@hydranium/glsp-server 1.0.0-next.12 → 1.0.0-next.123

package/src/storage/hydranium-glsp-storage.ts

@@ -7,7 +7,7 @@
  * SPDX-License-Identifier: MIT
  ********************************************************************************/
 
-import { MarkersReason, SetMarkersAction } from '@eclipse-glsp/protocol';
+import { MarkersReason, MessageAction, SetMarkersAction, StatusAction } from '@eclipse-glsp/protocol';
 import {
    type Action,
    ActionDispatcher,
@@ -31,16 +31,95 @@ import {
    type SourceModelStorage,
    TEMPORARY_CLIENT_ID
 } from '@eclipse-glsp/server';
-import { Debouncer, DisposableCollection } from '@hydranium/protocol';
+import {
+   Debouncer,
+   defineMessage,
+   DisposableCollection,
+   isDuplicateClientIdError,
+   isSessionClosedError,
+   SessionClosedError
+} from '@hydranium/protocol';
 import { inject, injectable, optional, postConstruct } from 'inversify';
 import { type AstNode } from '@hydranium/langium';
 import { URI } from '@hydranium/langium';
-import { AstDocument, type AstDocumentSavedEvent, type AstDocumentUpdatedEvent, type ServerSharedServices } from '@hydranium/core';
+import {
+   AstDocument,
+   type AstDocumentSavedEvent,
+   type AstDocumentUpdatedEvent,
+   type ClientSession as ModelClientSession,
+   type ServerSharedServices
+} from '@hydranium/core';
 import { DiagnosticSeverity } from 'vscode-languageserver-types';
 import { type AbstractHydraniumGlspState } from '../state/abstract-hydranium-glsp-state.js';
 import { type HydraniumGlspSubmissionHandler } from '../submission/hydranium-glsp-submission-handler.js';
 import { HydraniumTypes } from '../state/hydranium-shared-core-services.js';
-import { DEFAULT_SAVE_CONFLICT_POLICY, SaveConflictPolicy } from './save-conflict-policy.js';
+import { DEFAULT_SAVE_DELIVERY_POLICY, SaveDeliveryPolicy } from './save-delivery-policy.js';
+
+/**
+ * A save action arrived with nowhere to write to. A save action carries no
+ * request id, so it falls through to the error handler and `message` becomes
+ * the toast text.
+ *
+ * Rendered at the raise site rather than by a carrier method, because GLSP's
+ * action protocol has no slot for an identity anywhere — every member of its
+ * message, status and reject actions is prose or an enum, and
+ * `MessageAction.details` is not a substitute since it is prose populated from
+ * `cause?.toString?.()`, and a Theia host shows it to a user on demand. So the
+ * throw is the last place that still knows which message this is.
+ */
+export const SAVE_TARGET_UNKNOWN = defineMessage(
+   'hydranium/glsp-server/save-target-unknown',
+   'Could not determine where to save this model'
+);
+
+/**
+ * A model request arrived without the source URI it is required to carry.
+ * Rendered at the raise site, like its save-path sibling and for the same
+ * reason.
+ */
+export const SOURCE_URI_MISSING = defineMessage(
+   'hydranium/glsp-server/source-uri-missing',
+   'Could not open this model: the request did not say which document to load'
+);
+
+/**
+ * Why the canvas has stopped accepting edits.
+ *
+ * **A READONLY canvas is otherwise indistinguishable from a broken one.** The
+ * client's answer to {@link SetEditModeAction} is to withdraw the tool palette,
+ * so the surface a reader was working in silently loses the only control it had,
+ * with the cause — a syntax error in a document that may not even be open —
+ * nowhere on screen. The mode flip is the mechanism; this is the only part of it
+ * a user can see.
+ *
+ * Rendered at the raise site, like its two siblings above and for the same
+ * reason: every member of GLSP's status action is prose or an enum.
+ *
+ * It names the recovery rather than the fault, because the fault already has a
+ * surface — the squiggle and the problems list, both of which say WHICH
+ * character — and repeating it here would put a second, less precise account of
+ * the same error on screen. What no other surface says is that the diagram is
+ * waiting on it.
+ */
+export const DIAGRAM_READONLY_PARSE_ERROR = defineMessage(
+   'hydranium/glsp-server/diagram-readonly-parse-error',
+   'Read-only: this document has a syntax error. Fix it to edit the diagram again.'
+);
+
+/**
+ * The diagram's GLSP client id is still live as another participant's client
+ * id once the load has waited for it to free, so the diagram does not load.
+ *
+ * Rendered at the raise site, as {@link SAVE_TARGET_UNKNOWN} is and for the
+ * same reason, and dispatched to the client as a message of its own: a model
+ * request fails as a rejection whose detail is the English cause, which no user
+ * sees. It names the recovery: a host that numbers its diagram clients gives a
+ * reopened diagram a fresh id.
+ */
+export const DIAGRAM_SESSION_REFUSED = defineMessage(
+   'hydranium/glsp-server/diagram-session-refused',
+   'Could not open this diagram: its identifier is still in use by another editor. Close the diagram and open it again.'
+);
 
