@hydranium/core 1.0.0-next.114 → 1.0.0-next.117

package/src/langium/model-service/model-service.ts

@@ -8,6 +8,7 @@
  ********************************************************************************/
 
 import {
+   type BasedOn,
    type CanonicalUri,
    type CloseModelArgs,
    ConflictError,
@@ -34,7 +35,10 @@ import { type LogNameOptions } from '../diagnostics/logger.js';
 import { IntegrityService } from '../integrity/integrity-service.js';
 import { labelPhaseListener } from '../document-builder/labeled-phase-listener.js';
 import { LANGUAGE_CLIENT_ID } from '../../documents/client-ids.js';
+import { DocumentNotOpenError } from '../../documents/client-session-errors.js';
+import { type OpenOptions } from '../../documents/client-session-registry.js';
 import { type ServerSharedServices } from '../module.js';
+import { type ClientSession, DefaultClientSession } from './client-session.js';
 
 /**
  * The undo-stack entry for a server-authored write pushed to the editor.
@@ -274,6 +278,21 @@ export interface ModelService<
    onModelUpdated(uri: string, listener: (event: AstDocumentUpdatedEvent<TAst, TDiagnostic>) => void): Disposable;
    onModelSaved(uri: string, listener: (event: AstDocumentSavedEvent<TAst, TDiagnostic>) => void): Disposable;
    onClientClosed(uri: string, clientId: string, listener: () => void): Disposable;
+
+   /**
+    * Start a client session. The id defaults to `label#` plus a random UUID;
+    * a fixed `clientId` is taken as given. Throws `DuplicateClientIdError` when
+    * the id is reserved by the framework, held by another live session, or has
+    * documents open under it as a client that is not a session.
+    *
+    * `TOpenOptions` types the options the session's `open` takes.
+    */
+   createSession<TOpenOptions extends OpenOptions = OpenOptions>(
+      label?: string,
+      clientId?: string
+   ): ClientSession<TAst, TDiagnostic, TTransfer, TOpenOptions>;
+   /** The live session started under `clientId`, or `undefined` once it has ended or was never started. */
+   getSession(clientId: string): ClientSession<TAst, TDiagnostic, TTransfer> | undefined;
 }
 
 export class DefaultModelService<
@@ -318,6 +337,20 @@ export class DefaultModelService<
    protected readonly syncChains = new Map<string, Promise<void>>();
    protected readonly pendingSync = new Map<string, string>();
 
