@evolu/common 8.12.0 → 8.13.0

package/dist/src/local-first/Shared.js

@@ -53,7 +53,9 @@
  * still waiting after three seconds reports {@link OtherBuildRunningError} to
  * its tabs. Every build broadcasts console entries and errors on
  * {@link consoleEntryOrErrorBroadcastChannelName}, so a waiting tab also prints
- * the running build's output and reports its errors as its own `evoluError`.
+ * the running build's output, reports each {@link UnknownError} it sends as its
+ * own `evoluError`, and only logs any other error, such as an older build's
+ * sync error.
  *
  * The tabs of one worker elect the host of its DbWorkers among themselves, with
  * a lock scoped to the worker, so a tab of another worker never hosts them.
@@ -100,7 +102,8 @@
  * writable registrations for its owner, whichever instance made it, even one
  * disposed before the database worker answered. When a relay frame stores new
  * messages, the tenant requests a round through each other transport claimed
- * for the owner, so data learned from one relay reaches the others. A closed
+ * for the owner, so data learned from one relay reaches the others, except
+ * through a route that skipped a message, as described below. A closed
  * transport reconciles when it opens, and a replacement leader reconciles every
  * transport again, because a response reporting stored messages may have been
  * lost.
@@ -109,26 +112,34 @@
  * also delivers it as local Broadcast frames to every other tenant with
  * writable access to the owner, even while sockets are closed. A copy keeps the
  * uploader's target, and a recipient that stores new continuation messages
- * reconciles them through the transports outside that target. Local delivery
- * forwards uploads, including historical messages sent during reconciliation,
- * but does not reconcile local database histories with each other. That waits
- * until replication scopes and retention semantics are defined.
+ * reconciles them through the transports outside that target, except through a
+ * route that skipped a message. Local delivery forwards uploads, including
+ * historical messages sent during reconciliation, but does not reconcile local
+ * database histories with each other. That waits until replication scopes and
+ * retention semantics are defined.
  *
  * ## Sync state
  *
  * The shared worker publishes one plain snapshot, {@link SyncState}, of every
  * transport it manages and every database and owner registration it holds, with
- * one route per writable registration and transport, as specified below.
- * {@link syncStateToOwnerSyncStates} derives one state per database and owner.
+ * one route per writable registration and transport, as specified below. Each
+ * part is a union of the states the worker keeps for it: a transport's
+ * connection, a database that is active or refused startup, a writable or
+ * readonly owner, and a pending, settled, or complete route. A transport's
+ * events drive its connection, so publishing never reads a socket.
+ *
+ * Apps show users an owner's {@link OwnerSyncStatus}, which
+ * {@link syncStateToOwnerSyncStatus} derives. A view of each relay pairs each
+ * route with its transport by {@link syncStateToRelaySyncStates} and tells the
+ * relay's status by {@link relaySyncStateToStatus}. Snapshots store neither, so
+ * a status never disagrees with the routes it comes from.
  *
  * Each worker broadcasts snapshots on its own channel, whose name a connecting
  * tab receives through its port, so a tab never hears another worker, such as
  * one of a different app version, and
  * {@link SyncStateDep.syncState | deps.syncState} keeps the last snapshot. The
- * worker publishes after every change it observes; a transition without an
- * event, such as a closed socket starting to reconnect, appears with the next
- * snapshot. The snapshot lives in worker memory only, so a new worker starts
- * empty.
+ * worker publishes after every change it observes. The snapshot lives in worker
+ * memory only, so a new worker starts empty.
  *
  * ## Synchronization completion
  *
@@ -156,27 +167,51 @@
  * - The tenant has sent a round through the transport since the last event that
  *   requires one: its first use of the transport for the owner, the socket
  *   opening, an explicit request, a replacement leader, or storing messages
- *   from another transport. No failed or aborted result has arrived on the
- *   route since.
+ *   from another transport, unless the route skipped a message. No failed or
+ *   aborted result has arrived on the route since.
+ * - No result that skipped a received message has arrived on the route since a
+ *   round was last requested through it, and since that request, no messages
+ *   have been stored from another transport, directly or through a sibling copy
+ *   uploaded outside this transport, and no sibling copy has failed to apply or
+ *   skipped a message.
+ *
+ * A route is settled when every condition except the last holds, so a complete
+ * route is settled too. A settled route that is incomplete has ended its
+ * reconciliation, but its relay may offer a message the database skipped, or
+ * messages stored elsewhere may not have reached it; it is published as
+ * {@link SettledSyncRoute}.
  *
  * A reconciliation chain ends only with a converged result, a failure, an
  * abort, a dropped frame, or a continuation that finds the socket closed, and
  * relay errors reach every applying tenant, so these conditions mean every
  * chain, including this tenant's, converged. A local Broadcast from a sibling
  * tenant holds every route of its owner until it is applied, because it arrives
- * without a request of its own; one that fails to apply requires a round
- * through every transport.
+ * without a request of its own; one that fails to apply or skips a message
+ * requires a round through every transport whose route has not skipped one.
  *
  * A failed result on a route requests one round through it. Any further failure
- * before the route completes waits for an explicit request or a reopen, so a
+ * before the route settles waits for an explicit request or a reopen, so a
  * persistent failure cannot loop; a converged reply in between does not end the
  * wait, because it may answer another tenant's round on the shared socket. An
  * aborted apply leaves its routes incomplete without a retry. An exception
  * while the database worker creates a round is logged there and fails the
- * round's routes with `SyncFailed` without a retry; other unexpected SQLite
- * exceptions remain unsupported and can panic the database worker. A frame the
- * relay silently drops, such as invalid data, leaves the count above zero until
- * the liveness rule below replaces the socket.
+ * round's routes with `SyncFailed` without a retry. A mutation that throws is
+ * rolled back and reported as an {@link UnknownError} to the tab that made it,
+ * or to every tab when its Evolu instance was disposed first. Other unexpected
+ * SQLite exceptions remain unsupported and can panic the database worker. A
+ * frame the relay silently drops, such as invalid data, leaves the count above
+ * zero until the liveness rule below replaces the socket.
+ *
+ * A result that skipped a received message the database could not decrypt,
+ * verify, or decode records the error on the route as its `skippedError`,
+ * without ending its chain, so it requests no round, and the relay offers the
+ * message again in every round through the route until the database stores a
+ * message with that timestamp. The messages received elsewhere that the last
+ * condition names request no round through such a route, even while a requested
+ * round checks it again, because each round would download every skipped
+ * message again. The next round that a first use of the transport for the
+ * owner, an explicit request, a reopen, a replacement leader, or a failure
+ * sends through the route reconciles them.
