@agentshouse/mdruntime 0.1.0-cc294e382554d → 0.1.0-cc56db96f86ae

package/dist/connection.js

@@ -1,33 +1,34 @@
+import { roomTarget, target } from '@agentshouse/mdmodel';
 import { attachedModel } from './attached-model.js';
 import { cached, modelTypes, NO_MODEL, sameModel, } from './model.js';
 import { observing, whole } from './observation.js';
 import { filterOf, identityOf, planOf, plain, queryKey, } from './query.js';
 import { createReadSide } from './read-side.js';
 import { seededResult } from './seed.js';
-import { markdownPath, roomOfKey } from './rows.js';
+import { documentKey, markdownPath, roomOfKey } from './rows.js';
 import { createSearchIndex, searchPlanOf, } from './search.js';
 import { capped, MAXIMUM_WINDOW } from './windows.js';
 import { bootstrapRoom } from './bootstrap.js';
 import { changeSet, changing, entering, mergeChangeSets } from './change-set.js';
 import { createConversationStore, } from './conversation.js';
-import { queuedFile } from './change.js';
+import { leaving as leavingIn, partnerOf, queuedFile, } from './change.js';
 import { indexReferrers, referencesIndexed, validRoot, } from './collection.js';
 import { runtimeError } from './failure.js';
 import { createLog } from './log.js';
 import { binaryRecord } from './binary.js';
-import { absentBinary, binaryAnswer, binaryLinkAnswer, calledResult, failure, historyAnswer, undeclared, UNCERTAIN, } from './outcome.js';
+import { ABSENT_TARGET, absentBinary, binaryAnswer, binaryLinkAnswer, calledResult, failure, historyAnswer, LOCKED_UNREADABLE, lockedRoom, undeclared, UNCERTAIN, UNREADABLE, } from './outcome.js';
 import { createRecovery } from './recovery.js';
 import { doorReads } from './reads.js';
 import { refreshRoom } from './refresh.js';
-import { buildBatch, joined, limitedIn, queuedDocuments, requeued, } from './save.js';
-import { applyReturned, compositionOf, confirmedOf, landed, readReclassified, replicaOf, replicating, sameMembership, standing, } from './replica.js';
+import { buildBatch, buildMove, joined, limiting, queuedDocuments, requeuing, } from './save.js';
+import { applyReturned, compositionOf, confirmedOf, landed, readReclassified, replicating, sameMembership, standing, } from './replica.js';
 import { binaryBase, changedParts, changesOf, held, heldFile, joinedDraft, moveTarget, readParts, returnedBy, returnedInto, staleWrite, underneath, withdrawnDrafts, } from './room-draft.js';
 import { same, saving, STARTING, transferring, } from './status.js';
 import { detectStorageLoss, nextGeneration } from './durability.js';
 import { readinessOf, SETTLED_ROOMS, } from './readiness.js';
 import { FencedMap } from './fence.js';
-import { tally } from './shared.js';
-import { inChunks, ROW_WEIGHT, stepped, yielded } from './turn.js';
+import { keysIn, tallying } from './shared.js';
+import { finished, inChunks, ROW_WEIGHT, stepped, yielded } from './turn.js';
 import { identityTime, roomDraftRevision } from './identity.js';
 import { beneath, normalize } from './paths.js';
 import { openRuntimeStore, } from './store.js';
@@ -59,6 +60,8 @@ const OPENING_LANE = 'opening';
 const CONVERSATION_LANE = 'conversations';
 const ROOM_READS = 256;
 const ROOM_ATTEMPTS = 16;
+// A Room that locks offline stays readable this long after the connection drops, so a laptop waking or changing network keeps working while a disconnected device locks soon after.
+const LOCK_GRACE_MS = 120_000;
 function operationOf(input) {
     const operation = input?.operation_id;
     return typeof operation === 'string' ? operation : null;
@@ -88,6 +91,9 @@ function abandonedOn(signal) {
 function roomLane(locator) {
     return `room ${locator}`;
 }
+function pendingKey(locator, id) {
+    return `${locator}\u0000${id}`;
+}
 export function composeRuntime(options) {
     const localSaves = options.adapter.localSaves === true;
     let authorization = options.authorization;
@@ -180,6 +186,9 @@ export function composeRuntime(options) {
     let withdrawConversations;
     let currencyQueued = null;
     let socketOpen = false;
+    const confirmed = new Set();
+    let lockGrace = null;
+    const lockListeners = new Set();
     let serviceMode = 'open';
     let haltedRefusal = false;
     let openSignals = 0;
@@ -331,20 +340,74 @@ export function composeRuntime(options) {
     }
     function documentsIn(locator) {
         const replica = replicas.get(locator);
-        if (replica === undefined)
-            return 0;
-        const roots = replica.confirmed.record.typedSelection?.roots ?? [];
-        const weighed = outsideOf(roots);
-        return (tally(replica.visible.documents, weighed.documents) +
-            tally(replica.visible.binaries, weighed.binaries));
+        return replica === undefined ? 0 : finished(counting(replica));
+    }
+    function* counting(replica) {
+        const weighed = outsideOf(replica.confirmed.record.typedSelection?.roots ?? []);
+        return ((yield* tallying(replica.visible.documents, weighed.documents)) +
+            (yield* tallying(replica.visible.binaries, weighed.binaries)));
     }
     function listed() {
         return structuredClone([...rooms.values()].map((room) => {
             const documents = documentsIn(room.locator);
             counted.set(room.locator, documents);
-            return { ...room, documents };
+            return locked(room.locator)
+                ? {
+                    ...room,
+                    model: modelTypes(NO_MODEL),
+                    typedSelection: null,
+                    documents: 0,
+                    locked: true,
+                }
+                : { ...room, documents, locked: false };
         }));
     }
+    function locked(locator) {
+        return rooms.get(locator)?.replica.offline === 'locked' && !confirmed.has(locator);
+    }
+    function lockedRooms() {
+        return [...rooms.keys()].filter(locked).sort();
+    }
+    function relocked(before) {
+        const after = lockedRooms();
+        if (JSON.stringify(after) === JSON.stringify(before))
+            return;
+        journal.record(`locked ${after.length}`);
+        emitRooms();
+        for (const notify of [...lockListeners])
+            notify();
+    }
+    function confirmLocks(listed) {
+        if (!socketOpen)
+            return;
+        for (const room of listed) {
+            if (room.replica.admission === 'admitted')
+                confirmed.add(room.locator);
+        }
+    }
+    function connectionLost() {
+        if (lockGrace !== null || closed)
+            return;
+        lockGrace = setTimeout(() => {
+            lockGrace = null;
+            if (socketOpen || closed)
+                return;
+            const before = lockedRooms();
+            confirmed.clear();
+            relocked(before);
+        }, LOCK_GRACE_MS);
+    }
+    function connectionLive() {
+        if (lockGrace !== null)
+            clearTimeout(lockGrace);
+        lockGrace = null;
+    }
+    function watchLocks(notify) {
+        lockListeners.add(notify);
+        return () => {
+            lockListeners.delete(notify);
+        };
+    }
     function roomFacts(reach = null) {
         const held = [...rooms.values()]
             .filter((room) => holds(reach, room.locator))
@@ -402,17 +465,17 @@ export function composeRuntime(options) {
         for (const listener of statusListeners)
             listener(shown);
     }
-    function entryOf(batch) {
+    function entryOf(locator, batch) {
         if (localSaves)
             return Object.freeze({ batch, state: 'local' });
-        const state = pendings.get(batch.id);
+        const state = pendings.get(pendingKey(locator, batch.id));
         if (state?.accepted !== undefined) {
             return Object.freeze({ batch, state: 'accepted', roomVersion: state.accepted });
         }
         return Object.freeze({ batch, ...(state?.submission ?? { state: 'waiting' }) });
     }
     function entriesOf(locator) {
-        return (replicas.get(locator)?.queue ?? queuesWithoutReplica.get(locator) ?? []).map(entryOf);
+        return (replicas.get(locator)?.queue ?? queuesWithoutReplica.get(locator) ?? []).map((batch) => entryOf(locator, batch));
     }
     function emitQueue(locator) {
         const entries = entriesOf(locator);
@@ -451,13 +514,10 @@ export function composeRuntime(options) {
         if (replica === undefined || closed || prepared.has(locator))
             return;
         const visible = replica.visible;
-        const paths = [
-            ...new Set([...Object.keys(visible.documents), ...Object.keys(visible.binaries)]),
-        ];
         const entered = [];
         projecting.add(locator);
         try {
-            await inChunks(paths, (path) => ROW_WEIGHT + (visible.documents[path]?.length ?? 0), (chunk) => {
+            await inChunks(await stepped(keysIn(visible.documents, visible.binaries)), (path) => ROW_WEIGHT + (visible.documents[path]?.length ?? 0), (chunk) => {
                 const current = replicas.get(locator);
                 if (current === undefined || closed)
                     return;
@@ -514,7 +574,9 @@ export function composeRuntime(options) {
             (reached === null
                 ? [...new Set([...rooms.keys(), ...replicas.keys(), ...queuesWithoutReplica.keys()])]
                 : [...reached]);
-        return [...new Set(named)].filter((locator) => reached === null || reached.has(locator)).sort();
+        return [...new Set(named)]
+            .filter((locator) => (reached === null || reached.has(locator)) && !plan.locked.includes(locator))
+            .sort();
     }
     function awaited(locator) {
