@agentshouse/mdruntime 0.1.0-cc5745cd9af96 → 0.1.0-ccbe92df1c4f6

package/dist/connection.js

@@ -1,47 +1,41 @@
-import { attachedModel } from './attached-model.js';
+import { escapePointer, parseFrontmatter, roomTarget, target } from '@agentshouse/mdmodel';
+import { attachedModel, NO_ROOM_TYPES, roomTypesOf } from './attached-model.js';
 import { cached, modelTypes, NO_MODEL, sameModel, } from './model.js';
 import { observing, whole } from './observation.js';
 import { filterOf, identityOf, planOf, plain, queryKey, } from './query.js';
-import { createReadSide } from './read-side.js';
+import { createLiveQueries } from './live.js';
 import { seededResult } from './seed.js';
-import { markdownPath, roomOfKey } from './rows.js';
-import { createSearchIndex, searchPlanOf, } from './search.js';
+import { documentKey, roomOfKey } from './rows.js';
+import { searchPlanOf } from './search.js';
 import { capped, MAXIMUM_WINDOW } from './windows.js';
 import { bootstrapRoom } from './bootstrap.js';
-import { changeSet, changing, entering, mergeChangeSets } from './change-set.js';
+import { changeSet, mergeChangeSets } from './change-set.js';
 import { createConversationStore, } from './conversation.js';
-import { queuedFile } from './change.js';
-import { indexReferrers, referencesIndexed, validRoot, } from './collection.js';
+import { leaving as leavingIn, partnerOf, queuedFile, } from './change.js';
+import { available, collectionOf, unreadable as unreadableIn, validRoot, } from './collection.js';
 import { runtimeError } from './failure.js';
 import { createLog } from './log.js';
 import { binaryRecord } from './binary.js';
-import { absentBinary, binaryAnswer, binaryLinkAnswer, calledResult, failure, historyAnswer, undeclared, UNCERTAIN, } from './outcome.js';
+import { openedFiles } from './opened.js';
+import { ABSENT_TARGET, absentBinary, binaryAnswer, binaryLinkAnswer, calledResult, failure, historyAnswer, LOCKED_UNREADABLE, lockedRoom, undeclared, UNCERTAIN, UNREADABLE, } from './outcome.js';
 import { createRecovery } from './recovery.js';
 import { doorReads } from './reads.js';
-import { refreshRoom } from './refresh.js';
-import { buildBatch, joined, limitedIn, queuedDocuments, requeued, } from './save.js';
-import { applyReturned, compositionOf, confirmedOf, landed, readReclassified, replicaOf, replicating, sameMembership, standing, } from './replica.js';
+import { advancement } from './refresh.js';
+import { buildBatch, buildMove, joined, limiting, queuedDocuments, requeuing, } from './save.js';
+import { compositionOf, entryAt, landed, movedBy, overlayOf, replaying, returning, returnedPaths, sameMembership, slicing, slicingWith, standing, storedRecord, touchedBy, } from './replica.js';
 import { binaryBase, changedParts, changesOf, held, heldFile, joinedDraft, moveTarget, readParts, returnedBy, returnedInto, staleWrite, underneath, withdrawnDrafts, } from './room-draft.js';
 import { same, saving, STARTING, transferring, } from './status.js';
-import { detectStorageLoss, nextGeneration } from './durability.js';
-import { readinessOf, SETTLED_ROOMS, } from './readiness.js';
+import { detectStorageLoss, nextGeneration, refusedForSpace, } from './durability.js';
+import { readinessOf, } from './readiness.js';
 import { FencedMap } from './fence.js';
-import { tally } from './shared.js';
-import { inChunks, ROW_WEIGHT, stepped, yielded } from './turn.js';
+import { sameBinary } from './overlay.js';
+import { paced, ROW_WEIGHT, stepped, yielded } from './turn.js';
 import { identityTime, roomDraftRevision } from './identity.js';
 import { beneath, normalize } from './paths.js';
 import { openRuntimeStore, } from './store.js';
+import { changedCleanly, sameComposition, validatedCollection, } from './validation.js';
 import { unconfirmed } from './transfer.js';
 import { governs, holds, narrowed, planReach, } from './reach.js';
-function roomsAlone(plan) {
-    return (plan.reach === null &&
-        plan.root.types === null &&
-        plan.root.where === null &&
-        plan.root.pathPrefix === null &&
-        plan.paths === null &&
-        plan.hop === null &&
-        plan.backlinks === null);
-}
 function within(root, path) {
     return root === '' || beneath(root, path);
 }
@@ -59,24 +53,30 @@ const OPENING_LANE = 'opening';
 const CONVERSATION_LANE = 'conversations';
 const ROOM_READS = 256;
 const ROOM_ATTEMPTS = 16;
+const ERASE_BATCH = 512;
+const REDERIVE_BATCH = 256;
+const WALK_BYTES = 1 << 20;
+const QUERY_BYTES = 1 << 20;
+const STAGE_BYTES = 1 << 20;
+const STAGE_FLOOR = 1 << 16;
+// A batch aims at this much database work, so a Save or a query waits behind at most one short write.
+const STAGE_AIM_MS = 50;
+const PARTS_HELD = 4;
+// Bytes still arriving are reported at most this often, well inside the 2 s progress bound, so readiness is not rebuilt for every chunk the network hands over.
+const ARRIVAL_REPORT_MS = 250;
+const INSTALL_STEPS = [
+    'writing',
+    'downloading',
+    'replaying',
+    'listing',
+];
+const CLEAN_CHANGES = 2_000;
+// A Room that locks offline stays readable this long after the connection drops, so a laptop waking or changing network keeps working while a disconnected device locks soon after.
+const LOCK_GRACE_MS = 120_000;
 function operationOf(input) {
     const operation = input?.operation_id;
     return typeof operation === 'string' ? operation : null;
 }
-const outside = new Map();
-function outsideOf(roots) {
-    const key = JSON.stringify(roots);
-    const held = outside.get(key);
-    if (held !== undefined)
-        return held;
-    const counted = (path) => (roots.some((root) => beneath(root, path)) ? 0 : 1);
-    const made = {
-        documents: (path) => (markdownPath(path) ? counted(path) : 0),
-        binaries: counted,
-    };
-    outside.set(key, made);
-    return made;
-}
 function abandonedOn(signal) {
     return new Promise((resolve) => {
         if (signal.aborted)
@@ -88,11 +88,14 @@ function abandonedOn(signal) {
 function roomLane(locator) {
     return `room ${locator}`;
 }
+function pendingKey(locator, id) {
+    return `${locator}\u0000${id}`;
+}
 export function composeRuntime(options) {
     const localSaves = options.adapter.localSaves === true;
+    const roomTypes = roomTypesOf(options.adapter.roomTypes);
     let authorization = options.authorization;
     let opening;
-    let store;
     const fences = new Map();
     const isFenced = (locator) => fences.has(locator);
     let fencings = 0;
@@ -176,50 +179,79 @@ export function composeRuntime(options) {
     const queueSubscriptions = new Set();
     const roomDraftListeners = new Set();
     const presentationListeners = new Set();
-    const readSide = createReadSide();
+    const liveQueries = createLiveQueries((plan, cover) => answeredPlan(plan, cover));
     let withdrawConversations;
     let currencyQueued = null;
     let socketOpen = false;
+    const confirmed = new Set();
+    let lockGrace = null;
+    const lockListeners = new Set();
     let serviceMode = 'open';
     let haltedRefusal = false;
     let openSignals = 0;
     const serviceModeListeners = new Set();
     let member = null;
     const memberListeners = new Set();
-    const prepared = new Set();
-    const projecting = new Set();
     const unpreparedDemand = new Set();
-    const unindexable = new Set();
+    const unpreparable = new Set();
     let preparing = false;
     let targets = {};
     let persistence = options.shell.persistence;
-    let capacity = null;
-    const paused = new Set();
-    let rechecking = null;
+    let full = false;
+    let probing = null;
+    let testing = null;
+    const database = {
+        async ask(request) {
+            try {
+                return await options.database.ask(request);
+            }
+            catch (error) {
+                if (refusedForSpace(error))
+                    filled();
+                throw error;
+            }
+        },
+    };
     const readinessWatches = new Set();
     let readinessQueued = false;
     const catching = new Set();
     const transfers = new FencedMap(isFenced);
+    const installs = new Map();
+    const arrivals = new Map();
+    let arrivalReported = 0;
+    let onScreen = options.shell.onScreen;
+    const shownWaiters = [];
+    let partsFree = PARTS_HELD;
+    const partWaiters = [];
+    let stageBytes = STAGE_FLOOR * 4;
+    let installWrites = Promise.resolve();
     const conversations = createConversationStore({
         agents: declaredAgents,
-        documents: ({ locator }) => rowsQuery(planOf({ rooms: [locator], select: { fields: 'all' } }, roomFacts())),
+        documents: (declaration, after) => rowsQuery(planOf({
+            rooms: [declaration.locator],
+            types: [declaration.type],
+            select: {
+                fields: [
+                    declaration.identity,
+                    declaration.name,
+                    ...(declaration.retired === undefined ? [] : [declaration.retired]),
+                ].map((field) => `/${escapePointer(field)}`),
+            },
+            limit: MAXIMUM_WINDOW,
+            ...(after === undefined ? {} : { after }),
+        }, roomFacts())),
         call: (name, input) => invokeAction(name, input),
         durably,
         stream: () => options.adapter.conversations,
         publish: publishChangeSet,
         online: () => connectionOf() !== 'unreachable' && refusal === null,
+        full: () => full,
         closed: () => closed,
         unanswered: resendLater,
         expired: (operation) => pastHorizon(operation),
     });
-    const searchIndex = createSearchIndex({
-        room: (room) => readSide.room(room),
-        document: (room, path) => readSide.document(room, path),
-    });
-    const roomsToIndex = new Set();
-    const conversationsToIndex = new Set();
-    let indexing = false;
     const journal = createLog();
+    const keptFiles = openedFiles(database, isFenced);
     let notifyReady = () => { };
     const ready = new Promise((resolve) => {
         notifyReady = resolve;
@@ -237,16 +269,36 @@ export function composeRuntime(options) {
         if (room.size === 0)
             roomDrafts.delete(locator);
     }
-    function roomDraftOf(record) {
+    async function visibleOf(locator, paths) {
+        const held = replicas.get(locator);
+        if (held === undefined)
+            return undefined;
+        const local = await openLocal();
+        const slice = await stepped(slicing(await local.entries(held.record.key, 'visible', paths), paths));
+        return { ...slice, collection: collectionOf(slice.documents, compositionOf(held.record)) };
+    }
+    function roomDraftOf(record, visible) {
         return structuredClone({
             room: record.locator,
             path: record.path,
             revision: record.revision,
             parts: record.parts,
-            changedUnderneath: underneath(record.parts, record.path, replicas.get(record.locator)?.visible),
+            changedUnderneath: underneath(record.parts, record.path, visible),
             returned: record.returned,
         });
     }
+    async function roomDraftsOf(records) {
+        const rooms = new Map();
+        for (const record of records) {
+            const paths = rooms.get(record.locator) ?? [];
+            paths.push(record.path);
+            rooms.set(record.locator, paths);
+        }
+        const layers = new Map();
+        for (const [locator, paths] of rooms)
+            layers.set(locator, await visibleOf(locator, paths));
+        return records.map((record) => roomDraftOf(record, layers.get(record.locator)));
+    }
     function snapshotRoomDrafts() {
         const records = [...roomDrafts.values()].flatMap((room) => [...room.values()]);
         records.sort((left, right) => {
@@ -256,18 +308,24 @@ export function composeRuntime(options) {
                 return left.path < right.path ? -1 : 1;
             return 0;
         });
-        return records.map(roomDraftOf);
+        return roomDraftsOf(records);
     }
+    let draftsShown = Promise.resolve();
     function publishRoomDrafts(waitingOnly) {
         if (closed)
             return;
-        const value = snapshotRoomDrafts();
-        for (const listener of roomDraftListeners) {
-            if (waitingOnly && listener.ready)
-                continue;
-            listener.ready = true;
-            listener.notify(value);
-        }
+        const snapshot = snapshotRoomDrafts();
+        draftsShown = draftsShown.then(async () => {
+            const value = await snapshot.catch(() => null);
+            if (value === null || closed)
+                return;
+            for (const listener of roomDraftListeners) {
+                if (waitingOnly && listener.ready)
+                    continue;
+                listener.ready = true;
+                listener.notify(value);
+            }
+        });
     }
     function presentationOf(app) {
         const value = presentations.get(app);
@@ -279,7 +337,7 @@ export function composeRuntime(options) {
             const stored = next(presentations.get(app));
             await local.present({ app, value: stored });
             presentations.set(app, stored);
-            publishChangeSet(changeSet('', null, null, { presentation: app }));
+            publishChangeSet(changeSet('', { presentation: app }));
         });
     }
     function emitPresentation(app) {
@@ -330,21 +388,69 @@ export function composeRuntime(options) {
         return { attentionRequired, reset };
     }
     function documentsIn(locator) {
-        const replica = replicas.get(locator);
-        if (replica === undefined)
-            return 0;
-        const roots = replica.confirmed.record.typedSelection?.roots ?? [];
-        const weighed = outsideOf(roots);
-        return (tally(replica.visible.documents, weighed.documents) +
-            tally(replica.visible.binaries, weighed.binaries));
+        return replicas.get(locator)?.count ?? 0;
     }
     function listed() {
         return structuredClone([...rooms.values()].map((room) => {
             const documents = documentsIn(room.locator);
             counted.set(room.locator, documents);
-            return { ...room, documents };
+            return locked(room.locator)
+                ? {
+                    ...room,
+                    model: modelTypes(NO_MODEL),
+                    typedSelection: null,
+                    documents: 0,
+                    locked: true,
+                }
+                : { ...room, documents, locked: false };
         }));
     }
+    function locked(locator) {
+        return rooms.get(locator)?.replica.offline === 'locked' && !confirmed.has(locator);
+    }
+    function lockedRooms() {
+        return [...rooms.keys()].filter(locked).sort();
+    }
+    function relocked(before) {
+        const after = lockedRooms();
+        if (JSON.stringify(after) === JSON.stringify(before))
+            return;
+        journal.record(`locked ${after.length}`);
+        emitRooms();
+        for (const notify of [...lockListeners])
+            notify();
+    }
+    function confirmLocks(listed) {
+        if (!socketOpen)
+            return;
+        for (const room of listed) {
+            if (room.replica.admission === 'admitted')
+                confirmed.add(room.locator);
+        }
+    }
+    function connectionLost() {
+        if (lockGrace !== null || closed)
+            return;
+        lockGrace = setTimeout(() => {
+            lockGrace = null;
+            if (socketOpen || closed)
+                return;
+            const before = lockedRooms();
+            confirmed.clear();
+            relocked(before);
+        }, LOCK_GRACE_MS);
+    }
+    function connectionLive() {
+        if (lockGrace !== null)
+            clearTimeout(lockGrace);
+        lockGrace = null;
+    }
+    function watchLocks(notify) {
+        lockListeners.add(notify);
+        return () => {
+            lockListeners.delete(notify);
+        };
+    }
     function roomFacts(reach = null) {
         const held = [...rooms.values()]
             .filter((room) => holds(reach, room.locator))
@@ -363,7 +469,7 @@ export function composeRuntime(options) {
         return { listed: roomsListed, rooms: held };
     }
     function emitRooms() {
-        readSide.recover();
+        liveQueries.recover();
         queueReadiness();
         const value = listed();
         for (const listener of roomListeners)
@@ -402,17 +508,17 @@ export function composeRuntime(options) {
         for (const listener of statusListeners)
             listener(shown);
     }
-    function entryOf(batch) {
+    function entryOf(locator, batch) {
         if (localSaves)
             return Object.freeze({ batch, state: 'local' });
-        const state = pendings.get(batch.id);
+        const state = pendings.get(pendingKey(locator, batch.id));
         if (state?.accepted !== undefined) {
             return Object.freeze({ batch, state: 'accepted', roomVersion: state.accepted });
         }
         return Object.freeze({ batch, ...(state?.submission ?? { state: 'waiting' }) });
     }
     function entriesOf(locator) {
-        return (replicas.get(locator)?.queue ?? queuesWithoutReplica.get(locator) ?? []).map(entryOf);
+        return (replicas.get(locator)?.queue ?? queuesWithoutReplica.get(locator) ?? []).map((batch) => entryOf(locator, batch));
     }
     function emitQueue(locator) {
         const entries = entriesOf(locator);
@@ -422,66 +528,39 @@ export function composeRuntime(options) {
         }
     }
     function applyChangeSet(set) {
-        const held = {
-            ...set,
-            documents: set.documents.filter(({ locator }) => prepared.has(locator) || projecting.has(locator)),
-        };
-        const applied = readSide.apply(held, () => searchIndex.changed(held));
-        if (applied instanceof Promise)
-            void applied.catch(unpublished);
+        liveQueries.touched(set);
     }
     function unpublished(error) {
         journal.record(`publication failed ${error instanceof Error ? error.name : 'unknown'}`);
     }
-    async function referenced(locator) {
-        for (;;) {
-            const record = replicas.get(locator)?.confirmed.record;
-            if (record === undefined || closed)
-                return;
-            const held = { text: record.documents, binaries: record.binaries };
-            const composition = compositionOf(record);
-            if (referencesIndexed(held, composition))
-                return;
-            await indexReferrers(held, composition);
-        }
+    function indexed(locator) {
+        return replicas.get(locator)?.indexed === true;
     }
     async function prepareReplica(locator) {
-        await referenced(locator);
-        const replica = replicas.get(locator);
-        if (replica === undefined || closed || prepared.has(locator))
-            return;
-        const visible = replica.visible;
-        const paths = [
-            ...new Set([...Object.keys(visible.documents), ...Object.keys(visible.binaries)]),
-        ];
-        const entered = [];
-        projecting.add(locator);
-        try {
-            await inChunks(paths, (path) => ROW_WEIGHT + (visible.documents[path]?.length ?? 0), (chunk) => {
-                const current = replicas.get(locator);
-                if (current === undefined || closed)
-                    return;
-                const set = entering(locator, current, chunk);
-                entered.push(set);
-                return readSide.apply(set);
-            });
-            if (!replicas.has(locator) || closed)
+        for (;;) {
+            const held = replicas.get(locator);
+            if (held === undefined || closed || held.indexed)
                 return;
-            prepared.add(locator);
-        }
-        finally {
-            projecting.delete(locator);
+            const key = held.record.key;
+            const done = await exclusive(async () => (await openLocal()).rederive(key, REDERIVE_BATCH));
+            const now = replicas.get(locator);
+            if (now?.record.key !== key)
+                continue;
+            if (!done)
+                continue;
+            replicas.set(locator, { ...now, indexed: true });
+            publishChangeSet(changeSet(locator, { documents: null }));
+            liveQueries.recover();
+            queueReadiness();
+            return;
         }
-        conversations.changed(mergeChangeSets(entered));
-        readSide.recover();
-        queueReadiness();
     }
     function unprepared() {
-        return [...unpreparedDemand, ...replicas.keys()].find((locator) => !prepared.has(locator) && !unindexable.has(locator));
+        return [...unpreparedDemand, ...replicas.keys()].find((locator) => !indexed(locator) && !unpreparable.has(locator));
     }
-    function unbuilt(locator, error) {
-        unindexable.add(locator);
-        journal.record(`index failed ${locator} ${error instanceof Error ? error.name : 'unknown'}`);
+    function unpreparedBy(locator, error) {
+        unpreparable.add(locator);
+        journal.record(`preparation failed ${locator} ${error instanceof Error ? error.name : 'unknown'}`);
         queueReadiness();
     }
     function prepare(locators = []) {
@@ -497,7 +576,7 @@ export function composeRuntime(options) {
                     if (closed)
                         return;
                     unpreparedDemand.delete(waiting);
-                    await prepareReplica(waiting).catch((error) => unbuilt(waiting, error));
+                    await prepareReplica(waiting).catch((error) => unpreparedBy(waiting, error));
                 }
             }
             finally {
@@ -514,7 +593,9 @@ export function composeRuntime(options) {
             (reached === null
                 ? [...new Set([...rooms.keys(), ...replicas.keys(), ...queuesWithoutReplica.keys()])]
                 : [...reached]);
-        return [...new Set(named)].filter((locator) => reached === null || reached.has(locator)).sort();
+        return [...new Set(named)]
+            .filter((locator) => (reached === null || reached.has(locator)) && !plan.locked.includes(locator))
+            .sort();
     }
     function awaited(locator) {
         return (!roomsListed ||
@@ -528,6 +609,7 @@ export function composeRuntime(options) {
         const pending = [];
         const coverage = [];
         const overlay = [];
+        const read = [];
         for (const locator of locators) {
             const replica = replicas.get(locator);
             if (replica === undefined) {
@@ -535,21 +617,22 @@ export function composeRuntime(options) {
                     pending.push({ room: locator, awaits: 'acquisition' });
                 continue;
             }
-            if (!prepared.has(locator)) {
+            if (!replica.indexed) {
                 pending.push({ room: locator, awaits: 'preparation' });
                 continue;
             }
             coverage.push({
                 room: locator,
-                generation: replica.confirmed.record.transfer,
+                generation: replica.record.transfer,
                 current: !(catching.has(locator) || owed.has(locator) || transfers.has(locator)),
             });
+            read.push({ locator, key: replica.record.key });
             for (const batch of replica.queue)
                 overlay.push(batch.id);
         }
         if (pending.length > 0)
             return { pending };
-        return { coverage: { rooms: coverage, indexes: [], overlay } };
+        return { coverage: { rooms: coverage, indexes: [], overlay }, rooms: read };
     }
     function awaitPreparation(cover) {
         if (!('pending' in cover))
@@ -567,7 +650,7 @@ export function composeRuntime(options) {
             return { listed: true, rooms: named.filter((room) => rooms.has(room)) };
         return { listed: named.every((room) => replicas.has(room)), rooms: named };
     }
-    function roomState(locator, search) {
+    function roomState(locator) {
         if (sourceRefusals.has(locator))
             return 'refused';
         const listedRoom = discovered.get(locator);
@@ -578,27 +661,17 @@ export function composeRuntime(options) {
             return 'unadmitted';
         if (!replicas.has(locator))
             return 'acquiring';
-        if (!prepared.has(locator))
+        if (!indexed(locator))
             return 'preparing';
-        if (search && !searchIndex.rooms().has(locator))
-            return 'indexing';
         return 'complete';
     }
-    function conversationCoverage(reach, search) {
+    function conversationCoverage(reach) {
         const declared = reach === null || reach.conversations;
         if (!declared || options.adapter.conversations === undefined || declaredAgents() === undefined)
             return 'undeclared';
         if (!conversations.known() || !conversations.current())
             return 'acquiring';
-        if (!search)
-            return 'complete';
-        const unindexed = conversations
-            .searchable()
-            .filter((one) => conversations.acquired(one) && !searchIndex.conversations().has(one));
-        if (unindexed.length === 0)