  *
  * ### Liveness
  *
@@ -196,11 +231,13 @@
  * The timeout belongs to the transport, not to an owner, because a small reply
  * for one owner can wait behind another owner's large frame on the socket. A
  * grown timeout lasts while a request is outstanding on the socket or a
- * database that has not refused startup has an incomplete route through it,
- * including one waiting after a failure, and ends with the transport. A reply's
- * speed proves nothing, because a recovery on a slow link starts with small
- * replies that arrive quickly. The reopen resets the counts and starts the open
- * rounds, so a dropped frame delays a route instead of stranding it.
+ * database that has not refused startup has an unsettled route through it,
+ * including one waiting after a failure, and ends with the transport. A settled
+ * route that is incomplete does not count, because its reconciliation has
+ * ended. A reply's speed proves nothing, because a recovery on a slow link
+ * starts with small replies that arrive quickly. The reopen resets the counts
+ * and starts the open rounds, so a dropped frame delays a route instead of
+ * stranding it.
  *
  * The shared worker sends nothing while idle, so a path that dies then may go
  * unnoticed until its next request; until then, changes from other devices stop
@@ -264,6 +301,7 @@ var __disposeResources = (this && this.__disposeResources) || (function (Suppres
 });
 import { emptyArray, firstInArray, isNonEmptyArray, } from "../Array.js";
 import { assert, assertNonNullable, assertNotSame, assertNotUndefined, assertSame, } from "../Assert.js";
+import { createUnknownError } from "../Error.js";
 import { disposable, exhaustiveCheck } from "../Function.js";
 import { acquireLeaderLock } from "../LockManager.js";
 import { createLookupMap, structuralLookup, } from "../Lookup.js";
@@ -305,24 +343,200 @@ export const BuildWaitingRequest = /*#__PURE__*/ object({
     type: /*#__PURE__*/ literal("BuildWaitingRequest"),
 });
 /**
- * Folds the routes of every writable owner registration of every running
- * database in a {@link SyncState} into one {@link OwnerSyncState} per database
- * and owner, which pairs each route with its transport as a
- * {@link RelaySyncState}. A database that refused startup and a readonly
- * registration synchronize nothing, so they are left out.
+ * Tells what an app shows about syncing an owner in a database: `Error` when a
+ * relay has one, holding the newest failure of any relay or, without one, the
+ * newest skipped change; otherwise the first of `Syncing`, `Synced`, and
+ * `Offline` that a relay has, or `NoRelays`. Accepts null, the store's value
+ * before the first snapshot. See {@link OwnerSyncStatus} for what to show.
+ *
+ * The same status is the same object: statuses other than `Error` are shared
+ * constants, and an `Error` status is the same object for the same error
+ * object, which {@link SyncStateDep.syncState} keeps between snapshots while it
+ * is unchanged. So compare statuses with `===`.
  *
  * ### Example
  *
  * ```ts
  * import {
  *   assertEqual,
+ *   assertSame,
  *   createId,
+ *   createUnknownError,
  *   Millis,
  *   testCreateDeps,
  *   testName,
  * } from "@evolu/common";
  * import {
- *   syncStateToOwnerSyncStates,
+ *   syncStateToOwnerSyncStatus,
+ *   testAppOwner,
+ *   type PendingSyncRoute,
+ *   type SyncConnection,
+ *   type SyncRoute,
+ *   type SyncState,
+ *   type SyncTransportId,
+ * } from "@evolu/common/local-first";
+ *
+ * const deps = testCreateDeps();
+ * const primaryId = createId<"SyncTransport">(deps);
+ * const backupId = createId<"SyncTransport">(deps);
+ *
+ * const stateOf = (
+ *   connections: ReadonlyArray<SyncConnection>,
+ *   routes: ReadonlyArray<SyncRoute>,
+ * ): SyncState => ({
+ *   transports: connections.map((connection, index) => ({
+ *     type: "WebSocket",
+ *     id: index === 0 ? primaryId : backupId,
+ *     label: "wss://relay.example",
+ *     connection,
+ *   })),
+ *   tenants: [
+ *     {
+ *       type: "Active",
+ *       name: testName,
+ *       owners: [{ type: "Writable", ownerId: testAppOwner.id, routes }],
+ *     },
+ *   ],
+ * });
+ * const pending = (transportId: SyncTransportId): PendingSyncRoute => ({
+ *   type: "Pending",
+ *   transportId,
+ *   failure: null,
+ *   skippedError: null,
+ *   completeAt: null,
+ *   lastSentAt: null,
+ *   lastReceivedAt: null,
+ * });
+ * const statusOf = (state: SyncState | null) =>
+ *   syncStateToOwnerSyncStatus(state, testName, testAppOwner.id);
+ *
+ * // Before the first snapshot, nothing syncs the owner.
+ * assertEqual(statusOf(null), { type: "NoRelays" });
+ *
+ * // A first connection is syncing; a lost one is offline.
+ * const connecting: SyncConnection = { type: "Connecting" };
+ * assertEqual(statusOf(stateOf([connecting], [pending(primaryId)])), {
+ *   type: "Syncing",
+ * });
+ * const disconnected: SyncConnection = {
+ *   type: "Disconnected",
+ *   disconnectedAt: Millis.orThrow(2000),
+ *   openedAt: Millis.orThrow(1000),
+ *   error: null,
+ * };
+ * assertEqual(statusOf(stateOf([disconnected], [pending(primaryId)])), {
+ *   type: "Offline",
+ * });
+ *
+ * // A quota failure on one relay shows before a newer skipped change on
+ * // another, because the app can act on it.
+ * const quotaError = {
+ *   type: "ProtocolQuotaError",
+ *   ownerId: testAppOwner.id,
+ *   at: Millis.orThrow(3000),
+ * } as const;
+ * const open: SyncConnection = {
+ *   type: "Open",
+ *   openedAt: Millis.orThrow(3400),
+ *   error: null,
+ * };
+ * assertEqual(
+ *   statusOf(
+ *     stateOf(
+ *       [disconnected, open],
+ *       [
+ *         { ...pending(primaryId), failure: quotaError },
+ *         {
+ *           type: "Settled",
+ *           transportId: backupId,
+ *           skippedError: {
+ *             type: "DecryptWithXChaCha20Poly1305Error",
+ *             error: createUnknownError(new Error("invalid tag")),
+ *             at: Millis.orThrow(4000),
+ *           },
+ *           completeAt: null,
+ *           lastSentAt: Millis.orThrow(3500),
+ *           lastReceivedAt: Millis.orThrow(4000),
+ *         },
+ *       ],
+ *     ),
+ *   ),
+ *   { type: "Error", error: quotaError },
+ * );
+ *
+ * // The same error gives the same status object.
