@hydranium/glsp-server 1.0.0-next.12 → 1.0.0-next.123

package/lib/state/reconciling-transfer-hydranium-glsp-state.js

@@ -28,16 +28,16 @@ import { reconcileSourceModelWrite } from './reconcile-source-model-write.js';
  *   field-level shape is what lets `fast-json-patch` diff per field, so undo /
  *   redo and forward-write reconcile act per field instead of clobbering the
  *   whole document.
- * - {@link baseline} — the last in-sync projection, captured on every
+ * - {@link base} — the last in-sync projection, captured on every
  *   {@link setSourceRoot}. A forward-write conflict reconciles the user's
- *   intent (baseline → attempted) against the fresh server root.
+ *   intent (base → ours) against the server's current root (theirs).
  * - {@link updateSourceModel} — the concrete reconcile template: persist,
  *   and on a `ConflictError` consult the injected `conflictResolver` and act
  *   on the merged / no-op / conflict / unavailable outcome.
  * - {@link persist} / {@link refetch} — the only I/O seams. Defaults route
- *   through `ModelService.update` / `.validated` (reachable from the base via
- *   `sharedServices.model`); adopters whose document round-trip differs
- *   override these without touching the orchestration.
+ *   through the diagram session's `update` and `ModelService.validated`;
+ *   adopters whose document round-trip differs override these without
+ *   touching the orchestration.
  *
  * Adopters whose source model is whole-document text (a bare `{ text }`
  * source model) or that are read-only do NOT extend this class — they extend
@@ -49,12 +49,12 @@ import { reconcileSourceModelWrite } from './reconcile-source-model-write.js';
 let ReconcilingTransferHydraniumGlspState = class ReconcilingTransferHydraniumGlspState extends AbstractHydraniumGlspState {
     /**
      * Last in-sync source-model projection, captured on every
-     * {@link setSourceRoot} (initial load + post-update). The baseline a
+     * {@link setSourceRoot} (initial load + post-update). The base a
      * forward-write conflict reconciles against: it stays the pre-command
      * state because operation handlers mutate `_sourceRoot` in place during
      * `execute` while `setSourceRoot` only re-runs once the write commits.
      */
-    baseline;
+    base;
     /**
      * Persisted-shape projection of the current source root, consumed by GLSP's
      * {@link JsonModelState} read side and recorded for field-level undo / redo.
@@ -68,27 +68,27 @@ let ReconcilingTransferHydraniumGlspState = class ReconcilingTransferHydraniumGl
     }
     setSourceRoot(uri, root) {
         super.setSourceRoot(uri, root);
-        this.baseline = this.sourceModel;
+        this.base = this.sourceModel;
     }
     /**
      * Persist `model` back to the document store, then capture the resulting
      * AST root. On a `ConflictError` (the based-on version was superseded),
-     * reconcile the user's intent against the fresh server root via the bound
+     * reconcile the user's intent against the server's current root via the bound
      * `conflictResolver` and act on the outcome — one declarative policy
      * (force = last-writer-wins, reconciling = field-level merge) shared with
      * undo / redo.
      */
-    async updateSourceModel(model, version) {
+    async updateSourceModel(model, basedOn = this.basedOn) {
         // Orchestration lives in `reconcileSourceModelWrite` so the multi-document
         // state gets the identical conflict handling; this method supplies only
         // the single-document meaning of persist / project.
-        return reconcileSourceModelWrite(model, version, {
-            persist: async (candidate, baseVersion) => {
-                const { root } = await this.persist(candidate, baseVersion);
+        return reconcileSourceModelWrite(model, basedOn, {
+            persist: async (candidate, candidateBasedOn) => {
+                const { root } = await this.persist(candidate, candidateBasedOn);
                 this.setSourceRoot(this._sourceUri, root);
             },
             refetch: () => this.refetch(),
-            baseline: this.baseline,
+            base: this.base,
             conflictResolver: this.conflictResolver,
             logger: this.logger,
             onConflictDropped: () => this.refreshSourceRoot()
@@ -96,30 +96,26 @@ let ReconcilingTransferHydraniumGlspState = class ReconcilingTransferHydraniumGl
     }
     /**
      * Persist hook — the only write-side I/O. Default routes the structured
-     * model through `ModelService.update` (serialize → reparse), opting into
-     * the `ConflictError` gate when `version` is given. Adopters whose document
+     * model through the diagram session's `update` (serialize → reparse),
+     * opting into the `ConflictError` gate unless `basedOn` is `'anything'`,
+     * and throws without a session. Adopters whose document
      * round-trip differs override this; the orchestration in
      * {@link updateSourceModel} is unchanged.
      */
-    async persist(model, baseVersion) {
-        const document = await this.sharedServices.model.ModelService.update({
-            uri: this._sourceUri,
-            model,
-            clientId: this.clientId,
-            baseVersion
-        });
+    async persist(model, basedOn) {
+        const document = await this.requireModelSession().update({ uri: this._sourceUri, model, basedOn });
         return document;
     }
     /**
-     * Refetch hook — reads the current settled server root as a persisted-shape
-     * projection (or `undefined` when unavailable). The `conflictResolver`
-     * replays the user's intent against this fresh state. Default uses
-     * `ModelService.validated` + the framework encoder's `'grammar'` mode;
-     * adopters override alongside {@link persist}.
