
+            await loseRooms([room.locator]);
+            return;
+        }
         scopedRefusals.set(room.locator, {
             code: result.code,
             fields: result.fields,
@@ -1578,22 +1797,14 @@ export function composeRuntime(options) {
         });
         let scopedAway = room;
         if (result.scope === 'model')
-            await retainModel(local, room, 'collection', {
+            await retainModel(local, room, {
                 status: 'unavailable',
                 reason: 'not-readable',
             });
         else if (result.scope !== 'operation') {
             unreadable.add(room.locator);
-            scopedAway = {
-                ...room,
-                replica: { ...room.replica, admission: 'unavailable' },
-                operations: {
-                    ...room.operations,
-                    ...(result.scope === 'content' ? { read: [] } : {}),
-                    ...(result.scope === 'sync' ? { sync: [] } : {}),
-                },
-            };
-            await retainModel(local, scopedAway, 'collection', modelOf(room.locator));
+            scopedAway = { ...room, replica: { ...room.replica, admission: 'unavailable' } };
+            await retainModel(local, scopedAway, null);
         }
         if (!continuing())
             return;
@@ -1601,131 +1812,182 @@ export function composeRuntime(options) {
         emitRooms();
         journal.record(`scoped refusal ${room.locator} ${result.scope} ${result.code}`);
     }
-    function heldRooms(listed) {
+    async function name(locator) {
+        const room = discovered.get(locator);
+        if (!socket.streamed || room === undefined || !socket.isOpen() || !socket.isHanded())
+            return;
+        const [held] = await heldRooms([room]);
+        if (held === undefined || !socket.isOpen() || !socket.isHanded())
+            return;
+        socket.name(held);
+    }
+    async function heldRooms(listed) {
+        const stored = await storedRooms(listed.map((room) => room.locator));
         return listed.flatMap((room) => {
-            const record = replicas.get(room.locator)?.confirmed.record;
-            if (record === undefined || record.replica.selection !== room.replica.selection)
+            const record = stored.get(room.locator)?.record;
+            if (record === undefined) {
+                return room.replica.admission === 'admitted'
+                    ? [{ locator: room.locator, roomVersion: null }]
+                    : [];
+            }
+            if (record.replica.selection !== room.replica.selection)
                 return [];
-            return [
-                {
-                    locator: room.locator,
-                    roomVersion: record.roomVersion,
-                    documents: record.documents,
-                    revisions: record.revisions,
-                },
-            ];
+            return [{ locator: room.locator, roomVersion: record.roomVersion }];
         });
     }
-    async function synchronize(listed, local, progress, attempt) {
-        const prepared = await Promise.allSettled(listed.map((room) => prepareRoom(room, local, progress)));
+    async function synchronize(listed, local, progress, attempt, live) {
+        const heldNow = await storedRooms(listed.map(({ locator }) => locator));
+        const prepared = await Promise.allSettled(listed.map((room) => prepareRoom(room, local, progress, heldNow.get(room.locator)?.record)));
+        if (!live())
+            return;
         const ready = listed.filter((_, index) => {
             const outcome = prepared[index];
             return outcome?.status === 'fulfilled' && outcome.value;
         });
+        const held = await heldRooms(ready);
+        if (!live())
+            return;
         if (attempt === 'opened') {
-            options.adapter.roomStream?.hold(heldRooms(ready));
-            handed = true;
+            socket.hand(held);
+        }
+        const kept = attempt === 'unstreamed'
+            ? new Set()
+            : new Set((await storedRooms(ready.map(({ locator }) => locator))).keys());
+        for (const room of ready) {
+            if (attempt === 'opened' || kept.has(room.locator)) {
+                if (attempt === 'authorized')
+                    await name(room.locator);
+                continue;
+            }
+            void roomTask(room.locator, (live) => loadRoom(room, local, progress, live)).then(() => rest(progress));
         }
-        const loaded = await Promise.allSettled(ready
-            .filter((room) => attempt === 'unstreamed' || !replicas.has(room.locator))
-            .map((room) => loadRoom(room, local, progress)));
-        const failed = [...prepared, ...loaded].find((room) => room.status === 'rejected');
+        const failed = prepared.find((room) => room.status === 'rejected');
         if (failed !== undefined)
             throw failed.reason;
     }
-    async function prepareRoom(room, local, progress) {
+    async function prepareRoom(room, local, progress, prior) {
         if (closed || authorization === undefined) {
             progress.complete = false;
             return false;
         }
-        const prior = replicas.get(room.locator)?.confirmed.record;
         if (prior !== undefined && prior.replica.selection !== room.replica.selection) {
-            list(prior, false);
+            listHeld(room.locator);
             emitRooms();
             journal.record(`selection changed ${room.locator}`);
             progress.complete = false;
             return false;
         }
-        if (prior !== undefined)
-            await retainModel(local, room, 'collection', modelOf(room.locator));
+        if (prior !== undefined && !declaredAsHeld(prior, room))
+            await retainModel(local, room, null);
+        if (prior !== undefined && (prior.name !== room.name || prior.handle !== room.handle)) {
+            await keepNaming(local, room);
+        }
         if (discoveryPaused || authorization === undefined)
             return false;
-        if (room.replica.admission !== 'admitted') {
-            if (replicas.has(room.locator))
-                progress.complete = false;
-            return false;
-        }
-        return true;
+        return room.replica.admission === 'admitted';
     }
-    async function caughtUp(room, local, progress) {
-        const held = replicas.get(room.locator)?.confirmed.record.roomVersion;
-        if (held === undefined || authorization === undefined)
+    async function caughtUp(room, local, progress, live) {
+        if (options.adapter.roomStream !== undefined || authorization === undefined)
             return;
-        const behind = [announced.get(room.locator), room.roomVersion].some((later) => later !== undefined && !options.adapter.reached(room.locator, held, later));
-        if (!behind)
+        if (!live() || !(await behind(installer, room)))
             return;
-        const withheld = await advance(room, local, authorization);
+        const withheld = await advance(room, local, authorization, live);
         if (withheld !== null)
             await withhold(withheld, room, local, progress);
     }
-    function revoked(locator) {
-        return ['collection', 'typed-selection'].some((attached) => {
-            const model = modelOf(locator, attached);
-            return model.status === 'unavailable' && model.reason === 'revoked';
-        });
+    function revoked(model) {
+        return model?.status === 'unavailable' && model.reason === 'revoked';
     }
-    async function loadRoom(room, local, progress) {
-        if (discoveryPaused || authorization === undefined)
-            return;
-        if (replicas.has(room.locator) && revoked(room.locator)) {
-            await reload(room, local, progress);
+    async function loadRoom(room, local, progress, live, unheld) {
+        if (!live() || authorization === undefined)
             return;
+        const prior = unheld === undefined ? await recordAt(room.locator) : undefined;
+        if (prior !== undefined) {
+            if (!(await prepareRoom(room, local, progress, prior)))
+                return;
+            if (revoked(prior.model)) {
+                await reload(room, local, progress, live);
+                return;
+            }
         }
-        const withheld = await advance(room, local, authorization);
+        const withheld = await advance(room, local, authorization, live, unheld);
         if (withheld !== null) {
             await withhold(withheld, room, local, progress);