         return (!roomsListed ||
@@ -717,7 +779,7 @@ export function composeRuntime(options) {
     }
     async function estimated() {
         const estimate = options.shell.estimate === undefined ? null : await options.shell.estimate();
-        return estimate === null ? null : Math.max(0, estimate.quota - estimate.usage);
+        return estimate === null ? null : Math.max(0, estimate.total - estimate.usage);
     }
     function pause(locator, cause) {
         paused.add(locator);
@@ -738,7 +800,8 @@ export function composeRuntime(options) {
         const available = await estimated().catch(() => null);
         if (available === null || available < (held.needed ?? 0))
             return;
-        if (held.cause === 'quota-exceeded' && (held.available === null || available <= held.available))
+        if (held.cause === 'storage-exceeded' &&
+            (held.available === null || available <= held.available))
             return;
         resume();
     }
@@ -780,7 +843,7 @@ export function composeRuntime(options) {
     }
     async function exceededOn(locator, bytes) {
         const available = await estimated().catch(() => null);
-        pause(locator, { cause: 'quota-exceeded', needed: bytes, available });
+        pause(locator, { cause: 'storage-exceeded', needed: bytes, available });
     }
     function seedRoomHeld(room, version) {
         return prepared.has(room) && reachedBy(room, version);
@@ -917,17 +980,22 @@ export function composeRuntime(options) {
                         models.set(key, revoked);
                         liveModels.delete(key);
                     }
-                    const changed = [];
-                    for (const [locator, room] of rooms) {
+                    const revocations = [];
+                    for (const locator of [...rooms.keys()]) {
                         const before = replicas.get(locator) ?? null;
-                        if (before !== null) {
-                            const record = {
-                                ...before.confirmed.record,
-                                model: revoked,
-                                selectionModel: revoked,
-                            };
-                            replicas.set(locator, replicaOf(confirmedOf(record, before.confirmed), before.queue, before));
-                        }
+                        const after = before === null
+                            ? null
+                            : await stepped(replicating(await confirmedOf({ ...before.confirmed.record, model: revoked, selectionModel: revoked }, before.confirmed), before.queue, before));
+                        const set = await stepped(changing(locator, before, after, { room: true }));
+                        revocations.push([locator, before, after, set]);
+                    }
+                    const changed = [];
+                    for (const [locator, before, after, set] of revocations) {
+                        const room = rooms.get(locator);
+                        if (room === undefined || (replicas.get(locator) ?? null) !== before)
+                            continue;
+                        if (after !== null)
+                            replicas.set(locator, after);
                         rooms.set(locator, {
                             ...room,
                             model: modelTypes(revoked),
@@ -935,7 +1003,7 @@ export function composeRuntime(options) {
                                 ? null
                                 : { ...room.typedSelection, model: modelTypes(revoked) },
                         });
-                        changed.push(changeSet(locator, before, replicas.get(locator) ?? null, { room: true }));
+                        changed.push(set);
                     }
                     publishChangeSet(mergeChangeSets(changed));
                 });
@@ -974,6 +1042,7 @@ export function composeRuntime(options) {
         });
     }
     async function applyDiscovery(found, started, covered) {
+        const lockedBefore = lockedRooms();
         for (const room of found) {
             const fence = fences.get(room.locator);
             if (fence !== undefined && fence.erased && fence.at < started)
@@ -1006,8 +1075,10 @@ export function composeRuntime(options) {
             }
             list(room, room.replica.admission === 'admitted' && !unreadable.has(room.locator));
         }
+        confirmLocks(listed);
         roomsListed = true;
         emitRooms();
+        relocked(lockedBefore);
         return listed;
     }
     function heldLocally(locator) {
@@ -1037,16 +1108,17 @@ export function composeRuntime(options) {
     }
     function fence(locators) {
         const fresh = [...new Set(locators)].filter((locator) => !fences.has(locator));
-        const removed = fresh.map((locator) => changeSet(locator, replicas.get(locator) ?? null, null, {
-            room: true,
-            queue: true,
+        const removed = fresh.map((locator) => ({
+            locator,
+            shown: prepared.has(locator) || projecting.has(locator) ? (replicas.get(locator) ?? null) : null,
             drafts: [...(roomDrafts.get(locator)?.keys() ?? [])],
         }));
         for (const locator of fresh) {
             fences.set(locator, { at: discoveries, erased: false });
             lastFenced.set(locator, ++fencings);
+            confirmed.delete(locator);
             for (const batch of replicas.get(locator)?.queue ?? queuesWithoutReplica.get(locator) ?? [])
-                pendings.delete(batch.id);
+                pendings.delete(pendingKey(locator, batch.id));
             replicas.delete(locator);
             queuesWithoutReplica.delete(locator);
             rooms.delete(locator);
@@ -1060,6 +1132,7 @@ export function composeRuntime(options) {
             repairable.delete(locator);
             unindexable.delete(locator);
             paused.delete(locator);
+            prepared.delete(locator);
             scopedRefusals.delete(locator);
             sourceRefusals.delete(locator);
             declarationRefusals.delete(locator);
@@ -1073,14 +1146,21 @@ export function composeRuntime(options) {
         }
         if (fresh.length === 0)
             return fresh;
-        publishChangeSet(mergeChangeSets(removed));
-        for (const locator of fresh)
-            prepared.delete(locator);
         searchIndex.forget(fresh);
+        const withdrawn = readSide.apply(stepped(withdrawing(removed)), (set) => conversations.changed(set));
+        if (withdrawn instanceof Promise)
+            void withdrawn.catch(unpublished);
+        publishChangeSet(mergeChangeSets(removed.map(({ locator, drafts }) => changeSet(locator, null, null, { room: true, queue: true, drafts }))));
         readSide.recover();
         moveTo({ ...status, ...attention() });
         return fresh;
     }
+    function* withdrawing(removed) {
+        const sets = [];
+        for (const { locator, shown } of removed)
+            sets.push(yield* changing(locator, shown, null));
+        return mergeChangeSets(sets);
+    }
     async function erased(local, locators) {
         await local.erase(locators);
         for (const locator of locators) {
@@ -1091,8 +1171,12 @@ export function composeRuntime(options) {
     }
     async function loseRooms(locators) {
         const fresh = fence(locators);
-        if (fresh.length > 0)
-            await durably((local) => erased(local, fresh));
+        if (fresh.length === 0)
+            return;
+        await durably(async (local) => {
+            await erased(local, fresh);
+            await unpair(local);
+        });
     }
     function restored(key, persisted) {
         const prior = models.get(key);
@@ -1127,6 +1211,22 @@ export function composeRuntime(options) {
             opened.transfers(),
             opened.targets(),
         ]);
+        const queuedBatches = new Map(queues.map((queue) => [queue.locator, queue.pending.map(({ batch }) => batch)]));
+        const previousReplicas = new Map(replicas);
+        const read = new Map();
+        for (const record of records) {
+            const model = restored(modelKey(record.locator, 'collection'), record.model);
+            const selectionModel = restored(modelKey(record.locator, 'typed-selection'), record.selectionModel);
+            const prior = previousReplicas.get(record.locator);
+            const confirmed = await confirmedOf({ ...record, model, selectionModel }, prior?.confirmed);
+            const replica = await stepped(replicating(confirmed, queuedBatches.get(record.locator) ?? [], prior));
+            await stepped(counting(replica));
+            read.set(record.locator, replica);
+        }
+        const sets = new Map();
+        for (const locator of new Set([...previousReplicas.keys(), ...read.keys()])) {
+            sets.set(locator, await stepped(changing(locator, previousReplicas.get(locator) ?? null, read.get(locator) ?? null)));
+        }
         targets = heldTargets;
         transfers.clear();
         for (const record of staged)
@@ -1141,26 +1241,24 @@ export function composeRuntime(options) {
         for (const record of presented)
             presentations.set(record.app, record.value);
         conversations.hydrate(held, chatDrafts);
-        const queuedBatches = new Map(queues.map((queue) => [queue.locator, queue.pending.map(({ batch }) => batch)]));
         pendings.clear();
         for (const queue of queues) {
-            for (const { batch, state } of queue.pending)
-                pendings.set(batch.id, state);
+            for (const { batch, state } of queue.pending) {