+   /**
+    * The live sessions this service started, by client id. {@link update}
+    * reads it to tell a session's write, which must find its document open,
+    * from a write under a plain client id, which opens it.
+    */
+   protected readonly sessions = new Map<string, ClientSession<TAst, TDiagnostic, TTransfer>>();
+   /**
+    * Drops an ended session from {@link sessions}. Subscribed by the first
+    * {@link createSession} rather than at construction, so a services tree with
+    * no text store, or one that knows nothing of sessions, still constructs
+    * this service.
+    */
+   protected sessionCloseListener?: Disposable;
+
    /**
     * Workspace-level readiness gate. Resolves when the framework has
     * finished its first workspace build cycle and the `ModelService`
@@ -681,8 +714,19 @@ export class DefaultModelService<
     * with vN's specific settled snapshot, intermediate-phase
     * observability, slow-warn / hard-timeout behaviour) override this
     * method.
+    *
+    * **Upsert, except for a session.** Under a plain client id the write opens
+    * the document for that client first, creating it from the payload when no
+    * file exists. Under the id of a live session from {@link createSession} it
+    * opens nothing, and fails with `DocumentNotOpenError` unless the session
+    * has the URI open at the moment the text is applied.
     */
    async update(args: TransferUpdateArgs<TTransfer>, cancelToken?: CancellationToken): Promise<AstDocument<TAst, TDiagnostic>> {
+      // Read before the first await, while the call is still the caller's: a
+      // session that ends during the serialise would otherwise read as a plain
+      // client id here, and the write would open the document for an id no
+      // session owns any more and land there.
+      const bySession = this.sessions.has(args.clientId);
       const stopwatch = this.slowUpdateWarn !== undefined ? this.services.Clock.stopwatch() : undefined;
       // Per-stage self-time breakdown of the update/reconcile chain (serialise →
       // open → apply → rebuild), opt-in at debug — the default path skips the
@@ -731,16 +775,34 @@ export class DefaultModelService<
       // reason to close a document it never asked to open. Serialisation is
       // held back too; it is the adopter's code and need not be side-effect
       // free.
-      const currentVersion = this.services.workspace.TextDocuments.version(uri);
-      if (isSnapshotVersion(args.basedOn) && currentVersion !== args.basedOn) {
-         // Distinct from the post-build "superseded" debug line below: this is a
-         // based-on-stale rejection (the write never applies), not two writes racing.
-         this.tracer.debug(`Conflict on ${uri}: based-on v${args.basedOn} stale, server at v${currentVersion}`);
-         throw new ConflictError(uri, args.basedOn, currentVersion);
-      }
+      const textDocuments = this.services.workspace.TextDocuments;
+      this.checkBasedOn(uri, args.basedOn, textDocuments.version(uri));
+      // Whether this call's own open is the one that creates the document, read
+      // in the same step as the check above so no other open can land between.
+      const opensCold = !bySession && textDocuments.get(uri) === undefined;
       const text = await run('serialize', () => this.modelToText(uri, args.model, cancelToken));
-      await run('open', () => this.open({ uri, clientId: args.clientId, text }));
-      const appliedVersion = await run('apply', () => this.services.workspace.AstDocumentManager.update(uri, text, args.clientId));
+      if (!bySession) {
+         await run('open', () => this.open({ uri, clientId: args.clientId, text }));
+      }
+      const appliedVersion = await run('apply', () => {
+         // A session's write never opens its document. The check sits in the
+         // same synchronous step as the apply: made before the serialize await
+         // instead, it passes for a write whose session closes the document
+         // during that await, and the write then lands on a document the
+         // session no longer has open.
+         if (bySession && !textDocuments.isOpenInClient(uri, args.clientId)) {
+            throw new DocumentNotOpenError(uri, args.clientId);
+         }
+         // The gate again, in the same step as the apply: two writes based on
+         // one version both pass the check at the door while they serialise,
+         // and without this both apply. The version a cold open assigned from
+         // this write's own text is not a conflict; the store holding exactly
+         // that text is how it shows.
+         if (!(opensCold && textDocuments.get(uri)?.getText() === text)) {
+            this.checkBasedOn(uri, args.basedOn, textDocuments.version(uri));
+         }
+         return this.services.workspace.AstDocumentManager.update(uri, text, args.clientId);
+      });
       // Dispatch through the public `rebuild` (which re-canonicalizes the already-
       // canonical `uri` once, idempotently) rather than `rebuildCanonical`, so an
       // adopter `rebuild` override stays in the update path. The redundant call is
@@ -765,6 +827,23 @@ export class DefaultModelService<
       return doc;
    }
 
