@hydranium/core 1.0.0-next.13 → 1.0.0-next.132

package/src/locale/server-locale.ts

@@ -0,0 +1,86 @@
+/********************************************************************************
+ * Copyright (c) 2026 CrossBreeze, EclipseSource and others.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the MIT License which is available in the project root.
+ *
+ * SPDX-License-Identifier: MIT
+ ********************************************************************************/
+
+import type { Locale, Tracer } from '@hydranium/protocol';
+import { type LogNameOptions } from '../langium/diagnostics/logger.js';
+import type { ServerSharedServicesMinimal } from '../langium/shared-services.js';
+
+/** Construction options for {@link ServerLocale}. */
+export type ServerLocaleOptions = LogNameOptions;
+
+/**
+ * The locale contract the `ServerLocale` slot holds, implemented by
+ * {@link DefaultServerLocale}.
+ *
+ * An interface rather than the class, so the slot is compared STRUCTURALLY —
+ * a class-typed slot carries its `protected` members into every assignability
+ * check, compared nominally, which makes it unsatisfiable across two physical
+ * copies of this package and unreplaceable by an adopter's own declaration.
+ */
+export interface ServerLocale {
+   /** The locale, or `undefined` when no init supplied one — the framework's English. */
+   readonly value: Locale | undefined;
+   accept(locale: Locale): void;
+}
+
+/**
+ * The locale the server was handed at init, for whoever needs to render in the
+ * reading user's language. Held apart from the message renderer that reads it,
+ * so replacing the renderer cannot drop locale handling.
+ *
+ * A plain string in and out. A consumer that must react to a change rather than
+ * read the current value wraps this itself — nothing does today, and both real
+ * hosts respawn the server on a display-language switch.
+ */
+export class DefaultServerLocale implements ServerLocale {
+   protected readonly tracer: Tracer;
+   protected current: Locale | undefined;
+
+   constructor(services: ServerSharedServicesMinimal, options: ServerLocaleOptions = {}) {
+      this.tracer = services.Tracer.for(options.logName ?? 'ServerLocale').trace('instantiated');
+   }
+
+   /** The locale, or `undefined` when no init supplied one — which means the framework's English. */
+   get value(): Locale | undefined {
+      return this.current;
+   }
+
+   /**
+    * Take the locale an init declared.
+    *
+    * **One locale per process, and the reason the OTHER heads need none of
+    * their own.** The data and GLSP heads publish a port over the LSP
+    * connection and are reached by forwarding a socket to it, so they are the
+    * same process as the LSP head that was handed this locale — there is no
+    * topology in which one of them serves a second frontend. The Theia backend
+    * is the case that would break it, and it holds no locale precisely because
+    * it serves every frontend at once; nothing there writes here.
+    *
+    * The framework accepts a locale and never sources one, and neither
+    * validates nor normalises the tag: rejecting an unfamiliar one would be
+    * selecting a locale.
+    *
+    * Override to ignore the argument, which is how a host pins a locale it
+    * already knows but has no LSP client to declare.
+    *
+    * **The line is at `info`, which is a deliberate exception to the
+    * per-service default.** A locale is written once per process and it is the
+    * one setting that silently changes every user-facing sentence the server
+    * produces, so a reader trying to explain an unexpected language has nothing
+    * else to look at: the framework ships no catalogue, so "no entry for this
+    * code" and "no locale declared" both render the English and are
+    * indistinguishable in the output. At `debug` the line is below the default
+    * threshold and therefore absent from exactly the log someone would be
+    * reading.
+    */
+   accept(locale: Locale): void {
+      this.current = locale;
+      this.tracer.info(`rendering messages in locale '${locale}'`);
+   }
+}

package/src/lsp/completion/hydranium-completion-provider.ts

@@ -7,9 +7,16 @@
  * SPDX-License-Identifier: MIT
  ********************************************************************************/
 
