@evolu/common 8.15.1 → 8.16.0

package/dist/src/local-first/Shared.js

@@ -102,18 +102,19 @@
  * another tenant's request is still a valid reconciliation step.
  *
  * Traffic goes only where it is needed. A continuation returns to the transport
- * that produced the response, and a round started by a socket opening or by a
- * tenant's first use of a transport for an owner goes through that transport.
- * Explicit synchronization requests and mutation uploads go to every open
- * transport claimed for the owner. A write uploads through the database's
- * writable registrations for its owner, whichever instance made it, even one
- * disposed before the database worker answered. When a relay frame stores new
- * messages, the tenant requests a round through each other transport claimed
- * for the owner, so data learned from one relay reaches the others, except
- * through a route that skipped a message, as described below. A closed
- * transport reconciles when it opens, and a replacement leader reconciles every
- * transport again, because a response reporting stored messages may have been
- * lost.
+ * that produced the response, a round started by a socket opening or by a
+ * transport's first claim for an owner goes through that transport, and a
+ * tenant's first writable registration of an owner starts one through each
+ * transport already claimed for it. Explicit synchronization requests and
+ * mutation uploads go to every open transport claimed for the owner. A write
+ * uploads through the database's writable registrations for its owner,
+ * whichever instance made it, even one disposed before the database worker
+ * answered. When a relay frame stores new messages, the tenant requests a round
+ * through each other transport claimed for the owner, so data learned from one
+ * relay reaches the others, except through a route that skipped a message, as
+ * described below. A closed transport reconciles when it opens, and a
+ * replacement leader reconciles every transport again, because a response
+ * reporting stored messages may have been lost.
  *
  * Relays omit the sending socket when broadcasting an upload, so the uploader
  * also delivers it as local Broadcast frames to every other tenant with
@@ -128,12 +129,13 @@
  * ## Sync state
  *
  * The shared worker publishes one plain snapshot, {@link SyncState}, of every
- * transport it manages and every database and owner registration it holds, with
- * one route per writable registration and transport, as specified below. Each
- * part is a union of the states the worker keeps for it: a transport's
- * connection, a database that is active or refused startup, a writable or
- * readonly owner, and a pending, settled, or complete route. A transport's
- * events drive its connection, so publishing never reads a socket.
+ * transport it manages and every database it holds, with the owners its
+ * instances registered and, for each writable owner, one route per transport
+ * claimed for the owner by any database, as specified below. Each part is a
+ * union of the states the worker keeps for it: a transport's connection, a
+ * database that is active or refused startup, a writable or readonly owner, and
+ * a pending, settled, or complete route. A transport's events drive its
+ * connection, so publishing never reads a socket.
  *
  * Apps show users an owner's {@link OwnerSyncStatus}, which
  * {@link syncStateToOwnerSyncStatus} derives. A view of each relay pairs each
@@ -172,10 +174,10 @@
  * - The tenant has no replicated write for the owner queued, because its upload
  *   is sent only after the database worker answers it.
  * - The tenant has sent a round through the transport since the last event that
- *   requires one: its first use of the transport for the owner, the socket
- *   opening, an explicit request, a replacement leader, or storing messages
- *   from another transport, unless the route skipped a message. No failed or
- *   aborted result has arrived on the route since.
+ *   requires one: the route's creation, the socket opening, an explicit
+ *   request, a replacement leader, or storing messages from another transport,
+ *   unless the route skipped a message. No failed or aborted result has arrived
+ *   on the route since.
  * - No result that skipped a received message has arrived on the route since a
  *   round was last requested through it, and since that request, no messages
  *   have been stored from another transport, directly or through a sibling copy
@@ -197,7 +199,8 @@
  * requires a round through every transport whose route has not skipped one.
  *
  * A failed result on a route requests one round through it. Any further failure
- * before the route settles waits for an explicit request or a reopen, so a
+ * before the route settles requests no round of its own and waits for the next
+ * round another event requests, such as an explicit request or a reopen, so a
  * persistent failure cannot loop; a converged reply in between does not end the
  * wait, because it may answer another tenant's round on the shared socket. An
  * aborted apply leaves its routes incomplete without a retry. An exception
@@ -216,9 +219,8 @@
  * message with that timestamp. The messages received elsewhere that the last
  * condition names request no round through such a route, even while a requested
  * round checks it again, because each round would download every skipped
- * message again. The next round that a first use of the transport for the
- * owner, an explicit request, a reopen, a replacement leader, or a failure
- * sends through the route reconciles them.
+ * message again. The next round that an explicit request, a reopen, a
+ * replacement leader, or a failure sends through the route reconciles them.
  *
  * ### Liveness
  *
@@ -314,9 +316,10 @@ import { acquireLeaderLock } from "../LockManager.js";
 import { createLookupMap, structuralLookup, } from "../Lookup.js";
 import { createRefCountedRelation } from "../Relation.js";
 import { createSharedResourceByKey, createSharedResourceByKeyWithClaims, } from "../Resource.js";
-import { ok } from "../Result.js";
+import { ok, trySync } from "../Result.js";
 import { createStore } from "../Store.js";
-import { AbortError, createMutex, unabortable, } from "../Task.js";
+import { safelyStringifyUnknownValue } from "../String.js";
+import { AbortError, createMutex, unabortable } from "../Task.js";
 import { performanceDurationBetween, PositiveMillis, } from "../Time.js";
 import { createId, id, literal, object, } from "../Type.js";
 import { createProtocolBroadcastMessagesFromCrdtMessages, createProtocolMessageForUnsubscribe, createProtocolMessageFromCrdtMessages, MessageType, parseProtocolHeader, } from "./Protocol.js";
@@ -324,6 +327,35 @@ import { makePatches, } from "./Query.js";
 import { isLocalOnlyTable } from "./Schema.js";
 import { orderTimestamp } from "./Timestamp.js";
 export const consoleEntryOrErrorBroadcastChannelName = "evolu:console-entry-or-error";
+/**
+ * Posts a {@link ConsoleEntry} to tabs on a channel named
+ * {@link consoleEntryOrErrorBroadcastChannelName}.