-            return 'complete';
-        index([], unindexed);
-        return 'indexing';
+        return 'complete';
     }
     function connectionOf() {
         if (socketOpen)
@@ -625,34 +698,73 @@ export function composeRuntime(options) {
             ];
         });
     }
+    function installationOf(coverage) {
+        const rooms = { done: 0, total: 0 };
+        const parts = { done: 0, total: 0 };
+        const bytes = { done: 0, total: 0 };
+        const received = { done: 0, total: 0 };
+        const steps = new Set();
+        let waiting = false;
+        for (const { room, state } of coverage) {
+            if (state === 'unadmitted')
+                continue;
+            rooms.total += 1;
+            if (state === 'complete')
+                rooms.done += 1;
+            const transfer = transfers.get(room);
+            const held = installs.get(room);
+            const inventory = transfer?.inventory ?? replicas.get(room)?.record.inventory ?? null;
+            if (inventory !== null) {
+                const done = transfer?.done ?? inventory;
+                const share = held?.share ?? null;
+                parts.total += inventory.parts;
+                bytes.total += inventory.bytes;
+                parts.done += done.parts;
+                bytes.done += done.bytes;
+                if (share !== null && share.entries > 0) {
+                    bytes.done += Math.floor((share.bytes * share.written) / share.entries);
+                }
+                received.total += inventory.bytes;
+                received.done += done.bytes + (share?.bytes ?? 0);
+                for (const arrived of arrivals.get(room)?.values() ?? [])
+                    received.done += arrived;
+            }
+            const installing = held !== undefined && state !== 'complete';
+            if (installing)
+                steps.add(held.step);
+            waiting ||= installing || state === 'acquiring';
+        }
+        return {
+            step: INSTALL_STEPS.find((step) => steps.has(step)) ?? null,
+            paused: waiting && !onScreen ? 'hidden' : null,
+            rooms,
+            parts,
+            bytes,
+            received,
+        };
+    }
     function readinessFor(port, reach) {
         const required = requiredRooms(reach);
         const search = port.search === 'required';
-        const coverage = required.rooms.map((room) => ({ room, state: roomState(room, search) }));
-        const building = (state) => coverage
-            .filter((room) => room.state === state && !unindexable.has(room.room))
+        const coverage = required.rooms.map((room) => ({ room, state: roomState(room) }));
+        const preparing = coverage
+            .filter((room) => room.state === 'preparing' && !unpreparable.has(room.room))
             .map(({ room }) => room);
-        const preparing = building('preparing');
         if (preparing.length > 0)
             prepare(preparing);
-        const indexing = building('indexing');
-        if (indexing.length > 0)
-            index(indexing, []);
         return readinessOf({
             code: port.code,
             coverage: {
                 listed: required.listed,
                 rooms: coverage,
-                conversations: conversationCoverage(reach, search),
+                conversations: conversationCoverage(reach),
                 search: search ? 'required' : 'unused',
             },
             persistence,
             connection: connectionOf(),
             house: refusal !== null ? 'refused' : writesHeld() ? 'write-halted' : 'open',
-            capacity: capacity !== null &&
-                coverage.some(({ room, state }) => paused.has(room) || !SETTLED_ROOMS.has(state))
-                ? capacity
-                : port.capacity,
+            space: full ? 'full' : port.space,
+            installation: installationOf(coverage),
             refused: refusedIn(required.rooms),
             lost: storageLoss !== null,
             established: targets[port.target]?.established === true,
@@ -661,7 +773,8 @@ export function composeRuntime(options) {
     function establish(name) {
         targets = { ...targets, [name]: { established: true } };
         queueReadiness();
-        void durably((local) => local.keepTargets(targets)).catch(() => {
+        probeEachMinute();
+        void durably((local) => local.fact('targets', targets)).catch(() => {
             journal.record(`target record failed ${name}`);
         });
     }
@@ -698,92 +811,51 @@ export function composeRuntime(options) {
             readinessWatches.delete(watch);
         };
     }
-    function layerBytes(layer) {
-        let bytes = 0;
-        for (const [path, text] of Object.entries(layer.documents))
-            bytes += (path.length + text.length) * 2;
-        return bytes;
-    }
-    function grownBy(next, previous) {
-        if (previous === undefined)
-            return layerBytes(next);
-        const documents = Object.fromEntries(Object.entries(next.documents).filter(([path, text]) => previous.documents[path] !== text));
-        return layerBytes({ ...next, documents });
-    }
-    function exceeded(error) {
-        return (typeof error === 'object' &&
-            error !== null &&
-            error.name === 'QuotaExceededError');
-    }
-    async function estimated() {
-        const estimate = options.shell.estimate === undefined ? null : await options.shell.estimate();
-        return estimate === null ? null : Math.max(0, estimate.quota - estimate.usage);
-    }
-    function pause(locator, cause) {
-        paused.add(locator);
-        capacity = cause;
-        journal.record(`capacity ${cause.cause} ${locator} ${cause.needed} ${cause.available ?? '-'}`);
+    function filled() {
+        if (full || closed)
+            return;
+        full = true;
+        journal.record('space full');
         queueReadiness();
-        if (rechecking !== null)
+        probeEachMinute();
+    }
+    function installedTarget() {
+        return Object.values(targets).some((target) => target.established);
+    }
+    function probeEachMinute() {
+        if (!full || probing !== null || closed || !installedTarget())
             return;
-        // A paused preparation measures the browser's space again each minute, so space freed elsewhere resumes it without a retry.
-        rechecking = setInterval(() => {
-            void recheck();
+        // A device whose storage filled after its install tries a write each minute, so space freed elsewhere ends its read-only mode without a Retry.
+        probing = setInterval(() => {
+            void probed();
         }, 60_000);
     }
-    async function recheck() {
-        const held = capacity;
-        if (held === null || closed)
-            return;
-        const available = await estimated().catch(() => null);
-        if (available === null || available < (held.needed ?? 0))
-            return;
-        if (held.cause === 'quota-exceeded' && (held.available === null || available <= held.available))
-            return;
-        resume();
+    function probed() {
+        testing ??= database.ask({ kind: 'space.probe' }).then(() => {
+            testing = null;
+            spaceFreed();
+            return true;
+        }, () => {
+            testing = null;
+            return false;
+        });
+        return testing;
     }
-    function resume() {
-        if (rechecking !== null)
-            clearInterval(rechecking);
-        rechecking = null;
-        if (paused.size === 0 && capacity === null)
+    function spaceFreed() {
+        if (!full)
             return;
-        paused.clear();
-        capacity = null;
-        journal.record('capacity resumed');
+        full = false;
+        if (probing !== null)
+            clearInterval(probing);
+        probing = null;
+        unpreparable.clear();
+        journal.record('space freed');
         queueReadiness();
         if (!closed && authorization !== undefined)
             void sync('unstreamed');
     }
-    async function reclaimed(local) {
-        const unreferenced = [...transfers.keys()].filter((locator) => !discovered.has(locator));
-        for (const locator of unreferenced) {
-            await local.abandon(locator);
-            transfers.delete(locator);
-        }
-        if (unreferenced.length > 0)
-            journal.record(`capacity reclaimed ${unreferenced.length}`);
-        return unreferenced.length > 0;
-    }
-    async function admitted(local, locator, needed) {
-        if (paused.has(locator))
-            return false;
-        let available = await estimated().catch(() => null);
-        if (available === null || available >= needed)
-            return true;
-        if (await reclaimed(local))
-            available = await estimated().catch(() => null);
-        if (available === null || available >= needed)
-            return true;
-        pause(locator, { cause: 'insufficient-space', needed, available });
-        return false;
-    }
-    async function exceededOn(locator, bytes) {
-        const available = await estimated().catch(() => null);
-        pause(locator, { cause: 'quota-exceeded', needed: bytes, available });
-    }
     function seedRoomHeld(room, version) {
-        return prepared.has(room) && reachedBy(room, version);
+        return indexed(room) && reachedBy(room, version);
     }
     function seedHeld(at) {
         return Object.entries(at).every(([room, version]) => (roomsListed && !rooms.has(room)) || seedRoomHeld(room, version));
@@ -817,6 +889,75 @@ export function composeRuntime(options) {
                 shown();
         }
     }
+    function sameCover(left, right) {
+        return JSON.stringify(left) === JSON.stringify(right);
+    }
+    async function coveredRows(plan, cover) {
+        for (;;) {
+            const before = cover();
+            if ('pending' in before)
+                return { pending: before };
+            const local = await openLocal();
+            const keys = before.rooms.map(({ key }) => key);
+            const changes = local.changes(keys);
+            const current = () => local.changes(keys) === changes;
+            const rows = await windowRows(local, plan, before.rooms, current);
+            const after = cover();
+            if (rows !== null && sameCover(before, after))
+                return { rows, cover: before, current };
+        }
+    }
+    async function windowRows(local, plan, rooms, unchanged) {
+        const first = await local.query(plan, rooms, QUERY_BYTES);
+        if (first.more === undefined || !('documents' in first)) {
+            const { more: _more, ...rows } = first;
+            return rows;
+        }
+        const documents = [...first.documents];
+        for (let more = first.more; more !== undefined;) {
+            if (!unchanged())
+                return null;
+            const page = await local.query({
+                ...plan,
+                after: { text: more, values: JSON.parse(more) },
+                limit: plan.limit === null ? null : plan.limit - documents.length,
+                total: false,
+            }, rooms, QUERY_BYTES);
+            if (!('documents' in page))
+                return null;
+            documents.push(...page.documents);
+            more = page.more;
+            if (more === undefined) {
+                return {
+                    documents,
+                    ...(page.next === undefined ? {} : { next: page.next }),
+                    ...(first.total === undefined ? {} : { total: first.total }),
+                };
+            }
+        }
+        return null;
+    }
+    function keyedOf(rows, coverage) {
+        if ('groups' in rows) {
+            return {
+                result: { ...rows, coverage },
+                keys: rows.groups.map((group) => JSON.stringify(group.key)),
+            };
+        }
+        return {
+            result: { ...rows, coverage },
+            keys: rows.documents.map((document) => documentKey(document.room, document.path)),
+        };
+    }
+    async function answeredPlan(plan, cover) {
+        const answered = await coveredRows(plan, cover);
+        if ('pending' in answered) {
+            const pending = answered.pending;
+            return { result: pending, keys: [], current: () => true };
+        }
+        const held = answered.cover;
+        return { ...keyedOf(answered.rows, held.coverage), current: answered.current };
+    }
     async function rowsQuery(plan) {
         const before = covered(plan);
         awaitPreparation(before);
@@ -825,59 +966,15 @@ export function composeRuntime(options) {
             return seededResult(seeded).result;
         if ('pending' in before)
             return before;
-        const { rows, at: cover } = await readSide.query(plan, () => covered(plan));
-        awaitPreparation(cover);
-        if ('pending' in cover)
+        const answered = await coveredRows(plan, () => {
+            const cover = covered(plan);
+            awaitPreparation(cover);
             return cover;
-        return { ...rows, coverage: cover.coverage };
-    }
-    async function indexConversation(conversation) {
-        searchIndex.indexMessages(conversation, [], false);
-        let after = null;
-        for (;;) {
-            const batch = await durably((local) => local.messagesAfter(conversation, after));
-            if (closed)
-                return;
-            searchIndex.indexMessages(conversation, batch.map(({ identity, text }) => ({ conversation, identity, text })), batch.length === 0);
-            if (batch.length === 0)
-                return;
-            after = batch[batch.length - 1].identity;
-        }
-    }
-    function indexNext() {
-        const room = [...roomsToIndex].find((locator) => !searchIndex.rooms().has(locator) && !unindexable.has(locator));
-        if (room !== undefined) {
-            roomsToIndex.delete(room);
-            return () => prepared.has(room)
-                ? searchIndex.indexRoom(room).catch((error) => unbuilt(room, error))
-                : undefined;
-        }
-        const conversation = [...conversationsToIndex].find((one) => !searchIndex.conversations().has(one));
-        if (conversation === undefined)
-            return null;
-        conversationsToIndex.delete(conversation);
-        return () => indexConversation(conversation);
-    }
-    function index(rooms, named) {
-        for (const room of rooms)
-            roomsToIndex.add(room);
-        for (const conversation of named)
-            conversationsToIndex.add(conversation);
-        if (indexing)
-            return;
-        indexing = true;
-        void (async () => {
-            try {
-                for (let unit = indexNext(); unit !== null && !closed; unit = indexNext()) {
-                    await yielded();
-                    await unit();
-                    queueReadiness();
-                }
-            }
-            finally {
-                indexing = false;
-            }
-        })().catch(() => { });
+        });
+        if ('pending' in answered)
+            return answered.pending;
+        const held = answered.cover;
+        return { ...answered.rows, coverage: held.coverage };
     }
     function publishChangeSet(set) {
         applyChangeSet(set);
@@ -887,7 +984,10 @@ export function composeRuntime(options) {
         for (const locator of set.queues)
             emitQueue(locator);
         if (set.drafts.length > 0 ||
-            set.documents.some((change) => roomDrafts.get(change.locator)?.has(change.path) === true)) {
+            set.documents.some((change) => {
+                const held = roomDrafts.get(change.locator);
+                return held !== undefined && (change.path === null || held.has(change.path));
+            })) {
             publishRoomDrafts(false);
         }
         for (const app of set.presentations)
@@ -900,9 +1000,22 @@ export function composeRuntime(options) {
             if (reason === 'revoked-authorization') {
                 await exclusive(async () => {
                     const revoked = { status: 'unavailable', reason: 'revoked' };
+                    const records = [...replicas].map(([locator, held]) => ({
+                        locator,
+                        held,
+                        record: { ...held.record, model: revoked, selectionModel: revoked },
+                    }));
+                    let answer = null;
                     try {
                         const local = await openLocal();
-                        await local.revokeModels([...replicas.values()].map((replica) => replica.confirmed.record));
+                        answer = await local.commit({
+                            rooms: records.map(({ locator, record }) => ({
+                                locator,
+                                key: record.key,
+                                record: storedRecord(record),
+                                composition: compositionOf(record),
+                            })),
+                        });
                     }
                     catch {
                         journal.record('model revocation persistence failed');
@@ -918,16 +1031,16 @@ export function composeRuntime(options) {
                         liveModels.delete(key);
                     }
                     const changed = [];
-                    for (const [locator, room] of rooms) {
-                        const before = replicas.get(locator) ?? null;
-                        if (before !== null) {
-                            const record = {
-                                ...before.confirmed.record,
-                                model: revoked,
-                                selectionModel: revoked,
-                            };
-                            replicas.set(locator, replicaOf(confirmedOf(record, before.confirmed), before.queue, before));
-                        }
+                    for (const { locator, held, record } of records) {
+                        if (replicas.get(locator) !== held)
+                            continue;
+                        const indexed = answer === null ? held.indexed : committedRoom(locator, answer).indexed;
+                        replicas.set(locator, { ...held, record, indexed });
+                    }
+                    for (const locator of [...rooms.keys()]) {
+                        const room = rooms.get(locator);
+                        if (room === undefined)
+                            continue;
                         rooms.set(locator, {
                             ...room,
                             model: modelTypes(revoked),
@@ -935,9 +1048,10 @@ export function composeRuntime(options) {
                                 ? null
                                 : { ...room.typedSelection, model: modelTypes(revoked) },
                         });
-                        changed.push(changeSet(locator, before, replicas.get(locator) ?? null, { room: true }));
+                        changed.push(changeSet(locator, { documents: null, room: true }));
                     }
                     publishChangeSet(mergeChangeSets(changed));
+                    prepare();
                 });
             }
         }
@@ -968,12 +1082,13 @@ export function composeRuntime(options) {
                     model: modelTypes(modelOf(room.locator, 'typed-selection')),
                 },
             providerOwnedPaths: room.providerOwnedPaths,
-            roomVersion: replicas.get(room.locator)?.confirmed.record.roomVersion ?? null,
+            roomVersion: replicas.get(room.locator)?.record.roomVersion ?? null,
             synchronizationAvailable,
             refusal: scopedRefusals.get(room.locator) ?? sourceRefusals.get(room.locator) ?? null,
         });
     }
     async function applyDiscovery(found, started, covered) {
+        const lockedBefore = lockedRooms();
         for (const room of found) {
             const fence = fences.get(room.locator);
             if (fence !== undefined && fence.erased && fence.at < started)
@@ -999,15 +1114,17 @@ export function composeRuntime(options) {
         else
             unlistedKept(unlisted);
         for (const room of listed) {
-            const held = replicas.get(room.locator)?.confirmed.record;
+            const held = replicas.get(room.locator)?.record;
             if (held !== undefined && held.replica.selection !== room.replica.selection) {
                 list(held, false);
                 continue;
             }
             list(room, room.replica.admission === 'admitted' && !unreadable.has(room.locator));
         }
+        confirmLocks(listed);
         roomsListed = true;
         emitRooms();
+        relocked(lockedBefore);
         return listed;
     }
     function heldLocally(locator) {
@@ -1028,7 +1145,7 @@ export function composeRuntime(options) {
     }
     function unlistedKept(unlisted) {
         for (const locator of unlisted) {
-            const held = replicas.get(locator)?.confirmed.record;
+            const held = replicas.get(locator)?.record;
             if (held !== undefined)
                 list(held, false);
             else
@@ -1037,16 +1154,16 @@ export function composeRuntime(options) {
     }
     function fence(locators) {
         const fresh = [...new Set(locators)].filter((locator) => !fences.has(locator));
-        const removed = fresh.map((locator) => changeSet(locator, replicas.get(locator) ?? null, null, {
-            room: true,
-            queue: true,
+        const removed = fresh.map((locator) => ({
+            locator,
             drafts: [...(roomDrafts.get(locator)?.keys() ?? [])],
         }));
         for (const locator of fresh) {
             fences.set(locator, { at: discoveries, erased: false });
             lastFenced.set(locator, ++fencings);
+            confirmed.delete(locator);
             for (const batch of replicas.get(locator)?.queue ?? queuesWithoutReplica.get(locator) ?? [])
-                pendings.delete(batch.id);
+                pendings.delete(pendingKey(locator, batch.id));
             replicas.delete(locator);
             queuesWithoutReplica.delete(locator);
             rooms.delete(locator);
@@ -1058,8 +1175,7 @@ export function composeRuntime(options) {
             unreadable.delete(locator);
             stale.delete(locator);
             repairable.delete(locator);
-            unindexable.delete(locator);
-            paused.delete(locator);
+            unpreparable.delete(locator);
             scopedRefusals.delete(locator);
             sourceRefusals.delete(locator);
             declarationRefusals.delete(locator);
@@ -1073,26 +1189,48 @@ export function composeRuntime(options) {
         }
         if (fresh.length === 0)
             return fresh;
-        publishChangeSet(mergeChangeSets(removed));
-        for (const locator of fresh)
-            prepared.delete(locator);
-        searchIndex.forget(fresh);
-        readSide.recover();
+        publishChangeSet(mergeChangeSets(removed.map(({ locator, drafts }) => changeSet(locator, { documents: null, room: true, queue: true, drafts }))));
+        liveQueries.recover();
         moveTo({ ...status, ...attention() });
         return fresh;
     }
-    async function erased(local, locators) {
-        await local.erase(locators);
+    async function eraseFenced(locators) {
         for (const locator of locators) {
+            while (await durably((local) => local.erase(locator, ERASE_BATCH)))
+                await yielded();
             const held = fences.get(locator);
             if (held !== undefined)
                 held.erased = true;
         }
     }
+    let sweeping = false;
+    function sweep() {
+        if (sweeping || closed)
+            return;
+        sweeping = true;
+        void (async () => {
+            try {
+                while (!closed && (await durably((local) => local.erase(null, ERASE_BATCH)))) {
+                    await yielded();
+                }
+            }
+            catch {
+                journal.record('erasure failed');
+            }
+            finally {
+                sweeping = false;
+            }
+        })();
+    }
     async function loseRooms(locators) {
         const fresh = fence(locators);
-        if (fresh.length > 0)
-            await durably((local) => erased(local, fresh));
+        if (fresh.length === 0)
+            return;
+        await durably(async (local) => {
+            await local.fence(fresh);
+            await unpair(local);
+        });
+        await eraseFenced(fresh);
     }
     function restored(key, persisted) {
         const prior = models.get(key);
@@ -1113,54 +1251,56 @@ export function composeRuntime(options) {
         return model;
     }
     async function hydrate(opened) {
-        const [records, queues, kept, presented, held, chatDrafts, lastCompleted, declared, named, known, staged, heldTargets,] = await Promise.all([
-            opened.all(),
+        const [held, queues, kept, heldConversations, chatDrafts] = await Promise.all([
+            opened.opened(),
             opened.queues(),
             opened.roomDrafts(),