+ * const quotaState = stateOf(
+ *   [disconnected],
+ *   [{ ...pending(primaryId), failure: quotaError }],
+ * );
+ * assertSame(statusOf(quotaState), statusOf(quotaState));
+ * ```
+ */
+export const syncStateToOwnerSyncStatus = (state, name, ownerId) => {
+    let failure = null;
+    let skippedError = null;
+    let isSyncing = false;
+    let isSynced = false;
+    let isOffline = false;
+    for (const relay of syncStateToRelaySyncStates(state, name, ownerId)) {
+        const { route } = relay;
+        // A failure stops syncing through its relay, and a skipped change is
+        // stamped again by every reply that skips it, so a newer skipped change
+        // must not hide an older failure the app can act on.
+        if (route.type === "Pending" &&
+            route.failure &&
+            (!failure || route.failure.at > failure.at))
+            failure = route.failure;
+        if (route.type !== "Complete" &&
+            route.skippedError &&
+            (!skippedError || route.skippedError.at > skippedError.at))
+            skippedError = route.skippedError;
+        const status = relaySyncStateToStatus(relay);
+        switch (status.type) {
+            case "Error":
+                break;
+            case "Syncing":
+                isSyncing = true;
+                break;
+            case "Synced":
+                isSynced = true;
+                break;
+            case "Offline":
+                isOffline = true;
+                break;
+            default:
+                exhaustiveCheck(status);
+        }
+    }
+    const error = failure ?? skippedError;
+    return error
+        ? syncRouteErrorToSyncStatus(error)
+        : isSyncing
+            ? syncingSyncStatus
+            : isSynced
+                ? syncedSyncStatus
+                : isOffline
+                    ? offlineSyncStatus
+                    : noRelaysSyncStatus;
+};
+/**
+ * Pairs each route of an owner in a database with its transport, in route
+ * order. Returns none for a null snapshot, a missing or refused database, and a
+ * missing or readonly owner.
+ *
+ * ### Example
+ *
+ * ```ts
+ * import {
+ *   assertEqual,
+ *   createId,
+ *   Millis,
+ *   testCreateDeps,
+ *   testName,
+ * } from "@evolu/common";
+ * import {
+ *   relaySyncStateToStatus,
+ *   syncStateToRelaySyncStates,
  *   testAppOwner,
  *   type SyncRoute,
  *   type SyncState,
@@ -331,86 +545,94 @@ export const BuildWaitingRequest = /*#__PURE__*/ object({
  *
  * const deps = testCreateDeps();
  * const transport: SyncTransport = {
+ *   type: "WebSocket",
  *   id: createId<"SyncTransport">(deps),
  *   label: "wss://relay.example",
- *   readyState: "open",
- *   openedAt: null,
- *   closedAt: null,
- *   error: null,
+ *   connection: {
+ *     type: "Open",
+ *     openedAt: Millis.orThrow(800),
+ *     error: null,
+ *   },
  * };
  * const route: SyncRoute = {
+ *   type: "Complete",
  *   transportId: transport.id,
- *   complete: true,
  *   completeAt: Millis.orThrow(1000),
  *   lastSentAt: Millis.orThrow(900),
  *   lastReceivedAt: Millis.orThrow(1000),
- *   error: null,
  * };
  * const state: SyncState = {
  *   transports: [transport],
  *   tenants: [
  *     {
+ *       type: "Active",
  *       name: testName,
- *       refused: false,
  *       owners: [
- *         {
- *           ownerId: testAppOwner.id,
- *           writable: true,
- *           transportIds: [transport.id],
- *           routes: [route],
- *         },
+ *         { type: "Writable", ownerId: testAppOwner.id, routes: [route] },
  *       ],
  *     },
  *   ],
  * };
  *
- * assertEqual(syncStateToOwnerSyncStates(state), [
- *   {
- *     name: testName,
- *     ownerId: testAppOwner.id,
- *     status: "synced",
- *     syncedAt: Millis.orThrow(1000),
- *     error: null,
- *     relays: [{ transport, route, status: "synced" }],
- *   },
- * ]);
+ * const relays = syncStateToRelaySyncStates(
+ *   state,
+ *   testName,
+ *   testAppOwner.id,
+ * );
+ * assertEqual(relays, [{ transport, route }]);
+ * assertEqual(relays.map(relaySyncStateToStatus), [{ type: "Synced" }]);
+ * assertEqual(
+ *   syncStateToRelaySyncStates(null, testName, testAppOwner.id),
+ *   [],
+ * );
  * ```
  */
-export const syncStateToOwnerSyncStates = (state) => {
-    const transportById = new Map(state.transports.map((transport) => [transport.id, transport]));
-    return state.tenants.flatMap(({ name, refused, owners }) => refused
-        ? []
-        : owners.flatMap(({ ownerId, writable, routes }) => {
-            if (!writable)
-                return [];
-            let syncedAt = null;
-            let error = null;
-            const relays = [];
-            for (const route of routes) {
-                if (route.completeAt !== null &&
-                    (syncedAt === null || route.completeAt > syncedAt))
-                    syncedAt = route.completeAt;
-                if (route.error !== null &&
-                    (error === null || route.error.at > error.at))
-                    error = route.error;
-                // A snapshot lists the transport of every route.
-                const transport = transportById.get(route.transportId);
-                assertNonNullable(transport);
-                relays.push({
-                    transport,
-                    route,
-                    status: route.error !== null
-                        ? "error"
-                        : route.complete
-                            ? "synced"
-                            : transport.readyState === "open"
-                                ? "syncing"
-                                : "offline",
-                });
-            }
-            const status = ["error", "syncing", "synced", "offline"].find((candidate) => relays.some((relay) => relay.status === candidate)) ?? "initial";
-            return [{ name, ownerId, status, syncedAt, error, relays }];
-        }));
+export const syncStateToRelaySyncStates = (state, name, ownerId) => {
+    const tenant = state?.tenants.find((tenant) => tenant.name === name);
+    if (!state || tenant?.type !== "Active")
+        return emptyArray;
+    const owner = tenant.owners.find((owner) => owner.ownerId === ownerId);
+    if (owner?.type !== "Writable")
+        return emptyArray;
+    return owner.routes.map((route) => {
+        // A snapshot lists the transport of every route.
+        const transport = state.transports.find(({ id }) => id === route.transportId);
+        assertNonNullable(transport);
+        return { transport, route };
+    });
+};
+/** Tells the status of one relay; a failure shows before a skipped change. */
+export const relaySyncStateToStatus = ({ transport, route, }) => {
+    switch (route.type) {
+        case "Complete":
+            return syncedSyncStatus;
+        case "Settled":
+            return syncRouteErrorToSyncStatus(route.skippedError);
+        case "Pending": {
+            const error = route.failure ?? route.skippedError;
+            if (error)
+                return syncRouteErrorToSyncStatus(error);
+            return transport.connection.type === "Disconnected"
+                ? offlineSyncStatus
+                : syncingSyncStatus;
+        }
+    }
+};
+// Every status keeps its reference while it is unchanged, so bindings compare
+// statuses with `===`. The store shares an unchanged error object between
+// snapshots, and an error gives the same Error status object.
