@elytracms/studio 0.0.95 → 0.0.97

package/dist/lib/operations/cms-persistence.js

@@ -1,5 +1,23 @@
-import { applyDocumentPatches, documentKey, formatValuePath, selfTypeDocument, touchedPaths, valuePathsOverlap, } from '@elytracms/core/cms-core';
+import { applyDocumentPatches, documentKey, formatValuePath, isValuePathPrefix, readValueAt, selfTypeDocument, semanticValueEqual, touchedPaths, valuePathsOverlap, } from '@elytracms/core/cms-core';
 import { createPersistQueue } from './persist-queue.js';
+/** How many own writes a document's ledger keeps (an older base just stops lifting — a conflict, never a borrow). */
+const OWN_WRITES_KEPT = 256;
+/**
+ * EC-667 — the revision the content a view shows at `path` was authored against: the
+ * earliest of the floor and every shown write covering `path` (a write at `path` or at
+ * an ancestor of it). `undefined` path — a whole-document writer — the earliest of all.
+ * A write at a DESCENDANT of `path` does not lower it: that position's own token is
+ * lower, and the write still pending when an edit of `path` commits lowers it there.
+ */
+function provenanceAt(provenance, path) {
+    let at = provenance.floor;
+    for (const write of provenance.writes) {
+        if (path === undefined || write.paths.some((covered) => isValuePathPrefix(covered, path))) {
+            at = earlierBase(at, write.base);
+        }
+    }
+    return at;
+}
 /** A patch's identity within one call: op + target path (no two value writes of one path share a run). */
 function targetKey(op, path) {
     return `${op} ${formatValuePath(path)}`;
@@ -21,6 +39,43 @@ function isValueWrite(patch) {
 function samePath(a, b) {
     return a.length === b.length && valuePathsOverlap(a, b);
 }
+/** The earlier of two authoring bases (`undefined` — the provisional view — is the earliest of all). */
+function earlierBase(a, b) {
+    return a === undefined || b === undefined ? undefined : Math.min(a, b);
+}
+/**
+ * An import's whole-document write (EC-595 A2 → EC-647 → EC-673): a row the session SHOWS
+ * and holds a revision for is REPLACED at the revision of the row it showed (the one the
+ * import was judged against); any other row is CREATED (insert-if-absent).
+ *
+ * EC-673: the decision is the SHOWN row's, never the tracked revision alone. A document
+ * deleted earlier in the session is not shown, but its entry can still answer a
+ * revision — the editor's Delete and a colleague's delete keep the deleted lifetime's
+ * base, and the list's bulk Delete never tells the persister at all. Deciding on that
+ * revision sent the import down `replace`: queued on a deleted entry and skipped, or
+ * refused as unauthored with the deleted lifetime's values shown again. A replace with no
+ * shown row could never be right anyway — it names no revision it was authored against.
+ */
+export function importWrite(persister, document, shown) {
+    if (shown && persister.revisionOf(document) !== undefined) {
+        persister.replace(document, persister.revisionOfView(shown));
+    }
+    else
+        persister.create(document);
+}
+/** A write against a document this session no longer holds (deleted here or elsewhere). */
+function goneError(ref) {
+    return { code: 'not-found', message: 'The document is gone.', entity: 'cms-document', key: documentKey(ref) };
+}
+/** The refusal of a write that names no revision it was authored against (EC-647). */
+function unauthoredError(ref) {
+    return {
+        code: 'conflict',
+        key: documentKey(ref),
+        message: 'A change was not saved: it does not say which revision of the document it was made on, so it could overwrite a change made since (EC-647).',
+        messageRef: { key: 'cms.conflict.unauthored' },
+    };
+}
 export function createCmsPersister(options) {
     const queue = createPersistQueue((error) => {
         options.onError({
@@ -29,6 +84,10 @@ export function createCmsPersister(options) {
         });
     });
     const entries = new Map();
+    /** EC-647 / EC-667: every document value this persister showed or tracked → what it was authored against. */
+    const shown = new WeakMap();
+    /** A server row's document: every position at its revision. */
+    const registerRow = (row) => shown.set(row.document, { floor: row.revision, writes: [] });
     function entryOf(ref) {
         const key = documentKey(ref);
         let entry = entries.get(key);
@@ -39,11 +98,16 @@ export function createCmsPersister(options) {
                 provisional: undefined,
                 queue: [],
                 inFlight: [],
+                inFlightReplace: undefined,
                 busy: false,
                 conflicts: [],
+                conflictBases: new Map(),
                 held: undefined,
                 scheduled: false,
                 deleted: false,
+                creating: false,
+                created: undefined,
+                own: [],
             };
             entries.set(key, entry);
         }
@@ -56,26 +120,58 @@ export function createCmsPersister(options) {
             return doc;
         return selfTypeDocument(doc, collection, options.lookupManifest ? { lookupManifest: options.lookupManifest } : {});
     }
-    /** The session's view: base ⊕ unresolved mine ⊕ in-flight ⊕ queued (the pure merge, no log). */
+    /** The queued patches (not whole-document writes). */
+    function queuedPatches(entry) {
+        return entry.queue.filter((queued) => queued.kind === 'patch');
+    }
+    /**
+     * The session's view: base ⊕ unresolved mine ⊕ in-flight ⊕ queued (the pure merge, no
+     * log; a whole-document write resets it to its snapshot). Registered with what it was
+     * authored against, position by position (EC-647 → EC-667: the base's revision, a
+     * pending snapshot's, each shown write's base); a provisional view has none.