+                pendings.set(pendingKey(queue.locator, batch.id), state);
+            }
         }
-        const previousReplicas = new Map(replicas);
         replicas.clear();
         queuesWithoutReplica.clear();
-        const replicated = new Set(records.map((record) => record.locator));
         for (const [locator, queue] of queuedBatches) {
-            if (!replicated.has(locator))
+            if (!read.has(locator))
                 queuesWithoutReplica.set(locator, queue);
         }
         for (const record of records) {
-            const model = restored(modelKey(record.locator, 'collection'), record.model);
-            const selectionModel = restored(modelKey(record.locator, 'typed-selection'), record.selectionModel);
-            const prior = previousReplicas.get(record.locator);
-            const confirmed = confirmedOf({ ...record, model, selectionModel }, prior?.confirmed);
-            replicas.set(record.locator, replicaOf(confirmed, queuedBatches.get(record.locator) ?? [], prior));
+            if (fences.has(record.locator))
+                continue;
+            const replica = read.get(record.locator);
+            const { model, selectionModel } = replica.confirmed.record;
+            replicas.set(record.locator, replica);
             const existing = rooms.get(record.locator);
             if (existing === undefined)
                 list(record, false);
@@ -1183,7 +1281,7 @@ export function composeRuntime(options) {
         return {
             lastCompleted,
             locators: new Set([...queuedBatches.keys(), ...replicas.keys()]),
-            read: mergeChangeSets([...new Set([...previousReplicas.keys(), ...replicas.keys()])].map((locator) => changeSet(locator, previousReplicas.get(locator) ?? null, replicas.get(locator) ?? null))),
+            read: mergeChangeSets([...sets].flatMap(([locator, set]) => (fences.has(locator) ? [] : [set]))),
         };
     }
     async function readState(opened) {
@@ -1202,7 +1300,7 @@ export function composeRuntime(options) {
     async function open() {
         if (closed)
             throw new Error('runtime closed');
-        const opened = await openRuntimeStore(isFenced);
+        const opened = await openRuntimeStore(isFenced, options.database);
         store = opened;
         const interrupted = await opened.fences();
         for (const locator of interrupted) {
@@ -1225,6 +1323,9 @@ export function composeRuntime(options) {
         if (interrupted.length > 0)
             await erased(opened, interrupted);
         moveTo({ ...status, lastCompleted, ...attention() });
+        void exclusive(() => unpair(opened)).catch(() => {
+            journal.record('unpair failed');
+        });
         return opened;
     }
     function durably(work) {
@@ -1245,28 +1346,92 @@ export function composeRuntime(options) {
         mutations = next.then(() => undefined, () => undefined);
         return next;
     }
-    function withdrawable(batch) {
-        const state = pendings.get(batch.id);
-        return state !== undefined && state.submission.state !== 'submitted' && !state.lost;
+    function withdrawable(locator) {
+        return (batch) => {
+            const state = pendings.get(pendingKey(locator, batch.id));
+            return state !== undefined && state.submission.state !== 'submitted' && !state.lost;
+        };
+    }
+    function landedWhole(locator, batch, confirmed, current) {
+        if (!landed(batch, confirmed, current))
+            return false;
+        const partner = partnerOf(batch, locator);
+        if (partner === null)
+            return true;
+        const other = replicas.get(partner);
+        const half = other?.queue.find((one) => one.id === batch.id);
+        return other !== undefined && half !== undefined && landed(half, other.confirmed);
+    }
+    function carriedBack(locator, unlanded, written) {
+        const back = new Map();
+        const taken = [];
+        for (const batch of unlanded) {
+            const between = batch.between;
+            if (between === undefined)
+                continue;
+            const source = between.source.room;
+            const destination = between.destination.room;
+            for (const { path: to } of pendings.get(pendingKey(destination, batch.id))?.drafts ?? []) {
+                const record = roomDrafts.get(destination)?.get(to);
+                const path = between.moves.find((move) => move.to === to)?.path;
+                if (record === undefined || path === undefined)
+                    continue;
+                const [into, key] = source === locator ? [written, path] : [back, documentKey(source, path)];
+                const existing = into.get(key) ?? roomDrafts.get(source)?.get(path);
+                taken.push({ locator: destination, path: to });
+                into.set(key, {
+                    locator: source,
+                    path,
+                    revision: roomDraftRevision(),
+                    parts: returnedInto(existing?.parts, record.parts),
+                    returned: existing?.returned ?? null,
+                });
+            }
+        }
+        const records = [...back.values()];
+        const elsewhere = taken.filter((one) => one.locator !== locator);
+        const rooms = new Set([...records, ...elsewhere].map((one) => one.locator));
+        return {
+            taken: taken.filter((one) => one.locator === locator).map(({ path }) => path),
+            writes: [...rooms].map((room) => ({
+                locator: room,
+                roomDrafts: records.filter((record) => record.locator === room),
+                consumedRoomDrafts: elsewhere.filter((one) => one.locator === room).map(({ path }) => path),
+            })),
+            changes: [...rooms].map((room) => changeSet(room, null, null, {
+                drafts: [...records, ...elsewhere]
+                    .filter((one) => one.locator === room)
+                    .map(({ path }) => path),
+            })),
+            remember() {
+                for (const one of taken)
+                    forgetRoomDraft(one.locator, one.path);
+                for (const record of records)
+                    rememberRoomDraft(record);
+            },
+        };
     }
     async function settle(local, locator, before, confirmed, queue, settling = {}) {
         const previousQueue = before?.queue ?? queuesWithoutReplica.get(locator) ?? [];
-        const { withdrawn, kept } = await stepped(standing(confirmed, queue, withdrawable, localSaves));
+        const { withdrawn, kept } = await stepped(standing(confirmed, queue, withdrawable(locator), localSaves));
         const founded = kept.filter((batch) => !queue.includes(batch));
         const queueChanged = kept.length !== previousQueue.length || founded.length > 0;
         const unqueued = withdrawn.map((batch) => ({
             batch,
-            returned: localSaves || landed(batch, confirmed) ? null : returnedBy('withdrawn'),
+            landed: landedWhole(locator, batch, confirmed),
         }));
         const returning = [
-            ...[...unqueued].reverse(),
+            ...[...unqueued].reverse().map(({ batch, landed }) => ({
+                batch,
+                returned: localSaves || landed ? null : returnedBy('withdrawn'),
+            })),
             ...(settling.leaving === undefined ? [] : [settling.leaving]),
         ];
         const written = new Map();
         for (const { batch, returned } of returning) {
-            if (returned === null)
+            if (returned === null || batch.between?.destination.room === locator)
                 continue;
-            for (const saved of pendings.get(batch.id)?.drafts ?? []) {
+            for (const saved of pendings.get(pendingKey(locator, batch.id))?.drafts ?? []) {
                 const existing = written.get(saved.path) ?? roomDrafts.get(locator)?.get(saved.path);
                 written.set(saved.path, {
                     locator,
@@ -1277,14 +1442,28 @@ export function composeRuntime(options) {
                 });
             }
         }
-        await local.keepAuthored({ locator, queue: kept, founded, roomDrafts: [...written.values()] });
+        const carried = carriedBack(locator, [
+            ...[...unqueued].reverse().flatMap(({ batch, landed }) => (landed ? [] : [batch])),
+            ...(settling.leaving === undefined || settling.leaving.returned === null
+                ? []
+                : [settling.leaving.batch]),
+        ], written);
+        await local.keepAuthored({
+            locator,
+            queue: kept,
+            founded,
+            roomDrafts: [...written.values()],
+            consumedRoomDrafts: carried.taken,
+        }, ...carried.writes);
         const staying = new Set(kept.map((batch) => batch.id));
         for (const batch of previousQueue) {
             if (!staying.has(batch.id))
-                pendings.delete(batch.id);
+                pendings.delete(pendingKey(locator, batch.id));
         }
         for (const record of written.values())
             rememberRoomDraft(record);
+        carried.remember();
+        const drafts = [...written.keys(), ...carried.taken];
         try {
             await local.write({
                 next: confirmed.record,
@@ -1294,31 +1473,32 @@ export function composeRuntime(options) {
         }
         catch (error) {
             const held = before === undefined ? null : await stepped(replicating(before.confirmed, kept, before));
-            const set = await stepped(changing(locator, before ?? null, held, {
-                queue: queueChanged,