             return;
         }
-        await caughtUp(room, local, progress);
+        await caughtUp(room, local, progress, live);
+    }
+    async function reload(room, local, progress, live) {
+        try {
+            if (live())
+                reloadsDue.delete(room.locator);
+            if (!live() || authorization === undefined)
+                return;
+            const prior = await recordAt(room.locator);
+            const from = standingAt(store, room.locator, prior);
+            const bootstrapped = await pullBootstrap(installer, authorization, room, local, live, prior);
+            if (bootstrapped.kind !== 'staged') {
+                if (live())
+                    await withhold(bootstrapped, room, local, progress);
+                return;
+            }
+            await publish(installer, local, room, bootstrapped.record, { kind: 'bootstrapped', refreshed: bootstrapped.refreshed, from }, live);
+            await caughtUp(room, local, progress, live);
+        }
+        finally {
+            caughtUpTo(installer, room.locator);
+        }
+    }
+    async function asked(authorized) {
+        try {
+            return (await options.adapter.discover?.(authorized)) ?? { kind: 'transport-uncertainty' };
+        }
+        catch {
+            return { kind: 'transport-uncertainty' };
+        }
+    }
+    function malformed(listed) {
+        for (const room of listed) {
+            if (room.operations === undefined ||
+                !['write', 'erase'].every((operation) => Array.isArray(room.operations[operation]) &&
+                    room.operations[operation].every((scope) => typeof scope === 'string')) ||
+                room.replica === undefined ||
+                typeof room.replica.selection !== 'string' ||
+                room.replica.selection.length === 0 ||
+                !['admitted', 'unavailable'].includes(room.replica.admission) ||
+                !['locked', 'open'].includes(room.replica.offline)) {
+                return `invalid model or replica declaration ${room.locator}`;
+            }
+            if (!declaredSelection(room))
+                return `invalid typed selection declaration ${room.locator}`;
+        }
+        return null;
     }
-    async function reload(room, local, progress) {
-        if (discoveryPaused || authorization === undefined)
-            return;
-        const bootstrapped = await pullBootstrap(authorization, room, local);
-        if (!continuing())
+    async function signIn(local, signedIn) {
+        if (JSON.stringify(signedIn) === JSON.stringify((await local.facts()).member))
             return;
-        if (bootstrapped.kind !== 'staged') {
-            await withhold(bootstrapped, room, local, progress);
-            return;
-        }
-        await publish(local, room, bootstrapped.confirmed, { stored: bootstrapped.stored });
-        await caughtUp(room, local, progress);
+        await local.fact('member', signedIn);
+        emitMember(signedIn);
     }
-    async function discoverRooms(local, progress, attempt) {
+    async function discoverRooms(local, progress, attempt, live, found) {
         if (closed || authorization === undefined) {
             notifyReady();
             return;
         }
-        moveTo(transferring(status));
-        let result;
-        try {
-            result = await options.adapter.discover(authorization);
-        }
-        catch {
-            result = { kind: 'transport-uncertainty' };
-        }
-        if (closed) {
+        moveTo(transferring());
+        discoveries += 1;
+        const started = discoveries;
+        const result = found ?? (await asked(authorization));
+        if (result.kind === 'discovery')
+            roomsNamed = true;
+        if (!live()) {
+            progress.complete = false;
             notifyReady();
             return;
         }
         journal.record(`connection discover ${result.kind}`);
         if (result.kind === 'transport-uncertainty') {
-            for (const room of rooms.values()) {
-                await retainModel(local, room, 'collection', cached(modelOf(room.locator)));
-                if (room.typedSelection !== null) {
-                    await retainModel(local, room, 'typed-selection', cached(modelOf(room.locator, 'typed-selection')));
-                }
-            }
+            await cachedModels(local);
             progress.reachable = false;
             progress.complete = false;
             notifyReady();
@@ -1746,46 +2008,26 @@ export function composeRuntime(options) {
             notifyReady();
             return;
         }
-        for (const room of result.rooms) {
-            if (room.operations === undefined ||
-                !['read', 'sync', 'write', 'delete'].every((operation) => Array.isArray(room.operations[operation]) &&
-                    room.operations[operation].every((scope) => typeof scope === 'string')) ||
-                room.replica === undefined ||
-                typeof room.replica.selection !== 'string' ||
-                room.replica.selection.length === 0 ||
-                !['admitted', 'unavailable'].includes(room.replica.admission)) {
-                journal.record(`invalid model or replica declaration ${room.locator}`);
-                await refuse('missing-required-guarantee');
-                notifyReady();
-                return;
-            }
-            if (!declaredSelection(room)) {
-                journal.record(`invalid typed selection declaration ${room.locator}`);
-                await refuse('missing-required-guarantee');
-                notifyReady();
-                return;
-            }
+        const invalid = malformed(result.rooms);
+        if (invalid !== null) {
+            journal.record(invalid);
+            await refuse('missing-required-guarantee');
+            notifyReady();
+            return;
         }
         if (refusal !== null) {
             refusal = null;
             emitRefusal();
         }
-        const previousCapabilities = capabilities;
-        capabilities = result.capabilities;
-        notifyReady();
-        if (JSON.stringify(result.providerLimits) !== JSON.stringify(limits) ||
-            JSON.stringify(result.capabilities) !== JSON.stringify(previousCapabilities)) {
-            limits = result.providerLimits;
-            await local.declare(limits, capabilities);
-        }
-        const signedIn = result.member ?? null;
-        if (JSON.stringify(signedIn) !== JSON.stringify(member)) {
-            await local.keepMember(signedIn);
-            member = signedIn;
-            emitMember();
+        const held = await local.facts();
+        if (JSON.stringify(result.providerLimits) !== JSON.stringify(held.providerLimits) ||
+            JSON.stringify(result.capabilities) !== JSON.stringify(held.capabilities)) {
+            await local.fact('providerLimits', result.providerLimits);
+            await local.fact('capabilities', result.capabilities);
         }
-        await applyDiscovery(result.rooms, local);
-        await synchronize(result.rooms, local, progress, attempt);
+        notifyReady();
+        await signIn(local, result.member ?? null);
+        await synchronize(await applyDiscovery(result.rooms, started), local, progress, attempt, live);
     }
     async function ensureAuthorization() {
         if (authorization !== undefined)
@@ -1799,16 +2041,66 @@ export function composeRuntime(options) {
             throw error;
         }
     }
-    function task(work) {
+    async function admittedRead(work) {
+        while (roomReads.free === 0) {
+            await new Promise((admit) => roomReads.waiting.push(admit));
+        }
+        roomReads.free -= 1;
+        try {
+            await work();
+        }
+        finally {
+            roomReads.free += 1;
+            roomReads.waiting.shift()?.();
+        }
+    }
+    function inRoom(locator, work) {
+        roomWork += 1;
+        const ran = (roomLanes.get(locator) ?? Promise.resolve()).then(async () => {
+            try {
+                return await work(continuing);
+            }
+            finally {
+                roomWork -= 1;
+            }
+        });
+        const chain = ran.then(() => undefined, () => undefined);
+        roomLanes.set(locator, chain);
+        working.add(chain);
+        void chain.finally(() => {
+            working.delete(chain);
+            if (roomLanes.get(locator) === chain)
+                roomLanes.delete(locator);
+        });