+     * Refetch hook — the stored text parsed afresh, as a persisted-shape
+     * projection (or `undefined` when unavailable): theirs, which the
+     * `conflictResolver` replays the user's intent onto. Default uses
+     * {@link AbstractHydraniumGlspState.readCurrentRoot} + the framework
+     * encoder's `'grammar'` mode; adopters override alongside {@link persist}.
      */
     async refetch() {
-        const fresh = await this.sharedServices.model.ModelService.validated(this._sourceUri).catch(() => undefined);
-        return fresh ? this.sharedServices.model.TransferEncoder.toTransfer(fresh.root, 'grammar') : undefined;
+        const theirs = await this.readCurrentRoot(this._sourceUri);
+        return theirs ? this.sharedServices.model.TransferEncoder.toTransfer(theirs, 'grammar') : undefined;
     }
 };
 ReconcilingTransferHydraniumGlspState = __decorate([

package/lib/state/reconciling-transfer-hydranium-glsp-state.js.map

@@ -1 +1 @@
-{"version":3,"file":"reconciling-transfer-hydranium-glsp-state.js","sourceRoot":"","sources":["../../src/state/reconciling-transfer-hydranium-glsp-state.ts"],"names":[],"mappings":"AAAA;;;;;;;kFAOkF;;;;;;;AAGlF,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAGvC,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEI,IAAM,qCAAqC,GAA3C,MAAM,qCACV,SAAQ,0BAA+C;IAGvD;;;;;;OAMG;IACO,QAAQ,CAAgB;IAElC;;;;;;;OAOG;IACH,IAAI,WAAW;QACZ,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,CAA4B,CAAC;IACvH,CAAC;IAEQ,aAAa,CAAC,GAAW,EAAE,IAAW;QAC5C,KAAK,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC;IACpC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,iBAAiB,CAAC,KAAmB,EAAE,OAAgB;QAC1D,2EAA2E;QAC3E,wEAAwE;QACxE,oDAAoD;QACpD,OAAO,yBAAyB,CAAe,KAAK,EAAE,OAAO,EAAE;YAC5D,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE;gBACvC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;gBAC5D,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YAC7C,CAAC;YACD,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE;YAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,iBAAiB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,iBAAiB,EAAE;SACnD,CAAC,CAAC;IACN,CAAC;IAED;;;;;;OAMG;IACO,KAAK,CAAC,OAAO,CAAC,KAAmB,EAAE,WAAoB;QAC9D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC;YAClE,GAAG,EAAE,IAAI,CAAC,UAAU;YACpB,KAAK;YACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,WAAW;SACb,CAAC,CAAC;QACH,OAAO,QAAsC,CAAC;IACjD,CAAC;IAED;;;;;;OAMG;IACO,KAAK,CAAC,OAAO;QACpB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC7G,OAAO,KAAK,CAAC,CAAC,CAAE,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,CAA6B,CAAC,CAAC,CAAC,SAAS,CAAC;IACvI,CAAC;CACH,CAAA;AAnFY,qCAAqC;IADjD,UAAU,EAAE;GACA,qCAAqC,CAmFjD"}
+{"version":3,"file":"reconciling-transfer-hydranium-glsp-state.js","sourceRoot":"","sources":["../../src/state/reconciling-transfer-hydranium-glsp-state.ts"],"names":[],"mappings":"AAAA;;;;;;;kFAOkF;;;;;;;AAGlF,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAGvC,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEI,IAAM,qCAAqC,GAA3C,MAAM,qCACV,SAAQ,0BAA+C;IAGvD;;;;;;OAMG;IACO,IAAI,CAAgB;IAE9B;;;;;;;OAOG;IACH,IAAI,WAAW;QACZ,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,CAA4B,CAAC;IACvH,CAAC;IAEQ,aAAa,CAAC,GAAW,EAAE,IAAW;QAC5C,KAAK,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC;IAChC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,iBAAiB,CAAC,KAAmB,EAAE,UAAmB,IAAI,CAAC,OAAO;QACzE,2EAA2E;QAC3E,wEAAwE;QACxE,oDAAoD;QACpD,OAAO,yBAAyB,CAAe,KAAK,EAAE,OAAO,EAAE;YAC5D,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,EAAE;gBAC5C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;gBACjE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YAC7C,CAAC;YACD,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE;YAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,iBAAiB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,iBAAiB,EAAE;SACnD,CAAC,CAAC;IACN,CAAC;IAED;;;;;;;OAOG;IACO,KAAK,CAAC,OAAO,CAAC,KAAmB,EAAE,OAAgB;QAC1D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QACnG,OAAO,QAAsC,CAAC;IACjD,CAAC;IAED;;;;;;OAMG;IACO,KAAK,CAAC,OAAO;QACpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC3D,OAAO,MAAM,CAAC,CAAC,CAAE,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,eAAe,CAAC,UAAU,CAAC,MAAM,EAAE,SAAS,CAA6B,CAAC,CAAC,CAAC,SAAS,CAAC;IACpI,CAAC;CACH,CAAA;AA/EY,qCAAqC;IADjD,UAAU,EAAE;GACA,qCAAqC,CA+EjD"}

package/lib/storage/hydranium-glsp-storage.d.ts

@@ -9,10 +9,60 @@