+     */
     function display(entry) {
         const baseDocument = entry.base?.document ?? entry.provisional;
         if (entry.deleted || !baseDocument)
             return undefined;
-        const patches = [
-            ...entry.conflicts.map((conflict) => conflict.patch),
-            ...entry.inFlight.map((queued) => queued.patch),
-            ...entry.queue.map((queued) => queued.patch),
+        let document = baseDocument;
+        let floor = entry.base?.revision;
+        let patches = entry.conflicts.map((conflict) => conflict.patch);
+        let writes = entry.conflicts.map((conflict) => ({
+            paths: touchedPaths(conflict.patch),
+            base: entry.conflictBases.get(conflict.id),
+        }));
+        const pending = [
+            ...entry.inFlight,
+            ...(entry.inFlightReplace ? [entry.inFlightReplace] : []),
+            ...entry.queue,
         ];
-        if (patches.length === 0)
-            return baseDocument;
-        return applyDocumentPatches({ document: baseDocument, patches, since: [] }).document;
+        for (const queued of pending) {
+            if (queued.kind === 'replace') {
+                // The snapshot was authored over everything before it (the editor's draft): every
+                // position now shows content authored at the SNAPSHOT's revision (EC-667).
+                patches = [];
+                writes = [];
+                document = queued.document;
+                floor = queued.base;
+            }
+            else {
+                patches.push(queued.patch);
+                writes.push({ paths: touchedPaths(queued.patch), base: queued.base });
+            }
+        }
+        if (patches.length > 0)
+            document = applyDocumentPatches({ document, patches, since: [] }).document;
+        if (entry.base)
+            shown.set(document, { floor, writes });
+        return document;
     }
     function emitDocument(entry) {
         if (entry.deleted)
             return;
-        const shown = display(entry);
-        if (shown)
-            options.onDocument?.(entry.ref, shown);
+        const view = display(entry);
+        if (view)
+            options.onDocument?.(entry.ref, view);
     }
     function emitConflicts(entry) {
         options.onConflicts?.(entry.ref, [...entry.conflicts]);
@@ -85,6 +181,7 @@ export function createCmsPersister(options) {
         if (entry.base && record.revision < entry.base.revision)
             return;
         entry.base = record;
+        registerRow(record);
         options.onRecord?.(record);
         emitDocument(entry);
     }
@@ -101,13 +198,37 @@ export function createCmsPersister(options) {
         if (!entry.base || held.revision > entry.base.revision)
             adopt(entry, held);
     }
+    function settleAll(queued, outcome) {
+        for (const item of queued)
+            for (const settle of item.settle)
+                settle(outcome);
+    }
+    /** Drop every queued write, settling its waiters (the document is gone, or the writes cannot be based). */
+    function dropQueued(entry, outcome, which = () => true) {
+        const dropped = entry.queue.filter(which);
+        entry.queue = entry.queue.filter((queued) => !which(queued));
+        settleAll(dropped.filter((queued) => queued.kind === 'patch'), outcome);
+    }
     function markGone(entry) {
         if (entry.deleted)
             return;
         entry.deleted = true;
-        entry.queue = [];
+        dropQueued(entry, { status: 'failed', error: goneError(entry.ref) });
         options.onDocument?.(entry.ref, undefined);
     }
+    /**
+     * EC-673 — writes queued on a document this session no longer holds (one put back by a
+     * failed send after a delete, a "keep mine" on a document that went away): refused and
+     * REPORTED, never left in the queue for the drain to skip — nor sent into a later
+     * re-create of the id, whose first revision the own-write ledger would lift them across.