-                drafts: [...written.keys()],
-            }));
+            const set = await stepped(changing(locator, before ?? null, held, { queue: queueChanged, drafts }));
             if (held !== null)
                 replicas.set(locator, held);
             else if (kept.length > 0)
                 queuesWithoutReplica.set(locator, kept);
             else
                 queuesWithoutReplica.delete(locator);
-            publishChangeSet(set);
+            publishChangeSet(mergeChangeSets([set, ...carried.changes]));
             moveTo({ ...status, ...attention() });
             throw error;
         }
-        const changed = { room: settling.room, queue: queueChanged, drafts: [...written.keys()] };
+        const changed = { room: settling.room, queue: queueChanged, drafts };
         const next = await stepped(replicating(confirmed, kept, before));
+        await stepped(counting(next));
         const set = await stepped(changing(locator, before ?? null, next, changed));
         return () => {
             queuesWithoutReplica.delete(locator);
-            for (const { batch, returned } of unqueued) {
-                const outcome = localSaves ? 'dropped' : returned === null ? 'landed' : 'withdrawn';
+            for (const { batch, landed } of unqueued) {
+                const outcome = localSaves ? 'dropped' : landed ? 'landed' : 'withdrawn';
                 journal.record(`outcome ${locator} ${batch.id} ${outcome}`);
             }
             replicas.set(locator, next);
-            return heldChange(locator, before ?? null, next, set, changed);
+            return mergeChangeSets([
+                heldChange(locator, before ?? null, next, set, changed),
+                ...carried.changes,
+            ]);
         };
     }
     function heldChange(locator, before, next, set, changed) {
@@ -1376,7 +1556,7 @@ export function composeRuntime(options) {
             const queue = prior?.queue ?? queuesWithoutReplica.get(room.locator) ?? [];
             const roomVersion = confirmed.record.roomVersion;
             const accepted = queue.filter((batch) => {
-                const accepted = pendings.get(batch.id)?.accepted;
+                const accepted = pendings.get(pendingKey(room.locator, batch.id))?.accepted;
                 return (accepted !== undefined && options.adapter.reached(room.locator, roomVersion, accepted));
             });
             let settled;
@@ -1396,7 +1576,7 @@ export function composeRuntime(options) {
                 catching.delete(room.locator);
             }
             for (const batch of accepted)
-                pendings.delete(batch.id);
+                pendings.delete(pendingKey(room.locator, batch.id));
             stale.delete(room.locator);
             unindexable.delete(room.locator);
             if (unreadable.delete(room.locator))
@@ -1407,8 +1587,12 @@ export function composeRuntime(options) {
             if (prior === undefined)
                 prepared.add(room.locator);
             publishChangeSet(set);
+            await unpair(local);
             moveTo({ ...status, ...attention() });
             options.adapter.roomStream?.published(room.locator, roomVersion);
+            if (accepted.length > 0 && (replicas.get(room.locator)?.queue.length ?? 0) > 0) {
+                submitLater(room.locator);
+            }
             return true;
         });
     }
@@ -1444,13 +1628,17 @@ export function composeRuntime(options) {
         }
         const target = await savedRoom(locator);
         const saved = [];
+        const files = [];
         for (const { path, parts } of read) {
             const file = parts.file === undefined
                 ? undefined
                 : await heldFile(parts.file.blob, binaryBase(target.replica.visible, path));
+            if (parts.file !== undefined && file !== undefined) {
+                files.push({ key: file.localId, blob: parts.file.blob });
+            }
             saved.push({ path, parts: held(undefined, parts, file) });
         }
-        return committed(locator, target, saved, new Set(), writtenBy);
+        return committed(locator, target, saved, new Set(), writtenBy, files);
     }
     function carriedDrafts(locator, saved, consumed) {
         const holding = roomDrafts.get(locator);
@@ -1464,13 +1652,145 @@ export function composeRuntime(options) {
             return [[path, { ...record, path: to, revision: roomDraftRevision() }]];
         }));
     }
-    async function committed(locator, { local, replica, room }, saved, consumed, writtenBy) {
+    function sideOf(locator, replica, room) {
+        const record = replica.confirmed.record;
+        return {
+            room: locator,
+            handle: room.handle,
+            baseRoomVersion: record.roomVersion,
+            composition: compositionFor(record),
+            operations: room.operations,
+            providerOwnedPaths: room.providerOwnedPaths,
+            visible: replica.visible,
+            queued: queuedDocuments(replica.queue),
+            clean: {
+                text: record.documents,
+                binaries: record.binaries,
+                composition: compositionOf(record),
+            },
+        };
+    }
+    function movedInto(locator, saved) {
+        const into = saved.find(({ parts }) => parts.move?.room !== undefined && parts.move.room !== locator);
+        return into?.parts.move?.room ?? null;
+    }
+    async function committedMove(locator, destination, { local, replica, room }, saved, consumed, writtenBy, files) {
+        const mixed = saved.find(({ parts }) => Object.keys(parts).length !== 1 || parts.move?.room !== destination);
+        if (mixed !== undefined) {
+            return { outcome: 'refused', code: 'mixed-room-move', retryable: false, file: mixed.path };
+        }
+        const changed = saved.flatMap(({ path, parts }) => changedParts(path, underneath(parts, path, replica.visible)));
+        if (changed.length > 0)
+            return { outcome: 'refused', code: 'changed-underneath', retryable: false, parts: changed };
+        await referenced(destination);
+        const target = replicas.get(destination);
+        const listedRoom = rooms.get(destination);
+        if (target === undefined || listedRoom === undefined) {
+            throw runtimeError('room-not-held', `No Local Replica for ${destination}`);
+        }
+        const built = await buildMove({
+            source: sideOf(locator, replica, room),
+            destination: sideOf(destination, target, listedRoom),
+            moves: saved.map(({ path, parts }) => ({ path, to: moveTarget(parts.move) })),
+            providerLimits: limits,
+            local: localSaves,
+            ...(writtenBy === undefined ? {} : { writtenBy }),
+        });
+        if (built.kind === 'refused')
+            return { outcome: 'refused', ...built.refusal };
+        const id = built.leaving.id;
+        const carrying = saved.flatMap(({ path, parts }) => {
+            const record = roomDrafts.get(locator)?.get(path);
+            const to = moveTarget(parts.move);
+            if (record === undefined || consumed.has(path) || roomDrafts.get(destination)?.has(to)) {
+                return [];
+            }
+            const moved = {
+                ...record,
+                locator: destination,
+                path: to,
+                revision: roomDraftRevision(),
+            };
+            return [{ from: path, record: moved }];
+        });
+        const carried = carrying.map(({ record }) => record);
+        const marked = carried.map(({ path }) => ({ path, parts: {} }));
+        const left = [...consumed, ...carrying.map(({ from }) => from)];
+        const leavingQueue = [...replica.queue, built.leaving];
+        const arrivingQueue = [...target.queue, built.arriving];
+        let fencedRoom;
+        try {
+            fencedRoom = await local.saveAuthored(files, {
+                locator,
+                queue: leavingQueue,
+                saved: new Map([[id, saved]]),
+                consumedRoomDrafts: left,
+            }, {
+                locator: destination,
+                queue: arrivingQueue,
+                saved: new Map([[id, marked]]),
+                roomDrafts: carried,
+            });
+        }
+        catch {
+            return { outcome: 'refused', code: 'durable-write', retryable: true };
+        }
+        if (fencedRoom !== null) {
+            throw runtimeError('room-not-held', `No Local Replica for ${fencedRoom}`);
+        }
+        const nextSource = await stepped(replicating(replica.confirmed, leavingQueue, replica));
+        const nextDestination = await stepped(replicating(target.confirmed, arrivingQueue, target));
+        const sets = [
+            await stepped(changing(locator, replica, nextSource, { queue: true, drafts: left })),
+            await stepped(changing(destination, target, nextDestination, {
+                queue: true,
+                drafts: carried.map(({ path }) => path),
+            })),
+        ];
+        if (fences.has(locator) || fences.has(destination)) {
+            throw runtimeError('room-not-held', `No Local Replica for ${locator}`);
+        }
+        pendings.set(pendingKey(locator, id), {
+            drafts: saved,
+            submission: { state: 'waiting' },
+            lost: false,
+        });
+        pendings.set(pendingKey(destination, id), {
+            drafts: marked,
+            submission: { state: 'waiting' },
+            lost: false,
+        });
+        for (const path of left)
+            forgetRoomDraft(locator, path);