+        return ran;
+    }
+    function roomTask(locator, work) {
         if (stopping)
-            return chain;
-        chain = chain.then(work, work).catch(() => undefined);
-        return chain;
+            return Promise.resolve();
+        return inRoom(locator, (live) => admittedRead(() => work(live))).catch(() => undefined);
     }
-    function sync(attempt) {
-        return task(async () => {
-            if (closed || stopping || discoveryPaused) {
-                notifyReady();
+    function advanced(room, local, authorized) {
+        return inRoom(room.locator, (live) => advance(room, local, authorized, live));
+    }
+    function task(lane, work) {
+        if (stopping)
+            return Promise.resolve();
+        const held = lanes.get(lane);
+        const opened = socket.generation();
+        const current = held?.generation === opened ? held : { generation: opened, chain: Promise.resolve() };
+        const turn = current.generation;
+        const live = () => turn === socket.generation() && continuing();
+        const run = current.chain.then(() => work(live)).catch(() => undefined);
+        current.chain = run;
+        lanes.set(lane, current);
+        working.add(run);
+        void run.finally(() => working.delete(run));
+        return run;
+    }
+    function sync(attempt, found) {
+        return task(OPENING_LANE, async (live) => {
+            if (!live()) {
+                readyFromStore();
                 return;
             }
             const progress = { complete: true, reachable: true };
@@ -1817,40 +2109,100 @@ export function composeRuntime(options) {
                 streamed = progress;
             complete = false;
             recorded = false;
-            moveTo(transferring(status));
-            handed = false;
+            moveTo(transferring());
             try {
                 const local = await openLocal();
-                if (closed)
+                if (!live())
                     return;
                 await ensureAuthorization();
-                if (closed)
+                if (!live())
                     return;
-                await discoverRooms(local, progress, attempt);
+                await discoverRooms(local, progress, attempt, live, found);
             }
             catch {
                 progress.complete = false;
-                if (attempt === 'opened' && !handed)
+                if (attempt === 'opened' && !socket.isHanded())
                     progress.reachable = false;
             }
             finally {
                 notifyReady();
             }
+            if (!live())
+                return;
             if (attempt !== 'opened') {
-                await finishOpening(progress);
+                await finishOpening(progress, live);
                 return;
             }
-            if (handed || closed || progress.reachable)
+            if (socket.isHanded() || closed || progress.reachable)
                 return;
             underway = null;
-            journal.record('connection reopen');
-            await rest(progress);
-            options.adapter.roomStream?.reopen();
+            await rest(progress, live);
+        });
+    }
+    function resynchronize() {
+        return task(OPENING_LANE, async (live) => {
+            if (!live() || !socket.isAnnounced())
+                return;
+            const progress = { complete: true, reachable: true };
+            moveTo(transferring());
+            try {
+                const local = await openLocal();
+                if (!live())
+                    return;
+                await synchronize([...discovered.values()], local, progress, 'unstreamed', live);
+            }
+            catch {
+                progress.complete = false;
+            }
+            if (live())
+                await finishOpening(progress, live);
+        });
+    }
+    function countAuthorityChange() {
+        authorityChanges += 1;
+        for (const listener of authorityChangeListeners)
+            listener(authorityChanges);
+        lastAnswers.again();
+    }
+    function changeAuthority(change) {
+        return task(OPENING_LANE, async (live) => {
+            if (!live() || !socket.isAnnounced())
+                return;
+            countAuthorityChange();
+            const progress = { complete: true, reachable: true };
+            moveTo(transferring());
+            try {
+                const local = await openLocal();
+                if (!live())
+                    return;
+                const invalid = malformed(change.rooms);
+                if (invalid !== null) {
+                    journal.record(invalid);
+                    await refuse('missing-required-guarantee');
+                    return;
+                }
+                if (change.member !== undefined)
+                    await signIn(local, change.member);
+                discoveries += 1;
+                const listed = await applyDiscovery(change.rooms, discoveries, change.left);
+                await synchronize(listed, local, progress, 'authorized', live);
+            }
+            catch {
+                progress.complete = false;
+            }
+            if (!live())
+                return;
+            if (!progress.complete)
+                complete = false;
+            await rest(progress, live);
         });
     }
-    function closedSocket(revoked) {
-        const opened = socketOpen;
-        socketOpen = false;
+    function closedSocket(revoked, lost, opened) {
+        notifyReady();
+        unreadied();
+        connectionLost();
+        if (lost)
+            conversations.lost();
         if (revoked) {
             void refuse('revoked-authorization');
             return;
@@ -1861,201 +2213,366 @@ export function composeRuntime(options) {
         moveTo({
             ...status,
             state: status.state === 'synced' ? 'syncing' : status.state,
-            providerUnreachable: status.providerUnreachable || !opened,
+            providerUnreachable: status.providerUnreachable || (!opened && lost),
         });
+        void closing(opened);
     }
-    function applyOpening(expired) {
-        return task(async () => {
-            const progress = underway;
-            underway = null;
-            if (closed || stopping)
+    function closing(opened) {
+        return task(OPENING_LANE, async (live) => {
+            if (!live())
+                return;
+            const local = await openLocal();
+            if (!opened && !socket.isOpen())
+                await cachedModels(local);
+            await rest(null, live);
+        });
+    }
+    async function cachedModels(local) {
+        const held = await storedRooms();
+        await settleModels(listedLocators(held).flatMap((locator) => {
+            const room = discovered.get(locator) ?? declarationOf(locator, held.get(locator))?.room;
+            return room === undefined ? [] : [room];
+        }), 'cached', local);
+    }
+    function caughtUpRooms(expired) {
+        const progress = underway;
+        underway = null;
+        socket.named();
+        const cycle = progress ?? { complete: true, reachable: true };
+        replaced(store, expired);
+        const installing = store.installs.underway();
+        const held = progress === null ? storedRooms(expired) : storedRooms();
+        const reloading = progress === null
+            ? Promise.resolve([])
+            : held.then((stored) => owedReloads(expired, stored));
+        const replacing = Promise.all([held, reloading]).then(([stored, owed]) => reloadNow((room) => expired.includes(room.locator) || owed.includes(room.locator), cycle, stored, installing));
+        return task(OPENING_LANE, async (live) => {
+            if (!live())
                 return;
             if (progress === null) {
-                await reloadExpired(expired);
+                await replacing;
+                await rest(cycle, live);
                 return;
             }
             try {
                 const local = await openLocal();
-                const held = [...discovered.values()].filter((room) => replicas.has(room.locator));
-                const reloading = held.filter((room) => expired.includes(room.locator) || revoked(room.locator));
-                const reloaded = await Promise.allSettled(reloading.map((room) => reload(room, local, progress)));
+                await replacing;
                 if (progress.reachable) {
-                    for (const room of held)