 import { type Action, ActionDispatcher, type ClientSession, type ClientSessionListener, ClientSessionManager, type DefaultCommandStack, type Disposable, Logger as GlspLogger, type MaybePromise, ModelValidator, type RequestModelAction, type SaveModelAction, type SourceModelStorage } from '@eclipse-glsp/server';
 import { Debouncer, DisposableCollection } from '@hydranium/protocol';
 import { type AstNode } from '@hydranium/langium';
-import { AstDocument, type AstDocumentSavedEvent, type AstDocumentUpdatedEvent, type ServerSharedServices } from '@hydranium/core';
+import { AstDocument, type AstDocumentSavedEvent, type AstDocumentUpdatedEvent, type ClientSession as ModelClientSession, type ServerSharedServices } from '@hydranium/core';
 import { type AbstractHydraniumGlspState } from '../state/abstract-hydranium-glsp-state.js';
 import { type HydraniumGlspSubmissionHandler } from '../submission/hydranium-glsp-submission-handler.js';
-import { SaveConflictPolicy } from './save-conflict-policy.js';
+import { SaveDeliveryPolicy } from './save-delivery-policy.js';
+/**
+ * A save action arrived with nowhere to write to. A save action carries no
+ * request id, so it falls through to the error handler and `message` becomes
+ * the toast text.
+ *
+ * Rendered at the raise site rather than by a carrier method, because GLSP's
+ * action protocol has no slot for an identity anywhere — every member of its
+ * message, status and reject actions is prose or an enum, and
+ * `MessageAction.details` is not a substitute since it is prose populated from
+ * `cause?.toString?.()`, and a Theia host shows it to a user on demand. So the
+ * throw is the last place that still knows which message this is.
+ */
+export declare const SAVE_TARGET_UNKNOWN: import("@hydranium/protocol").MessageDefinition<"Could not determine where to save this model">;
+/**
+ * A model request arrived without the source URI it is required to carry.
+ * Rendered at the raise site, like its save-path sibling and for the same
+ * reason.
+ */
+export declare const SOURCE_URI_MISSING: import("@hydranium/protocol").MessageDefinition<"Could not open this model: the request did not say which document to load">;
+/**
+ * Why the canvas has stopped accepting edits.
+ *
+ * **A READONLY canvas is otherwise indistinguishable from a broken one.** The
+ * client's answer to {@link SetEditModeAction} is to withdraw the tool palette,
+ * so the surface a reader was working in silently loses the only control it had,
+ * with the cause — a syntax error in a document that may not even be open —
+ * nowhere on screen. The mode flip is the mechanism; this is the only part of it
+ * a user can see.
+ *
+ * Rendered at the raise site, like its two siblings above and for the same
+ * reason: every member of GLSP's status action is prose or an enum.
+ *
+ * It names the recovery rather than the fault, because the fault already has a
+ * surface — the squiggle and the problems list, both of which say WHICH
+ * character — and repeating it here would put a second, less precise account of
+ * the same error on screen. What no other surface says is that the diagram is
+ * waiting on it.
+ */
+export declare const DIAGRAM_READONLY_PARSE_ERROR: import("@hydranium/protocol").MessageDefinition<"Read-only: this document has a syntax error. Fix it to edit the diagram again.">;
+/**
+ * The diagram's GLSP client id is still live as another participant's client
+ * id once the load has waited for it to free, so the diagram does not load.
+ *
+ * Rendered at the raise site, as {@link SAVE_TARGET_UNKNOWN} is and for the
+ * same reason, and dispatched to the client as a message of its own: a model
+ * request fails as a rejection whose detail is the English cause, which no user
+ * sees. It names the recovery: a host that numbers its diagram clients gives a
+ * reopened diagram a fresh id.
+ */
+export declare const DIAGRAM_SESSION_REFUSED: import("@hydranium/protocol").MessageDefinition<"Could not open this diagram: its identifier is still in use by another editor. Close the diagram and open it again.">;
 /**
  * GLSP source-model storage base shared by all hydranium adopters.
  * Provides the DI signature, the {@link ClientSessionListener} +
@@ -33,17 +83,24 @@ import { SaveConflictPolicy } from './save-conflict-policy.js';
  *
  * Adopters with richer needs override the seams ({@link isStructurallyBroken},
  * {@link onParseErrorChanged}, {@link onSourceModelSettled}) rather than the
- * whole flow, and select a {@link SaveConflictPolicy} via the bound option to
- * tune how {@link saveSourceModel} reacts to a concurrent edit.
