@earendil-works/pi-durable 1.4.0 → 1.5.1

package/dist/session/writer.js

@@ -0,0 +1,294 @@
+import { withoutAbortSignal } from "@earendil-works/chord/context";
+import { SessionFailed } from "../errors.js";
+const SESSION_FAILED = { kind: "failed" };
+/**
+ * The writer of one Session. The line admits each commit as a part once its callback and settlement succeeded; the
+ * writer sends every part admitted while no call is in flight as one `commit()` call, off the line, and publishes
+ * the parts of a call one by one, in line order, with a macrotask between two, so the continuations of the waits one
+ * resolves start before the next is published. Held commits are parts without writes, published when the parts before
+ * them are.
+ *
+ * Each part registers the keys it writes; until it is published, it is the newest unpublished writer of each, and a
+ * job that touches one waits for its gate. A key leaves when its newest writer is published, so the map holds one entry
+ * per key with an unpublished writer.
+ */
+export class Writer {
+    #host;
+    /** Admitted parts not yet sent, in line order. */
+    #queue = [];
+    #flight = false;
+    /** Per key, the newest unpublished part that writes it. */
+    #unpublished = new Map();
+    /** The newest admitted part that is not yet published, whose gate opens after every earlier one's. */
+    #newest;
+    constructor(host) {
+        this.#host = host;
+    }
+    /** Admit a part: register its keys, queue it, and send it at once unless a call is in flight. */
+    admit(spec) {
+        const outcome = Promise.withResolvers();
+        outcome.promise.catch(() => { });
+        const part = {
+            ...spec,
+            outcome: outcome.promise,
+            settle: {
+                resolve: () => {
+                    part.done = true;
+                    outcome.resolve();
+                },
+                reject: (error) => {
+                    part.done = true;
+                    outcome.reject(error);
+                },
+            },
+            done: false,
+            gate: Promise.withResolvers(),
+        };
+        for (const key of spec.keys)
+            this.#unpublished.set(key, part);
+        this.#newest = part;
+        this.#queue.push(part);
+        this.#pump();
+        return part;
+    }
+    /** The gate of the newest unpublished writer of `key`, or `undefined` when it has none. */
+    gate(key) {
+        return this.#unpublished.get(key)?.gate.promise;
+    }
+    /** Opens once every part admitted so far is published or never will be. */
+    drained() {
+        return this.#newest?.gate.promise;
+    }
+    /** Keys with an unpublished writer, for tests that bound memory. */
+    get unpublished() {
+        return this.#unpublished.size;
+    }
+    #pump() {
+        if (this.#flight || this.#queue.length === 0)
+            return;
+        this.#flight = true;
+        const parts = this.#queue;
+        this.#queue = [];
+        void this.#flush(parts);
+    }
+    /**
+     * Send and publish `parts`, then what was admitted meanwhile. Never rejects: a throw the writer did not expect fails
+     * the Session and settles the parts (`#abandon()`), so no outcome or gate is stranded.
+     */
+    async #flush(parts) {
+        try {
+            await this.#send(parts);
+        }
+        catch (error) {
+            this.#abandon(parts, error);
+        }
+        this.#flight = false;
+        this.#pump();
+    }
+    /** Store `parts` in one call, then publish them in order; settles every one of them. */
+    async #send(parts) {
+        const stored = parts.filter((part) => part.writes !== undefined);
+        const seqs = [];
+        let result;
+        let rejected;
+        const failed = this.#host.failure();
+        if (failed !== undefined) {
+            for (const part of parts)
+                this.#unpublish(part, new SessionFailed(failed.error));
+            return;
+        }
+        if (stored.length > 0) {
+            try {
+                result = await this.#host.commit(stored.map((part) => part.writes), (index, seq) => {
+                    seqs[index] = seq;
+                }, withoutAbortSignal(stored[0].context));
+            }
+            catch (error) {
+                rejected = { error };
+            }
+        }
+        // A call that settles once another failure failed the Session reports `SessionFailed` with that first error,
+        // whatever it returned (spec §10.1), and publishes nothing.
+        const failedMeanwhile = this.#host.failure();
+        if (failedMeanwhile !== undefined) {
+            for (const part of parts)
+                this.#unpublish(part, new SessionFailed(failedMeanwhile.error));
+            return;
+        }
+        await this.#publish(parts, seqs, result, rejected);
+    }
+    /**
+     * Publish the received parts and held ones in order, a macrotask apart, and settle every part (group commit §3.4). A
+     * refusal, a rejection, or a part whose adoption or own observer throws fails the Session once the parts before it
+     * are published and the host observers got the last one; the parts after it are not published, and reject with
+     * `SessionFailed`. What the failure decides (the outcomes, and the gates of the parts it concerns) is settled only
+     * once the Session failed, so no job waiting at such a gate, and no later outcome, goes on as if it had not.
+     */
+    async #publish(parts, seqs, result, rejected) {
+        let stop;
+        /**
+         * Settled once the Session failed: each part, whether it was published, and its outcome: an error of its own (any
+         * value, `undefined` included), or `SessionFailed`.
+         */
+        const failing = [];
+        let storedIndex = 0;
+        let published = 0;
+        for (const part of parts) {
+            const index = part.writes === undefined ? undefined : storedIndex++;
+            if (stop !== undefined) {
+                // A part after a rejected call's last receipt has the call's error; any other part after a stop was not sent,
+                // nor any part once something else failed the Session.
+                const outcome = rejected !== undefined && index !== undefined && stop.external !== true
+                    ? { kind: "own", error: rejected.error }
+                    : SESSION_FAILED;
+                failing.push({ part, outcome, published: false });
+                continue;
+            }
+            const seq = index === undefined ? undefined : seqs[index];
+            if (index !== undefined && seq === undefined) {
+                const error = rejected !== undefined
+                    ? rejected.error
+                    : index === result?.stored && "refused" in result
+                        ? result.refused
+                        : new Error("Storage committed without adopting the batch");
+                failing.push({ part, outcome: { kind: "own", error }, published: false });
+                stop = { error, at: part.index };
+                continue;
+            }
+            // A macrotask between two parts: what the first resolves runs before the second is published.
+            if (published++ > 0)
+                await hop();
+            let failure;
+            // Failed by something else meanwhile, during the hop or before a storage's scope runs the publication: nothing
+            // more of the call is published. Checked right before it would be, after every wait.
+            let external;
+            const publication = this.#host.publishing(() => {
+                external = this.#host.failure();
+                if (external !== undefined)
+                    return;
+                // Its keys leave first, so what its publication schedules sees it published; its waiters wake after it.
+                this.#unregister(part);
+                // A throw anywhere in it, the read caches included, leaves memory behind what is stored: like an adoption's.
+                try {
+                    if (part.writes !== undefined)
+                        this.#host.stored(part.writes);
+                    failure = part.publish(seq);
+                }
+                catch (error) {
+                    failure = { kind: "adoption", error };
+                }
+            }, part.context);
+            if (publication !== undefined)
+                await publication;
+            if (external !== undefined) {
+                stop = { error: external.error, at: part.index, external: true };
+                failing.push({ part, outcome: SESSION_FAILED, published: false });
+                continue;
+            }
+            if (failure?.kind === "adoption") {
+                failing.push({ part, outcome: { kind: "own", error: failure.error }, published: true });
+                stop = { error: failure.error, at: part.index };
+                continue;
+            }
+            // A part published while its call rejected is durable but rejects (spec §10.1); an own observer's throw is then
+            // reported, as the Session fails with the storage error.