-                        if (!reloading.includes(room))
-                            await confirmModels(room, local);
+                    const stored = await held;
+                    const owed = await reloading;
+                    await settleModels([...discovered.values()].filter((room) => stored.has(room.locator) &&
+                        !expired.includes(room.locator) &&
+                        !owed.includes(room.locator)), 'current', local);
                 }
-                const failed = reloaded.find((outcome) => outcome.status === 'rejected');
-                if (failed !== undefined)
-                    throw failed.reason;
             }
             catch {
                 progress.complete = false;
                 progress.reachable = false;
             }
-            await finishOpening(progress);
+            if (live())
+                await finishOpening(progress, live);
         });
     }
-    async function reloadExpired(expired) {
-        const progress = { complete: true, reachable: true };
+    function owedReloads(expired, held) {
+        const reloading = [...discovered.values()]
+            .filter((room) => !expired.includes(room.locator) && revoked(held.get(room.locator)?.record.model))
+            .map((room) => room.locator);
+        for (const locator of reloading)
+            catching(store, locator);
+        recoverReads();
+        return reloading;
+    }
+    async function reloadNow(replaced, progress, held, installing) {
+        const reloaded = [...discovered.values()].filter((room) => held.has(room.locator) && !installing.has(room.locator) && replaced(room));
+        const acquired = [...discovered.values()].filter((room) => (!held.has(room.locator) || installing.has(room.locator)) &&
+            room.replica.admission === 'admitted' &&
+            replaced(room));
+        for (const room of reloaded)
+            reloadsDue.add(room.locator);
         try {
             const local = await openLocal();
-            await Promise.allSettled([...discovered.values()]
-                .filter((room) => replicas.has(room.locator) && expired.includes(room.locator))
-                .map((room) => reload(room, local, progress)));
+            const kept = acquired.length === 0 ? new Set() : (await local.held()).staged;
+            for (const room of reloaded) {
+                void roomTask(room.locator, (live) => reload(room, local, progress, live)).then(() => rest(progress));
+            }
+            for (const room of acquired) {
+                const unheld = installing.has(room.locator)
+                    ? undefined
+                    : { staged: kept.has(room.locator) };
+                void roomTask(room.locator, (live) => loadRoom(room, local, progress, live, unheld)).then(() => rest(progress));
+            }
         }
         catch {
+            for (const room of reloaded)
+                reloadsDue.delete(room.locator);
             progress.reachable = false;
         }
-        await rest(progress);
     }
-    async function confirmModels(room, local) {
-        for (const attached of ['collection', 'typed-selection']) {
-            const model = modelOf(room.locator, attached);
-            if (model.status === 'cached') {
-                await retainModel(local, room, attached, { ...model, status: 'current' });
+    async function settleModels(held, status, local) {
+        const owed = (model) => model.status !== 'unavailable' && model.status !== status;
+        const declaredAnew = await exclusive(async () => {
+            if (!continuing())
+                return [];
+            const stored = await storedRooms(held.map(({ locator }) => locator));
+            const unchanged = held.filter((room) => {
+                const record = stored.get(room.locator)?.record;
+                return (owed(record?.model ?? unheldModels.get(room.locator) ?? NO_MODEL) &&
+                    declaredAsHeld(record, room));
+            });
+            const records = unchanged.flatMap((room) => {
+                const record = stored.get(room.locator)?.record;
+                return record === undefined
+                    ? []
+                    : [{ ...record, model: { ...record.model, status } }];
+            });
+            if (records.length > 0) {
+                try {
+                    await local.commit({
+                        rooms: records.map((record) => ({
+                            locator: record.locator,
+                            key: record.key,
+                            record: storedRecord(record),
+                            composed: composedOf(composed(record)),
+                        })),
+                    });
+                }
+                catch {
+                    journal.record(`model ${status} persistence failed`);
+                }
+            }
+            for (const room of unchanged) {
+                const unheld = unheldModels.get(room.locator);
+                if (!stored.has(room.locator) && unheld !== undefined) {
+                    unheldModels.set(room.locator, { ...unheld, status });
+                }
+                list(room, room.replica.admission === 'admitted' && !unreadable.has(room.locator));
             }
+            if (unchanged.length > 0)
+                emitRooms();
+            return held.filter((room) => {
+                const record = stored.get(room.locator)?.record;
+                return (!unchanged.includes(room) &&
+                    owed(record?.model ?? unheldModels.get(room.locator) ?? NO_MODEL));
+            });
+        });
+        for (const room of declaredAnew) {
+            const model = await modelNow(room.locator);
+            if (owed(model))
+                await retainModel(local, room, { ...model, status });
         }
     }
-    function submitLater(locator) {
-        if (localSaves)
-            return;
-        const running = submitting.get(locator);
-        if (running !== undefined) {
-            running.again = true;
+    function repairLater(locator, when) {
+        if (!socket.isOpen() || repairing.has(locator))
             return;
+        void recovery.attempt(`repair ${locator}`, (signal) => repairPass(locator, signal), when);
+    }
+    async function repairPass(locator, signal) {
+        const room = discovered.get(locator);
+        if (!socket.isOpen() || closed || stopping || discoveryPaused || !stale.has(locator))
+            return 'done';
+        if (room === undefined || room.replica.admission !== 'admitted')
+            return 'done';
+        const progress = { complete: true, reachable: true };
+        repairing.add(locator);
+        try {
+            const local = await openLocal();
+            await roomTask(locator, async (live) => {
+                if (!live() || authorization === undefined)
+                    return;
+                const withheld = await advance(room, local, authorization, live);
+                if (withheld !== null && live())
+                    await withhold(withheld, room, local, progress);
+            });
         }
-        const run = { again: false, done: Promise.resolve() };
-        submitting.set(locator, run);
-        run.done = (async () => {
-            try {
-                do {
-                    run.again = false;
-                    const room = discovered.get(locator);
-                    if (closed || stopping || discoveryPaused || room === undefined)
-                        return;
-                    const progress = { complete: true, reachable: true };
-                    try {
-                        await ensureAuthorization();
-                        if (authorization === undefined)
-                            return;
-                        await submitRoom(room, await openLocal(), authorization, progress);
-                    }
-                    catch {
-                        progress.reachable = false;
-                    }
-                    armTimer();
-                    await rest(progress);
-                } while (run.again);
-            }
-            finally {
-                submitting.delete(locator);
-            }
-        })();
+        catch {
+            stale.add(locator);
+            progress.reachable = false;
+        }
+        finally {
+            repairing.delete(locator);
+        }
+        if (signal.aborted)
+            return 'done';
+        await rest(progress);
+        if (!stale.has(locator)) {
+            if ((await (await openLocal()).order(locator)).length > 0)