+ *
+ * An argument that cannot be structured-cloned is replaced: an `Error` by the
+ * plain object {@link createUnknownError} makes of it, and any other value, such
+ * as an object holding a function, by a string. Logging such a value in a
+ * worker therefore does not throw.
+ */
+export const postConsoleEntry = (channel, entry) => {
+    // A native BroadcastChannel throws a DataCloneError synchronously, into
+    // whatever called the console.
+    const posted = trySync(() => channel.postMessage({ type: "ConsoleEntry", entry }));
+    if (posted.ok)
+        return;
+    channel.postMessage({
+        type: "ConsoleEntry",
+        entry: {
+            ...entry,
+            args: entry.args.map((arg) => {
+                if (trySync(() => structuredClone(arg)).ok)
+                    return arg;
+                return arg instanceof Error
+                    ? createUnknownError(arg).error
+                    : safelyStringifyUnknownValue(arg);
+            }),
+        },
+    });
+};
 /** Identifies one running SharedWorker instance. */
 export const SharedWorkerId = /*#__PURE__*/ id("SharedWorker");
 /**
@@ -689,19 +721,14 @@ const routeToPending = (progress) => {
         case "Pending":
             return progress;
         case "Settled":
-            return {
-                type: "Pending",
-                roundRequired: false,
-                failure: null,
-                skip: { error: progress.error, isRechecking: false },
-                completeAt: progress.completeAt,
-            };
         case "Complete":
             return {
                 type: "Pending",
                 roundRequired: false,
                 failure: null,
-                skip: null,
+                skip: progress.type === "Settled"
+                    ? { error: progress.skippedError, isRechecking: false }
+                    : null,
                 completeAt: progress.completeAt,
             };
     }
@@ -709,11 +736,9 @@ const routeToPending = (progress) => {
 /**
  * Converts an error to a {@link SyncRouteError}: a caught value becomes an
  * {@link UnknownError}, and a {@link ProtocolInvalidDataError} leaves out its
- * data.
+ * data, which can be a whole frame.
  */
 const errorToSyncRouteError = (error, at) => {
-    // A caught value inside an error becomes an UnknownError, and a
-    // ProtocolInvalidDataError leaves out its data, which can be a whole frame.
     if (error.type === "ProtocolInvalidDataError") {
         const { data: _data, ...rest } = error;
         return { ...rest, error: createUnknownError(rest.error), at };
@@ -785,7 +810,7 @@ export const initSharedWorker = (self) => async (run) => {
                 port.onMessage = (message) => {
                     switch (message.type) {
                         case "AnnounceTabLeader": {
-                            console.setLevel(message.consoleLevel);
+                            deps.console.setLevel(message.consoleLevel);
                             tabLeaderPortStore.set(port);
                             console.info("tabLeaderAnnounced");
                             break;
@@ -832,7 +857,7 @@ export const initSharedWorker = (self) => async (run) => {
         disposer.defer(deps.consoleStoreOutputEntry.subscribe(() => {
             const entry = deps.consoleStoreOutputEntry.get();
             if (entry)
-                postConsoleEntryOrError({ type: "ConsoleEntry", entry });
+                postConsoleEntry(consoleEntryOrErrorBroadcastChannel, entry);
         }));
         const currentTenantsByName = new Map();
         const transportsByKey = new Map();
@@ -856,76 +881,23 @@ export const initSharedWorker = (self) => async (run) => {
                     label,
                     connection,
                 }));
+                const tenants = [...currentTenantsByName.values()].map((tenant) => tenant.getSyncTenant());
                 // A grown timeout lasts while a request is outstanding on the socket
                 // or a database that has not refused startup has an unsettled route
                 // through it. Every change to either publishes, including a route that
                 // goes away without settling.
                 const unsettledTransportIds = new Set();
-                const tenants = [...currentTenantsByName.values()].map((tenant) => {
-                    const state = tenant.getSyncTenant();
-                    if (state.type === "Refused")
-                        return state;
-                    return {
-                        type: "Active",
-                        name: state.name,
-                        owners: state.owners.map((owner) => owner.type === "Readonly"
-                            ? {
-                                type: "Readonly",
-                                ownerId: owner.ownerId,
-                                transportIds: owner.transportKeys.flatMap((key) => {
-                                    const entry = transportsByKey.get(key);
-                                    return entry ? [entry.id] : [];
-                                }),
-                            }
-                            : {
-                                type: "Writable",
-                                ownerId: owner.ownerId,
-                                routes: owner.routes.flatMap(({ transportKey, progress, lastSentAt, lastReceivedAt, }) => {
-                                    const entry = transportsByKey.get(transportKey);
-                                    if (!entry)
-                                        return [];
-                                    const transportId = entry.id;
-                                    if (progress.type !== "Pending") {
-                                        // Only a sent round settles a route or completes
-                                        // it.
-                                        assertNonNullable(lastSentAt);
-                                        return [
-                                            progress.type === "Complete"
-                                                ? {
-                                                    type: "Complete",
-                                                    transportId,
-                                                    completeAt: progress.completeAt,
-                                                    lastSentAt,
-                                                    lastReceivedAt,
-                                                }
-                                                : {
-                                                    type: "Settled",
-                                                    transportId,
-                                                    skippedError: progress.error,
-                                                    completeAt: progress.completeAt,
-                                                    lastSentAt,
-                                                    lastReceivedAt,
-                                                },
-                                        ];
-                                    }
-                                    // Only a database that has not refused startup
-                                    // publishes routes.
