@elytracms/studio 0.0.96 → 0.0.98

package/dist/lib/operations/cms-persistence.d.ts

@@ -36,6 +36,21 @@ import type { OperationError, OperationsClient } from './operations-package.js';
  * (which sent at whatever revision a later read returned). A write that cannot name the
  * revision it was authored against is refused, visibly — it never borrows one.
  *
+ * - **A view's token is per position (EC-667, Codex F18).** A view that shows a pending
+ *   write is a COMPOSITE: no single underlying revision names it. Each shown view is
+ *   registered with its provenance at display time — the base's revision, or under a
+ *   pending whole-document write its snapshot's authoring revision, and over that each
+ *   own unacknowledged write shown (queued, in flight, an open conflict's "mine") with
+ *   the base it was authored at. `revisionOfView(view, path)` is the revision the content
+ *   at `path` was authored against: the earliest of the floor and of the shown writes that
+ *   OVERLAP `path` — at it, at an ancestor, or at a descendant, whose content the value at
+ *   `path` contains (EC-681, Codex F23); a sibling's write does not lower it.
+ *   `revisionOfView(view)` — a whole-document writer — the EARLIEST of all. The record is
+ *   immutable, so it outlives the pending write: an edit started on a view that showed a
+ *   snapshot keeps the snapshot's revision after the snapshot is refused or fails
+ *   (before EC-667 the composite was named by the base's revision — a colleague's change
+ *   adopted underneath a pending snapshot lent the edit its revision, and the edit,
+ *   authored on the old content, overwrote it).
  * - **A position under one of this session's own unacknowledged writes** (queued, in
  *   flight, or an open conflict's "mine") was authored against THAT write's base: the
  *   view showed mine there, not a colleague's change that may sit underneath it. The
@@ -46,9 +61,12 @@ import type { OperationError, OperationsClient } from './operations-package.js';
  *   after it (nothing foreign happened in between), or to an own write's revision when
  *   the patch only touches positions that write covered and the write was sent at or
  *   below the patch's base (the store refused every foreign change of those positions in
- *   between, or the write would not have applied). Without it, the session's second
- *   edit of a position, made at the revision its first was authored against, would be
- *   refused by its own first write.
+ *   between, or the write would not have applied) — or, EC-681, across a revision someone
+ *   else wrote that the patch log shows touched none of the patch's positions (the store
+ *   would not refuse the patch on it), read only when an own write beyond it would
+ *   otherwise refuse the patch. Without it, the session's second edit of a position, made
+ *   at the revision its first was authored against, would be refused by its own first
+ *   write — and an edit of a parent, authored over an own child write, by that child's.
  * - **The provisional view** (`undefined` authoring revision): a document whose view
  *   has no revision yet — our own create in flight, or a document the session never
  *   tracked (a staged transfer). Writes on it are based on the revision our create
@@ -102,7 +120,13 @@ export type CommitOutcome = {
 export interface CmsPersister {
     /** Adopt a server row as this session's base for its document (hydration, a create result). */
     track(row: TrackedRow): void;
-    /** The revision the session's view of a document is at now (`undefined` = untracked). */
+    /**
+     * The revision of the server row the session last adopted for a document (`undefined` =
+     * untracked). A document deleted since still answers its removed lifetime's last
+     * revision (EC-673): a publish conditioned on it is refused, never sent unconditionally
+     * into a re-creation this session never showed — so whether to create or replace is
+     * never decided on it alone ({@link importWrite} decides on the row the session shows).
+     */
     revisionOf(ref: DocumentRef): number | undefined;
     /** The session's view of a tracked document (base ⊕ local), or `undefined`. */
     documentOf(ref: DocumentRef): CmsDocument | undefined;
@@ -113,8 +137,14 @@ export interface CmsPersister {
      * the pair cannot drift apart. `undefined` for a value the persister never showed (a
      * copy, a fixture), or a provisional view (our own create in flight, an untracked
      * document).
+     *
+     * EC-667 — per position: `path` given, the revision the content the view shows AT
+     * `path` was authored against (an editor's first keystroke there); without it, the
+     * EARLIEST authoring revision of any position the view shows — the token of a
+     * whole-document writer (a replace, an import). A view showing a pending write is never
+     * named by the base's revision alone (see the module doc).