-import { type AstNodeDescription, type ReferenceInfo, type Stream } from '@hydranium/langium';
+import { type AstNodeDescription, type LangiumDocument, type ReferenceInfo, type Stream } from '@hydranium/langium';
 import { DefaultCompletionProvider, type CompletionContext, type CompletionValueItem } from '@hydranium/langium/lsp';
-import type { CompletionItem, InsertReplaceEdit } from 'vscode-languageserver';
+import {
+   CompletionList,
+   type CancellationToken,
+   type CompletionItem,
+   type CompletionParams,
+   type InsertReplaceEdit,
+   type Position
+} from 'vscode-languageserver';
 import { type ReferenceCandidateProvider } from '../../langium/scope/reference-candidate-provider.js';
 import { type ServerLanguageServices } from '../../langium/language-module.js';
 
@@ -52,6 +59,14 @@ import { type ServerLanguageServices } from '../../langium/language-module.js';
  * elements. The provider owns that pipeline in one place, so the
  * text-editor dropdown and the protocol candidate picker stay in sync; this
  * class keeps only the LSP-specific {@link fillCompletionItem} upgrade.
+ *
+ * **A comment is not a completion site.** Langium's context builder reads the
+ * non-hidden token stream alone, so a cursor in a comment is indistinguishable
+ * from one in the whitespace between the tokens surrounding it: the grammar's
+ * follow-set goes out as keyword proposals, and none of them is filtered,
+ * because the characters the user typed belong to the hidden token and the
+ * prefix matched against is therefore empty. {@link isInsideComment} suppresses
+ * the request instead.
  */
 export class HydraniumCompletionProvider extends DefaultCompletionProvider {
    protected readonly candidateProvider: ReferenceCandidateProvider;
@@ -61,6 +76,71 @@ export class HydraniumCompletionProvider extends DefaultCompletionProvider {
       this.candidateProvider = services.references.CandidateProvider;
    }
 
+   /**
+    * Answer no proposals at all when the cursor is inside a comment.
+    *
+    * Suppressing the whole request is what makes the rule hold for every
+    * proposal kind at once. Filtering the built contexts instead has to catch
+    * each context kind the base builds separately, and a kind added upstream
+    * arrives unguarded.
+    *
+    * The list is marked incomplete so the client re-asks on the next keystroke
+    * and proposals resume the moment the cursor leaves the comment.
+    */
+   override async getCompletion(
+      document: LangiumDocument,
+      params: CompletionParams,
+      cancelToken?: CancellationToken
+   ): Promise<CompletionList | undefined> {
+      if (this.isInsideComment(document, params.position)) {
+         return CompletionList.create([], true);
+      }
+      return super.getCompletion(document, params, cancelToken);
+   }
+
+   /**
+    * Whether `position` falls in text a comment terminal claims.
+    *
+    * The two comment kinds part company at their far edge. A single-line
+    * comment runs to the line break, so a cursor at its end offset is still in
+    * prose and that offset counts as inside. A multi-line comment is
+    * terminated, so a cursor at its end offset has passed the terminator and is
+    * back in code. A cursor ON the opening delimiter is outside either way,
+    * that offset being a legal position for whatever token the comment
+    * displaced.
+    *
+    * The hidden token stream decides rather than the CST. A leaf lookup by
+    * offset misses the position a cursor reaches by typing prose into a
+    * trailing comment, because that comment ends AT the line break and
+    * whitespace is discarded before a CST node is built over it — so the
+    * lookup answers nothing exactly where proposals are least wanted.
+    *
+    * An adopter whose comment syntax carries completable content — a
+    * documentation tag naming a type — narrows this to return `false` over that
+    * region rather than replacing {@link getCompletion}.
+    */
+   protected isInsideComment(document: LangiumDocument, position: Position): boolean {
+      const text = document.textDocument.getText();
+      const offset = document.textDocument.offsetAt(position);
+      const multilineCommentRules = this.grammarConfig.multilineCommentRules;
+      for (const token of this.lexer.tokenize(text).hidden) {
+         if (token.startOffset >= offset) {
+            // Hidden tokens arrive in document order, so no later one reaches back over the cursor.
+            return false;
+         }
+         // `endOffset` is optional on the token type and the image is not, so
+         // the width comes from the image and needs no absent-value branch.
+         const endOffset = token.startOffset + token.image.length;
+         if (offset < endOffset) {
+            return true;
+         }
+         if (offset === endOffset && !multilineCommentRules.includes(token.tokenType.name)) {
+            return true;
+         }
+      }
+      return false;
+   }
+
    /**
     * Delegate cross-reference candidate gathering to the candidate provider
     * so the LSP completion dropdown applies the same filter / canonical