+ * whole flow, and select a {@link SaveDeliveryPolicy} via the bound option to
+ * tune how {@link saveSourceModel} delivers its result.
+ *
+ * **One client session per GLSP client session.** `init` registers the GLSP
+ * client id as a client session ({@link registerModelSession}) and hands it to
+ * the state as `modelSession`. The primary is opened through it on load, and
+ * every document that joins the write set as it joins
+ * ({@link openSecondary}); a document that leaves the write set stays open
+ * until the next save, so leaving never reverts the diagram's unsaved edits to
+ * it. Disposing the storage ends the session, which closes everything it has
+ * open.
  *
- * **Default `saveSourceModel` flow.** Delegates to `ModelService.save`, which
- * serialises through the language-specific `Serializer` bound at
- * `services.serializer.Serializer` (resolved per-URI via `ServiceRegistry`),
- * updates the multi-client text-document store, drives a rebuild, and writes the
- * result via the `WritableFileSystemProvider`. The bound
- * {@link SaveConflictPolicy} (default {@link DEFAULT_SAVE_CONFLICT_POLICY},
- * `overwrite`) decides the based-on-version guard, await-vs-fire-and-forget, and
- * failure handling.
+ * **Default `saveSourceModel` flow.** Flushes the stored text of every
+ * document the diagram's session has open via `AstDocumentManager.save`, with
+ * no serializer in the path — the update path already put the settled text in
+ * the store. The bound {@link SaveDeliveryPolicy} (default
+ * {@link DEFAULT_SAVE_DELIVERY_POLICY}, `await`) decides
+ * await-vs-fire-and-forget and failure handling.
  *
  * **tempId filter.** GLSP's `DefaultGlobalActionProvider` spins up a
  * throwaway per-diagram-type container with upstream's {@link TEMPORARY_CLIENT_ID}
@@ -54,9 +111,9 @@ import { SaveConflictPolicy } from './save-conflict-policy.js';
  * **Lifecycle ordering.** `init` runs after DI resolution and parks the
  * secondary-write-set watch, which outlives any single load.
  * {@link sessionDisposed} calls {@link dispose}, which drains
- * {@link toDispose} idempotently. Every transient subscription created in
- * {@link doLoadSourceModel} is parked on {@link toDispose} so the drain catches
- * them on client-detach.
+ * {@link toDispose} idempotently and then ends the client session. Every
+ * transient subscription created in {@link doLoadSourceModel} is parked on
+ * {@link toDispose} so the drain catches them on client-detach.
  */
 export declare class HydraniumGlspStorage<TRoot extends AstNode, TSourceModel = string> implements SourceModelStorage, ClientSessionListener, Disposable {
     protected readonly logger: GlspLogger;
@@ -75,14 +132,13 @@ export declare class HydraniumGlspStorage<TRoot extends AstNode, TSourceModel =
      */
     protected readonly modelValidator?: ModelValidator;
     /**
-     * Selected {@link SaveConflictPolicy} for {@link saveSourceModel}. Bind the
-     * {@link SaveConflictPolicy} token in a `DiagramModule` to choose a policy;
-     * left unbound it resolves to {@link DEFAULT_SAVE_CONFLICT_POLICY}
-     * (`overwrite`, last-write-wins). Read via {@link saveConflictPolicy} so the
-     * fallback is applied even when inversify injects `undefined` for an unbound
-     * `@optional()` member.
+     * Selected {@link SaveDeliveryPolicy} for {@link saveSourceModel}. Bind the
+     * {@link SaveDeliveryPolicy} token in a `DiagramModule` to choose a policy;
+     * left unbound it resolves to {@link DEFAULT_SAVE_DELIVERY_POLICY}. Read via
+     * {@link saveDeliveryPolicy} so the fallback is applied even when inversify
+     * injects `undefined` for an unbound `@optional()` member.
      */
-    protected readonly boundSaveConflictPolicy?: SaveConflictPolicy;
+    protected readonly boundSaveDeliveryPolicy?: SaveDeliveryPolicy;
     /** Disposables created during {@link doLoadSourceModel}; drained on session disposal. */
     protected toDispose: DisposableCollection;
     /**
@@ -94,6 +150,22 @@ export declare class HydraniumGlspStorage<TRoot extends AstNode, TSourceModel =
      * with it rather than linger until the client detaches.
      */
     protected readonly secondarySubscriptions: Map<string, Disposable>;
+    /**
+     * Documents that left the write set since the last save. They stay open in
+     * the diagram's session until that save has persisted them, and are closed
+     * after it: closing a document as it leaves would revert the diagram's
+     * unsaved edits to it where the diagram was its last client.
+     */
+    protected readonly departedSecondaries: Set<string>;
+    /**
+     * How long a load waits for a client id another participant holds to free
+     * before refusing. A reloaded client can reconnect under its old id before
+     * the server has noticed the old connection close, which ends that
+     * connection's sessions a moment later.