+        for (const record of carried)
+            rememberRoomDraft(record);
+        replicas.set(locator, nextSource);
+        replicas.set(destination, nextDestination);
+        publishChangeSet(mergeChangeSets(sets));
+        queuedSave(locator);
+        return { outcome: 'saved', identifier: id };
+    }
+    function queuedSave(locator) {
+        if (!localSaves)
+            recorded = false;
+        moveTo({ ...(localSaves ? status : saving(status)), ...attention() });
+        submitLater(locator);
+    }
+    async function committed(locator, target, saved, consumed, writtenBy, files = []) {
+        const into = movedInto(locator, saved);
+        if (into !== null) {
+            return committedMove(locator, into, target, saved, consumed, writtenBy, files);
+        }
+        const { local, replica, room } = target;
         const changed = saved.flatMap(({ path, parts }) => changedParts(path, underneath(parts, path, replica.visible)));
         if (changed.length > 0)
             return { outcome: 'refused', code: 'changed-underneath', retryable: false, parts: changed };
         const parts = saved.map(({ path, parts }) => changesOf(path, parts));
         const changes = parts.flatMap(({ changes }) => changes);
-        const requeue = requeued(replica.queue, changes, replica.visible, withdrawable, (queue) => replicaOf(replica.confirmed, queue, replica).visible);
+        const visibleOver = function* (queue) {
+            return (yield* replicating(replica.confirmed, queue, replica)).visible;
+        };
+        const requeue = await stepped(requeuing(replica.queue, changes, replica.visible, withdrawable(locator), visibleOver));
         if (requeue.kind === 'refused')
             return { outcome: 'refused', ...requeue.refusal };
         const foreign = [...requeue.withdrawn.keys()].some((origin) => {
@@ -1548,7 +1868,7 @@ export function composeRuntime(options) {
         for (const [origin, replaced] of withdrawn) {
             if (replaced === null)
                 continue;
-            const carried = withdrawnDrafts(pendings.get(origin)?.drafts ?? [], changes);
+            const carried = withdrawnDrafts(pendings.get(pendingKey(locator, origin))?.drafts ?? [], changes);
             drafted.set(replaced.id, replaced === join?.batch
                 ? [
                     ...carried.map((held) => joinedDraft(held, saved)),
@@ -1562,15 +1882,16 @@ export function composeRuntime(options) {
         for (const replaced of withdrawn.values()) {
             if (replaced === null || !batches.includes(replaced))
                 continue;
-            const limited = limitedIn(batches, replaced, limits, (queue) => replicaOf(replica.confirmed, queue, replica).visible);
+            const limited = await stepped(limiting(batches, replaced, limits, visibleOver));
             if (limited !== null)
                 return { outcome: 'refused', ...limited };
         }
         const carried = carriedDrafts(locator, saved, consumed);
         const left = [...consumed, ...carried.keys()];
         const arrived = [...carried.values()];
+        let fencedRoom;
         try {
-            await local.keepAuthored({
+            fencedRoom = await local.saveAuthored(files, {
                 locator,
                 queue: batches,
                 saved: drafted,
@@ -1581,6 +1902,9 @@ export function composeRuntime(options) {
         catch {
             return { outcome: 'refused', code: 'durable-write', retryable: true };
         }
+        if (fencedRoom !== null) {
+            throw runtimeError('room-not-held', `No Local Replica for ${fencedRoom}`);
+        }
         const next = await stepped(replicating(replica.confirmed, batches, replica));
         const set = await stepped(changing(locator, replica, next, {
             queue: true,
@@ -1589,39 +1913,43 @@ export function composeRuntime(options) {
         if (fences.has(locator))
             throw runtimeError('room-not-held', `No Local Replica for ${locator}`);
         for (const origin of withdrawn.keys())
-            pendings.delete(origin);
+            pendings.delete(pendingKey(locator, origin));
         for (const [id, drafts] of drafted) {
-            pendings.set(id, { drafts, submission: { state: 'waiting' }, lost: false });
+            pendings.set(pendingKey(locator, id), {
+                drafts,
+                submission: { state: 'waiting' },
+                lost: false,
+            });
         }
-        if (!localSaves)
-            recorded = false;
         for (const path of left)
             forgetRoomDraft(locator, path);
         for (const record of arrived)
             rememberRoomDraft(record);
         replicas.set(locator, next);
         publishChangeSet(set);
-        moveTo({ ...(localSaves ? status : saving(status)), ...attention() });
-        submitLater(locator);
+        queuedSave(locator);
         const identifier = join?.batch.id ??
             built?.batch.id ??
             [...requeue.withdrawn].map(([origin, replaced]) => replaced?.id ?? origin).at(-1);
         return { outcome: 'saved', identifier };
     }
-    async function mark(local, locator, identifier, submission, lost) {
-        const state = pendings.get(identifier);
-        if (!continuing() ||
-            state === undefined ||
-            (JSON.stringify(state.submission) === JSON.stringify(submission) && state.lost === lost)) {
-            return;
+    async function mark(local, locator, batch, submission, lost) {
+        const partner = partnerOf(batch, locator);
+        for (const held of partner === null ? [locator] : [locator, partner]) {
+            const state = pendings.get(pendingKey(held, batch.id));
+            if (!continuing() ||
+                state === undefined ||
+                (JSON.stringify(state.submission) === JSON.stringify(submission) && state.lost === lost)) {
+                continue;
+            }
+            await local.submit(held, batch.id, submission, lost);
+            if (fences.has(held))
+                continue;
+            pendings.set(pendingKey(held, batch.id), { ...state, submission, lost });
+            const replica = replicas.get(held);
+            if (replica !== undefined)
+                publishChangeSet(changeSet(held, replica, replica, { queue: true }));
         }
-        await local.submit(locator, identifier, submission, lost);
-        if (fences.has(locator))
-            return;
-        pendings.set(identifier, { ...state, submission, lost });
-        const replica = replicas.get(locator);
-        if (replica !== undefined)
-            publishChangeSet(changeSet(locator, replica, replica, { queue: true }));
         moveTo({ ...status, ...attention() });
     }
     async function keepUpload(local, locator, identifier, upload) {
@@ -1630,7 +1958,8 @@ export function composeRuntime(options) {
         await local.keepUpload(locator, identifier, upload);
         if (fences.has(locator))
             throw runtimeError('room-not-held', `No Local Replica for ${locator}`);
-        pendings.set(identifier, { ...pendings.get(identifier), upload });
+        const key = pendingKey(locator, identifier);
+        pendings.set(key, { ...pendings.get(key), upload });
         if (!continuing())
             throw new Error('connection refused');
     }
@@ -1676,19 +2005,61 @@ export function composeRuntime(options) {
             return UNCERTAIN;
         }
     }
-    function queuedBlob(locator, path, localId) {
+    function located(room, path, destination) {
+        const crossing = roomTarget(destination);
+        if (crossing === null) {
+            const named = target(path, destination);
+            return named === null || !rooms.has(room) ? null : { room, path: named };
+        }
+        const held = [...rooms.values()].find((listed) => listed.handle === crossing.handle);
+        return held === undefined ? null : { room: held.locator, path: crossing.path };
+    }
+    async function resolveReference(room, path, destination) {
+        if (roomTarget(destination) === null && target(path, destination) === null) {
+            return ABSENT_TARGET;
+        }
+        const at = located(room, path, destination);
+        if (at === null)
+            return UNREADABLE;
+        if (locked(at.room))
+            return LOCKED_UNREADABLE;
+        const visible = replicas.get(at.room)?.visible;
+        if (visible?.documents[at.path] !== undefined || visible?.binaries[at.path] !== undefined) {
+            return { kind: 'document', ...at };
+        }
+        const history = await readHistory(at.room, at.path);
+        if (history.kind === 'no-history' || history.kind === 'revision')
+            return ABSENT_TARGET;
+        if (history.kind !== 'history')
+            return history;
+        const [last] = history.revisions;
+        if (last === undefined)
+            return ABSENT_TARGET;
+        return history.deleted === true
+            ? { kind: 'deleted', ...at, revision: last }
+            : { kind: 'document', ...at };
+    }
+    async function queuedBlob(locator, path, localId) {
         for (const batch of replicas.get(locator)?.queue ?? []) {
             const change = batch.changes[queuedFile(batch, path, localId)];
             if (change?.kind === 'binary')
-                return change.blob;
+                return (await openLocal()).file(localId, change.mediaType);
         }
-        return null;
+        const drafted = roomDrafts.get(locator)?.get(path)?.parts.file;
+        return drafted?.localId === localId
+            ? (await openLocal()).file(localId, drafted.mediaType)