+     */
+    function refuseQueued(entry) {
+        if (entry.queue.length === 0)
+            return;
+        const error = goneError(entry.ref);
+        dropQueued(entry, { status: 'failed', error });
+        options.onError(error);
+    }
     function schedule(entry) {
         if (entry.scheduled)
             return;
@@ -118,6 +239,126 @@ export function createCmsPersister(options) {
             adoptHeld(entry);
         });
     }
+    /** EC-647: record one of this persister's acknowledged writes (the own-write ledger). */
+    function recordOwn(entry, write) {
+        entry.own.push(write);
+        if (entry.own.length > OWN_WRITES_KEPT)
+            entry.own.splice(0, entry.own.length - OWN_WRITES_KEPT);
+    }
+    /**
+     * EC-647 — THE lift: the base a write authored at `base` is SENT at. Only across this
+     * persister's own writes (see the module doc): a run of consecutive own revisions
+     * right after the base, or an own write that covered every position `paths` touch and
+     * was sent at or below the base. Never across a revision anyone else wrote.
+     */
+    function lift(entry, base, paths) {
+        let lifted = base;
+        for (;;) {
+            if (entry.own.some((write) => write.revision === lifted + 1)) {
+                lifted += 1;
+                continue;
+            }
+            const covering = paths
+                ? entry.own.find((write) => write.revision > lifted &&
+                    write.paths !== undefined &&
+                    write.sentBase !== undefined &&
+                    write.sentBase <= lifted &&
+                    paths.every((path) => write.paths.some((covered) => isValuePathPrefix(covered, path))))
+                : undefined;
+            if (!covering)
+                return lifted;
+            lifted = covering.revision;
+        }
+    }
+    /**
+     * EC-647 — the base a write is QUEUED with: the revision it was authored against, or
+     * the earlier base of an own unacknowledged write on the same positions (the view
+     * showed mine there, not whatever may sit underneath it).
+     */
+    function authoredBase(entry, patch, authored) {
+        let base = authored;
+        const overlaps = (other) => patch === undefined || patchesOverlap(other, patch);
+        for (const queued of [...entry.inFlight, ...entry.queue]) {
+            if (queued.kind === 'replace' || overlaps(queued.patch))
+                base = earlierBase(base, queued.base);
+        }
+        if (entry.inFlightReplace)
+            base = earlierBase(base, entry.inFlightReplace.base);
+        for (const conflict of entry.conflicts) {
+            if (overlaps(conflict.patch))
+                base = earlierBase(base, entry.conflictBases.get(conflict.id));
+        }
+        return base;
+    }
+    /** Whether a write may be authored on a provisional view (our own create, or an untracked document). */
+    function provisionalAllowed(entry) {
+        return entry.creating || entry.created !== undefined || !entry.base;
+    }
+    /** Our own create landed (or failed): base every write authored on its provisional view. */
+    function baseOnCreated(entry) {
+        if (entry.created === undefined)
+            return;
+        for (const queued of entry.queue)
+            if (queued.base === undefined)
+                queued.base = entry.created;
+    }
+    /**
+     * EC-647 — writes authored on the provisional view of a document this session holds no
+     * revision for (a staged transfer): read it; when it still EQUALS the view they were
+     * authored on, that read's revision is theirs — otherwise each is refused as a
+     * conflict on its position (theirs = the read). Never "whatever revision the read
+     * returns". `false` when the read failed (the writes stay queued, the error shows).
+     */
+    async function baseOnRead(entry, operations) {
+        if (!entry.queue.some((queued) => queued.kind === 'patch' && queued.base === undefined))
+            return true;
+        if (entry.created !== undefined) {
+            baseOnCreated(entry);
+            return true;
+        }
+        if (entry.base) {
+            // A tracked document this session did not create: commit already refused these.