+                submitLater(accepting, locator);
+            return 'done';
+        }
+        if (!repairable.has(locator))
+            return 'done';
+        const reset = repairable.get(locator);
+        return reset === undefined ? 'again' : { at: Date.parse(reset) };
+    }
+    function resendLater() {
+        if (!socket.isOpen())
+            return;
+        void recovery.attempt('resend', resendPass, { again: true });
     }
-    function submitAll() {
-        for (const [locator, replica] of replicas) {
-            if (replica.queue.length > 0)
-                submitLater(locator);
+    async function resendPass(signal) {
+        if (!socket.isOpen() || closed || stopping || discoveryPaused)
+            return 'done';
+        const reading = { complete: true, reachable: true };
+        try {
+            await conversations.resend(reading);
+        }
+        catch {
+            reading.reachable = false;
         }
+        if (signal.aborted)
+            return 'done';
+        return reading.reachable && reading.complete ? 'done' : 'again';
     }
-    async function finishOpening(progress) {
+    async function finishOpening(progress, live) {
         try {
-            if (closed || discoveryPaused) {
+            if (!live()) {
                 progress.complete = false;
                 return;
             }
-            submitAll();
+            await submitAll(accepting);
+            for (const locator of stale)
+                if (repairable.has(locator))
+                    repairLater(locator, {});
             await conversations.reconcile();
-            if (status.providerUnreachable)
-                conversations.reconnected();
             const reading = { complete: true, reachable: true };
             await conversations.catchUp(reading);
-            if (!reading.reachable)
+            if (progress.reachable && reading.reachable)
+                await conversations.resend(reading);
+            if (progress.reachable)
+                void recovery.attempt('calls', resendCalls);
+            if (!reading.reachable) {
                 progress.reachable = false;
+                resendLater();
+            }
         }
         catch {
             progress.complete = false;
         }
         finally {
-            complete = progress.complete;
-            await rest(progress);
+            if (live()) {
+                complete = progress.complete;
+                await rest(progress, live);
+            }
         }
     }
-    async function rest(progress) {
-        if (closed)
+    async function rest(progress, live = () => !closed) {
+        if (!live())
             return;
-        let lastCompleted = status.lastCompleted;
-        let synced = complete && stale.size === 0 && !pending();
+        const settled = () => complete && roomWork === 0 && !socket.naming() && stale.size === 0;
+        let synced = settled();
+        if (synced && !recorded) {
+            const queued = await queuedWork().catch(() => true);
+            if (!live())
+                return;
+            synced = !queued && settled();
+        }
         if (synced && !recorded) {
             const completedAt = new Date().toISOString();
             try {
-                await (await openLocal()).complete(completedAt);
+                await (await openLocal()).fact('lastCompleted', completedAt);
+                if (!live())
+                    return;
                 recorded = true;
-                lastCompleted = completedAt;
             }
             catch {
                 synced = false;
             }
         }
         moveTo({
-            state: pending() ? 'pending' : synced && complete ? 'synced' : 'syncing',
-            lastCompleted,
-            providerUnreachable: !progress.reachable,
-            ...attention(),
+            state: synced && complete && roomWork === 0 && !socket.naming() ? 'synced' : 'syncing',
+            providerUnreachable: progress === null ? status.providerUnreachable : !progress.reachable,
+            resting: true,
         });
     }
-    function applyRoom(locator, roomVersion) {
-        announced.set(locator, roomVersion);
-        return task(async () => {
-            await answering.get(locator);
-            if (closed || stopping || discoveryPaused || authorization === undefined)
-                return;
-            const room = discovered.get(locator);
-            const held = replicas.get(locator);
-            if (room === undefined || room.replica.admission !== 'admitted')
-                return;
-            if (held !== undefined &&
-                (held.confirmed.record.replica.selection !== room.replica.selection ||
-                    options.adapter.reached(locator, held.confirmed.record.roomVersion, roomVersion))) {
-                return;
-            }
-            const during = underway;
-            const progress = during ?? { complete: true, reachable: true };
-            if (during === null)
-                moveTo(transferring(status));
+    function applyRoom(change) {
+        const { locator } = change;
+        if (stopping)
+            return Promise.resolve();
+        return inRoom(locator, async (live) => {
+            await socket.answered(locator);
+            const progress = underway ?? { complete: true, reachable: true };
             try {
                 const local = await openLocal();
-                const withheld = await advance(room, local, authorization);
-                if (withheld !== null)
-                    await withhold(withheld, room, local, progress);
+                for (;;) {
+                    if (!live())
+                        return null;
+                    const room = discovered.get(locator);
+                    if (room === undefined || room.replica.admission !== 'admitted')
+                        return null;
+                    const held = await recordAt(locator);
+                    if (held === undefined) {
+                        if (change.from !== null)
+                            return null;
+                        await installCarried(room, local, change, live, progress);
+                        return progress;
+                    }
+                    if (held.replica.selection !== room.replica.selection)
+                        return null;
+                    const at = held.roomVersion;
+                    if (options.adapter.reached(locator, at, change.roomVersion))
+                        return progress;
+                    if (change.from === null || !options.adapter.reached(locator, at, change.from)) {
+                        await name(locator);
+                        return progress;
+                    }
+                    if (underway === null)
+                        moveTo(transferring());
+                    const writing = () => live() && !full;
+                    const refreshed = await store.ahead((hold) => pullRefresh(installer, authorization ?? {}, held, writing, hold, () => change.read()));
+                    if (refreshed.kind !== 'advanced')
+                        return progress;
+                    const landing = {
+                        kind: 'refreshed',
+                        from: refreshed.from,
+                        remodelled: refreshed.remodelled,
+                    };
+                    if (await publish(installer, local, room, refreshed.record, landing, writing)) {
+                        stale.delete(locator);
+                        if (!declaredAsHeld(held, room))
+                            await retainModel(local, room, null);
+                        return progress;
+                    }
+                }
             }
             catch {
+                if (!stale.has(locator))
+                    void name(locator);
                 stale.add(locator);
+                return progress;
             }
-            finally {
-                if (during === null)
-                    await rest(progress);
-            }
-        });
+        }).then((progress) => rest(progress), () => undefined);
     }
-    function observeStream() {
-        const stream = options.adapter.roomStream;
-        if (stream === undefined || withdrawStream !== undefined)
+    async function installCarried(room, local, change, live, progress) {
+        if (authorization === undefined)
             return;
-        withdrawStream = stream.observe((event) => {
-            if (closed || stopping)
-                return;