+            if (rejected !== undefined) {
+                if (failure !== undefined)
+                    this.#host.report(failure.error, part.context);
+                failing.push({ part, outcome: { kind: "own", error: rejected.error }, published: true });
+                continue;
+            }
+            // An own observer's throw: the commit stands; the Session fails after it.
+            if (failure !== undefined)
+                stop = { error: failure.error, at: part.index };
+            const failedMeanwhile = this.#host.failure();
+            if (failedMeanwhile !== undefined && failure === undefined) {
+                part.settle.reject(new SessionFailed(failedMeanwhile.error));
+            }
+            else
+                part.settle.resolve();
+            this.#open(part);
+        }
+        if (rejected !== undefined || stop !== undefined) {
+            // After the host dispatch of the last part published, which is one microtask away.
+            await Promise.resolve();
+            // Every part of the call that rejected keeps the storage error; the first of them is the failure's boundary.
+            const own = failing.flatMap(({ part, outcome }) => (outcome.kind === "own" ? [part.index] : []));
+            if (rejected !== undefined)
+                this.#host.fail(rejected.error, own[0], own);
+            else
+                this.#host.fail(stop.error, stop.at, own);
+        }
+        for (const { part, outcome, published: stored } of failing) {
+            const error = outcome.kind === "own" ? outcome.error : this.#failed(stop.error);
+            if (stored) {
+                part.settle.reject(error);
+                this.#open(part);
+            }
+            else
+                this.#unpublish(part, error);
+        }
+        // Admitted while this call ran, after the failure: never sent.
+        const failure = this.#host.failure();
+        if (failure !== undefined) {
+            const queued = this.#queue;
+            this.#queue = [];
+            for (const part of queued)
+                this.#unpublish(part, new SessionFailed(failure.error));
+        }
+    }
+    /**
+     * A throw the writer itself did not expect while sending or publishing `parts` (a bug): fail the Session at the first
+     * of them and settle every one not settled yet, so no outcome, gate, or close waits on it forever.
+     */
+    #abandon(parts, error) {
+        this.#host.fail(error, parts[0].index, []);
+        for (const part of parts) {
+            if (!part.done)
+                this.#unpublish(part, this.#failed(error));
+            this.#unregister(part);
+            this.#open(part);
+        }
+    }
+    /** `SessionFailed` with the Session's failure, or with `error` until the Session records it. */
+    #failed(error) {
+        const failure = this.#host.failure();
+        return new SessionFailed(failure !== undefined ? failure.error : error);
+    }
+    /** Settle a part that will never be published: discard it, reject it with `error`, and open its gate. */
+    #unpublish(part, error) {
+        part.discard();
+        part.settle.reject(error);
+        this.#unregister(part);
+        this.#open(part);
+    }
+    /** Drop the keys a part is still the newest writer of: it is published, or never will be. */
+    #unregister(part) {
+        for (const key of part.keys)
+            if (this.#unpublished.get(key) === part)
+                this.#unpublished.delete(key);
+    }
+    /** Open a part's gate: the jobs waiting for it go on. The newest part's opens `drained()` too. */
+    #open(part) {
+        part.gate.resolve();
+        if (this.#newest === part)
+            this.#newest = undefined;
+    }
+}
+/**
+ * Yield to the event loop once: `setImmediate` where there is one, otherwise a `MessageChannel` message (Workers,
+ * browsers). Microtasks queued before it, such as wait continuations, run first.
+ */
+function hop() {
+    if (typeof setImmediate === "function")
+        return new Promise((resolve) => setImmediate(resolve));
+    const channel = new MessageChannel();
+    return new Promise((resolve) => {
+        channel.port1.onmessage = () => {
+            channel.port1.close();
+            resolve();
+        };
+        channel.port2.postMessage(undefined);
+    });
+}
+//# sourceMappingURL=writer.js.map

package/dist/session/writer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"writer.js","sourceRoot":"","sources":["../../src/session/writer.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAwC7C,MAAM,cAAc,GAAkB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AA2BzD;;;;;;;;;;GAUG;AACH,MAAM,OAAO,MAAM;IACT,KAAK,CAAa;IAC3B,kDAAkD;IAClD,MAAM,GAAe,EAAE,CAAC;IACxB,OAAO,GAAG,KAAK,CAAC;IAChB,2DAA2D;IAClD,YAAY,GAAG,IAAI,GAAG,EAAoB,CAAC;IACpD,sGAAsG;IACtG,OAAO,CAAuB;IAE9B,YAAY,IAAgB;QAC3B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,iGAAiG;IACjG,KAAK,CAAC,IAAc;QACnB,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,EAAQ,CAAC;QAC9C,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAChC,MAAM,IAAI,GAAa;YACtB,GAAG,IAAI;YACP,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM,EAAE;gBACP,OAAO,EAAE,GAAG,EAAE;oBACb,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;oBACjB,OAAO,CAAC,OAAO,EAAE,CAAC;gBACnB,CAAC;gBACD,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;oBACjB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;oBACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACvB,CAAC;aACD;YACD,IAAI,EAAE,KAAK;YACX,IAAI,EAAE,OAAO,CAAC,aAAa,EAAQ;SACnC,CAAC;QACF,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI;YAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC9D,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACb,CAAC;IAED,2FAA2F;IAC3F,IAAI,CAAC,GAAW;QACf,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC;IACjD,CAAC;IAED,2EAA2E;IAC3E,OAAO;QACN,OAAO,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC;IACnC,CAAC;IAED,oEAAoE;IACpE,IAAI,WAAW;QACd,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;IAC/B,CAAC;IAED,KAAK;QACJ,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACrD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QACjB,KAAK,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,KAA0B;QACtC,IAAI,CAAC;YACJ,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACrB,IAAI,CAAC,KAAK,EAAE,CAAC;IACd,CAAC;IAED,wFAAwF;IACxF,KAAK,CAAC,KAAK,CAAC,KAA0B;QACrC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;QACjE,MAAM,IAAI,GAAwB,EAAE,CAAC;QACrC,IAAI,MAAgC,CAAC;QACrC,IAAI,QAAiD,CAAC;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACpC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC1