@evolu/common 8.12.0 → 8.14.0

package/src/local-first/Shared.ts

@@ -53,7 +53,9 @@
  * still waiting after three seconds reports {@link OtherBuildRunningError} to
  * its tabs. Every build broadcasts console entries and errors on
  * {@link consoleEntryOrErrorBroadcastChannelName}, so a waiting tab also prints
- * the running build's output and reports its errors as its own `evoluError`.
+ * the running build's output, reports each {@link UnknownError} it sends as its
+ * own `evoluError`, and only logs any other error, such as an older build's
+ * sync error.
  *
  * The tabs of one worker elect the host of its DbWorkers among themselves, with
  * a lock scoped to the worker, so a tab of another worker never hosts them.
@@ -67,13 +69,20 @@
  *
  * ## Storage
  *
- * A platform that can lack persistent storage, as a browser does in Safari's
- * Private Browsing, provides {@link PersistentStorageDep}. The worker checks it
- * once, after it takes the build lock and before any DbWorker starts. Without
- * persistent storage, every DbWorker it starts keeps its database in memory,
- * replacements included, and each tab that connects is told with
- * `StorageUnavailable`. The decision holds for the worker's lifetime, so all
- * its tabs see one mode, and the next worker checks again.
+ * The platform tells the worker with {@link DevicePersistenceDep} what it can
+ * promise about stored databases. The worker asks once, after it takes the
+ * build lock and before any DbWorker starts. A browser checks whether it can
+ * open the origin private file system, which Safari's Private Browsing and
+ * Firefox's private windows refuse. Without persistent storage, every DbWorker
+ * the worker starts keeps its database in memory, replacements included. The
+ * decision holds for the worker's lifetime, so all its tabs see one mode, and
+ * the next worker checks again.
+ *
+ * A tenant tells each instance it adds its {@link Evolu.devicePersistence}:
+ * `NotPersisted` when its database is kept in memory, because of the platform
+ * or {@link EvoluConfig.memoryOnly}, otherwise what the platform promised.
+ * Instances of one name share the tenant, so a later instance gets the mode the
+ * first one chose.
  *
  * The check cannot tell a private session from a storage failure, but memory
  * loses nothing that refusing to start would have kept, and the persistent
@@ -100,7 +109,8 @@
  * writable registrations for its owner, whichever instance made it, even one
  * disposed before the database worker answered. When a relay frame stores new
  * messages, the tenant requests a round through each other transport claimed
- * for the owner, so data learned from one relay reaches the others. A closed
+ * for the owner, so data learned from one relay reaches the others, except
+ * through a route that skipped a message, as described below. A closed
  * transport reconciles when it opens, and a replacement leader reconciles every
  * transport again, because a response reporting stored messages may have been
  * lost.
@@ -109,26 +119,34 @@
  * also delivers it as local Broadcast frames to every other tenant with
  * writable access to the owner, even while sockets are closed. A copy keeps the
  * uploader's target, and a recipient that stores new continuation messages
- * reconciles them through the transports outside that target. Local delivery
- * forwards uploads, including historical messages sent during reconciliation,
- * but does not reconcile local database histories with each other. That waits
- * until replication scopes and retention semantics are defined.
+ * reconciles them through the transports outside that target, except through a
+ * route that skipped a message. Local delivery forwards uploads, including
+ * historical messages sent during reconciliation, but does not reconcile local
+ * database histories with each other. That waits until replication scopes and
+ * retention semantics are defined.
  *
  * ## Sync state
  *
  * The shared worker publishes one plain snapshot, {@link SyncState}, of every
  * transport it manages and every database and owner registration it holds, with
- * one route per writable registration and transport, as specified below.
- * {@link syncStateToOwnerSyncStates} derives one state per database and owner.
+ * one route per writable registration and transport, as specified below. Each
+ * part is a union of the states the worker keeps for it: a transport's
+ * connection, a database that is active or refused startup, a writable or
+ * readonly owner, and a pending, settled, or complete route. A transport's
+ * events drive its connection, so publishing never reads a socket.
+ *
+ * Apps show users an owner's {@link OwnerSyncStatus}, which
+ * {@link syncStateToOwnerSyncStatus} derives. A view of each relay pairs each
+ * route with its transport by {@link syncStateToRelaySyncStates} and tells the
+ * relay's status by {@link relaySyncStateToStatus}. Snapshots store neither, so
+ * a status never disagrees with the routes it comes from.
  *
  * Each worker broadcasts snapshots on its own channel, whose name a connecting
  * tab receives through its port, so a tab never hears another worker, such as
  * one of a different app version, and
  * {@link SyncStateDep.syncState | deps.syncState} keeps the last snapshot. The
- * worker publishes after every change it observes; a transition without an
- * event, such as a closed socket starting to reconnect, appears with the next
- * snapshot. The snapshot lives in worker memory only, so a new worker starts
- * empty.
+ * worker publishes after every change it observes. The snapshot lives in worker
+ * memory only, so a new worker starts empty.
  *
  * ## Synchronization completion
  *
@@ -156,27 +174,51 @@
  * - The tenant has sent a round through the transport since the last event that
  *   requires one: its first use of the transport for the owner, the socket
  *   opening, an explicit request, a replacement leader, or storing messages
- *   from another transport. No failed or aborted result has arrived on the
- *   route since.
+ *   from another transport, unless the route skipped a message. No failed or
+ *   aborted result has arrived on the route since.
+ * - No result that skipped a received message has arrived on the route since a
+ *   round was last requested through it, and since that request, no messages
+ *   have been stored from another transport, directly or through a sibling copy
+ *   uploaded outside this transport, and no sibling copy has failed to apply or
+ *   skipped a message.
+ *
+ * A route is settled when every condition except the last holds, so a complete
+ * route is settled too. A settled route that is incomplete has ended its
+ * reconciliation, but its relay may offer a message the database skipped, or
+ * messages stored elsewhere may not have reached it; it is published as
+ * {@link SettledSyncRoute}.
  *
  * A reconciliation chain ends only with a converged result, a failure, an
  * abort, a dropped frame, or a continuation that finds the socket closed, and
  * relay errors reach every applying tenant, so these conditions mean every
  * chain, including this tenant's, converged. A local Broadcast from a sibling
  * tenant holds every route of its owner until it is applied, because it arrives
- * without a request of its own; one that fails to apply requires a round
- * through every transport.
+ * without a request of its own; one that fails to apply or skips a message
+ * requires a round through every transport whose route has not skipped one.
  *
  * A failed result on a route requests one round through it. Any further failure
- * before the route completes waits for an explicit request or a reopen, so a
+ * before the route settles waits for an explicit request or a reopen, so a
  * persistent failure cannot loop; a converged reply in between does not end the
  * wait, because it may answer another tenant's round on the shared socket. An
  * aborted apply leaves its routes incomplete without a retry. An exception
  * while the database worker creates a round is logged there and fails the
- * round's routes with `SyncFailed` without a retry; other unexpected SQLite
- * exceptions remain unsupported and can panic the database worker. A frame the
- * relay silently drops, such as invalid data, leaves the count above zero until
- * the liveness rule below replaces the socket.
+ * round's routes with `SyncFailed` without a retry. A mutation that throws is
+ * rolled back and reported as an {@link UnknownError} to the tab that made it,
+ * or to every tab when its Evolu instance was disposed first. Other unexpected
+ * SQLite exceptions remain unsupported and can panic the database worker. A
+ * frame the relay silently drops, such as invalid data, leaves the count above
+ * zero until the liveness rule below replaces the socket.
+ *
+ * A result that skipped a received message the database could not decrypt,
+ * verify, or decode records the error on the route as its `skippedError`,
+ * without ending its chain, so it requests no round, and the relay offers the
+ * message again in every round through the route until the database stores a
+ * message with that timestamp. The messages received elsewhere that the last
+ * condition names request no round through such a route, even while a requested
+ * round checks it again, because each round would download every skipped
+ * message again. The next round that a first use of the transport for the
+ * owner, an explicit request, a reopen, a replacement leader, or a failure
+ * sends through the route reconciles them.
  *
  * ### Liveness
  *
@@ -196,11 +238,13 @@
  * The timeout belongs to the transport, not to an owner, because a small reply
  * for one owner can wait behind another owner's large frame on the socket. A
  * grown timeout lasts while a request is outstanding on the socket or a
- * database that has not refused startup has an incomplete route through it,
- * including one waiting after a failure, and ends with the transport. A reply's
- * speed proves nothing, because a recovery on a slow link starts with small
- * replies that arrive quickly. The reopen resets the counts and starts the open
- * rounds, so a dropped frame delays a route instead of stranding it.
+ * database that has not refused startup has an unsettled route through it,
+ * including one waiting after a failure, and ends with the transport. A settled
+ * route that is incomplete does not count, because its reconciliation has
+ * ended. A reply's speed proves nothing, because a recovery on a slow link
+ * starts with small replies that arrive quickly. The reopen resets the counts
+ * and starts the open rounds, so a dropped frame delays a route instead of
+ * stranding it.
  *
  * The shared worker sends nothing while idle, so a path that dies then may go
  * unnoticed until its next request; until then, changes from other devices stop
@@ -226,7 +270,11 @@ import {
 } from "../Assert.ts";
 import type { Brand } from "../Brand.ts";
 import type { ConsoleEntry, ConsoleLevel } from "../Console.ts";
-import type { EncryptionKey } from "../Crypto.ts";
+import type {
+  DecryptWithXChaCha20Poly1305Error,
+  EncryptionKey,
+} from "../Crypto.ts";
+import { createUnknownError, type UnknownError } from "../Error.ts";
 import { disposable, exhaustiveCheck } from "../Function.ts";
 import { acquireLeaderLock, type LockManagerDep } from "../LockManager.ts";
 import {
@@ -281,7 +329,6 @@ import type {
   CreateWebSocketDep,
   WebSocket,
   WebSocketError,
-  WebSocketReadyState,
 } from "../WebSocket.ts";
 import type {
   SharedWorker as CommonSharedWorker,
@@ -293,7 +340,12 @@ import type {
   WorkerDeps,
 } from "../Worker.ts";
 import type { DbWorkerInit, UnsupportedDbVersionError } from "./Db.ts";
-import type { EvoluError, SyncStateDep } from "./Evolu.ts";
+import type {
+  DevicePersistence,
+  Evolu,
+  EvoluConfig,
+  SyncStateDep,
+} from "./Evolu.ts";
 import type { Owner, OwnerId, OwnerTransport, SyncOwner } from "./Owner.ts";
 import {
   createProtocolBroadcastMessagesFromCrdtMessages,
@@ -303,7 +355,10 @@ import {
   parseProtocolHeader,
   type ApplyProtocolMessageAsClientResult,
   type ProtocolError,
+  type ProtocolInvalidDataError,
   type ProtocolMessage,
+  type ProtocolQuotaError,
+  type ProtocolTimestampMismatchError,
 } from "./Protocol.ts";
 import {
   makePatches,
@@ -352,11 +407,12 @@ export type SharedWorkerOutput =
   | DbWorkerInit
   | {
       /**
-       * Sent to one tab only: its database refused startup, or another build
-       * keeps this worker waiting.
+       * Sent to one tab only: its database refused startup, a mutation it made
+       * could not be stored, or another build keeps this worker waiting.
        */
       readonly type: "Error";
-      readonly error: UnsupportedDbVersionError | OtherBuildRunningError;
+      readonly error:
+        OtherBuildRunningError | UnknownError | UnsupportedDbVersionError;
     }
   | {
       /**
@@ -376,14 +432,6 @@ export type SharedWorkerOutput =
       readonly type: "Connected";
       readonly workerId: SharedWorkerId;
       readonly syncStateChannelName: string;
-    }
-  | {
-      /**
-       * Sent to a connecting tab after `Connected` when the platform offers no
-       * persistent storage, so the worker keeps every database in memory; see
-       * Storage in this module's documentation.
-       */
-      readonly type: "StorageUnavailable";
     };
 