-            if (event.kind === 'opened') {
-                socketOpen = true;
-                void sync('opened');
-            }
-            else if (event.kind === 'closed')
-                closedSocket(event.revoked);
-            else if (event.kind === 'opening')
-                void applyOpening(event.expired);
-            else
-                void applyRoom(event.locator, event.roomVersion);
-        });
+        if (underway === null)
+            moveTo(transferring());
+        const prior = await recordAt(room.locator);
+        const from = standingAt(store, room.locator, prior);
+        const page = await change.read();
+        const carried = {
+            bootstrap: () => Promise.resolve({
+                kind: 'bootstrap',
+                roomVersion: page.roomVersion,
+                ...(page.models === undefined ? {} : { models: page.models }),
+                documents: page.documents,
+                facts: page.facts,
+                revisions: page.revisions,
+                ...(page.fileIds === undefined ? {} : { fileIds: page.fileIds }),
+                ...(page.created === undefined ? {} : { created: page.created }),
+                changes: page.changes,
+                binaryFiles: page.binaryFiles,
+                ...(page.folders === undefined ? {} : { folders: page.folders }),
+            }),
+            reached: (locator, roomVersion, target) => options.adapter.reached(locator, roomVersion, target),
+        };
+        const bootstrapped = await pullBootstrap(installer, authorization, room, local, live, prior, carried);
+        if (bootstrapped.kind !== 'staged') {
+            if (live())
+                await withhold(bootstrapped, room, local, progress);
+            return;
+        }
+        await publish(installer, local, room, bootstrapped.record, { kind: 'bootstrapped', refreshed: bootstrapped.refreshed, from }, live);
     }
     function writesHeld() {
         return serviceMode === 'write-halted' || haltedRefusal;
@@ -2070,37 +2587,35 @@ export function composeRuntime(options) {
             haltedRefusal = false;
         if (mode !== serviceMode) {
             serviceMode = mode;
+            queueReadiness();
             journal.record(`service mode ${mode}`);
             for (const listener of serviceModeListeners)
                 listener(mode);
         }
         if (releasing)
-            submitAll();
+            submitAll(accepting);
     }
-    function observeConversations() {
-        const stream = options.adapter.conversations;
-        if (stream === undefined || withdrawConversations !== undefined)
-            return;
-        withdrawConversations = stream.observe((event) => {
-            if (conversations.receive(event)) {
-                void ready.then(scheduleCurrency);
-                return;
-            }
-            if (event.kind !== 'gap' || conversations.current())
-                return;
-            show();
-            scheduleCurrency();
-        });
+    function haltedSince(opens) {
+        if (serviceMode === 'open' && openSignals !== opens)
+            return false;
+        haltedRefusal = true;
+        return true;
+    }
+    function pendingShown() {
+        if (!localSaves)
+            recorded = false;
+        return moveTo(localSaves ? status : { ...status, state: 'pending', resting: false });
     }
     function scheduleCurrency() {
-        if (currencyQueued || closed || stopping)
+        if (currencyQueued === socket.generation() || closed || stopping)
             return;
-        currencyQueued = true;
-        void task(runCurrency);
+        currencyQueued = socket.generation();
+        void task(CONVERSATION_LANE, runCurrency);
     }
-    async function runCurrency() {
-        currencyQueued = false;
-        if (closed || stopping || discoveryPaused)
+    async function runCurrency(live) {
+        if (currencyQueued === socket.generation())
+            currencyQueued = null;
+        if (!live())
             return;
         await conversations.reconcile();
         if (conversations.current()) {
@@ -2108,97 +2623,184 @@ export function composeRuntime(options) {
             return;
         }
         const progress = { complete: false, reachable: !status.providerUnreachable };
-        moveTo(transferring(status));
+        moveTo(transferring());
         try {
             await conversations.catchUp(progress);
         }
         catch {
             progress.reachable = false;
         }
-        await rest(progress);
+        await rest(progress, live);
     }
     function close() {
         if (closed)
             return;
         closed = true;
-        withdrawStream?.();
-        withdrawStream = undefined;
-        withdrawConversations?.();
-        withdrawConversations = undefined;
+        notifyDiscovered();
+        unreadied();
+        if (probing !== null)
+            clearInterval(probing);
+        connectionLive();
+        lockListeners.clear();
+        readinessWatches.clear();
+        socket.withdraw();
         withdrawServiceMode?.();
         conversations.close();
-        stopTimer();
-        store?.close();
-        void opening?.then((opened) => {
-            opened.close();
-        }, () => { });
+        void recovery.retire();
         roomListeners.clear();
+        unlistedRooms.clear();
         refusalListeners.clear();
         storageLossListeners.clear();
         statusListeners.clear();
         serviceModeListeners.clear();
         memberListeners.clear();
-        readSide.close();
+        authorityChangeListeners.clear();
+        liveQueries.close();
+        figures.close();
         queueSubscriptions.clear();
-        roomDraftListeners.clear();
-        presentationListeners.clear();
+        store.close();
     }
     async function stop() {
         stopping = true;
-        stopTimer();
-        await chain.catch(() => undefined);
-        await Promise.all([...submitting.values()].map((run) => run.done));
-        await mutations;
+        unreadied();
+        socket.stopReads();
+        await recovery.retire();
+        await Promise.all(working);
+        await store.written();
         close();
     }
     const withdrawServiceMode = options.adapter.serviceMode?.observe(signalled);
-    observeConversations();
+    socket.observeConversations((event) => {
+        if (event.kind === 'list' || event.kind === 'listed' || event.kind === 'unlisted')
+            queueReadiness();
+        conversations.receive(event);
+        if (event.kind !== 'gap' || conversations.current())
+            return;
+        show();
+        scheduleCurrency();
+    });
     options.signal?.addEventListener('abort', close, { once: true });
     if (options.signal?.aborted)
         close();
-    observeStream();
-    void openLocal().then(() => {
-        if (capabilities.length > 0)
-            notifyReady();
-    }, () => {
-        notifyReady();
+    socket.observe(() => !closed && !stopping, (event) => {
+        if (event.kind === 'opened') {
+            connectionLive();
+            conversations.reopened();
+            lastAnswers.reopened();
+            recovery.resume();
+        }
+        else if (event.kind === 'discovered') {
+            if (event.missed)
+                countAuthorityChange();
+            void sync('opened', event.discovery);
+        }
+        else if (event.kind === 'closed')
+            closedSocket(event.revoked, event.lost, event.opened);
+        else if (event.kind === 'caught-up')
+            void caughtUpRooms(event.expired);
+        else if (event.kind === 'authority-changed') {
+            if (socket.isAnnounced() && socket.isOpen())
+                fenceLive(event.left);
+            void changeAuthority(event);
+        }
+        else
+            void applyRoom(event);
+    });
+    void openLocal()
+        .then(async (local) => {
+        if ((await local.facts()).capabilities.length > 0)
+            readyFromStore();
+    })
+        .catch(() => {
+        readyFromStore();
     });
     if (options.adapter.roomStream === undefined)
-        void sync('unstreamed');
-    function planned(input, reach) {
-        return planOf(input, roomFacts(reach), planReach(reach));
-    }
-    function watchPlan(plan, deliver) {
-        materialize(reachedRooms(plan));
-        return readSide.watch(plan, identityOf(plan), deliver);
+        void sync('unstreamed', null);
+    async function planned(input, reach) {
+        const plan = planWithin(input, await roomFacts(reach), planReach(reach));