+const noRelaysSyncStatus = { type: "NoRelays" };
+const syncingSyncStatus = { type: "Syncing" };
+const syncedSyncStatus = { type: "Synced" };
+const offlineSyncStatus = { type: "Offline" };
+const errorSyncStatusByError = /*#__PURE__*/ new WeakMap();
+const syncRouteErrorToSyncStatus = (error) => {
+    let status = errorSyncStatusByError.get(error);
+    if (!status) {
+        status = { type: "Error", error };
+        errorSyncStatusByError.set(error, status);
+    }
+    return status;
 };
 /**
  * How long an unanswered request keeps a socket before it is replaced.
@@ -426,8 +648,78 @@ const syncRequestTimeout = PositiveMillis.orThrow(90_000);
  * {@link syncRequestTimeout}, which covers a 1 MB frame at about 6 kbit/s.
  */
 const maxSyncRequestTimeout = PositiveMillis.orThrow(16 * syncRequestTimeout);
+const connectingSyncConnection = {
+    type: "Connecting",
+};
+/**
+ * A connection already disconnected keeps when it disconnected, so failed
+ * reconnect attempts only record their error.
+ */
+const disconnectSyncConnection = (connection, at, error) => {
+    switch (connection.type) {
+        case "Connecting":
+            return {
+                type: "Disconnected",
+                disconnectedAt: at,
+                openedAt: null,
+                error,
+            };
+        case "Open":
+            return {
+                type: "Disconnected",
+                disconnectedAt: at,
+                openedAt: connection.openedAt,
+                error: error ?? connection.error,
+            };
+        case "Disconnected":
+            return error ? { ...connection, error } : connection;
+    }
+};
 const allTransports = { type: "AllTransports" };
 const isTargetTransport = (target, transport) => target.type === "AllTransports" || target.key === structuralLookup(transport);
+const routeToPending = (progress) => {
+    switch (progress.type) {
+        case "Pending":
+            return progress;
+        case "Settled":
+            return {
+                type: "Pending",
+                roundRequired: false,
+                failure: null,
+                skip: { error: progress.error, isRechecking: false },
+                completeAt: progress.completeAt,
+            };
+        case "Complete":
+            return {
+                type: "Pending",
+                roundRequired: false,
+                failure: null,
+                skip: null,
+                completeAt: progress.completeAt,
+            };
+    }
+};
+/**
+ * Converts an error to a {@link SyncRouteError}: a caught value becomes an
+ * {@link UnknownError}, and a {@link ProtocolInvalidDataError} leaves out its
+ * data.
+ */
+const errorToSyncRouteError = (error, at) => {
+    // A caught value inside an error becomes an UnknownError, and a
+    // ProtocolInvalidDataError leaves out its data, which can be a whole frame.
+    if (error.type === "ProtocolInvalidDataError") {
+        const { data: _data, ...rest } = error;
+        return { ...rest, error: createUnknownError(rest.error), at };
+    }
+    if (error.type === "DecryptWithXChaCha20Poly1305Error")
+        return { ...error, error: createUnknownError(error.error), at };
+    return { ...error, at };
+};
+const failRoute = (progress, failure) => ({
+    ...routeToPending(progress),
+    roundRequired: true,
+    failure,
+});
 // Long enough for another build's tabs to reload and its worker to end.
 const otherBuildRunningReportDelay = "3s";
 /**
@@ -519,8 +811,14 @@ export const initSharedWorker = (self) => async (run) => {
                 }
             });
         };
-        // Released after every tenant and DbWorker is disposed. Earlier releases
-        // take the same lock in their leader tab; see Builds.
+        // Held while this worker runs. Its DbWorkers stop once they can take it,
+        // because a Dispose posted right before this worker closes can be lost, as
+        // in Firefox. Taken before the build lock, so nothing delays the end of
+        // starting once that lock is held.
+        disposer.use(await run.ok(acquireLeaderLock(workerId)));
+        // Released after every tenant is disposed and has told its DbWorker to
+        // stop. Earlier releases take the same lock in their leader tab; see
+        // Builds.
         disposer.use(await run.ok(acquireLeaderLock("tab")));
         starting.dispose();
         // Checked once, before any DbWorker starts, so every DbWorker of this
@@ -549,51 +847,85 @@ export const initSharedWorker = (self) => async (run) => {
                 isPublishScheduled = false;
                 if (isDisposed)
                     return;
-                const transports = [...transportsByKey.values()].map(({ id, label, socket, openedAt, closedAt, error, }) => ({
+                const transports = [...transportsByKey.values()].map(({ id, label, connection }) => ({
+                    type: "WebSocket",
                     id,
                     label,
-                    // The transport drops its socket before disposal, so this never
-                    // reads a disposed one.
-                    readyState: socket?.getReadyState() ?? "connecting",
-                    openedAt,
-                    closedAt,
-                    error,
+                    connection,
                 }));
+                // A grown timeout lasts while a request is outstanding on the socket
+                // or a database that has not refused startup has an unsettled route
+                // through it. Every change to either publishes, including a route that
+                // goes away without settling.
+                const unsettledTransportIds = new Set();
                 const tenants = [...currentTenantsByName.values()].map((tenant) => {
-                    const { name, refused, owners } = tenant.getSyncTenant();
+                    const state = tenant.getSyncTenant();
+                    if (state.type === "Refused")
+                        return state;
                     return {
-                        name,
-                        refused,
-                        owners: owners.map(({ ownerId, writable, transportKeys, routes }) => ({
-                            ownerId,
-                            writable,
-                            transportIds: transportKeys.flatMap((key) => {
-                                const entry = transportsByKey.get(key);
-                                return entry ? [entry.id] : [];
-                            }),
-                            routes: routes.flatMap(({ transportKey, ...route }) => {
-                                const entry = transportsByKey.get(transportKey);
-                                return entry ? [{ transportId: entry.id, ...route }] : [];
+                        type: "Active",
+                        name: state.name,
+                        owners: state.owners.map((owner) => owner.type === "Readonly"
+                            ? {
+                                type: "Readonly",
+                                ownerId: owner.ownerId,
+                                transportIds: owner.transportKeys.flatMap((key) => {
+                                    const entry = transportsByKey.get(key);
+                                    return entry ? [entry.id] : [];
+                                }),
+                            }
+                            : {
+                                type: "Writable",
+                                ownerId: owner.ownerId,
+                                routes: owner.routes.flatMap(({ transportKey, progress, lastSentAt, lastReceivedAt, }) => {
+                                    const entry = transportsByKey.get(transportKey);
+                                    if (!entry)
+                                        return [];
+                                    const transportId = entry.id;
+                                    if (progress.type !== "Pending") {
+                                        // Only a sent round settles a route or completes
+                                        // it.