 export type ConsoleEntryOrError =
@@ -393,7 +441,7 @@ export type ConsoleEntryOrError =
     }
   | {
       readonly type: "Error";
-      readonly error: EvoluError;
+      readonly error: UnknownError;
     };
 
 export const consoleEntryOrErrorBroadcastChannelName =
@@ -451,31 +499,31 @@ export interface BuildWaitingRequest extends InferType<
 export interface OtherBuildRunningError extends Typed<"OtherBuildRunningError"> {}
 
 /**
- * A snapshot of the transports and databases the shared worker manages.
- *
- * See the Sync state section of this module's documentation.
+ * A snapshot of the transports and databases the shared worker manages. Each
+ * part is a union of the states the worker keeps for it, so each part holds
+ * only the fields valid for its state. Apps derive what to show with
+ * {@link syncStateToOwnerSyncStatus}; see Sync state in this module's
+ * documentation.
  */
 export interface SyncState {
   readonly transports: ReadonlyArray<SyncTransport>;
   readonly tenants: ReadonlyArray<SyncTenant>;
 }
 
-/** One WebSocket, shared by every owner and database claiming it. */
-export interface SyncTransport {
-  /** Opaque and stable for the transport's lifetime, across socket replacements. */
+/**
+ * One transport, shared by every owner and database claiming it. Its `type` is
+ * the kind of transport, and its {@link SyncConnection} tells whether it is
+ * connected.
+ */
+export type SyncTransport = WebSocketSyncTransport;
+
+/** A WebSocket {@link SyncTransport}. */
+export interface WebSocketSyncTransport extends Typed<"WebSocket"> {
+  /** Opaque and stable for the transport's lifetime, across reconnects. */
   readonly id: SyncTransportId;
-  /** The URL without its query, which carries the owner ID. */
+  /** The relay URL without the owner-specific query. */
   readonly label: string;
-  readonly readyState: WebSocketReadyState;
-  /** When the connection last opened, or null before its first open. */
-  readonly openedAt: Millis | null;
-  /** When the connection last closed, or null before its first close. */
-  readonly closedAt: Millis | null;
-  /**
-   * The last error, retained after a successful reconnect; null if none. Errors
-   * while reconnecting are routine.
-   */
-  readonly error: SyncTransportError | null;
+  readonly connection: SyncConnection;
 }
 
 export type SyncTransportId = Id & Brand<"SyncTransport">;
@@ -485,109 +533,519 @@ export interface SyncTransportError {
   readonly at: Millis;
 }
 
-/** One named local database and the owners it registered. */
-export interface SyncTenant {
+/**
+ * The connection of a {@link SyncTransport}: `Connecting` until its first
+ * connection opens or fails, `Open` while a connection is open, and
+ * `Disconnected` from a close, a failure, or an unanswered request that
+ * replaced the connection, until a connection opens again. It never returns to
+ * `Connecting`. The transport's events drive these states.
+ */
+export type SyncConnection =
+  ConnectingSyncConnection | OpenSyncConnection | DisconnectedSyncConnection;
+
+/**
+ * A first connection, which has neither opened nor failed. A connection to a
+ * host that drops packets stays here until the operating system or browser
+ * gives up on it, which can take a minute or more.
+ */
+export interface ConnectingSyncConnection extends Typed<"Connecting"> {}
+
+/** An open connection. */
+export interface OpenSyncConnection extends Typed<"Open"> {
+  /** When this connection opened. */
+  readonly openedAt: Millis;
+  /** The last error of an earlier connection or attempt, or null. */
+  readonly error: SyncTransportError | null;
+}
+
+/**
+ * No connection: a connection closed or failed, or the relay did not answer a
+ * request in time. The transport reconnects by itself.
+ */
+export interface DisconnectedSyncConnection extends Typed<"Disconnected"> {
+  /** When it disconnected. Failed reconnect attempts leave it unchanged. */
+  readonly disconnectedAt: Millis;
+  /** When the last connection opened, or null when none has. */
+  readonly openedAt: Millis | null;
+  /**
+   * The last error, or null. A close or an unanswered request records none, so
+   * it can come from an earlier connection. Errors while reconnecting are
+   * routine.
+   */
+  readonly error: SyncTransportError | null;
+}
+
+/** One named local database: `Active`, or `Refused` when it refused startup. */
+export type SyncTenant = ActiveSyncTenant | RefusedSyncTenant;
+
+/**
+ * A database that has not refused startup, including one still starting, with
+ * the owners its instances registered.
+ */
+export interface ActiveSyncTenant extends Typed<"Active"> {
   readonly name: Name;
-  /** The database refused startup, so nothing it holds synchronizes. */
-  readonly refused: boolean;
   readonly owners: ReadonlyArray<SyncTenantOwner>;
 }
 
-export interface SyncTenantOwner {
+/**
+ * A database that refused startup, so nothing it holds syncs. Its tabs also
+ * receive the error through `evoluError`.
+ */
+export interface RefusedSyncTenant extends Typed<"Refused"> {
+  readonly name: Name;
+  readonly error: UnsupportedDbVersionError;
+}
+
+/**
+ * An owner registered by any instance of an {@link ActiveSyncTenant}: `Writable`
+ * when any registration holds its write key, otherwise `Readonly`.
+ */
+export type SyncTenantOwner = WritableSyncTenantOwner | ReadonlySyncTenantOwner;
+
+/**
+ * An owner the database syncs, with one route per transport claimed for it by
+ * this or any other database. Routes are briefly empty while the owner's
+ * transports are being claimed.
+ */
+export interface WritableSyncTenantOwner extends Typed<"Writable"> {
+  readonly ownerId: OwnerId;
+  readonly routes: ReadonlyArray<SyncRoute>;
+}
+
+/**
+ * An owner registered only without its write key. Its registrations hold
+ * transports, which other databases' routes for the owner use, but this
+ * database does not sync it.
+ */
+export interface ReadonlySyncTenantOwner extends Typed<"Readonly"> {
   readonly ownerId: OwnerId;
-  /** A readonly registration holds transports but never synchronizes. */
-  readonly writable: boolean;
   /** Every transport claimed for the owner, by any database. */
   readonly transportIds: ReadonlyArray<SyncTransportId>;
-  /** One route per transport for a writable owner; none for a readonly one. */
-  readonly routes: ReadonlyArray<SyncRoute>;
 }
 
 /**
- * One database's use of one owner through one transport. See the
- * Synchronization completion section of this module's documentation.
+ * One database's use of one owner through one transport: `Pending` until its
+ * reconciliation ends, then `Complete`, or `Settled` while its relay offers a
+ * change the database skipped. See Synchronization completion in this module's
+ * documentation.
  */
-export interface SyncRoute {
+export type SyncRoute = PendingSyncRoute | SettledSyncRoute | CompleteSyncRoute;
+
+/**
+ * A route whose reconciliation has not ended: its transport is not open, a
+ * request or a received frame is outstanding, a replicated write is queued, or
+ * a round must still be sent through it.
+ */
+export interface PendingSyncRoute extends Typed<"Pending"> {
   readonly transportId: SyncTransportId;
-  /** Whether the database is reconciled with the relay for the owner. */
-  readonly complete: boolean;
+  /**
+   * The failure since the route last settled, or null. The first one requests a
+   * round; a further one waits for {@link Evolu.requestSync} or a reopen.
+   */
+  readonly failure: SyncRouteError | null;
+  /**
+   * The first change skipped in the latest reply that skipped one, or null. The
+   * relay offers it again in every round through the route until this database
+   * stores a change with that timestamp.
+   */
+  readonly skippedError: SyncRouteError | null;
   /** When the route last became complete, or null. */
   readonly completeAt: Millis | null;
   /** When this database last sent a request through the route, or null. */
   readonly lastSentAt: Millis | null;
   /**
    * When processing a frame from the route last finished, successfully or with
-   * a failure, or null. Aborted processing does not update this timestamp.
+   * a failure, or null. Aborted processing does not update it.
    */
   readonly lastReceivedAt: Millis | null;
-  /** The last failed result on the route; cleared when the route completes. */
-  readonly error: SyncRouteError | null;
 }
 
-export interface SyncRouteError {
-  readonly type: SyncRouteErrorType;
-  readonly at: Millis;
+/**
+ * A route whose reconciliation ended while its relay offers a change the
+ * database skipped, so it is incomplete. Changes stored from other relays
+ * request no round through it; the next round requested through it, such as by
+ * {@link Evolu.requestSync} or a reopen, checks it again.
+ */
+export interface SettledSyncRoute extends Typed<"Settled"> {
+  readonly transportId: SyncTransportId;
+  /** The first change skipped in the latest reply that skipped one. */
+  readonly skippedError: SyncRouteError;
+  /** When the route last became complete, or null. */
+  readonly completeAt: Millis | null;
+  /** When this database last sent a request through the route. */
+  readonly lastSentAt: Millis;
+  /** When processing a frame from the route last finished, or null. */
+  readonly lastReceivedAt: Millis | null;
+}
+
+/** A route on which the database is reconciled with the relay for the owner. */
+export interface CompleteSyncRoute extends Typed<"Complete"> {
+  readonly transportId: SyncTransportId;
+  /** When the route became complete. */
+  readonly completeAt: Millis;
+  /** When this database last sent a request through the route. */
+  readonly lastSentAt: Millis;
+  /** When processing a frame from the route last finished, or null. */
+  readonly lastReceivedAt: Millis | null;
 }
 