      */
-    revisionOfView(view: CmsDocument): number | undefined;
+    revisionOfView(view: CmsDocument, path?: ValuePath): number | undefined;
     /**
      * Commit patches a writer made and flush them. The session's view updates
      * synchronously (via `onDocument`); the patches persist in order through
@@ -185,4 +215,18 @@ export interface CmsPersisterOptions {
 }
 /** What the session hydrated for a document: its value and the revision it is at. */
 export type TrackedRow = Pick<CmsDocumentRecord, 'document' | 'revision'>;
+/**
+ * An import's whole-document write (EC-595 A2 → EC-647 → EC-673): a row the session SHOWS
+ * and holds a revision for is REPLACED at the revision of the row it showed (the one the
+ * import was judged against); any other row is CREATED (insert-if-absent).
+ *
+ * EC-673: the decision is the SHOWN row's, never the tracked revision alone. A document
+ * deleted earlier in the session is not shown, but its entry can still answer a
+ * revision — the editor's Delete and a colleague's delete keep the deleted lifetime's
+ * base, and the list's bulk Delete never tells the persister at all. Deciding on that
+ * revision sent the import down `replace`: queued on a deleted entry and skipped, or
+ * refused as unauthored with the deleted lifetime's values shown again. A replace with no
+ * shown row could never be right anyway — it names no revision it was authored against.
+ */
+export declare function importWrite(persister: Pick<CmsPersister, 'revisionOf' | 'revisionOfView' | 'replace' | 'create'>, document: CmsDocument, shown: CmsDocument | undefined): void;
 export declare function createCmsPersister(options: CmsPersisterOptions): CmsPersister;

package/dist/lib/operations/cms-persistence.js

@@ -1,7 +1,46 @@
-import { applyDocumentPatches, documentKey, formatValuePath, isValuePathPrefix, readValueAt, selfTypeDocument, semanticValueEqual, touchedPaths, valuePathsOverlap, } from '@elytracms/core/cms-core';
+import { applyDocumentPatches, documentKey, formatValuePath, isValuePathPrefix, readValueAt, selfTypeDocument, semanticValueEqual, touchedPaths, touchedPathsOfEntry, valuePathsOverlap, } from '@elytracms/core/cms-core';
 import { createPersistQueue } from './persist-queue.js';
 /** How many own writes a document's ledger keeps (an older base just stops lifting — a conflict, never a borrow). */
 const OWN_WRITES_KEPT = 256;
+/**
+ * EC-667 → EC-681 — the revision the content a view shows at `path` was authored against:
+ * a token describes the WHOLE value a writer of `path` may replace. It is the earliest of
+ * the floor and of every shown write whose positions OVERLAP `path` structurally — a write
+ * at an ancestor of `path`, at `path`, or at a DESCENDANT of it (the value at `path`
+ * contains that write's content). A write at a sibling position does not lower it.
+ * `undefined` path — a whole-document writer — the earliest of all.
+ *
+ * Minted when the view is shown, never when the edit commits (Codex F18, F23): a
+ * descendant write may be refused and its conflict resolved before an edit of `path`
+ * started on this view commits, and that edit still carries the descendant's old content.
+ * The own descendant write that then APPLIES is lifted across at send time ({@link lift}).
+ */
+function provenanceAt(provenance, path) {
+    let at = provenance.floor;
+    for (const write of provenance.writes) {
+        if (path === undefined || write.paths.some((written) => valuePathsOverlap(written, path))) {
+            at = earlierBase(at, write.base);
+        }
+    }
+    return at;
+}
+/**
+ * EC-681 — whether a write at `a` may overlap one at `b` as the STORE judges it: THE
+ * conflict relation (`valuePathsOverlap`) unless BOTH name a component node — then any two
+ * in overlapping field positions. The store compares node paths EXPANDED by their ancestry
+ * (`value-path.ts`); the persister holds the submitted form, so it never claims two node
+ * paths of one field apart. Conservative by construction: a "may" that is wrong costs a
+ * lift (a conflict at worst), never a borrow.
+ */
+function mayOverlap(a, b) {
+    const fieldOf = (path) => {
+        const node = path.findIndex((segment) => segment.kind === 'node');
+        return node < 0 ? undefined : path.slice(0, node);
+    };
+    const fieldA = fieldOf(a);
+    const fieldB = fieldOf(b);
+    return fieldA && fieldB ? valuePathsOverlap(fieldA, fieldB) : valuePathsOverlap(a, b);
+}
 /** A patch's identity within one call: op + target path (no two value writes of one path share a run). */
 function targetKey(op, path) {
     return `${op} ${formatValuePath(path)}`;
@@ -27,6 +66,49 @@ function samePath(a, b) {
 function earlierBase(a, b) {
     return a === undefined || b === undefined ? undefined : Math.min(a, b);
 }
+/**
+ * An import's whole-document write (EC-595 A2 → EC-647 → EC-673): a row the session SHOWS
+ * and holds a revision for is REPLACED at the revision of the row it showed (the one the
+ * import was judged against); any other row is CREATED (insert-if-absent).
