@hydranium/glsp-server 1.0.0-next.13 → 1.0.0-next.132

package/lib/storage/hydranium-glsp-storage.js

@@ -15,15 +15,65 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-import { MarkersReason, SetMarkersAction } from '@eclipse-glsp/protocol';
-import { ActionDispatcher, ClientSessionManager, CommandStack, EditMode, GLSPServerError, Logger as GlspLogger, ModelState, ModelSubmissionHandler, ModelValidator, SOURCE_URI_ARG, SetEditModeAction, TEMPORARY_CLIENT_ID } from '@eclipse-glsp/server';
-import { Debouncer, DisposableCollection } from '@hydranium/protocol';
+import { MarkersReason, MessageAction, SetMarkersAction, StatusAction } from '@eclipse-glsp/protocol';
+import { ActionDispatcher, ClientSessionManager, CommandStack, EditMode, GLSPServerError, Logger as GlspLogger, ModelState, ModelSubmissionHandler, ModelValidator, SOURCE_URI_ARG, SetDirtyStateAction, SetEditModeAction, TEMPORARY_CLIENT_ID } from '@eclipse-glsp/server';
+import { Debouncer, defineMessage, DisposableCollection, isDuplicateClientIdError, isSessionClosedError, SessionClosedError } from '@hydranium/protocol';
 import { inject, injectable, optional, postConstruct } from 'inversify';
 import { URI } from '@hydranium/langium';
 import { AstDocument } from '@hydranium/core';
 import { DiagnosticSeverity } from 'vscode-languageserver-types';
 import { HydraniumTypes } from '../state/hydranium-shared-core-services.js';
-import { DEFAULT_SAVE_CONFLICT_POLICY, SaveConflictPolicy } from './save-conflict-policy.js';
+import { DEFAULT_SAVE_DELIVERY_POLICY, SaveDeliveryPolicy } from './save-delivery-policy.js';
+/**
+ * A save action arrived with nowhere to write to. A save action carries no
+ * request id, so it falls through to the error handler and `message` becomes
+ * the toast text.
+ *
+ * Rendered at the raise site rather than by a carrier method, because GLSP's
+ * action protocol has no slot for an identity anywhere — every member of its
+ * message, status and reject actions is prose or an enum, and
+ * `MessageAction.details` is not a substitute since it is prose populated from
+ * `cause?.toString?.()`, and a Theia host shows it to a user on demand. So the
+ * throw is the last place that still knows which message this is.
+ */
+export const SAVE_TARGET_UNKNOWN = defineMessage('hydranium/glsp-server/save-target-unknown', 'Could not determine where to save this model');
+/**
+ * A model request arrived without the source URI it is required to carry.
+ * Rendered at the raise site, like its save-path sibling and for the same
+ * reason.
+ */
+export const SOURCE_URI_MISSING = defineMessage('hydranium/glsp-server/source-uri-missing', 'Could not open this model: the request did not say which document to load');
+/**
+ * Why the canvas has stopped accepting edits.
+ *
+ * **A READONLY canvas is otherwise indistinguishable from a broken one.** The
+ * client's answer to {@link SetEditModeAction} is to withdraw the tool palette,
+ * so the surface a reader was working in silently loses the only control it had,
+ * with the cause — a syntax error in a document that may not even be open —
+ * nowhere on screen. The mode flip is the mechanism; this is the only part of it
+ * a user can see.
+ *
+ * Rendered at the raise site, like its two siblings above and for the same
+ * reason: every member of GLSP's status action is prose or an enum.
+ *
+ * It names the recovery rather than the fault, because the fault already has a
+ * surface — the squiggle and the problems list, both of which say WHICH
+ * character — and repeating it here would put a second, less precise account of
+ * the same error on screen. What no other surface says is that the diagram is
+ * waiting on it.
+ */
+export const DIAGRAM_READONLY_PARSE_ERROR = defineMessage('hydranium/glsp-server/diagram-readonly-parse-error', 'Read-only: this document has a syntax error. Fix it to edit the diagram again.');
+/**
+ * The diagram's GLSP client id is still live as another participant's client
+ * id once the load has waited for it to free, so the diagram does not load.
+ *
+ * Rendered at the raise site, as {@link SAVE_TARGET_UNKNOWN} is and for the
+ * same reason, and dispatched to the client as a message of its own: a model
+ * request fails as a rejection whose detail is the English cause, which no user
+ * sees. It names the recovery: a host that numbers its diagram clients gives a
+ * reopened diagram a fresh id.