+                                        assertNonNullable(lastSentAt);
+                                        return [
+                                            progress.type === "Complete"
+                                                ? {
+                                                    type: "Complete",
+                                                    transportId,
+                                                    completeAt: progress.completeAt,
+                                                    lastSentAt,
+                                                    lastReceivedAt,
+                                                }
+                                                : {
+                                                    type: "Settled",
+                                                    transportId,
+                                                    skippedError: progress.error,
+                                                    completeAt: progress.completeAt,
+                                                    lastSentAt,
+                                                    lastReceivedAt,
+                                                },
+                                        ];
+                                    }
+                                    // Only a database that has not refused startup
+                                    // publishes routes.
+                                    unsettledTransportIds.add(transportId);
+                                    return [
+                                        {
+                                            type: "Pending",
+                                            transportId,
+                                            failure: progress.failure,
+                                            skippedError: progress.skip?.error ?? null,
+                                            completeAt: progress.completeAt,
+                                            lastSentAt,
+                                            lastReceivedAt,
+                                        },
+                                    ];
+                                }),
                             }),
-                        })),
                     };
                 });
-                // A grown timeout lasts while a request is outstanding on the socket
-                // or a database that has not refused startup has an incomplete route
-                // through it. Every change to either publishes, including a route that
-                // goes away without completing.
-                const incompleteTransportIds = new Set();
-                for (const { refused, owners } of tenants) {
-                    if (refused)
-                        continue;
-                    for (const { routes } of owners)
-                        for (const { transportId, complete } of routes)
-                            if (!complete)
-                                incompleteTransportIds.add(transportId);
-                }
                 for (const entry of transportsByKey.values())
                     if (entry.outstandingByOwnerId.size === 0 &&
-                        !incompleteTransportIds.has(entry.id))
+                        !unsettledTransportIds.has(entry.id))
                         entry.timeout = syncRequestTimeout;
                 syncStateBroadcastChannel.postMessage({ transports, tenants });
             });
@@ -642,10 +974,10 @@ export const initSharedWorker = (self) => async (run) => {
                 entry.timeout = PositiveMillis.orThrow(Math.min(entry.timeout * 2, maxSyncRequestTimeout));
                 // Reconnecting abandons the connection and starts a fresh retry
                 // schedule. The socket reports no close for it, so the transport
-                // records the moment here.
+                // disconnects here.
                 entry.socket?.reconnect();
-                // `now` is monotonic; the reported close time is wall clock.
-                entry.closedAt = deps.time.now();
+                // `now` is monotonic; the reported time is wall clock.
+                entry.connection = disconnectSyncConnection(entry.connection, deps.time.now(), null);
                 refreshAllSyncRoutes();
                 publishSyncState();
             }, delay);
@@ -684,9 +1016,7 @@ export const initSharedWorker = (self) => async (run) => {
                     outstandingByOwnerId: new Map(),
                     timeout: syncRequestTimeout,
                     socket: null,
-                    openedAt: null,
-                    closedAt: null,
-                    error: null,
+                    connection: connectingSyncConnection,
                     timeoutId: null,
                 };
                 const disposer = __addDisposableResource(env_2, new AsyncDisposableStack(), true);
@@ -706,7 +1036,15 @@ export const initSharedWorker = (self) => async (run) => {
                         // answered.
                         entry.outstandingByOwnerId.clear();
                         clearSyncRequestTimeout(entry);
-                        entry.openedAt = run.deps.time.now();
+                        // A connection that opens keeps the last error of an earlier
+                        // one.
+                        entry.connection = {
+                            type: "Open",
+                            openedAt: run.deps.time.now(),
+                            error: entry.connection.type === "Connecting"
+                                ? null
+                                : entry.connection.error,
+                        };
                         publishSyncState();
                         const ownerIds = transports.getClaimsForResource(transport);
                         console.debug("transportOpen", {
@@ -728,7 +1066,7 @@ export const initSharedWorker = (self) => async (run) => {
                             code: event.code,
                             wasClean: event.wasClean,
                         });
-                        entry.closedAt = run.deps.time.now();
+                        entry.connection = disconnectSyncConnection(entry.connection, run.deps.time.now(), null);
                         clearSyncRequestTimeout(entry);
                         refreshAllSyncRoutes();
                         publishSyncState();
@@ -738,10 +1076,13 @@ export const initSharedWorker = (self) => async (run) => {
                             url: transport.url,
                             type: error.type,
                         });
-                        entry.error = {
-                            type: error.type,
-                            at: run.deps.time.now(),
-                        };
+                        // Every error disconnects. A browser reports a failed
+                        // attempt only as an error, because the socket stops
+                        // listening before its close arrives. A connection error
+                        // arrives once the socket is closed, before its close, and
+                        // exhausted retries end reconnecting.
+                        const now = run.deps.time.now();
+                        entry.connection = disconnectSyncConnection(entry.connection, now, { type: error.type, at: now });
                         refreshAllSyncRoutes();
                         publishSyncState();
                     },
@@ -794,9 +1135,8 @@ export const initSharedWorker = (self) => async (run) => {
                 // LIFO: the transport drops its timer and its socket reference
                 // before the socket is disposed. `disposable` guards every method
                 // of the socket the claims lease, and disposing the socket awaits
-                // its retry, so a `publishSyncState` microtask can run while this
-                // entry is still registered. It must find no socket rather than
-                // read a disposed one.
+                // its retry, so this entry stays registered meanwhile. It keeps its
+                // last connection and holds no socket to reconnect.