package/src/lsp/connection-features.ts

@@ -0,0 +1,67 @@
+/********************************************************************************
+ * Copyright (c) 2026 CrossBreeze, EclipseSource and others.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the MIT License which is available in the project root.
+ *
+ * SPDX-License-Identifier: MIT
+ ********************************************************************************/
+
+import { LogMessageNotification, MessageType, type Features, type RemoteConsole } from 'vscode-languageserver';
+import { isConnectionGoneError } from '../util/connection-liveness.js';
+
+/**
+ * Add Hydranium's connection-liveness handling to a language-server
+ * connection's console. The upstream `RemoteConsole` catches every failed log
+ * notification and prints `Sending log message failed`, so every ordinary
+ * teardown reports a failure; this console drops only a failure that
+ * {@link isConnectionGoneError} recognises and re-raises any other as an
+ * unhandled rejection.
+ *
+ * Supply it where the connection is created. `createConnection` builds the
+ * console from these features, so a connection that already exists keeps the
+ * upstream console for its whole lifetime.
+ */
+export function withHydraniumLspFeatures<T extends Features>(features: T): T {
+   return {
+      ...features,
+      console: (Base: new () => RemoteConsole) =>
+         class extends Base {
+            override error(message: string): void {
+               this.sendLogMessage(MessageType.Error, message);
+            }
+
+            override warn(message: string): void {
+               this.sendLogMessage(MessageType.Warning, message);
+            }
+
+            override info(message: string): void {
+               this.sendLogMessage(MessageType.Info, message);
+            }
+
+            override log(message: string): void {
+               this.sendLogMessage(MessageType.Log, message);
+            }
+
+            override debug(message: string): void {
+               this.sendLogMessage(MessageType.Debug, message);
+            }
+
+            private sendLogMessage(type: MessageType, message: string): void {
+               try {
+                  void this.connection.sendNotification(LogMessageNotification.type, { type, message }).catch(error => {
+                     this.handleLogSendFailure(error);
+                  });
+               } catch (error) {
+                  this.handleLogSendFailure(error);
+               }
+            }
+
+            private handleLogSendFailure(error: unknown): void {
+               if (!isConnectionGoneError(error)) {
+                  void Promise.reject(error);
+               }
+            }
+         }
+   } as T;
+}

package/src/lsp/diagnostics-connection.ts

@@ -0,0 +1,56 @@
+/********************************************************************************
+ * Copyright (c) 2026 CrossBreeze, EclipseSource and others.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the MIT License which is available in the project root.
+ *
+ * SPDX-License-Identifier: MIT
+ ********************************************************************************/
+
+import type { Connection } from 'vscode-languageserver';
+import { isConnectionGoneError } from '../util/connection-liveness.js';
+
+const wrappedConnections = new WeakSet<object>();
+
+/**
+ * Protect Langium's fire-and-forget diagnostics publish from the expected
+ * failure caused by a peer disconnecting during teardown.
+ *
+ * A publish issued after the connection is disposed throws synchronously
+ * instead of rejecting, and Langium's publisher is a document-phase listener,
+ * so an unguarded throw fails the build that validated the document. The
+ * `try` answers that case with a resolved promise; a guard on the promise
+ * alone never sees it.
+ *
+ * Otherwise the original promise is returned unchanged. The detached catch is
+ * deliberate: it marks the original promise as observed, suppresses only the
+ * expected connection-liveness error, and rethrows unexpected failures so they
+ * stay visible as unhandled rejections, as an unguarded fire-and-forget send
+ * would leave them.
+ */
+export function guardDiagnosticsConnection(connection: Connection): void {
+   if (wrappedConnections.has(connection)) {
+      return;
+   }
+   wrappedConnections.add(connection);
+
+   const sendDiagnostics = connection.sendDiagnostics.bind(connection);
+   connection.sendDiagnostics = params => {
+      let result: Promise<void>;
+      try {
+         result = sendDiagnostics(params);
+      } catch (error: unknown) {
+         if (isConnectionGoneError(error)) {
+            return Promise.resolve();
+         }
+         throw error;
+      }
+      void result.catch(error => {
+         if (isConnectionGoneError(error)) {
+            return;
+         }
+         throw error;
+      });
+      return result;
+   };
+}

package/src/lsp/hydranium-document-update-handler.ts

@@ -7,30 +7,27 @@
  * SPDX-License-Identifier: MIT
  ********************************************************************************/
 