-                                    unsettledTransportIds.add(transportId);
-                                    return [
-                                        {
-                                            type: "Pending",
-                                            transportId,
-                                            failure: progress.failure,
-                                            skippedError: progress.skip?.error ?? null,
-                                            completeAt: progress.completeAt,
-                                            lastSentAt,
-                                            lastReceivedAt,
-                                        },
-                                    ];
-                                }),
-                            }),
-                    };
-                });
+                for (const tenant of tenants) {
+                    if (tenant.type !== "Active")
+                        continue;
+                    for (const owner of tenant.owners) {
+                        if (owner.type !== "Writable")
+                            continue;
+                        for (const route of owner.routes)
+                            if (route.type === "Pending")
+                                unsettledTransportIds.add(route.transportId);
+                    }
+                }
                 for (const entry of transportsByKey.values())
                     if (entry.outstandingByOwnerId.size === 0 &&
                         !unsettledTransportIds.has(entry.id))
@@ -962,8 +934,9 @@ export const initSharedWorker = (self) => async (run) => {
                         shortestRemaining = remaining;
                 }
                 if (!isTimedOut) {
-                    if (shortestRemaining === null)
-                        return;
+                    // Emptying outstandingByOwnerId clears this timer, so an owner is
+                    // still outstanding.
+                    assertNonNullable(shortestRemaining);
                     // Timer delays use integer milliseconds; round up to wait at least
                     // the remaining fractional duration.
                     armSyncRequestTimeout(entry, PositiveMillis.orThrow(Math.ceil(shortestRemaining)));
@@ -988,8 +961,7 @@ export const initSharedWorker = (self) => async (run) => {
         const syncRequests = {
             noteSent: (ownerId, key) => {
                 const entry = transportsByKey.get(key);
-                if (!entry)
-                    return;
+                assertNonNullable(entry);
                 const outstanding = entry.outstandingByOwnerId.get(ownerId);
                 if (outstanding)
                     outstanding.count++;
@@ -1008,6 +980,7 @@ export const initSharedWorker = (self) => async (run) => {
             const env_2 = { stack: [], error: void 0, hasError: false };
             try {
                 const key = structuralLookup(transport);
+                const target = { type: "Transport", key };
                 // The query carries the owner ID; WebSocket accepts URLs that
                 // URL() rejects, so the label is derived without parsing.
                 const queryIndex = transport.url.indexOf("?");
@@ -1024,10 +997,10 @@ export const initSharedWorker = (self) => async (run) => {
                 };
                 const disposer = __addDisposableResource(env_2, new AsyncDisposableStack(), true);
                 // Registered before the socket, so an aborted creation also
-                // forgets the transport.
+                // forgets the transport. No claim exists while a transport is
+                // created or torn down, so neither changes a route.
                 disposer.defer(() => {
                     transportsByKey.delete(key);
-                    refreshAllSyncRoutes();
                     publishSyncState();
                 });
                 transportsByKey.set(key, entry);
@@ -1054,13 +1027,8 @@ export const initSharedWorker = (self) => async (run) => {
                             url: transport.url,
                             ownerIds: [...ownerIds],
                         });
-                        const target = {
-                            type: "Transport",
-                            key: structuralLookup(transport),
-                        };
-                        forEachTenant((tenant) => {
+                        for (const tenant of currentTenantsByName.values())
                             tenant.requestCreateSyncMessages(ownerIds, target);
-                        });
                         refreshAllSyncRoutes();
                     },
                     onClose: (event) => {
@@ -1089,7 +1057,7 @@ export const initSharedWorker = (self) => async (run) => {
                         refreshAllSyncRoutes();
                         publishSyncState();
                     },
-                    onMessage(data) {
+                    onMessage: (data) => {
                         if (!(data instanceof ArrayBuffer))
                             return;
                         const message = new Uint8Array(data);
@@ -1123,12 +1091,8 @@ export const initSharedWorker = (self) => async (run) => {
                                 clearSyncRequestTimeout(entry);
                             publishSyncState();
                         }
-                        forEachTenant((tenant) => {
-                            tenant.requestApplySyncMessage(headerResult.value.ownerId, message, {
-                                type: "Transport",
-                                key: structuralLookup(transport),
-                            });
-                        });
+                        for (const tenant of currentTenantsByName.values())
+                            tenant.requestApplySyncMessage(headerResult.value.ownerId, message, target);
                         // Do not complete a sibling after decrementing the shared
                         // counter but before its apply has been queued.
                         refreshAllSyncRoutes();
@@ -1137,18 +1101,15 @@ export const initSharedWorker = (self) => async (run) => {
                 disposer.use(socket);
                 // LIFO: the transport drops its timer and its socket reference
                 // before the socket is disposed. `disposable` guards every method
-                // of the socket the claims lease, and disposing the socket awaits
-                // its retry, so this entry stays registered meanwhile. It keeps its
+                // of the socket lent to claims, and disposing the socket awaits its
+                // retry, so this entry stays registered meanwhile. It keeps its
                 // last connection and holds no socket to reconnect.
                 disposer.defer(() => {
                     clearSyncRequestTimeout(entry);
                     entry.socket = null;
-                    refreshAllSyncRoutes();
                 });
                 const disposables = disposer.move();
                 entry.socket = socket;
-                refreshAllSyncRoutes();
-                publishSyncState();
                 // `disposable` replaces the socket's disposal method in place, but
                 // `disposer.use` above already captured the original, so disposing
                 // `disposables` disposes the socket rather than recursing.