 /** Window (ms) over which back-to-back external rebuilds collapse into one resubmit. */
 const EXTERNAL_SUBMIT_DEBOUNCE_MS = 250;
@@ -90,17 +169,24 @@ function isStructuralDiagnostic(diagnostic: unknown): boolean {
  *
  * Adopters with richer needs override the seams ({@link isStructurallyBroken},
  * {@link onParseErrorChanged}, {@link onSourceModelSettled}) rather than the
- * whole flow, and select a {@link SaveConflictPolicy} via the bound option to
- * tune how {@link saveSourceModel} reacts to a concurrent edit.
+ * whole flow, and select a {@link SaveDeliveryPolicy} via the bound option to
+ * tune how {@link saveSourceModel} delivers its result.
+ *
+ * **One client session per GLSP client session.** `init` registers the GLSP
+ * client id as a client session ({@link registerModelSession}) and hands it to
+ * the state as `modelSession`. The primary is opened through it on load, and
+ * every document that joins the write set as it joins
+ * ({@link openSecondary}); a document that leaves the write set stays open
+ * until the next save, so leaving never reverts the diagram's unsaved edits to
+ * it. Disposing the storage ends the session, which closes everything it has
+ * open.
  *
- * **Default `saveSourceModel` flow.** Delegates to `ModelService.save`, which
- * serialises through the language-specific `Serializer` bound at
- * `services.serializer.Serializer` (resolved per-URI via `ServiceRegistry`),
- * updates the multi-client text-document store, drives a rebuild, and writes the
- * result via the `WritableFileSystemProvider`. The bound
- * {@link SaveConflictPolicy} (default {@link DEFAULT_SAVE_CONFLICT_POLICY},
- * `overwrite`) decides the based-on-version guard, await-vs-fire-and-forget, and
- * failure handling.
+ * **Default `saveSourceModel` flow.** Flushes the stored text of every
+ * document the diagram's session has open via `AstDocumentManager.save`, with
+ * no serializer in the path — the update path already put the settled text in
+ * the store. The bound {@link SaveDeliveryPolicy} (default
+ * {@link DEFAULT_SAVE_DELIVERY_POLICY}, `await`) decides
+ * await-vs-fire-and-forget and failure handling.
  *
  * **tempId filter.** GLSP's `DefaultGlobalActionProvider` spins up a
  * throwaway per-diagram-type container with upstream's {@link TEMPORARY_CLIENT_ID}
@@ -111,9 +197,9 @@ function isStructuralDiagnostic(diagnostic: unknown): boolean {
  * **Lifecycle ordering.** `init` runs after DI resolution and parks the
  * secondary-write-set watch, which outlives any single load.
  * {@link sessionDisposed} calls {@link dispose}, which drains
- * {@link toDispose} idempotently. Every transient subscription created in
- * {@link doLoadSourceModel} is parked on {@link toDispose} so the drain catches
- * them on client-detach.
+ * {@link toDispose} idempotently and then ends the client session. Every
+ * transient subscription created in {@link doLoadSourceModel} is parked on
+ * {@link toDispose} so the drain catches them on client-detach.
  */
 @injectable()
 export class HydraniumGlspStorage<TRoot extends AstNode, TSourceModel = string>
@@ -137,14 +223,13 @@ export class HydraniumGlspStorage<TRoot extends AstNode, TSourceModel = string>
    @inject(ModelValidator) @optional() protected readonly modelValidator?: ModelValidator;
 
    /**
-    * Selected {@link SaveConflictPolicy} for {@link saveSourceModel}. Bind the
-    * {@link SaveConflictPolicy} token in a `DiagramModule` to choose a policy;
-    * left unbound it resolves to {@link DEFAULT_SAVE_CONFLICT_POLICY}
-    * (`overwrite`, last-write-wins). Read via {@link saveConflictPolicy} so the
-    * fallback is applied even when inversify injects `undefined` for an unbound
-    * `@optional()` member.
+    * Selected {@link SaveDeliveryPolicy} for {@link saveSourceModel}. Bind the
+    * {@link SaveDeliveryPolicy} token in a `DiagramModule` to choose a policy;
+    * left unbound it resolves to {@link DEFAULT_SAVE_DELIVERY_POLICY}. Read via
+    * {@link saveDeliveryPolicy} so the fallback is applied even when inversify
+    * injects `undefined` for an unbound `@optional()` member.
     */
-   @inject(SaveConflictPolicy) @optional() protected readonly boundSaveConflictPolicy?: SaveConflictPolicy;
+   @inject(SaveDeliveryPolicy) @optional() protected readonly boundSaveDeliveryPolicy?: SaveDeliveryPolicy;
 
    /** Disposables created during {@link doLoadSourceModel}; drained on session disposal. */
    protected toDispose = new DisposableCollection();
@@ -159,6 +244,25 @@ export class HydraniumGlspStorage<TRoot extends AstNode, TSourceModel = string>
     */
    protected readonly secondarySubscriptions = new Map<string, Disposable>();
 