 /**
- * A {@link ProtocolError} or the original {@link StorageWriteMessagesError} type
- * for a rejected write. `WriteFailed` means a `writeMessages` call that threw,
- * logged by the protocol, and `SyncFailed` means a logged failure while
- * creating a round or reconciling ranges.
+ * A failure or a skipped change of a {@link SyncRoute}, with the time it
+ * arrived.
+ *
+ * It is the error itself, so it carries its details, such as the expected and
+ * actual timestamps of a {@link ProtocolTimestampMismatchError}. A skipped
+ * message adds {@link DecryptWithXChaCha20Poly1305Error}. A
+ * {@link ProtocolInvalidDataError} leaves out its data, which can be a whole
+ * frame. The caught value in the `error` of either is an {@link UnknownError}.
+ * `WriteFailed` means a `writeMessages` call that threw, logged by the
+ * protocol, and `SyncFailed` means a logged failure while creating a round or
+ * reconciling ranges.
  */
-export type SyncRouteErrorType =
-  | ProtocolError["type"]
-  | StorageWriteMessagesError["type"]
-  | "WriteFailed"
-  | "SyncFailed";
+export type SyncRouteError = (
+  | Exclude<ProtocolError, ProtocolInvalidDataError>
+  | Omit<ProtocolInvalidDataError, "data">
+  | StorageWriteMessagesError
+  | DecryptWithXChaCha20Poly1305Error
+  | Typed<"WriteFailed">
+  | Typed<"SyncFailed">
+) & { readonly at: Millis };
+
+/** The type of a {@link SyncRouteError}. */
+export type SyncRouteErrorType = SyncRouteError["type"];
 
 /**
- * One owner's standing with its relays in one database, derived from
- * {@link SyncState} by {@link syncStateToOwnerSyncStates}.
+ * One relay of an owner in one database: a transport and the database's route
+ * through it, from {@link syncStateToRelaySyncStates}. Its status comes from
+ * {@link relaySyncStateToStatus} and is not stored beside them.
  */
-export interface OwnerSyncState {
-  readonly name: Name;
-  readonly ownerId: OwnerId;
-  readonly status: OwnerSyncStatus;
-  /** When a route of the owner last became complete, or null. */
-  readonly syncedAt: Millis | null;
-  /** The newest route error of the owner, or null. */
-  readonly error: SyncRouteError | null;
-  /** Each relay of the owner, in the order of its routes. */
-  readonly relays: ReadonlyArray<RelaySyncState>;
+export interface RelaySyncState {
+  readonly transport: SyncTransport;
+  readonly route: SyncRoute;
 }
 
 /**
- * The status of an {@link OwnerSyncState}: the first of `error`, `syncing`,
- * `synced`, and `offline` that one of its relays has, or `initial` before the
- * owner has a relay. Work in progress on an open transport shows before a relay
- * that is already up to date.
+ * What an app shows users about syncing one owner of one database, from
+ * {@link syncStateToOwnerSyncStatus} or the React and Vue `useOwnerSyncStatus`.
+ *
+ * Its variants:
+ *
+ * - `NoRelays`: nothing syncs the owner here. There is no snapshot yet, the
+ *   owner's transports are still being set up, the app uses no relays for it,
+ *   it is registered only as readonly, or the database refused startup, which
+ *   `evoluError` reports.
+ * - `Syncing`: a relay connects for the first time or reconciles. A first
+ *   connection to a host that drops packets stays `Syncing` until the platform
+ *   gives up on it, which can take a minute.
+ * - `Synced`: a relay is up to date, and none syncs.
+ * - `Offline`: every relay is disconnected. Evolu keeps reconnecting, up to 30
+ *   seconds apart, so `Offline` can briefly outlast the outage.
+ * - `Error`: a relay failed or offers a change this database skipped. `error` is
+ *   the newest failure, or without one, the newest skipped change: a failure
+ *   stops syncing through its relay, while a skipped change leaves out only
+ *   that change.
+ *
+ * Evolu stores changes in the local database before they sync, so sync needs no
+ * UI while it works: show nothing for `NoRelays`, `Syncing`, and `Synced`. An
+ * indicator that changes with every edit distracts, and screen readers announce
+ * each change.
+ *
+ * For `Offline` and `Error`, show one quiet line that lasts as long as the
+ * status, not a dialog, which interrupts, or a toast, which disappears while
+ * the problem lasts. Do not say that changes are saved on this device unless
+ * {@link Evolu.devicePersistence} is `Persisted`: a browser may keep them only
+ * for a private session or delete them later. Evolu reports `Offline` at once;
+ * an app may wait a few seconds before showing it, because brief
+ * disconnections, such as waking from sleep, reconnect quickly. For `Error`,
+ * write actionable text for the error types the app can act on, such as a
+ * {@link ProtocolQuotaError}: the relay stores no more data for the owner, so
+ * offer more quota, such as a plan upgrade, then call {@link Evolu.requestSync}
+ * with the owner's ID. For any other error, show generic text that names the
+ * error type, which helps when the user reports it.
+ *
+ * Render the line inside one element with `role="status"` that stays mounted:
+ * screen readers announce changes only in a live region that already exists,
+ * and a polite announcement fits a status that loses nothing. Do not use
+ * `role="alert"`.
+ *
+ * Show the app owner's status once for the whole app, such as below the header,
+ * and another owner's status where the app shows that owner's data. Each Evolu
+ * instance finds its own status by {@link Evolu.name}, so an app with several
+ * databases shows the status of the one the user works in.
+ *
+ * ### Example
+ *
+ * ```ts
+ * import { assertEqual, Millis } from "@evolu/common";
+ * import {
+ *   testAppOwner,
+ *   type OwnerSyncStatus,
+ * } from "@evolu/common/local-first";
+ *
+ * // What to tell the user, or null while sync works or is not used.
+ * const syncStatusToMessage = (status: OwnerSyncStatus): string | null => {
+ *   switch (status.type) {
+ *     case "NoRelays":
+ *     case "Syncing":
+ *     case "Synced":
+ *       return null;
+ *     case "Offline":
+ *       return "Offline. Changes will sync when you're back online.";
+ *     case "Error":
+ *       return status.error.type === "ProtocolQuotaError"
+ *         ? "Sync is paused because the sync server is full."
+ *         : `Sync error: ${status.error.type}.`;
+ *   }
+ * };
+ *
+ * assertEqual(syncStatusToMessage({ type: "Synced" }), null);
+ * assertEqual(
+ *   syncStatusToMessage({ type: "Offline" }),
+ *   "Offline. Changes will sync when you're back online.",
+ * );
+ * assertEqual(
+ *   syncStatusToMessage({
+ *     type: "Error",
+ *     error: {
+ *       type: "ProtocolQuotaError",
+ *       ownerId: testAppOwner.id,
+ *       at: Millis.orThrow(1000),
+ *     },
+ *   }),
+ *   "Sync is paused because the sync server is full.",
+ * );
+ * assertEqual(
+ *   syncStatusToMessage({
+ *     type: "Error",
+ *     error: { type: "SyncFailed", at: Millis.orThrow(1000) },
+ *   }),
+ *   "Sync error: SyncFailed.",
+ * );
+ * ```
  */
-export type OwnerSyncStatus = "initial" | RelaySyncStatus;
+export type OwnerSyncStatus = NoRelaysSyncStatus | RelaySyncStatus;
 
 /**
- * One relay of an {@link OwnerSyncState}: a transport and the database's route
- * through it.
+ * The status of a {@link RelaySyncState}, from {@link relaySyncStateToStatus}:
+ * `Error` when its route has a failure or a skipped change, the failure first;
+ * otherwise `Synced` when the route is complete, `Syncing` while the
+ * transport's connection is `Connecting` or `Open`, and `Offline` while it is
+ * `Disconnected`.
  */
-export interface RelaySyncState {
-  readonly transport: SyncTransport;
-  readonly route: SyncRoute;
-  readonly status: RelaySyncStatus;
+export type RelaySyncStatus =
+  SyncingSyncStatus | SyncedSyncStatus | OfflineSyncStatus | ErrorSyncStatus;
+
+/** Evolu reports no relay syncing the owner in the database. */
+export interface NoRelaysSyncStatus extends Typed<"NoRelays"> {}
+
+/** A relay makes its first connection or reconciles. */
+export interface SyncingSyncStatus extends Typed<"Syncing"> {}
+
+/** A relay is reconciled with the database for the owner. */
+export interface SyncedSyncStatus extends Typed<"Synced"> {}
+
+/** Relays are disconnected and reconnecting, so changes wait on this device. */
+export interface OfflineSyncStatus extends Typed<"Offline"> {}
+
+/** A route failed or holds a change the database skipped. */
+export interface ErrorSyncStatus extends Typed<"Error"> {
+  /**
+   * The failure, or without one, the skipped change. For an owner, the newest
+   * failure of any relay, or without one, the newest skipped change.
+   */
+  readonly error: SyncRouteError;
 }
 