@@ -1170,9 +1131,8 @@ export const initSharedWorker = (self) => async (run) => {
                         type: "Transport",
                         key: structuralLookup(transport),
                     };
-                    forEachTenant((tenant) => {
+                    for (const tenant of currentTenantsByName.values())
                         tenant.requestCreateSyncMessages(new Set([ownerId]), target);
-                    });
                 }
                 refreshAllSyncRoutes();
             },
@@ -1189,6 +1149,11 @@ export const initSharedWorker = (self) => async (run) => {
         })));
         const sharedWorkerRun = disposer.use(run.create({
             ...deps,
+            getSyncTransportId: (key) => {
+                const entry = transportsByKey.get(key);
+                assertNonNullable(entry);
+                return entry.id;
+            },
             postConsoleEntryOrError,
             publishSyncState,
             refreshAllSyncRoutes,
@@ -1196,19 +1161,11 @@ export const initSharedWorker = (self) => async (run) => {
             tabLeaderPortStore,
             transports,
         }));
-        const tenantsByName = disposer.use(await sharedWorkerRun.ok(createSharedResourceByKey((message) => {
-            const memoryOnly = message.memoryOnly ||
-                platformDevicePersistence === "NotPersisted";
-            return createEvoluTenant({ ...message, memoryOnly }, memoryOnly ? "NotPersisted" : platformDevicePersistence, currentTenantsByName, workerId);
-        }, {
+        const tenantsByName = disposer.use(await sharedWorkerRun.ok(createSharedResourceByKey((message) => createEvoluTenant(message, message.memoryOnly ? "NotPersisted" : platformDevicePersistence, currentTenantsByName, workerId), {
             idleDisposeAfter: "3s",
             lookup: (message) => message.name,
         })));
         sharedWorkerReady.resolve();
-        const forEachTenant = (callback) => {
-            for (const tenant of currentTenantsByName.values())
-                callback(tenant);
-        };
         return ok(disposer.move());
     }
     catch (e_1) {
@@ -1221,13 +1178,14 @@ export const initSharedWorker = (self) => async (run) => {
             await result_1;
     }
 };
-const createEvoluTenant = ({ name, consoleLevel, sqliteSchema, encryptionKey, memoryOnly, }, devicePersistence, currentTenantsByName, workerId) => async (run) => {
+const createEvoluTenant = ({ name, consoleLevel, sqliteSchema, encryptionKey, }, devicePersistence, currentTenantsByName, workerId) => async (run) => {
     const env_3 = { stack: [], error: void 0, hasError: false };
     try {
         const disposer = __addDisposableResource(env_3, new AsyncDisposableStack(), true);
         const tenantRun = disposer.use(run.create());
         const { deps } = run;
         const console = deps.console.child(name).child("SharedWorker");
+        console.setLevel(consoleLevel);
         const instancesById = disposer.adopt(new Map(), async (instancesById) => {
             const env_4 = { stack: [], error: void 0, hasError: false };
             try {
@@ -1246,21 +1204,45 @@ const createEvoluTenant = ({ name, consoleLevel, sqliteSchema, encryptionKey, me
                     await result_4;
             }
         });
-        let dbWorkerPort = null;
         const dbWorkerInited = Promise.withResolvers();
+        let dbWorker = { type: "Starting" };
+        const queue = [];
+        const pendingWriteCountByOwnerId = new Map();
+        const pendingApplyCountForAllRoutesByOwnerId = new Map();
+        // Queued applies of relay frames, counted per owner and source transport.
+        const ownerTransportApplyRelation = createRefCountedRelation();
+        // Each tab is told once during this tenant's lifetime, through its own
+        // connection. Recreating the tenant after idle disposal retries startup
+        // and may report the refusal again.
+        const refusedTabPorts = new WeakSet();
+        const routesByOwnerIdByKey = new Map();
+        // Disposal does not wait for the DbWorker. It holds the database lock
+        // until Dispose arrives, its tab closes, or this worker ends, and the next
+        // DbWorker for this database, of this worker or another build, waits for
+        // that lock before it reads the clock. A requested DbWorker that reports
+        // in later gets Dispose, and a refused tenant stays refused, so it keeps
+        // dropping requests.
+        disposer.defer(() => {
+            if (dbWorker.type === "Leading")
+                dbWorker.port.postMessage({ type: "Dispose" });
+            if (dbWorker.type !== "Refused")
+                dbWorker = { type: "Disposed" };
+        });
         const initDbWorker = () => {
             // Without a tab leader yet, the store subscription starts the DbWorker
             // once a tab announces itself.
             const tabLeaderPort = deps.tabLeaderPortStore.get();
-            if (startupError || !tabLeaderPort)
+            if (dbWorker.type === "Refused" || !tabLeaderPort)
                 return;
             const dbWorkerChannel = deps.createMessageChannel();
             const currentDbWorkerPort = dbWorkerChannel.port2;
             currentDbWorkerPort.onMessage = (message) => {
                 switch (message.type) {
                     case "LeaderAcquired": {
-                        assertNotSame(dbWorkerPort, currentDbWorkerPort);
-                        if (startupError || isDisposing) {
+                        const previous = dbWorker;
+                        if (previous.type === "Leading")
+                            assertNotSame(previous.port, currentDbWorkerPort);
+                        if (previous.type === "Refused" || previous.type === "Disposed") {
                             // This worker was requested before the refusal or before
                             // disposal started. The tenant will not use it, so let it
                             // release the database lock.
@@ -1268,30 +1250,27 @@ const createEvoluTenant = ({ name, consoleLevel, sqliteSchema, encryptionKey, me
                             currentDbWorkerPort[Symbol.dispose]();
                             break;
                         }
-                        const replacesLeader = dbWorkerPort !== null;
-                        dbWorkerPort?.[Symbol.dispose]();
-                        dbWorkerPort = currentDbWorkerPort;
-                        activeDispatch = null;
-                        // A replacement may advance the clock by releasing quarantine, or
-                        // start behind it with an empty memoryOnly database. Keep the
-                        // greater clock; pending writes retain their captured inputs.
-                        if (sessionClock === null ||
-                            orderTimestamp(sessionClock, message.clock) === -1) {
-                            sessionClock = message.clock;
-                        }
+                        if (previous.type === "Leading")
+                            previous.port[Symbol.dispose]();
+                        dbWorker = {
+                            type: "Leading",
+                            port: currentDbWorkerPort,
+                            // A replacement may advance the clock by releasing quarantine,
+                            // or start behind it with an empty memoryOnly database. Keep the
+                            // greater clock; pending writes retain their captured inputs.