+ *
+ * EC-673: the decision is the SHOWN row's, never the tracked revision alone. A document
+ * deleted earlier in the session is not shown, but its entry can still answer a
+ * revision — the editor's Delete and a colleague's delete keep the deleted lifetime's
+ * base, and the list's bulk Delete never tells the persister at all. Deciding on that
+ * revision sent the import down `replace`: queued on a deleted entry and skipped, or
+ * refused as unauthored with the deleted lifetime's values shown again. A replace with no
+ * shown row could never be right anyway — it names no revision it was authored against.
+ */
+export function importWrite(persister, document, shown) {
+    if (shown && persister.revisionOf(document) !== undefined) {
+        persister.replace(document, persister.revisionOfView(shown));
+    }
+    else
+        persister.create(document);
+}
+/**
+ * EC-674 — THE classification of a write that failed without a per-field conflict (one
+ * declaration, read by the whole-document and the patch path): `true` = KEPT — put back,
+ * still shown, re-sent by the next commit or forced flush — for every failure the store did
+ * not JUDGE: `backend-unavailable` and `unknown`, whatever the message. `false` = DROPPED
+ * for the store's verdicts, `validation`, `unauthorized` and `not-found`: the same write is
+ * refused the same way again, so it is reported and the writes behind it drain.
+ *
+ * Why every `unknown` (measured, EC-674): no adapter emits `backend-unavailable`, and a
+ * network failure, a gateway's 5xx, an expired session and a crash all arrive as `unknown`
+ * with whatever text the transport carried — no message set can name every transient (an
+ * OCC exhaustion, a timeout, a new runtime's wording). Dropping one loses the edit; keeping
+ * a deterministic `unknown` (an undeclared field type's `canonicalise` crash) loses nothing:
+ * its error stays visible, each commit or flush re-sends it once, and the document's later
+ * writes wait behind it. Loss ranks above a wedge (the v1 bar).
+ */
+function keepsFailedWrite(error) {
+    return error.code === 'backend-unavailable' || error.code === 'unknown';
+}
+/** A write against a document this session no longer holds (deleted here or elsewhere). */
+function goneError(ref) {
+    return { code: 'not-found', message: 'The document is gone.', entity: 'cms-document', key: documentKey(ref) };
+}
 /** The refusal of a write that names no revision it was authored against (EC-647). */
 function unauthoredError(ref) {
     return {
@@ -44,8 +126,10 @@ export function createCmsPersister(options) {
         });
     });
     const entries = new Map();
-    /** EC-647: every document value this persister showed or tracked → the revision it is at. */
+    /** EC-647 / EC-667: every document value this persister showed or tracked → what it was authored against. */
     const shown = new WeakMap();
+    /** A server row's document: every position at its revision. */
+    const registerRow = (row) => shown.set(row.document, { floor: row.revision, writes: [] });
     function entryOf(ref) {
         const key = documentKey(ref);
         let entry = entries.get(key);
@@ -84,15 +168,21 @@ export function createCmsPersister(options) {
     }
     /**
      * The session's view: base ⊕ unresolved mine ⊕ in-flight ⊕ queued (the pure merge, no
-     * log; a whole-document write resets it to its snapshot). Registered with the revision
-     * it is at (EC-647) — the base's; a provisional view has none.
+     * log; a whole-document write resets it to its snapshot). Registered with what it was
+     * authored against, position by position (EC-647 → EC-667: the base's revision, a
+     * pending snapshot's, each shown write's base); a provisional view has none.
      */
     function display(entry) {
         const baseDocument = entry.base?.document ?? entry.provisional;
         if (entry.deleted || !baseDocument)
             return undefined;
         let document = baseDocument;
+        let floor = entry.base?.revision;
         let patches = entry.conflicts.map((conflict) => conflict.patch);
+        let writes = entry.conflicts.map((conflict) => ({
+            paths: touchedPaths(conflict.patch),
+            base: entry.conflictBases.get(conflict.id),
+        }));
         const pending = [
             ...entry.inFlight,
             ...(entry.inFlightReplace ? [entry.inFlightReplace] : []),
@@ -100,17 +190,22 @@ export function createCmsPersister(options) {
         ];
         for (const queued of pending) {
             if (queued.kind === 'replace') {
-                // The snapshot was authored over everything before it (the editor's draft).