B,KAAK,MAAM,IAAI,IAAI,KAAK;gBAAE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACjF,OAAO;QACR,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC;gBACJ,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAC/B,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAO,CAAC,EAClC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;oBACd,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC;gBACnB,CAAC,EACD,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,CACtC,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,QAAQ,GAAG,EAAE,KAAK,EAAE,CAAC;YACtB,CAAC;QACF,CAAC;QACD,6GAA6G;QAC7G,4DAA4D;QAC5D,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAC7C,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YACnC,KAAK,MAAM,IAAI,IAAI,KAAK;gBAAE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,aAAa,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;YAC1F,OAAO;QACR,CAAC;QACD,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACpD,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,QAAQ,CACb,KAA0B,EAC1B,IAAkC,EAClC,MAAgC,EAChC,QAAiD;QAEjD,IAAI,IAA4F,CAAC;QACjG;;;WAGG;QACH,MAAM,OAAO,GAAgG,EAAE,CAAC;QAChH,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACpE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACxB,8GAA8G;gBAC9G,uDAAuD;gBACvD,MAAM,OAAO,GACZ,QAAQ,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI;oBACtE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE;oBACxC,CAAC,CAAC,cAAc,CAAC;gBACnB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;gBAClD,SAAS;YACV,CAAC;YACD,MAAM,GAAG,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1D,IAAI,KAAK,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBAC9C,MAAM,KAAK,GACV,QAAQ,KAAK,SAAS;oBACrB,CAAC,CAAC,QAAQ,CAAC,KAAK;oBAChB,CAAC,CAAC,KAAK,KAAK,MAAM,EAAE,MAAM,IAAI,SAAS,IAAI,MAAM;wBAChD,CAAC,CAAC,MAAM,CAAC,OAAO;wBAChB,CAAC,CAAC,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;gBAC/D,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC1E,IAAI,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACjC,SAAS;YACV,CAAC;YACD,8FAA8F;YAC9F,IAAI,SAAS,EAAE,GAAG,CAAC;gBAAE,MAAM,GAAG,EAAE,CAAC;YACjC,IAAI,OAAmC,CAAC;YACxC,+GAA+G;YAC/G,qFAAqF;YACrF,IAAI,QAAiD,CAAC;YACtD,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE;gBAC9C,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;gBAChC,IAAI,QAAQ,KAAK,SAAS;oBAAE,OAAO;gBACnC,wGAAwG;gBACxG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;gBACvB,6GAA6G;gBAC7G,IAAI,CAAC;oBACJ,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;wBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBAC9D,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAC7B,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,OAAO,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;gBACvC,CAAC;YACF,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YACjB,IAAI,WAAW,KAAK,SAAS;gBAAE,MAAM,WAAW,CAAC;YACjD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC5B,IAAI,GAAG,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;gBACjE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;gBAClE,SAAS;YACV,CAAC;YACD,IAAI,OAAO,EAAE,IAAI,KAAK,UAAU,EAAE,CAAC;gBAClC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxF,IAAI,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;gBAChD,SAAS;YACV,CAAC;YACD,gHAAgH;YAChH,yDAAyD;YACzD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC5B,IAAI,OAAO,KAAK,SAAS;oBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC1E,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACzF,SAAS;YACV,CAAC;YACD,0EAA0E;YAC1E,IAAI,OAAO,KAAK,SAAS;gBAAE,IAAI,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;YAC3E,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YAC7C,IAAI,eAAe,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC5D,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;YAC9D,CAAC;;gBAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAClD,mFAAmF;YACnF,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;YACxB,6GAA6G;YAC7G,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACjG,IAAI,QAAQ,KAAK,SAAS;gBAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAE,EAAE,GAAG,CAAC,CAAC;;gBACrE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAK,CAAC,KAAK,EAAE,IAAK,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAClD,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;YAC5D,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAK,CAAC,KAAK,CAAC,CAAC;YACjF,IAAI,MAAM,EAAE,CAAC;gBACZ,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC1B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC;;gBAAM,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACrC,CAAC;QACD,+DAA+D;QAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACrC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YAC3B,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;YACjB,KAAK,MAAM,IAAI,IAAI,MAAM;gBAAE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QACpF,CAAC;IACF,CAAC;IAED;;;OAGG;IACH,QAAQ,CAAC,KAA0B,EAAE,KAAc;QAClD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAC1B,IAAI,CAAC,IAAI,CAAC,IAAI;gBAAE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;YAC3D,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YACvB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;IACF,CAAC;IAED,gGAAgG;IAChG,OAAO,CAAC,KAAc;QACrB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACrC,OAAO,IAAI,aAAa,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACzE,CAAC;IAED,yGAAyG;IACzG,UAAU,CAAC,IAAc,EAAE,KAAc;QACxC,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACvB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IAED,6FAA6F;IAC7F,WAAW,CAAC,IAAc;QACzB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI;YAAE,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI;gBAAE,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACrG,CAAC;IAED,kGAAkG;IAClG,KAAK,CAAC,IAAc;QACnB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACpB,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI;YAAE,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;IACrD,CAAC;CACD;AAED;;;GAGG;AACH,SAAS,GAAG;IACX,IAAI,OAAO,YAAY,KAAK,UAAU;QAAE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/F,MAAM,OAAO,GAAG,IAAI,cAAc,EAAE,CAAC;IACrC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9B,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,GAAG,EAAE;YAC9B,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACtB,OAAO,EAAE,CAAC;QACX,CAAC,CAAC;QACF,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;AACJ,CAAC","sourcesContent":["// The Session's writer: commits the mutation line admitted, stored in batches off the line and published in line order.