-import { Debouncer, type Logger, ObservableValue, type MaybeObservableValue } from '@hydranium/protocol';
+import { Debouncer, Deferred, type Logger, ObservableValue, type MaybeObservableValue, TIMED_OUT } from '@hydranium/protocol';
 import { URI, UriUtils } from '@hydranium/langium';
 import { DefaultDocumentUpdateHandler } from '@hydranium/langium/lsp';
-import { type HydraniumDocumentBuilder } from '../langium/document-builder/document-builder.js';
+import { HYDRANIUM_BUILD_REASONS, type HydraniumDocumentBuilder } from '../langium/document-builder/document-builder.js';
 import { type ServerSharedServices } from '../langium/module.js';
 import { LANGUAGE_CLIENT_ID } from '../documents/client-ids.js';
 import { type SelfSaveRegistry } from '../documents/self-save-registry.js';
 import { type WritableFileSystemProvider } from '../documents/ast-document-manager.js';
 import { type HydraniumTextDocuments } from '../documents/hydranium-text-documents.js';
-import { type DidChangeWatchedFilesParams, type FileEvent, FileChangeType, type TextDocumentChangeEvent } from 'vscode-languageserver';
+import { isConnectionGoneError } from '../util/connection-liveness.js';
+import {
+   type DidChangeWatchedFilesParams,
+   type FileEvent,
+   FileChangeType,
+   type TextDocumentChangeEvent,
+   type TextDocumentWillSaveEvent,
+   type TextEdit
+} from 'vscode-languageserver';
 import { type TextDocument } from 'vscode-languageserver-textdocument';
 
-/**
- * Default LSP-event reasons stamped by {@link HydraniumDocumentUpdateHandler}
- * onto the next `documentBuilder.update` call via `markNextReason`. Exposed
- * so adopters subclassing the handler can layer additional reasons or rename
- * existing ones without losing the canonical names the framework emits.
- */
-export const HYDRANIUM_BUILD_REASONS = Object.freeze({
-   didOpen: 'didOpen',
-   didChangeContent: 'didChangeContent',
-   didChangeWatchedFiles: 'didChangeWatchedFiles',
-   didClose: 'didClose'
-} as const);
+export { HYDRANIUM_BUILD_REASONS };
 
 /**
  * Construction options for {@link HydraniumDocumentUpdateHandler}.
@@ -56,6 +53,17 @@ export interface HydraniumDocumentUpdateHandlerOptions {
     * load tests).
     */
    readonly bypassNonLanguageClientChanges?: boolean;
+   /**
+    * Longest an editor's save waits on the server, in milliseconds, at each of
+    * its two steps: the `willSaveWaitUntil` answer waits for the server's disk
+    * writes of the document already queued, and server writes queued after the
+    * answer wait for the editor's `didSave`. Either wait that runs out is
+    * logged, and the editor's write and the server's can then land in either
+    * order. Default `1000`: VS Code gives up on an answer after about 1.5 s,
+    * and switches the listener off for the session once four answers, over
+    * all documents, timed out or failed.
+    */
+   readonly willSaveGateMs?: number;
 }
 