+   /**
+    * Throw {@link ConflictError} when `basedOn` names a version other than
+    * `currentVersion`. {@link update} calls it at the door and again in the
+    * synchronous step that applies the text, and has to call it synchronously
+    * there: a check separated from the apply by an await lets two writes based
+    * on one version both apply.
+    */
+   protected checkBasedOn(uri: string, basedOn: BasedOn, currentVersion: number): void {
+      if (isSnapshotVersion(basedOn) && currentVersion !== basedOn) {
+         // Distinct from the post-build "superseded" debug line in `update`: this
+         // is a based-on-stale rejection (the write never applies), not two
+         // writes racing.
+         this.tracer.debug(`Conflict on ${uri}: based-on v${basedOn} stale, server at v${currentVersion}`);
+         throw new ConflictError(uri, basedOn, currentVersion);
+      }
+   }
+
    /**
     * Persist `uri` to disk. Same content-change + settled-phase flow as
     * {@link update}, then writes via the
@@ -773,8 +852,16 @@ export class DefaultModelService<
     * the `onDidSave` event regardless of who originated the persist).
     *
     * Returns the post-save AST snapshot.
+    *
+    * Under the id of a live session the save also fails with
+    * `DocumentNotOpenError` when the session closes the URI while the text is
+    * being built, and writes nothing. Once the manager has taken the text, the
+    * write completes whatever the session does next.
     */
    async save(args: TransferSaveArgs<TTransfer>, cancelToken?: CancellationToken): Promise<AstDocument<TAst, TDiagnostic>> {
+      // Read before the first await, as in `update`: a session that ends during
+      // the rebuild would otherwise read as a plain client id below.
+      const bySession = this.sessions.has(args.clientId);
       // Dispatch through `update` (not its internals) so an adopter `update`
       // override — version-matched resolution, etc. — applies to saves too.
       const doc = await this.update(args, cancelToken);
@@ -782,6 +869,12 @@ export class DefaultModelService<
       // the canonical (real) path follows any symlink to the same file, and the
       // `onDidSave` keys the one canonical registration.
       const uri = this.uriPolicy.canonicalUri(args.uri);
+      // In the same synchronous step as the manager taking the text: checked
+      // any earlier, a session that closes the URI during the rebuild still has
+      // the shared text, other clients' edits included, written in its name.
+      if (bySession && !this.services.workspace.TextDocuments.isOpenInClient(uri, args.clientId)) {
+         throw new DocumentNotOpenError(uri, args.clientId);
+      }
       await this.services.workspace.AstDocumentManager.save(uri, args.clientId);
       return doc;
    }
@@ -906,6 +999,55 @@ export class DefaultModelService<
       return this.services.workspace.AstDocumentManager.getDocument(uri);
    }
 