+     */
+    protected readonly sessionWaitMs: number;
+    /** Set by {@link dispose}; a disposed storage registers no session again. */
+    protected disposed: boolean;
     /**
      * Whether an external resubmit has ever been dispatched. Gates the
      * keep-the-last-valid-GModel branch, which needs to know a canvas is already
@@ -111,8 +183,32 @@ export declare class HydraniumGlspStorage<TRoot extends AstNode, TSourceModel =
      */
     protected resubmitDebouncer: Debouncer;
     /** Latest event document awaiting the debounced resubmit; read by {@link flushResubmit} (last write wins). */
-    protected pendingResubmitDocument?: AstDocument<AstNode, unknown>;
+    protected pendingResubmitDocument?: AstDocument<AstNode>;
     protected init(): void;
+    /**
+     * Register the diagram's client session under the GLSP client id, or
+     * `undefined` when another participant holds that id, which is logged.
+     *
+     * The diagram then refuses to load ({@link requireModelSession}). Taking
+     * the id over would end the other participant's session under it, and
+     * working without a session would share that participant's opens and
+     * echoes, so its close would take the diagram's documents with it.
+     */
+    protected registerModelSession(): ModelClientSession<AstNode> | undefined;
+    /**
+     * The diagram's client session, registering it again when the id was held
+     * earlier. Throws `SessionClosedError` once the storage is disposed, and the
+     * refusal when the id is still held.
+     */
+    protected requireModelSession(): ModelClientSession<AstNode>;
+    /**
+     * {@link requireModelSession} for the load: while the id is held, wait up to
+     * {@link sessionWaitMs} for its holder to end before refusing, and tell the
+     * user when it does not.
+     */
+    protected awaitModelSession(): Promise<ModelClientSession<AstNode>>;
+    /** Resolve once the client session under `clientId` ends, or after `timeoutMs`. */
+    protected waitForSessionEnd(clientId: string, timeoutMs: number): Promise<void>;
     /**
      * Default load flow — {@link doLoadSourceModel}. Adopters whose load flow
      * needs more than the seams allow override this method.
@@ -120,12 +216,29 @@ export declare class HydraniumGlspStorage<TRoot extends AstNode, TSourceModel =
     loadSourceModel(action: RequestModelAction): MaybePromise<void>;
     protected doLoadSourceModel(action: RequestModelAction): Promise<void>;
     /**
-     * Capture the initial settled root and apply the initial edit mode. `settled()`
-     * strips diagnostics by phase contract, so the first edit mode is `EDITABLE`;
-     * the first {@link handleModelUpdated} (at `Validated`, with diagnostics) flips
-     * it READONLY if the document has structural parse errors. Edit-mode +
-     * settle-hook actions are dispatched on a macrotask so the initial
+     * Capture the initial settled root and apply the initial edit mode. Edit-mode
+     * + settle-hook actions are dispatched on a macrotask so the initial
      * `requestModel → setModel` handshake isn't perturbed.
+     *
+     * **Whether the settled document carries diagnostics depends on how far it
+     * had already got, so the initial edit mode has two correct outcomes rather
+     * than one.** `settled()` strips nothing: it resolves AT OR ABOVE the
+     * integrity landmark and hands back the live document's own array. Its
+     * `AstDocument<TAst, never>` return type asserts emptiness for a document the
+     * wait had to DRIVE to that landmark, which is pre-validation — and for that
+     * one the mode here is `EDITABLE` and the flip to READONLY arrives with the
+     * first {@link handleModelUpdated}. A document already past `Validated` when
+     * the session opened resolves immediately with its diagnostics intact, and is
+     * decided correctly here with no later update owed. Any host that validates
+     * its workspace before a diagram is opened produces the second case, so
+     * neither is exceptional.
+     *
+     * **A correct decision is not a delivered one.** This dispatch happens inside
+     * the initial `requestModel`, before the client has the model — so the UI
+     * extensions that answer {@link onParseErrorChanged}'s actions are not yet
+     * constructed, and a canvas that opens READONLY over a broken document shows
+     * none of that feedback. The same timer carries {@link onSourceModelSettled},
+     * so an adopter's own initial actions have it too.
      */
     protected captureSettledRoot(rootUri: string, document: AstDocument<AstNode, never>): Promise<void>;
     /**
@@ -146,6 +259,14 @@ export declare class HydraniumGlspStorage<TRoot extends AstNode, TSourceModel =
      * piece is a subscription, not an invalidation.
      */
     protected reconcileSecondarySubscriptions(): void;
+    /**
+     * Open a document that joined the write set through the diagram's session,
+     * where it stays open until the diagram's next save after it leaves the set,
+     * or the diagram's end. A document that does not exist yet is left to the
+     * write that creates it, and a failed open is logged: the write that needs
+     * the document opens it again and fails there.
+     */
+    protected openSecondary(uri: string): void;
     /**
      * React to a rebuild of a SECONDARY document by resubmitting the diagram, so
      * an external edit to (say) a layout file reaches the canvas.