+   /**
+    * Documents that left the write set since the last save. They stay open in
+    * the diagram's session until that save has persisted them, and are closed
+    * after it: closing a document as it leaves would revert the diagram's
+    * unsaved edits to it where the diagram was its last client.
+    */
+   protected readonly departedSecondaries = new Set<string>();
+
+   /**
+    * How long a load waits for a client id another participant holds to free
+    * before refusing. A reloaded client can reconnect under its old id before
+    * the server has noticed the old connection close, which ends that
+    * connection's sessions a moment later.
+    */
+   protected readonly sessionWaitMs: number = 2_000;
+
+   /** Set by {@link dispose}; a disposed storage registers no session again. */
+   protected disposed = false;
+
    /**
     * Whether an external resubmit has ever been dispatched. Gates the
     * keep-the-last-valid-GModel branch, which needs to know a canvas is already
@@ -178,7 +282,7 @@ export class HydraniumGlspStorage<TRoot extends AstNode, TSourceModel = string>
    protected resubmitDebouncer!: Debouncer;
 
    /** Latest event document awaiting the debounced resubmit; read by {@link flushResubmit} (last write wins). */
-   protected pendingResubmitDocument?: AstDocument<AstNode, unknown>;
+   protected pendingResubmitDocument?: AstDocument<AstNode>;
 
    @postConstruct()
    protected init(): void {
@@ -188,6 +292,7 @@ export class HydraniumGlspStorage<TRoot extends AstNode, TSourceModel = string>
       if (this.state.clientId === TEMPORARY_CLIENT_ID) {
          return;
       }
+      this.state.modelSession = this.registerModelSession();
       this.sessionManager.addListener(this, this.state.clientId);
       // Watched for this storage's whole lifetime rather than per load. The load
       // flow is a documented override point, so a subscription parked there would
@@ -196,6 +301,102 @@ export class HydraniumGlspStorage<TRoot extends AstNode, TSourceModel = string>
       this.toDispose.push(this.state.onSecondaryUrisChanged(() => this.reconcileSecondarySubscriptions()));
    }
 
+   /**
+    * Register the diagram's client session under the GLSP client id, or
+    * `undefined` when another participant holds that id, which is logged.
+    *
+    * The diagram then refuses to load ({@link requireModelSession}). Taking
+    * the id over would end the other participant's session under it, and
+    * working without a session would share that participant's opens and
+    * echoes, so its close would take the diagram's documents with it.
+    */
+   protected registerModelSession(): ModelClientSession<AstNode> | undefined {
+      try {
+         return this.sharedServices.model.ModelService.createSession('diagram', this.state.clientId);
+      } catch (error: unknown) {
+         if (!isDuplicateClientIdError(error)) {
+            throw error;
+         }
+         this.logger.warn(`Client id ${this.state.clientId} is held by another participant: this diagram has no session yet`);
+         return undefined;
+      }
+   }
+
+   /**
+    * The diagram's client session, registering it again when the id was held
+    * earlier. Throws `SessionClosedError` once the storage is disposed, and the
+    * refusal when the id is still held.
+    */
+   protected requireModelSession(): ModelClientSession<AstNode> {
+      if (this.disposed) {
+         throw new SessionClosedError(
+            this.state.clientId,
+            `The diagram of ${this.state.clientId} has closed; its client session has ended`
+         );
+      }
+      if (!this.state.modelSession) {
+         this.state.modelSession = this.registerModelSession();
+      }
+      const session = this.state.modelSession;
+      if (!session) {
+         throw new GLSPServerError(
+            this.sharedServices.MessageRenderer.renderMessage(DIAGRAM_SESSION_REFUSED),
+            `clientId=${this.state.clientId} is still held by another participant, so this diagram has no client session`
+         );
+      }
+      return session;
+   }
+
+   /**
+    * {@link requireModelSession} for the load: while the id is held, wait up to
+    * {@link sessionWaitMs} for its holder to end before refusing, and tell the
+    * user when it does not.
+    */
+   protected async awaitModelSession(): Promise<ModelClientSession<AstNode>> {
+      if (!this.state.modelSession && !this.disposed) {
+         this.state.modelSession = this.registerModelSession();
+      }
+      if (!this.state.modelSession && !this.disposed) {
+         await this.waitForSessionEnd(this.state.clientId, this.sessionWaitMs);
+      }
+      try {
+         return this.requireModelSession();
+      } catch (error: unknown) {
+         // A diagram closed while it waited has no client left to tell.
+         if (isSessionClosedError(error)) {
+            throw error;
+         }
+         this.logger.error(`Client id ${this.state.clientId} is still held by another participant: this diagram does not load`);
+         this.actionDispatcher
+            .dispatch(
+               MessageAction.create(this.sharedServices.MessageRenderer.renderMessage(DIAGRAM_SESSION_REFUSED), { severity: 'ERROR' })
+            )
+            .catch((dispatchError: unknown) =>
+               this.logger.warn(`Could not tell the client the diagram was refused: ${String(dispatchError)}`)
+            );
+         throw error;
+      }
+   }
+
+   /** Resolve once the client session under `clientId` ends, or after `timeoutMs`. */
+   protected waitForSessionEnd(clientId: string, timeoutMs: number): Promise<void> {
+      return new Promise<void>(resolve => {
+         const subscriptions = new DisposableCollection();
+         const done = (): void => {
+            subscriptions.dispose();
+            resolve();
+         };
+         subscriptions.push(this.sharedServices.Clock.setTimer(done, timeoutMs));
+         subscriptions.push(
+            this.sharedServices.workspace.TextDocuments.onDidCloseSession(event => {
+               if (event.clientId === clientId) {
+                  done();
+               }
+            })
+         );
+      });
+   }
+
    /**
     * Default load flow — {@link doLoadSourceModel}. Adopters whose load flow
     * needs more than the seams allow override this method.
@@ -211,8 +412,8 @@ export class HydraniumGlspStorage<TRoot extends AstNode, TSourceModel = string>
 