+                            clock: previous.type !== "Leading" ||
+                                orderTimestamp(previous.clock, message.clock) === -1
+                                ? message.clock
+                                : previous.clock,
+                            activeDispatch: null,
+                        };
                         // A replacement leader may have committed writes whose responses
                         // were lost, and may have released quarantine at startup. A lost
                         // response may also have reported stored owner messages, so the
                         // owners reconcile through every transport again.
-                        if (replacesLeader) {
+                        if (previous.type === "Leading") {
                             refreshQueries();
-                            const usedOwnerIds = new Set();
-                            for (const instance of instancesById.values()) {
-                                for (const { owner } of instance.ownerRegistrations.keys()) {
-                                    usedOwnerIds.add(owner.id);
-                                }
-                            }
-                            requestCreateSyncMessages(usedOwnerIds, allTransports);
+                            requestCreateSyncMessages(new Set(getSyncOwners().map(({ ownerId }) => ownerId)), allTransports);
                         }
                         console.info("leaderAcquired");
                         dbWorkerInited.resolve();
@@ -1299,21 +1278,20 @@ const createEvoluTenant = ({ name, consoleLevel, sqliteSchema, encryptionKey, me
                         break;
                     }
                     case "LeaderRefused": {
-                        assertNotSame(dbWorkerPort, currentDbWorkerPort);
                         // The worker refused startup and is releasing its resources.
                         // Requests stay unanswered until their instances are disposed.
                         // Keep the tenant unavailable, tell each connected tab once, and
                         // tell tabs that connect later without starting another worker.
-                        dbWorkerPort?.[Symbol.dispose]();
-                        dbWorkerPort = null;
+                        if (dbWorker.type === "Leading") {
+                            assertNotSame(dbWorker.port, currentDbWorkerPort);
+                            dbWorker.port[Symbol.dispose]();
+                        }
                         currentDbWorkerPort[Symbol.dispose]();
-                        activeDispatch = null;
                         queue.length = 0;
                         pendingWriteCountByOwnerId.clear();
                         pendingApplyCountForAllRoutesByOwnerId.clear();
                         ownerTransportApplyRelation.clear();
-                        startupError = message.error;
-                        refreshSyncRoutes();
+                        dbWorker = { type: "Refused", error: message.error };
                         deps.publishSyncState();
                         console.info("leaderRefused", message.error);
                         for (const instance of instancesById.values()) {
@@ -1323,19 +1301,18 @@ const createEvoluTenant = ({ name, consoleLevel, sqliteSchema, encryptionKey, me
                         break;
                     }
                     case "OnQueuedResponse": {
-                        if (activeDispatch?.attemptId !== message.attemptId)
+                        const leading = dbWorker;
+                        if (leading.type !== "Leading" ||
+                            leading.activeDispatch?.attemptId !== message.attemptId)
                             return;
-                        const { entry } = activeDispatch;
+                        const { entry } = leading.activeDispatch;
                         const { response } = message;
-                        if (response.message.type === "Mutate" ||
-                            response.message.type === "ApplySyncMessage") {
-                            // Replays report their computed clock, which a replacement
-                            // leader may have passed at startup. Keep the greater clock.
-                            assertNonNullable(sessionClock);
-                            if (orderTimestamp(sessionClock, response.message.clock) === -1) {
-                                sessionClock = response.message.clock;
-                            }
-                        }
+                        // Replays report their computed clock, which a replacement leader
+                        // may have passed at startup. Keep the greater clock.
+                        if ((response.message.type === "Mutate" ||
+                            response.message.type === "ApplySyncMessage") &&
+                            orderTimestamp(leading.clock, response.message.clock) === -1)
+                            leading.clock = response.message.clock;
                         switch (entry.type) {
                             case "Read":
                             case "Write":
@@ -1353,7 +1330,7 @@ const createEvoluTenant = ({ name, consoleLevel, sqliteSchema, encryptionKey, me
                         const head = queue.shift();
                         assertNonNullable(head);
                         updatePendingWork(head, -1);
-                        activeDispatch = null;
+                        leading.activeDispatch = null;
                         // Follow-up uploads and retries are already queued or sent. Only
                         // now can removing the completed head establish convergence.
                         refreshSyncRoutes();
@@ -1362,6 +1339,8 @@ const createEvoluTenant = ({ name, consoleLevel, sqliteSchema, encryptionKey, me
                         runQueue();
                         break;
                     }
+                    default:
+                        exhaustiveCheck(message);
                 }
             };
             tabLeaderPort.postMessage({
@@ -1370,7 +1349,7 @@ const createEvoluTenant = ({ name, consoleLevel, sqliteSchema, encryptionKey, me
                 consoleLevel,
                 sqliteSchema,
                 encryptionKey,
-                memoryOnly,
+                memoryOnly: devicePersistence === "NotPersisted",
                 sharedWorkerId: workerId,
                 port: dbWorkerChannel.port1.native,
             }, [dbWorkerChannel.port1.native]);
@@ -1382,11 +1361,6 @@ const createEvoluTenant = ({ name, consoleLevel, sqliteSchema, encryptionKey, me
                 instance.port.postMessage({ type: "RefreshQueries" });
             }
         };
-        const queue = [];
-        const pendingWriteCountByOwnerId = new Map();
-        const pendingApplyCountForAllRoutesByOwnerId = new Map();
-        // Queued applies of relay frames, counted per owner and source transport.