 /**
- * The status of a {@link RelaySyncState}: `error` when its route failed and has
- * not completed since, `synced` when the route is complete, `syncing` while the
- * transport is open, and `offline` otherwise.
+ * Tells what an app shows about syncing an owner in a database: `Error` when a
+ * relay has one, holding the newest failure of any relay or, without one, the
+ * newest skipped change; otherwise the first of `Syncing`, `Synced`, and
+ * `Offline` that a relay has, or `NoRelays`. Accepts null, the store's value
+ * before the first snapshot. See {@link OwnerSyncStatus} for what to show.
+ *
+ * The same status is the same object: statuses other than `Error` are shared
+ * constants, and an `Error` status is the same object for the same error
+ * object, which {@link SyncStateDep.syncState} keeps between snapshots while it
+ * is unchanged. So compare statuses with `===`.
+ *
+ * ### Example
+ *
+ * ```ts
+ * import {
+ *   assertEqual,
+ *   assertSame,
+ *   createId,
+ *   createUnknownError,
+ *   Millis,
+ *   testCreateDeps,
+ *   testName,
+ * } from "@evolu/common";
+ * import {
+ *   syncStateToOwnerSyncStatus,
+ *   testAppOwner,
+ *   type PendingSyncRoute,
+ *   type SyncConnection,
+ *   type SyncRoute,
+ *   type SyncState,
+ *   type SyncTransportId,
+ * } from "@evolu/common/local-first";
+ *
+ * const deps = testCreateDeps();
+ * const primaryId = createId<"SyncTransport">(deps);
+ * const backupId = createId<"SyncTransport">(deps);
+ *
+ * const stateOf = (
+ *   connections: ReadonlyArray<SyncConnection>,
+ *   routes: ReadonlyArray<SyncRoute>,
+ * ): SyncState => ({
+ *   transports: connections.map((connection, index) => ({
+ *     type: "WebSocket",
+ *     id: index === 0 ? primaryId : backupId,
+ *     label: "wss://relay.example",
+ *     connection,
+ *   })),
+ *   tenants: [
+ *     {
+ *       type: "Active",
+ *       name: testName,
+ *       owners: [{ type: "Writable", ownerId: testAppOwner.id, routes }],
+ *     },
+ *   ],
+ * });
+ * const pending = (transportId: SyncTransportId): PendingSyncRoute => ({
+ *   type: "Pending",
+ *   transportId,
+ *   failure: null,
+ *   skippedError: null,
+ *   completeAt: null,
+ *   lastSentAt: null,
+ *   lastReceivedAt: null,
+ * });
+ * const statusOf = (state: SyncState | null) =>
+ *   syncStateToOwnerSyncStatus(state, testName, testAppOwner.id);
+ *
+ * // Before the first snapshot, nothing syncs the owner.
+ * assertEqual(statusOf(null), { type: "NoRelays" });
+ *
+ * // A first connection is syncing; a lost one is offline.
+ * const connecting: SyncConnection = { type: "Connecting" };
+ * assertEqual(statusOf(stateOf([connecting], [pending(primaryId)])), {
+ *   type: "Syncing",
+ * });
+ * const disconnected: SyncConnection = {
+ *   type: "Disconnected",
+ *   disconnectedAt: Millis.orThrow(2000),
+ *   openedAt: Millis.orThrow(1000),
+ *   error: null,
+ * };
+ * assertEqual(statusOf(stateOf([disconnected], [pending(primaryId)])), {
+ *   type: "Offline",
+ * });
+ *
+ * // A quota failure on one relay shows before a newer skipped change on
+ * // another, because the app can act on it.
+ * const quotaError = {
+ *   type: "ProtocolQuotaError",
+ *   ownerId: testAppOwner.id,
+ *   at: Millis.orThrow(3000),
+ * } as const;
+ * const open: SyncConnection = {
+ *   type: "Open",
+ *   openedAt: Millis.orThrow(3400),
+ *   error: null,
+ * };
+ * assertEqual(
+ *   statusOf(
+ *     stateOf(
+ *       [disconnected, open],
+ *       [
+ *         { ...pending(primaryId), failure: quotaError },
+ *         {
+ *           type: "Settled",
+ *           transportId: backupId,
+ *           skippedError: {
+ *             type: "DecryptWithXChaCha20Poly1305Error",
+ *             error: createUnknownError(new Error("invalid tag")),
+ *             at: Millis.orThrow(4000),
+ *           },
+ *           completeAt: null,
+ *           lastSentAt: Millis.orThrow(3500),
+ *           lastReceivedAt: Millis.orThrow(4000),
+ *         },
+ *       ],
+ *     ),
+ *   ),
+ *   { type: "Error", error: quotaError },
+ * );
+ *
+ * // The same error gives the same status object.
+ * const quotaState = stateOf(
+ *   [disconnected],
+ *   [{ ...pending(primaryId), failure: quotaError }],
+ * );
+ * assertSame(statusOf(quotaState), statusOf(quotaState));
+ * ```
  */
-export type RelaySyncStatus = "syncing" | "synced" | "offline" | "error";
+export const syncStateToOwnerSyncStatus = (
+  state: SyncState | null,
+  name: Name,
+  ownerId: OwnerId,
+): OwnerSyncStatus => {
+  let failure: SyncRouteError | null = null;
+  let skippedError: SyncRouteError | null = null;
+  let isSyncing = false;
+  let isSynced = false;
+  let isOffline = false;
+  for (const relay of syncStateToRelaySyncStates(state, name, ownerId)) {
+    const { route } = relay;
+    // A failure stops syncing through its relay, and a skipped change is
+    // stamped again by every reply that skips it, so a newer skipped change
+    // must not hide an older failure the app can act on.
+    if (
+      route.type === "Pending" &&
+      route.failure &&
+      (!failure || route.failure.at > failure.at)
+    )
+      failure = route.failure;
+    if (
+      route.type !== "Complete" &&
+      route.skippedError &&
+      (!skippedError || route.skippedError.at > skippedError.at)
+    )
+      skippedError = route.skippedError;
+    const status = relaySyncStateToStatus(relay);
+    switch (status.type) {
+      case "Error":
+        break;
+      case "Syncing":
+        isSyncing = true;
+        break;
+      case "Synced":
+        isSynced = true;
+        break;
+      case "Offline":
+        isOffline = true;
+        break;
+      default:
+        exhaustiveCheck(status);
+    }
+  }
+  const error = failure ?? skippedError;
+  return error
+    ? syncRouteErrorToSyncStatus(error)
+    : isSyncing
+      ? syncingSyncStatus
+      : isSynced
+        ? syncedSyncStatus
+        : isOffline
+          ? offlineSyncStatus
+          : noRelaysSyncStatus;
+};
 