                 disposer.defer(() => {
                     clearSyncRequestTimeout(entry);
                     entry.socket = null;
@@ -855,7 +1195,7 @@ export const initSharedWorker = (self) => async (run) => {
         }));
         const tenantsByName = disposer.use(await sharedWorkerRun.ok(createSharedResourceByKey((message) => createEvoluTenant(isPersistentStorageUnavailable
             ? { ...message, memoryOnly: true }
-            : message, currentTenantsByName), {
+            : message, currentTenantsByName, workerId), {
             idleDisposeAfter: "3s",
             lookup: (message) => message.name,
         })));
@@ -876,7 +1216,7 @@ export const initSharedWorker = (self) => async (run) => {
             await result_1;
     }
 };
-const createEvoluTenant = ({ name, consoleLevel, sqliteSchema, encryptionKey, memoryOnly, }, currentTenantsByName) => async (run) => {
+const createEvoluTenant = ({ name, consoleLevel, sqliteSchema, encryptionKey, memoryOnly, }, currentTenantsByName, workerId) => async (run) => {
     const env_3 = { stack: [], error: void 0, hasError: false };
     try {
         const disposer = __addDisposableResource(env_3, new AsyncDisposableStack(), true);
@@ -1026,6 +1366,7 @@ const createEvoluTenant = ({ name, consoleLevel, sqliteSchema, encryptionKey, me
                 sqliteSchema,
                 encryptionKey,
                 memoryOnly,
+                sharedWorkerId: workerId,
                 port: dbWorkerChannel.port1.native,
             }, [dbWorkerChannel.port1.native]);
         };
@@ -1126,31 +1467,16 @@ const createEvoluTenant = ({ name, consoleLevel, sqliteSchema, encryptionKey, me
                 });
             }
         };
-        disposer.defer(async () => {
-            const env_5 = { stack: [], error: void 0, hasError: false };
-            try {
-                isDisposing = true;
-                dbWorkerPort?.postMessage({ type: "Dispose" });
-                dbWorkerPort = null;
-                activeDispatch = null;
-                // The DbWorker holds this tenant leader lock while it is alive. Tenant
-                // disposal sends Dispose, then acquires the same lock to wait until the
-                // DbWorker releases it: either because Dispose was delivered or because
-                // the hosting tab closed. A worker requested from a later tab leader may
-                // be queued for the lock first; it is told to stop when it reports in.
-                // The wait is unabortable because tenant disposal must finish even after
-                // tenantRun receives an abort request.
-                const _ = __addDisposableResource(env_5, await tenantRun.ok(acquireLeaderLock(name)), true);
-            }
-            catch (e_5) {
-                env_5.error = e_5;
-                env_5.hasError = true;
-            }
-            finally {
-                const result_5 = __disposeResources(env_5);
-                if (result_5)
-                    await result_5;
-            }
+        // Disposal does not wait for the DbWorker. It holds the database lock
+        // until Dispose arrives, its tab closes, or this worker ends, and the next
+        // DbWorker for this database, of this worker or another build, waits for
+        // that lock before it reads the clock. A requested DbWorker that reports
+        // in later gets Dispose from the isDisposing check.
+        disposer.defer(() => {
+            isDisposing = true;
+            dbWorkerPort?.postMessage({ type: "Dispose" });
+            dbWorkerPort = null;
+            activeDispatch = null;
         });
         const handleResponseForEvolu = (response, first) => {
             // A disposed instance gets no patches, but its committed write still
@@ -1198,9 +1524,36 @@ const createEvoluTenant = ({ name, consoleLevel, sqliteSchema, encryptionKey, me
                     }
                     break;
                 }
+                case "MutateFailed": {
+                    // The tab shows it, and the instance releases the mutation's
+                    // onComplete callbacks without running them. A write outlives its
+                    // instance, so without one, every tab is told.
+                    //
+                    // A replay after leader replacement can fail although the earlier
+                    // leader committed the write and only its answer was lost. The tab
+                    // then shows an error for a stored write, and its onComplete
+                    // callbacks never run. Nothing is lost or reused: the replacement
+                    // adopted the stored clock, refreshed every instance's queries, and
+                    // reconciles every used owner.
+                    const { error } = response.message;
+                    if (instance) {
+                        assertSame(first.message.type, "Mutate");
+                        instance.tabPort.postMessage({ type: "Error", error });
+                        instance.port.postMessage({
+                            type: "OnMutateFailed",
+                            onCompleteIds: first.message.onCompleteIds,
+                        });
+                    }
+                    else {
+                        deps.postConsoleEntryOrError({ type: "Error", error });
+                    }
+                    break;
+                }
                 case "Export":
                     instance?.port.postMessage({ type: "OnExport", file: response.message.file }, [response.message.file.buffer]);
                     break;
+                default:
+                    exhaustiveCheck(response.message);
             }
         };
         const routesByOwnerIdByKey = new Map();
@@ -1213,12 +1566,15 @@ const createEvoluTenant = ({ name, consoleLevel, sqliteSchema, encryptionKey, me
             let route = routesByOwnerId.get(ownerId);
             if (!route) {
                 route = {
-                    roundRequired: true,
-                    complete: false,
-                    completeAt: null,
+                    progress: {
+                        type: "Pending",
+                        roundRequired: true,
+                        failure: null,
+                        skip: null,
+                        completeAt: null,
+                    },
                     lastSentAt: null,
                     lastReceivedAt: null,
-                    error: null,
                 };
                 routesByOwnerId.set(ownerId, route);
             }
@@ -1277,19 +1633,27 @@ const createEvoluTenant = ({ name, consoleLevel, sqliteSchema, encryptionKey, me
                     // worker answers it. Local-only changes create no synchronization
                     // work.
                     const hasQueuedWrite = pendingWriteCountByOwnerId.has(ownerId);
-                    // A refused database synchronizes nothing, and refusal discards its
-                    // queued writes without uploading them.
-                    const complete = startupError === null &&
-                        isOpen &&
+                    const isReconciled = isOpen &&
                         deps.syncRequests.getOutstanding(ownerId, key) === 0 &&
                         !hasQueuedApply &&
-                        !hasQueuedWrite &&
-                        !route.roundRequired;
-                    if (complete && !route.complete) {
-                        route.completeAt = deps.time.now();
-                        route.error = null;
-                    }
-                    route.complete = complete;
+                        !hasQueuedWrite;
+                    // Settling drops the failure, so the next one requests a round
+                    // again. A route with a skip it is not rechecking settles without
+                    // completing, because its relay may offer the skipped message or
+                    // lack messages stored elsewhere.
+                    const pending = routeToPending(route.progress);
+                    route.progress =
+                        !isReconciled || pending.roundRequired
+                            ? pending
+                            : pending.skip && !pending.skip.isRechecking
+                                ? {
+                                    type: "Settled",
+                                    error: pending.skip.error,
+                                    completeAt: pending.completeAt,
+                                }
+                                : route.progress.type === "Complete"
+                                    ? route.progress
+                                    : { type: "Complete", completeAt: deps.time.now() };
                 }
             }
         };
@@ -1313,8 +1677,10 @@ const createEvoluTenant = ({ name, consoleLevel, sqliteSchema, encryptionKey, me
                                 ?.get(ownerId);
                             if (!route)
                                 return;
-                            route.roundRequired = true;
-                            route.error = { type: "SyncFailed", at: now };
+                            route.progress = failRoute(route.progress, {
+                                type: "SyncFailed",
+                                at: now,
+                            });
                         });
                     }
                     deps.publishSyncState();
@@ -1327,6 +1693,8 @@ const createEvoluTenant = ({ name, consoleLevel, sqliteSchema, encryptionKey, me
                     const { ownerId, result } = response.message;
                     const error = result.ok ? null : result.error;
                     const isAborted = error?.type === "AbortError";
+                    // An aborted apply reports no skipped message.