+                // The snapshot was authored over everything before it (the editor's draft): every
+                // position now shows content authored at the SNAPSHOT's revision (EC-667).
                 patches = [];
+                writes = [];
                 document = queued.document;
+                floor = queued.base;
             }
-            else
+            else {
                 patches.push(queued.patch);
+                writes.push({ paths: touchedPaths(queued.patch), base: queued.base });
+            }
         }
         if (patches.length > 0)
             document = applyDocumentPatches({ document, patches, since: [] }).document;
         if (entry.base)
-            shown.set(document, entry.base.revision);
+            shown.set(document, { floor, writes });
         return document;
     }
     function emitDocument(entry) {
@@ -128,7 +223,7 @@ export function createCmsPersister(options) {
         if (entry.base && record.revision < entry.base.revision)
             return;
         entry.base = record;
-        shown.set(record.document, record.revision);
+        registerRow(record);
         options.onRecord?.(record);
         emitDocument(entry);
     }
@@ -160,12 +255,22 @@ export function createCmsPersister(options) {
         if (entry.deleted)
             return;
         entry.deleted = true;
-        dropQueued(entry, {
-            status: 'failed',
-            error: { code: 'not-found', message: 'The document is gone.', entity: 'cms-document', key: documentKey(entry.ref) },
-        });
+        dropQueued(entry, { status: 'failed', error: goneError(entry.ref) });
         options.onDocument?.(entry.ref, undefined);
     }
+    /**
+     * EC-673 — writes queued on a document this session no longer holds (one put back by a
+     * failed send after a delete, a "keep mine" on a document that went away): refused and
+     * REPORTED, never left in the queue for the drain to skip — nor sent into a later
+     * re-create of the id, whose first revision the own-write ledger would lift them across.
+     */
+    function refuseQueued(entry) {
+        if (entry.queue.length === 0)
+            return;
+        const error = goneError(entry.ref);
+        dropQueued(entry, { status: 'failed', error });
+        options.onError(error);
+    }
     function schedule(entry) {
         if (entry.scheduled)
             return;
@@ -183,12 +288,23 @@ export function createCmsPersister(options) {
             entry.own.splice(0, entry.own.length - OWN_WRITES_KEPT);
     }
     /**
-     * EC-647 — THE lift: the base a write authored at `base` is SENT at. Only across this
-     * persister's own writes (see the module doc): a run of consecutive own revisions
-     * right after the base, or an own write that covered every position `paths` touch and
-     * was sent at or below the base. Never across a revision anyone else wrote.
+     * EC-647 → EC-681 — THE lift: the base a write authored at `base` is SENT at. It crosses
+     * a revision only where the store's refusal on it would be a refusal of OUR content —
+     * never a change by anyone else of a position the write touches. Three rules, applied
+     * until none moves it:
+     * 1. the next revision is one of this persister's own writes (a run of own writes);
+     * 2. an own write that covered every position `paths` touch (each at or under one of its
+     *    paths) and was sent at or below the lifted base: its revision — the store refused
+     *    every foreign change of those positions in between, or it would not have applied;
+     * 3. (EC-681, `log` given) the next revision is someone else's and touched none of
+     *    `paths` ({@link mayOverlap}, the store's own row reading `touchedPathsOfEntry`): the
+     *    store would not refuse the write on it, so crossing it moves nothing — it only lets
+     *    rule 1 reach an own write beyond it. That is the case rule 2 cannot prove: an
+     *    ancestor's write over an own DESCENDANT write (whose acceptance says nothing of the
+     *    ancestor's other descendants), past an unrelated colleague write in between.
+     * A whole-document write (`paths` undefined) takes rule 1 only.
      */
-    function lift(entry, base, paths) {
+    function lift(entry, base, paths, log) {
         let lifted = base;
         for (;;) {
             if (entry.own.some((write) => write.revision === lifted + 1)) {
@@ -202,11 +318,38 @@ export function createCmsPersister(options) {
                     write.sentBase <= lifted &&
                     paths.every((path) => write.paths.some((covered) => isValuePathPrefix(covered, path))))
                 : undefined;
-            if (!covering)
-                return lifted;
-            lifted = covering.revision;
+            if (covering) {
+                lifted = covering.revision;
+                continue;
+            }
+            const foreign = paths ? log?.get(lifted + 1) : undefined;
+            if (foreign && !touchedPathsOfEntry(foreign).some((logged) => paths.some((path) => mayOverlap(logged, path)))) {
+                lifted += 1;
+                continue;
+            }
+            return lifted;
         }
     }
+    /**
+     * EC-681 — the patch log {@link lift} rule 3 reads for a queued patch: only when an own
+     * write the store would refuse it on lies beyond its lift (an own write that may overlap
+     * its positions, past a revision someone else wrote), read after that lift. `undefined`
+     * when not needed or not readable — then no lift, a conflict at worst, never a borrow.