+            : null;
+    }
+    function batchFile(batch) {
+        return async (localId) => {
+            const change = batch.changes.find((held) => held.kind === 'binary' && held.localId === localId);
+            return (await openLocal()).file(localId, change?.kind === 'binary' ? change.mediaType : '');
+        };
     }
     function binaryRoom(request) {
         if (request.kind === 'path')
             return request.locator;
-        const scope = options.adapter.referrerScope(request.referrer);
-        return scope?.kind === 'room' ? scope.locator : null;
+        return options.adapter.referrerScope(request.referrer)?.locator ?? null;
     }
     async function transferBinary(request, transfer, answer) {
         if (closed || refusal !== null)
@@ -1765,11 +2136,14 @@ export function composeRuntime(options) {
     }
     async function readBinaryPath(locator, path, revision) {
         await ready;
-        const asked = binaryPath(locator, path, revision);
+        const drafted = roomDrafts.get(locator)?.get(path)?.parts.file;
+        const asked = drafted !== undefined && drafted.localId === revision
+            ? { kind: 'pending', localId: revision }
+            : binaryPath(locator, path, revision);
         if (asked === null)
             return absentBinary(path);
         if (asked.kind === 'pending') {
-            const blob = queuedBlob(locator, path, asked.localId);
+            const blob = await queuedBlob(locator, path, asked.localId);
             return blob === null ? absentBinary(path) : { kind: 'binary', blob };
         }
         return readBinary(asked);
@@ -1805,6 +2179,13 @@ export function composeRuntime(options) {
         }
         return undefined;
     }
+    function calledRooms(name, input) {
+        const member = declaredAction(name)?.room;
+        if (member === undefined || input === null || typeof input !== 'object')
+            return [];
+        const named = input[member];
+        return (Array.isArray(named) ? named : [named]).filter((room) => typeof room === 'string');
+    }
     async function invokeAction(name, input, dispatching) {
         await ready;
         if (closed || refusal !== null)
@@ -2143,15 +2524,16 @@ export function composeRuntime(options) {
                 ? accepted.roomVersion
                 : held, accepted.roomVersion);
         if (applied.kind !== 'staged') {
-            const state = pendings.get(submitted.id);
+            const key = pendingKey(room.locator, submitted.id);
+            const state = pendings.get(key);
             await local.accept(room.locator, submitted.id, accepted.roomVersion);
             if (state !== undefined && !fences.has(room.locator))
-                pendings.set(submitted.id, { ...state, accepted: accepted.roomVersion });
+                pendings.set(key, { ...state, accepted: accepted.roomVersion });
             emitQueue(room.locator);
             return applied;
         }
         const settled = await settle(local, room.locator, current, applied.confirmed, current.queue.filter((batch) => batch.id !== submitted.id), { room: true });
-        pendings.delete(submitted.id);
+        pendings.delete(pendingKey(room.locator, submitted.id));
         unreadable.delete(room.locator);
         sourceRefusals.delete(room.locator);
         declarationRefusals.delete(room.locator);
@@ -2162,22 +2544,150 @@ export function composeRuntime(options) {
         return null;
     }
     async function adopted(room, local, submitted, accepted) {
-        const failed = await exclusive(() => adoptAccepted(room, local, submitted, accepted));
+        const failed = await exclusive(async () => {
+            const adopting = await adoptAccepted(room, local, submitted, accepted);
+            await unpair(local);
+            return adopting;
+        });
         if (failed === null)
             return true;
         if (failed.kind === 'refused' && continuing())
             refusedSource(room, failed);
         return false;
     }
+    async function adoptedMove(room, partner, local, submitted, accepted) {
+        const other = discovered.get(partner);
+        const failed = await exclusive(async () => {
+            const left = await adoptAccepted(room, local, submitted, accepted);
+            const arriving = replicas.get(partner)?.queue.find((batch) => batch.id === submitted.id);
+            const arrived = other === undefined || arriving === undefined || accepted.destination === undefined
+                ? null
+                : await adoptAccepted(other, local, arriving, {
+                    kind: 'accepted',
+                    ...accepted.destination,
+                });
+            if (other !== undefined && arrived?.kind === 'refused' && continuing()) {
+                refusedSource(other, arrived);
+            }
+            await unpair(local);
+            return left;
+        });
+        submitLater(partner);
+        if (failed === null)
+            return true;
+        if (failed.kind === 'refused' && continuing())
+            refusedSource(room, failed);
+        return false;
+    }
+    function queueIn(locator) {
+        return replicas.get(locator)?.queue ?? queuesWithoutReplica.get(locator) ?? [];
+    }
+    function behindIn(locator, batch) {
+        const held = replicas.get(locator)?.queue;
+        if (held === undefined)
+            return queuesWithoutReplica.get(locator) !== undefined;
+        return held.findIndex((one) => one.id === batch.id) > 0;
+    }
+    function unpaired(skipped) {
+        for (const locator of [...replicas.keys(), ...queuesWithoutReplica.keys()]) {
+            for (const batch of queueIn(locator)) {
+                const partner = partnerOf(batch, locator);
+                if (partner === null || skipped.has(pendingKey(locator, batch.id)))
+                    continue;
+                if (queueIn(partner).some((held) => held.id === batch.id))
+                    continue;
+                if (pendings.get(pendingKey(locator, batch.id))?.accepted !== undefined)
+                    continue;
+                if (leavingIn(batch, locator) && !withdrawable(locator)(batch))
+                    continue;
+                return { locator, batch };
+            }
+        }
+        return null;
+    }
+    async function unpair(local) {
+        const handled = new Set();
+        for (let held = unpaired(handled); held !== null && continuing(); held = unpaired(handled)) {
+            const { locator, batch } = held;
+            handled.add(pendingKey(locator, batch.id));
+            journal.record(`outcome ${locator} ${batch.id} ${localSaves ? 'dropped' : 'unpaired'}`);
+            const leaving = {
+                batch,
+                returned: !localSaves && leavingIn(batch, locator) ? returnedBy('withdrawn') : null,
+            };
+            const current = replicas.get(locator);
+            if (current !== undefined) {
+                const settled = await settle(local, locator, current, current.confirmed, current.queue.filter((one) => one.id !== batch.id), { leaving });
+                publishChangeSet(settled());
+                continue;
+            }
+            const queue = queueIn(locator).filter((one) => one.id !== batch.id);
+            const written = new Map((leaving.returned === null
+                ? []
+                : (pendings.get(pendingKey(locator, batch.id))?.drafts ?? [])).map((saved) => [
+                saved.path,
+                {
+                    locator,
+                    path: saved.path,
+                    revision: roomDraftRevision(),
+                    parts: returnedInto(roomDrafts.get(locator)?.get(saved.path)?.parts, saved.parts),
+                    returned: leaving.returned,
+                },
+            ]));
+            const carried = carriedBack(locator, leaving.returned === null ? [] : [batch], written);
+            await local.keepAuthored({
+                locator,
+                queue,
+                roomDrafts: [...written.values()],
+                consumedRoomDrafts: carried.taken,
+            }, ...carried.writes);
+            pendings.delete(pendingKey(locator, batch.id));
+            if (queue.length > 0)
+                queuesWithoutReplica.set(locator, queue);
+            else
+                queuesWithoutReplica.delete(locator);
+            for (const record of written.values())
+                rememberRoomDraft(record);
+            carried.remember();
+            publishChangeSet(mergeChangeSets([
+                changeSet(locator, null, null, {
+                    queue: true,
+                    drafts: [...written.keys(), ...carried.taken],
+                }),
+                ...carried.changes,
+            ]));
+        }
+        if (handled.size === 0)
+            return;
+        moveTo({ ...status, ...attention() });
+        for (const key of handled)
+            submitLater(key.slice(0, key.indexOf('\u0000')));
+    }
+    async function discardHeld(head, room, local, signal) {
+        const partner = partnerOf(head, room.locator);
+        const other = partner === null ? undefined : discovered.get(partner);
+        await discardPending(room, local, signal);
+        if (other !== undefined && !signal.aborted)
+            await discardPending(other, local, signal);
+    }
     async function submitRoom(room, local, authorized, progress, signal) {
         while (continuing() && authorization !== undefined && !signal.aborted) {
             const replica = replicas.get(room.locator);
             const head = replica?.queue[0];