@@ -171,18 +292,19 @@ export declare class HydraniumGlspStorage<TRoot extends AstNode, TSourceModel =
      * drag this client authors — the guard above gates the resubmit, not the
      * markers.
      */
-    protected handleSecondaryUpdated(uri: string, event: AstDocumentUpdatedEvent<AstNode, unknown>): void;
+    protected handleSecondaryUpdated(uri: string, event: AstDocumentUpdatedEvent<AstNode>): void;
     /**
      * The primary document's current state, or `undefined` when it is not
      * registered.
      *
      * Synchronous by construction — the phase-agnostic lookup door plus the shared
      * projection — so reacting to a secondary neither waits nor can force a build.
-     * `settled()` is not an alternative: it strips diagnostics by phase contract,
-     * and diagnostics are the reason {@link doUpdateAndSubmit} takes a separate
-     * event document at all.
+     * `settled()` is not an alternative: besides being asynchronous, it cannot be
+     * relied on to carry diagnostics — a document it has to drive to the landmark
+     * arrives pre-validation with an empty array — and diagnostics are the reason
+     * {@link doUpdateAndSubmit} takes a separate event document at all.
      */
-    protected currentPrimaryDocument(): AstDocument<AstNode, unknown> | undefined;
+    protected currentPrimaryDocument(): AstDocument<AstNode> | undefined;
     /**
      * React to an external rebuild reaching `Validated`. Self-cleans if the
      * session has vanished but this listener leaked (neither `sessionDisposed`
@@ -191,7 +313,7 @@ export declare class HydraniumGlspStorage<TRoot extends AstNode, TSourceModel =
      * diagnostic markers for every update — including own edits, which skip
      * the resubmit but can still change diagnostics.
      */
-    protected handleModelUpdated(rootUri: string, event: AstDocumentUpdatedEvent<AstNode, unknown>): Promise<void>;
+    protected handleModelUpdated(rootUri: string, event: AstDocumentUpdatedEvent<AstNode>): Promise<void>;
     /**
      * Whether this storage has outlived its session — disposing it as a side
      * effect when so. Checked from every subscription entry point because GLSP's
@@ -206,7 +328,7 @@ export declare class HydraniumGlspStorage<TRoot extends AstNode, TSourceModel =
      * {@link resubmitDebouncer}, so a burst of rebuilds runs
      * {@link doUpdateAndSubmit} once with the most recent document.
      */
-    protected scheduleUpdateAndSubmit(document: AstDocument<AstNode, unknown>): void;
+    protected scheduleUpdateAndSubmit(document: AstDocument<AstNode>): void;
     /**
      * Debouncer callback: run the resubmit for the latest pending document
      * against this storage's (invariant) source URI and dispatch the result.
@@ -218,20 +340,22 @@ export declare class HydraniumGlspStorage<TRoot extends AstNode, TSourceModel =
      * mark our stack clean so the editor doesn't prompt to re-save identical
      * content. Our own saves already settle the stack through the save flow.
      */
-    protected handleModelSaved(event: AstDocumentSavedEvent<AstNode, unknown>): void;
+    protected handleModelSaved(event: AstDocumentSavedEvent<AstNode>): void;
     /**
      * Re-settle to a guaranteed fully-linked + reprojected root, capture it, and
      * (unless suppressed) resubmit a deduped external GModel. Diagnostics for the
-     * edit-mode decision come from the event document (`settled()` strips them by
-     * phase contract).
+     * edit-mode decision come from the event document, because the re-settled one
+     * cannot be relied on to have any: a document driven to the landmark arrives
+     * pre-validation, and this path re-settles precisely to escape a transient
+     * mid-rebuild snapshot.
      */
-    protected doUpdateAndSubmit(rootUri: string, eventDocument: AstDocument<AstNode, unknown>): Promise<Action[]>;
+    protected doUpdateAndSubmit(rootUri: string, eventDocument: AstDocument<AstNode>): Promise<Action[]>;
     /**
      * Recompute the desired edit mode from the document's structural-error state,
      * flip {@link AbstractHydraniumGlspState.editMode}, and — only on a transition —
      * return the {@link onParseErrorChanged} actions. No transition → no actions.
      */
-    protected refreshEditMode(document: AstDocument<AstNode, unknown>): Action[];
+    protected refreshEditMode(document: AstDocument<AstNode>): Action[];
     /**
      * Seam: is the AST structurally broken (lexing/parsing errors)? Drives both
      * READONLY mode and the GModel resubmit skip — keeping the last valid canvas
@@ -239,46 +363,96 @@ export declare class HydraniumGlspStorage<TRoot extends AstNode, TSourceModel =
      * carrying a Langium `lexing-error` / `parsing-error` code. Adopters override
      * to compose additional break reasons.
      */
-    protected isStructurallyBroken(document: AstDocument<AstNode, unknown>): boolean;
+    protected isStructurallyBroken(document: AstDocument<AstNode>): boolean;
     /**
-     * Seam: actions to emit when the structural-broken state transitions. Default:
-     * a single {@link SetEditModeAction} toggling READONLY ↔ EDITABLE — editing is
-     * disabled while the syntax is broken but re-enabled once it parses, a sound
-     * generic for any Langium-backed diagram. Adopters override to add or replace
-     * the transition feedback. The {@link AbstractHydraniumGlspState.editMode}
-     * flip itself is owned by {@link refreshEditMode}.