-        const ownerTransportApplyRelation = createRefCountedRelation();
         const updatePendingCount = (counts, key, delta) => {
             const count = (counts.get(key) ?? 0) + delta;
             assert(count >= 0, "Pending queue count must not become negative");
@@ -1430,59 +1404,42 @@ const createEvoluTenant = ({ name, consoleLevel, sqliteSchema, encryptionKey, me
             updatePendingWork(entry, 1);
             queue.push(entry);
         };
-        let sessionClock = null;
-        let startupError = null;
-        let isDisposing = false;
-        // Each tab is told once during this tenant's lifetime, through its own
-        // connection. Recreating the tenant after idle disposal retries startup
-        // and may report the refusal again.
-        const refusedTabPorts = new WeakSet();
         const reportRefusal = (tabPort, error) => {
             if (refusedTabPorts.has(tabPort))
                 return;
             refusedTabPorts.add(tabPort);
             tabPort.postMessage({ type: "Error", error });
         };
-        let activeDispatch = null;
         const runQueue = () => {
-            if (activeDispatch || !isNonEmptyArray(queue) || !dbWorkerPort)
+            if (dbWorker.type !== "Leading" ||
+                dbWorker.activeDispatch ||
+                !isNonEmptyArray(queue))
                 return;
-            assertNonNullable(sessionClock);
             const entry = firstInArray(queue);
             const attemptId = createId(run.deps);
-            activeDispatch = { entry, attemptId };
+            dbWorker.activeDispatch = { entry, attemptId };
             if (entry.type === "Write" || entry.type === "ApplySyncMessage") {
                 // A write captures its inputs on first dispatch, so a retry after
                 // leader replacement reproduces the same timestamps.
-                entry.now ??= run.deps.time.now();
-                entry.clock ??= sessionClock;
-                dbWorkerPort.postMessage({
+                entry.capturedInputs ??= {
+                    clock: dbWorker.clock,
+                    now: run.deps.time.now(),
+                };
+                dbWorker.port.postMessage({
                     type: "Request",
                     attemptId,
                     request: entry.request,
-                    clock: entry.clock,
-                    now: entry.now,
+                    ...entry.capturedInputs,
                 });
             }
             else {
-                dbWorkerPort.postMessage({
+                dbWorker.port.postMessage({
                     type: "Request",
                     attemptId,
                     request: entry.request,
                 });
             }
         };
-        // Disposal does not wait for the DbWorker. It holds the database lock
-        // until Dispose arrives, its tab closes, or this worker ends, and the next
-        // DbWorker for this database, of this worker or another build, waits for
-        // that lock before it reads the clock. A requested DbWorker that reports
-        // in later gets Dispose from the isDisposing check.
-        disposer.defer(() => {
-            isDisposing = true;
-            dbWorkerPort?.postMessage({ type: "Dispose" });
-            dbWorkerPort = null;
-            activeDispatch = null;
-        });
         const handleResponseForEvolu = (response, first) => {
             // A disposed instance gets no patches, but its committed write still
             // synchronizes.
@@ -1491,13 +1448,11 @@ const createEvoluTenant = ({ name, consoleLevel, sqliteSchema, encryptionKey, me
                 case "Mutate":
                 case "Query": {
                     if (instance) {
-                        const nextRowsByQuery = new Map(instance.rowsByQuery);
                         const patchesByQuery = new Map();
                         for (const [query, rows] of response.message.rowsByQuery) {
-                            nextRowsByQuery.set(query, rows);
                             patchesByQuery.set(query, makePatches(instance.rowsByQuery.get(query), rows));
+                            instance.rowsByQuery.set(query, rows);
                         }
-                        instance.rowsByQuery = nextRowsByQuery;
                         instance.port.postMessage({
                             type: "OnPatchesByQuery",
                             patchesByQuery,
@@ -1561,30 +1516,19 @@ const createEvoluTenant = ({ name, consoleLevel, sqliteSchema, encryptionKey, me
                     exhaustiveCheck(response.message);
             }
         };
-        const routesByOwnerIdByKey = new Map();
-        const getRoute = (ownerId, key) => {
-            let routesByOwnerId = routesByOwnerIdByKey.get(key);
-            if (!routesByOwnerId) {
-                routesByOwnerId = new Map();
-                routesByOwnerIdByKey.set(key, routesByOwnerId);
-            }
-            let route = routesByOwnerId.get(ownerId);
-            if (!route) {
-                route = {
-                    progress: {
-                        type: "Pending",
-                        roundRequired: true,
-                        failure: null,
-                        skip: null,
-                        completeAt: null,
-                    },
-                    lastSentAt: null,
-                    lastReceivedAt: null,
-                };
-                routesByOwnerId.set(ownerId, route);
-            }
-            return route;
-        };
+        const getRoute = (ownerId, key) => routesByOwnerIdByKey
+            .getOrInsertComputed(key, () => new Map())
+            .getOrInsertComputed(ownerId, () => ({
+            progress: {
+                type: "Pending",
+                roundRequired: true,
+                failure: null,
+                skip: null,
+                completeAt: null,
+            },
+            lastSentAt: null,
+            lastReceivedAt: null,
+        }));
         const getSyncOwners = () => {
             const ownersById = new Map();
             for (const instance of instancesById.values()) {
@@ -1653,7 +1597,7 @@ const createEvoluTenant = ({ name, consoleLevel, sqliteSchema, encryptionKey, me
                             : pending.skip && !pending.skip.isRechecking
                                 ? {
                                     type: "Settled",
-                                    error: pending.skip.error,
+                                    skippedError: pending.skip.error,
                                     completeAt: pending.completeAt,
                                 }
                                 : route.progress.type === "Complete"
@@ -1670,8 +1614,9 @@ const createEvoluTenant = ({ name, consoleLevel, sqliteSchema, encryptionKey, me
                     const { failedOwnerIds } = response.message;
                     if (failedOwnerIds.size === 0)
                         break;
-                    // A retry would likely fail the same way, so the routes wait for an
-                    // explicit request or a reopen.