\nimport type { Context } from \"@earendil-works/chord/context\";\nimport { withoutAbortSignal } from \"@earendil-works/chord/context\";\nimport { SessionFailed } from \"../errors.ts\";\nimport type { CommitResult, Seq, StorageWrite } from \"../types.ts\";\n\n/** A part's own failure at publication: memory could not adopt it, or one of the Session's own observers threw. */\nexport type PublishFailure = { readonly kind: \"adoption\" | \"listener\"; readonly error: unknown };\n\n/** One logical commit the line admitted: stored (`writes`, never empty), or held in memory only (no `writes`). */\nexport type PartSpec = {\n\t/** Line index of the job that admitted it: a failure it causes makes only later jobs' outcomes `SessionFailed`. */\n\treadonly index: number;\n\treadonly writes: readonly StorageWrite[] | undefined;\n\t/** Keys it writes: a read of one waits for its publication. */\n\treadonly keys: readonly string[];\n\treadonly context: Context;\n\t/** Publish it in memory, in line order, once it is durable (with its seq) or, held, once the parts before it are. */\n\treadonly publish: (seq: Seq | undefined) => PublishFailure | undefined;\n\t/** It will never be published: abort what it prepared. */\n\treadonly discard: () => void;\n};\n\n/** An admitted part and its outcome. */\nexport type Part = PartSpec & {\n\t/**\n\t * Resolves once it is published; rejects once it never will be, and also after publication when its storage call\n\t * rejected or the Session failed meanwhile. Always handled, so a part nobody awaits rejects silently.\n\t */\n\treadonly outcome: Promise<void>;\n};\n\ntype Admitted = Part & {\n\treadonly settle: { resolve(): void; reject(error: unknown): void };\n\t/** Set once its outcome is settled. */\n\tdone: boolean;\n\t/** Opens once it is published or never will be; never rejects. */\n\treadonly gate: PromiseWithResolvers<void>;\n};\n\n/** How a part that will not resolve settles: with an error of its own, which may be any value, or `SessionFailed`. */\ntype FailedOutcome = { readonly kind: \"own\"; readonly error: unknown } | { readonly kind: \"failed\" };\n\nconst SESSION_FAILED: FailedOutcome = { kind: \"failed\" };\n\n/** What the writer needs of its Session. */\nexport type WriterHost = {\n\tcommit(\n\t\tbatches: readonly (readonly StorageWrite[])[],\n\t\treceive: (index: number, seq: Seq) => void,\n\t\tcontext: Context,\n\t): Promise<CommitResult>;\n\t/** Apply a stored batch to the Session's read caches, right before it is published. */\n\tstored(writes: readonly StorageWrite[]): void;\n\t/**\n\t * Run one part's publication inside the Storage's own scope (`Storage.publishing`); `undefined` when it ran at once,\n\t * else settles once it ran.\n\t */\n\tpublishing(publish: () => void, context: Context): Promise<void> | undefined;\n\t/** The Session's failure, if it failed. */\n\tfailure(): { readonly error: unknown } | undefined;\n\t/**\n\t * Fail the Session; `at` is the line index of the first job whose outcome the failure is, and `own` the jobs after it\n\t * whose outcome is still their own error (the other parts of a call that rejected), not `SessionFailed`.\n\t */\n\tfail(error: unknown, at: number, own: readonly number[]): void;\n\t/** Report an own observer's throw that cannot fail the Session, as it fails with a storage error. */\n\treport(error: unknown, context: Context): void;\n};\n\n/**\n * The writer of one Session. The line admits each commit as a part once its callback and settlement succeeded; the\n * writer sends every part admitted while no call is in flight as one `commit()` call, off the line, and publishes\n * the parts of a call one by one, in line order, with a macrotask between two, so the continuations of the waits one\n * resolves start before the next is published. Held commits are parts without writes, published when the parts before\n * them are.\n *\n * Each part registers the keys it writes; until it is published, it is the newest unpublished writer of each, and a\n * job that touches one waits for its gate. A key leaves when its newest writer is published, so the map holds one entry\n * per key with an unpublished writer.\n */\nexport class Writer {\n\treadonly #host: WriterHost;\n\t/** Admitted parts not yet sent, in line order. */\n\t#queue: Admitted[] = [];\n\t#flight = false;\n\t/** Per key, the newest unpublished part that writes it. */\n\treadonly #unpublished = new Map<string, Admitted>();\n\t/** The newest admitted part that is not yet published, whose gate opens after every earlier one's. */\n\t#newest: Admitted | undefined;\n\n\tconstructor(host: WriterHost) {\n\t\tthis.#host = host;\n\t}\n\n\t/** Admit a part: register its keys, queue it, and send it at once unless a call is in flight. */\n\tadmit(spec: PartSpec): Part {\n\t\tconst outcome = Promise.withResolvers<void>();\n\t\toutcome.promise.catch(() => {});\n\t\tconst part: Admitted = {\n\t\t\t...spec,\n\t\t\toutcome: outcome.promise,\n\t\t\tsettle: {\n\t\t\t\tresolve: () => {\n\t\t\t\t\tpart.done = true;\n\t\t\t\t\toutcome.resolve();\n\t\t\t\t},\n\t\t\t\treject: (error) => {\n\t\t\t\t\tpart.done = true;\n\t\t\t\t\toutcome.reject(error);\n\t\t\t\t},\n\t\t\t},\n\t\t\tdone: false,\n\t\t\tgate: Promise.withResolvers<void>(),\n\t\t};\n\t\tfor (const key of spec.keys) this.#unpublished.set(key, part);\n\t\tthis.#newest = part;\n\t\tthis.#queue.push(part);\n\t\tthis.#pump();\n\t\treturn part;\n\t}\n\n\t/** The gate of the newest unpublished writer of `key`, or `undefined` when it has none. */\n\tgate(key: string): Promise<void> | undefined {\n\t\treturn this.#unpublished.get(key)?.gate.promise;\n\t}\n\n\t/** Opens once every part admitted so far is published or never will be. */\n\tdrained(): Promise<void> | undefined {\n\t\treturn this.#newest?.gate.promise;\n\t}\n\n\t/** Keys with an unpublished writer, for tests that bound memory. */\n\tget unpublished(): number {\n\t\treturn this.#unpublished.size;\n\t}\n\n\t#pump(): void {\n\t\tif (this.#flight || this.#queue.length === 0) return;\n\t\tthis.#flight = true;\n\t\tconst parts = this.#queue;\n\t\tthis.#queue = [];\n\t\tvoid this.#flush(parts);\n\t}\n\n\t/**\n\t * Send and publish `parts`, then what was admitted meanwhile. Never rejects: a throw the writer did not expect fails\n\t * the Session and settles the parts (`#abandon()`), so no outcome or gate is stranded.\n\t */\n\tasync #flush(parts: readonly Admitted[]): Promise<void> {\n\t\ttry {\n\t\t\tawait this.#send(parts);\n\t\t} catch (error) {\n\t\t\tthis.#abandon(parts, error);\n\t\t}\n\t\tthis.#flight = false;\n\t\tthis.#pump();\n\t}\n\n\t/** Store `parts` in one call, then publish them in order; settles every one of them. */\n\tasync #send(parts: readonly Admitted[]): Promise<void> {\n\t\tconst stored = parts.filter((part) => part.writes !