+                    const skippedError = isAborted ? null : response.message.skippedError;
                     let failure = null;
                     if (isAborted) {
                         // An abort proves no convergence. A local sibling copy affects
@@ -1338,19 +1706,22 @@ const createEvoluTenant = ({ name, consoleLevel, sqliteSchema, encryptionKey, me
                                 return;
                             const route = routesByOwnerIdByKey.get(key)?.get(ownerId);
                             if (route)
-                                route.roundRequired = true;
+                                route.progress = {
+                                    ...routeToPending(route.progress),
+                                    roundRequired: true,
+                                };
                         });
                     }
                     else if (error !== null) {
-                        failure = error.type;
-                        deps.postConsoleEntryOrError({
-                            type: "Error",
-                            error,
-                        });
+                        // A relay's error shows on its route, not as an EvoluError,
+                        // because it belongs to one relay and often repeats in every
+                        // round. A sibling copy's error is reported below.
+                        failure = error;
                     }
                     else if (result.ok && result.value.type === "Failed") {
-                        failure =
-                            result.value.cause === "Write" ? "WriteFailed" : "SyncFailed";
+                        failure = {
+                            type: result.value.cause === "Write" ? "WriteFailed" : "SyncFailed",
+                        };
                     }
                     if (source.type === "Transport") {
                         // A registration or claim may have been removed while this apply
@@ -1361,36 +1732,63 @@ const createEvoluTenant = ({ name, consoleLevel, sqliteSchema, encryptionKey, me
                             // An aborted apply applied nothing.
                             if (!isAborted)
                                 route.lastReceivedAt = now;
+                            // A skipped message is recorded as the route's skip, not a
+                            // failure, and does not end the round, whose response below is
+                            // still sent, so it requests no round. The relay offers the
+                            // message again in every later round, so the route stays
+                            // incomplete until a round requested through it settles without
+                            // skipping a message and without messages stored elsewhere since
+                            // that request.
+                            if (skippedError !== null)
+                                route.progress = {
+                                    ...routeToPending(route.progress),
+                                    skip: {
+                                        error: errorToSyncRouteError(skippedError, now),
+                                        isRechecking: false,
+                                    },
+                                };
                             if (failure !== null) {
-                                // The first failure since the route completed requests one
+                                // The first failure since the route settled requests one
                                 // round. Further failures wait for an explicit request or a
                                 // reopen, even after a converged reply, which may answer
                                 // another request.
-                                if (route.error === null)
+                                const requestsRetry = route.progress.type !== "Pending" ||
+                                    route.progress.failure === null;
+                                route.progress = failRoute(route.progress, errorToSyncRouteError(failure, now));
+                                if (requestsRetry)
                                     requestCreateSyncMessages(new Set([ownerId]), source);
-                                route.roundRequired = true;
-                                route.error = { type: failure, at: now };
                             }
                         }
                     }
-                    else if (failure !== null) {
-                        // A sibling's messages were not stored; rounds fetch them from
-                        // the relays.
-                        requestCreateSyncMessages(new Set([ownerId]), allTransports);
+                    else if (failure !== null || skippedError !== null) {
+                        // A sibling's copy comes from this worker, not from a relay, so no
+                        // route shows its failure. It is a Broadcast, which carries no
+                        // relay error, so an error or a skip means a bug, such as
+                        // databases holding different keys for the owner, and is reported
+                        // as an unexpected failure. A Failed result was logged, which
+                        // reports it already. An error is the failure, which is never an
+                        // abort, and like a route, the report leaves out its frame.
+                        const unexpected = error !== null ? failure : skippedError;
+                        if (unexpected !== null)
+                            deps.postConsoleEntryOrError({
+                                type: "Error",
+                                error: createUnknownError(errorToSyncRouteError(unexpected, deps.time.now())),
+                            });
+                        // Some of a sibling's messages were not stored; rounds fetch them
+                        // from the relays, whose routes then record a skip for any message
+                        // this database skips.
+                        requestRoundsForReceivedMessages(ownerId, {
+                            except: null,
+                            afterQueuedWrites: true,
+                        });
                     }
                     if (response.message.didWriteMessages) {
                         refreshQueries();
                         // Reconcile newly stored messages through each other transport.
-                        // Rounds toward the same transport coalesce whatever their source.
-                        const keys = [];
-                        deps.transports.forEachResourceForClaim(ownerId, (_, transport) => {
-                            if (isTargetTransport(target, transport))
-                                return;
-                            keys.push(structuralLookup(transport));
+                        requestRoundsForReceivedMessages(ownerId, {
+                            except: target,
+                            afterQueuedWrites: false,
                         });
-                        for (const key of keys) {
-                            requestCreateSyncMessages(new Set([ownerId]), { type: "Transport", key }, { afterQueuedWrites: false });
-                        }
                     }
                     if (result.ok) {
                         switch (result.value.type) {
@@ -1443,13 +1841,49 @@ const createEvoluTenant = ({ name, consoleLevel, sqliteSchema, encryptionKey, me
                     const route = getRoute(ownerId, key);
                     route.lastSentAt = deps.time.now();
                     if (isRound)
-                        route.roundRequired = false;
+                        route.progress = {
+                            ...routeToPending(route.progress),
+                            roundRequired: false,
+                        };
                 });
             }
             // Sends raise counters shared by every tenant; one refresh covers them.
             if (protocolMessagesByOwnerId.size > 0)
                 deps.refreshAllSyncRoutes();
         };
+        /**
+         * Requests a round through each transport claimed for the owner outside
+         * `except`, after messages from elsewhere were stored or a sibling copy was
+         * not fully stored. Rounds toward the same transport coalesce whatever
+         * their source. A route that skipped a message gets none, because its relay
+         * would offer that message again, and a route rechecking one stops
+         * rechecking, because its round may have read the database before this
+         * event. A later requested round through such a route reconciles it.
+         */
+        const requestRoundsForReceivedMessages = (ownerId, { except, afterQueuedWrites, }) => {
+            const keys = [];
+            deps.transports.forEachResourceForClaim(ownerId, (_, transport) => {
+                if (except && isTargetTransport(except, transport))
+                    return;
+                const key = structuralLookup(transport);
+                const route = routesByOwnerIdByKey.get(key)?.get(ownerId);
+                if (route?.progress.type === "Settled")
+                    return;
+                if (route?.progress.type === "Pending" && route.progress.skip) {
+                    // A round already requested may have read the database before these
+                    // messages were stored, so it can no longer complete the route.