+   // ============================================================
+   // Client sessions
+   // ============================================================
+
+   createSession<TOpenOptions extends OpenOptions = OpenOptions>(
+      label?: string,
+      clientId?: string
+   ): ClientSession<TAst, TDiagnostic, TTransfer, TOpenOptions> {
+      const sessionLabel = label ?? 'session';
+      const id = clientId ?? `${sessionLabel}#${globalThis.crypto.randomUUID()}`;
+      const textDocuments = this.services.workspace.TextDocuments;
+      textDocuments.registerSession(id);
+      this.sessionCloseListener ??= textDocuments.onDidCloseSession(event => {
+         // Also reached when the store ends a session directly; disposing the
+         // handle makes its later calls fail rather than write under an id
+         // this service no longer treats as a session.
+         this.sessions.get(event.clientId)?.dispose();
+         this.sessions.delete(event.clientId);
+      });
+      let session: ClientSession<TAst, TDiagnostic, TTransfer, TOpenOptions>;
+      try {
+         session = this.newSession<TOpenOptions>(id, sessionLabel);
+      } catch (err: unknown) {
+         textDocuments.closeSession(id);
+         throw err;
+      }
+      this.sessions.set(id, session);
+      return session;
+   }
+
+   getSession(clientId: string): ClientSession<TAst, TDiagnostic, TTransfer> | undefined {
+      return this.sessions.get(clientId);
+   }
+
+   /**
+    * Build the handle for a session {@link createSession} has already
+    * registered. The override point for a custom session class; narrow the
+    * return type to it.
+    *
+    * Registration and the uniqueness check have already happened when this
+    * runs, so an override cannot skip them.
+    */
+   protected newSession<TOpenOptions extends OpenOptions = OpenOptions>(
+      clientId: string,
+      label: string
+   ): ClientSession<TAst, TDiagnostic, TTransfer, TOpenOptions> {
+      return new DefaultClientSession<TAst, TDiagnostic, TTransfer, TOpenOptions>(this, this.services, clientId, label);
+   }
+
    // ============================================================
    // LSP-client sync (mirror non-LSP-client changes back to Monaco)
    // ============================================================
@@ -917,15 +1059,20 @@ export class DefaultModelService<
     * `HydraniumTextDocuments.applyEditToLanguageClient` and
     * `HydraniumTextDocuments.stagePendingContent`.
     *
-    * Routes to one of two mechanisms by language-client registration, because
-    * an open and a closed document answer different questions:
+    * Routes by client registration, because an open and a closed document
+    * answer different questions:
     *
     * - **Open in the language client** → {@link syncOpenDocument}: mirror the
     *   settled text via a coalesced `applyEditToLanguageClient`, routed purely by
     *   **content**.
-    * - **Closed in the language client** → {@link stageClosedDocument}: stage the
-    *   text for the eventual first `didOpen`, gated by **provenance**
-    *   ({@link isNonLanguageClientEdit}).
+    * - **Open only in another client** (the data or GLSP head) → nothing. A
+    *   language client opening it joins the existing entry and is refreshed from
+    *   the store, and only a FIRST open reads a stage, so staging here would
+    *   leave text nothing reads.
+    * - **Closed in every client** → {@link stageClosedDocument}, gated by
+    *   **provenance** ({@link isNonLanguageClientEdit}). With the default text
+    *   store this never stages; see {@link stageClosedDocument} for why, and
+    *   for the store it serves.
     *
     * The decision is **re-derived from the current settled state every time** (it
     * is not a one-shot enrolment), which is what makes it self-healing: a doc
@@ -935,9 +1082,9 @@ export class DefaultModelService<
     */
    protected syncToLanguageClient(document: LangiumDocument): void {
       // `document.textDocument.uri` is the server-identity (canonical) URI off the
-      // build. Route by language-client registration (a presence question —
-      // `isOpenInLanguageClient` canonicalizes internally, so a divergent open path
-      // still resolves to the same record), but key the outbound sync by this
+      // build. Route by client registration (presence questions — both
+      // predicates canonicalize internally, so a divergent open path still
+      // resolves to the same record), but key the outbound sync by this
       // CANONICAL URI — the same key `settleSave` looks the chain up under —
       // so a save-settle can drain the in-flight applyEdit. The canonical→client-URI
       // translation (a symlinked path the client opened, or a dual-open fan-out)
@@ -945,9 +1092,10 @@ export class DefaultModelService<
       // the canonical key to the recorded language-client URI(s); driving the chain
       // in client space here would key it under a URI `settleSave` never computes, so
       // the drain would miss for a divergent open path.
-      if (this.services.workspace.TextDocuments.isOpenInLanguageClient(document.textDocument.uri)) {
+      const textDocuments = this.services.workspace.TextDocuments;
+      if (textDocuments.isOpenInLanguageClient(document.textDocument.uri)) {
          this.syncOpenDocument(document.textDocument.uri, document.textDocument.getText());
-      } else {
+      } else if (!textDocuments.isOpenInAnyClient(document.textDocument.uri)) {
          this.stageClosedDocument(document);
       }
    }
@@ -968,11 +1116,18 @@ export class DefaultModelService<
    }
 
    /**
-    * Stage the settled text of a document closed in the language client so the
-    * eventual first `didOpen` sees this in-memory text instead of stale disk —
+    * Stage the settled text of a document no client holds so the eventual
+    * first `didOpen` sees this in-memory text instead of stale disk —
     * but only for a {@link isNonLanguageClientEdit genuine non-language-client edit}.
     * A document rebuilt by an internal build is skipped, leaving disk authoritative
     * on the next open.
+    *
+    * The default `HydraniumTextDocuments` never gets this far. Its own paths
+    * record a version's author only while a client holds the document, and the
+    * last close drops that history with the tracking record, so a document no
+    * client holds reports no author and the provenance gate refuses. The stage
+    * is reachable for a text store that keeps authorship past the last close,
+    * or a subclass overriding {@link isNonLanguageClientEdit}.
     */
    protected stageClosedDocument(document: LangiumDocument): void {
       if (this.isNonLanguageClientEdit(document)) {

package/src/lsp/hydranium-document-update-handler.ts

@@ -133,7 +133,10 @@ export class HydraniumDocumentUpdateHandler extends DefaultDocumentUpdateHandler
     */
    protected pendingReason?: string;
 