       // Open FIRST: a workspace-scanned-but-never-didOpened document rebuilds here,
       // so the capture below settles on a built root rather than a transient
-      // mid-rebuild one.
-      this.toDispose.push(await modelService.open({ uri: rootUri, clientId: this.state.clientId }));
+      // mid-rebuild one. Closed when the session ends.
+      await (await this.awaitModelSession()).open(rootUri);
 
       // GLSP's sessionDisposed is unreliable on Theia tab-close; dispose on client
       // detach so reopens don't accumulate stale onModelUpdated listeners.
@@ -235,12 +436,29 @@ export class HydraniumGlspStorage<TRoot extends AstNode, TSourceModel = string>
    }
 
    /**
-    * Capture the initial settled root and apply the initial edit mode. `settled()`
-    * strips diagnostics by phase contract, so the first edit mode is `EDITABLE`;
-    * the first {@link handleModelUpdated} (at `Validated`, with diagnostics) flips
-    * it READONLY if the document has structural parse errors. Edit-mode +
-    * settle-hook actions are dispatched on a macrotask so the initial
+    * Capture the initial settled root and apply the initial edit mode. Edit-mode
+    * + settle-hook actions are dispatched on a macrotask so the initial
     * `requestModel → setModel` handshake isn't perturbed.
+    *
+    * **Whether the settled document carries diagnostics depends on how far it
+    * had already got, so the initial edit mode has two correct outcomes rather
+    * than one.** `settled()` strips nothing: it resolves AT OR ABOVE the
+    * integrity landmark and hands back the live document's own array. Its
+    * `AstDocument<TAst, never>` return type asserts emptiness for a document the
+    * wait had to DRIVE to that landmark, which is pre-validation — and for that
+    * one the mode here is `EDITABLE` and the flip to READONLY arrives with the
+    * first {@link handleModelUpdated}. A document already past `Validated` when
+    * the session opened resolves immediately with its diagnostics intact, and is
+    * decided correctly here with no later update owed. Any host that validates
+    * its workspace before a diagram is opened produces the second case, so
+    * neither is exceptional.
+    *
+    * **A correct decision is not a delivered one.** This dispatch happens inside
+    * the initial `requestModel`, before the client has the model — so the UI
+    * extensions that answer {@link onParseErrorChanged}'s actions are not yet
+    * constructed, and a canvas that opens READONLY over a broken document shows
+    * none of that feedback. The same timer carries {@link onSourceModelSettled},
+    * so an adopter's own initial actions have it too.
     */
    protected async captureSettledRoot(rootUri: string, document: AstDocument<AstNode, never>): Promise<void> {
       this.state.setSourceRoot(rootUri, document.root as TRoot);
@@ -275,18 +493,44 @@ export class HydraniumGlspStorage<TRoot extends AstNode, TSourceModel = string>
          if (!current.has(uri)) {
             subscription.dispose();
             this.secondarySubscriptions.delete(uri);
+            this.departedSecondaries.add(uri);
          }
       }
       for (const uri of current) {
          if (!this.secondarySubscriptions.has(uri)) {
+            this.departedSecondaries.delete(uri);
             this.secondarySubscriptions.set(
                uri,
                this.sharedServices.model.ModelService.onModelUpdated(uri, event => this.handleSecondaryUpdated(uri, event))
             );
+            this.openSecondary(uri);
          }
       }
    }
 