== undefined);\n\t\tconst seqs: (Seq | undefined)[] = [];\n\t\tlet result: CommitResult | undefined;\n\t\tlet rejected: { readonly error: unknown } | undefined;\n\t\tconst failed = this.#host.failure();\n\t\tif (failed !== undefined) {\n\t\t\tfor (const part of parts) this.#unpublish(part, new SessionFailed(failed.error));\n\t\t\treturn;\n\t\t}\n\t\tif (stored.length > 0) {\n\t\t\ttry {\n\t\t\t\tresult = await this.#host.commit(\n\t\t\t\t\tstored.map((part) => part.writes!),\n\t\t\t\t\t(index, seq) => {\n\t\t\t\t\t\tseqs[index] = seq;\n\t\t\t\t\t},\n\t\t\t\t\twithoutAbortSignal(stored[0]!.context),\n\t\t\t\t);\n\t\t\t} catch (error) {\n\t\t\t\trejected = { error };\n\t\t\t}\n\t\t}\n\t\t// A call that settles once another failure failed the Session reports `SessionFailed` with that first error,\n\t\t// whatever it returned (spec §10.1), and publishes nothing.\n\t\tconst failedMeanwhile = this.#host.failure();\n\t\tif (failedMeanwhile !== undefined) {\n\t\t\tfor (const part of parts) this.#unpublish(part, new SessionFailed(failedMeanwhile.error));\n\t\t\treturn;\n\t\t}\n\t\tawait this.#publish(parts, seqs, result, rejected);\n\t}\n\n\t/**\n\t * Publish the received parts and held ones in order, a macrotask apart, and settle every part (group commit §3.4). A\n\t * refusal, a rejection, or a part whose adoption or own observer throws fails the Session once the parts before it\n\t * are published and the host observers got the last one; the parts after it are not published, and reject with\n\t * `SessionFailed`. What the failure decides (the outcomes, and the gates of the parts it concerns) is settled only\n\t * once the Session failed, so no job waiting at such a gate, and no later outcome, goes on as if it had not.\n\t */\n\tasync #publish(\n\t\tparts: readonly Admitted[],\n\t\tseqs: readonly (Seq | undefined)[],\n\t\tresult: CommitResult | undefined,\n\t\trejected: { readonly error: unknown } | undefined,\n\t): Promise<void> {\n\t\tlet stop: { readonly error: unknown; readonly at: number; readonly external?: true } | undefined;\n\t\t/**\n\t\t * Settled once the Session failed: each part, whether it was published, and its outcome: an error of its own (any\n\t\t * value, `undefined` included), or `SessionFailed`.\n\t\t */\n\t\tconst failing: { readonly part: Admitted; readonly outcome: FailedOutcome; readonly published: boolean }[] = [];\n\t\tlet storedIndex = 0;\n\t\tlet published = 0;\n\t\tfor (const part of parts) {\n\t\t\tconst index = part.writes === undefined ? undefined : storedIndex++;\n\t\t\tif (stop !== undefined) {\n\t\t\t\t// A part after a rejected call's last receipt has the call's error; any other part after a stop was not sent,\n\t\t\t\t// nor any part once something else failed the Session.\n\t\t\t\tconst outcome: FailedOutcome =\n\t\t\t\t\trejected !== undefined && index !== undefined && stop.external !== true\n\t\t\t\t\t\t? { kind: \"own\", error: rejected.error }\n\t\t\t\t\t\t: SESSION_FAILED;\n\t\t\t\tfailing.push({ part, outcome, published: false });\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tconst seq = index === undefined ? undefined : seqs[index];\n\t\t\tif (index !== undefined && seq === undefined) {\n\t\t\t\tconst error =\n\t\t\t\t\trejected !== undefined\n\t\t\t\t\t\t? rejected.error\n\t\t\t\t\t\t: index === result?.stored && \"refused\" in result\n\t\t\t\t\t\t\t? result.refused\n\t\t\t\t\t\t\t: new Error(\"Storage committed without adopting the batch\");\n\t\t\t\tfailing.push({ part, outcome: { kind: \"own\", error }, published: false });\n\t\t\t\tstop = { error, at: part.index };\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\t// A macrotask between two parts: what the first resolves runs before the second is published.\n\t\t\tif (published++ > 0) await hop();\n\t\t\tlet failure: PublishFailure | undefined;\n\t\t\t// Failed by something else meanwhile, during the hop or before a storage's scope runs the publication: nothing\n\t\t\t// more of the call is published. Checked right before it would be, after every wait.\n\t\t\tlet external: { readonly error: unknown } | undefined;\n\t\t\tconst publication = this.#host.publishing(() => {\n\t\t\t\texternal = this.#host.failure();\n\t\t\t\tif (external !== undefined) return;\n\t\t\t\t// Its keys leave first, so what its publication schedules sees it published; its waiters wake after it.\n\t\t\t\tthis.#unregister(part);\n\t\t\t\t// A throw anywhere in it, the read caches included, leaves memory behind what is stored: like an adoption's.\n\t\t\t\ttry {\n\t\t\t\t\tif (part.writes !== undefined) this.#host.stored(part.writes);\n\t\t\t\t\tfailure = part.publish(seq);\n\t\t\t\t} catch (error) {\n\t\t\t\t\tfailure = { kind: \"adoption\", error };\n\t\t\t\t}\n\t\t\t}, part.context);\n\t\t\tif (publication !== undefined) await publication;\n\t\t\tif (external !== undefined) {\n\t\t\t\tstop = { error: external.error, at: part.index, external: true };\n\t\t\t\tfailing.push({ part, outcome: SESSION_FAILED, published: false });\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (failure?.kind === \"adoption\") {\n\t\t\t\tfailing.push({ part, outcome: { kind: \"own\", error: failure.error }, published: true });\n\t\t\t\tstop = { error: failure.error, at: part.index };\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\t// A part published while its call rejected is durable but rejects (spec §10.1); an own observer's throw is then\n\t\t\t// reported, as the Session fails with the storage error.\n\t\t\tif (rejected !== undefined) {\n\t\t\t\tif (failure !== undefined) this.#host.report(failure.error, part.context);\n\t\t\t\tfailing.push({ part, outcome: { kind: \"own\", error: rejected.error }, published: true });\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\t// An own observer's throw: the commit stands; the Session fails after it.\n\t\t\tif (failure !== undefined) stop = { error: failure.error, at: part.index };\n\t\t\tconst failedMeanwhile = this.#host.failure();\n\t\t\tif (failedMeanwhile !== undefined && failure === undefined) {\n\t\t\t\tpart.settle.reject(new SessionFailed(failedMeanwhile.error));\n\t\t\t} else part.settle.resolve();\n\t\t\tthis.#open(part);\n\t\t}\n\t\tif (rejected !== undefined || stop !== undefined) {\n\t\t\t// After the host dispatch of the last part published, which is one microtask away.\n\t\t\tawait Promise.resolve();\n\t\t\t// Every part of the call that rejected keeps the storage error; the first of them is the failure's boundary.\n\t\t\tconst own = failing.flatMap(({ part, outcome }) => (outcome.kind === \"own\" ? [part.index] : []));\n\t\t\tif (rejected !== undefined) this.#host.fail(rejected.error, own[0]!, own);\n\t\t\telse this.