             if (replica === undefined || head === undefined)
                 return 'done';
-            if (pendings.get(head.id)?.accepted !== undefined)
+            const state = pendings.get(pendingKey(room.locator, head.id));
+            if (state?.accepted !== undefined)
+                return 'done';
+            const partner = partnerOf(head, room.locator);
+            if (partner !== null && !leavingIn(head, room.locator)) {
+                submitLater(partner);
                 return 'done';
-            const state = pendings.get(head.id);
+            }
+            if (partner !== null && behindIn(partner, head)) {
+                progress.complete = false;
+                return 'done';
+            }
             const { submission, lost: earlier } = state ?? {
                 submission: { state: 'waiting' },
                 lost: false,
@@ -2193,16 +2703,16 @@ export function composeRuntime(options) {
             }
             const lost = earlier || submission.state === 'submitted';
             if (lost && pastHorizon(head.id)) {
-                await discardPending(room, local, signal);
+                await discardHeld(head, room, local, signal);
                 return 'done';
             }
             let result;
             journal.record(`submission ${room.locator} ${head.id}`);
-            await exclusive(() => mark(local, room.locator, head.id, { state: 'submitted' }, lost));
+            await exclusive(() => mark(local, room.locator, head, { state: 'submitted' }, lost));
             if (discoveryPaused || fences.has(room.locator))
                 return 'done';
             if (signal.aborted || writesHeld()) {
-                await exclusive(() => mark(local, room.locator, head.id, submission, earlier));
+                await exclusive(() => mark(local, room.locator, head, submission, earlier));
                 if (signal.aborted)
                     return 'done';
                 progress.complete = false;
@@ -2210,11 +2720,17 @@ export function composeRuntime(options) {
                 return 'done';
             }
             const opensBefore = openSignals;
-            const answered = awaitingAnswer(room.locator);
+            const answeredHere = awaitingAnswer(room.locator);
+            const answeredThere = partner === null ? () => { } : awaitingAnswer(partner);
+            const answered = () => {
+                answeredHere();
+                answeredThere();
+            };
             try {
                 result = await options.adapter.mutate(authorized, {
                     locator: room.locator,
                     changeBatch: head,
+                    file: batchFile(head),
                     ...(state?.upload === undefined ? {} : { upload: state.upload }),
                 }, (upload) => exclusive(() => keepUpload(local, room.locator, head.id, upload)));
             }
@@ -2239,9 +2755,10 @@ export function composeRuntime(options) {
                 return 'again';
             }
             if (result.kind === 'room-not-readable') {
+                const unread = discovered.get(result.locator) ?? room;
                 progress.complete = false;
-                unreadable.add(room.locator);
-                list(room, false);
+                unreadable.add(unread.locator);
+                list(unread, false);
                 emitRooms();
                 return 'done';
             }
@@ -2256,24 +2773,30 @@ export function composeRuntime(options) {
             }
             if (result.kind === 'write-halted') {
                 journal.record(`outcome ${room.locator} ${head.id} write-halted`);
-                await exclusive(() => mark(local, room.locator, head.id, { state: 'waiting' }, lost));
+                await exclusive(() => mark(local, room.locator, head, { state: 'waiting' }, lost));
                 if (serviceMode === 'open' && openSignals !== opensBefore)
                     continue;
                 haltedRefusal = true;
                 progress.complete = false;
                 return 'done';
             }
+            const other = partner === null ? undefined : discovered.get(partner);
             if (result.kind === 'conflicted' ||
                 result.kind === 'rejected' ||
                 result.kind === 'expired' ||
                 result.kind === 'retryable-refusal') {
                 if (result.kind === 'expired' && lost && result.restored !== true) {
                     journal.record(`outcome ${room.locator} ${head.id} expired`);
-                    await discardPending(room, local, signal);
+                    await discardHeld(head, room, local, signal);
                     return 'done';
                 }
                 if (result.kind === 'expired') {
-                    await exclusive(() => mark(local, room.locator, head.id, { state: 'waiting' }, false));
+                    await exclusive(() => mark(local, room.locator, head, { state: 'waiting' }, partner !== null && lost));
+                    const there = other === undefined ? null : await advance(other, local, authorized, continuing);
+                    if (other !== undefined && there !== null) {
+                        await withhold(there, other, local, progress);
+                        return 'done';
+                    }
                     const withheld = await advance(room, local, authorized, continuing);
                     if (withheld !== null) {
                         await withhold(withheld, room, local, progress);
@@ -2290,11 +2813,25 @@ export function composeRuntime(options) {
             if (result.kind === 'retryable-refusal') {
                 const reset = result.reset;
                 progress.complete = false;
-                await exclusive(() => mark(local, room.locator, head.id, reset === undefined ? { state: 'waiting' } : { state: 'reset', reset }, lost));
+                await exclusive(() => mark(local, room.locator, head, reset === undefined ? { state: 'waiting' } : { state: 'reset', reset }, lost));
                 return reset === undefined ? 'again' : { at: Date.parse(reset) };
             }
             if (result.kind === 'conflicted' || result.kind === 'rejected' || result.kind === 'expired') {
                 const left = leaving(head, result);
+                const refreshed = async () => ({
+                    there: other === undefined ? null : await advance(other, local, authorized, continuing),
+                    here: await advance(room, local, authorized, continuing),
+                });
+                const judged = result.kind === 'conflicted' && other !== undefined ? await refreshed() : null;
+                if (judged !== null && (judged.there !== null || judged.here !== null)) {
+                    await exclusive(() => mark(local, room.locator, head, { state: 'waiting' }, lost));
+                    if (other !== undefined && judged.there !== null) {
+                        await withhold(judged.there, other, local, progress);
+                    }
+                    if (judged.here !== null)
+                        await withhold(judged.here, room, local, progress);
+                    return 'done';
+                }
                 await exclusive(async () => {
                     if (!continuing())
                         return;
@@ -2303,24 +2840,30 @@ export function composeRuntime(options) {
                         return;
                     }
                     const settled = await settle(local, room.locator, current, current.confirmed, current.queue.filter((batch) => batch.id !== head.id), {
-                        leaving: (result.kind === 'expired' && landed(head, current.confirmed)) ||
-                            (result.kind === 'conflicted' && landed(head, current.confirmed, result.affected))
+                        leaving: (result.kind === 'expired' && landedWhole(room.locator, head, current.confirmed)) ||
+                            (result.kind === 'conflicted' &&
+                                landedWhole(room.locator, head, current.confirmed, result.affected))
                             ? { ...left, returned: null }
                             : left,
                     });
                     publishChangeSet(settled());
+                    await unpair(local);
                     moveTo({ ...status, ...attention() });
                 });
                 if (result.kind === 'expired')
                     continue;
-                const withheld = await advance(room, local, authorized, continuing);
-                if (withheld !== null) {
-                    await withhold(withheld, room, local, progress);
+                const { there, here } = judged ?? (await refreshed());
+                if (other !== undefined && there !== null)
+                    await withhold(there, other, local, progress);
+                if (here !== null) {
+                    await withhold(here, room, local, progress);
                     return 'done';
                 }
                 continue;
             }
-            const kept = await adopted(room, local, head, result).finally(answered);
+            const kept = await (partner === null
+                ? adopted(room, local, head, result)
+                : adoptedMove(room, partner, local, head, result)).finally(answered);
             if (!kept) {
                 progress.complete = false;
                 return 'done';
@@ -2347,9 +2890,9 @@ export function composeRuntime(options) {
                 fences.delete(locator);
             }
             for (const batch of queue)
-                pendings.delete(batch.id);