+                    route.progress = {
+                        ...route.progress,
+                        skip: { ...route.progress.skip, isRechecking: false },
+                    };
+                    return;
+                }
+                keys.push(key);
+            });
+            for (const key of keys) {
+                requestCreateSyncMessages(new Set([ownerId]), { type: "Transport", key }, { afterQueuedWrites });
+            }
+        };
         /** The keys of every transport claimed for the owner, by any database. */
         const getClaimedKeys = (ownerId) => [...deps.transports.getResourceKeysForClaim(ownerId)].map(structuralLookup);
         const getUsedOwnersById = (ownerIds) => {
@@ -1468,12 +1902,19 @@ const createEvoluTenant = ({ name, consoleLevel, sqliteSchema, encryptionKey, me
                 return;
             const usedOwnersById = getUsedOwnersById(ownerIds);
             // Opening, storing messages from another transport, a failure, and an
-            // explicit request each require a new round before completion.
+            // explicit request each require a new round before completion. The
+            // round also checks again whether the relay holds a skipped message.
             for (const ownerId of usedOwnersById.keys()) {
                 deps.transports.forEachResourceForClaim(ownerId, (_, transport) => {
                     if (!isTargetTransport(target, transport))
                         return;
-                    getRoute(ownerId, structuralLookup(transport)).roundRequired = true;
+                    const route = getRoute(ownerId, structuralLookup(transport));
+                    const pending = routeToPending(route.progress);
+                    route.progress = {
+                        ...pending,
+                        roundRequired: true,
+                        skip: pending.skip && { ...pending.skip, isRechecking: true },
+                    };
                 });
             }
             refreshSyncRoutes();
@@ -1599,31 +2040,28 @@ const createEvoluTenant = ({ name, consoleLevel, sqliteSchema, encryptionKey, me
             deps.publishSyncState();
         });
         const tenant = disposable({
-            getSyncTenant: () => ({
-                name,
-                refused: startupError !== null,
-                owners: getSyncOwners().map(({ ownerId, writable, transportKeys }) => ({
-                    ownerId,
-                    writable,
-                    transportKeys,
-                    routes: writable
-                        ? transportKeys.map((key) => {
-                            const route = routesByOwnerIdByKey.get(key)?.get(ownerId);
-                            // Registration and claim changes refresh routes before yielding.
-                            // Snapshot reads must not create missing routes.
-                            assertNotUndefined(route);
-                            return {
-                                transportKey: key,
-                                complete: route.complete,
-                                completeAt: route.completeAt,
-                                lastSentAt: route.lastSentAt,
-                                lastReceivedAt: route.lastReceivedAt,
-                                error: route.error,
-                            };
-                        })
-                        : [],
-                })),
-            }),
+            getSyncTenant: () => startupError
+                ? { type: "Refused", name, error: startupError }
+                : {
+                    type: "Active",
+                    name,
+                    owners: getSyncOwners().map(({ ownerId, writable, transportKeys }) => writable
+                        ? {
+                            type: "Writable",
+                            ownerId,
+                            routes: transportKeys.map((key) => {
+                                const route = routesByOwnerIdByKey
+                                    .get(key)
+                                    ?.get(ownerId);
+                                // Registration and claim changes refresh routes
+                                // before yielding. Snapshot reads must not create
+                                // missing routes.
+                                assertNotUndefined(route);
+                                return { transportKey: key, ...route };
+                            }),
+                        }
+                        : { type: "Readonly", ownerId, transportKeys }),
+                },
             refreshSyncRoutes,
             addInstance: (message, tabPort, onDisposed) => {
                 const disposer = new AsyncDisposableStack();
@@ -1646,18 +2084,20 @@ const createEvoluTenant = ({ name, consoleLevel, sqliteSchema, encryptionKey, me
                 };
                 instancesById.set(instance.id, instance);
                 disposer.defer(instance.onDisposed);
-                disposer.defer(async () => {
-                    await tenantRun(instance.useOwnerMutex.withLock(() => {
-                        for (const leases of instance.ownerRegistrations.values()) {
-                            for (const lease of leases)
-                                lease?.release();
-                        }
-                        instance.ownerRegistrations.clear();
-                        deps.refreshAllSyncRoutes();
-                        deps.publishSyncState();
-                        return ok();
-                    }));
+                disposer.defer(() => {
+                    for (const leases of instance.ownerRegistrations.values()) {
+                        for (const lease of leases)
+                            lease?.release();
+                    }
+                    instance.ownerRegistrations.clear();
+                    deps.refreshAllSyncRoutes();
+                    deps.publishSyncState();
                 });
+                // Cleanup starts no Task, because a root abort may dispose every Run
+                // first. Disposed before the claims above are released, this Run
+                // aborts queued UseOwner batches and waits for the running one, whose
+                // transport claim cannot be aborted, so the release sees every lease.
+                const instanceRun = disposer.use(tenantRun.create());
                 disposer.defer(() => {
                     instancesById.delete(instance.id);
                     refreshSyncRoutes();
@@ -1671,7 +2111,7 @@ const createEvoluTenant = ({ name, consoleLevel, sqliteSchema, encryptionKey, me
                 // while it is alive. Acquiring the same lock here means the main
                 // thread instance was disposed or its tab closed, so the tenant-side
                 // instance must dispose itself.
-                void tenantRun
+                void instanceRun
                     .abortable(acquireLeaderLock(message.id))
                     .then((lock) => {
                     if (!lock.ok)
@@ -1712,7 +2152,7 @@ const createEvoluTenant = ({ name, consoleLevel, sqliteSchema, encryptionKey, me
                             break;
                         }
                         case "UseOwner": {
-                            void tenantRun(instance.useOwnerMutex.withLock(async (run) => {
+                            void instanceRun(instance.useOwnerMutex.withLock(async (run) => {
                                 for (const action of message.actions) {
                                     switch (action.action) {
                                         case "sync":
@@ -1808,14 +2248,14 @@ const createEvoluTenant = ({ name, consoleLevel, sqliteSchema, encryptionKey, me
 //       readonly reload: boolean;
 //     })
 // TODO: SharedWorker follow-ups.
-// - Complete the queue head when a DbWorker mutation returns an error.
 // - Rotate the node ID when a copied database is detected; see the Duplicate
 //   node IDs section in the Timestamp module.
 // - Detect DbWorker and port liveness so a worker-only crash resumes the queue.
 //   Defer panicked-worker restart until failure detection and recovery are
-//   defined, accounting for SQLite WASM's detection limits. Normal SQLite
-//   operations are expected not to throw; user-defined UNIQUE indexes, which
-//   can make replicated writes fail, are planned to be forbidden.
+//   defined, accounting for SQLite WASM's detection limits. A mutation that
+//   throws is answered, but other SQLite operations are expected not to throw;
+//   user-defined UNIQUE indexes, which can make replicated writes fail, are
+//   planned to be forbidden.
 // - Split worker protocol types and the EvoluTenant implementation into focused
 //   modules.
 // - Remove the obsolete commented protocol block above.