 /**
- * Folds the routes of every writable owner registration of every running
- * database in a {@link SyncState} into one {@link OwnerSyncState} per database
- * and owner, which pairs each route with its transport as a
- * {@link RelaySyncState}. A database that refused startup and a readonly
- * registration synchronize nothing, so they are left out.
+ * Pairs each route of an owner in a database with its transport, in route
+ * order. Returns none for a null snapshot, a missing or refused database, and a
+ * missing or readonly owner.
  *
  * ### Example
  *
@@ -600,7 +1058,8 @@ export type RelaySyncStatus = "syncing" | "synced" | "offline" | "error";
  *   testName,
  * } from "@evolu/common";
  * import {
- *   syncStateToOwnerSyncStates,
+ *   relaySyncStateToStatus,
+ *   syncStateToRelaySyncStates,
  *   testAppOwner,
  *   type SyncRoute,
  *   type SyncState,
@@ -609,99 +1068,106 @@ export type RelaySyncStatus = "syncing" | "synced" | "offline" | "error";
  *
  * const deps = testCreateDeps();
  * const transport: SyncTransport = {
+ *   type: "WebSocket",
  *   id: createId<"SyncTransport">(deps),
  *   label: "wss://relay.example",
- *   readyState: "open",
- *   openedAt: null,
- *   closedAt: null,
- *   error: null,
+ *   connection: {
+ *     type: "Open",
+ *     openedAt: Millis.orThrow(800),
+ *     error: null,
+ *   },
  * };
  * const route: SyncRoute = {
+ *   type: "Complete",
  *   transportId: transport.id,
- *   complete: true,
  *   completeAt: Millis.orThrow(1000),
  *   lastSentAt: Millis.orThrow(900),
  *   lastReceivedAt: Millis.orThrow(1000),
- *   error: null,
  * };
  * const state: SyncState = {
  *   transports: [transport],
  *   tenants: [
  *     {
+ *       type: "Active",
  *       name: testName,
- *       refused: false,
  *       owners: [
- *         {
- *           ownerId: testAppOwner.id,
- *           writable: true,
- *           transportIds: [transport.id],
- *           routes: [route],
- *         },
+ *         { type: "Writable", ownerId: testAppOwner.id, routes: [route] },
  *       ],
  *     },
  *   ],
  * };
  *
- * assertEqual(syncStateToOwnerSyncStates(state), [
- *   {
- *     name: testName,
- *     ownerId: testAppOwner.id,
- *     status: "synced",
- *     syncedAt: Millis.orThrow(1000),
- *     error: null,
- *     relays: [{ transport, route, status: "synced" }],
- *   },
- * ]);
+ * const relays = syncStateToRelaySyncStates(
+ *   state,
+ *   testName,
+ *   testAppOwner.id,
+ * );
+ * assertEqual(relays, [{ transport, route }]);
+ * assertEqual(relays.map(relaySyncStateToStatus), [{ type: "Synced" }]);
+ * assertEqual(
+ *   syncStateToRelaySyncStates(null, testName, testAppOwner.id),
+ *   [],
+ * );
  * ```
  */
-export const syncStateToOwnerSyncStates = (
-  state: SyncState,
-): ReadonlyArray<OwnerSyncState> => {
-  const transportById = new Map(
-    state.transports.map((transport) => [transport.id, transport]),
-  );
-  return state.tenants.flatMap(({ name, refused, owners }) =>
-    refused
-      ? []
-      : owners.flatMap(({ ownerId, writable, routes }) => {
-          if (!writable) return [];
-          let syncedAt: Millis | null = null;
-          let error: SyncRouteError | null = null;
-          const relays: Array<RelaySyncState> = [];
-          for (const route of routes) {
-            if (
-              route.completeAt !== null &&
-              (syncedAt === null || route.completeAt > syncedAt)
-            )
-              syncedAt = route.completeAt;
-            if (
-              route.error !== null &&
-              (error === null || route.error.at > error.at)
-            )
-              error = route.error;
-            // A snapshot lists the transport of every route.
-            const transport = transportById.get(route.transportId);
-            assertNonNullable(transport);
-            relays.push({
-              transport,
-              route,
-              status:
-                route.error !== null
-                  ? "error"
-                  : route.complete
-                    ? "synced"
-                    : transport.readyState === "open"
-                      ? "syncing"
-                      : "offline",
-            });
-          }
-          const status: OwnerSyncStatus =
-            (["error", "syncing", "synced", "offline"] as const).find(
-              (candidate) => relays.some((relay) => relay.status === candidate),
-            ) ?? "initial";
-          return [{ name, ownerId, status, syncedAt, error, relays }];
-        }),
-  );
+export const syncStateToRelaySyncStates = (
+  state: SyncState | null,
+  name: Name,
+  ownerId: OwnerId,
+): ReadonlyArray<RelaySyncState> => {
+  const tenant = state?.tenants.find((tenant) => tenant.name === name);
+  if (!state || tenant?.type !== "Active") return emptyArray;
+  const owner = tenant.owners.find((owner) => owner.ownerId === ownerId);
+  if (owner?.type !== "Writable") return emptyArray;
+  return owner.routes.map((route) => {
+    // A snapshot lists the transport of every route.
+    const transport = state.transports.find(
+      ({ id }) => id === route.transportId,
+    );
+    assertNonNullable(transport);
+    return { transport, route };
+  });
+};
+
+/** Tells the status of one relay; a failure shows before a skipped change. */
+export const relaySyncStateToStatus = ({
+  transport,
+  route,
+}: RelaySyncState): RelaySyncStatus => {
+  switch (route.type) {
+    case "Complete":
+      return syncedSyncStatus;
+    case "Settled":
+      return syncRouteErrorToSyncStatus(route.skippedError);
+    case "Pending": {
+      const error = route.failure ?? route.skippedError;
+      if (error) return syncRouteErrorToSyncStatus(error);
+      return transport.connection.type === "Disconnected"
+        ? offlineSyncStatus
+        : syncingSyncStatus;
+    }
+  }
+};
+
+// Every status keeps its reference while it is unchanged, so bindings compare
+// statuses with `===`. The store shares an unchanged error object between
+// snapshots, and an error gives the same Error status object.
+const noRelaysSyncStatus: NoRelaysSyncStatus = { type: "NoRelays" };
+const syncingSyncStatus: SyncingSyncStatus = { type: "Syncing" };
+const syncedSyncStatus: SyncedSyncStatus = { type: "Synced" };
+const offlineSyncStatus: OfflineSyncStatus = { type: "Offline" };
+const errorSyncStatusByError = /*#__PURE__*/ new WeakMap<
+  SyncRouteError,
+  ErrorSyncStatus
+>();
+
+const syncRouteErrorToSyncStatus = (error: SyncRouteError): ErrorSyncStatus => {
+  let status = errorSyncStatusByError.get(error);
+  if (!status) {
+    status = { type: "Error", error };
+    errorSyncStatusByError.set(error, status);
+  }
+  return status;
 };
 
 export type EvoluInput =
@@ -744,6 +1210,16 @@ export type EvoluOutput =
   | {
       readonly type: "OnExport";
       readonly file: Uint8Array<ArrayBuffer>;
+    }
+  | {
+      /** The mutation with these onComplete callbacks could not be stored. */
+      readonly type: "OnMutateFailed";
+      readonly onCompleteIds: ReadonlyArray<Id>;
+    }
+  | {
+      /** Sent once, when the tenant adds the instance; see Storage. */
+      readonly type: "OnDevicePersistence";
+      readonly devicePersistence: DevicePersistence;
     };
 
 export type DbWorkerInput =
@@ -820,6 +1296,11 @@ export type DbWorkerQueuedResponse =
             >;
             readonly rowsByQuery: RowsByQueryMap;
           }
+        | {
+            /** The mutation threw, so it rolled back and nothing was stored. */
+            readonly type: "MutateFailed";
+            readonly error: UnknownError;
+          }
         | {
             readonly type: "Query";
             readonly rowsByQuery: RowsByQueryMap;
@@ -846,6 +1327,15 @@ export type DbWorkerQueuedResponse =
             readonly clock: Timestamp;
             readonly ownerId: OwnerId;
             readonly didWriteMessages: boolean;
+            /**
+             * The first error of a received message the DbWorker skipped while
+             * storing the rest, or null. It does not end the round.
+             */
+            readonly skippedError:
+              | DecryptWithXChaCha20Poly1305Error
+              | ProtocolInvalidDataError
+              | ProtocolTimestampMismatchError
+              | null;
             readonly result: Result<
               ApplyProtocolMessageAsClientResult,
               ProtocolError | StorageWriteMessagesError | AbortError
@@ -854,21 +1344,22 @@ export type DbWorkerQueuedResponse =
     };
 
 /**
- * Tells whether the platform can store databases persistently.
+ * Tells what the platform can promise about the databases it stores.
  *
- * Only a platform that can lack persistent storage provides it, as a browser
- * does in Safari's Private Browsing; see Storage in the Shared module.
+ * `NotPersisted` means the platform offers no persistent storage now, as a
+ * browser does in Safari's Private Browsing or a Firefox private window, so the
+ * worker keeps every database in memory; see Storage in the Shared module.
  */
-export interface PersistentStorageDep {
-  readonly isPersistentStorageAvailable: () => Promise<boolean>;
+export interface DevicePersistenceDep {
+  readonly getDevicePersistence: () => Promise<DevicePersistence>;
 }
 
 export type SharedWorkerDeps = WorkerDeps &
   CreateBroadcastChannelDep &
   CreateMessageChannelDep &
   CreateWebSocketDep &
-  LockManagerDep &
-  Partial<PersistentStorageDep>;
+  DevicePersistenceDep &
+  LockManagerDep;
 
 /**
  * Coordinates all instances of one named local database within a SharedWorker.
@@ -898,19 +1389,31 @@ interface EvoluTenant extends AsyncDisposable {
 }
 
 /** A tenant's part of {@link SyncState}, with its transports still keyed. */
-interface TenantSyncState {
+type TenantSyncState = ActiveTenantSyncState | RefusedSyncTenant;
+
+interface ActiveTenantSyncState extends Typed<"Active"> {
   readonly name: Name;
-  readonly refused: boolean;
-  readonly owners: ReadonlyArray<{
-    readonly ownerId: OwnerId;
-    readonly writable: boolean;
-    readonly transportKeys: ReadonlyArray<StructuralLookupKey>;
-    readonly routes: ReadonlyArray<TenantSyncRoute>;
-  }>;
+  readonly owners: ReadonlyArray<TenantSyncOwner>;
+}
+
+type TenantSyncOwner = WritableTenantSyncOwner | ReadonlyTenantSyncOwner;
+
+interface WritableTenantSyncOwner extends Typed<"Writable"> {
+  readonly ownerId: OwnerId;
+  readonly routes: ReadonlyArray<TenantSyncRoute>;
 }
 
-interface TenantSyncRoute extends Omit<SyncRoute, "transportId"> {
+interface ReadonlyTenantSyncOwner extends Typed<"Readonly"> {
+  readonly ownerId: OwnerId;
+  readonly transportKeys: ReadonlyArray<StructuralLookupKey>;
+}
+
+/** A tenant's route, with its transport still keyed. */
+interface TenantSyncRoute {
   readonly transportKey: StructuralLookupKey;
+  readonly progress: RouteProgress;
+  readonly lastSentAt: Millis | null;
+  readonly lastReceivedAt: Millis | null;
 }
 
 /**
@@ -929,6 +1432,39 @@ const syncRequestTimeout = PositiveMillis.orThrow(90_000);
  */
 const maxSyncRequestTimeout = PositiveMillis.orThrow(16 * syncRequestTimeout);
 
+const connectingSyncConnection: ConnectingSyncConnection = {
+  type: "Connecting",
+};
+
+/**
+ * A connection already disconnected keeps when it disconnected, so failed
+ * reconnect attempts only record their error.
+ */
+const disconnectSyncConnection = (
+  connection: SyncConnection,
+  at: Millis,
+  error: SyncTransportError | null,
+): DisconnectedSyncConnection => {
+  switch (connection.type) {
+    case "Connecting":
+      return {
+        type: "Disconnected",
+        disconnectedAt: at,
+        openedAt: null,
+        error,
+      };
+    case "Open":
+      return {
+        type: "Disconnected",
+        disconnectedAt: at,
+        openedAt: connection.openedAt,
+        error: error ?? connection.error,
+      };
+    case "Disconnected":
+      return error ? { ...connection, error } : connection;
+  }
+};
+
 /** Where the protocol messages produced by a queued sync request are sent. */
 type SyncTarget =
   | { readonly type: "AllTransports" }
@@ -955,6 +1491,118 @@ const isTargetTransport = (
 ): boolean =>
   target.type === "AllTransports" || target.key === structuralLookup(transport);
 
+/**
+ * A tenant's progress toward completing a route, per the Synchronization
+ * completion rules. Events move the route to `Pending`, which keeps what the
+ * route must remember until it settles, except that messages stored elsewhere
+ * leave a `Settled` route settled. Refreshing the routes settles a `Pending`
+ * route once the tenant's reconciliation conditions hold, and returns a settled
+ * or complete route to `Pending` when they no longer hold.
+ */
+type RouteProgress = PendingRoute | SettledRoute | CompleteRoute;
+
+/**
+ * A route whose reconciliation has not ended, or has not been evaluated since
+ * an event.
+ */
+interface PendingRoute extends Typed<"Pending"> {
+  /** A round must be sent through the route before it can settle. */
+  readonly roundRequired: boolean;
+  /**
+   * The failure since the route settled, or null. A further failure requests no
+   * round until the route settles.
+   */
+  readonly failure: SyncRouteError | null;