-            opened.presentation(),
             opened.conversations(),
             opened.chatDrafts(),
-            opened.lastCompleted(),
-            opened.providerLimits(),
-            opened.capabilities(),
-            opened.member(),
-            opened.transfers(),
-            opened.targets(),
         ]);
-        targets = heldTargets;
+        const records = [...held.rooms.values()];
+        const counts = await opened.counts(records.map(({ key, typedSelection }) => ({ key, roots: typedSelection?.roots ?? [] })));
+        const queuedBatches = new Map(queues.map((queue) => [queue.locator, queue.pending.map(({ batch }) => batch)]));
+        targets = held.targets;
         transfers.clear();
-        for (const record of staged)
-            transfers.set(record.locator, record);
-        limits = declared;
-        capabilities = named;
-        member = known;
+        for (const [locator, record] of held.transfers)
+            transfers.set(locator, record);
+        limits = held.providerLimits;
+        capabilities = held.capabilities;
+        member = held.member;
         roomDrafts.clear();
         for (const record of kept)
             rememberRoomDraft(record);
         presentations.clear();
-        for (const record of presented)
+        for (const record of held.presentation)
             presentations.set(record.app, record.value);
-        conversations.hydrate(held, chatDrafts);
-        const queuedBatches = new Map(queues.map((queue) => [queue.locator, queue.pending.map(({ batch }) => batch)]));
+        conversations.hydrate(heldConversations, chatDrafts);
         pendings.clear();
         for (const queue of queues) {
-            for (const { batch, state } of queue.pending)
-                pendings.set(batch.id, state);
+            for (const { batch, state } of queue.pending) {
+                pendings.set(pendingKey(queue.locator, batch.id), state);
+            }
         }
-        const previousReplicas = new Map(replicas);
         replicas.clear();
         queuesWithoutReplica.clear();
-        const replicated = new Set(records.map((record) => record.locator));
         for (const [locator, queue] of queuedBatches) {
-            if (!replicated.has(locator))
+            if (!held.rooms.has(locator))
                 queuesWithoutReplica.set(locator, queue);
         }
-        for (const record of records) {
-            const model = restored(modelKey(record.locator, 'collection'), record.model);
-            const selectionModel = restored(modelKey(record.locator, 'typed-selection'), record.selectionModel);
-            const prior = previousReplicas.get(record.locator);
-            const confirmed = confirmedOf({ ...record, model, selectionModel }, prior?.confirmed);
-            replicas.set(record.locator, replicaOf(confirmed, queuedBatches.get(record.locator) ?? [], prior));
+        records.forEach((stored, index) => {
+            if (fences.has(stored.locator))
+                return;
+            const model = restored(modelKey(stored.locator, 'collection'), stored.model);
+            const selectionModel = restored(modelKey(stored.locator, 'typed-selection'), stored.selectionModel);
+            const record = { ...stored, model, selectionModel };
+            replicas.set(record.locator, {
+                record,
+                queue: queuedBatches.get(record.locator) ?? [],
+                overlaid: held.overlaid.get(record.key) ?? new Set(),
+                count: counts[index] ?? 0,
+                confirmed: 0,
+                indexed: !held.unindexed.has(record.key),
+            });
             const existing = rooms.get(record.locator);
             if (existing === undefined)
                 list(record, false);
@@ -1179,11 +1319,15 @@ export function composeRuntime(options) {
                         },
                 });
             }
-        }
+        });
+        for (const key of held.orphans)
+            await opened.release(key);
+        if (held.erasing || held.orphans.length > 0)
+            queueMicrotask(sweep);
         return {
-            lastCompleted,
+            lastCompleted: held.lastCompleted,
             locators: new Set([...queuedBatches.keys(), ...replicas.keys()]),
-            read: mergeChangeSets([...new Set([...previousReplicas.keys(), ...replicas.keys()])].map((locator) => changeSet(locator, previousReplicas.get(locator) ?? null, replicas.get(locator) ?? null))),
+            read: mergeChangeSets([...replicas.keys()].map((locator) => changeSet(locator, { documents: null }))),
         };
     }
     async function readState(opened) {
@@ -1202,8 +1346,7 @@ export function composeRuntime(options) {
     async function open() {
         if (closed)
             throw new Error('runtime closed');
-        const opened = await openRuntimeStore(isFenced);
-        store = opened;
+        const opened = openRuntimeStore(isFenced, database);
         const interrupted = await opened.fences();
         for (const locator of interrupted) {
             fences.set(locator, { at: discoveries, erased: false });
@@ -1222,9 +1365,17 @@ export function composeRuntime(options) {
             emitStorageLoss();
         }
         const lastCompleted = await readState(opened);
-        if (interrupted.length > 0)
-            await erased(opened, interrupted);
+        if (interrupted.length > 0) {
+            queueMicrotask(() => {
+                void eraseFenced(interrupted).catch(() => {
+                    journal.record('erasure failed');
+                });
+            });
+        }
         moveTo({ ...status, lastCompleted, ...attention() });
+        void exclusive(() => unpair(opened)).catch(() => {
+            journal.record('unpair failed');
+        });
         return opened;
     }
     function durably(work) {
@@ -1245,86 +1396,262 @@ export function composeRuntime(options) {
         mutations = next.then(() => undefined, () => undefined);
         return next;
     }
-    function withdrawable(batch) {
-        const state = pendings.get(batch.id);
-        return state !== undefined && state.submission.state !== 'submitted' && !state.lost;
+    function withdrawable(locator) {
+        return (batch) => {
+            const state = pendings.get(pendingKey(locator, batch.id));
+            return state !== undefined && state.submission.state !== 'submitted' && !state.lost;
+        };
+    }
+    const REWRITE_LINKS = ['field', 'body'];
+    const CHECKED_LINKS = ['field', 'section'];
+    async function sliceAt(record, view, queue, extra = [], moved = []) {
+        const local = await openLocal();
+        const needed = new Set([...touchedBy(queue), ...extra]);
+        const movedPaths = [...new Set([...movedBy(queue, record.locator), ...moved])];
+        if (movedPaths.length > 0) {
+            for (const { path } of await local.referrers(record.key, view, movedPaths, REWRITE_LINKS)) {
+                needed.add(path);
+            }
+        }
+        const paths = [...needed];
+        return stepped(slicing(await local.entries(record.key, view, paths), paths));
+    }
+    async function landedWhole(locator, batch, confirmedLayer, current) {
+        if (!landed(batch, confirmedLayer, current))
+            return false;
+        const partner = partnerOf(batch, locator);
+        if (partner === null)
+            return true;
+        const other = replicas.get(partner);
+        const half = other?.queue.find((one) => one.id === batch.id);
+        if (other === undefined || half === undefined)
+            return false;
+        return landed(half, await sliceAt(other.record, 'confirmed', [half]));
+    }
+    function carriedBack(locator, unlanded, written) {
+        const back = new Map();
+        const taken = [];
+        for (const batch of unlanded) {
+            const between = batch.between;
+            if (between === undefined)
+                continue;
+            const source = between.source.room;
+            const destination = between.destination.room;
+            for (const { path: to } of pendings.get(pendingKey(destination, batch.id))?.drafts ?? []) {
+                const record = roomDrafts.get(destination)?.get(to);
+                const path = between.moves.find((move) => move.to === to)?.path;
+                if (record === undefined || path === undefined)
+                    continue;
+                const [into, key] = source === locator ? [written, path] : [back, documentKey(source, path)];
+                const existing = into.get(key) ?? roomDrafts.get(source)?.get(path);
+                taken.push({ locator: destination, path: to });
+                into.set(key, {
+                    locator: source,
+                    path,
+                    revision: roomDraftRevision(),
+                    parts: returnedInto(existing?.parts, record.parts),
+                    returned: existing?.returned ?? null,
+                });
+            }
+        }
+        const records = [...back.values()];
+        const elsewhere = taken.filter((one) => one.locator !== locator);
+        const rooms = new Set([...records, ...elsewhere].map((one) => one.locator));
+        return {
+            taken: taken.filter((one) => one.locator === locator).map(({ path }) => path),
+            writes: [...rooms].map((room) => ({
+                locator: room,
+                roomDrafts: records.filter((record) => record.locator === room),
+                consumedRoomDrafts: elsewhere.filter((one) => one.locator === room).map(({ path }) => path),
+            })),
+            changes: [...rooms].map((room) => changeSet(room, {
+                drafts: [...records, ...elsewhere]
+                    .filter((one) => one.locator === room)
+                    .map(({ path }) => path),
+            })),
+            remember() {
+                for (const one of taken)
+                    forgetRoomDraft(one.locator, one.path);
+                for (const record of records)
+                    rememberRoomDraft(record);
+            },
+        };
+    }
+    function committedRoom(locator, answer) {
+        const indexed = answer.indexed[locator] ?? replicas.get(locator)?.indexed ?? false;
+        if (!indexed)
+            prepare([locator]);
+        return { count: answer.counts[locator] ?? replicas.get(locator)?.count ?? 0, indexed };
+    }
+    function replayed(record, confirmedLayer, queue) {
+        return stepped(replaying(confirmedLayer, queue, record.locator, compositionOf(record)));
     }
-    async function settle(local, locator, before, confirmed, queue, settling = {}) {
+    async function overlayDiff(record, before, visible, touched) {
+        const kept = before !== undefined && before.record.key === record.key
+            ? before.overlaid
+            : new Set();
+        return {
+            overlay: {
+                set: await stepped(overlayOf(visible, touched)),
+                cleared: [...kept].filter((path) => !touched.has(path)),
+            },
+            touched,
+        };
+    }
+    async function settle(local, locator, before, record, queue, settling = {}) {
+        return together(local, [await settlement(local, locator, before, record, queue, settling)]);
+    }
+    function unpairedIn(locator, batch) {
+        if (!queueIn(locator).some((held) => held.id === batch.id))
+            return false;
+        if (pendings.get(pendingKey(locator, batch.id))?.accepted !== undefined)
+            return false;
+        return !leavingIn(batch, locator) || withdrawable(locator)(batch);
+    }
+    async function together(local, settlements) {
+        const settled = new Set(settlements.map(({ locator }) => locator));
+        const all = [...settlements];
+        for (let wave = settlements; wave.length > 0;) {
+            const partnered = new Map();
+            for (const { locator, left } of wave) {
+                for (const batch of left) {
+                    const partner = partnerOf(batch, locator);
+                    if (partner === null || settled.has(partner) || !unpairedIn(partner, batch))
+                        continue;
+                    partnered.set(partner, [...(partnered.get(partner) ?? []), batch]);
+                }
+            }
+            const partners = [];
+            for (const [partner, batches] of partnered) {
+                settled.add(partner);
+                partners.push(await unpairing(local, partner, batches));
+            }
+            all.push(...partners);
+            wave = partners;
+        }
+        const answer = await local.commit({
+            rooms: all.flatMap(({ commit }) => commit.rooms),
+            writes: all.flatMap(({ commit }) => commit.writes),
+        });
+        return mergeChangeSets(all.map((one) => one.apply(answer)));
+    }
+    async function settlement(local, locator, before, record, queue, settling = {}) {
+        const view = settling.view ?? 'confirmed';
         const previousQueue = before?.queue ?? queuesWithoutReplica.get(locator) ?? [];
-        const { withdrawn, kept } = await stepped(standing(confirmed, queue, withdrawable, localSaves));
+        const overrides = settling.changes;
+        const read = await sliceAt(record, view, queue, [
+            ...(before !== undefined && before.record.key === record.key ? before.overlaid : []),
+            ...(overrides?.set.map(({ path }) => path) ?? []),
+            ...(overrides?.removed ?? []),
+        ]);
+        const confirmedLayer = overrides === undefined
+            ? read
+            : await stepped(slicingWith(read, overrides.set, overrides.removed));
+        const composition = compositionOf(record);
+        const { withdrawn, kept } = await stepped(standing(confirmedLayer, queue, withdrawable(locator), localSaves, locator, composition));
         const founded = kept.filter((batch) => !queue.includes(batch));
         const queueChanged = kept.length !== previousQueue.length || founded.length > 0;
-        const unqueued = withdrawn.map((batch) => ({
-            batch,
-            returned: localSaves || landed(batch, confirmed) ? null : returnedBy('withdrawn'),
-        }));
+        const unqueued = [];
+        for (const batch of withdrawn) {
+            unqueued.push({ batch, landed: await landedWhole(locator, batch, confirmedLayer) });
+        }
         const returning = [
-            ...[...unqueued].reverse(),
-            ...(settling.leaving === undefined ? [] : [settling.leaving]),
+            ...[...unqueued].reverse().map(({ batch, landed: held }) => ({
+                batch,
+                returned: localSaves || held ? null : returnedBy('withdrawn'),
+            })),
+            ...(settling.leaving ?? []),
         ];
         const written = new Map();
-        for (const { batch, returned } of returning) {
-            if (returned === null)
+        for (const { batch, returned: reason } of returning) {
+            if (reason === null || batch.between?.destination.room === locator)
                 continue;
-            for (const saved of pendings.get(batch.id)?.drafts ?? []) {
+            for (const saved of pendings.get(pendingKey(locator, batch.id))?.drafts ?? []) {
                 const existing = written.get(saved.path) ?? roomDrafts.get(locator)?.get(saved.path);
                 written.set(saved.path, {
                     locator,
                     path: saved.path,
                     revision: roomDraftRevision(),
                     parts: returnedInto(existing?.parts, saved.parts),
-                    returned,
+                    returned: reason,
                 });
             }
         }
-        await local.keepAuthored({ locator, queue: kept, founded, roomDrafts: [...written.values()] });
+        const carried = carriedBack(locator, [
+            ...[...unqueued].reverse().flatMap(({ batch, landed: held }) => (held ? [] : [batch])),
+            ...(settling.leaving ?? []).flatMap(({ batch, returned }) => returned === null ? [] : [batch]),
+        ], written);
+        const replayedLayer = await replayed(record, confirmedLayer, kept);
+        const { overlay, touched } = await overlayDiff(record, before, replayedLayer.visible, replayedLayer.touched);
+        const commit = {
+            rooms: [
+                {
+                    locator,
+                    key: record.key,
+                    record: storedRecord(record),
+                    roots: record.typedSelection?.roots ?? [],
+                    ...settling.commit,
+                    ...(overrides === undefined
+                        ? {}
+                        : { confirmed: { set: overrides.set, removed: overrides.removed } }),
+                    overlay,
+                },
+            ],
+            writes: [
+                {
+                    locator,
+                    queue: kept,
+                    founded,
+                    roomDrafts: [...written.values()],
+                    consumedRoomDrafts: carried.taken,
+                },
+                ...carried.writes,
+            ],
+        };
         const staying = new Set(kept.map((batch) => batch.id));
-        for (const batch of previousQueue) {
-            if (!staying.has(batch.id))
-                pendings.delete(batch.id);
-        }
-        for (const record of written.values())
-            rememberRoomDraft(record);
-        try {
-            await local.write({
-                next: confirmed.record,
-                previous: before?.confirmed.record ?? null,
-                ...(settling.stored === undefined ? {} : { stored: settling.stored }),
-            });
-        }
-        catch (error) {
-            const held = before === undefined ? null : await stepped(replicating(before.confirmed, kept, before));
-            const set = await stepped(changing(locator, before ?? null, held, {
-                queue: queueChanged,
-                drafts: [...written.keys()],
-            }));
-            if (held !== null)
-                replicas.set(locator, held);
-            else if (kept.length > 0)
-                queuesWithoutReplica.set(locator, kept);
-            else
+        return {
+            locator,
+            left: previousQueue.filter((batch) => !staying.has(batch.id)),
+            commit,
+            apply: (answer) => {
+                for (const batch of previousQueue) {
+                    if (!staying.has(batch.id))
+                        pendings.delete(pendingKey(locator, batch.id));
+                }
+                for (const draft of written.values())
+                    rememberRoomDraft(draft);
+                carried.remember();
+                const drafts = [...written.keys(), ...carried.taken];
                 queuesWithoutReplica.delete(locator);
-            publishChangeSet(set);
-            moveTo({ ...status, ...attention() });
-            throw error;
-        }
-        const changed = { room: settling.room, queue: queueChanged, drafts: [...written.keys()] };
-        const next = await stepped(replicating(confirmed, kept, before));
-        const set = await stepped(changing(locator, before ?? null, next, changed));
-        return () => {
-            queuesWithoutReplica.delete(locator);
-            for (const { batch, returned } of unqueued) {
-                const outcome = localSaves ? 'dropped' : returned === null ? 'landed' : 'withdrawn';
-                journal.record(`outcome ${locator} ${batch.id} ${outcome}`);
-            }
-            replicas.set(locator, next);
-            return heldChange(locator, before ?? null, next, set, changed);
+                for (const { batch, landed: held } of unqueued) {
+                    const outcome = localSaves ? 'dropped' : held ? 'landed' : 'withdrawn';
+                    journal.record(`outcome ${locator} ${batch.id} ${outcome}`);
+                }
+                const changed = answer.changed[locator];
+                const confirmedChanged = settling.commit?.published !== undefined ||
+                    settling.commit?.refreshed === true ||
+                    overrides !== undefined;
+                const { count, indexed } = committedRoom(locator, answer);
+                replicas.set(locator, {
+                    record,
+                    queue: kept,
+                    overlaid: touched,
+                    count,
+                    confirmed: (before?.confirmed ?? 0) + (confirmedChanged ? 1 : 0),
+                    indexed,
+                });
+                return mergeChangeSets([
+                    changeSet(locator, {
+                        documents: changed === undefined ? [] : changed,
+                        room: settling.room,
+                        queue: queueChanged,
+                        drafts,
+                    }),
+                    ...carried.changes,
+                ]);
+            },
         };
     }
-    function heldChange(locator, before, next, set, changed) {
-        const held = replicas.get(locator) ?? null;
-        return held === next ? set : changeSet(locator, before, held, changed);
-    }
     function adoptModels(locator, record) {
         for (const [attached, model] of [
             ['collection', record.model],
@@ -1343,7 +1670,7 @@ export function composeRuntime(options) {
         const taken = (answer, previous, attached) => {
             if (answer === undefined)
                 return previous;
-            const { state, refused } = attachedModel(answer, previous);
+            const { state, refused } = attachedModel(answer, previous, attached === 'collection' ? roomTypes : NO_ROOM_TYPES);
             if (refused !== null) {
                 const where = refused.location === undefined ? '' : ` ${refused.location}`;
                 journal.record(`model invalid ${locator} ${attached} ${refused.identity} ${refused.rule}${where}`);
@@ -1356,65 +1683,76 @@ export function composeRuntime(options) {
             selection: taken(answers?.selection, held.selection, 'typed-selection'),
         };
     }
-    function publish(local, room, confirmed, landing, live) {
-        const { base, stored } = landing;
-        return exclusive(async () => {
-            if (stored !== undefined) {
-                await indexReferrers({ text: confirmed.record.documents, binaries: confirmed.record.binaries }, compositionOf(confirmed.record));
-            }
+    function publish(local, room, record, landing, live) {
+        const landed = exclusive(async () => {
             if (!live()) {
                 caughtUpTo(room.locator);
                 return true;
             }
             const prior = replicas.get(room.locator);
-            if (base !== undefined &&
-                (prior?.confirmed.record.roomVersion !== base.record.roomVersion ||
-                    prior.confirmed.record.revisions !== base.record.revisions)) {
+            if (landing.kind === 'refreshed' &&
+                (prior === undefined || prior.record.key !== record.key || prior.confirmed !== landing.base)) {
+                await local.unrefresh(record.key);
                 return false;
             }
-            adoptModels(room.locator, confirmed.record);
+            adoptModels(room.locator, record);
             const queue = prior?.queue ?? queuesWithoutReplica.get(room.locator) ?? [];
-            const roomVersion = confirmed.record.roomVersion;
+            const roomVersion = record.roomVersion;
             const accepted = queue.filter((batch) => {
-                const accepted = pendings.get(batch.id)?.accepted;
-                return (accepted !== undefined && options.adapter.reached(room.locator, roomVersion, accepted));
+                const at = pendings.get(pendingKey(room.locator, batch.id))?.accepted;
+                return at !== undefined && options.adapter.reached(room.locator, roomVersion, at);
             });
-            let settled;
+            let set;
             try {
-                settled = await settle(local, room.locator, prior, confirmed, queue.filter((batch) => !accepted.includes(batch)), { room: true, ...(stored === undefined ? {} : { stored }) });
+                set = await settle(local, room.locator, prior, record, queue.filter((batch) => !accepted.includes(batch)), landing.kind === 'refreshed'
+                    ? {
+                        room: true,
+                        view: 'refreshed',
+                        commit: { refreshed: true, composition: compositionOf(record) },
+                    }
+                    : {
+                        room: true,
+                        view: landing.refreshed ? 'refreshed' : 'confirmed',
+                        commit: {
+                            published: { from: prior?.record.key ?? null },
+                            composition: compositionOf(record),
+                            ...(landing.refreshed ? { refreshed: true } : {}),
+                        },
+                    });
             }
             catch (error) {
-                if (!exceeded(error))
+                if (!refusedForSpace(error))
                     throw error;
-                await exceededOn(room.locator, grownBy(confirmed.record, prior?.confirmed.record));