 /**
@@ -71,19 +79,25 @@ export interface HydraniumDocumentUpdateHandlerOptions {
  *     changes and watched-file changes bypass the debounce (their
  *     producers are already coalesced).
  *  3. **Build-reason stamping** — the LSP event overrides
- *     (`didOpenDocument`, `didChangeContent`, `didChangeWatchedFiles`,
- *     `didCloseDocument`) populate {@link nextReason} with a canonical
- *     reason string. {@link fireDocumentUpdate} captures the reason;
- *     {@link dispatch} stages it on the builder via
- *     {@link HydraniumDocumentBuilder.markNextReason}, so a subclass that
- *     formats build logs can tag its line with the event that caused the
- *     build without per-adopter wiring to capture it.
- *  4. **Last-client-close rebuild trigger** ({@link didCloseDocument}) —
- *     when the final client closes a document, dispatch a build so the
- *     LangiumDocument's `textDocument` is refreshed (from disk for `file:`
- *     URIs, or removed from the index for ephemeral URIs). Langium's
- *     default handler does not implement `didCloseDocument`, so the
- *     in-memory text of the last writer would otherwise persist.
+ *     (`didOpenDocument`, `didChangeContent`, `didChangeWatchedFiles`)
+ *     populate {@link nextReason} with a canonical reason string.
+ *     {@link fireDocumentUpdate} captures the reason; {@link dispatch} stages
+ *     it on the builder via {@link HydraniumDocumentBuilder.markNextReason},
+ *     so a subclass that formats build logs can tag its line with the event
+ *     that caused the build without per-adopter wiring to capture it.
+ *  4. **Editor save gate** ({@link willSaveDocumentWaitUntil}) — the editor
+ *     writes the file itself, so the server's disk writes of that document
+ *     are ordered around it: the editor's save waits for the ones already
+ *     queued, and the ones queued during its save wait for its `didSave`.
+ *     Both waits are capped by
+ *     {@link HydraniumDocumentUpdateHandlerOptions.willSaveGateMs}.
+ *
+ * The revert to disk after a document's last close is not dispatched here:
+ * the text store runs it for every head, the LSP head included, so a
+ * `didCloseDocument` added in a subclass would build the document twice. A
+ * change still debounced for the document is dropped when the store releases
+ * it: the store's revert rebuilds the document from the file system provider
+ * or removes it.
  *
  * Adopters with their own handler subclass should extend this class
  * (not Langium's `DefaultDocumentUpdateHandler`) so all of them are
@@ -132,7 +146,21 @@ export class HydraniumDocumentUpdateHandler extends DefaultDocumentUpdateHandler
     */
    protected pendingReason?: string;
 
-   constructor(services: ServerSharedServices, options: HydraniumDocumentUpdateHandlerOptions = {}) {
+   protected readonly willSaveGateMs: number;
+   /**
+    * Per document URI, the release of the hold an editor's save in progress
+    * keeps on the document's disk queue. A second save of the document
+    * releases the first: its hold would otherwise keep the second's answer
+    * waiting until the cap. The key is the document, not the save, so for a
+    * client that sends its next `willSaveWaitUntil` before the previous
+    * `didSave`, that late `didSave` releases the next save's hold.
+    */
+   protected readonly editorSaves = new Map<string, () => void>();
+
+   constructor(
+      protected readonly services: ServerSharedServices,
+      options: HydraniumDocumentUpdateHandlerOptions = {}
+   ) {
       super(services);
       this.logger = services.Logger;
       this.selfSaveRegistry = services.workspace.SelfSaveRegistry;
@@ -141,6 +169,18 @@ export class HydraniumDocumentUpdateHandler extends DefaultDocumentUpdateHandler
       this.debounce = ObservableValue.from(options.debounceMs ?? 0);
       this.flushDebouncer = new Debouncer(services.Clock, () => this.flushPending(), { delayMs: this.debounce });
       this.bypassNonLanguageClientChanges = options.bypassNonLanguageClientChanges ?? true;
+      this.willSaveGateMs = options.willSaveGateMs ?? 1000;
+      this.textDocuments.onDidSaveInLanguageClient(event => this.editorSaves.get(event.uri)?.());
+      // A change still debounced for a document the store has released would
+      // build it once more after the store's own revert: from the provider
+      // again, or, for a document the revert removed, by reading a file that
+      // is not there.
+      this.textDocuments.onDidCloseLastOpen(event => {
+         this.pendingChanged.delete(URI.parse(event.uri).toString());
+         if (this.pendingChanged.size === 0 && this.pendingDeleted.size === 0) {
+            this.pendingReason = undefined;
+         }
+      });
    }
 
    didOpenDocument(_change: TextDocumentChangeEvent<TextDocument>): void {
@@ -165,61 +205,21 @@ export class HydraniumDocumentUpdateHandler extends DefaultDocumentUpdateHandler
       super.didChangeContent(change);
    }
 