+   /**
+    * Open a document that joined the write set through the diagram's session,
+    * where it stays open until the diagram's next save after it leaves the set,
+    * or the diagram's end. A document that does not exist yet is left to the
+    * write that creates it, and a failed open is logged: the write that needs
+    * the document opens it again and fails there.
+    */
+   protected openSecondary(uri: string): void {
+      const session = this.state.modelSession;
+      if (!session || !this.sharedServices.model.ModelService.getDocument(uri)) {
+         return;
+      }
+      session.open(uri).catch((error: unknown) => {
+         const detail = `Could not open ${uri} for ${this.state.clientId}: ${error instanceof Error ? error.message : String(error)}`;
+         // A session ending while the open reads is the diagram closing.
+         if (isSessionClosedError(error)) {
+            this.logger.debug(detail);
+         } else {
+            this.logger.warn(detail);
+         }
+      });
+   }
+
    /**
     * React to a rebuild of a SECONDARY document by resubmitting the diagram, so
     * an external edit to (say) a layout file reaches the canvas.
@@ -312,7 +556,7 @@ export class HydraniumGlspStorage<TRoot extends AstNode, TSourceModel = string>
     * drag this client authors — the guard above gates the resubmit, not the
     * markers.
     */
-   protected handleSecondaryUpdated(uri: string, event: AstDocumentUpdatedEvent<AstNode, unknown>): void {
+   protected handleSecondaryUpdated(uri: string, event: AstDocumentUpdatedEvent<AstNode>): void {
       if (this.disposeIfStale(uri)) {
          return;
       }
@@ -333,11 +577,12 @@ export class HydraniumGlspStorage<TRoot extends AstNode, TSourceModel = string>
     *
     * Synchronous by construction — the phase-agnostic lookup door plus the shared
     * projection — so reacting to a secondary neither waits nor can force a build.
-    * `settled()` is not an alternative: it strips diagnostics by phase contract,
-    * and diagnostics are the reason {@link doUpdateAndSubmit} takes a separate
-    * event document at all.
+    * `settled()` is not an alternative: besides being asynchronous, it cannot be
+    * relied on to carry diagnostics — a document it has to drive to the landmark
+    * arrives pre-validation with an empty array — and diagnostics are the reason
+    * {@link doUpdateAndSubmit} takes a separate event document at all.
     */
-   protected currentPrimaryDocument(): AstDocument<AstNode, unknown> | undefined {
+   protected currentPrimaryDocument(): AstDocument<AstNode> | undefined {
       const document = this.sharedServices.model.ModelService.getDocument(this.state.sourceUri);
       return document ? AstDocument.from(document) : undefined;
    }
@@ -350,7 +595,7 @@ export class HydraniumGlspStorage<TRoot extends AstNode, TSourceModel = string>
     * diagnostic markers for every update — including own edits, which skip
     * the resubmit but can still change diagnostics.
     */
-   protected async handleModelUpdated(rootUri: string, event: AstDocumentUpdatedEvent<AstNode, unknown>): Promise<void> {
+   protected async handleModelUpdated(rootUri: string, event: AstDocumentUpdatedEvent<AstNode>): Promise<void> {
       if (this.disposeIfStale(rootUri)) {
          return;
       }
@@ -382,7 +627,7 @@ export class HydraniumGlspStorage<TRoot extends AstNode, TSourceModel = string>
     * {@link resubmitDebouncer}, so a burst of rebuilds runs
     * {@link doUpdateAndSubmit} once with the most recent document.
     */
-   protected scheduleUpdateAndSubmit(document: AstDocument<AstNode, unknown>): void {
+   protected scheduleUpdateAndSubmit(document: AstDocument<AstNode>): void {
       this.pendingResubmitDocument = document;
       this.resubmitDebouncer.schedule();
    }
@@ -409,7 +654,7 @@ export class HydraniumGlspStorage<TRoot extends AstNode, TSourceModel = string>
     * mark our stack clean so the editor doesn't prompt to re-save identical
     * content. Our own saves already settle the stack through the save flow.
     */
-   protected handleModelSaved(event: AstDocumentSavedEvent<AstNode, unknown>): void {
+   protected handleModelSaved(event: AstDocumentSavedEvent<AstNode>): void {
       if (this.state.clientId !== event.sourceClientId) {
          this.commandStack.saveIsDone();
       }
@@ -418,10 +663,12 @@ export class HydraniumGlspStorage<TRoot extends AstNode, TSourceModel = string>
    /**
     * Re-settle to a guaranteed fully-linked + reprojected root, capture it, and
     * (unless suppressed) resubmit a deduped external GModel. Diagnostics for the
-    * edit-mode decision come from the event document (`settled()` strips them by
-    * phase contract).
+    * edit-mode decision come from the event document, because the re-settled one
+    * cannot be relied on to have any: a document driven to the landmark arrives
+    * pre-validation, and this path re-settles precisely to escape a transient
+    * mid-rebuild snapshot.
     */
-   protected async doUpdateAndSubmit(rootUri: string, eventDocument: AstDocument<AstNode, unknown>): Promise<Action[]> {
+   protected async doUpdateAndSubmit(rootUri: string, eventDocument: AstDocument<AstNode>): Promise<Action[]> {
       // Settle-gate the capture: never setSourceRoot off the event's possibly-transient
       // snapshot — the event can arrive while a re-entered document is mid-rebuild.
       const document = await this.sharedServices.model.ModelService.settled(rootUri);
@@ -459,7 +706,7 @@ export class HydraniumGlspStorage<TRoot extends AstNode, TSourceModel = string>
     * flip {@link AbstractHydraniumGlspState.editMode}, and — only on a transition —
     * return the {@link onParseErrorChanged} actions. No transition → no actions.
     */
-   protected refreshEditMode(document: AstDocument<AstNode, unknown>): Action[] {
+   protected refreshEditMode(document: AstDocument<AstNode>): Action[] {
       const broken = this.isStructurallyBroken(document);
       const previousEditMode = this.state.editMode;
       this.state.editMode = broken ? EditMode.READONLY : EditMode.EDITABLE;
@@ -476,20 +723,53 @@ export class HydraniumGlspStorage<TRoot extends AstNode, TSourceModel = string>
     * carrying a Langium `lexing-error` / `parsing-error` code. Adopters override
     * to compose additional break reasons.
     */
-   protected isStructurallyBroken(document: AstDocument<AstNode, unknown>): boolean {
+   protected isStructurallyBroken(document: AstDocument<AstNode>): boolean {
       return document.diagnostics.some(diagnostic => isStructuralDiagnostic(diagnostic));
    }
 