#host.fail(stop!.error, stop!.at, own);\n\t\t}\n\t\tfor (const { part, outcome, published: stored } of failing) {\n\t\t\tconst error = outcome.kind === \"own\" ? outcome.error : this.#failed(stop!.error);\n\t\t\tif (stored) {\n\t\t\t\tpart.settle.reject(error);\n\t\t\t\tthis.#open(part);\n\t\t\t} else this.#unpublish(part, error);\n\t\t}\n\t\t// Admitted while this call ran, after the failure: never sent.\n\t\tconst failure = this.#host.failure();\n\t\tif (failure !== undefined) {\n\t\t\tconst queued = this.#queue;\n\t\t\tthis.#queue = [];\n\t\t\tfor (const part of queued) this.#unpublish(part, new SessionFailed(failure.error));\n\t\t}\n\t}\n\n\t/**\n\t * A throw the writer itself did not expect while sending or publishing `parts` (a bug): fail the Session at the first\n\t * of them and settle every one not settled yet, so no outcome, gate, or close waits on it forever.\n\t */\n\t#abandon(parts: readonly Admitted[], error: unknown): void {\n\t\tthis.#host.fail(error, parts[0]!.index, []);\n\t\tfor (const part of parts) {\n\t\t\tif (!part.done) this.#unpublish(part, this.#failed(error));\n\t\t\tthis.#unregister(part);\n\t\t\tthis.#open(part);\n\t\t}\n\t}\n\n\t/** `SessionFailed` with the Session's failure, or with `error` until the Session records it. */\n\t#failed(error: unknown): SessionFailed {\n\t\tconst failure = this.#host.failure();\n\t\treturn new SessionFailed(failure !== undefined ? failure.error : error);\n\t}\n\n\t/** Settle a part that will never be published: discard it, reject it with `error`, and open its gate. */\n\t#unpublish(part: Admitted, error: unknown): void {\n\t\tpart.discard();\n\t\tpart.settle.reject(error);\n\t\tthis.#unregister(part);\n\t\tthis.#open(part);\n\t}\n\n\t/** Drop the keys a part is still the newest writer of: it is published, or never will be. */\n\t#unregister(part: Admitted): void {\n\t\tfor (const key of part.keys) if (this.#unpublished.get(key) === part) this.#unpublished.delete(key);\n\t}\n\n\t/** Open a part's gate: the jobs waiting for it go on. The newest part's opens `drained()` too. */\n\t#open(part: Admitted): void {\n\t\tpart.gate.resolve();\n\t\tif (this.#newest === part) this.#newest = undefined;\n\t}\n}\n\n/**\n * Yield to the event loop once: `setImmediate` where there is one, otherwise a `MessageChannel` message (Workers,\n * browsers). Microtasks queued before it, such as wait continuations, run first.\n */\nfunction hop(): Promise<void> {\n\tif (typeof setImmediate === \"function\") return new Promise((resolve) => setImmediate(resolve));\n\tconst channel = new MessageChannel();\n\treturn new Promise((resolve) => {\n\t\tchannel.port1.onmessage = () => {\n\t\t\tchannel.port1.close();\n\t\t\tresolve();\n\t\t};\n\t\tchannel.port2.postMessage(undefined);\n\t});\n}\n"]}

package/dist/storage/indexeddb.d.ts

@@ -1,5 +1,6 @@
-import type { Context, JsonValue } from "@earendil-works/chord";
-import type { ConversationId, ConversationQuery, ConversationRecord, Cursor, DocumentAddress, DocumentId, DocumentPoint, DocumentQuery, DocumentRecord, EntryId, EntryQuery, EntryRecord, Id, Page, Seq, Storage, StorageWrite, StoredDocument, SubmissionId, SubmissionQuery, SubmissionRecord, TaskId, TaskQuery, TaskRecord } from "../types.ts";
+import type { Context } from "@earendil-works/chord/context";
+import type { JsonValue } from "@earendil-works/chord/json";
+import type { CommitResult, ConversationId, ConversationQuery, ConversationRecord, Cursor, DocumentAddress, DocumentId, DocumentPoint, DocumentQuery, DocumentRecord, EntryId, EntryQuery, EntryRecord, Id, Page, Seq, Storage, StorageWrite, StoredDocument, SubmissionId, SubmissionQuery, SubmissionRecord, TaskId, TaskQuery, TaskRecord } from "../types.ts";
 type StoredTask = TaskRecord<JsonValue, JsonValue, JsonValue>;
 type IndexedDbStorageOptions = {
     readonly indexedDB?: IDBFactory;
@@ -16,7 +17,13 @@ export declare class IndexedDbStorage implements Storage {
     static open(name: string, options?: IndexedDbStorageOptions): Promise<IndexedDbStorage>;
     /** Delete a closed database. Open connections in this or another owner can block deletion. */
     static delete(name: string, options?: IndexedDbStorageOptions): Promise<void>;
-    commit(writes: readonly StorageWrite[], _context: Context): Promise<Seq>;
+    /**
+     * Commit `batches` in one IndexedDB transaction, each with its own seq. Each batch does every read and check, copy
+     * resolution included, against the state the earlier ones left before it issues its first write; the first one
+     * refused ends the call, and the transaction commits the ones before it. An error of IndexedDB itself aborts the
+     * transaction: the call rejects with nothing stored.
+     */
+    commit(batches: readonly (readonly StorageWrite[])[], receive: (index: number, seq: Seq) => void, _context: Context): Promise<CommitResult>;
     mintId<I extends Id<string>>(): Promise<I>;
     conversation(id: ConversationId, _context: Context): Promise<ConversationRecord | undefined>;
     scanConversations(query: ConversationQuery, limit: number, cursor: Cursor | undefined, _context: Context): Promise<Page<ConversationRecord, Cursor>>;
@@ -53,6 +60,8 @@ export declare class IndexedDbStorage implements Storage {
     private currentDocumentId;
     private claimId;
     private applyTableWrite;
+    /** Resolve each copy to a base of its source's state before this batch, which may not change the source. */
+    private resolveCopies;
     private applyDocumentActions;
     private assertOpen;
 }

package/dist/storage/indexeddb.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"indexeddb.d.ts","sourceRoot":"","sources":["../../src/storage/indexeddb.