                 caughtUpTo(room.locator);
                 return true;
             }
-            const set = settled();
-            if (stored !== undefined) {
+            if (landing.kind === 'bootstrapped') {
                 transfers.delete(room.locator);
                 catching.delete(room.locator);
+                sweep();
             }
             for (const batch of accepted)
-                pendings.delete(batch.id);
+                pendings.delete(pendingKey(room.locator, batch.id));
             stale.delete(room.locator);
-            unindexable.delete(room.locator);
+            unpreparable.delete(room.locator);
             if (unreadable.delete(room.locator))
                 scopedRefusals.delete(room.locator);
             sourceRefusals.delete(room.locator);
             declarationRefusals.delete(room.locator);
             list(room, true);
-            if (prior === undefined)
-                prepared.add(room.locator);
             publishChangeSet(set);
+            await unpair(local);
             moveTo({ ...status, ...attention() });
             options.adapter.roomStream?.published(room.locator, roomVersion);
+            if (accepted.length > 0 && (replicas.get(room.locator)?.queue.length ?? 0) > 0) {
+                submitLater(room.locator);
+            }
             return true;
         });
+        return landing.kind === 'refreshed' ? landed : landed.finally(() => installed(room.locator));
     }
     async function savedRoom(locator) {
         const local = await openLocal();
-        await referenced(locator);
         const replica = replicas.get(locator);
         const room = rooms.get(locator);
         if (replica === undefined || room === undefined) {
@@ -1444,13 +1782,19 @@ export function composeRuntime(options) {
         }
         const target = await savedRoom(locator);
         const saved = [];
+        const files = [];
+        const filed = read.filter(({ parts }) => parts.file !== undefined).map(({ path }) => path);
+        const visible = filed.length === 0 ? undefined : await visibleOf(locator, filed);
         for (const { path, parts } of read) {
             const file = parts.file === undefined
                 ? undefined
-                : await heldFile(parts.file.blob, binaryBase(target.replica.visible, path));
+                : await heldFile(parts.file.blob, binaryBase(visible, path));
+            if (parts.file !== undefined && file !== undefined) {
+                files.push({ key: file.localId, blob: parts.file.blob });
+            }
             saved.push({ path, parts: held(undefined, parts, file) });
         }
-        return committed(locator, target, saved, new Set(), writtenBy);
+        return committed(locator, target, saved, new Set(), writtenBy, files);
     }
     function carriedDrafts(locator, saved, consumed) {
         const holding = roomDrafts.get(locator);
@@ -1464,13 +1808,361 @@ export function composeRuntime(options) {
             return [[path, { ...record, path: to, revision: roomDraftRevision() }]];
         }));
     }
-    async function committed(locator, { local, replica, room }, saved, consumed, writtenBy) {
-        const changed = saved.flatMap(({ path, parts }) => changedParts(path, underneath(parts, path, replica.visible)));
+    async function savingIn(replica, changes, extra, leaving = []) {
+        const record = replica.record;
+        const local = await openLocal();
+        const paths = [
+            ...extra,
+            ...changes.flatMap((change) => change.kind === 'move' ? [change.path, change.to] : [change.path]),
+        ];
+        const moved = [
+            ...leaving,
+            ...changes.flatMap((change) => (change.kind === 'move' ? [change.path] : [])),
+        ];
+        const removed = changes.flatMap((change) => (change.kind === 'remove' ? [change.path] : []));
+        const referring = removed.length === 0
+            ? []
+            : (await local.referrers(record.key, 'confirmed', removed, CHECKED_LINKS)).map(({ path }) => path);
+        const confirmedLayer = await sliceAt(record, 'confirmed', replica.queue, [...paths, ...referring], moved);
+        const { visible } = await replayed(record, confirmedLayer, replica.queue);
+        const composition = compositionOf(record);
+        return {
+            record,
+            confirmed: confirmedLayer,
+            visible,
+            *visibleOver(queue) {
+                return (yield* replaying(confirmedLayer, queue, record.locator, composition)).visible;
+            },
+        };
+    }
+    async function unmodeledIn(record) {
+        const composition = compositionFor(record);
+        if (available(composition))
+            return false;
+        const local = await openLocal();
+        const roots = record.typedSelection?.roots ?? [];
+        if (composition.model.status === 'unavailable' &&
+            (await local.typedWithin(record.key, 'visible', roots, false))) {
+            return true;
+        }
+        return (composition.selection !== null &&
+            composition.selection.model.status === 'unavailable' &&
+            (await local.typedWithin(record.key, 'visible', roots, true)));
+    }
+    function textDiffers(left, right) {
+        return ((left?.content ?? undefined) !== (right?.content ?? undefined) ||
+            !sameBinary(left?.binary ?? undefined, right?.binary ?? undefined));
+    }
+    function textOf(entry) {
+        if (entry === null)
+            return undefined;
+        return entry.binary !== null ? null : entry.content;
+    }
+    function walkOf(local, key, view) {
+        return async (after) => {
+            const page = await local.walk(key, view, after, WALK_BYTES);
+            return {
+                entries: page.entries.map(({ path, content, binary }) => ({
+                    path,
+                    content: binary !== null ? null : content,
+                })),
+                next: page.next,
+            };
+        };
+    }
+    function lookupOf(local, key, view) {
+        return async (paths) => {
+            if (paths.length === 0)
+                return new Map();
+            return new Map((await local.typed(key, view, paths)).map(({ path, type, binary }) => [
+                path,
+                { type: type ?? undefined, binary },
+            ]));
+        };
+    }
+    function declaredOf(entry) {
+        if (entry.binary !== null)
+            return { type: undefined, binary: true };
+        const read = parseFrontmatter(entry.content ?? '');
+        return { type: read.ok ? (read.frontmatter.type ?? 'any') : undefined, binary: false };
+    }
+    function overriddenWalk(walk, overrides) {
+        const sorted = [...overrides.keys()].sort();
+        const beyond = (path) => {
+            if (path === null)
+                return 0;
+            let low = 0;
+            let high = sorted.length;
+            while (low < high) {
+                const middle = (low + high) >>> 1;
+                if (sorted[middle] <= path)
+                    low = middle + 1;
+                else
+                    high = middle;
+            }
+            return low;
+        };
+        return async (after) => {
+            const page = await walk(after);
+            const end = page.next;
+            const added = sorted
+                .slice(beyond(after), end === null ? sorted.length : beyond(end))
+                .flatMap((path) => {
+                const entry = overrides.get(path);
+                return entry === null || entry === undefined
+                    ? []
+                    : [{ path, content: entry.binary !== null ? null : entry.content }];
+            });
+            const entries = [...page.entries.filter(({ path }) => !overrides.has(path)), ...added].sort((left, right) => (left.path < right.path ? -1 : left.path > right.path ? 1 : 0));
+            return { entries, next: end };
+        };
+    }
+    function overriddenLookup(lookup, overrides) {
+        return async (paths) => {
+            const known = new Map(await lookup(paths.filter((path) => !overrides.has(path))));
+            for (const path of paths) {
+                const entry = overrides.get(path);
+                if (entry === undefined)
+                    continue;
+                if (entry === null)
+                    known.delete(path);
+                else
+                    known.set(path, declaredOf(entry));
+            }
+            return known;
+        };
+    }
+    function validatorOf(record, confirmedLayer) {
+        return async (resulting, touched) => {
+            const composition = compositionFor(record);
+            const local = await openLocal();
+            const changed = [];
+            const overrides = new Map();
+            const pace = paced();
+            for (const path of new Set([...confirmedLayer.held, ...touched])) {
+                await pace(ROW_WEIGHT);
+                const was = entryAt(confirmedLayer, path);
+                const now = entryAt(resulting, path);
+                if (!textDiffers(was, now))
+                    continue;
+                overrides.set(path, now);
+                if (textOf(was) !== textOf(now))
+                    changed.push({ path, was: textOf(was), now: textOf(now) });
+            }
+            const lookup = overriddenLookup(lookupOf(local, record.key, 'confirmed'), overrides);
+            const clean = available(composition) &&
+                changed.length <= CLEAN_CHANGES &&
+                (await changedCleanly(changed, compositionOf(record), composition, {
+                    lookup,
+                    texts: textsOf(local, record.key, 'confirmed'),
+                    referrers: referrersOf(local, record.key, 'confirmed'),
+                }));
+            if (clean)
+                return { verdict: 'accept' };
+            return validatedCollection(overriddenWalk(walkOf(local, record.key, 'confirmed'), overrides), lookup, composition);
+        };
+    }
+    function textsOf(local, key, view) {
+        return async (paths) => new Map((await local.entries(key, view, paths)).map(({ path, content, binary }) => [
+            path,
+            binary !== null ? null : content,
+        ]));
+    }
+    function referrersOf(local, key, view) {
+        return async (targets) => [
+            ...new Set((await local.referrers(key, view, targets, CHECKED_LINKS)).map(({ path }) => path)),
+        ];
+    }
+    async function sideOf(locator, replica, room, saving) {
+        const record = replica.record;
+        return {
+            room: locator,
+            handle: room.handle,
+            baseRoomVersion: record.roomVersion,
+            composition: compositionFor(record),
+            operations: room.operations,
+            providerOwnedPaths: room.providerOwnedPaths,
+            visible: saving.visible,
+            queued: queuedDocuments(replica.queue),
+            unmodeled: await unmodeledIn(record),
+            validate: validatorOf(record, saving.confirmed),
+        };
+    }
+    function movedInto(locator, saved) {
+        const into = saved.find(({ parts }) => parts.move?.room !== undefined && parts.move.room !== locator);
+        return into?.parts.move?.room ?? null;
+    }
+    async function saveCommit(local, files, rooms) {
+        const touched = new Map();
+        const commits = [];
+        for (const { locator, saving, before, queue } of rooms) {
+            const replayedLayer = await replayed(saving.record, saving.confirmed, queue);
+            const diff = await overlayDiff(saving.record, before, replayedLayer.visible, replayedLayer.touched);
+            touched.set(locator, diff.touched);
+            commits.push({
+                locator,
+                key: saving.record.key,
+                roots: saving.record.typedSelection?.roots ?? [],
+                overlay: diff.overlay,
+            });
+        }
+        try {
+            const answer = await local.commit({
+                rooms: commits,
+                writes: rooms.map(({ write }) => write),
+                files,
+                whole: true,
+            });
+            return { answer, touched };
+        }
+        catch {
+            return null;
+        }
+    }
+    function savedReplica(locator, before, queue, touched, answer) {
+        replicas.set(locator, {
+            ...before,
+            queue,
+            overlaid: touched,
+            count: answer.counts[locator] ?? before.count,
+        });
+    }
+    async function committedMove(locator, destination, { local, replica, room }, saved, consumed, writtenBy, files) {
+        const mixed = saved.find(({ parts }) => Object.keys(parts).length !== 1 || parts.move?.room !== destination);
+        if (mixed !== undefined) {
+            return { outcome: 'refused', code: 'mixed-room-move', retryable: false, file: mixed.path };
+        }
+        const moves = saved.map(({ path, parts }) => ({ path, to: moveTarget(parts.move) }));
+        const sourceSaving = await savingIn(replica, moves.map(({ path }) => ({ kind: 'remove', path })), saved.map(({ path }) => path), moves.map(({ path }) => path));
+        const changed = saved.flatMap(({ path, parts }) => changedParts(path, underneath(parts, path, sourceSaving.visible)));
         if (changed.length > 0)
             return { outcome: 'refused', code: 'changed-underneath', retryable: false, parts: changed };
-        const parts = saved.map(({ path, parts }) => changesOf(path, parts));
-        const changes = parts.flatMap(({ changes }) => changes);
-        const requeue = requeued(replica.queue, changes, replica.visible, withdrawable, (queue) => replicaOf(replica.confirmed, queue, replica).visible);
+        const target = replicas.get(destination);
+        const listedRoom = rooms.get(destination);
+        if (target === undefined || listedRoom === undefined) {
+            throw runtimeError('room-not-held', `No Local Replica for ${destination}`);
+        }
+        const arriving = await savingIn(target, [], moves.map(({ to }) => to));
+        const built = await buildMove({
+            source: await sideOf(locator, replica, room, sourceSaving),
+            destination: await sideOf(destination, target, listedRoom, arriving),
+            moves,
+            providerLimits: limits,
+            local: localSaves,
+            ...(writtenBy === undefined ? {} : { writtenBy }),
+        });
+        if (built.kind === 'refused')
+            return { outcome: 'refused', ...built.refusal };
+        const id = built.leaving.id;
+        const carrying = saved.flatMap(({ path, parts }) => {
+            const record = roomDrafts.get(locator)?.get(path);
+            const to = moveTarget(parts.move);
+            if (record === undefined || consumed.has(path) || roomDrafts.get(destination)?.has(to)) {
+                return [];
+            }
+            const moved = {
+                ...record,
+                locator: destination,
+                path: to,
+                revision: roomDraftRevision(),
+            };
+            return [{ from: path, record: moved }];
+        });
+        const carried = carrying.map(({ record }) => record);
+        const marked = carried.map(({ path }) => ({ path, parts: {} }));
+        const left = [...consumed, ...carrying.map(({ from }) => from)];
+        const leavingQueue = [...replica.queue, built.leaving];
+        const arrivingQueue = [...target.queue, built.arriving];
+        const committedBoth = await saveCommit(local, files, [
+            {
+                locator,
+                saving: sourceSaving,
+                before: replica,
+                queue: leavingQueue,
+                write: {
+                    locator,
+                    queue: leavingQueue,
+                    saved: new Map([[id, saved]]),
+                    consumedRoomDrafts: left,
+                },
+            },
+            {
+                locator: destination,
+                saving: arriving,
+                before: target,
+                queue: arrivingQueue,
+                write: {
+                    locator: destination,
+                    queue: arrivingQueue,
+                    saved: new Map([[id, marked]]),
+                    roomDrafts: carried,
+                },
+            },
+        ]);
+        if (committedBoth === null)
+            return { outcome: 'refused', code: 'durable-write', retryable: true };
+        const { answer, touched } = committedBoth;
+        if (answer.fenced !== null) {
+            throw runtimeError('room-not-held', `No Local Replica for ${answer.fenced}`);
+        }
+        if (fences.has(locator) || fences.has(destination)) {
+            throw runtimeError('room-not-held', `No Local Replica for ${locator}`);
+        }
+        pendings.set(pendingKey(locator, id), {
+            drafts: saved,
+            submission: { state: 'waiting' },
+            lost: false,
+        });
+        pendings.set(pendingKey(destination, id), {
+            drafts: marked,
+            submission: { state: 'waiting' },
+            lost: false,
+        });
+        for (const path of left)
+            forgetRoomDraft(locator, path);
+        for (const record of carried)
+            rememberRoomDraft(record);
+        savedReplica(locator, replica, leavingQueue, touched.get(locator), answer);
+        savedReplica(destination, target, arrivingQueue, touched.get(destination), answer);
+        publishChangeSet(mergeChangeSets([
+            changeSet(locator, {
+                documents: answer.changed[locator] ?? [],
+                queue: true,
+                drafts: left,
+            }),
+            changeSet(destination, {
+                documents: answer.changed[destination] ?? [],
+                queue: true,
+                drafts: carried.map(({ path }) => path),
+            }),
+        ]));
+        queuedSave(locator);
+        return { outcome: 'saved', identifier: id };
+    }
+    function queuedSave(locator) {
+        if (!localSaves)
+            recorded = false;
+        moveTo({ ...(localSaves ? status : saving(status)), ...attention() });
+        submitLater(locator);
+    }
+    async function committed(locator, target, saved, consumed, writtenBy, files = []) {
+        if (full)
+            return { outcome: 'refused', code: 'durable-write', retryable: true };
+        const into = movedInto(locator, saved);
+        if (into !== null) {
+            return committedMove(locator, into, target, saved, consumed, writtenBy, files);
+        }
+        const { local, replica, room } = target;
+        const parts = saved.map(({ path, parts: held }) => changesOf(path, held));
+        const changes = parts.flatMap(({ changes: made }) => made);
+        const saving = await savingIn(replica, changes, [
+            ...saved.map(({ path }) => path),
+            ...parts.flatMap(({ bases }) => bases.map(({ path }) => path)),
+        ]);
+        const changed = saved.flatMap(({ path, parts: held }) => changedParts(path, underneath(held, path, saving.visible)));
+        if (changed.length > 0)
+            return { outcome: 'refused', code: 'changed-underneath', retryable: false, parts: changed };
+        const requeue = await stepped(requeuing(replica.queue, changes, saving.visible, withdrawable(locator), saving.visibleOver));
         if (requeue.kind === 'refused')
             return { outcome: 'refused', ...requeue.refusal };
         const foreign = [...requeue.withdrawn.keys()].some((origin) => {
@@ -1488,22 +2180,19 @@ export function composeRuntime(options) {
         const withdrawing = requeue.withdrawn.size > 0;
         const input = {
             local: localSaves,
-            baseRoomVersion: replica.confirmed.record.roomVersion,
-            composition: compositionFor(replica.confirmed.record),
+            baseRoomVersion: replica.record.roomVersion,
+            composition: compositionFor(replica.record),
             operations: room.operations,
             providerOwnedPaths: room.providerOwnedPaths,
             providerLimits: limits,
             handle: room.handle,
-            visible: replica.visible,
+            visible: saving.visible,
             changes,
             bases: parts.flatMap(({ bases }) => bases),
             queued: queuedDocuments(replica.queue),
             writtenBy,
-            clean: {
-                text: replica.confirmed.record.documents,
-                binaries: replica.confirmed.record.binaries,
-                composition: compositionOf(replica.confirmed.record),
-            },
+            unmodeled: await unmodeledIn(replica.record),
+            validate: validatorOf(replica.record, saving.confirmed),
         };
         const checked = withdrawing
             ? await buildBatch({ ...input, queued: new Set([...input.queued, ...requeue.queued]) })
@@ -1528,8 +2217,7 @@ export function composeRuntime(options) {
                 ? null
                 : await buildBatch({
                     ...input,
-                    visible: (await stepped(replicating(replica.confirmed, requeue.queue, replica)))
-                        .visible,
+                    visible: await stepped(saving.visibleOver(requeue.queue)),
                     changes: requeue.changes,
                     queued: queuedDocuments(requeue.queue),
                 });
@@ -1548,7 +2236,7 @@ export function composeRuntime(options) {
         for (const [origin, replaced] of withdrawn) {
             if (replaced === null)
                 continue;
-            const carried = withdrawnDrafts(pendings.get(origin)?.drafts ?? [], changes);
+            const carried = withdrawnDrafts(pendings.get(pendingKey(locator, origin))?.drafts ?? [], changes);
             drafted.set(replaced.id, replaced === join?.batch
                 ? [
                     ...carried.map((held) => joinedDraft(held, saved)),
@@ -1562,66 +2250,77 @@ export function composeRuntime(options) {
         for (const replaced of withdrawn.values()) {
             if (replaced === null || !batches.includes(replaced))
                 continue;
-            const limited = limitedIn(batches, replaced, limits, (queue) => replicaOf(replica.confirmed, queue, replica).visible);
+            const limited = await stepped(limiting(batches, replaced, limits, saving.visibleOver));
             if (limited !== null)
                 return { outcome: 'refused', ...limited };
         }
         const carried = carriedDrafts(locator, saved, consumed);
         const left = [...consumed, ...carried.keys()];
         const arrived = [...carried.values()];
-        try {
-            await local.keepAuthored({
+        const done = await saveCommit(local, files, [
+            {
                 locator,
+                saving,
+                before: replica,
                 queue: batches,
-                saved: drafted,
-                consumedRoomDrafts: left,
-                roomDrafts: arrived,
-            });
-        }
-        catch {
+                write: {
+                    locator,
+                    queue: batches,
+                    saved: drafted,
+                    consumedRoomDrafts: left,
+                    roomDrafts: arrived,
+                },
+            },
+        ]);
+        if (done === null)
             return { outcome: 'refused', code: 'durable-write', retryable: true };
+        const { answer, touched } = done;
+        if (answer.fenced !== null) {
+            throw runtimeError('room-not-held', `No Local Replica for ${answer.fenced}`);
         }
-        const next = await stepped(replicating(replica.confirmed, batches, replica));
-        const set = await stepped(changing(locator, replica, next, {
-            queue: true,
-            drafts: [...left, ...arrived.map(({ path }) => path)],
-        }));
         if (fences.has(locator))
             throw runtimeError('room-not-held', `No Local Replica for ${locator}`);
         for (const origin of withdrawn.keys())
-            pendings.delete(origin);
+            pendings.delete(pendingKey(locator, origin));
         for (const [id, drafts] of drafted) {
-            pendings.set(id, { drafts, submission: { state: 'waiting' }, lost: false });
+            pendings.set(pendingKey(locator, id), {
+                drafts,
+                submission: { state: 'waiting' },
+                lost: false,
+            });
         }
-        if (!localSaves)
-            recorded = false;
         for (const path of left)
             forgetRoomDraft(locator, path);
         for (const record of arrived)
             rememberRoomDraft(record);
-        replicas.set(locator, next);
-        publishChangeSet(set);
-        moveTo({ ...(localSaves ? status : saving(status)), ...attention() });
-        submitLater(locator);
+        savedReplica(locator, replica, batches, touched.get(locator), answer);
+        publishChangeSet(changeSet(locator, {
+            documents: answer.changed[locator] ?? [],
+            queue: true,
+            drafts: [...left, ...arrived.map(({ path }) => path)],
+        }));
+        queuedSave(locator);
         const identifier = join?.batch.id ??