+  /** The route's skipped message, or null. */
+  readonly skip: RouteSkip | null;
+  /** When the route last became complete, or null. */
+  readonly completeAt: Millis | null;
+}
+
+/**
+ * A message a route skipped. Its relay offers the message again in every round,
+ * so messages received elsewhere request no round through the route.
+ */
+interface RouteSkip {
+  readonly error: SyncRouteError;
+  /**
+   * A round was requested through the route since the skip, and no messages
+   * received elsewhere have been stored since that request, so the route
+   * completes if it settles first.
+   */
+  readonly isRechecking: boolean;
+}
+
+/**
+ * A route whose reconciliation has ended, but whose relay may offer a skipped
+ * message or lack messages stored elsewhere, so it is incomplete.
+ */
+interface SettledRoute extends Typed<"Settled"> {
+  readonly error: SyncRouteError;
+  readonly completeAt: Millis | null;
+}
+
+interface CompleteRoute extends Typed<"Complete"> {
+  readonly completeAt: Millis;
+}
+
+const routeToPending = (progress: RouteProgress): PendingRoute => {
+  switch (progress.type) {
+    case "Pending":
+      return progress;
+    case "Settled":
+      return {
+        type: "Pending",
+        roundRequired: false,
+        failure: null,
+        skip: { error: progress.error, isRechecking: false },
+        completeAt: progress.completeAt,
+      };
+    case "Complete":
+      return {
+        type: "Pending",
+        roundRequired: false,
+        failure: null,
+        skip: null,
+        completeAt: progress.completeAt,
+      };
+  }
+};
+
+/**
+ * Converts an error to a {@link SyncRouteError}: a caught value becomes an
+ * {@link UnknownError}, and a {@link ProtocolInvalidDataError} leaves out its
+ * data.
+ */
+const errorToSyncRouteError = (
+  error:
+    | ProtocolError
+    | StorageWriteMessagesError
+    | DecryptWithXChaCha20Poly1305Error
+    | Typed<"WriteFailed">
+    | Typed<"SyncFailed">,
+  at: Millis,
+): SyncRouteError => {
+  // A caught value inside an error becomes an UnknownError, and a
+  // ProtocolInvalidDataError leaves out its data, which can be a whole frame.
+  if (error.type === "ProtocolInvalidDataError") {
+    const { data: _data, ...rest } = error;
+    return { ...rest, error: createUnknownError(rest.error), at };
+  }
+  if (error.type === "DecryptWithXChaCha20Poly1305Error")
+    return { ...error, error: createUnknownError(error.error), at };
+  return { ...error, at };
+};
+
+const failRoute = (
+  progress: RouteProgress,
+  failure: SyncRouteError,
+): PendingRoute => ({
+  ...routeToPending(progress),
+  roundRequired: true,
+  failure,
+});
+
 type EvoluTenantDeps = SharedWorkerDeps &
   PostConsoleEntryOrErrorDep &
   PublishSyncStateDep &
@@ -1111,23 +1759,25 @@ export const initSharedWorker =
           workerId,
           syncStateChannelName,
         });
-        if (isPersistentStorageUnavailable) {
-          port.postMessage({ type: "StorageUnavailable" });
-        }
       });
     };
 
-    // Released after every tenant and DbWorker is disposed. Earlier releases
-    // take the same lock in their leader tab; see Builds.
+    // Held while this worker runs. Its DbWorkers stop once they can take it,
+    // because a Dispose posted right before this worker closes can be lost, as
+    // in Firefox. Taken before the build lock, so nothing delays the end of
+    // starting once that lock is held.
+    disposer.use(await run.ok(acquireLeaderLock(workerId)));
+
+    // Released after every tenant is disposed and has told its DbWorker to
+    // stop. Earlier releases take the same lock in their leader tab; see
+    // Builds.
     disposer.use(await run.ok(acquireLeaderLock("tab")));
     starting.dispose();
 
-    // Checked once, before any DbWorker starts, so every DbWorker of this
-    // worker, replacements included, keeps its database in memory; see
-    // Storage.
-    const isPersistentStorageUnavailable =
-      deps.isPersistentStorageAvailable !== undefined &&
-      !(await deps.isPersistentStorageAvailable());
+    // Checked once, before any DbWorker starts, so without persistent
+    // storage every DbWorker of this worker, replacements included, keeps its
+    // database in memory; see Storage.
+    const platformDevicePersistence = await deps.getDevicePersistence();
 
     disposer.defer(
       deps.consoleStoreOutputEntry.subscribe(() => {
@@ -1156,13 +1806,12 @@ export const initSharedWorker =
        * another, so a reply can wait behind another owner's large frame. It
        * doubles after each timeout and survives reconnects until nothing is
        * outstanding and every route through the transport of a database that
-       * has not refused startup is complete.
+       * has not refused startup has settled.
        */
       timeout: PositiveMillis;
       socket: WebSocket | null;
-      openedAt: Millis | null;
-      closedAt: Millis | null;
-      error: SyncTransportError | null;
+      /** Socket events drive it, so publishing never reads the socket. */
+      connection: SyncConnection;
       /** Armed while a request is outstanding on an open socket. */
       timeoutId: TimeoutId | null;
     }
@@ -1181,62 +1830,96 @@ export const initSharedWorker =
         isPublishScheduled = false;
         if (isDisposed) return;
         const transports = [...transportsByKey.values()].map(
-          ({
-            id,
-            label,
-            socket,
-            openedAt,
-            closedAt,
-            error,
-          }): SyncTransport => ({
+          ({ id, label, connection }): SyncTransport => ({
+            type: "WebSocket",
             id,
             label,
-            // The transport drops its socket before disposal, so this never
-            // reads a disposed one.
-            readyState: socket?.getReadyState() ?? "connecting",
-            openedAt,
-            closedAt,
-            error,
+            connection,
           }),
         );
+        // A grown timeout lasts while a request is outstanding on the socket
+        // or a database that has not refused startup has an unsettled route
+        // through it. Every change to either publishes, including a route that
+        // goes away without settling.
+        const unsettledTransportIds = new Set<SyncTransportId>();
         const tenants = [...currentTenantsByName.values()].map(
           (tenant): SyncTenant => {
-            const { name, refused, owners } = tenant.getSyncTenant();
+            const state = tenant.getSyncTenant();
+            if (state.type === "Refused") return state;
             return {
-              name,
-              refused,
-              owners: owners.map(
-                ({ ownerId, writable, transportKeys, routes }) => ({
-                  ownerId,
-                  writable,
-                  transportIds: transportKeys.flatMap((key) => {
-                    const entry = transportsByKey.get(key);
-                    return entry ? [entry.id] : [];
-                  }),
-                  routes: routes.flatMap(({ transportKey, ...route }) => {
-                    const entry = transportsByKey.get(transportKey);
-                    return entry ? [{ transportId: entry.id, ...route }] : [];
-                  }),
-                }),
+              type: "Active",
+              name: state.name,
+              owners: state.owners.map((owner): SyncTenantOwner =>
+                owner.type === "Readonly"
+                  ? {
+                      type: "Readonly",
+                      ownerId: owner.ownerId,
+                      transportIds: owner.transportKeys.flatMap((key) => {
+                        const entry = transportsByKey.get(key);
+                        return entry ? [entry.id] : [];
+                      }),
+                    }
+                  : {
+                      type: "Writable",
+                      ownerId: owner.ownerId,
+                      routes: owner.routes.flatMap(
+                        ({
+                          transportKey,
+                          progress,
+                          lastSentAt,
+                          lastReceivedAt,
+                        }): Array<SyncRoute> => {
+                          const entry = transportsByKey.get(transportKey);
+                          if (!entry) return [];
+                          const transportId = entry.id;
+                          if (progress.type !== "Pending") {
+                            // Only a sent round settles a route or completes
+                            // it.
+                            assertNonNullable(lastSentAt);
+                            return [
+                              progress.type === "Complete"
+                                ? {
+                                    type: "Complete",
+                                    transportId,
+                                    completeAt: progress.completeAt,
+                                    lastSentAt,
+                                    lastReceivedAt,
+                                  }
+                                : {
+                                    type: "Settled",
+                                    transportId,
+                                    skippedError: progress.error,
+                                    completeAt: progress.completeAt,
+                                    lastSentAt,
+                                    lastReceivedAt,
+                                  },
+                            ];
+                          }
+                          // Only a database that has not refused startup
+                          // publishes routes.
+                          unsettledTransportIds.add(transportId);
+                          return [
+                            {
+                              type: "Pending",
+                              transportId,
+                              failure: progress.failure,
+                              skippedError: progress.skip?.error ?? null,
+                              completeAt: progress.completeAt,
+                              lastSentAt,
+                              lastReceivedAt,
+                            },
+                          ];
+                        },
+                      ),
+                    },
               ),
             };
           },
         );
-        // A grown timeout lasts while a request is outstanding on the socket
-        // or a database that has not refused startup has an incomplete route
-        // through it. Every change to either publishes, including a route that
-        // goes away without completing.
-        const incompleteTransportIds = new Set<SyncTransportId>();
-        for (const { refused, owners } of tenants) {
-          if (refused) continue;
-          for (const { routes } of owners)
-            for (const { transportId, complete } of routes)
-              if (!complete) incompleteTransportIds.add(transportId);
-        }
         for (const entry of transportsByKey.values())
           if (
             entry.outstandingByOwnerId.size === 0 &&
-            !incompleteTransportIds.has(entry.id)
+            !unsettledTransportIds.has(entry.id)
           )
             entry.timeout = syncRequestTimeout;
         syncStateBroadcastChannel.postMessage({ transports, tenants });
@@ -1295,10 +1978,14 @@ export const initSharedWorker =
         );
         // Reconnecting abandons the connection and starts a fresh retry
         // schedule. The socket reports no close for it, so the transport
-        // records the moment here.
+        // disconnects here.
         entry.socket?.reconnect();
-        // `now` is monotonic; the reported close time is wall clock.
-        entry.closedAt = deps.time.now();
+        // `now` is monotonic; the reported time is wall clock.
+        entry.connection = disconnectSyncConnection(
+          entry.connection,
+          deps.time.now(),
+          null,
+        );
         refreshAllSyncRoutes();
         publishSyncState();
       }, delay);
@@ -1346,9 +2033,7 @@ export const initSharedWorker =
               outstandingByOwnerId: new Map(),
               timeout: syncRequestTimeout,
               socket: null,
-              openedAt: null,
-              closedAt: null,
-              error: null,
+              connection: connectingSyncConnection,
               timeoutId: null,
             };
             await using disposer = new AsyncDisposableStack();
@@ -1371,7 +2056,16 @@ export const initSharedWorker =
                   // answered.
                   entry.outstandingByOwnerId.clear();
                   clearSyncRequestTimeout(entry);
-                  entry.openedAt = run.deps.time.now();
+                  // A connection that opens keeps the last error of an earlier
+                  // one.
+                  entry.connection = {
+                    type: "Open",
+                    openedAt: run.deps.time.now(),
+                    error:
+                      entry.connection.type === "Connecting"
+                        ? null
+                        : entry.connection.error,