-   constructor(services: ServerSharedServices, options: HydraniumDocumentUpdateHandlerOptions = {}) {
+   constructor(
+      protected readonly services: ServerSharedServices,
+      options: HydraniumDocumentUpdateHandlerOptions = {}
+   ) {
       super(services);
       this.logger = services.Logger;
       this.selfSaveRegistry = services.workspace.SelfSaveRegistry;
@@ -201,6 +204,11 @@ export class HydraniumDocumentUpdateHandler extends DefaultDocumentUpdateHandler
     *
     * Per-client closes (where other clients still hold the URI) are
     * suppressed via {@link HydraniumTextDocuments.isOpenInAnyClient}.
+    *
+    * The dispatch waits for the URI's disk queue to drain, because the rebuild
+    * re-reads the file: dispatched while a save is still queued, it reads the
+    * text from before that save, and the document reverts past it. A client
+    * that opens the URI meanwhile holds the text, so no revert follows.
     */
    didCloseDocument(change: TextDocumentChangeEvent<TextDocument>): void {
       if (this.textDocuments.isOpenInAnyClient(change.document.uri)) {
@@ -210,9 +218,19 @@ export class HydraniumDocumentUpdateHandler extends DefaultDocumentUpdateHandler
       if (uri.scheme !== 'file') {
          return;
       }
-      this.nextReason = HYDRANIUM_BUILD_REASONS.didClose;
-      this.immediateFlush = true;
-      this.fireDocumentUpdate([uri], []);
+      this.services.workspace.AstDocumentManager.queueDiskTask(change.document.uri, async () => undefined)
+         .then(() => {
+            if (this.textDocuments.isOpenInAnyClient(change.document.uri)) {
+               return;
+            }
+            this.nextReason = HYDRANIUM_BUILD_REASONS.didClose;
+            this.immediateFlush = true;
+            this.fireDocumentUpdate([uri], []);
+         })
+         .catch((err: unknown) => {
+            const detail = err instanceof Error ? (err.stack ?? err.message) : String(err);
+            this.logger.error(`Revert on last close dropped for ${change.document.uri}. ${detail}`);
+         });
    }
 
    override didChangeWatchedFiles(params: DidChangeWatchedFilesParams): void {

package/src/testing/stub-ast-document-manager.ts

@@ -24,8 +24,9 @@ import type { StubLangiumDocuments } from './stub-langium-documents.js';
  * Minimal stub of {@link AstDocumentManager} for use in test
  * harnesses. Implements just the methods the framework's
  * `ModelService` calls (`open` / `close` / `update` / `save` /
- * `isOpen` / `getDocument`); `onSave` / `onClientClosed` forward to the
- * underlying stub text-document manager, `onUpdate` is driven explicitly
+ * `isOpen` / `getDocument`) and a disk queue that runs each task at once;
+ * `onSave` / `onClientClosed` forward to the underlying stub text store,
+ * `onUpdate` is driven explicitly
  * through {@link StubAstDocumentManager.emitUpdate} because the stub tree runs
  * no build phases to emit from, and the remaining read helpers
  * (`isTriggeringEdit`, `getAuthor`) throw if invoked — tests that need them
@@ -52,6 +53,7 @@ export interface StubAstDocumentManager<TAst extends AstNode, TDiagnostic extend
    | 'isOpen'
    | 'update'
    | 'save'
+   | 'queueDiskTask'
    | 'onUpdate'
    | 'onSave'
    | 'onClientClosed'
@@ -151,6 +153,9 @@ export function makeStubAstDocumentManager<TAst extends AstNode, TDiagnostic ext
          await fileSystem.writeFile(UriUtils.toUri(uri), text);
          textDocuments.notifyDidSaveTextDocument({ textDocument: { uri }, text }, clientId);
       },
+      queueDiskTask<T>(_uri: string, task: () => Promise<T>): Promise<T> {
+         return task();
+      },
       // Registers the listener but never calls it by itself — the real manager
       // emits from a `DocumentBuilder.onDocumentPhase(Validated)` hook and the
       // stub tree runs no phases. `emitUpdate` is the only thing that fires it;