             built?.batch.id ??
             [...requeue.withdrawn].map(([origin, replaced]) => replaced?.id ?? origin).at(-1);
         return { outcome: 'saved', identifier };
     }
-    async function mark(local, locator, identifier, submission, lost) {
-        const state = pendings.get(identifier);
-        if (!continuing() ||
-            state === undefined ||
-            (JSON.stringify(state.submission) === JSON.stringify(submission) && state.lost === lost)) {
-            return;
-        }
-        await local.submit(locator, identifier, submission, lost);
-        if (fences.has(locator))
-            return;
-        pendings.set(identifier, { ...state, submission, lost });
-        const replica = replicas.get(locator);
-        if (replica !== undefined)
-            publishChangeSet(changeSet(locator, replica, replica, { queue: true }));
+    async function mark(local, locator, batch, submission, lost) {
+        const partner = partnerOf(batch, locator);
+        for (const held of partner === null ? [locator] : [locator, partner]) {
+            const state = pendings.get(pendingKey(held, batch.id));
+            if (!continuing() ||
+                state === undefined ||
+                (JSON.stringify(state.submission) === JSON.stringify(submission) && state.lost === lost)) {
+                continue;
+            }
+            await local.submit(held, batch.id, submission, lost);
+            if (fences.has(held))
+                continue;
+            pendings.set(pendingKey(held, batch.id), { ...state, submission, lost });
+            if (replicas.has(held))
+                publishChangeSet(changeSet(held, { queue: true }));
+        }
         moveTo({ ...status, ...attention() });
     }
     async function keepUpload(local, locator, identifier, upload) {
@@ -1630,7 +2329,8 @@ export function composeRuntime(options) {
         await local.keepUpload(locator, identifier, upload);
         if (fences.has(locator))
             throw runtimeError('room-not-held', `No Local Replica for ${locator}`);
-        pendings.set(identifier, { ...pendings.get(identifier), upload });
+        const key = pendingKey(locator, identifier);
+        pendings.set(key, { ...pendings.get(key), upload });
         if (!continuing())
             throw new Error('connection refused');
     }
@@ -1663,7 +2363,7 @@ export function composeRuntime(options) {
             if (fencedSince(locator, since))
                 return failure({ kind: 'room-not-readable', locator });
             if (result.kind === 'scoped-refusal') {
-                const room = replicas.get(result.locator)?.confirmed.record;
+                const room = replicas.get(result.locator)?.record;
                 if (room !== undefined)
                     await scoped(result, room, await openLocal());
             }
@@ -1676,19 +2376,55 @@ export function composeRuntime(options) {
             return UNCERTAIN;
         }
     }
-    function queuedBlob(locator, path, localId) {
+    function located(room, path, destination) {
+        const crossing = roomTarget(destination);
+        if (crossing === null) {
+            const named = target(path, destination);
+            return named === null || !rooms.has(room) ? null : { room, path: named };
+        }
+        const held = [...rooms.values()].find((listed) => listed.handle === crossing.handle);
+        return held === undefined ? null : { room: held.locator, path: crossing.path };
+    }
+    async function resolveReference(room, path, destination) {
+        if (roomTarget(destination) === null && target(path, destination) === null) {
+            return ABSENT_TARGET;
+        }
+        const at = located(room, path, destination);
+        if (at === null)
+            return UNREADABLE;
+        if (locked(at.room))
+            return LOCKED_UNREADABLE;
+        const held = replicas.get(at.room);
+        if (held !== undefined &&
+            (await (await openLocal()).entries(held.record.key, 'visible', [at.path])).length > 0) {
+            return { kind: 'document', ...at };
+        }
+        const history = await readHistory(at.room, at.path);
+        if (history.kind === 'no-history' || history.kind === 'revision')
+            return ABSENT_TARGET;
+        if (history.kind !== 'history')
+            return history;
+        const [last] = history.revisions;
+        if (last === undefined)
+            return ABSENT_TARGET;
+        return history.deleted === true
+            ? { kind: 'deleted', ...at, revision: last }
+            : { kind: 'document', ...at };
+    }
+    function queuedFacts(locator, path, localId) {
         for (const batch of replicas.get(locator)?.queue ?? []) {
             const change = batch.changes[queuedFile(batch, path, localId)];
             if (change?.kind === 'binary')
-                return change.blob;
+                return change;
         }
-        return null;
+        const drafted = roomDrafts.get(locator)?.get(path)?.parts.file;
+        return drafted?.localId === localId ? drafted : null;
     }
-    function binaryRoom(request) {
-        if (request.kind === 'path')
-            return request.locator;
-        const scope = options.adapter.referrerScope(request.referrer);
-        return scope?.kind === 'room' ? scope.locator : null;
+    function batchFile(batch) {
+        return async (localId) => {
+            const change = batch.changes.find((held) => held.kind === 'binary' && held.localId === localId);
+            return (await openLocal()).file(localId, change?.kind === 'binary' ? change.mediaType : '');
+        };
     }
     async function transferBinary(request, transfer, answer) {
         if (closed || refusal !== null)
@@ -1702,18 +2438,15 @@ export function composeRuntime(options) {
         if (closed || authorization === undefined || refusal !== null)
             return UNCERTAIN;
         const since = fencings;
-        journal.record(request.kind === 'path'
-            ? `transfer binary ${request.locator} ${request.path}`
-            : `transfer binary ${request.fileRef}`);
+        journal.record(`transfer binary ${request.locator} ${request.path}`);
         try {
             const result = await transfer(authorization);
             const settled = result;
             journal.record(`outcome binary ${settled.kind}`);
-            const locator = binaryRoom(request);
-            if (locator !== null && fencedSince(locator, since))
-                return failure({ kind: 'room-not-readable', locator });
+            if (fencedSince(request.locator, since))
+                return failure({ kind: 'room-not-readable', locator: request.locator });
             if (settled.kind === 'scoped-refusal') {
-                const room = replicas.get(settled.locator)?.confirmed.record;
+                const room = replicas.get(settled.locator)?.record;
                 if (room !== undefined)
                     await scoped(settled, room, await openLocal());
             }
@@ -1726,68 +2459,88 @@ export function composeRuntime(options) {
             return UNCERTAIN;
         }
     }
-    function readBinary(request) {
-        return transferBinary(request, (held) => options.adapter.binary(held, request), binaryAnswer);
+    async function readBinary(request, name) {
+        if (closed)
+            return UNCERTAIN;
+        const held = await keptFiles.find(name);
+        if (held !== null)
+            return held;
+        return transferBinary(request, (authorization) => keptFiles.fetch(name, () => options.adapter.binary(authorization, request)), binaryAnswer);
     }
-    function binaryPath(locator, path, revision) {
+    async function binaryPath(locator, path, revision) {
         if (revision !== undefined)
             return { kind: 'path', locator, path, revision };
-        const visible = replicas.get(locator)?.visible;
-        const held = visible?.binaries[path];
-        if (visible === undefined || held === undefined)
+        const replica = replicas.get(locator);
+        if (replica === undefined)
+            return null;
+        const local = await openLocal();
+        const [held] = await local.entries(replica.record.key, 'visible', [path]);
+        if (held?.binary === undefined || held.binary === null)
             return null;
-        if (held.state === 'pending')
-            return { kind: 'pending', localId: held.localId };
-        const record = binaryRecord(path, held, visible.revisions[path]);
+        if (held.binary.state === 'pending')
+            return { kind: 'pending', localId: held.binary.localId };
+        const record = binaryRecord(path, held.binary, held.revision ?? undefined);
         if (record.state !== 'accepted')
             return null;
-        const replica = replicas.get(locator);
-        const queued = (replica?.queue ?? []).flatMap((batch) => batch.changes);
+        const queued = replica.queue.flatMap((batch) => batch.changes);
+        const sources = queued.flatMap((change) => (change.kind === 'move' ? [change.path] : []));
+        const confirmedLayer = await stepped(slicing(await local.entries(replica.record.key, 'confirmed', [path, ...sources]), [
+            path,
+            ...sources,
+        ]));
         const holds = (at) => {
-            const kept = replica?.confirmed.record.binaries[at];
+            const kept = confirmedLayer.binaries[at];
             return (kept?.state === 'accepted' &&
-                kept.fileRef === record.fileRef &&
-                replica?.confirmed.record.revisions[at] === record.revision);
+                kept.sha256 === record.sha256 &&
+                confirmedLayer.revisions[at] === record.revision);
         };
-        let confirmed = path;
-        for (let index = queued.length - 1; index >= 0 && !holds(confirmed); index -= 1) {
+        let confirmedAt = path;
+        for (let index = queued.length - 1; index >= 0 && !holds(confirmedAt); index -= 1) {
             const change = queued[index];
-            if (change.kind === 'move' && change.to === confirmed)
-                confirmed = change.path;
+            if (change.kind === 'move' && change.to === confirmedAt)
+                confirmedAt = change.path;
         }
         return {
             kind: 'path',
             locator,
-            path: confirmed,
+            path: confirmedAt,
             revision: record.revision,
-            fileRef: record.fileRef,
         };
     }
     async function readBinaryPath(locator, path, revision) {
         await ready;
-        const asked = binaryPath(locator, path, revision);
+        const drafted = roomDrafts.get(locator)?.get(path)?.parts.file;
+        const asked = drafted !== undefined && drafted.localId === revision
+            ? { kind: 'pending', localId: revision }
+            : await binaryPath(locator, path, revision);
         if (asked === null)
             return absentBinary(path);
         if (asked.kind === 'pending') {
-            const blob = queuedBlob(locator, path, asked.localId);
-            return blob === null ? absentBinary(path) : { kind: 'binary', blob };
+            const facts = queuedFacts(locator, path, asked.localId);
+            return facts === null
+                ? absentBinary(path)
+                : {
+                    kind: 'binary',
+                    file: asked.localId,
+                    byteLength: facts.byteLength,
+                    mediaType: facts.mediaType,
+                };
         }
-        return readBinary(asked);
+        return readBinary(asked, { locator, path: asked.path, revision: asked.revision });
     }
     async function linkBinaryPath(locator, path, revision) {
         await ready;
-        const asked = binaryPath(locator, path, revision);
+        const asked = await binaryPath(locator, path, revision);
         if (asked === null || asked.kind === 'pending')
             return absentBinary(path);
         return transferBinary(asked, (held) => options.adapter.link(held, asked), binaryLinkAnswer);
     }
-    async function readBinaryReference(reference) {
-        await ready;
-        return readBinary({
-            kind: 'reference',
-            fileRef: reference.fileRef,
-            referrer: reference.referrer,
-        });
+    function readPart(file, part) {
+        return database.ask({ kind: 'file.part', key: file, part });
+    }
+    async function cleanUp() {
+        const freed = await database.ask({ kind: 'opened.clean' });
+        return freed + ((await options.shell.cleanUp?.()) ?? 0);
     }
     function declaredAgents() {
         for (const capability of capabilities) {
@@ -1805,6 +2558,13 @@ export function composeRuntime(options) {
         }
         return undefined;
     }
+    function calledRooms(name, input) {
+        const member = declaredAction(name)?.room;
+        if (member === undefined || input === null || typeof input !== 'object')
+            return [];
+        const named = input[member];
+        return (Array.isArray(named) ? named : [named]).filter((room) => typeof room === 'string');
+    }
     async function invokeAction(name, input, dispatching) {
         await ready;
         if (closed || refusal !== null)
@@ -1824,7 +2584,7 @@ export function composeRuntime(options) {
         try {
             const result = await options.adapter.action(authorization, { name, input });
             if (result.kind === 'scoped-refusal') {
-                const room = replicas.get(result.locator)?.confirmed.record;
+                const room = replicas.get(result.locator)?.record;
                 if (room !== undefined)
                     await scoped(result, room, await openLocal());
             }
@@ -1899,93 +2659,426 @@ export function composeRuntime(options) {
     }
     function reachedBy(locator, roomVersion) {
         const held = replicas.get(locator);
-        return (held !== undefined &&
-            options.adapter.reached(locator, held.confirmed.record.roomVersion, roomVersion));
+        return (held !== undefined && options.adapter.reached(locator, held.record.roomVersion, roomVersion));
     }
-    function writtenAfter(locator, roomVersion, path) {
-        const written = replicas.get(locator)?.confirmed.record.written[path];
+    async function writtenAfter(locator, roomVersion, path) {
+        const held = replicas.get(locator);
+        if (held === undefined)
+            return false;
+        const [entry] = await (await openLocal()).entries(held.record.key, 'confirmed', [path]);
+        const written = entry?.written ?? undefined;
         return (written !== undefined &&
             options.adapter.reached(locator, written, roomVersion) &&
             !options.adapter.reached(locator, roomVersion, written));
     }
-    async function pullRefresh(authorized, confirmed, live) {
-        if (!live())
+    function overriddenTexts(texts, overrides) {
+        return async (paths) => {
+            const known = new Map(await texts(paths.filter((path) => !overrides.has(path))));
+            for (const path of paths) {
+                const entry = overrides.get(path);
+                if (entry === undefined)
+                    continue;
+                if (entry === null)
+                    known.delete(path);
+                else
+                    known.set(path, entry.binary !== null ? null : entry.content);
+            }
+            return known;
+        };
+    }
+    async function unreadableRoom(texts, walk, paths) {
+        if (paths !== null) {
+            const text = {};
+            for (const [path, content] of await texts(paths))
+                if (content !== null)
+                    text[path] = content;
+            return stepped(unreadableIn(text, Object.keys(text)));
+        }
+        for (let after = null;;) {
+            const page = await walk(after);
+            const text = {};
+            for (const { path, content } of page.entries)
+                if (content !== null)
+                    text[path] = content;
+            const refused = await stepped(unreadableIn(text, Object.keys(text)));
+            if (refused !== null)
+                return refused;
+            if (page.next === null)
+                return null;
+            after = page.next;
+        }
+    }
+    async function validatedRoom(local, record, view, previous, overrides = null) {
+        const composition = compositionOf(record);
+        const modeled = record.model.status !== 'unavailable' || record.selectionModel.status !== 'unavailable';
+        const lookup = overrides === null
+            ? lookupOf(local, record.key, view)
+            : overriddenLookup(lookupOf(local, record.key, view), overrides);
+        const texts = overrides === null
+            ? textsOf(local, record.key, view)
+            : overriddenTexts(textsOf(local, record.key, view), overrides);
+        const walk = overrides === null
+            ? walkOf(local, record.key, view)
+            : overriddenWalk(walkOf(local, record.key, view), overrides);
+        let changes = null;
+        let reshaped = false;
+        if (previous !== null && previous.changed.length <= CLEAN_CHANGES) {
+            const [was, now] = await Promise.all([
+                local.entries(record.key, 'confirmed', previous.changed),
+                overrides === null
+                    ? local.entries(record.key, view, previous.changed)
+                    : Promise.resolve([]),
+            ]);
+            const before = new Map(was.map((entry) => [entry.path, entry]));
+            const after = overrides === null
+                ? new Map(now.map((entry) => [entry.path, entry]))
+                : overrides;
+            changes = previous.changed.flatMap((path) => {
+                const one = before.get(path) ?? null;
+                const other = after.get(path) ?? null;
+                reshaped ||= textDiffers(one, other);
+                const held = textOf(one);
+                const next = textOf(other);
+                return held === next ? [] : [{ path, was: held, now: next }];
+            });
+        }
+        const named = changes === null ? null : changes.map(({ path }) => path);
+        const textChanged = changes === null || changes.length > 0 || reshaped;
+        const modelsChanged = previous === null || !sameComposition(compositionOf(previous.record), composition);
+        if (modeled && (textChanged || modelsChanged)) {
+            const clean = previous !== null &&
+                changes !== null &&
+                (await changedCleanly(changes, compositionOf(previous.record), composition, {
+                    lookup,
+                    texts,
+                    referrers: referrersOf(local, record.key, 'confirmed'),
+                }));
+            if (clean)
+                return null;
+            const verdict = await validatedCollection(walk, lookup, composition);
+            if (verdict.verdict === 'accept')
+                return null;
+            if (verdict.rule !== 'model-unavailable')
+                return { kind: 'refused', refusal: verdict };
+            return unreadableRoom(texts, walk, named);
+        }
+        if (textChanged)
+            return unreadableRoom(texts, walk, named);
+        return null;
+    }
+    function refreshingOf(local, key, liveness, replaying = null) {
+        const write = replaying === null ? exclusive : installWrite;
+        return {
+            async turn() {
+                if (replaying === null)
+                    return;
+                installing(replaying, 'replaying');
+                await screened();
+            },
+            prior: async (paths) => new Map((await local.entries(key, 'refreshed', paths)).map((entry) => [entry.path, entry])),
+            async stage(page) {
+                for (let written = 0;;) {
+                    if (replaying !== null)
+                        await screened();
+                    const end = batchEnd(page.entries, written);
+                    const last = end === page.entries.length;
+                    const entries = page.entries.slice(written, end);
+                    const staged = await write(async () => {
+                        if (!liveness())
+                            return false;
+                        await timed(() => local.refresh(key, last
+                            ? { ...page, entries }
+                            : { entries, removals: [], folders: [], folderRemovals: [] }));
+                        return true;
+                    });
+                    if (!staged)
+                        return false;
+                    if (last)
+                        return true;
+                    written = end;
+                }
+            },
+        };
+    }
+    function batchEnd(entries, from) {
+        let end = from;
+        let spent = 0;
+        while (end < entries.length) {
+            const size = (entries[end].content?.length ?? 0) + ROW_WEIGHT;
+            if (spent + size > stageBytes && end > from)
+                break;
+            spent += size;
+            end += 1;
+        }
+        return end;
+    }
+    async function timed(work) {
+        const started = performance.now();
+        const done = await work();
+        const spent = performance.now() - started;
+        if (spent < STAGE_AIM_MS / 2)
+            stageBytes = Math.min(STAGE_BYTES, Math.round(stageBytes * 1.5));
+        else if (spent > STAGE_AIM_MS * 2) {
+            stageBytes = Math.max(STAGE_FLOOR, Math.round(stageBytes / 1.5));
+        }
+        return done;
+    }
+    function installWrite(work) {
+        const next = installWrites.then(() => exclusive(work), () => exclusive(work));
+        installWrites = next.then(() => undefined, () => undefined);
+        return next;
+    }
+    function screened() {
+        if (onScreen || closed)
+            return Promise.resolve();
+        queueReadiness();
+        return new Promise((resolve) => shownWaiters.push(resolve));
+    }
+    async function heldPart() {
+        while (partsFree === 0)
+            await new Promise((admit) => partWaiters.push(admit));
+        partsFree -= 1;
+        return freed();
+    }
+    function freed() {
+        let released = false;
+        return () => {
+            if (released)
+                return;
+            released = true;
+            partsFree += 1;
+            partWaiters.shift()?.();
+        };
+    }
+    function installing(locator, step, share = null) {
+        installs.set(locator, { step, share });
+        queueReadiness();
+    }
+    function installed(locator) {
+        if (installs.delete(locator))
+            queueReadiness();
+    }
+    function screen(value) {
+        if (value === onScreen)
+            return;
+        onScreen = value;
+        journal.record(`installation ${value ? 'shown' : 'hidden'}`);
+        queueReadiness();
+        if (!value)
+            return;
+        for (const resolve of shownWaiters.splice(0))