-   /**
-    * Last-client close is the missing rebuild trigger in Langium's
-    * `DefaultDocumentUpdateHandler`: `documents.onDidClose` fires on every
-    * per-client close, but the default handler ignores the event entirely.
-    * For multi-client servers this leaves the LangiumDocument carrying the
-    * unsaved in-memory `textDocument` of the last writer until something
-    * else triggers a rebuild — integrity rules walking `langiumDocuments.all`
-    * then see stale text long after the user discarded their edits.
-    *
-    * We funnel the last-client transition through the same dispatch path
-    * the other LSP events use, so the rebuild gets debouncing, workspace
-    * locking, build-reason stamping, and `markNextReason` for free. The
-    * scheme split governs the `DocumentBuilder.update` shape:
-    *
-    *  - **`file:` URI** → `update([uri], [])`. Routes through
-    *    `LangiumDocuments.invalidateDocument` (doc stays in the trie) and
-    *    `LangiumDocumentFactory.update`, which consults the LSP-tracked
-    *    open-documents map first. That map is cleared LATER in the same
-    *    synchronous `notifyDidCloseTextDocument` call that fires this event,
-    *    and {@link dispatch} defers the build behind `workspaceManager.ready`
-    *    — so by the time the factory looks, the URI is gone: it falls back to
-    *    `FileSystemProvider.readFile` and the doc rebuilds from disk,
-    *    Langium's canonical close-without-save semantic. A dispatch made
-    *    synchronously here would still see the open document and re-read the
-    *    in-memory text instead.
-    *  - **non-`file:` URI** (`builtin:`, `untitled:`) → no dispatch.
-    *    Adopter-loaded schemes — documents pulled in via
-    *    `loadAdditionalDocuments` — need to stay in the workspace index;
-    *    dropping them on close would break every cross-reference that
-    *    targets them. The framework cannot enumerate adopter schemes, so the
-    *    safe default is "leave alone unless it's a file." Adopters that need
-    *    ephemeral-URI cleanup handle it explicitly.
-    *
-    * Per-client closes (where other clients still hold the URI) are
-    * suppressed via {@link HydraniumTextDocuments.isOpenInAnyClient}.
-    */
-   didCloseDocument(change: TextDocumentChangeEvent<TextDocument>): void {
-      if (this.textDocuments.isOpenInAnyClient(change.document.uri)) {
-         return;
-      }
-      const uri = URI.parse(change.document.uri);
-      if (uri.scheme !== 'file') {
-         return;
-      }
-      this.nextReason = HYDRANIUM_BUILD_REASONS.didClose;
-      this.immediateFlush = true;
-      this.fireDocumentUpdate([uri], []);
-   }
-
    override didChangeWatchedFiles(params: DidChangeWatchedFilesParams): void {
       void this.filterSelfSaves(params)
          .then(filtered => {
             if (filtered.changes.length === 0) {
                return;
             }
+            // Only an open document keeps the file's text as its disk
+            // baseline; the store ignores the rest. The self-save filter has
+            // dropped the server's own writes, which set the baseline when
+            // they wrote.
+            for (const change of filtered.changes) {
+               this.textDocuments
+                  .reloadDiskBaseline(change.uri)
+                  .catch((err: unknown) => this.logger.error(`Disk baseline not reloaded for ${change.uri}. ${String(err)}`));
+            }
             // External file-system changes are authoritative — overwrite any
             // pending reason (typically empty here; could be `didChangeContent`
             // if a watcher event raced an in-flight Monaco edit, in which case
@@ -241,6 +241,77 @@ export class HydraniumDocumentUpdateHandler extends DefaultDocumentUpdateHandler
          });
    }
 