package/src/testing/stub-hydranium-text-documents.ts

@@ -12,6 +12,7 @@ import type { ApplyWorkspaceEditResult } from 'vscode-languageserver';
 import { Disposable } from 'vscode-languageserver';
 import type { TextDocument } from 'vscode-languageserver-textdocument';
 import { LANGUAGE_CLIENT_ID } from '../documents/client-ids.js';
+import { ClientSessionRegistry } from '../documents/client-session-registry.js';
 import type { ClientTextDocumentChangeEvent, HydraniumTextDocuments } from '../documents/hydranium-text-documents.js';
 
 /** Snapshot of an open document tracked by the stub. */
@@ -27,9 +28,11 @@ export interface StubTextDocumentEntry {
  * reads from on test paths — the content channel
  * (`notifyDidChangeTextDocument` / `applyContentChange` / `version` /
  * `getAuthor`), the open-state probes (`isOpenInLanguageClient` /
- * `isOpenInAnyClient` / `openDocuments`), the push channel to the language
- * client (`applyEditToLanguageClient` / `stagePendingContent`) and the
- * save / close notifications — plus test-only helpers:
+ * `isOpenInAnyClient` / `isOpenInClient` / `openDocuments`), the push channel
+ * to the language client (`applyEditToLanguageClient` / `stagePendingContent`),
+ * the save / close notifications, and the client-session table
+ * (`registerSession` / `closeSession` / `onDidCloseSession` and the open
+ * options), which is a real `ClientSessionRegistry` — plus test-only helpers:
  *
  * - {@link seedOpen} — pre-populate an open document without firing change
  *   events. Use to set up a baseline version before exercising an `update`.
@@ -69,6 +72,12 @@ export interface StubHydraniumTextDocuments extends Pick<
    | 'applyEditToLanguageClient'
    | 'stagePendingContent'
    | 'openDocuments'
+   | 'isOpenInClient'
+   | 'registerSession'
+   | 'closeSession'
+   | 'onDidCloseSession'
+   | 'openOptions'
+   | 'setOpenOptions'
 > {
    /**
     * Stub-tailored read accessor. Returns just the surface the framework's
@@ -93,7 +102,13 @@ export interface StubHydraniumTextDocuments extends Pick<
    seedOpenInLanguageClient(uri: string): void;
    /** Synchronously deliver `onDidClose` to subscribers. */
    fireClose(uri: string, clientId: string): void;
-   /** Drop recorded state. Useful for `beforeEach` resets. */
+   /**
+    * Drop recorded state. Useful for `beforeEach` resets.
+    *
+    * Sessions end without announcing it, so a model service built on this
+    * stub still holds the handles it started before the reset. Build a fresh
+    * service after a reset rather than reusing one across it.
+    */
    reset(): void;
    readonly changes: readonly StubTextDocumentEntry[];
    readonly saves: readonly { uri: string; clientId: string }[];
@@ -125,8 +140,13 @@ export function makeStubHydraniumTextDocuments(): StubHydraniumTextDocuments {
    let applyEditHandler: (uri: string, text: string) => ApplyWorkspaceEditResult | undefined = () => ({ applied: true });
    const saveListeners: Array<(event: { document: { uri: string }; clientId: string }) => void> = [];
    const closeListeners: Array<(event: ClientTextDocumentChangeEvent<TextDocument>) => void> = [];
+   // The real registry, so the session table, the opens, the closing state and
+   // the open options behave as the store's do. The stub's plain-string keys
+   // stand in for canonical URIs (one stub-boundary cast, like `fireClose`).
+   const sessions = new ClientSessionRegistry();
+   const key = (uri: string): CanonicalUri => uri as CanonicalUri;
 