+            resolve();
+    }
+    async function pullRefresh(authorized, held, liveness) {
+        if (!liveness())
             return unconfirmed;
         const turn = generation;
+        const { record } = held;
+        const base = held.confirmed;
+        const local = await openLocal();
         try {
-            const result = await refreshRoom(reads, authorized, confirmed, (models, held) => (live() ? remodel(confirmed.record.locator, models, held) : held), live);
-            const detail = result.kind === 'advanced' ? result.confirmed.record.roomVersion : result.kind;
-            journal.record(`transfer refresh ${confirmed.record.locator} ${detail}`);
-            return result;
+            await exclusive(() => local.unrefresh(record.key));
+            const result = await advancement(reads, authorized, record, (models, kept) => (liveness() ? remodel(record.locator, models, kept) : kept), liveness, refreshingOf(local, record.key, liveness));
+            if (result.kind !== 'advanced') {
+                journal.record(`transfer refresh ${record.locator} ${result.kind}`);
+                return result;
+            }
+            const refused = await validatedRoom(local, result.record, 'refreshed', {
+                record,
+                changed: [...result.changed],
+            });
+            if (refused !== null) {
+                journal.record(`transfer refresh ${record.locator} refused`);
+                return refused;
+            }
+            journal.record(`transfer refresh ${record.locator} ${result.record.roomVersion}`);
+            return { kind: 'advanced', record: result.record, base };
         }
         catch (error) {
-            journal.record(`transfer refresh ${confirmed.record.locator} transport-uncertainty`);
+            if (refusedForSpace(error))
+                return unconfirmed;
+            journal.record(`transfer refresh ${record.locator} transport-uncertainty`);
             throw error;
         }
         finally {
-            reads.finished(confirmed.record.locator, turn);
-        }
+            reads.finished(record.locator, turn);
+        }
+    }
+    const heldContents = new Map();
+    function heldContentOf(local, key) {
+        const known = heldContents.get(key);
+        if (known !== undefined)
+            return known;
+        if (heldContents.size > ROOM_READS)
+            heldContents.clear();
+        const made = {
+            files: (after, limit) => local.files(key, 'confirmed', after, limit),
+            async contents(paths) {
+                return new Map((await local.entries(key, 'confirmed', paths)).flatMap(({ path, content, revision }) => content === null || revision === null ? [] : [[path, { content, revision }]]));
+            },
+        };
+        heldContents.set(key, made);
+        return made;
     }
-    function staging(local, live) {
+    function staging(local, liveness) {
         return {
             held: (locator) => transfers.get(locator) ?? null,
-            staged: (record) => local.staged(record),
-            stage: (record, page) => exclusive(async () => {
-                if (!live())
-                    return false;
-                const bytes = layerBytes(page);
-                if (!(await admitted(local, record.locator, bytes)))
-                    return false;
-                try {
-                    await local.stage(record, page);
-                }
-                catch (error) {
-                    if (!exceeded(error))
-                        throw error;
-                    await exceededOn(record.locator, bytes);
-                    return false;
+            async turn(locator, step) {
+                installing(locator, step);
+                for (;;) {
+                    await screened();
+                    const release = step === 'downloading' ? await heldPart() : () => { };
+                    if (onScreen || closed)
+                        return release;
+                    release();
                 }
-                transfers.set(record.locator, record);
-                readSide.recover();
-                return true;
+            },
+            spare() {
+                if (!onScreen || closed || partsFree === 0)
+                    return null;
+                partsFree -= 1;
+                return freed();
+            },
+            arriving(locator) {
+                let ended = false;
+                return {
+                    at(token, bytes) {
+                        if (ended)
+                            return;
+                        const held = arrivals.get(locator) ?? new Map();
+                        arrivals.set(locator, held.set(token, bytes));
+                        const now = performance.now();
+                        if (now - arrivalReported < ARRIVAL_REPORT_MS)
+                            return;
+                        arrivalReported = now;
+                        queueReadiness();
+                    },
+                    end() {
+                        ended = true;
+                        if (arrivals.delete(locator))
+                            queueReadiness();
+                    },
+                };
+            },
+            received: (locator, token) => local.transferPart(locator, token),
+            keep: (locator, token, received) => installWrite(async () => {
+                if (liveness())
+                    await local.keepPart(locator, token, received);
             }),
+            announced(locator) {
+                const later = announced.get(locator);
+                return later === undefined ? [] : [later];
+            },
+            async stage(record, page, composition, received) {
+                const { locator } = record;
+                const whole = received?.byteLength ?? 0;
+                const from = record.writing?.written ?? 0;
+                const token = record.writing?.token ?? null;
+                const entries = page.entries.length;
+                let held = record;
+                if (token !== null)
+                    arrivals.get(locator)?.delete(token);
+                installing(locator, 'writing', { written: from, entries, bytes: whole });
+                for (let written = from;;) {
+                    await screened();
+                    if (!liveness())
+                        return null;
+                    const end = batchEnd(page.entries, written);
+                    const last = end === entries;
+                    const next = last
+                        ? {
+                            ...held,
+                            writing: null,
+                            done: {
+                                parts: held.done.parts + (received === null ? 0 : 1),
+                                bytes: held.done.bytes + whole,
+                            },
+                        }
+                        : { ...held, writing: { token, written: end } };
+                    const key = await installWrite(async () => {
+                        if (!liveness())
+                            return null;
+                        return timed(() => local.stage(next, composition, {
+                            entries: page.entries.slice(written, end),
+                            folders: last ? page.folders : [],
+                        }, last && received !== null && token !== null ? token : undefined));
+                    });
+                    if (key === null)
+                        return null;
+                    const arrived = !transfers.has(locator);
+                    held = { ...next, key };
+                    transfers.set(locator, held);
+                    if (arrived)
+                        liveQueries.recover();
+                    if (last) {
+                        installing(locator, held.pageToken === null ? 'replaying' : 'downloading');
+                        liveQueries.recover();
+                        return held;
+                    }
+                    installing(locator, 'writing', { written: end, entries, bytes: whole });
+                    written = end;
+                }
+            },
+            async refreshing(locator, key) {
+                await exclusive(() => local.unrefresh(key));
+                return refreshingOf(local, key, liveness, locator);
+            },
             abandon: (locator) => exclusive(async () => {
-                if (!live())
+                if (!liveness())
                     return;
                 await local.abandon(locator);
                 transfers.delete(locator);
-                readSide.recover();
+                liveQueries.recover();
+                sweep();
             }),
+            setAside: (locator) => exclusive(async () => {
+                if (!liveness())
+                    return;
+                await local.abandon(locator, true);
+                transfers.delete(locator);
+                liveQueries.recover();
+            }),
+            release: (key) => exclusive(async () => {
+                await local.release(key);
+                sweep();
+            }),
+            content: (key) => heldContentOf(local, key),
+            validate: (record, view) => validatedRoom(local, record, view, null),
         };
     }
-    function reusable(room) {
-        const record = replicas.get(room.locator)?.confirmed.record;
+    function reusable(room, local) {
+        const record = replicas.get(room.locator)?.record;
         if (record === undefined || record.replica.selection !== room.replica.selection)
             return null;
-        return { documents: record.documents, revisions: record.revisions };
+        return heldContentOf(local, record.key);
     }
-    async function pullBootstrap(authorized, room, local, live) {
-        if (!live())
+    async function pullBootstrap(authorized, room, local, liveness) {
+        if (!liveness())
             return unconfirmed;
         const turn = generation;
         if (replicas.has(room.locator)) {
             catching.add(room.locator);
-            readSide.recover();
+            liveQueries.recover();
         }
         try {
             const result = await bootstrapRoom(reads, authorized, room, {
                 collection: modelOf(room.locator),
                 selection: modelOf(room.locator, 'typed-selection'),
-            }, (models, held) => (live() ? remodel(room.locator, models, held) : held), live, staging(local, live), reusable(room));
-            const detail = result.kind === 'staged' ? result.confirmed.record.roomVersion : result.kind;
+            }, (models, held) => (liveness() ? remodel(room.locator, models, held) : held), liveness, staging(local, liveness), reusable(room, local));
+            const detail = result.kind === 'staged' ? result.record.roomVersion : result.kind;
             journal.record(`transfer bootstrap ${room.locator} ${detail}`);
-            if (result.kind !== 'staged')
+            if (result.kind !== 'staged') {
                 caughtUpTo(room.locator);
+                installed(room.locator);
+            }
             return result;
         }
         catch (error) {
-            journal.record(`transfer bootstrap ${room.locator} transport-uncertainty`);
             caughtUpTo(room.locator);
+            installed(room.locator);
+            if (refusedForSpace(error))
+                return unconfirmed;
+            journal.record(`transfer bootstrap ${room.locator} transport-uncertainty`);
             throw error;
         }
         finally {
@@ -1994,10 +3087,10 @@ export function composeRuntime(options) {
     }
     function caughtUpTo(locator) {
         if (catching.delete(locator))
-            readSide.recover();
+            liveQueries.recover();
     }
     function behind(room) {
-        const held = replicas.get(room.locator)?.confirmed.record.roomVersion;
+        const held = replicas.get(room.locator)?.record.roomVersion;
         return (held !== undefined &&
             [announced.get(room.locator), room.roomVersion].some((later) => later !== undefined && !options.adapter.reached(room.locator, held, later)));
     }
@@ -2009,13 +3102,13 @@ export function composeRuntime(options) {
         }
         return advanceOnce(room, local, authorized, live);
     }
-    async function advanceOnce(room, local, authorized, live) {
-        await referenced(room.locator);
-        if (!live() || paused.has(room.locator))
+    async function advanceOnce(room, local, authorized, running) {
+        const live = () => running() && !full;
+        if (!live())
             return unconfirmed;
         const held = replicas.get(room.locator);
         if (held !== undefined) {
-            const refreshed = await pullRefresh(authorized, held.confirmed, live);
+            const refreshed = await pullRefresh(authorized, held, live);
             if (!live())
                 return unconfirmed;
             if (refreshed.kind === 'still-current') {
@@ -2030,10 +3123,11 @@ export function composeRuntime(options) {
                 return null;
             }
             if (refreshed.kind === 'advanced') {
-                if (!(await publish(local, room, refreshed.confirmed, { base: held.confirmed }, live))) {
-                    const now = replicas.get(room.locator)?.confirmed.record.roomVersion;
+                const landing = { kind: 'refreshed', base: refreshed.base };
+                if (!(await publish(local, room, refreshed.record, landing, live))) {
+                    const now = replicas.get(room.locator)?.record.roomVersion;
                     const reached = now !== undefined &&
-                        options.adapter.reached(room.locator, now, refreshed.confirmed.record.roomVersion);
+                        options.adapter.reached(room.locator, now, refreshed.record.roomVersion);
                     return reached ? null : advance(room, local, authorized, live);
                 }
                 await retainModel(local, room, 'collection', modelOf(room.locator));
@@ -2043,19 +3137,18 @@ export function composeRuntime(options) {
                 return refreshed;
             if (opened !== null) {
                 owed.add(room.locator);
-                readSide.recover();
+                liveQueries.recover();
                 return unconfirmed;
             }
             if (reloadsDue.get(room.locator) === generation)
                 return unconfirmed;
         }
         const bootstrapped = await pullBootstrap(authorized, room, local, live);
-        if (!live())
-            return unconfirmed;
-        if (bootstrapped.kind !== 'staged')
-            return bootstrapped;
-        await publish(local, room, bootstrapped.confirmed, { stored: bootstrapped.stored }, live);
-        return null;
+        if (bootstrapped.kind === 'staged') {
+            await publish(local, room, bootstrapped.record, { kind: 'bootstrapped', refreshed: bootstrapped.refreshed }, live);
+            return live() ? null : unconfirmed;
+        }
+        return live() ? bootstrapped : unconfirmed;
     }
     async function withhold(withheld, room, local, progress) {
         if (withheld.kind === 'unconfirmed')
@@ -2127,57 +3220,254 @@ export function composeRuntime(options) {
             (accepted.author === undefined ? '' : ` author ${accepted.author}`) +
             (accepted.time === undefined ? '' : ` time ${accepted.time}`));
     }
-    async function adoptAccepted(room, local, submitted, accepted) {
-        await referenced(room.locator);
+    function settling(acceptance) {
+        return acceptance !== null && 'apply' in acceptance;
+    }
+    function refusalOf(acceptance) {
+        return settling(acceptance) ? (acceptance.refused ?? null) : acceptance;
+    }
+    async function acceptance(room, local, submitted, accepted) {
         if (!continuing())
             return unconfirmed;
         const current = replicas.get(room.locator);
         if (current === undefined || !current.queue.some((batch) => batch.id === submitted.id)) {
             return null;
         }
-        const held = current.confirmed.record.roomVersion;
+        const held = current.record.roomVersion;
         logAccepted(room.locator, submitted, accepted);
-        const applied = options.adapter.reached(room.locator, held, accepted.roomVersion)
-            ? { kind: 'staged', confirmed: current.confirmed }
-            : await applyReturned(current.confirmed, submitted, accepted, options.adapter.follows(room.locator, held, accepted.roomVersion)
-                ? accepted.roomVersion
-                : held, accepted.roomVersion);
-        if (applied.kind !== 'staged') {
-            const state = pendings.get(submitted.id);
-            await local.accept(room.locator, submitted.id, accepted.roomVersion);
-            if (state !== undefined && !fences.has(room.locator))
-                pendings.set(submitted.id, { ...state, accepted: accepted.roomVersion });
-            emitQueue(room.locator);
-            return applied;
-        }
-        const settled = await settle(local, room.locator, current, applied.confirmed, current.queue.filter((batch) => batch.id !== submitted.id), { room: true });
-        pendings.delete(submitted.id);
-        unreadable.delete(room.locator);
-        sourceRefusals.delete(room.locator);
-        declarationRefusals.delete(room.locator);
-        const set = settled();
-        list(room, true);
-        publishChangeSet(set);
-        moveTo({ ...status, ...attention() });
-        return null;
+        let record = current.record;
+        let changes;
+        if (!options.adapter.reached(room.locator, held, accepted.roomVersion)) {
+            const paths = [...returnedPaths(submitted, accepted)];
+            const confirmedLayer = await stepped(slicing(await local.entries(record.key, 'confirmed', paths), paths));
+            const back = await stepped(returning(confirmedLayer, submitted, accepted, accepted.roomVersion));
+            record = {
+                ...record,
+                roomVersion: options.adapter.follows(room.locator, held, accepted.roomVersion)
+                    ? accepted.roomVersion
+                    : held,
+            };
+            const overrides = new Map([
+                ...back.set.map((entry) => [entry.path, entry]),
+                ...back.removed.map((path) => [path, null]),
+            ]);
+            const refused = await validatedRoom(local, record, 'confirmed', { record: current.record, changed: [...overrides.keys()] }, overrides);
+            if (refused !== null) {
+                const key = pendingKey(room.locator, submitted.id);
+                return {
+                    locator: room.locator,
+                    left: [],
+                    commit: {
+                        rooms: [],
+                        writes: [
+                            {
+                                locator: room.locator,
+                                accepted: [{ id: submitted.id, roomVersion: accepted.roomVersion }],
+                            },
+                        ],
+                    },
+                    refused,
+                    apply() {
+                        const state = pendings.get(key);
+                        if (state !== undefined && !fences.has(room.locator))
+                            pendings.set(key, { ...state, accepted: accepted.roomVersion });
+                        return changeSet(room.locator, { queue: true });
+                    },
+                };
+            }
+            changes = back;
+        }
+        const settled = await settlement(local, room.locator, current, record, current.queue.filter((batch) => batch.id !== submitted.id), { room: true, ...(changes === undefined ? {} : { changes }) });
+        return {
+            ...settled,
+            apply(answer) {
+                const set = settled.apply(answer);
+                pendings.delete(pendingKey(room.locator, submitted.id));
+                unreadable.delete(room.locator);
+                sourceRefusals.delete(room.locator);
+                declarationRefusals.delete(room.locator);
+                list(room, true);
+                return set;
+            },
+        };
+    }
+    async function adoptedTogether(local, acceptances) {
+        const settlements = acceptances.filter(settling);
+        if (settlements.length > 0) {
+            publishChangeSet(await together(local, settlements));
+            moveTo({ ...status, ...attention() });
+        }
+        await unpair(local);
     }
     async function adopted(room, local, submitted, accepted) {
-        const failed = await exclusive(() => adoptAccepted(room, local, submitted, accepted));
+        const failed = await exclusive(async () => {
+            const adopting = await acceptance(room, local, submitted, accepted);
+            await adoptedTogether(local, [adopting]);
+            return refusalOf(adopting);
+        });
+        if (failed === null)
+            return true;
+        if (failed.kind === 'refused' && continuing())
+            refusedSource(room, failed);
+        return false;
+    }
+    async function adoptedMove(room, partner, local, submitted, accepted) {
+        const other = discovered.get(partner);
+        const failed = await exclusive(async () => {
+            const left = await acceptance(room, local, submitted, accepted);
+            const arriving = replicas.get(partner)?.queue.find((batch) => batch.id === submitted.id);
+            const arrived = other === undefined || arriving === undefined || accepted.destination === undefined
+                ? null
+                : await acceptance(other, local, arriving, {
+                    kind: 'accepted',
+                    ...accepted.destination,
+                });
+            await adoptedTogether(local, [left, arrived]);
+            const refusedArrival = refusalOf(arrived);
+            if (other !== undefined && refusedArrival?.kind === 'refused' && continuing()) {
+                refusedSource(other, refusedArrival);
+            }
+            return refusalOf(left);
+        });
+        submitLater(partner);
         if (failed === null)
             return true;
         if (failed.kind === 'refused' && continuing())
             refusedSource(room, failed);
         return false;
     }
+    function queueIn(locator) {
+        return replicas.get(locator)?.queue ?? queuesWithoutReplica.get(locator) ?? [];
+    }
+    function behindIn(locator, batch) {
+        const held = replicas.get(locator)?.queue;
+        if (held === undefined)
+            return queuesWithoutReplica.get(locator) !== undefined;
+        return held.findIndex((one) => one.id === batch.id) > 0;
+    }
+    function unpaired(skipped) {
+        for (const locator of [...replicas.keys(), ...queuesWithoutReplica.keys()]) {
+            for (const batch of queueIn(locator)) {
+                const partner = partnerOf(batch, locator);