+     */
+    async function liftLog(entry, operations, queued) {
+        const paths = touchedPaths(queued.patch);
+        const lifted = lift(entry, queued.base, paths);
+        const blocking = entry.own.some((write) => write.revision > lifted &&
+            (write.paths === undefined || write.paths.some((own) => paths.some((path) => mayOverlap(own, path)))));
+        if (!blocking)
+            return undefined;
+        const read = await operations.documents.listPatches({
+            projectId: options.projectId,
+            ref: entry.ref,
+            afterRevision: lifted,
+        });
+        return read.ok ? new Map(read.value.map((row) => [row.revision, row])) : undefined;
+    }
     /**
      * EC-647 — the base a write is QUEUED with: the revision it was authored against, or
      * the earlier base of an own unacknowledged write on the same positions (the view
@@ -327,6 +470,24 @@ export function createCmsPersister(options) {
             // The actor is decoration on a conflict the user can already resolve.
         }
     }
+    /**
+     * EC-674 — a write that failed without a per-field conflict: KEPT when the store did not
+     * judge it ({@link keepsFailedWrite}) — back at the head of the queue, still shown,
+     * re-sent by the next commit or forced flush at its own authoring base (a retry never
+     * borrows a newer revision) — or DROPPED on the store's verdict, and the view re-derived
+     * without it. Reported either way. `true` when kept: the drain stops there, so nothing
+     * committed after it is sent ahead of it. The one path for both the whole-document write
+     * and the patch run.
+     */
+    function failedWrite(entry, writes, error) {
+        const kept = keepsFailedWrite(error);
+        if (kept)
+            entry.queue.unshift(...writes);
+        else
+            emitDocument(entry);
+        options.onError(error);
+        return kept;
+    }
     /** Send one queued whole-document write at the revision its snapshot was authored against. `false` → stop draining. */
     async function sendReplace(entry, operations, write) {
         const precondition = write.base !== undefined
@@ -360,14 +521,13 @@ export function createCmsPersister(options) {
                 });
                 adopt(entry, result.value);
             }
-            else {
-                if (result.error.code === 'conflict' && 'current' in result.error && result.error.current) {
-                    adopt(entry, result.error.current);
-                }
-                else
-                    emitDocument(entry);
+            else if (result.error.code === 'conflict' && 'current' in result.error && result.error.current) {
+                adopt(entry, result.error.current);
                 options.onError(result.error);
             }
+            else if (failedWrite(entry, [write], result.error)) {
+                return false;
+            }
         }
         finally {
             entry.inFlightReplace = undefined;
@@ -378,7 +538,11 @@ export function createCmsPersister(options) {
     }
     /** Send the queue — runs of equal (lifted) base, whole-document writes in their place — until it is empty or a write fails. */
     async function drain(entry) {
-        while (entry.queue.length > 0 && !entry.deleted) {
+        while (entry.queue.length > 0) {
+            if (entry.deleted) {
+                refuseQueued(entry);
+                return;
+            }
             const operations = await options.getOperations();
             if (!(await baseOnRead(entry, operations)))
                 return;
@@ -386,10 +550,15 @@ export function createCmsPersister(options) {
             if (!head)
                 return;
             if (head.kind === 'replace') {
-                await sendReplace(entry, operations, head);
+                if (!(await sendReplace(entry, operations, head)))
+                    return;
                 continue;
             }
-            const sendBase = (queued) => lift(entry, queued.base, touchedPaths(queued.patch));
+            const log = await liftLog(entry, operations, head);
+            // The queue may have moved while the log was read (a superseding edit, a delete): start over.
+            if (entry.queue[0] !== head)
+                continue;
+            const sendBase = (queued) => lift(entry, queued.base, touchedPaths(queued.patch), log);
             const first = sendBase(head);
             let end = 1;
             while (end < entry.queue.length) {
@@ -461,14 +630,15 @@ export function createCmsPersister(options) {
                 settleAll(run, { status: 'failed', error });
                 return;
             }
-            // A transport / authorization failure: the patches stay local (shown, unsent) and
-            // the error is visible; the next commit or forced flush retries them. The commits
-            // waiting on them learn of the failure now.