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAIhE,OAAO,KAAK,EACX,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,MAAM,EACN,eAAe,EAGf,UAAU,EACV,aAAa,EACb,aAAa,EACb,cAAc,EACd,OAAO,EACP,UAAU,EACV,WAAW,EACX,EAAE,EAEF,IAAI,EAEJ,GAAG,EACH,OAAO,EACP,YAAY,EACZ,cAAc,EACd,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,MAAM,EACN,SAAS,EACT,UAAU,EACV,MAAM,aAAa,CAAC;AAuCrB,KAAK,UAAU,GAAG,UAAU,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;AA8D9D,KAAK,uBAAuB,GAAG;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC;CAChC,CAAC;AA8OF,0HAA0H;AAC1H,qBAAa,gBAAiB,YAAW,OAAO;IAC/C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAc;IACvC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,OAAO,CAA4B;IAC3C,OAAO,CAAC,gBAAgB,CAAK;IAC7B,OAAO,CAAC,iBAAiB,CAA2B;IAEpD,OAAO,eAEN;IAED,wDAAwD;IACxD,OAAa,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,uBAA4B,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAqBhG;IAED,8FAA8F;IAC9F,OAAa,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,uBAA4B,GAAG,OAAO,CAAC,IAAI,CAAC,CAItF;IAEK,MAAM,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,EAAE,QAAQ,EAAE,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAoB7E;IAEK,MAAM,CAAC,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAU/C;IAED,YAAY,CAAC,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAW3F;IAEK,iBAAiB,CACtB,KAAK,EAAE,iBAAiB,EACxB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,QAAQ,EAAE,OAAO,GACf,OAAO,CAAC,IAAI,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,CAsC3C;IAED,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAA;KAAE,GAAG,SAAS,CAAC,CAAC;IACpH,KAAK,CACJ,cAAc,EAAE,cAAc,EAC9B,EAAE,EAAE,OAAO,EACX,OAAO,EAAE,OAAO,GACd,OAAO,CAAC;QAAE,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAA;KAAE,GAAG,SAAS,CAAC,CAAC;IAqCjF,oBAAoB,CACnB,cAAc,EAAE,cAAc,EAC9B,iBAAiB,EAAE,OAAO,GAAG,SAAS,EACtC,QAAQ,EAAE,OAAO,GACf,OAAO,CAAC,CAAC,WAAW,GAAG;QAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,GAAG,SAAS,CAAC,CAcjE;IAEK,WAAW,CAChB,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,QAAQ,EAAE,OAAO,GACf,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CASpC;IAED,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAQnE;IAEK,SAAS,CACd,KAAK,EAAE,SAAS,EAChB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,QAAQ,EAAE,OAAO,GACf,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CA4CnC;IAED,UAAU,CAAC,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAWrF;IAEK,eAAe,CACpB,KAAK,EAAE,eAAe,EACtB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,QAAQ,EAAE,OAAO,GACf,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAuCzC;IAED,mBAAmB,CAClB,cAAc,EAAE,cAAc,EAC9B,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,OAAO,GACf,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAUvC;IAED,YAAY,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAUhH;IAED,QAAQ,CAAC,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAIlG;IAEK,aAAa,CAClB,KAAK,EAAE,aAAa,EACpB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,QAAQ,EAAE,OAAO,GACf,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAuBvC;IAED,KAAK,CAAC,QAAQ,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAMtC;YAEa,aAAa;YASb,WAAW;YAgCX,gBAAgB;YAWhB,qBAAqB;YA+BrB,oBAAoB;YAmCpB,mBAAmB;YAwCnB,cAAc;IAsB5B,OAAO,CAAC,sBAAsB;YA+ChB,oBAAoB;YAmCpB,iBAAiB;YAajB,OAAO;YAIP,eAAe;YA+Df,oBAAoB;IA+ElC,OAAO,CAAC,UAAU;CAGlB;AAED,YAAY,EAAE,uBAAuB,EAAE,CAAC"}
+{"version":3,"file":"indexeddb.d.ts","sourceRoot":"","sources":["../../src/storage/indexeddb.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,+BAA+B,CAAC;AAE7D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAG5D,OAAO,KAAK,EACX,YAAY,EACZ,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,MAAM,EACN,eAAe,EAGf,UAAU,EACV,aAAa,EACb,aAAa,EACb,cAAc,EACd,OAAO,EACP,UAAU,EACV,WAAW,EACX,EAAE,EAEF,IAAI,EAEJ,GAAG,EACH,OAAO,EACP,YAAY,EACZ,cAAc,EACd,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,MAAM,EACN,SAAS,EACT,UAAU,EACV,MAAM,aAAa,CAAC;AAuCrB,KAAK,UAAU,GAAG,UAAU,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;AA8D9D,KAAK,uBAAuB,GAAG;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC;CAChC,CAAC;AA2QF,0HAA0H;AAC1H,qBAAa,gBAAiB,YAAW,OAAO;IAC/C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAc;IACvC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,OAAO,CAA4B;IAC3C,OAAO,CAAC,gBAAgB,CAAK;IAC7B,OAAO,CAAC,iBAAiB,CAA2B;IAEpD,OAAO,eAEN;IAED,wDAAwD;IACxD,OAAa,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,uBAA4B,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAqBhG;IAED,8FAA8F;IAC9F,OAAa,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,uBAA4B,GAAG,OAAO,CAAC,IAAI,CAAC,CAItF;IAED;;;;;OAKG;IACG,MAAM,CACX,OAAO,EAAE,SAAS,CAAC,SAAS,YAAY,EAAE,CAAC,EAAE,EAC7C,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,IAAI,EAC1C,QAAQ,EAAE,OAAO,GACf,OAAO,CAAC,YAAY,CAAC,CAsCvB;IAEK,MAAM,CAAC,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAU/C;IAED,YAAY,CAAC,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAW3F;IAEK,iBAAiB,CACtB,KAAK,EAAE,iBAAiB,EACxB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,QAAQ,EAAE,OAAO,GACf,OAAO,CAAC,IAAI,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,CAsC3C;IAED,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAA;KAAE,GAAG,SAAS,CAAC,CAAC;IACpH,KAAK,CACJ,cAAc,EAAE,cAAc,EAC9B,EAAE,EAAE,OAAO,EACX,OAAO,EAAE,OAAO,GACd,OAAO,CAAC;QAAE,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAA;KAAE,GAAG,SAAS,CAAC,CAAC;IAqCjF,oBAAoB,CACnB,cAAc,EAAE,cAAc,EAC9B,iBAAiB,EAAE,OAAO,GAAG,SAAS,EACtC,QAAQ,EAAE,OAAO,GACf,OAAO,CAAC,CAAC,WAAW,GAAG;QAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,GAAG,SAAS,CAAC,CAcjE;IAEK,WAAW,CAChB,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,QAAQ,EAAE,OAAO,GACf,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CASpC;IAED,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAQnE;IAEK,SAAS,CACd,KAAK,EAAE,SAAS,EAChB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,QAAQ,EAAE,OAAO,GACf,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CA4CnC;IAED,UAAU,CAAC,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAWrF;IAEK,eAAe,CACpB,KAAK,EAAE,eAAe,EACtB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,QAAQ,EAAE,OAAO,GACf,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAuCzC;IAED,mBAAmB,CAClB,cAAc,EAAE,cAAc,EAC9B,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,OAAO,GACf,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAUvC;IAED,YAAY,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAUhH;IAED,QAAQ,CAAC,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAIlG;IAEK,aAAa,CAClB,KAAK,EAAE,aAAa,EACpB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,QAAQ,EAAE,OAAO,GACf,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAuBvC;IAED,KAAK,CAAC,QAAQ,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAMtC;YAEa,aAAa;YASb,WAAW;YAgCX,gBAAgB;YAWhB,qBAAqB;YA+BrB,oBAAoB;YAmCpB,mBAAmB;YAwCnB,cAAc;IAsB5B,OAAO,CAAC,sBAAsB;YA+ChB,oBAAoB;YAmCpB,iBAAiB;YAajB,OAAO;YAIP,eAAe;IA+D7B,4GAA4G;YAC9F,aAAa;YAwBb,oBAAoB;IA4DlC,OAAO,CAAC,UAAU;CAGlB;AAED,YAAY,EAAE,uBAAuB,EAAE,CAAC"}

package/dist/storage/indexeddb.js

@@ -35,16 +35,33 @@ const INDEXES = {
     documentsByScopeKind: "documents_by_scope_kind",
     documentRevisionsByKind: "document_revisions_by_kind",
 };
+/** A failure IndexedDB reported without an error of its own: the database's, like every `DOMException` it throws. */
+class IndexedDbFailure extends Error {
+}
+/**
+ * Whether `error`, or an error it was caused by (a copy's rejection wraps its cause), is IndexedDB's own: a
+ * `DOMException`, or a failure it reported without one. Any other error of a batch's checks is one of Durable's.