+                if (partner === null || skipped.has(pendingKey(locator, batch.id)))
+                    continue;
+                if (queueIn(partner).some((held) => held.id === batch.id))
+                    continue;
+                if (unpairedIn(locator, batch))
+                    return { locator, batch };
+            }
+        }
+        return null;
+    }
+    async function unpairing(local, locator, batches) {
+        const ids = new Set(batches.map(({ id }) => id));
+        const leaving = batches.map((batch) => ({
+            batch,
+            returned: !localSaves && leavingIn(batch, locator) ? returnedBy('withdrawn') : null,
+        }));
+        const outcome = localSaves ? 'dropped' : 'unpaired';
+        const current = replicas.get(locator);
+        if (current !== undefined) {
+            const settled = await settlement(local, locator, current, current.record, current.queue.filter((one) => !ids.has(one.id)), { leaving });
+            return {
+                ...settled,
+                apply(answer) {
+                    for (const batch of batches)
+                        journal.record(`outcome ${locator} ${batch.id} ${outcome}`);
+                    const set = settled.apply(answer);
+                    submitLater(locator);
+                    return set;
+                },
+            };
+        }
+        const queue = queueIn(locator).filter((one) => !ids.has(one.id));
+        const written = new Map();
+        for (const { batch, returned } of leaving) {
+            if (returned === null)
+                continue;
+            for (const saved of pendings.get(pendingKey(locator, batch.id))?.drafts ?? []) {
+                written.set(saved.path, {
+                    locator,
+                    path: saved.path,
+                    revision: roomDraftRevision(),
+                    parts: returnedInto((written.get(saved.path) ?? roomDrafts.get(locator)?.get(saved.path))?.parts, saved.parts),
+                    returned,
+                });
+            }
+        }
+        const carried = carriedBack(locator, leaving.flatMap(({ batch, returned }) => (returned === null ? [] : [batch])), written);
+        return {
+            locator,
+            left: batches,
+            commit: {
+                rooms: [],
+                writes: [
+                    {
+                        locator,
+                        queue,
+                        roomDrafts: [...written.values()],
+                        consumedRoomDrafts: carried.taken,
+                    },
+                    ...carried.writes,
+                ],
+            },
+            apply() {
+                for (const batch of batches) {
+                    journal.record(`outcome ${locator} ${batch.id} ${outcome}`);
+                    pendings.delete(pendingKey(locator, batch.id));
+                }
+                if (queue.length > 0)
+                    queuesWithoutReplica.set(locator, queue);
+                else
+                    queuesWithoutReplica.delete(locator);
+                for (const record of written.values())
+                    rememberRoomDraft(record);
+                carried.remember();
+                submitLater(locator);
+                return mergeChangeSets([
+                    changeSet(locator, {
+                        queue: true,
+                        drafts: [...written.keys(), ...carried.taken],
+                    }),
+                    ...carried.changes,
+                ]);
+            },
+        };
+    }
+    async function unpair(local) {
+        const handled = new Set();
+        for (let held = unpaired(handled); held !== null && continuing(); held = unpaired(handled)) {
+            const { locator, batch } = held;
+            handled.add(pendingKey(locator, batch.id));
+            publishChangeSet(await together(local, [await unpairing(local, locator, [batch])]));
+        }
+        if (handled.size === 0)
+            return;
+        moveTo({ ...status, ...attention() });
+    }
+    async function discardHeld(head, room, local, signal) {
+        const partner = partnerOf(head, room.locator);
+        const other = partner === null ? undefined : discovered.get(partner);
+        await discardPending(other === undefined ? [room] : [room, other], local, signal);
+    }
     async function submitRoom(room, local, authorized, progress, signal) {
         while (continuing() && authorization !== undefined && !signal.aborted) {
             const replica = replicas.get(room.locator);
             const head = replica?.queue[0];
             if (replica === undefined || head === undefined)
                 return 'done';
-            if (pendings.get(head.id)?.accepted !== undefined)
+            const state = pendings.get(pendingKey(room.locator, head.id));
+            if (state?.accepted !== undefined)
+                return 'done';
+            const partner = partnerOf(head, room.locator);
+            if (partner !== null && !leavingIn(head, room.locator)) {
+                submitLater(partner);
                 return 'done';
-            const state = pendings.get(head.id);
+            }
+            if (partner !== null && behindIn(partner, head)) {
+                progress.complete = false;
+                return 'done';
+            }
             const { submission, lost: earlier } = state ?? {
                 submission: { state: 'waiting' },
                 lost: false,
@@ -2193,16 +3483,16 @@ export function composeRuntime(options) {
             }
             const lost = earlier || submission.state === 'submitted';
             if (lost && pastHorizon(head.id)) {
-                await discardPending(room, local, signal);
+                await discardHeld(head, room, local, signal);
                 return 'done';
             }
             let result;
             journal.record(`submission ${room.locator} ${head.id}`);
-            await exclusive(() => mark(local, room.locator, head.id, { state: 'submitted' }, lost));
+            await exclusive(() => mark(local, room.locator, head, { state: 'submitted' }, lost));
             if (discoveryPaused || fences.has(room.locator))
                 return 'done';
             if (signal.aborted || writesHeld()) {
-                await exclusive(() => mark(local, room.locator, head.id, submission, earlier));
+                await exclusive(() => mark(local, room.locator, head, submission, earlier));
                 if (signal.aborted)
                     return 'done';
                 progress.complete = false;
@@ -2210,11 +3500,17 @@ export function composeRuntime(options) {
                 return 'done';
             }
             const opensBefore = openSignals;
-            const answered = awaitingAnswer(room.locator);
+            const answeredHere = awaitingAnswer(room.locator);
+            const answeredThere = partner === null ? () => { } : awaitingAnswer(partner);
+            const answered = () => {
+                answeredHere();
+                answeredThere();
+            };
             try {
                 result = await options.adapter.mutate(authorized, {
                     locator: room.locator,
                     changeBatch: head,
+                    file: batchFile(head),
                     ...(state?.upload === undefined ? {} : { upload: state.upload }),
                 }, (upload) => exclusive(() => keepUpload(local, room.locator, head.id, upload)));
             }
@@ -2239,9 +3535,10 @@ export function composeRuntime(options) {
                 return 'again';
             }
             if (result.kind === 'room-not-readable') {
+                const unread = discovered.get(result.locator) ?? room;
                 progress.complete = false;
-                unreadable.add(room.locator);
-                list(room, false);
+                unreadable.add(unread.locator);
+                list(unread, false);
                 emitRooms();
                 return 'done';
             }
@@ -2256,24 +3553,30 @@ export function composeRuntime(options) {
             }
             if (result.kind === 'write-halted') {
                 journal.record(`outcome ${room.locator} ${head.id} write-halted`);
-                await exclusive(() => mark(local, room.locator, head.id, { state: 'waiting' }, lost));
+                await exclusive(() => mark(local, room.locator, head, { state: 'waiting' }, lost));
                 if (serviceMode === 'open' && openSignals !== opensBefore)
                     continue;
                 haltedRefusal = true;
                 progress.complete = false;
                 return 'done';
             }
+            const other = partner === null ? undefined : discovered.get(partner);
             if (result.kind === 'conflicted' ||
                 result.kind === 'rejected' ||
                 result.kind === 'expired' ||
                 result.kind === 'retryable-refusal') {
                 if (result.kind === 'expired' && lost && result.restored !== true) {
                     journal.record(`outcome ${room.locator} ${head.id} expired`);
-                    await discardPending(room, local, signal);
+                    await discardHeld(head, room, local, signal);
                     return 'done';
                 }
                 if (result.kind === 'expired') {
-                    await exclusive(() => mark(local, room.locator, head.id, { state: 'waiting' }, false));
+                    await exclusive(() => mark(local, room.locator, head, { state: 'waiting' }, partner !== null && lost));
+                    const there = other === undefined ? null : await advance(other, local, authorized, continuing);
+                    if (other !== undefined && there !== null) {
+                        await withhold(there, other, local, progress);
+                        return 'done';
+                    }
                     const withheld = await advance(room, local, authorized, continuing);
                     if (withheld !== null) {
                         await withhold(withheld, room, local, progress);
@@ -2290,11 +3593,25 @@ export function composeRuntime(options) {
             if (result.kind === 'retryable-refusal') {
                 const reset = result.reset;
                 progress.complete = false;
-                await exclusive(() => mark(local, room.locator, head.id, reset === undefined ? { state: 'waiting' } : { state: 'reset', reset }, lost));
+                await exclusive(() => mark(local, room.locator, head, reset === undefined ? { state: 'waiting' } : { state: 'reset', reset }, lost));
                 return reset === undefined ? 'again' : { at: Date.parse(reset) };
             }
             if (result.kind === 'conflicted' || result.kind === 'rejected' || result.kind === 'expired') {
                 const left = leaving(head, result);
+                const refreshed = async () => ({
+                    there: other === undefined ? null : await advance(other, local, authorized, continuing),
+                    here: await advance(room, local, authorized, continuing),
+                });
+                const judged = result.kind === 'conflicted' && other !== undefined ? await refreshed() : null;
+                if (judged !== null && (judged.there !== null || judged.here !== null)) {
+                    await exclusive(() => mark(local, room.locator, head, { state: 'waiting' }, lost));
+                    if (other !== undefined && judged.there !== null) {
+                        await withhold(judged.there, other, local, progress);
+                    }
+                    if (judged.here !== null)
+                        await withhold(judged.here, room, local, progress);
+                    return 'done';
+                }
                 await exclusive(async () => {
                     if (!continuing())
                         return;
@@ -2302,25 +3619,29 @@ export function composeRuntime(options) {
                     if (current === undefined || !current.queue.some((batch) => batch.id === head.id)) {
                         return;
                     }
-                    const settled = await settle(local, room.locator, current, current.confirmed, current.queue.filter((batch) => batch.id !== head.id), {
-                        leaving: (result.kind === 'expired' && landed(head, current.confirmed)) ||
-                            (result.kind === 'conflicted' && landed(head, current.confirmed, result.affected))
-                            ? { ...left, returned: null }
-                            : left,
-                    });
-                    publishChangeSet(settled());
+                    const confirmedLayer = await sliceAt(current.record, 'confirmed', [head]);
+                    const held = (result.kind === 'expired' &&
+                        (await landedWhole(room.locator, head, confirmedLayer))) ||
+                        (result.kind === 'conflicted' &&
+                            (await landedWhole(room.locator, head, confirmedLayer, result.affected)));
+                    publishChangeSet(await settle(local, room.locator, current, current.record, current.queue.filter((batch) => batch.id !== head.id), { leaving: [held ? { ...left, returned: null } : left] }));
+                    await unpair(local);
                     moveTo({ ...status, ...attention() });
                 });
                 if (result.kind === 'expired')
                     continue;
-                const withheld = await advance(room, local, authorized, continuing);
-                if (withheld !== null) {
-                    await withhold(withheld, room, local, progress);
+                const { there, here } = judged ?? (await refreshed());
+                if (other !== undefined && there !== null)
+                    await withhold(there, other, local, progress);
+                if (here !== null) {
+                    await withhold(here, room, local, progress);
                     return 'done';
                 }
                 continue;
             }
-            const kept = await adopted(room, local, head, result).finally(answered);
+            const kept = await (partner === null
+                ? adopted(room, local, head, result)
+                : adoptedMove(room, partner, local, head, result)).finally(answered);
             if (!kept) {
                 progress.complete = false;
                 return 'done';
@@ -2331,44 +3652,67 @@ export function composeRuntime(options) {
     function pastHorizon(identity) {
         return (outcomeRetention !== null && identityTime(identity) + outcomeRetention * 1000 <= Date.now());
     }
-    async function discardPending(room, local, signal) {
-        const { locator } = room;
+    async function discardPending(rooms, local, signal) {
         const discarded = await exclusive(async () => {
-            if (fences.has(locator))
-                return false;
-            const before = replicas.get(locator);
-            const queue = before?.queue ?? queuesWithoutReplica.get(locator) ?? [];
-            fences.set(locator, { at: discoveries, erased: false });
-            lastFenced.set(locator, ++fencings);
-            try {
-                await local.discard(locator);
-            }
-            finally {
-                fences.delete(locator);
+            const held = rooms
+                .filter(({ locator }) => !fences.has(locator))
+                .map((room) => ({
+                room,
+                before: replicas.get(room.locator),
+                queue: queueIn(room.locator),
+            }));
+            if (held.length === 0)
+                return [];
+            const answer = await local.commit({
+                rooms: held.flatMap(({ room, before }) => before === undefined
+                    ? []
+                    : [
+                        {
+                            locator: room.locator,
+                            key: before.record.key,
+                            roots: before.record.typedSelection?.roots ?? [],
+                            overlay: { set: [], cleared: [...before.overlaid] },
+                        },
+                    ]),
+                discards: held.map(({ room }) => room.locator),
+            });
+            for (const { room, before, queue } of held) {
+                const { locator } = room;
+                lastFenced.set(locator, ++fencings);
+                for (const batch of queue)
+                    pendings.delete(pendingKey(locator, batch.id));
+                queuesWithoutReplica.delete(locator);
+                if (before !== undefined) {
+                    replicas.set(locator, {
+                        ...before,
+                        queue: [],
+                        overlaid: new Set(),
+                        count: answer.counts[locator] ?? before.count,
+                    });
+                }
+                journal.record(`room discarded ${locator}`);
             }
-            for (const batch of queue)
-                pendings.delete(batch.id);
-            queuesWithoutReplica.delete(locator);
-            const after = before === undefined ? null : replicaOf(before.confirmed, [], before);
-            if (after !== null)
-                replicas.set(locator, after);
-            journal.record(`room discarded ${locator}`);
-            publishChangeSet(changeSet(locator, before ?? null, after, { queue: true }));
+            publishChangeSet(mergeChangeSets(held.map(({ room }) => changeSet(room.locator, {
+                documents: answer.changed[room.locator] ?? [],
+                queue: true,
+            }))));
             moveTo({ ...status, ...attention() });
-            return true;
+            return held.map(({ room }) => room);
         });
-        if (!discarded)
-            return;
-        const progress = { complete: true, reachable: true };
-        await roomTask(locator, async (live) => {
-            await Promise.race([
-                reload(room, local, progress, () => live() && !signal.aborted),
-                abandonedOn(signal),
-            ]);
-        });
-        if (signal.aborted)
-            return;
-        await rest(progress);
+        for (const room of discarded) {
+            if (signal.aborted)
+                return;
+            const progress = { complete: true, reachable: true };
+            await roomTask(room.locator, async (live) => {
+                await Promise.race([
+                    reload(room, local, progress, () => live() && !signal.aborted),
+                    abandonedOn(signal),
+                ]);
+            });
+            if (signal.aborted)
+                return;
+            await rest(progress);
+        }
     }
     function awaitingAnswer(locator) {
         let release = () => { };
@@ -2385,7 +3729,7 @@ export function composeRuntime(options) {
     async function retainModel(local, room, attached, next) {
         const key = modelKey(room.locator, attached);
         const previous = modelOf(room.locator, attached);
-        const heldBefore = replicas.get(room.locator)?.confirmed.record;
+        const heldBefore = replicas.get(room.locator)?.record;
         if (JSON.stringify(previous) === JSON.stringify(next) &&
             (heldBefore === undefined ||
                 (JSON.stringify(heldBefore.operations) === JSON.stringify(room.operations) &&
@@ -2404,32 +3748,47 @@ export function composeRuntime(options) {
             let changed = null;
             if (held !== undefined) {
                 const declared = {
-                    ...held.confirmed.record,
+                    ...held.record,
                     operations: room.operations,
                     replica: room.replica,
                     typedSelection: room.typedSelection ?? null,
                     ...(attached === 'collection' ? { model: next } : { selectionModel: next }),
                 };
-                const reclassified = sameMembership(declared, held.confirmed.record)
-                    ? { kind: 'staged', confirmed: confirmedOf(declared, held.confirmed) }
-                    : await readReclassified(declared, held.confirmed);
-                const record = reclassified.kind === 'staged'
+                let read = 'staged';
+                if (!sameMembership(declared, held.record)) {
+                    const verdict = await validatedCollection(walkOf(local, held.record.key, 'confirmed'), lookupOf(local, held.record.key, 'confirmed'), compositionOf(declared));
+                    read =
+                        verdict.verdict !== 'refuse'
+                            ? 'staged'
+                            : verdict.rule === 'model-unavailable'
+                                ? 'deferred'
+                                : { kind: 'refused', refusal: verdict };
+                }
+                const record = read === 'staged'
                     ? declared
-                    : {
-                        ...declared,
-                        typedSelection: held.confirmed.record.typedSelection,
-                    };
-                const read = reclassified.kind === 'deferred'
-                    ? { kind: 'staged', confirmed: confirmedOf(record, held.confirmed) }
-                    : reclassified;
-                await local.write({ next: record, previous: held.confirmed.record });
-                const replica = read.kind === 'staged'
-                    ? await stepped(replicating(read.confirmed, held.queue, held))
-                    : { ...held, confirmed: { ...held.confirmed, record } };
-                const set = await stepped(changing(room.locator, held, replica, { room: true }));
-                replicas.set(room.locator, replica);
-                changed = heldChange(room.locator, held, replica, set, { room: true });
-                if (read.kind === 'staged') {
+                    : { ...declared, typedSelection: held.record.typedSelection };
+                const confirmedLayer = await sliceAt(record, 'confirmed', held.queue, held.overlaid);
+                const replayedLayer = await replayed(record, confirmedLayer, held.queue);
+                const diff = await overlayDiff(record, held, replayedLayer.visible, replayedLayer.touched);
+                const answer = await local.commit({
+                    rooms: [
+                        {
+                            locator: room.locator,
+                            key: record.key,
+                            record: storedRecord(record),
+                            roots: record.typedSelection?.roots ?? [],
+                            composition: compositionOf(record),
+                            overlay: diff.overlay,
+                        },
+                    ],
+                });
+                const { count, indexed } = committedRoom(room.locator, answer);
+                replicas.set(room.locator, { ...held, record, overlaid: diff.touched, count, indexed });