    /**
-    * Seam: actions to emit when the structural-broken state transitions. Default:
-    * a single {@link SetEditModeAction} toggling READONLY ↔ EDITABLE — editing is
-    * disabled while the syntax is broken but re-enabled once it parses, a sound
-    * generic for any Langium-backed diagram. Adopters override to add or replace
-    * the transition feedback. The {@link AbstractHydraniumGlspState.editMode}
-    * flip itself is owned by {@link refreshEditMode}.
+    * Seam: actions to emit when the structural-broken state transitions.
+    * Default: a {@link SetEditModeAction} toggling READONLY ↔ EDITABLE — editing
+    * is disabled while the syntax is broken but re-enabled once it parses, a
+    * sound generic for any Langium-backed diagram — plus the
+    * {@link DIAGRAM_READONLY_PARSE_ERROR} band that says why, cleared on the way
+    * back. Adopters override to add or replace the transition feedback. The
+    * {@link AbstractHydraniumGlspState.editMode} flip itself is owned by
+    * {@link refreshEditMode}.
+    *
+    * **Both actions or neither, which is why they are one seam rather than
+    * two.** The mode flip removes the tool palette and the band is the only
+    * account of that, so an override that keeps one and drops the other produces
+    * either an unexplained loss of the palette or a warning about a restriction
+    * that is not in force.
+    *
+    * **The status is dispatched with no `timeout`, so it persists** — a
+    * time-limited band would describe a condition that outlasts it.
+    *
+    * **The slot is SHARED, and the other writer wins on one path.**
+    * `ModelSubmissionHandler`'s live validation writes the same slot, clearing
+    * it with `severity: 'NONE'` when it finishes, and an adopter dispatching its
+    * own `StatusAction` replaces this one too. Nothing re-asserts it. That is
+    * harmless while a document is being edited, because a resubmit is skipped
+    * once the AST is broken (see {@link doUpdateAndSubmit}) — but NOT at load:
+    * the initial `requestModel` submit is not that skipped path, so a diagram
+    * opened on an already-broken document shows this band and then loses it to
+    * the validation clear a moment later. Measured on a browser host, polling the
+    * overlay: no element, empty, the sentence, empty again.
     */
-   protected onParseErrorChanged(_document: AstDocument<AstNode, unknown>, broken: boolean): Action[] {
-      return [SetEditModeAction.create(broken ? EditMode.READONLY : EditMode.EDITABLE)];
+   protected onParseErrorChanged(_document: AstDocument<AstNode>, broken: boolean): Action[] {
+      return [
+         SetEditModeAction.create(broken ? EditMode.READONLY : EditMode.EDITABLE),
+         broken
+            ? StatusAction.create(this.sharedServices.MessageRenderer.renderMessage(DIAGRAM_READONLY_PARSE_ERROR), {
+                 severity: 'WARNING'
+              })
+            : // `NONE` is the client's own spelling for "clear", not a severity it
+              // renders: `StatusOverlay.handle` branches on it before touching the
+              // DOM. An empty message at any other severity leaves an empty band
+              // with a warning icon standing on the canvas.
+              StatusAction.create('', { severity: 'NONE' })
+      ];
    }
 
    /**
@@ -500,32 +780,48 @@ export class HydraniumGlspStorage<TRoot extends AstNode, TSourceModel = string>
       return [];
    }
 
-   /** The effective {@link SaveConflictPolicy}: the bound option, or {@link DEFAULT_SAVE_CONFLICT_POLICY} when unbound. */
-   protected get saveConflictPolicy(): SaveConflictPolicy {
-      return this.boundSaveConflictPolicy ?? DEFAULT_SAVE_CONFLICT_POLICY;
+   /** The effective {@link SaveDeliveryPolicy}: the bound option, or {@link DEFAULT_SAVE_DELIVERY_POLICY} when unbound. */
+   protected get saveDeliveryPolicy(): SaveDeliveryPolicy {
+      return this.boundSaveDeliveryPolicy ?? DEFAULT_SAVE_DELIVERY_POLICY;
    }
 