+   /**
+    * Answer an editor's `willSaveWaitUntil` with no edits once the server's
+    * disk writes of the document already queued have landed, or after
+    * {@link willSaveGateMs}, whichever is first. From the moment the queue
+    * reaches this save, disk tasks of the document queued behind it wait for
+    * the editor's `didSave`, reported through
+    * `HydraniumTextDocuments.onDidSaveInLanguageClient`, or for
+    * {@link willSaveGateMs} more.
+    *
+    * The hold is a disk task that waits only for that signal or its timer:
+    * waiting on a build, a save or anything else queued for the document would
+    * wedge its queue. Resolves in every case, since a failed request counts
+    * against the listener in VS Code; Langium drops the request's cancellation,
+    * so an abandoned request still runs to the cap. A hold that runs out is
+    * logged at debug only: an editor skips `didSave` for a save it cancels or
+    * that changed nothing.
+    */
+   willSaveDocumentWaitUntil(event: TextDocumentWillSaveEvent<TextDocument>): Promise<TextEdit[]> {
+      const uri = event.document.uri;
+      this.editorSaves.get(uri)?.();
+      const hold = new Deferred();
+      const release = (): void => {
+         if (this.editorSaves.get(uri) === release) {
+            this.editorSaves.delete(uri);
+         }
+         hold.resolve();
+      };
+      this.editorSaves.set(uri, release);
+      return new Promise<TextEdit[]>(resolve => {
+         const clock = this.services.Clock;
+         const cap = clock.setTimer(() => {
+            this.logger.warn(
+               `willSaveWaitUntil for ${uri} answered after ${this.willSaveGateMs} ms with server writes of it still queued; the editor's save may race them.`
+            );
+            resolve([]);
+         }, this.willSaveGateMs);
+         try {
+            void this.services.workspace.FileSystemTaskQueue.enqueue(uri, async () => {
+               cap.dispose();
+               resolve([]);
+               if ((await clock.raceTimer(hold.promise, this.willSaveGateMs)) === TIMED_OUT) {
+                  this.logger.debug(
+                     `No didSave for ${uri} within ${this.willSaveGateMs} ms; server writes of it no longer wait for the editor's save.`
+                  );
+                  release();
+               }
+            });
+         } catch (err) {
+            cap.dispose();
+            this.logger.error(
+               `willSaveWaitUntil for ${uri} answered without waiting. ${err instanceof Error ? (err.stack ?? err.message) : String(err)}`
+            );
+            release();
+            resolve([]);
+         }
+      });
+   }
+
+   /**
+    * Present so that Langium advertises `save` and editors send `didSave`;
+    * without it every hold of {@link willSaveDocumentWaitUntil} waits out its
+    * cap. The hold is released on
+    * `HydraniumTextDocuments.onDidSaveInLanguageClient` instead: it fires as
+    * soon as the editor reports the save, while `onDidSave`, and so this
+    * method, follows only once the file has been read back, and not at all
+    * when the file does not hold the store's text.
+    */
+   didSaveDocument(_event: TextDocumentChangeEvent<TextDocument>): void {
+      // Nothing to do; see the doc comment.
+   }
+
    /**
     * Drop watched-file changes whose path + mtime match a recent self-save
     * record. Deletions always pass (no mtime); stat failures pass (the
@@ -257,7 +328,7 @@ export class HydraniumDocumentUpdateHandler extends DefaultDocumentUpdateHandler
             }
             const uri = UriUtils.toUri(change.uri);
             const mtimeMs = await this.fileSystemProvider.mtimeMs?.(uri);
-            if (mtimeMs !== undefined && this.selfSaveRegistry.matches(uri.fsPath, mtimeMs)) {
+            if (mtimeMs !== undefined && this.selfSaveRegistry.isRegistered(uri.fsPath, mtimeMs)) {
                return undefined;
             }
             return change;
@@ -338,6 +409,14 @@ export class HydraniumDocumentUpdateHandler extends DefaultDocumentUpdateHandler
             })
          )
          .catch(err => {
+            // A deferred rebuild can finish after the LSP peer has gone away.
+            // Unless the head was started through `startLanguageServer`, whose
+            // guard absorbs it, the diagnostics publish then fails this build:
+            // a routine teardown race, not a failed workspace update. Keep
+            // genuine update failures visible.
+            if (isConnectionGoneError(err)) {
+               return;
+            }
             const detail = err instanceof Error ? (err.stack ?? err.message) : String(err);
             this.logger.error(`Workspace initialization failed. Could not perform document update. ${detail}`);
          });

package/src/lsp/index.ts

@@ -8,7 +8,9 @@
  ********************************************************************************/
 
 export * from './completion/hydranium-completion-provider.js';
-export * from './instrument-connection.js';
+export * from './lsp-latency.js';
+export * from './connection-features.js';
+export * from './diagnostics-connection.js';
 export * from './semantic-token-provider.js';
 export * from './language-module.js';
 export * from './shared-module.js';