+     * Seam: actions to emit when the structural-broken state transitions.
+     * Default: a {@link SetEditModeAction} toggling READONLY ↔ EDITABLE — editing
+     * is disabled while the syntax is broken but re-enabled once it parses, a
+     * sound generic for any Langium-backed diagram — plus the
+     * {@link DIAGRAM_READONLY_PARSE_ERROR} band that says why, cleared on the way
+     * back. Adopters override to add or replace the transition feedback. The
+     * {@link AbstractHydraniumGlspState.editMode} flip itself is owned by
+     * {@link refreshEditMode}.
+     *
+     * **Both actions or neither, which is why they are one seam rather than
+     * two.** The mode flip removes the tool palette and the band is the only
+     * account of that, so an override that keeps one and drops the other produces
+     * either an unexplained loss of the palette or a warning about a restriction
+     * that is not in force.
+     *
+     * **The status is dispatched with no `timeout`, so it persists** — a
+     * time-limited band would describe a condition that outlasts it.
+     *
+     * **The slot is SHARED, and the other writer wins on one path.**
+     * `ModelSubmissionHandler`'s live validation writes the same slot, clearing
+     * it with `severity: 'NONE'` when it finishes, and an adopter dispatching its
+     * own `StatusAction` replaces this one too. Nothing re-asserts it. That is
+     * harmless while a document is being edited, because a resubmit is skipped
+     * once the AST is broken (see {@link doUpdateAndSubmit}) — but NOT at load:
+     * the initial `requestModel` submit is not that skipped path, so a diagram
+     * opened on an already-broken document shows this band and then loses it to
+     * the validation clear a moment later. Measured on a browser host, polling the
+     * overlay: no element, empty, the sentence, empty again.
      */
-    protected onParseErrorChanged(_document: AstDocument<AstNode, unknown>, broken: boolean): Action[];
+    protected onParseErrorChanged(_document: AstDocument<AstNode>, broken: boolean): Action[];
     /**
      * Seam: extra actions to dispatch right after the initial settled root is
      * captured (e.g. an adopter-specific status or palette refresh). Default: none.
      */
     protected onSourceModelSettled(_document: AstDocument<AstNode, never>): Action[];
-    /** The effective {@link SaveConflictPolicy}: the bound option, or {@link DEFAULT_SAVE_CONFLICT_POLICY} when unbound. */
-    protected get saveConflictPolicy(): SaveConflictPolicy;
-    /**
-     * Default save flow: route through `ModelService.save`. The framework
-     * serialise-and-persist machinery handles serialisation (via the
-     * language-specific `Serializer` bound at `services.serializer.Serializer`),
-     * the multi-client text-document update, the rebuild, and the eventual
-     * `WritableFileSystemProvider.writeFile`.
+    /** The effective {@link SaveDeliveryPolicy}: the bound option, or {@link DEFAULT_SAVE_DELIVERY_POLICY} when unbound. */
+    protected get saveDeliveryPolicy(): SaveDeliveryPolicy;
+    /**
+     * Default save flow: persist the store's current text for every document the
+     * diagram's session has open.
+     *
+     * **A save persists, it does not author.** Every diagram gesture already
+     * reached the store through the diagram's session, so the store holds the
+     * settled text and disk is the only thing behind. Re-serializing from the AST
+     * here cannot improve on that text and can only damage it: a serializer
+     * normalises formatting, and the comments the write path carries over keep
+     * none of the hand-formatting around them, so a save would reflow a document
+     * nothing changed — which is what a pure bounds drag does to the semantic
+     * file when only its layout moved.
+     *
+     * **What is saved is the primary, every tracked secondary
+     * (`AbstractHydraniumGlspState.trackSecondaryDocument`) and every document
+     * that left the write set since the last save**, so a document the diagram
+     * wrote is persisted whether or not it is the one the client named. One the
+     * diagram's session does not have open is skipped, even when another client
+     * has it open: that client's unsaved edits are not the diagram's to persist.
+     *
+     * **A save therefore names documents the gesture did not aim at**, which is
+     * why an unchanged one is not rewritten even though the user asked for a
+     * save: the mtime would move on a file they never touched.
+     * `AstDocumentManager.save` decides that per document and announces the save
+     * either way.
      *
-     * The configured {@link SaveConflictPolicy} (see {@link saveConflictPolicy})
-     * decides how a concurrent edit that advanced the document is handled:
-     * - `overwrite` (default): no based-on guard, await, propagate failures —
-     *   last-write-wins, correct for a single-editor head.
-     * - `reject`: guard on the captured `state.version`, await, surface a
-     *   `ConflictError` (and any other failure) to the GLSP save action.