    /**
-    * Default save flow: route through `ModelService.save`. The framework
-    * serialise-and-persist machinery handles serialisation (via the
-    * language-specific `Serializer` bound at `services.serializer.Serializer`),
-    * the multi-client text-document update, the rebuild, and the eventual
-    * `WritableFileSystemProvider.writeFile`.
+    * Default save flow: persist the store's current text for every document the
+    * diagram's session has open.
+    *
+    * **A save persists, it does not author.** Every diagram gesture already
+    * reached the store through the diagram's session, so the store holds the
+    * settled text and disk is the only thing behind. Re-serializing from the AST
+    * here cannot improve on that text and can only damage it: a serializer
+    * normalises formatting, and the comments the write path carries over keep
+    * none of the hand-formatting around them, so a save would reflow a document
+    * nothing changed — which is what a pure bounds drag does to the semantic
+    * file when only its layout moved.
     *
-    * The configured {@link SaveConflictPolicy} (see {@link saveConflictPolicy})
-    * decides how a concurrent edit that advanced the document is handled:
-    * - `overwrite` (default): no based-on guard, await, propagate failures —
-    *   last-write-wins, correct for a single-editor head.
-    * - `reject`: guard on the captured `state.version`, await, surface a
-    *   `ConflictError` (and any other failure) to the GLSP save action.
-    * - `drop-and-log`: guard, fire-and-forget, log + swallow failures — a stale
-    *   diagram save is dropped because a concurrent form/code edit already wrote
-    *   the truth, and GLSP exposes no save-failure back-channel.
+    * **What is saved is the primary, every tracked secondary
+    * (`AbstractHydraniumGlspState.trackSecondaryDocument`) and every document
+    * that left the write set since the last save**, so a document the diagram
+    * wrote is persisted whether or not it is the one the client named. One the
+    * diagram's session does not have open is skipped, even when another client
+    * has it open: that client's unsaved edits are not the diagram's to persist.
+    *
+    * **A save therefore names documents the gesture did not aim at**, which is
+    * why an unchanged one is not rewritten even though the user asked for a
+    * save: the mtime would move on a file they never touched.
+    * `AstDocumentManager.save` decides that per document and announces the save
+    * either way.
+    *
+    * The configured {@link SaveDeliveryPolicy} (see {@link saveDeliveryPolicy})
+    * decides await-vs-fire-and-forget and failure handling. It carries no
+    * based-on guard: the guard exists to stop a stale writer overwriting a newer
+    * document, and a flush persists the store — which already holds every other
+    * client's change, including the one that advanced the version.
     *
     * Returns `MaybePromise<void>` to match upstream `SourceModelStorage`:
-    * resolves with the persist under `overwrite`/`reject`, returns synchronously
-    * under `drop-and-log`. Adopters that bypass `ModelService` (writing through
-    * `WritableFileSystemProvider` directly) still override the whole method.
+    * resolves with the flush under `await`, returns synchronously under
+    * `fire-and-forget`. Adopters that bypass `AstDocumentManager` (writing
+    * through `WritableFileSystemProvider` directly) still override the whole
+    * method.
     */
    saveSourceModel(action: SaveModelAction): MaybePromise<void> {
       // Normalised for the same reason the load path is: `SaveModelAction.fileUri`
@@ -535,26 +831,51 @@ export class HydraniumGlspStorage<TRoot extends AstNode, TSourceModel = string>
       // the call site rather than inside `getFileUri` so that method's contract —
       // return what the action said — is unchanged for adopters overriding it.
       const uri = this.toSourceModelUri(this.getFileUri(action));
-      const policy = this.saveConflictPolicy;
-      const persisted = this.sharedServices.model.ModelService.save({
-         uri,
-         model: this.state.sourceRoot,
-         clientId: this.state.clientId,
-         baseVersion: policy.kind === 'overwrite' ? undefined : this.state.version
-      }).then(() => undefined);
-
-      if (policy.kind === 'drop-and-log') {
-         // Fire-and-forget: the diagram save lost the race to a concurrent edit
-         // that already persisted the truth, so it must neither block the action
-         // nor surface. Log rather than leave an unhandled rejection.
+      const policy = this.saveDeliveryPolicy;
+      const persisted = this.flushWriteSet(uri);
+
+      if (policy.kind === 'fire-and-forget') {
+         // Log rather than leave an unhandled rejection: the promise is not
+         // returned, so nothing else will observe a failure.
          persisted.catch(error => this.logger.error(`Save failed for ${uri}: ${error instanceof Error ? error.message : String(error)}`));
          return undefined;
       }
-      // overwrite / reject: await; a ConflictError (reject) or any other failure
-      // propagates to GLSP's save-action handler.
+      // Awaited: any failure propagates to GLSP's save-action handler.
       return persisted;
    }
 