+                    // A retry would likely fail the same way, so the routes wait for the
+                    // next round another event requests, such as an explicit request or
+                    // a reopen.
                     const now = deps.time.now();
                     for (const ownerId of failedOwnerIds) {
                         deps.transports.forEachResourceForClaim(ownerId, (_, transport) => {
@@ -1754,9 +1699,9 @@ const createEvoluTenant = ({ name, consoleLevel, sqliteSchema, encryptionKey, me
                                 };
                             if (failure !== null) {
                                 // The first failure since the route settled requests one
-                                // round. Further failures wait for an explicit request or a
-                                // reopen, even after a converged reply, which may answer
-                                // another request.
+                                // round. Further failures wait for the next round another event
+                                // requests, such as an explicit request or a reopen, even after
+                                // a converged reply, which may answer another request.
                                 const requestsRetry = route.progress.type !== "Pending" ||
                                     route.progress.failure === null;
                                 route.progress = failRoute(route.progress, errorToSyncRouteError(failure, now));
@@ -1903,7 +1848,7 @@ const createEvoluTenant = ({ name, consoleLevel, sqliteSchema, encryptionKey, me
             return ownersById;
         };
         const requestCreateSyncMessages = (ownerIds, target, { afterQueuedWrites = true, } = {}) => {
-            if (startupError)
+            if (dbWorker.type === "Refused")
                 return;
             const usedOwnersById = getUsedOwnersById(ownerIds);
             // Opening, storing messages from another transport, a failure, and an
@@ -1941,8 +1886,11 @@ const createEvoluTenant = ({ name, consoleLevel, sqliteSchema, encryptionKey, me
             const lastWriteIndex = afterQueuedWrites
                 ? queue.findLastIndex(({ type }) => type === "Write" || type === "ApplySyncMessage")
                 : -1;
+            const dispatchedEntry = dbWorker.type === "Leading"
+                ? dbWorker.activeDispatch?.entry
+                : undefined;
             const isQueued = queue.some((entry, index) => index > lastWriteIndex &&
-                entry !== activeDispatch?.entry &&
+                entry !== dispatchedEntry &&
                 entry.type === "CreateSyncMessages" &&
                 (entry.target.type === "AllTransports" ||
                     (target.type === "Transport" && entry.target.key === target.key)) &&
@@ -1971,23 +1919,12 @@ const createEvoluTenant = ({ name, consoleLevel, sqliteSchema, encryptionKey, me
                 const isFirstWritableUse = "writeKey" in syncOwner.owner &&
                     !getUsedOwnersById(new Set([ownerId])).has(ownerId);
                 // A transport first claimed for the owner starts every tenant's
-                // round through onFirstClaimAdded. A joining tenant also reconciles
-                // its existing history through the owner's already claimed transports.
-                // Later registrations reconcile only transports newly used here:
-                // earlier rounds may predate writes from an unregistered instance.
-                const claimedKeys = new Set(getClaimedKeys(ownerId));
-                const usedKeys = new Set();
-                for (const { ownerRegistrations } of instancesById.values()) {
-                    for (const [usedSyncOwner, leases] of ownerRegistrations) {
-                        if (usedSyncOwner.owner.id !== ownerId)
-                            continue;
-                        if (!leases.some((lease) => lease !== null))
-                            continue;
-                        for (const transport of usedSyncOwner.transports) {
-                            usedKeys.add(structuralLookup(transport));
-                        }
-                    }
-                }
+                // round through onFirstClaimAdded. A tenant's first writable
+                // registration reconciles its existing history through the
+                // transports already claimed for the owner. Later writes upload
+                // through every claimed transport, whichever instance made them, so
+                // later registrations need no round.
+                const claimedKeys = getClaimedKeys(ownerId);
                 const leases = instance.ownerRegistrations.getOrInsertComputed(syncOwner, () => []);
                 // First-claim callbacks must see the owner before acquisition finishes.
                 const index = leases.push(null) - 1;
@@ -2003,17 +1940,12 @@ const createEvoluTenant = ({ name, consoleLevel, sqliteSchema, encryptionKey, me
                     }
                     deps.refreshAllSyncRoutes();
                 }
-                const keysToSync = isFirstWritableUse
-                    ? claimedKeys
-                    : syncOwner.transports
-                        .map(structuralLookup)
-                        .filter((key) => claimedKeys.has(key) && !usedKeys.has(key));
-                for (const key of keysToSync) {
-                    requestCreateSyncMessages(new Set([ownerId]), {
-                        type: "Transport",
-                        key,
-                    });
-                }
+                if (isFirstWritableUse)
+                    for (const key of claimedKeys)
+                        requestCreateSyncMessages(new Set([ownerId]), {
+                            type: "Transport",
+                            key,
+                        });
             }
             else {
                 const claimLeases = instance.ownerRegistrations.get(syncOwner);
@@ -2045,8 +1977,8 @@ const createEvoluTenant = ({ name, consoleLevel, sqliteSchema, encryptionKey, me
             deps.publishSyncState();
         });
         const tenant = disposable({
-            getSyncTenant: () => startupError
-                ? { type: "Refused", name, error: startupError }
+            getSyncTenant: () => dbWorker.type === "Refused"
+                ? { type: "Refused", name, error: dbWorker.error }
                 : {
                     type: "Active",
                     name,
@@ -2062,10 +1994,46 @@ const createEvoluTenant = ({ name, consoleLevel, sqliteSchema, encryptionKey, me
                                 // before yielding. Snapshot reads must not create
                                 // missing routes.
                                 assertNotUndefined(route);
-                                return { transportKey: key, ...route };
+                                const transportId = deps.getSyncTransportId(key);
+                                const { progress, lastSentAt, lastReceivedAt } = route;
+                                if (progress.type === "Pending")
+                                    return {
+                                        type: "Pending",
+                                        transportId,
+                                        failure: progress.failure,
+                                        skippedError: progress.skip?.error ?? null,
+                                        completeAt: progress.completeAt,
+                                        lastSentAt,
+                                        lastReceivedAt,
+                                    };
+                                // Only a sent round settles a route or completes
+                                // it.