+        const named = plan.paths !== null &&
+            plan.rooms !== null &&
+            plan.paths.length * plan.rooms.length <= MAXIMUM_WINDOW;
+        return plan.limit === null && named ? plan : { ...plan, limit: capped(plan.limit) };
+    }
+    function watchPlan(plan, deliver, fail) {
+        return watchSeeded(seeding, plan, deliver, (behind, answered) => liveQueries.watch(plan, identityOf(plan), (held) => {
+            const cover = covered(plan, held);
+            awaitPreparation(cover);
+            return behind(cover, held);
+        }, answered, fail));
+    }
+    function watchPlanned(planning, deliver, fail) {
+        let stop = null;
+        let stopped = false;
+        planning.then((plan) => {
+            if (!stopped)
+                stop = watchPlan(plan, deliver, fail);
+        }, (error) => {
+            if (!stopped)
+                fail(error);
+        });
+        return () => {
+            stopped = true;
+            stop?.();
+        };
     }
     async function searched(input, reach) {
-        const plan = searchPlanOf(input);
-        const selected = plan.documents === undefined && reach === null
-            ? null
-            : (await rowsQuery(filterOf(plan.documents ?? {}, roomFacts(reach), planReach(reach)))).documents;
-        if (selected === null)
-            materialize(null);
-        return searchIndex.search(reach === null || reach.conversations ? plan : { ...plan, conversations: [] }, selected);
-    }
-    const watch = (topic, input, deliver) => {
-        if (topic === 'room-drafts') {
-            const listener = { notify: deliver, ready: false };
-            roomDraftListeners.add(listener);
-            void exclusive(async () => {
-                await openLocal();
-                if (closed || !roomDraftListeners.has(listener))
-                    return;
-                listener.ready = true;
-            }).then(() => {
-                if (closed || !listener.ready || !roomDraftListeners.has(listener))
-                    return;
-                listener.notify(snapshotRoomDrafts());
-            }, () => { });
-            return () => {
-                roomDraftListeners.delete(listener);
+        const asked = searchPlanOf(input);
+        await ready;
+        const search = options.adapter.search;
+        if (search === undefined) {
+            return {
+                kind: 'undeclared',
+                code: 'action-undeclared',
+                fields: { name: 'search' },
+                retryable: false,
+            };
+        }
+        if (closed || refusal !== null || (await connectionNow()) !== 'connected')
+            return OFFLINE;
+        const reached = reach === null ? null : new Set(reach.rooms);
+        const named = asked.rooms === null
+            ? reached === null
+                ? null
+                : [...reached]
+            : asked.rooms.filter((room) => reached === null || reached.has(room));
+        const held = named === null ? null : await storedRooms(named);
+        const rooms = named === null ? null : named.filter((room) => held.has(room)).sort();
+        if (rooms !== null && rooms.length === 0)
+            return { kind: 'found', documents: [] };
+        try {
+            await ensureAuthorization();
+        }
+        catch {
+            return UNCERTAIN;
+        }
+        if (closed || authorization === undefined || refusal !== null)
+            return UNCERTAIN;
+        journal.record('transfer search');
+        try {
+            const result = await search(authorization, { text: asked.text, rooms });
+            if (result.kind === 'revoked-authorization')
+                await refuse('revoked-authorization');
+            journal.record(`outcome search ${result.kind}`);
+            if (result.kind === 'rejected')
+                return result;
+            if (result.kind !== 'found')
+                return failure(result);
+            const kept = rooms === null ? null : new Set(rooms);
+            return {
+                kind: 'found',
+                documents: result.documents.filter((hit) => kept === null || kept.has(hit.room)),
             };
         }
+        catch {
+            journal.record('outcome search transport-uncertainty');
+            return UNCERTAIN;
+        }
+    }
+    const watch = (topic, input, deliver, fail) => {
+        if (topic === 'room-drafts')
+            return watchRoomDrafts(drafting, deliver);
         if (topic === 'conversation') {
             return conversations.watch(input[0], input[1], deliver);
         }
@@ -2206,30 +2808,23 @@ export function composeRuntime(options) {
             return conversations.watchList(deliver);
         if (topic === 'agents')
             return conversations.watchAgents(deliver);
-        if (topic === 'presentation') {
-            const listener = {
-                app: input[0],
-                notify: deliver,
-                ready: false,
-            };
-            presentationListeners.add(listener);
-            void exclusive(async () => {
-                await openLocal();
-            }).then(() => {
-                if (closed || !presentationListeners.has(listener))
-                    return;
-                listener.ready = true;
-                listener.notify(presentationOf(listener.app));
-            }, () => { });
-            return () => {
-                presentationListeners.delete(listener);
-            };
+        if (topic === 'figures')
+            return figures.watch(deliver, fail);
+        if (topic === 'read')
+            return lastAnswers.watch(input[0], input[1], deliver);
+        if (topic === 'presentation')
+            return watchPresentation(drafting, input[0], deliver);
+        if (topic === 'readiness') {
+            return watchReadiness({ target: '', code: 'stored' }, null, deliver);
         }
         if (topic === 'rooms') {
-            roomListeners.add(deliver);
-            deliver(listed());
+            unlistedRooms.add(deliver);
+            emitKnownRooms();
             return () => {
+                unlistedRooms.delete(deliver);
                 roomListeners.delete(deliver);
+                if (roomListeners.size === 0)
+                    roomsShown = null;
             };
         }
         if (topic === 'connection-refusal') {
@@ -2262,160 +2857,160 @@ export function composeRuntime(options) {
         }
         if (topic === 'member') {
             memberListeners.add(deliver);
-            deliver(member);
+            void openLocal()
+                .then((local) => local.facts())
+                .then(({ member }) => {
+                if (memberListeners.has(deliver))
+                    deliver(member);
+            }, () => { });
             return () => {
                 memberListeners.delete(deliver);
             };
         }
+        if (topic === 'authority-changes') {
+            authorityChangeListeners.add(deliver);
+            deliver(authorityChanges);
+            return () => {
+                authorityChangeListeners.delete(deliver);
+            };
+        }
         if (topic === 'queue') {
             const queue = { locator: input[0], notify: deliver };
             queueSubscriptions.add(queue);
-            queue.notify(entriesOf(queue.locator));
+            void publication(async () => {
+                if (!queueSubscriptions.has(queue))
+                    return;
+                const entries = await entriesOf(queue.locator);
+                if (queueSubscriptions.has(queue))
+                    queue.notify(entries);
+            });
             return () => {
                 queueSubscriptions.delete(queue);
             };
         }
-        return watchPlan(planned(input[0], null), deliver);
+        return watchPlanned(planned(input[0], null), deliver, fail);
     };
     const md = {
         loaded() {
             return openLocal().then(() => undefined);
         },
         rooms() {
-            return listed();
+            if (closed)
+                return Promise.resolve([]);
+            return new Promise((settle) => {
+                const answer = (value) => {
+                    unlistedRooms.delete(answer);
+                    roomListeners.delete(answer);
+                    settle(value);
+                };
+                unlistedRooms.add(answer);
+                emitKnownRooms();
+            });
         },
-        query: ((input) => rowsQuery(planned(input, null))),