+                  };
                   publishSyncState();
                   const ownerIds = transports.getClaimsForResource(transport);
                   console.debug("transportOpen", {
@@ -1395,7 +2089,11 @@ export const initSharedWorker =
                     code: event.code,
                     wasClean: event.wasClean,
                   });
-                  entry.closedAt = run.deps.time.now();
+                  entry.connection = disconnectSyncConnection(
+                    entry.connection,
+                    run.deps.time.now(),
+                    null,
+                  );
                   clearSyncRequestTimeout(entry);
                   refreshAllSyncRoutes();
                   publishSyncState();
@@ -1406,10 +2104,17 @@ export const initSharedWorker =
                     url: transport.url,
                     type: error.type,
                   });
-                  entry.error = {
-                    type: error.type,
-                    at: run.deps.time.now(),
-                  };
+                  // Every error disconnects. A browser reports a failed
+                  // attempt only as an error, because the socket stops
+                  // listening before its close arrives. A connection error
+                  // arrives once the socket is closed, before its close, and
+                  // exhausted retries end reconnecting.
+                  const now = run.deps.time.now();
+                  entry.connection = disconnectSyncConnection(
+                    entry.connection,
+                    now,
+                    { type: error.type, at: now },
+                  );
                   refreshAllSyncRoutes();
                   publishSyncState();
                 },
@@ -1474,9 +2179,8 @@ export const initSharedWorker =
             // LIFO: the transport drops its timer and its socket reference
             // before the socket is disposed. `disposable` guards every method
             // of the socket the claims lease, and disposing the socket awaits
-            // its retry, so a `publishSyncState` microtask can run while this
-            // entry is still registered. It must find no socket rather than
-            // read a disposed one.
+            // its retry, so this entry stays registered meanwhile. It keeps its
+            // last connection and holds no socket to reconnect.
             disposer.defer(() => {
               clearSyncRequestTimeout(entry);
               entry.socket = null;
@@ -1535,13 +2239,17 @@ export const initSharedWorker =
     const tenantsByName = disposer.use(
       await sharedWorkerRun.ok(
         createSharedResourceByKey(
-          (message: ExtractTyped<SharedWorkerInput, "CreateEvolu">) =>
-            createEvoluTenant(
-              isPersistentStorageUnavailable
-                ? { ...message, memoryOnly: true }
-                : message,
+          (message: ExtractTyped<SharedWorkerInput, "CreateEvolu">) => {
+            const memoryOnly =
+              message.memoryOnly ||
+              platformDevicePersistence === "NotPersisted";
+            return createEvoluTenant(
+              { ...message, memoryOnly },
+              memoryOnly ? "NotPersisted" : platformDevicePersistence,
               currentTenantsByName,
-            ),
+              workerId,
+            );
+          },
           {
             idleDisposeAfter: "3s",
             lookup: (message) => message.name,
@@ -1570,7 +2278,9 @@ const createEvoluTenant =
       encryptionKey,
       memoryOnly,
     }: ExtractTyped<SharedWorkerInput, "CreateEvolu">,
+    devicePersistence: DevicePersistence,
     currentTenantsByName: Map<Name, BorrowedResource<EvoluTenant>>,
+    workerId: SharedWorkerId,
   ): Task<EvoluTenant, never, EvoluTenantDeps> =>
   async (run) => {
     await using disposer = new AsyncDisposableStack();
@@ -1741,6 +2451,7 @@ const createEvoluTenant =
           sqliteSchema,
           encryptionKey,
           memoryOnly,
+          sharedWorkerId: workerId,
           port: dbWorkerChannel.port1.native,
         },
         [dbWorkerChannel.port1.native],
@@ -1896,20 +2607,16 @@ const createEvoluTenant =
       }
     };
 
-    disposer.defer(async () => {
+    // Disposal does not wait for the DbWorker. It holds the database lock
+    // until Dispose arrives, its tab closes, or this worker ends, and the next
+    // DbWorker for this database, of this worker or another build, waits for
+    // that lock before it reads the clock. A requested DbWorker that reports
+    // in later gets Dispose from the isDisposing check.
+    disposer.defer(() => {
       isDisposing = true;
       dbWorkerPort?.postMessage({ type: "Dispose" });
       dbWorkerPort = null;
       activeDispatch = null;
-
-      // The DbWorker holds this tenant leader lock while it is alive. Tenant
-      // disposal sends Dispose, then acquires the same lock to wait until the
-      // DbWorker releases it: either because Dispose was delivered or because
-      // the hosting tab closed. A worker requested from a later tab leader may
-      // be queued for the lock first; it is told to stop when it reports in.
-      // The wait is unabortable because tenant disposal must finish even after
-      // tenantRun receives an abort request.
-      await using _ = await tenantRun.ok(acquireLeaderLock(name));
     });
 
     const handleResponseForEvolu = (
@@ -1996,23 +2703,47 @@ const createEvoluTenant =
           break;
         }
 
+        case "MutateFailed": {
+          // The tab shows it, and the instance releases the mutation's
+          // onComplete callbacks without running them. A write outlives its
+          // instance, so without one, every tab is told.
+          //
+          // A replay after leader replacement can fail although the earlier
+          // leader committed the write and only its answer was lost. The tab
+          // then shows an error for a stored write, and its onComplete
+          // callbacks never run. Nothing is lost or reused: the replacement
+          // adopted the stored clock, refreshed every instance's queries, and
+          // reconciles every used owner.
+          const { error } = response.message;
+          if (instance) {
+            assertSame(first.message.type, "Mutate");
+            instance.tabPort.postMessage({ type: "Error", error });
+            instance.port.postMessage({
+              type: "OnMutateFailed",
+              onCompleteIds: first.message.onCompleteIds,
+            });
+          } else {
+            deps.postConsoleEntryOrError({ type: "Error", error });
+          }
+          break;
+        }
+
         case "Export":
           instance?.port.postMessage(
             { type: "OnExport", file: response.message.file },
             [response.message.file.buffer],
           );
           break;
+
+        default:
+          exhaustiveCheck(response.message);
       }
     };
 
     interface RouteState {
-      /** A round must be sent through the route before it can be complete. */
-      roundRequired: boolean;
-      complete: boolean;
-      completeAt: Millis | null;
+      progress: RouteProgress;
       lastSentAt: Millis | null;
       lastReceivedAt: Millis | null;
-      error: SyncRouteError | null;
     }
     const routesByOwnerIdByKey = new Map<
       StructuralLookupKey,
@@ -2031,12 +2762,15 @@ const createEvoluTenant =
       let route = routesByOwnerId.get(ownerId);
       if (!route) {
         route = {
-          roundRequired: true,
-          complete: false,
-          completeAt: null,
+          progress: {
+            type: "Pending",
+            roundRequired: true,
+            failure: null,
+            skip: null,
+            completeAt: null,
+          },
           lastSentAt: null,
           lastReceivedAt: null,
-          error: null,
         };
         routesByOwnerId.set(ownerId, route);
       }
@@ -2099,20 +2833,28 @@ const createEvoluTenant =
           // worker answers it. Local-only changes create no synchronization
           // work.
           const hasQueuedWrite = pendingWriteCountByOwnerId.has(ownerId);
-          // A refused database synchronizes nothing, and refusal discards its
-          // queued writes without uploading them.
-          const complete =
-            startupError === null &&
+          const isReconciled =
             isOpen &&
             deps.syncRequests.getOutstanding(ownerId, key) === 0 &&
             !hasQueuedApply &&
-            !hasQueuedWrite &&
-            !route.roundRequired;
-          if (complete && !route.complete) {
-            route.completeAt = deps.time.now();
-            route.error = null;
-          }
-          route.complete = complete;
+            !hasQueuedWrite;
+          // Settling drops the failure, so the next one requests a round
+          // again. A route with a skip it is not rechecking settles without
+          // completing, because its relay may offer the skipped message or
+          // lack messages stored elsewhere.
+          const pending = routeToPending(route.progress);
+          route.progress =
+            !isReconciled || pending.roundRequired
+              ? pending
+              : pending.skip && !pending.skip.isRechecking
+                ? {
+                    type: "Settled",
+                    error: pending.skip.error,
+                    completeAt: pending.completeAt,
+                  }
+                : route.progress.type === "Complete"
+                  ? route.progress
+                  : { type: "Complete", completeAt: deps.time.now() };
         }
       }
     };
@@ -2144,8 +2886,10 @@ const createEvoluTenant =
                 .get(structuralLookup(transport))
                 ?.get(ownerId);
               if (!route) return;
-              route.roundRequired = true;
-              route.error = { type: "SyncFailed", at: now };
+              route.progress = failRoute(route.progress, {
+                type: "SyncFailed",
+                at: now,
+              });
             });
           }
           deps.publishSyncState();
@@ -2159,7 +2903,14 @@ const createEvoluTenant =
           const { ownerId, result } = response.message;
           const error = result.ok ? null : result.error;
           const isAborted = error?.type === "AbortError";
-          let failure: SyncRouteErrorType | null = null;
+          // An aborted apply reports no skipped message.
+          const skippedError = isAborted ? null : response.message.skippedError;
+          let failure:
+            | ProtocolError
+            | StorageWriteMessagesError
+            | Typed<"WriteFailed">
+            | Typed<"SyncFailed">
+            | null = null;
           if (isAborted) {
             // An abort proves no convergence. A local sibling copy affects
             // every route; a relay frame affects only its source route.
@@ -2168,17 +2919,22 @@ const createEvoluTenant =
               const key = structuralLookup(transport);
               if (source.type === "Transport" && source.key !== key) return;
               const route = routesByOwnerIdByKey.get(key)?.get(ownerId);
-              if (route) route.roundRequired = true;
+              if (route)
+                route.progress = {
+                  ...routeToPending(route.progress),
+                  roundRequired: true,
+                };
             });
           } else if (error !== null) {
-            failure = error.type;
-            deps.postConsoleEntryOrError({
-              type: "Error",
-              error,
-            });
+            // A relay's error shows on its route, not as an EvoluError,
+            // because it belongs to one relay and often repeats in every
+            // round. A sibling copy's error is reported below.
+            failure = error;
           } else if (result.ok && result.value.type === "Failed") {
-            failure =
-              result.value.cause === "Write" ? "WriteFailed" : "SyncFailed";
+            failure = {
+              type:
+                result.value.cause === "Write" ? "WriteFailed" : "SyncFailed",
+            };
           }
           if (source.type === "Transport") {
             // A registration or claim may have been removed while this apply
@@ -2188,39 +2944,69 @@ const createEvoluTenant =
               const now = deps.time.now();
               // An aborted apply applied nothing.
               if (!isAborted) route.lastReceivedAt = now;
+              // A skipped message is recorded as the route's skip, not a
+              // failure, and does not end the round, whose response below is
+              // still sent, so it requests no round. The relay offers the
+              // message again in every later round, so the route stays
+              // incomplete until a round requested through it settles without
+              // skipping a message and without messages stored elsewhere since
+              // that request.
+              if (skippedError !== null)
+                route.progress = {
+                  ...routeToPending(route.progress),
+                  skip: {
+                    error: errorToSyncRouteError(skippedError, now),