+            // EC-674 — any other failure: the commits waiting on the run learn of it now. One the
+            // store did not judge keeps the patches (shown, unsent; the next commit or forced flush
+            // re-sends them); a verdict (validation, unauthorized, not-found) drops them, and the
+            // writes behind it drain — put back, it would be refused in front of every later write.
             settleAll(run, { status: 'failed', error });
-            entry.queue.unshift(...run.map((queued) => ({ ...queued, settle: [] })));
+            const kept = failedWrite(entry, run.map((queued) => ({ ...queued, settle: [] })), error);
             adoptHeld(entry);
-            options.onError(error);
-            return;
+            if (kept)
+                return;
         }
     }
     function upsertConflict(entry, refused, revision, base) {
@@ -503,7 +673,7 @@ export function createCmsPersister(options) {
     return {
         track(row) {
             const entry = entryOf(row.document);
-            shown.set(row.document, row.revision);
+            registerRow(row);
             if (!entry.base || row.revision > entry.base.revision)
                 entry.base = row;
         },
@@ -512,7 +682,10 @@ export function createCmsPersister(options) {
             const entry = entries.get(documentKey(ref));
             return entry ? display(entry) : undefined;
         },
-        revisionOfView: (view) => shown.get(view),
+        revisionOfView: (view, path) => {
+            const provenance = shown.get(view);
+            return provenance ? provenanceAt(provenance, path) : undefined;
+        },
         adoptRecord(record) {
             const entry = entryOf(record.document);
             if (entry.deleted)
@@ -522,11 +695,14 @@ export function createCmsPersister(options) {
         },
         commit(ref, patches, bases, view) {
             const entry = entryOf(ref);
-            if (patches.length === 0 || entry.deleted) {
-                return Promise.resolve({
-                    status: 'failed',
-                    error: { code: 'not-found', message: 'The document is gone.', entity: 'cms-document', key: documentKey(ref) },
-                });
+            if (patches.length === 0)
+                return Promise.resolve({ status: 'failed', error: goneError(ref) });
+            if (entry.deleted) {
+                // EC-673: a write that cannot be sent is reported, not only settled — the editor's
+                // committer and the transfer dialog do not read the outcome.
+                const error = goneError(ref);
+                options.onError(error);
+                return Promise.resolve({ status: 'failed', error });
             }
             if (!Array.isArray(bases)) {
                 // EC-647: a writer that names no authoring revision at all — never given the tracked one.
@@ -605,7 +781,17 @@ export function createCmsPersister(options) {
         create(document) {
             const doc = canonical(document);
             const entry = entryOf(doc);
-            // A fresh document: nothing of an earlier incarnation of this ref carries over.
+            // A fresh document: nothing of an earlier incarnation of this ref carries over —
+            // EC-673: its queued writes (refused and reported, never sent into this one) and its
+            // open conflicts (a colleague's delete keeps them; their "mine" is not laid over this one).
+            if (entry.deleted) {
+                refuseQueued(entry);
+                if (entry.conflicts.length > 0) {
+                    entry.conflicts = [];
+                    entry.conflictBases.clear();
+                    emitConflicts(entry);
+                }
+            }
             entry.deleted = false;
             entry.base = undefined;
             entry.own = [];
@@ -648,6 +834,13 @@ export function createCmsPersister(options) {
         replace(document, revision) {
             const doc = canonical(document);
             const entry = entryOf(doc);
+            if (entry.deleted) {
+                // EC-673: a document this session no longer holds has nothing to replace — refused
+                // and reported here, never queued for a drain that skips it (or a re-create of the
+                // id that would send it). A new document of the id is a `create`.
+                options.onError(goneError(entry.ref));
+                return;
+            }
             if (!entry.base && !entry.provisional)
                 entry.provisional = doc;
             // Queued in its place: the patches committed before it are sent first (the snapshot
@@ -660,10 +853,7 @@ export function createCmsPersister(options) {
         },
         deleteDocument(ref) {
             const entry = entryOf(ref);
-            dropQueued(entry, {
-                status: 'failed',
-                error: { code: 'not-found', message: 'The document is gone.', entity: 'cms-document', key: documentKey(ref) },
-            });
+            dropQueued(entry, { status: 'failed', error: goneError(ref) });
             entry.conflicts = [];
             entry.conflictBases.clear();
             entry.deleted = true;