+            const error = unauthoredError(entry.ref);
+            dropQueued(entry, { status: 'failed', error }, (queued) => queued.kind === 'patch' && queued.base === undefined);
+            options.onError(error);
+            return true;
+        }
+        const read = await operations.documents.get({ projectId: options.projectId, ref: entry.ref });
+        if (!read.ok) {
+            options.onError(read.error);
+            return false;
+        }
+        const record = read.value;
+        const authoredOn = entry.provisional;
+        if (authoredOn && semanticValueEqual(record.document, authoredOn)) {
+            for (const queued of entry.queue)
+                if (queued.kind === 'patch' && queued.base === undefined)
+                    queued.base = record.revision;
+        }
+        else {
+            const refused = [];
+            for (const queued of queuedPatches(entry)) {
+                if (queued.base !== undefined)
+                    continue;
+                const path = patchTarget(queued.patch);
+                const conflict = upsertConflict(entry, {
+                    patch: queued.patch,
+                    reason: 'conflict',
+                    path,
+                    current: readValueAt(record.document, path),
+                    detail: 'the document changed since the view this edit was made on',
+                }, record.revision, record.revision);
+                refused.push(conflict);
+                for (const settle of queued.settle)
+                    settle({ status: 'refused', conflicts: [conflict] });
+            }
+            entry.queue = entry.queue.filter((queued) => !(queued.kind === 'patch' && queued.base === undefined));
+            if (refused.length > 0)
+                emitConflicts(entry);
+        }
+        adopt(entry, record);
+        return true;
+    }
     /** Who changed a refused path — the newest patch-log row in (base, current] touching it. Best-effort. */
     async function resolveActors(entry, sentBase, refused) {
         try {
@@ -149,25 +390,81 @@ export function createCmsPersister(options) {
             // The actor is decoration on a conflict the user can already resolve.
         }
     }
-    /** Send the queue, one run of equal base at a time, until it is empty or a write fails. */
+    /** Send one queued whole-document write at the revision its snapshot was authored against. `false` → stop draining. */
+    async function sendReplace(entry, operations, write) {
+        const precondition = write.base !== undefined
+            ? { revision: lift(entry, write.base, undefined) }
+            : entry.created !== undefined
+                ? { revision: lift(entry, entry.created, undefined) }
+                : !entry.base
+                    ? { ifAbsent: true }
+                    : undefined;
+        entry.queue.shift();
+        if (!precondition) {
+            // A tracked document this session did not create, written whole from a view with no revision.
+            options.onError(unauthoredError(entry.ref));
+            emitDocument(entry);
+            return true;
+        }
+        entry.inFlightReplace = write;
+        entry.busy = true;
+        try {
+            const result = await operations.documents.replace({
+                projectId: options.projectId,
+                document: write.document,
+                precondition,
+            });
+            entry.inFlightReplace = undefined;
+            if (result.ok) {
+                recordOwn(entry, {
+                    revision: result.value.revision,
+                    sentBase: 'revision' in precondition ? precondition.revision : undefined,
+                    paths: undefined,
+                });
+                adopt(entry, result.value);
+            }
+            else {
+                if (result.error.code === 'conflict' && 'current' in result.error && result.error.current) {
+                    adopt(entry, result.error.current);
+                }
+                else
+                    emitDocument(entry);
+                options.onError(result.error);
+            }
+        }
+        finally {
+            entry.inFlightReplace = undefined;
+            entry.busy = false;
+            adoptHeld(entry);
+        }
+        return true;
+    }
+    /** Send the queue — runs of equal (lifted) base, whole-document writes in their place — until it is empty or a write fails. */
     async function drain(entry) {
-        while (entry.queue.length > 0 && !entry.deleted) {
+        while (entry.queue.length > 0) {
+            if (entry.deleted) {
+                refuseQueued(entry);
+                return;
+            }
             const operations = await options.getOperations();
-            if (!entry.base) {
-                // Untracked (a document the session never hydrated a revision for): read it.
-                // The user's view of it is the session's, so this is the narrowest window left.