+                changed = changeSet(room.locator, {
+                    documents: answer.changed[room.locator] ?? [],
+                    room: true,
+                });
+                if (read === 'staged' || read === 'deferred') {
                     if (declarationRefusals.delete(room.locator)) {
                         sourceRefusals.delete(room.locator);
                         unreadable.delete(room.locator);
@@ -2453,7 +3812,7 @@ export function composeRuntime(options) {
         });
     }
     async function scoped(result, room, local) {
-        if ((result.scope === 'content' || result.scope === 'sync') && !result.retryable) {
+        if (result.scope === 'content' && !result.retryable) {
             journal.record(`scoped refusal ${room.locator} ${result.scope} ${result.code}`);
             await loseRooms([room.locator]);
             return;
@@ -2471,15 +3830,7 @@ export function composeRuntime(options) {
             });
         else if (result.scope !== 'operation') {
             unreadable.add(room.locator);
-            scopedAway = {
-                ...room,
-                replica: { ...room.replica, admission: 'unavailable' },
-                operations: {
-                    ...room.operations,
-                    ...(result.scope === 'content' ? { read: [] } : {}),
-                    ...(result.scope === 'sync' ? { sync: [] } : {}),
-                },
-            };
+            scopedAway = { ...room, replica: { ...room.replica, admission: 'unavailable' } };
             await retainModel(local, scopedAway, 'collection', modelOf(room.locator));
         }
         if (!continuing())
@@ -2490,17 +3841,10 @@ export function composeRuntime(options) {
     }
     function heldRooms(listed) {
         return listed.flatMap((room) => {
-            const record = replicas.get(room.locator)?.confirmed.record;
+            const record = replicas.get(room.locator)?.record;
             if (record === undefined || record.replica.selection !== room.replica.selection)
                 return [];
-            return [
-                {
-                    locator: room.locator,
-                    roomVersion: record.roomVersion,
-                    documents: record.documents,
-                    revisions: record.revisions,
-                },
-            ];
+            return [{ locator: room.locator, roomVersion: record.roomVersion }];
         });
     }
     async function synchronize(listed, local, progress, attempt, live) {
@@ -2528,7 +3872,7 @@ export function composeRuntime(options) {
             progress.complete = false;
             return false;
         }
-        const prior = replicas.get(room.locator)?.confirmed.record;
+        const prior = replicas.get(room.locator)?.record;
         if (prior !== undefined && prior.replica.selection !== room.replica.selection) {
             list(prior, false);
             emitRooms();
@@ -2576,13 +3920,12 @@ export function composeRuntime(options) {
             if (!live() || authorization === undefined)
                 return;
             const bootstrapped = await pullBootstrap(authorization, room, local, live);
-            if (!live())
-                return;
             if (bootstrapped.kind !== 'staged') {
-                await withhold(bootstrapped, room, local, progress);
+                if (live())
+                    await withhold(bootstrapped, room, local, progress);
                 return;
             }
-            await publish(local, room, bootstrapped.confirmed, { stored: bootstrapped.stored }, live);
+            await publish(local, room, bootstrapped.record, { kind: 'bootstrapped', refreshed: bootstrapped.refreshed }, live);
             await caughtUp(room, local, progress, live);
         }
         finally {
@@ -2639,12 +3982,13 @@ export function composeRuntime(options) {
         }
         for (const room of result.rooms) {
             if (room.operations === undefined ||
-                !['read', 'sync', 'write', 'delete'].every((operation) => Array.isArray(room.operations[operation]) &&
+                !['write', 'delete'].every((operation) => Array.isArray(room.operations[operation]) &&
                     room.operations[operation].every((scope) => typeof scope === 'string')) ||
                 room.replica === undefined ||
                 typeof room.replica.selection !== 'string' ||
                 room.replica.selection.length === 0 ||
-                !['admitted', 'unavailable'].includes(room.replica.admission)) {
+                !['admitted', 'unavailable'].includes(room.replica.admission) ||
+                !['locked', 'open'].includes(room.replica.offline)) {
                 journal.record(`invalid model or replica declaration ${room.locator}`);
                 await refuse('missing-required-guarantee');
                 notifyReady();
@@ -2668,11 +4012,12 @@ export function composeRuntime(options) {
         if (JSON.stringify(result.providerLimits) !== JSON.stringify(limits) ||
             JSON.stringify(result.capabilities) !== JSON.stringify(previousCapabilities)) {
             limits = result.providerLimits;
-            await local.declare(limits, capabilities);
+            await local.fact('providerLimits', limits);
+            await local.fact('capabilities', capabilities);
         }
         const signedIn = result.member ?? null;
         if (JSON.stringify(signedIn) !== JSON.stringify(member)) {
-            await local.keepMember(signedIn);
+            await local.fact('member', signedIn);
             member = signedIn;
             emitMember();
         }
@@ -2806,6 +4151,7 @@ export function composeRuntime(options) {
     function closedSocket(revoked, lost) {
         const opened = socketOpen;
         socketOpen = false;
+        connectionLost();
         if (lost) {
             reads.lost();
             conversations.lost();
@@ -2875,7 +4221,7 @@ export function composeRuntime(options) {
         owed.clear();
         for (const locator of reloading)
             catching.add(locator);
-        readSide.recover();
+        liveQueries.recover();
         return reloading;
     }
     async function reloadNow(replaced, progress) {
@@ -3042,7 +4388,7 @@ export function composeRuntime(options) {
         if (synced && !recorded) {
             const completedAt = new Date().toISOString();
             try {
-                await (await openLocal()).complete(completedAt);
+                await (await openLocal()).fact('lastCompleted', completedAt);
                 if (!live())
                     return;
                 recorded = true;
@@ -3082,8 +4428,8 @@ export function composeRuntime(options) {
             if (room === undefined || room.replica.admission !== 'admitted')
                 return;
             if (held !== undefined &&
-                (held.confirmed.record.replica.selection !== room.replica.selection ||
-                    options.adapter.reached(locator, held.confirmed.record.roomVersion, roomVersion))) {
+                (held.record.replica.selection !== room.replica.selection ||
+                    options.adapter.reached(locator, held.record.roomVersion, roomVersion))) {
                 return;
             }
             const during = underway?.generation === generation ? underway.progress : null;
@@ -3130,6 +4476,7 @@ export function composeRuntime(options) {
                 return;
             if (event.kind === 'opened') {
                 socketOpen = true;
+                connectionLive();
                 generation += 1;
                 reads.opened();
                 conversations.reopened();
@@ -3144,7 +4491,14 @@ export function composeRuntime(options) {
                 void rediscover(event.scope);
             else
                 void applyRoom(event.locator, event.roomVersion);
-        }, receipts);
+        }, receipts, heldRevisions);
+    }
+    async function heldRevisions(locator, paths) {
+        const held = replicas.get(locator);
+        if (held === undefined || paths.length === 0)
+            return new Map();
+        const entries = await (await openLocal()).entries(held.record.key, 'confirmed', paths);
+        return new Map(entries.flatMap(({ path, revision }) => revision === null ? [] : [[path, revision]]));
     }
     function writesHeld() {
         return serviceMode === 'write-halted' || haltedRefusal;
@@ -3214,8 +4568,12 @@ export function composeRuntime(options) {
         if (closed)
             return;
         closed = true;
-        if (rechecking !== null)
-            clearInterval(rechecking);
+        if (probing !== null)
+            clearInterval(probing);
+        for (const resolve of shownWaiters.splice(0))
+            resolve();
+        connectionLive();
+        lockListeners.clear();
         readinessWatches.clear();
         withdrawStream?.();
         withdrawStream = undefined;
@@ -3224,17 +4582,13 @@ export function composeRuntime(options) {
         withdrawServiceMode?.();
         conversations.close();
         void recovery.retire();
-        store?.close();
-        void opening?.then((opened) => {
-            opened.close();
-        }, () => { });
         roomListeners.clear();
         refusalListeners.clear();
         storageLossListeners.clear();
         statusListeners.clear();
         serviceModeListeners.clear();
         memberListeners.clear();
-        readSide.close();
+        liveQueries.close();
         queueSubscriptions.clear();
         roomDraftListeners.clear();
         presentationListeners.clear();
@@ -3280,7 +4634,7 @@ export function composeRuntime(options) {
         const watchers = seedWatchers.get(plan.key) ?? new Set();
         seedWatchers.set(plan.key, watchers);
         watchers.add(shown);
-        const stop = readSide.watch(plan, identityOf(plan), () => {
+        const stop = liveQueries.watch(plan, identityOf(plan), () => {
             const cover = covered(plan);
             awaitPreparation(cover);
             return seedBehind(plan, cover);
@@ -3301,66 +4655,53 @@ export function composeRuntime(options) {
             stop();
         };
     }
-    async function searched(input, reach) {
+    async function searched(input, reach, locked) {
         const asked = searchPlanOf(input);
-        const plan = { ...asked, limit: capped(asked.limit) };
-        const filter = filterOf(plan.documents ?? {}, roomFacts(reach), planReach(reach));
+        const filter = {
+            ...filterOf(asked.documents ?? {}, roomFacts(reach), planReach(reach)),
+            locked,
+        };
+        const unlocking = (filter.rooms ?? [])
+            .filter((room) => locked.includes(room))
+            .map((room) => ({ room, awaits: 'unlock' }));
         for (;;) {
             const cover = covered(filter);
             awaitPreparation(cover);
-            const pending = 'pending' in cover ? [...cover.pending] : [];
-            const awaited = new Set('pending' in cover ? cover.pending.map(({ room }) => room) : []);
-            const held = covered({
-                ...filter,
-                rooms: reachedRooms(filter).filter((room) => !awaited.has(room)),
-            });
-            const covering = 'pending' in held ? [] : held.coverage.rooms;
-            const unindexed = covering
-                .filter(({ room }) => !searchIndex.rooms().has(room))
-                .map(({ room }) => room);
-            for (const room of unindexed)
-                pending.push({ room, awaits: 'index' });
-            const listed = conversations.searchable();
-            const named = reach !== null && !reach.conversations
-                ? []
-                : (plan.conversations ?? listed).filter((one) => listed.includes(one) && conversations.acquired(one));
-            const waiting = named.filter((one) => !searchIndex.conversations().has(one));
-            for (const conversation of waiting)
-                pending.push({ conversation, awaits: 'index' });
-            if (unindexed.length > 0 || waiting.length > 0)
-                index(unindexed, waiting);
+            const pending = [...unlocking, ...('pending' in cover ? cover.pending : [])];
             const complete = pending.length === 0 && !('pending' in cover);
+            const awaited = new Set('pending' in cover ? cover.pending.map(({ room }) => room) : []);
             const answering = complete
                 ? filter
-                : {
-                    ...filter,
-                    rooms: covering
-                        .filter(({ room }) => searchIndex.rooms().has(room))
-                        .map(({ room }) => room),
-                };
+                : { ...filter, rooms: reachedRooms(filter).filter((room) => !awaited.has(room)) };
             const answered = covered(answering);
             if ('pending' in answered)
                 continue;
-            const searchedConversations = named.filter((one) => searchIndex.conversations().has(one));
-            await readSide.settled();
-            const seen = searchIndex.changes();
-            await searchIndex.caughtUp();
-            const selected = roomsAlone(answering) ? null : await rowsQuery(answering);
-            if (selected !== null && 'pending' in selected)
-                continue;
-            if (searchIndex.changes() !== seen ||
-                JSON.stringify(covered(answering)) !== JSON.stringify(answered))
+            const listed = conversations.searchable();
+            const named = reach !== null && !reach.conversations
+                ? []
+                : (asked.conversations ?? listed).filter((one) => listed.includes(one) && conversations.acquired(one));
+            const hits = await (await openLocal()).search({
+                text: asked.text,
+                limit: capped(asked.limit),
+                after: asked.after,
+                total: asked.total,
+                documents: {
+                    plan: answering,
+                    rooms: answered.rooms,
+                    beneath: asked.collection
+                        ? answered.rooms.map(({ locator, key }) => ({
+                            key,
+                            roots: replicas.get(locator)?.record.typedSelection?.roots ?? [],
+                        }))
+                        : [],
+                },
+                conversations: named,
+            });
+            if (JSON.stringify(covered(answering)) !== JSON.stringify(answered))
                 continue;
-            const hits = searchIndex.search(plan, selected === null ? null : selected.documents, searchedConversations, answering.rooms === null ? null : new Set(answering.rooms), plan.collection
-                ? new Map(answered.coverage.rooms.map(({ room }) => [
-                    room,
-                    replicas.get(room)?.confirmed.record.typedSelection?.roots ?? [],
-                ]))
-                : null);
             const coverage = {
                 rooms: answered.coverage.rooms,
-                conversations: searchedConversations,
-                index: searchIndex.generation(),
+                conversations: named,
                 overlay: answered.coverage.overlay,
             };
             return complete
@@ -3374,13 +4715,17 @@ export function composeRuntime(options) {
             roomDraftListeners.add(listener);
             void exclusive(async () => {
                 await openLocal();
-                if (closed || !roomDraftListeners.has(listener))
-                    return;
-                listener.ready = true;
             }).then(() => {
-                if (closed || !listener.ready || !roomDraftListeners.has(listener))
+                if (closed || !roomDraftListeners.has(listener))
                     return;
-                listener.notify(snapshotRoomDrafts());
+                const snapshot = snapshotRoomDrafts();
+                draftsShown = draftsShown.then(async () => {
+                    const value = await snapshot.catch(() => null);
+                    if (value === null || closed || !roomDraftListeners.has(listener))
+                        return;
+                    listener.ready = true;
+                    listener.notify(value);
+                });
             }, () => { });
             return () => {
                 roomDraftListeners.delete(listener);
@@ -3413,7 +4758,7 @@ export function composeRuntime(options) {
             };
         }
         if (topic === 'readiness') {
-            return watchReadiness({ target: '', code: 'stored', capacity: null, search: 'unused' }, null, deliver);
+            return watchReadiness({ target: '', code: 'stored', space: null, search: 'unused' }, null, deliver);
         }
         if (topic === 'rooms') {
             roomListeners.add(deliver);
@@ -3475,7 +4820,7 @@ export function composeRuntime(options) {
             return listed();
         },
         query: ((input) => rowsQuery(planned(input, null))),
-        search: (input) => searched(input, null),
+        search: (input) => searched(input, null, []),
         types(locator) {
             return {
                 collection: modelTypes(modelOf(locator)),
@@ -3495,9 +4840,9 @@ export function composeRuntime(options) {
                     return listed;
                 });
             },
-            read(room, path) {
+            async read(room, path) {
                 const record = roomDrafts.get(room)?.get(path);
-                return record === undefined ? null : roomDraftOf(record);
+                return record === undefined ? null : ((await roomDraftsOf([record]))[0] ?? null);
             },
             write(room, path, revision, input) {
                 return exclusive(async () => {
@@ -3507,11 +4852,11 @@ export function composeRuntime(options) {
                     const local = await openLocal();
                     const current = roomDrafts.get(room)?.get(path);
                     if ((current?.revision ?? null) !== revision) {
-                        return staleWrite(current === undefined ? null : roomDraftOf(current));
+                        return staleWrite(current === undefined ? null : ((await roomDraftsOf([current]))[0] ?? null));
                     }
                     const file = parts.file === undefined
                         ? undefined
-                        : await heldFile(parts.file.blob, binaryBase(replicas.get(room)?.visible, path));
+                        : await heldFile(parts.file.blob, binaryBase(await visibleOf(room, [path]), path));
                     const record = {
                         locator: room,
                         path,
@@ -3519,10 +4864,12 @@ export function composeRuntime(options) {
                         parts: held(current?.parts, parts, file),
                         returned: current?.returned ?? null,
                     };
-                    await local.keepRoomDraft(record);
+                    await local.keepRoomDraft(record, parts.file === undefined || file === undefined
+                        ? []
+                        : [{ key: file.localId, blob: parts.file.blob }]);
                     rememberRoomDraft(record);
-                    publishChangeSet(changeSet(room, null, null, { drafts: [path] }));
-                    return { outcome: 'written', roomDraft: roomDraftOf(record) };
+                    publishChangeSet(changeSet(room, { drafts: [path] }));
+                    return { outcome: 'written', roomDraft: (await roomDraftsOf([record]))[0] ?? null };
                 });
             },
             discard(room, path, revision) {
@@ -3530,11 +4877,11 @@ export function composeRuntime(options) {
                     const local = await openLocal();
                     const current = roomDrafts.get(room)?.get(path);
                     if (current === undefined || current.revision !== revision) {
-                        return staleWrite(current === undefined ? null : roomDraftOf(current));
+                        return staleWrite(current === undefined ? null : ((await roomDraftsOf([current]))[0] ?? null));
                     }
                     await local.discardRoomDraft(room, path);
                     forgetRoomDraft(room, path);
-                    publishChangeSet(changeSet(room, null, null, { drafts: [path] }));
+                    publishChangeSet(changeSet(room, { drafts: [path] }));
                     moveTo({ ...status, ...attention() });
                     return { outcome: 'written', roomDraft: null };
                 });
@@ -3568,15 +4915,20 @@ export function composeRuntime(options) {
         history(locator, path, query) {
             return readHistory(locator, path, query);
         },
+        resolve(room, path, destination) {
+            return resolveReference(room, path, destination);
+        },
         binaryFile: {
+            part: readPart,
             read: readBinaryPath,
             link: linkBinaryPath,
-            readReference: readBinaryReference,
         },
-        call(name, input) {
-            return recoveredAction(name, input);
+        async call(name, input) {
+            await ready;
+            const room = calledRooms(name, input).find((one) => locked(one));
+            return room === undefined ? recoveredAction(name, input) : lockedRoom(room);
         },
-        reached(locator, roomVersion, path) {
+        async reached(locator, roomVersion, path) {
             return path === undefined
                 ? reachedBy(locator, roomVersion)
                 : writtenAfter(locator, roomVersion, path);
@@ -3584,14 +4936,16 @@ export function composeRuntime(options) {
         log() {
             return journal.export();
         },
+        cleanUp,
         persistence() {
             return persistence === 'granted';
         },
         async retry() {
             journal.record('retry');
-            unindexable.clear();
+            unpreparable.clear();
             queueReadiness();
-            resume();
+            if (full)
+                await probed();
         },
         observe: observing(watch),
         async reauthorize() {
@@ -3613,12 +4967,15 @@ export function composeRuntime(options) {
     const reachable = {
         md,
         watch,
-        referrerScope: (referrer) => options.adapter.referrerScope(referrer),
         plan: planned,
         query: (plan) => rowsQuery(plan),
         watchPlan,
         search: searched,
         watchReadiness,
+        locked,
+        lockedRooms,
+        watchLocks,
+        located,
     };
     return {
         md,
@@ -3633,6 +4990,11 @@ export function composeRuntime(options) {
             journal.record(`persistence ${answer}`);
             queueReadiness();
         },
-        within: (reach, port) => narrowed(reachable, reach, port),
+        shown: screen,
+        within: (reach, port) => {
+            if (full)
+                void probed();
+            return narrowed(reachable, reach, port);
+        },
     };
 }