-     * - `drop-and-log`: guard, fire-and-forget, log + swallow failures — a stale
-     *   diagram save is dropped because a concurrent form/code edit already wrote
-     *   the truth, and GLSP exposes no save-failure back-channel.
+     * The configured {@link SaveDeliveryPolicy} (see {@link saveDeliveryPolicy})
+     * decides await-vs-fire-and-forget and failure handling. It carries no
+     * based-on guard: the guard exists to stop a stale writer overwriting a newer
+     * document, and a flush persists the store — which already holds every other
+     * client's change, including the one that advanced the version.
      *
      * Returns `MaybePromise<void>` to match upstream `SourceModelStorage`:
-     * resolves with the persist under `overwrite`/`reject`, returns synchronously
-     * under `drop-and-log`. Adopters that bypass `ModelService` (writing through
-     * `WritableFileSystemProvider` directly) still override the whole method.
+     * resolves with the flush under `await`, returns synchronously under
+     * `fire-and-forget`. Adopters that bypass `AstDocumentManager` (writing
+     * through `WritableFileSystemProvider` directly) still override the whole
+     * method.
      */
     saveSourceModel(action: SaveModelAction): MaybePromise<void>;
+    /**
+     * Save the stored text of `primaryUri`, every tracked secondary and every
+     * document that left the write set since the last save, each only where
+     * the diagram's session has it open; then close those that left.
+     *
+     * Deduplicated, because a state that tracks its own primary as a secondary
+     * would otherwise save it twice and fire two save notifications for one
+     * save. Every save is called in one synchronous step, so each takes its text
+     * before anything can close a document of the set: saved one after another,
+     * a GLSP session ending during the first write closes the rest unsaved.
+     */
+    protected flushWriteSet(primaryUri: string): Promise<void>;
     /**
      * Normalise GLSP's `sourceUri` — which may be a filesystem PATH or a URI
      * string — to the URI string the workspace keys documents by.
@@ -305,6 +479,17 @@ export declare class HydraniumGlspStorage<TRoot extends AstNode, TSourceModel =
      *
      * Returns it VERBATIM, in whatever form the client sent;
      * {@link toSourceModelUri} is what normalises it.
+     *
+     * A model request DOES carry a request id, so a throw here takes the
+     * client-request path rather than the toast path — and on that path `detail`
+     * comes from `cause?.toString?.()`. A single-argument throw therefore reaches
+     * neither the server log nor the client console: both print `undefined`. So
+     * the two readers are addressed separately, as on the save path: `message`
+     * names what failed in the user's terms and is rendered, `cause` names the
+     * action and the option key that was missing and stays English. On THIS path
+     * the cause reaches only logs — `RejectAction.detail` is read by nothing but
+     * the client action-dispatcher's `logger.warn` — which is not what makes it
+     * English; its content is.
      */
     protected getSourceUri(action: RequestModelAction): string;
     /**
@@ -314,12 +499,18 @@ export declare class HydraniumGlspStorage<TRoot extends AstNode, TSourceModel =
      * {@link AbstractHydraniumGlspState.setSourceRoot}.
      *
      * A save action carries no request id, so a throw here reaches the user as a
-     * toast built from `message`, with `cause` behind its details control. The
-     * two therefore address different readers and must not be collapsed: the
-     * message names what failed in the user's terms, and the cause names which
-     * lookups came back empty for whom. Neither can name the URI — not having
-     * one IS the failure, and both sources are written together, so the typed
-     * `sourceUri` is equally empty whenever this fires.
+     * toast built from `message`, while `cause` travels in
+     * `MessageAction.details` — **which a Theia host DOES put in front of a
+     * user**, as a "Show details" button on the toast opening a dialog. So the
+     * two are not split by reachability; they are split by AUDIENCE, which is
+     * the older rule and the one that holds here. The message names what failed
+     * in the user's terms and is rendered; the cause names which lookups came
+     * back empty for whom, and stays English because a wire action kind, an
+     * option key and a client id address whoever composes the system — a
+     * translated developer string is a worse outcome than an untranslated one.
+     * Neither can name the URI — not having one IS the failure, and both sources
+     * are written together, so the typed `sourceUri` is equally empty whenever
+     * this fires.
      */
     protected getFileUri(action: SaveModelAction): string;
     /**
@@ -338,10 +529,14 @@ export declare class HydraniumGlspStorage<TRoot extends AstNode, TSourceModel =
     refreshDiagnosticMarkers(): Promise<void>;
     sessionDisposed(_clientSession: ClientSession): void;
     /**
-     * Cancel any pending resubmit and drain every subscription — those registered
+     * Cancel any pending resubmit, drain every subscription — those registered
      * during {@link doLoadSourceModel} and the per-secondary ones, which live
-     * outside {@link toDispose} because they come and go with the write set.
+     * outside {@link toDispose} because they come and go with the write set —
+     * and end the diagram's client session, closing everything it has open.
      * Idempotent.
+     *
+     * The session ends last, once the detach listener is gone: its closes would
+     * otherwise report this storage's own teardown as a client detaching.
      */
     dispose(): void;
 }