+                    isRechecking: false,
+                  },
+                };
               if (failure !== null) {
-                // The first failure since the route completed requests one
+                // The first failure since the route settled requests one
                 // round. Further failures wait for an explicit request or a
                 // reopen, even after a converged reply, which may answer
                 // another request.
-                if (route.error === null)
+                const requestsRetry =
+                  route.progress.type !== "Pending" ||
+                  route.progress.failure === null;
+                route.progress = failRoute(
+                  route.progress,
+                  errorToSyncRouteError(failure, now),
+                );
+                if (requestsRetry)
                   requestCreateSyncMessages(new Set([ownerId]), source);
-                route.roundRequired = true;
-                route.error = { type: failure, at: now };
               }
             }
-          } else if (failure !== null) {
-            // A sibling's messages were not stored; rounds fetch them from
-            // the relays.
-            requestCreateSyncMessages(new Set([ownerId]), allTransports);
+          } else if (failure !== null || skippedError !== null) {
+            // A sibling's copy comes from this worker, not from a relay, so no
+            // route shows its failure. It is a Broadcast, which carries no
+            // relay error, so an error or a skip means a bug, such as
+            // databases holding different keys for the owner, and is reported
+            // as an unexpected failure. A Failed result was logged, which
+            // reports it already. An error is the failure, which is never an
+            // abort, and like a route, the report leaves out its frame.
+            const unexpected = error !== null ? failure : skippedError;
+            if (unexpected !== null)
+              deps.postConsoleEntryOrError({
+                type: "Error",
+                error: createUnknownError(
+                  errorToSyncRouteError(unexpected, deps.time.now()),
+                ),
+              });
+            // Some of a sibling's messages were not stored; rounds fetch them
+            // from the relays, whose routes then record a skip for any message
+            // this database skips.
+            requestRoundsForReceivedMessages(ownerId, {
+              except: null,
+              afterQueuedWrites: true,
+            });
           }
 
           if (response.message.didWriteMessages) {
             refreshQueries();
             // Reconcile newly stored messages through each other transport.
-            // Rounds toward the same transport coalesce whatever their source.
-            const keys: Array<StructuralLookupKey> = [];
-            deps.transports.forEachResourceForClaim(ownerId, (_, transport) => {
-              if (isTargetTransport(target, transport)) return;
-              keys.push(structuralLookup(transport));
+            requestRoundsForReceivedMessages(ownerId, {
+              except: target,
+              afterQueuedWrites: false,
             });
-            for (const key of keys) {
-              requestCreateSyncMessages(
-                new Set([ownerId]),
-                { type: "Transport", key },
-                { afterQueuedWrites: false },
-              );
-            }
           }
 
           if (result.ok) {
@@ -2299,7 +3085,11 @@ const createEvoluTenant =
             deps.syncRequests.noteSent(ownerId, key);
             const route = getRoute(ownerId, key);
             route.lastSentAt = deps.time.now();
-            if (isRound) route.roundRequired = false;
+            if (isRound)
+              route.progress = {
+                ...routeToPending(route.progress),
+                roundRequired: false,
+              };
           },
         );
       }
@@ -2307,6 +3097,48 @@ const createEvoluTenant =
       if (protocolMessagesByOwnerId.size > 0) deps.refreshAllSyncRoutes();
     };
 
+    /**
+     * Requests a round through each transport claimed for the owner outside
+     * `except`, after messages from elsewhere were stored or a sibling copy was
+     * not fully stored. Rounds toward the same transport coalesce whatever
+     * their source. A route that skipped a message gets none, because its relay
+     * would offer that message again, and a route rechecking one stops
+     * rechecking, because its round may have read the database before this
+     * event. A later requested round through such a route reconciles it.
+     */
+    const requestRoundsForReceivedMessages = (
+      ownerId: OwnerId,
+      {
+        except,
+        afterQueuedWrites,
+      }: { except: SyncTarget | null; afterQueuedWrites: boolean },
+    ): void => {
+      const keys: Array<StructuralLookupKey> = [];
+      deps.transports.forEachResourceForClaim(ownerId, (_, transport) => {
+        if (except && isTargetTransport(except, transport)) return;
+        const key = structuralLookup(transport);
+        const route = routesByOwnerIdByKey.get(key)?.get(ownerId);
+        if (route?.progress.type === "Settled") return;
+        if (route?.progress.type === "Pending" && route.progress.skip) {
+          // A round already requested may have read the database before these
+          // messages were stored, so it can no longer complete the route.
+          route.progress = {
+            ...route.progress,
+            skip: { ...route.progress.skip, isRechecking: false },
+          };
+          return;
+        }
+        keys.push(key);
+      });
+      for (const key of keys) {
+        requestCreateSyncMessages(
+          new Set([ownerId]),
+          { type: "Transport", key },
+          { afterQueuedWrites },
+        );
+      }
+    };
+
     /** The keys of every transport claimed for the owner, by any database. */
     const getClaimedKeys = (
       ownerId: OwnerId,
@@ -2341,11 +3173,18 @@ const createEvoluTenant =
       if (startupError) return;
       const usedOwnersById = getUsedOwnersById(ownerIds);
       // Opening, storing messages from another transport, a failure, and an
-      // explicit request each require a new round before completion.
+      // explicit request each require a new round before completion. The
+      // round also checks again whether the relay holds a skipped message.
       for (const ownerId of usedOwnersById.keys()) {
         deps.transports.forEachResourceForClaim(ownerId, (_, transport) => {
           if (!isTargetTransport(target, transport)) return;
-          getRoute(ownerId, structuralLookup(transport)).roundRequired = true;
+          const route = getRoute(ownerId, structuralLookup(transport));
+          const pending = routeToPending(route.progress);
+          route.progress = {
+            ...pending,
+            roundRequired: true,
+            skip: pending.skip && { ...pending.skip, isRechecking: true },
+          };
         });
       }
       refreshSyncRoutes();
@@ -2493,33 +3332,32 @@ const createEvoluTenant =
     });
     const tenant = disposable<EvoluTenant>(
       {
-        getSyncTenant: () => ({
-          name,
-          refused: startupError !== null,
-          owners: getSyncOwners().map(
-            ({ ownerId, writable, transportKeys }) => ({
-              ownerId,
-              writable,
-              transportKeys,
-              routes: writable
-                ? transportKeys.map((key): TenantSyncRoute => {
-                    const route = routesByOwnerIdByKey.get(key)?.get(ownerId);
-                    // Registration and claim changes refresh routes before yielding.
-                    // Snapshot reads must not create missing routes.
-                    assertNotUndefined(route);
-                    return {
-                      transportKey: key,
-                      complete: route.complete,
-                      completeAt: route.completeAt,
-                      lastSentAt: route.lastSentAt,
-                      lastReceivedAt: route.lastReceivedAt,
-                      error: route.error,
-                    };
-                  })
-                : [],
-            }),
-          ),
-        }),
+        getSyncTenant: () =>
+          startupError
+            ? { type: "Refused", name, error: startupError }
+            : {
+                type: "Active",
+                name,
+                owners: getSyncOwners().map(
+                  ({ ownerId, writable, transportKeys }): TenantSyncOwner =>
+                    writable
+                      ? {
+                          type: "Writable",
+                          ownerId,
+                          routes: transportKeys.map((key): TenantSyncRoute => {
+                            const route = routesByOwnerIdByKey
+                              .get(key)
+                              ?.get(ownerId);
+                            // Registration and claim changes refresh routes
+                            // before yielding. Snapshot reads must not create
+                            // missing routes.
+                            assertNotUndefined(route);
+                            return { transportKey: key, ...route };
+                          }),
+                        }
+                      : { type: "Readonly", ownerId, transportKeys },
+                ),
+              },
 
         refreshSyncRoutes,
 
@@ -2553,19 +3391,19 @@ const createEvoluTenant =
 
           disposer.defer(instance.onDisposed);
 
-          disposer.defer(async () => {
-            await tenantRun(
-              instance.useOwnerMutex.withLock(() => {
-                for (const leases of instance.ownerRegistrations.values()) {
-                  for (const lease of leases) lease?.release();
-                }
-                instance.ownerRegistrations.clear();
-                deps.refreshAllSyncRoutes();
-                deps.publishSyncState();
-                return ok();
-              }),
-            );
+          disposer.defer(() => {
+            for (const leases of instance.ownerRegistrations.values()) {
+              for (const lease of leases) lease?.release();
+            }
+            instance.ownerRegistrations.clear();
+            deps.refreshAllSyncRoutes();
+            deps.publishSyncState();
           });
+          // Cleanup starts no Task, because a root abort may dispose every Run
+          // first. Disposed before the claims above are released, this Run
+          // aborts queued UseOwner batches and waits for the running one, whose
+          // transport claim cannot be aborted, so the release sees every lease.
+          const instanceRun = disposer.use(tenantRun.create());
 
           disposer.defer(() => {
             instancesById.delete(instance.id);
@@ -2576,12 +3414,18 @@ const createEvoluTenant =
           disposer.defer(() => {
             instance.port.onMessage = null;
           });
+          // Instances of one name share the tenant, so each learns the mode
+          // the first one chose.
+          instance.port.postMessage({
+            type: "OnDevicePersistence",
+            devicePersistence,
+          });
 
           // The main-thread Evolu instance holds this per-instance leader lock
           // while it is alive. Acquiring the same lock here means the main
           // thread instance was disposed or its tab closed, so the tenant-side
           // instance must dispose itself.
-          void tenantRun
+          void instanceRun
             .abortable(acquireLeaderLock(message.id))
             .then((lock) => {
               if (!lock.ok) return;
@@ -2622,7 +3466,7 @@ const createEvoluTenant =
                 break;
               }
               case "UseOwner": {
-                void tenantRun(
+                void instanceRun(
                   instance.useOwnerMutex.withLock(async (run) => {
                     for (const action of message.actions) {
                       switch (action.action) {
@@ -2729,14 +3573,14 @@ const createEvoluTenant =
 //     })
 
 // TODO: SharedWorker follow-ups.
-// - Complete the queue head when a DbWorker mutation returns an error.
 // - Rotate the node ID when a copied database is detected; see the Duplicate
 //   node IDs section in the Timestamp module.
 // - Detect DbWorker and port liveness so a worker-only crash resumes the queue.
 //   Defer panicked-worker restart until failure detection and recovery are
-//   defined, accounting for SQLite WASM's detection limits. Normal SQLite
-//   operations are expected not to throw; user-defined UNIQUE indexes, which
-//   can make replicated writes fail, are planned to be forbidden.
+//   defined, accounting for SQLite WASM's detection limits. A mutation that
+//   throws is answered, but other SQLite operations are expected not to throw;
+//   user-defined UNIQUE indexes, which can make replicated writes fail, are
+//   planned to be forbidden.
 // - Split worker protocol types and the EvoluTenant implementation into focused
 //   modules.
 // - Remove the obsolete commented protocol block above.