+   /**
+    * Save the stored text of `primaryUri`, every tracked secondary and every
+    * document that left the write set since the last save, each only where
+    * the diagram's session has it open; then close those that left.
+    *
+    * Deduplicated, because a state that tracks its own primary as a secondary
+    * would otherwise save it twice and fire two save notifications for one
+    * save. Every save is called in one synchronous step, so each takes its text
+    * before anything can close a document of the set: saved one after another,
+    * a GLSP session ending during the first write closes the rest unsaved.
+    */
+   protected async flushWriteSet(primaryUri: string): Promise<void> {
+      // Refused like the load: without a session the client id's opens are
+      // another participant's, and this would save them.
+      this.requireModelSession();
+      const documents = this.sharedServices.workspace.AstDocumentManager;
+      const textDocuments = this.sharedServices.workspace.TextDocuments;
+      const clientId = this.state.clientId;
+      // Taken with the targets: a document leaving the set during the writes
+      // was not saved by them, and stays open for the next save.
+      const departed = [...this.departedSecondaries];
+      const targets = [...new Set([primaryUri, ...this.state.secondaryUris, ...departed])].filter(uri =>
+         textDocuments.isOpenInClient(uri, clientId)
+      );
+      await Promise.all(targets.map(target => documents.save(target, clientId)));
+      for (const uri of departed) {
+         if (this.departedSecondaries.delete(uri) && uri !== this.state.sourceUri) {
+            await this.state.modelSession?.close(uri);
+         }
+      }
+   }
+
    /**
     * Normalise GLSP's `sourceUri` — which may be a filesystem PATH or a URI
     * string — to the URI string the workspace keys documents by.
@@ -584,11 +905,25 @@ export class HydraniumGlspStorage<TRoot extends AstNode, TSourceModel = string>
     *
     * Returns it VERBATIM, in whatever form the client sent;
     * {@link toSourceModelUri} is what normalises it.
+    *
+    * A model request DOES carry a request id, so a throw here takes the
+    * client-request path rather than the toast path — and on that path `detail`
+    * comes from `cause?.toString?.()`. A single-argument throw therefore reaches
+    * neither the server log nor the client console: both print `undefined`. So
+    * the two readers are addressed separately, as on the save path: `message`
+    * names what failed in the user's terms and is rendered, `cause` names the
+    * action and the option key that was missing and stays English. On THIS path
+    * the cause reaches only logs — `RejectAction.detail` is read by nothing but
+    * the client action-dispatcher's `logger.warn` — which is not what makes it
+    * English; its content is.
     */
    protected getSourceUri(action: RequestModelAction): string {
       const sourceUri = action.options?.[SOURCE_URI_ARG];
       if (typeof sourceUri !== 'string') {
-         throw new GLSPServerError(`Invalid RequestModelAction! Missing argument with key '${SOURCE_URI_ARG}'`);
+         throw new GLSPServerError(
+            this.sharedServices.MessageRenderer.renderMessage(SOURCE_URI_MISSING),
+            `no '${SOURCE_URI_ARG}' option on the ${action.kind} action (received ${typeof sourceUri})`
+         );
       }
       return sourceUri;
    }
@@ -600,18 +935,24 @@ export class HydraniumGlspStorage<TRoot extends AstNode, TSourceModel = string>
     * {@link AbstractHydraniumGlspState.setSourceRoot}.
     *
     * A save action carries no request id, so a throw here reaches the user as a
-    * toast built from `message`, with `cause` behind its details control. The
-    * two therefore address different readers and must not be collapsed: the
-    * message names what failed in the user's terms, and the cause names which
-    * lookups came back empty for whom. Neither can name the URI — not having
-    * one IS the failure, and both sources are written together, so the typed
-    * `sourceUri` is equally empty whenever this fires.
+    * toast built from `message`, while `cause` travels in
+    * `MessageAction.details` — **which a Theia host DOES put in front of a
+    * user**, as a "Show details" button on the toast opening a dialog. So the
+    * two are not split by reachability; they are split by AUDIENCE, which is
+    * the older rule and the one that holds here. The message names what failed
+    * in the user's terms and is rendered; the cause names which lookups came
+    * back empty for whom, and stays English because a wire action kind, an
+    * option key and a client id address whoever composes the system — a
+    * translated developer string is a worse outcome than an untranslated one.
+    * Neither can name the URI — not having one IS the failure, and both sources
+    * are written together, so the typed `sourceUri` is equally empty whenever
+    * this fires.
     */
    protected getFileUri(action: SaveModelAction): string {
       const uri = action.fileUri ?? this.state.get<string>(SOURCE_URI_ARG);
       if (!uri) {
          throw new GLSPServerError(
-            'Could not determine where to save this model',
+            this.sharedServices.MessageRenderer.renderMessage(SAVE_TARGET_UNKNOWN),
             `no fileUri on the save action and no ${SOURCE_URI_ARG} in the model state (clientId=${this.state.clientId})`
          );
       }
@@ -644,10 +985,14 @@ export class HydraniumGlspStorage<TRoot extends AstNode, TSourceModel = string>
    }
 
    /**
-    * Cancel any pending resubmit and drain every subscription — those registered
+    * Cancel any pending resubmit, drain every subscription — those registered
     * during {@link doLoadSourceModel} and the per-secondary ones, which live
-    * outside {@link toDispose} because they come and go with the write set.
+    * outside {@link toDispose} because they come and go with the write set —
+    * and end the diagram's client session, closing everything it has open.
     * Idempotent.
+    *
+    * The session ends last, once the detach listener is gone: its closes would
+    * otherwise report this storage's own teardown as a client detaching.
     */
    dispose(): void {
       this.resubmitDebouncer?.dispose();
@@ -656,5 +1001,8 @@ export class HydraniumGlspStorage<TRoot extends AstNode, TSourceModel = string>
       }
       this.secondarySubscriptions.clear();
       this.toDispose.dispose();
+      this.disposed = true;
+      this.state.modelSession?.dispose();
+      this.state.modelSession = undefined;
    }
 }