+        query: ((input) => planned(input, null).then(rowsQuery)),
         search: (input) => searched(input, null),
-        types(locator) {
+        async types(locator) {
+            const held = (await storedRooms([locator])).get(locator);
+            const room = isFenced(locator) ? undefined : declarationOf(locator, held)?.room;
             return {
-                collection: modelTypes(modelOf(locator)),
-                typedSelection: rooms.get(locator)?.typedSelection === undefined ||
-                    rooms.get(locator)?.typedSelection === null
-                    ? null
-                    : modelTypes(modelOf(locator, 'typed-selection')),
+                collection: modelTypes(isFenced(locator) ? NO_MODEL : modelIn(locator, held)),
+                typedSelection: (room?.typedSelection ?? null) === null ? null : modelTypes(builtIn),
             };
         },
-        roomDraft: {
-            list() {
-                return exclusive(async () => {
-                    await openLocal();
-                    return snapshotRoomDrafts();
-                }).then((listed) => {
-                    publishRoomDrafts(true);
-                    return listed;
-                });
-            },
-            read(room, path) {
-                const record = roomDrafts.get(room)?.get(path);
-                return record === undefined ? null : roomDraftOf(record);
-            },
-            write(room, path, revision, input) {
-                return exclusive(async () => {
-                    const parts = readParts(input);
-                    if (path === '' || normalize(path) !== path)
-                        throw runtimeError('room-draft-malformed');
-                    const local = await openLocal();
-                    const current = roomDrafts.get(room)?.get(path);
-                    if ((current?.revision ?? null) !== revision) {
-                        return staleWrite(current === undefined ? null : roomDraftOf(current));
-                    }
-                    const file = parts.file === undefined
-                        ? undefined
-                        : await heldFile(parts.file.blob, binaryBase(replicas.get(room)?.visible, path));
-                    const record = {
-                        locator: room,
-                        path,
-                        revision: roomDraftRevision(),
-                        parts: held(current?.parts, parts, file),
-                        returned: current?.returned ?? null,
-                    };
-                    await local.keepRoomDraft(record);
-                    rememberRoomDraft(record);
-                    publishChangeSet(changeSet(room, null, null, { drafts: [path] }));
-                    return { outcome: 'written', roomDraft: roomDraftOf(record) };
-                });
-            },
-            discard(room, path, revision) {
-                return exclusive(async () => {
-                    const local = await openLocal();
-                    const current = roomDrafts.get(room)?.get(path);
-                    if (current === undefined || current.revision !== revision) {
-                        return staleWrite(current === undefined ? null : roomDraftOf(current));
-                    }
-                    await local.discardRoomDraft(room, path);
-                    forgetRoomDraft(room, path);
-                    publishChangeSet(changeSet(room, null, null, { drafts: [path] }));
-                    moveTo({ ...status, ...attention() });
-                    return { outcome: 'written', roomDraft: null };
-                });
-            },
-        },
+        roomDraft: roomDraftSurface(drafting),
         conversation: conversations.surface,
         chatDraft: conversations.chatDraft,
-        presentation: {
-            read(app) {
-                return exclusive(async () => {
-                    await openLocal();
-                    return presentationOf(app);
-                });
-            },
-            write(app, value) {
-                return exclusive(async () => {
-                    const local = await openLocal();
-                    const stored = structuredClone(value);
-                    await local.present({ app, value: stored });
-                    presentations.set(app, stored);
-                    publishChangeSet(changeSet('', null, null, { presentation: app }));
-                });
-            },
-        },
+        presentation: presentationSurface(drafting),
         save(room, named, writtenBy) {
-            return exclusive(() => saveRoomDrafts(room, named, writtenBy));
+            return exclusive(() => saveRoomDrafts(saver, room, named, writtenBy));
+        },
+        saveParts(room, parts, writtenBy) {
+            return exclusive(() => saveParts(saver, room, parts, writtenBy));
         },
         history(locator, path, query) {
             return readHistory(locator, path, query);
         },
-        binaryFile: {
-            read: readBinaryPath,
-            readReference: readBinaryReference,
+        resolve(room, path, destination) {
+            return resolveReference(room, path, destination);
         },
-        call(name, input) {
-            return invokeAction(name, input);
+        binaryFile: binaryFileSurface(saver),
+        async call(name, input) {
+            await ready;
+            const lockedNow = await lockedRooms();
+            const room = (await calledRooms(name, input)).find((one) => lockedNow.includes(one));
+            return room === undefined ? recoveredAction(name, input) : lockedRoom(room);
         },
-        reached(locator, roomVersion, path) {
+        async reached(locator, roomVersion, path) {
             return path === undefined
-                ? reachedBy(locator, roomVersion)
-                : writtenAfter(locator, roomVersion, path);
+                ? reachedBy(installer, locator, roomVersion)
+                : writtenAfter(installer, locator, roomVersion, path);
         },
         log() {
             return journal.export();
         },
+        cleanUp,
+        unsent: () => database.ask({ kind: 'authored.unsent' }),
+        reset: () => options.shell.reset(),
+        async readAgain() {
+            lastAnswers.again();
+        },
         persistence() {
-            return options.shell.persistentStorage;
+            return persistence === 'granted';
+        },
+        async retry() {
+            journal.record('retry');
+            unpreparable.clear();
+            queueReadiness();
+            if (full)
+                await probed();
         },
         observe: observing(watch),
         async reauthorize() {
             if (refusal === null || !refusal.reauthorizationOffered)
                 return;
             journal.record('connection reauthorize');
-            await chain.catch(() => undefined);
-            await mutations;
+            await Promise.all([...lanes.values()]
+                .filter((held) => held.generation === socket.generation())
+                .map((held) => held.chain));
+            await store.written();
             authorization = undefined;
             discoveryPaused = false;
             if (options.adapter.roomStream === undefined)
-                await sync('unstreamed');
+                await sync('unstreamed', null);
             else
-                await task(ensureAuthorization);
+                await task(OPENING_LANE, ensureAuthorization);
         },
     };
     const reachable = {
         md,
         watch,
-        referrerScope: (referrer) => options.adapter.referrerScope(referrer),
         plan: planned,
         query: (plan) => rowsQuery(plan),
         watchPlan,
         search: searched,
+        watchReadiness,
+        locked,
+        lockedRooms,
+        watchLocks,
+        located,
+        room: async (locator) => shownRooms(await listingNow()).find((one) => one.locator === locator),
+    };
+    return {
+        md,
+        seed: (entry) => keepEntrySeed(store, entry),
+        stop,
+        watch,
+        persisted(answer) {
+            if (answer === persistence)
+                return;
+            persistence = answer;
+            journal.record(`persistence ${answer}`);
+            queueReadiness();
+        },
+        within: (reach, port) => {
+            if (full)
+                void probed();
+            return narrowed(reachable, reach, port);
+        },
     };
-    return { md, stop, watch, within: (reach) => narrowed(reachable, reach) };
 }