+ */
+function fromIndexedDb(error) {
+    const seen = new Set();
+    for (let at = error; at !== null && typeof at === "object" && !seen.has(at);) {
+        if (at instanceof DOMException || at instanceof IndexedDbFailure)
+            return true;
+        seen.add(at);
+        at = at.cause;
+    }
+    return false;
+}
 const requestResult = (request) => new Promise((resolve, reject) => {
     request.addEventListener("success", () => resolve(request.result), { once: true });
-    request.addEventListener("error", () => reject(request.error ?? new Error("IndexedDB request failed")), {
+    request.addEventListener("error", () => reject(request.error ?? new IndexedDbFailure("IndexedDB request failed")), {
         once: true,
     });
 });
 const transactionResult = (transaction) => new Promise((resolve, reject) => {
     transaction.addEventListener("complete", () => resolve(), { once: true });
-    transaction.addEventListener("abort", () => reject(transaction.error ?? new Error("IndexedDB transaction was aborted")), { once: true });
-    transaction.addEventListener("error", () => reject(transaction.error ?? new Error("IndexedDB transaction failed")), { once: true });
+    transaction.addEventListener("abort", () => reject(transaction.error ?? new IndexedDbFailure("IndexedDB transaction was aborted")), { once: true });
+    transaction.addEventListener("error", () => reject(transaction.error ?? new IndexedDbFailure("IndexedDB transaction failed")), { once: true });
 });
 const keyRanges = () => {
     if (typeof IDBKeyRange === "undefined")
@@ -54,7 +71,7 @@ const keyRanges = () => {
 const cursorValues = (source, range, direction, limit, accept = () => true) => new Promise((resolve, reject) => {
     const values = [];
     const request = source.openCursor(range, direction);
-    request.addEventListener("error", () => reject(request.error ?? new Error("IndexedDB cursor failed")), {
+    request.addEventListener("error", () => reject(request.error ?? new IndexedDbFailure("IndexedDB cursor failed")), {
         once: true,
     });
     request.addEventListener("success", () => {
@@ -75,7 +92,7 @@ const cursorValues = (source, range, direction, limit, accept = () => true) => n
 });
 const firstCursorValue = (source, range, direction, accept = () => true) => new Promise((resolve, reject) => {
     const request = source.openCursor(range, direction);
-    request.addEventListener("error", () => reject(request.error ?? new Error("IndexedDB cursor failed")), {
+    request.addEventListener("error", () => reject(request.error ?? new IndexedDbFailure("IndexedDB cursor failed")), {
         once: true,
     });
     request.addEventListener("success", () => {
@@ -242,29 +259,56 @@ export class IndexedDbStorage {
             throw new Error("IndexedDB is not available");
         await requestResult(factory.deleteDatabase(name));
     }
-    async commit(writes, _context) {
+    /**
+     * Commit `batches` in one IndexedDB transaction, each with its own seq. Each batch does every read and check, copy
+     * resolution included, against the state the earlier ones left before it issues its first write; the first one
+     * refused ends the call, and the transaction commits the ones before it. An error of IndexedDB itself aborts the
+     * transaction: the call rejects with nothing stored.
+     */
+    async commit(batches, receive, _context) {
         this.assertOpen();
-        const documentActions = this.prepareDocumentActions(writes);
-        return this.transaction(ALL_STORES, "readwrite", async (transaction) => {
+        const seqs = [];
+        let refused;
+        await this.transaction(ALL_STORES, "readwrite", async (transaction) => {
             const metaStore = transaction.objectStore(STORES.meta);
             const metadata = await requestResult(metaStore.get(META_KEY));
             if (metadata === undefined)
                 throw new Error("Durable IndexedDB metadata is missing");
-            const seq = seqFromNumber(metadata.nextSeq);
-            await this.checkGlobalIds(transaction, writes);
-            await this.checkDocumentActions(transaction, documentActions);
-            for (const write of writes)
-                await this.applyTableWrite(transaction, write, seq);
-            await this.applyDocumentActions(transaction, documentActions, seq);
+            let next = metadata.nextSeq;
             let nextId = metadata.nextId;
-            for (const write of writes) {
-                const id = writeId(write);
-                if (id !== undefined)
-                    nextId = Math.max(nextId, id + 1);
+            for (const writes of batches) {
+                let documentActions;
+                try {
+                    documentActions = this.prepareDocumentActions(writes);
+                    await this.checkGlobalIds(transaction, writes);
+                    await this.checkDocumentActions(transaction, documentActions);
+                    await this.resolveCopies(transaction, documentActions);
+                }
+                catch (error) {
+                    if (fromIndexedDb(error))
+                        throw error;
+                    refused = { error };
+                    break;
+                }
+                const seq = seqFromNumber(next++);
+                for (const write of writes)
+                    await this.applyTableWrite(transaction, write, seq);
+                await this.applyDocumentActions(transaction, documentActions, seq);
+                for (const write of writes) {
+                    const id = writeId(write);
+                    if (id !== undefined)
+                        nextId = Math.max(nextId, id + 1);
+                }
+                seqs.push(seq);
+            }
+            if (seqs.length > 0) {
+                await requestResult(metaStore.put({ key: META_KEY, nextId, nextSeq: next }));
             }
-            await requestResult(metaStore.put({ key: META_KEY, nextId, nextSeq: seq + 1 }));
-            return seq;
         });
+        // The transaction completed: the stored batches are durable.
+        for (const [index, seq] of seqs.entries())
+            receive(index, seq);
+        return refused === undefined ? { stored: seqs.length } : { stored: seqs.length, refused: refused.error };
     }
     async mintId() {
         this.assertOpen();
@@ -754,31 +798,37 @@ export class IndexedDbStorage {
                 break;
         }
     }
+    /** Resolve each copy to a base of its source's state before this batch, which may not change the source. */
+    async resolveCopies(transaction, actions) {
+        for (const [id, action] of actions) {
+            if (action.copy === undefined)
+                continue;
+            try {
+                const stored = await this.materializeDocument(transaction, action.copy.id, action.copy.at);
+                if (stored === undefined)
+                    throw new Error(`Fork source document ${action.copy.id} cannot be read`);
+                const create = action.create;
+                if (stored.record.scope.kind !== "conversation" ||
+                    create.scope.kind !== "conversation" ||
+                    stored.record.kind !== create.kind ||
+                    stored.record.key !== create.key ||
+                    stored.record.history !== create.history ||
+                    stored.record.fork !== create.fork) {
+                    throw new Error(`Fork source document ${action.copy.id} does not match the copied record`);
+                }
+                action.content = { kind: "base", version: stored.version, value: stored.value };
+            }
+            catch (error) {
+                throw new Error(`Document copy ${id} was rejected`, { cause: error });
+            }
+        }
+    }
     async applyDocumentActions(transaction, actions, seq) {
         const documents = transaction.objectStore(STORES.documents);
         const revisions = transaction.objectStore(STORES.documentRevisions);
         for (const [id, action] of actions) {
-            let content = action.content;
-            if (action.copy !== undefined) {
-                try {
-                    const stored = await this.materializeDocument(transaction, action.copy.id, action.copy.at);
-                    if (stored === undefined)
-                        throw new Error(`Fork source document ${action.copy.id} cannot be read`);
-                    const create = action.create;
-                    if (stored.record.scope.kind !== "conversation" ||
-                        create.scope.kind !== "conversation" ||
-                        stored.record.kind !== create.kind ||
-                        stored.record.key !== create.key ||
-                        stored.record.history !== create.history ||
-                        stored.record.fork !== create.fork) {
-                        throw new Error(`Fork source document ${action.copy.id} does not match the copied record`);
-                    }
-                    content = { kind: "base", version: stored.version, value: stored.value };
-                }
-                catch (error) {
-                    throw new Error(`Document copy ${id} was rejected`, { cause: error });
-                }
-            }
+            // Copies are resolved to their content by `resolveCopies()`.
+            const content = action.content;
             let record;
             if (action.create !== undefined) {
                 record = {