-                const read = await operations.documents.get({ projectId: options.projectId, ref: entry.ref });
-                if (!read.ok) {
-                    options.onError(read.error);
-                    return;
-                }
-                entry.base = read.value;
+            if (!(await baseOnRead(entry, operations)))
+                return;
+            const head = entry.queue[0];
+            if (!head)
+                return;
+            if (head.kind === 'replace') {
+                await sendReplace(entry, operations, head);
+                continue;
             }
-            const resolveBase = (queued) => queued.base ?? entry.base.revision;
-            const first = resolveBase(entry.queue[0]);
+            const sendBase = (queued) => lift(entry, queued.base, touchedPaths(queued.patch));
+            const first = sendBase(head);
             let end = 1;
-            while (end < entry.queue.length && resolveBase(entry.queue[end]) === first)
+            while (end < entry.queue.length) {
+                const next = entry.queue[end];
+                if (next.kind !== 'patch' || sendBase(next) !== first)
+                    break;
                 end += 1;
+            }
             const run = entry.queue.splice(0, end);
             entry.inFlight = run;
             const result = await operations.documents.patch({
@@ -178,7 +475,11 @@ export function createCmsPersister(options) {
             });
             entry.inFlight = [];
             if (result.ok) {
-                rebaseCovered(entry, run, result.value.revision);
+                recordOwn(entry, {
+                    revision: result.value.revision,
+                    sentBase: first,
+                    paths: run.flatMap((queued) => touchedPaths(queued.patch)),
+                });
                 adopt(entry, result.value);
                 adoptHeld(entry);
                 settleAll(run, { status: 'applied', record: result.value });
@@ -199,12 +500,20 @@ export function createCmsPersister(options) {
                         continue;
                     }
                     // MINE is what the user wrote (the queued patch), not the canonicalised echo.
-                    const conflict = upsertConflict(entry, { ...refused, patch: queued.patch }, current.revision);
+                    const conflict = upsertConflict(entry, { ...refused, patch: queued.patch }, current.revision, queued.base);
                     conflicts.push(conflict);
                     for (const settle of queued.settle)
                         settle({ status: 'refused', conflicts: [conflict] });
                 }
-                rebaseCovered(entry, applied, current.revision);
+                // A partially applied run IS a write of ours (the row it returns is after it);
+                // a wholly refused one wrote nothing — its row is someone else's revision.
+                if (applied.length > 0) {
+                    recordOwn(entry, {
+                        revision: current.revision,
+                        sentBase: first,
+                        paths: applied.flatMap((queued) => touchedPaths(queued.patch)),
+                    });
+                }
                 adopt(entry, current);
                 adoptHeld(entry);
                 emitConflicts(entry);
@@ -229,23 +538,7 @@ export function createCmsPersister(options) {
             return;
         }
     }
-    function settleAll(queued, outcome) {
-        for (const item of queued)
-            for (const settle of item.settle)
-                settle(outcome);
-    }
-    /** Queued patches on a path our own write just covered move their base to that write's revision. */
-    function rebaseCovered(entry, written, revision) {
-        if (written.length === 0)
-            return;
-        for (const queued of entry.queue) {
-            if (queued.base !== undefined && queued.base >= revision)
-                continue;
-            if (written.some((done) => patchesOverlap(done.patch, queued.patch)))
-                queued.base = revision;
-        }
-    }
-    function upsertConflict(entry, refused, revision) {
+    function upsertConflict(entry, refused, revision, base) {
         const conflict = {
             id: conflictId(entry.ref, refused.path),
             ref: entry.ref,
@@ -256,6 +549,7 @@ export function createCmsPersister(options) {
             revision,
         };
         entry.conflicts = [...entry.conflicts.filter((c) => c.id !== conflict.id), conflict];
+        entry.conflictBases.set(conflict.id, base);
         return conflict;
     }
     function command(entry, run) {
@@ -276,6 +570,7 @@ export function createCmsPersister(options) {
     return {
         track(row) {
             const entry = entryOf(row.document);
+            registerRow(row);
             if (!entry.base || row.revision > entry.base.revision)
                 entry.base = row;
         },
@@ -284,6 +579,10 @@ export function createCmsPersister(options) {
             const entry = entries.get(documentKey(ref));
             return entry ? display(entry) : undefined;
         },
+        revisionOfView: (view, path) => {
+            const provenance = shown.get(view);
+            return provenance ? provenanceAt(provenance, path) : undefined;
+        },
         adoptRecord(record) {
             const entry = entryOf(record.document);
             if (entry.deleted)
@@ -291,22 +590,39 @@ export function createCmsPersister(options) {
             if (!entry.base || record.revision > entry.base.revision)
                 adopt(entry, record);
         },
-        commit(ref, patches, view, bases) {
+        commit(ref, patches, bases, view) {
             const entry = entryOf(ref);
-            if (patches.length === 0 || entry.deleted) {
-                return Promise.resolve({
-                    status: 'failed',
-                    error: { code: 'not-found', message: 'The document is gone.', entity: 'cms-document', key: documentKey(ref) },
-                });
+            if (patches.length === 0)
+                return Promise.resolve({ status: 'failed', error: goneError(ref) });
+            if (entry.deleted) {
+                // EC-673: a write that cannot be sent is reported, not only settled — the editor's
+                // committer and the transfer dialog do not read the outcome.