+                pendings.delete(pendingKey(locator, batch.id));
             queuesWithoutReplica.delete(locator);
-            const after = before === undefined ? null : replicaOf(before.confirmed, [], before);
+            const after = before === undefined ? null : await stepped(replicating(before.confirmed, [], before));
             if (after !== null)
                 replicas.set(locator, after);
             journal.record(`room discarded ${locator}`);
@@ -2411,7 +2954,7 @@ export function composeRuntime(options) {
                     ...(attached === 'collection' ? { model: next } : { selectionModel: next }),
                 };
                 const reclassified = sameMembership(declared, held.confirmed.record)
-                    ? { kind: 'staged', confirmed: confirmedOf(declared, held.confirmed) }
+                    ? { kind: 'staged', confirmed: await confirmedOf(declared, held.confirmed) }
                     : await readReclassified(declared, held.confirmed);
                 const record = reclassified.kind === 'staged'
                     ? declared
@@ -2420,12 +2963,13 @@ export function composeRuntime(options) {
                         typedSelection: held.confirmed.record.typedSelection,
                     };
                 const read = reclassified.kind === 'deferred'
-                    ? { kind: 'staged', confirmed: confirmedOf(record, held.confirmed) }
+                    ? { kind: 'staged', confirmed: await confirmedOf(record, held.confirmed) }
                     : reclassified;
                 await local.write({ next: record, previous: held.confirmed.record });
                 const replica = read.kind === 'staged'
                     ? await stepped(replicating(read.confirmed, held.queue, held))
                     : { ...held, confirmed: { ...held.confirmed, record } };
+                await stepped(counting(replica));
                 const set = await stepped(changing(room.locator, held, replica, { room: true }));
                 replicas.set(room.locator, replica);
                 changed = heldChange(room.locator, held, replica, set, { room: true });
@@ -2453,7 +2997,7 @@ export function composeRuntime(options) {
         });
     }
     async function scoped(result, room, local) {
-        if ((result.scope === 'content' || result.scope === 'sync') && !result.retryable) {
+        if (result.scope === 'content' && !result.retryable) {
             journal.record(`scoped refusal ${room.locator} ${result.scope} ${result.code}`);
             await loseRooms([room.locator]);
             return;
@@ -2471,15 +3015,7 @@ export function composeRuntime(options) {
             });
         else if (result.scope !== 'operation') {
             unreadable.add(room.locator);
-            scopedAway = {
-                ...room,
-                replica: { ...room.replica, admission: 'unavailable' },
-                operations: {
-                    ...room.operations,
-                    ...(result.scope === 'content' ? { read: [] } : {}),
-                    ...(result.scope === 'sync' ? { sync: [] } : {}),
-                },
-            };
+            scopedAway = { ...room, replica: { ...room.replica, admission: 'unavailable' } };
             await retainModel(local, scopedAway, 'collection', modelOf(room.locator));
         }
         if (!continuing())
@@ -2639,12 +3175,13 @@ export function composeRuntime(options) {
         }
         for (const room of result.rooms) {
             if (room.operations === undefined ||
-                !['read', 'sync', 'write', 'delete'].every((operation) => Array.isArray(room.operations[operation]) &&
+                !['write', 'delete'].every((operation) => Array.isArray(room.operations[operation]) &&
                     room.operations[operation].every((scope) => typeof scope === 'string')) ||
                 room.replica === undefined ||
                 typeof room.replica.selection !== 'string' ||
                 room.replica.selection.length === 0 ||
-                !['admitted', 'unavailable'].includes(room.replica.admission)) {
+                !['admitted', 'unavailable'].includes(room.replica.admission) ||
+                !['locked', 'open'].includes(room.replica.offline)) {
                 journal.record(`invalid model or replica declaration ${room.locator}`);
                 await refuse('missing-required-guarantee');
                 notifyReady();
@@ -2806,6 +3343,7 @@ export function composeRuntime(options) {
     function closedSocket(revoked, lost) {
         const opened = socketOpen;
         socketOpen = false;
+        connectionLost();
         if (lost) {
             reads.lost();
             conversations.lost();
@@ -3130,6 +3668,7 @@ export function composeRuntime(options) {
                 return;
             if (event.kind === 'opened') {
                 socketOpen = true;
+                connectionLive();
                 generation += 1;
                 reads.opened();
                 conversations.reopened();
@@ -3216,6 +3755,8 @@ export function composeRuntime(options) {
         closed = true;
         if (rechecking !== null)
             clearInterval(rechecking);
+        connectionLive();
+        lockListeners.clear();
         readinessWatches.clear();
         withdrawStream?.();
         withdrawStream = undefined;
@@ -3301,14 +3842,23 @@ export function composeRuntime(options) {
             stop();
         };
     }
-    async function searched(input, reach) {
+    async function searched(input, reach, locked) {
         const asked = searchPlanOf(input);
         const plan = { ...asked, limit: capped(asked.limit) };
-        const filter = filterOf(plan.documents ?? {}, roomFacts(reach), planReach(reach));
+        const filter = {
+            ...filterOf(plan.documents ?? {}, roomFacts(reach), planReach(reach)),
+            locked,
+        };
+        const unlocking = (filter.rooms ?? [])
+            .filter((room) => locked.includes(room))
+            .map((room) => ({ room, awaits: 'unlock' }));
         for (;;) {
             const cover = covered(filter);
             awaitPreparation(cover);
-            const pending = 'pending' in cover ? [...cover.pending] : [];
+            const pending = [
+                ...unlocking,
+                ...('pending' in cover ? cover.pending : []),
+            ];
             const awaited = new Set('pending' in cover ? cover.pending.map(({ room }) => room) : []);
             const held = covered({
                 ...filter,
@@ -3351,7 +3901,11 @@ export function composeRuntime(options) {
             if (searchIndex.changes() !== seen ||
                 JSON.stringify(covered(answering)) !== JSON.stringify(answered))
                 continue;
-            const hits = searchIndex.search(plan, selected === null ? null : selected.documents, searchedConversations, answering.rooms === null ? null : new Set(answering.rooms), plan.collection
+            const hits = searchIndex.search(plan, selected === null ? null : selected.documents, searchedConversations, answering.rooms !== null
+                ? new Set(answering.rooms)
+                : locked.length === 0
+                    ? null
+                    : new Set(reachedRooms(answering)), plan.collection
                 ? new Map(answered.coverage.rooms.map(({ room }) => [
                     room,
                     replicas.get(room)?.confirmed.record.typedSelection?.roots ?? [],
@@ -3475,7 +4029,7 @@ export function composeRuntime(options) {
             return listed();
         },
         query: ((input) => rowsQuery(planned(input, null))),
-        search: (input) => searched(input, null),
+        search: (input) => searched(input, null, []),
         types(locator) {
             return {
                 collection: modelTypes(modelOf(locator)),
@@ -3519,7 +4073,9 @@ export function composeRuntime(options) {
                         parts: held(current?.parts, parts, file),
                         returned: current?.returned ?? null,
                     };
-                    await local.keepRoomDraft(record);
+                    await local.keepRoomDraft(record, parts.file === undefined || file === undefined
+                        ? []
+                        : [{ key: file.localId, blob: parts.file.blob }]);
                     rememberRoomDraft(record);
                     publishChangeSet(changeSet(room, null, null, { drafts: [path] }));
                     return { outcome: 'written', roomDraft: roomDraftOf(record) };
@@ -3568,13 +4124,18 @@ export function composeRuntime(options) {
         history(locator, path, query) {
             return readHistory(locator, path, query);
         },
+        resolve(room, path, destination) {
+            return resolveReference(room, path, destination);
+        },
         binaryFile: {
             read: readBinaryPath,
             link: linkBinaryPath,
             readReference: readBinaryReference,
         },
-        call(name, input) {
-            return recoveredAction(name, input);
+        async call(name, input) {
+            await ready;
+            const room = calledRooms(name, input).find((one) => locked(one));
+            return room === undefined ? recoveredAction(name, input) : lockedRoom(room);
         },
         reached(locator, roomVersion, path) {
             return path === undefined
@@ -3619,6 +4180,10 @@ export function composeRuntime(options) {
         watchPlan,
         search: searched,
         watchReadiness,
+        locked,
+        lockedRooms,
+        watchLocks,
+        located,
     };
     return {
         md,