-   return {
+   const stub: StubHydraniumTextDocuments = {
       get changes() {
          return changes;
       },
@@ -207,21 +227,37 @@ export function makeStubHydraniumTextDocuments(): StubHydraniumTextDocuments {
       isOpenInAnyClient(uri) {
          return docs.has(uri) || languageClientOpen.has(uri);
       },
-      openDocuments() {
-         // Merge the two seeding channels: `seedOpen` records the holding client
-         // on the doc entry, `seedOpenInLanguageClient` marks the LSP client.
-         const clientsByUri = new Map<string, Set<string>>();
-         for (const [uri, entry] of docs) {
-            clientsByUri.set(uri, new Set([entry.clientId]));
+      isOpenInClient(uri, clientId) {
+         return sessions.isOpenIn(key(uri), clientId);
+      },
+      registerSession(clientId) {
+         sessions.register(clientId);
+      },
+      closeSession(clientId) {
+         if (!sessions.isRegistered(clientId)) {
+            return;
          }
-         for (const uri of languageClientOpen) {
-            const clients = clientsByUri.get(uri) ?? new Set<string>();
-            clients.add(LANGUAGE_CLIENT_ID);
-            clientsByUri.set(uri, clients);
+         try {
+            for (const uri of sessions.beginClose(clientId)) {
+               stub.fireClose(uri, clientId);
+            }
+         } finally {
+            sessions.unregister(clientId);
          }
-         // The real store keys by canonical identity; the stub's plain-string
-         // keys stand in for it (single stub-boundary cast, like `fireClose`).
-         return [...clientsByUri].map(([uri, clients]) => ({ uri: uri as CanonicalUri, clients: [...clients] }));
+      },
+      get onDidCloseSession() {
+         return sessions.onDidCloseSession;
+      },
+      openOptions(uri, clientId) {
+         return sessions.openOptions(key(uri), clientId);
+      },
+      setOpenOptions(uri, clientId, options) {
+         sessions.setOpenOptions(key(uri), clientId, options);
+      },
+      openDocuments() {
+         // From the registry that also answers `isOpenInClient`, which both
+         // seeding channels feed, so the two never disagree about an open.
+         return sessions.openDocuments();
       },
       setApplyEditHandler(handler) {
          applyEditHandler = handler;
@@ -234,9 +270,11 @@ export function makeStubHydraniumTextDocuments(): StubHydraniumTextDocuments {
          staged.push({ uri, text });
       },
       seedOpen(uri, text, clientId) {
+         sessions.addOpen(key(uri), clientId);
          docs.set(uri, { uri, version: 1, text, clientId });
       },
       seedOpenInLanguageClient(uri) {
+         sessions.addOpen(key(uri), LANGUAGE_CLIENT_ID);
          languageClientOpen.add(uri);
       },
       fireClose(uri, clientId) {
@@ -247,6 +285,7 @@ export function makeStubHydraniumTextDocuments(): StubHydraniumTextDocuments {
          if (holder && holder.clientId === clientId) {
             docs.delete(uri);
          }
+         sessions.removeOpen(key(uri), clientId);
          if (clientId === LANGUAGE_CLIENT_ID) {
             languageClientOpen.delete(uri);
          }
@@ -265,6 +304,11 @@ export function makeStubHydraniumTextDocuments(): StubHydraniumTextDocuments {
          saveListeners.length = 0;
          closeListeners.length = 0;
          applyEditHandler = () => ({ applied: true });
+         // Cleared in place rather than replaced: a model service built on the
+         // stub subscribed to `onDidCloseSession` once, and a new registry would
+         // leave that subscription on one nothing fires.
+         sessions.clear();
       }
    };
+   return stub;
 }