+                const error = goneError(ref);
+                options.onError(error);
+                return Promise.resolve({ status: 'failed', error });
+            }
+            if (!Array.isArray(bases)) {
+                // EC-647: a writer that names no authoring revision at all — never given the tracked one.
+                const error = unauthoredError(ref);
+                options.onError(error);
+                return Promise.resolve({ status: 'failed', error });
             }
             if (!entry.base && !entry.provisional && view)
                 entry.provisional = view;
             let conflictsChanged = false;
+            let unauthored = false;
             const waits = [];
             for (const [index, patch] of patches.entries()) {
-                const madeAt = bases?.[index] ?? entry.base?.revision;
+                const authored = bases[index];
                 let settle;
                 waits.push(new Promise((resolve) => (settle = resolve)));
+                if (authored === undefined && !provisionalAllowed(entry)) {
+                    // EC-647: authored on a view with no revision, on a document this session
+                    // tracks and did not create — it cannot be checked, so it is not sent.
+                    unauthored = true;
+                    settle({ status: 'failed', error: unauthoredError(ref) });
+                    continue;
+                }
                 // A field with an unresolved conflict: the new value replaces MINE, unsent —
                 // the user decides (keep mine sends it), never an implicit overwrite of theirs.
                 const open = entry.conflicts.find((conflict) => patchesOverlap(conflict.patch, patch));
@@ -317,18 +633,33 @@ export function createCmsPersister(options) {
                     settle({ status: 'refused', conflicts: [replaced] });
                     continue;
                 }
+                const base = authoredBase(entry, patch, authored);
                 // A later value write of the same field supersedes an unsent one (keeping the
-                // EARLIER base — the user never saw a foreign value of a field they were typing in).
+                // EARLIER base — the user never saw a foreign value of a field they were typing
+                // in). Only after the last queued whole-document write: one before it is sent
+                // before the snapshot that was authored over it.
                 if (isValueWrite(patch)) {
-                    const pending = entry.queue.findIndex((queued) => isValueWrite(queued.patch) && samePath(queued.patch.path, patch.path));
+                    let after = 0;
+                    entry.queue.forEach((queued, at) => {
+                        if (queued.kind === 'replace')
+                            after = at + 1;
+                    });
+                    const pending = entry.queue.findIndex((queued, at) => at >= after && queued.kind === 'patch' && isValueWrite(queued.patch) && samePath(queued.patch.path, patch.path));
                     if (pending >= 0) {
                         const superseded = entry.queue[pending];
-                        entry.queue[pending] = { patch, base: superseded.base, settle: [...superseded.settle, settle] };
+                        entry.queue[pending] = {
+                            kind: 'patch',
+                            patch,
+                            base: earlierBase(superseded.base, base),
+                            settle: [...superseded.settle, settle],
+                        };
                         continue;
                     }
                 }
-                entry.queue.push({ patch, base: madeAt, settle: [settle] });
+                entry.queue.push({ kind: 'patch', patch, base, settle: [settle] });
             }
+            if (unauthored)
+                options.onError(unauthoredError(ref));
             emitDocument(entry);
             if (conflictsChanged)
                 emitConflicts(entry);
@@ -347,7 +678,22 @@ export function createCmsPersister(options) {
         create(document) {
             const doc = canonical(document);
             const entry = entryOf(doc);
+            // A fresh document: nothing of an earlier incarnation of this ref carries over —
+            // EC-673: its queued writes (refused and reported, never sent into this one) and its
+            // open conflicts (a colleague's delete keeps them; their "mine" is not laid over this one).