+                                assertNonNullable(lastSentAt);
+                                if (progress.type === "Complete")
+                                    return {
+                                        type: "Complete",
+                                        transportId,
+                                        completeAt: progress.completeAt,
+                                        lastSentAt,
+                                        lastReceivedAt,
+                                    };
+                                // Only a received reply records a skip.
+                                assertNonNullable(lastReceivedAt);
+                                return {
+                                    type: "Settled",
+                                    transportId,
+                                    skippedError: progress.skippedError,
+                                    completeAt: progress.completeAt,
+                                    lastSentAt,
+                                    lastReceivedAt,
+                                };
                             }),
                         }
-                        : { type: "Readonly", ownerId, transportKeys }),
+                        : {
+                            type: "Readonly",
+                            ownerId,
+                            transportIds: transportKeys.map(deps.getSyncTransportId),
+                        }),
                 },
             refreshSyncRoutes,
             addInstance: (message, tabPort, onDisposed) => {
@@ -2082,13 +2050,11 @@ const createEvoluTenant = ({ name, consoleLevel, sqliteSchema, encryptionKey, me
                     }),
                     port: deps.createMessagePort(message.evoluPort),
                     tabPort,
-                    onDisposed,
                     rowsByQuery: new Map(),
-                    useOwnerMutex: createMutex(),
                     [Symbol.asyncDispose]: () => disposer.disposeAsync(),
                 };
                 instancesById.set(instance.id, instance);
-                disposer.defer(instance.onDisposed);
+                disposer.defer(onDisposed);
                 disposer.defer(() => {
                     for (const leases of instance.ownerRegistrations.values()) {
                         for (const lease of leases)
@@ -2103,6 +2069,7 @@ const createEvoluTenant = ({ name, consoleLevel, sqliteSchema, encryptionKey, me
                 // aborts queued UseOwner batches and waits for the running one, whose
                 // transport claim cannot be aborted, so the release sees every lease.
                 const instanceRun = disposer.use(tenantRun.create());
+                const useOwnerMutex = createMutex();
                 disposer.defer(() => {
                     instancesById.delete(instance.id);
                     refreshSyncRoutes();
@@ -2131,7 +2098,7 @@ const createEvoluTenant = ({ name, consoleLevel, sqliteSchema, encryptionKey, me
                     return instance[Symbol.asyncDispose]();
                 });
                 instance.port.onMessage = (message) => {
-                    if (startupError)
+                    if (dbWorker.type === "Refused")
                         return;
                     switch (message.type) {
                         case "Query":
@@ -2163,7 +2130,7 @@ const createEvoluTenant = ({ name, consoleLevel, sqliteSchema, encryptionKey, me
                             break;
                         }
                         case "UseOwner": {
-                            void instanceRun(instance.useOwnerMutex.withLock(async (run) => {
+                            void instanceRun(useOwnerMutex.withLock(async (run) => {
                                 for (const action of message.actions) {
                                     switch (action.action) {
                                         case "sync":
@@ -2191,14 +2158,16 @@ const createEvoluTenant = ({ name, consoleLevel, sqliteSchema, encryptionKey, me
                             }));
                             break;
                         }
+                        default:
+                            exhaustiveCheck(message);
                     }
                 };
-                if (startupError)
-                    reportRefusal(instance.tabPort, startupError);
+                if (dbWorker.type === "Refused")
+                    reportRefusal(instance.tabPort, dbWorker.error);
             },
             requestCreateSyncMessages,
             requestApplySyncMessage: (ownerId, inputMessage, source) => {
-                if (startupError)
+                if (dbWorker.type === "Refused")
                     return;
                 const owner = getUsedOwnersById(new Set([ownerId])).get(ownerId);
                 if (!owner)
@@ -2236,39 +2205,16 @@ const createEvoluTenant = ({ name, consoleLevel, sqliteSchema, encryptionKey, me
             await result_3;
     }
 };
-//   | (Typed<"reset"> & {
-//       readonly onCompleteId: CallbackId;
-//       readonly reload: boolean;
-//       readonly restore?: {
-//         readonly sqliteSchema: SqliteSchema;
-//         readonly mnemonic: Mnemonic;
-//       };
-//     })
-//   | (Typed<"ensureSqliteSchema"> & {
-//       readonly sqliteSchema: SqliteSchema;
-//     })
-//   | (Typed<"export"> & {
-//       readonly onCompleteId: CallbackId;
-//     })
-//   | (Typed<"useOwner"> & {
-//       readonly use: boolean;
-//       readonly owner: SyncOwner;
-//     });
-//   | (Typed<"onReset"> & {
-//       readonly onCompleteId: CallbackId;
-//       readonly reload: boolean;
-//     })
 // TODO: SharedWorker follow-ups.
 // - Rotate the node ID when a copied database is detected; see the Duplicate
 //   node IDs section in the Timestamp module.
 // - Detect DbWorker and port liveness so a worker-only crash resumes the queue.
 //   Defer panicked-worker restart until failure detection and recovery are
-//   defined, accounting for SQLite WASM's detection limits. A mutation that
-//   throws is answered, but other SQLite operations are expected not to throw.
+//   defined, accounting for SQLite WASM's detection limits. Mutations, round
+//   creation, and frame application are answered when SQLite throws; a query
+//   or an export that throws is not, and stops the database's queue.
 // - Split worker protocol types and the EvoluTenant implementation into focused
 //   modules.
-// - Remove the obsolete commented protocol block above.
-// - Propagate invalid protocol messages to sync state.
 // - Bound sync state publishing during a bulk catch-up: every sent and applied
 //   frame changes a route timestamp, so each frame broadcasts a full snapshot
 //   to every tab. Throttling needs a wall-clock policy and a deterministic way