+            if (entry.deleted) {
+                refuseQueued(entry);
+                if (entry.conflicts.length > 0) {
+                    entry.conflicts = [];
+                    entry.conflictBases.clear();
+                    emitConflicts(entry);
+                }
+            }
             entry.deleted = false;
+            entry.base = undefined;
+            entry.own = [];
+            entry.created = undefined;
+            entry.creating = true;
             // Optimistic: the session shows the document at once; the base is the created row.
             entry.provisional = doc;
             options.onDocument?.(entry.ref, doc);
@@ -360,12 +706,21 @@ export function createCmsPersister(options) {
                         document: doc,
                         precondition: { ifAbsent: true },
                     });
-                    if (result.ok)
+                    if (result.ok) {
+                        entry.created = result.value.revision;
+                        recordOwn(entry, { revision: result.value.revision, sentBase: undefined, paths: undefined });
+                        baseOnCreated(entry);
                         adopt(entry, result.value);
-                    else
+                    }
+                    else {
                         options.onError(result.error);
+                        // EC-647: the writes authored on the document we meant to create have no
+                        // revision to be based on — never the revision of a row someone else wrote.
+                        dropQueued(entry, { status: 'failed', error: result.error }, (queued) => queued.base === undefined);
+                    }
                 }
                 finally {
+                    entry.creating = false;
                     entry.busy = false;
                     adoptHeld(entry);
                 }
@@ -373,41 +728,31 @@ export function createCmsPersister(options) {
                     await drain(entry);
             });
         },
-        replace(document) {
+        replace(document, revision) {
             const doc = canonical(document);
             const entry = entryOf(doc);
-            if (!entry.base)
+            if (entry.deleted) {
+                // EC-673: a document this session no longer holds has nothing to replace — refused
+                // and reported here, never queued for a drain that skips it (or a re-create of the
+                // id that would send it). A new document of the id is a `create`.
+                options.onError(goneError(entry.ref));
+                return;
+            }
+            if (!entry.base && !entry.provisional)
                 entry.provisional = doc;
-            options.onDocument?.(entry.ref, doc);
-            queue.push(async () => {
-                await drain(entry);
-                const operations = await options.getOperations();
-                entry.busy = true;
-                try {
-                    const result = await operations.documents.replace({
-                        projectId: options.projectId,
-                        document: doc,
-                        precondition: entry.base ? { revision: entry.base.revision } : { ifAbsent: true },
-                    });
-                    if (result.ok)
-                        adopt(entry, result.value);
-                    else {
-                        if (result.error.code === 'conflict' && 'current' in result.error && result.error.current) {
-                            adopt(entry, result.error.current);
-                        }
-                        options.onError(result.error);
-                    }
-                }
-                finally {
-                    entry.busy = false;
-                    adoptHeld(entry);
-                }
-            });
+            // Queued in its place: the patches committed before it are sent first (the snapshot
+            // holds them), the ones committed after it are sent after it (it does not). EC-647
+            // (Codex F10): one with no authoring revision on a document this session tracks and
+            // did not create is refused there, in order — never sent at the tracked revision.
+            entry.queue.push({ kind: 'replace', document: doc, base: authoredBase(entry, undefined, revision) });
+            emitDocument(entry);
+            schedule(entry);
         },
         deleteDocument(ref) {
             const entry = entryOf(ref);
-            entry.queue = [];
+            dropQueued(entry, { status: 'failed', error: goneError(ref) });
             entry.conflicts = [];
+            entry.conflictBases.clear();
             entry.deleted = true;
             emitConflicts(entry);
             command(entry, (operations) => operations.documents.delete({ projectId: options.projectId, ref }));
@@ -420,8 +765,10 @@ export function createCmsPersister(options) {
                 entry.busy = true;
                 try {
                     const result = await operations.documents.unpublish({ projectId: options.projectId, ref });
-                    if (result.ok)
+                    if (result.ok) {
+                        recordOwn(entry, { revision: result.value.revision, sentBase: undefined, paths: [] });
                         adopt(entry, result.value);
+                    }
                     else
                         options.onError(result.error);
                 }
@@ -458,9 +805,12 @@ export function createCmsPersister(options) {
             if (!conflict)
                 return;
             entry.conflicts = entry.conflicts.filter((c) => c !== conflict);
+            entry.conflictBases.delete(conflict.id);
             if (choice === 'mine') {
-                // Keep mine: re-send at the CURRENT base — a visible, explicit second write.
-                entry.queue.push({ patch: conflict.patch, base: entry.base?.revision, settle: [] });
+                // Keep mine: re-send at the CURRENT base — a visible, explicit second write, and
+                // the one deliberate "at the current base" write (EC-647): the user chose it
+                // after seeing theirs.
+                entry.queue.push({ kind: 'patch', patch: conflict.patch, base: entry.base?.revision, settle: [] });
                 schedule(entry);
             }
             emitDocument(entry);