+ */
+export const DIAGRAM_SESSION_REFUSED = defineMessage('hydranium/glsp-server/diagram-session-refused', 'Could not open this diagram: its identifier is still in use by another editor. Close the diagram and open it again.');
 /** Window (ms) over which back-to-back external rebuilds collapse into one resubmit. */
 const EXTERNAL_SUBMIT_DEBOUNCE_MS = 250;
 /**
@@ -69,17 +119,24 @@ function isStructuralDiagnostic(diagnostic) {
  *
  * Adopters with richer needs override the seams ({@link isStructurallyBroken},
  * {@link onParseErrorChanged}, {@link onSourceModelSettled}) rather than the
- * whole flow, and select a {@link SaveConflictPolicy} via the bound option to
- * tune how {@link saveSourceModel} reacts to a concurrent edit.
+ * whole flow, and select a {@link SaveDeliveryPolicy} via the bound option to
+ * tune how {@link saveSourceModel} delivers its result.
  *
- * **Default `saveSourceModel` flow.** Delegates to `ModelService.save`, which
- * serialises through the language-specific `Serializer` bound at
- * `services.serializer.Serializer` (resolved per-URI via `ServiceRegistry`),
- * updates the multi-client text-document store, drives a rebuild, and writes the
- * result via the `WritableFileSystemProvider`. The bound
- * {@link SaveConflictPolicy} (default {@link DEFAULT_SAVE_CONFLICT_POLICY},
- * `overwrite`) decides the based-on-version guard, await-vs-fire-and-forget, and
- * failure handling.
+ * **One client session per GLSP client session.** `init` registers the GLSP
+ * client id as a client session ({@link registerModelSession}) and hands it to
+ * the state as `modelSession`. The primary is opened through it on load, and
+ * every document that joins the write set as it joins
+ * ({@link openSecondary}); a document that leaves the write set stays open
+ * until the next save, so leaving never reverts the diagram's unsaved edits to
+ * it. Disposing the storage ends the session, which closes everything it has
+ * open.
+ *
+ * **Default `saveSourceModel` flow.** Flushes the stored text of every
+ * document the diagram's session has open via `AstDocumentManager.save`, with
+ * no serializer in the path — the update path already put the settled text in
+ * the store. The bound {@link SaveDeliveryPolicy} (default
+ * {@link DEFAULT_SAVE_DELIVERY_POLICY}, `await`) decides
+ * await-vs-fire-and-forget and failure handling.
  *
  * **tempId filter.** GLSP's `DefaultGlobalActionProvider` spins up a
  * throwaway per-diagram-type container with upstream's {@link TEMPORARY_CLIENT_ID}
@@ -90,9 +147,9 @@ function isStructuralDiagnostic(diagnostic) {
  * **Lifecycle ordering.** `init` runs after DI resolution and parks the
  * secondary-write-set watch, which outlives any single load.
  * {@link sessionDisposed} calls {@link dispose}, which drains
- * {@link toDispose} idempotently. Every transient subscription created in
- * {@link doLoadSourceModel} is parked on {@link toDispose} so the drain catches
- * them on client-detach.
+ * {@link toDispose} idempotently and then ends the client session. Every
+ * transient subscription created in {@link doLoadSourceModel} is parked on
+ * {@link toDispose} so the drain catches them on client-detach.
  */
 let HydraniumGlspStorage = class HydraniumGlspStorage {
     logger;
@@ -111,14 +168,13 @@ let HydraniumGlspStorage = class HydraniumGlspStorage {
      */
     modelValidator;
     /**
-     * Selected {@link SaveConflictPolicy} for {@link saveSourceModel}. Bind the
-     * {@link SaveConflictPolicy} token in a `DiagramModule` to choose a policy;
-     * left unbound it resolves to {@link DEFAULT_SAVE_CONFLICT_POLICY}
-     * (`overwrite`, last-write-wins). Read via {@link saveConflictPolicy} so the
-     * fallback is applied even when inversify injects `undefined` for an unbound
-     * `@optional()` member.
+     * Selected {@link SaveDeliveryPolicy} for {@link saveSourceModel}. Bind the
+     * {@link SaveDeliveryPolicy} token in a `DiagramModule` to choose a policy;
+     * left unbound it resolves to {@link DEFAULT_SAVE_DELIVERY_POLICY}. Read via
+     * {@link saveDeliveryPolicy} so the fallback is applied even when inversify
+     * injects `undefined` for an unbound `@optional()` member.
      */
-    boundSaveConflictPolicy;
+    boundSaveDeliveryPolicy;
     /** Disposables created during {@link doLoadSourceModel}; drained on session disposal. */
     toDispose = new DisposableCollection();
     /**
@@ -130,6 +186,24 @@ let HydraniumGlspStorage = class HydraniumGlspStorage {
      * with it rather than linger until the client detaches.
      */
     secondarySubscriptions = new Map();
+    /**
+     * Documents that left the write set since the last save. They stay open in
+     * the diagram's session until that save has persisted them, and are closed
+     * after it: closing a document as it leaves would revert the diagram's
+     * unsaved edits to it where the diagram was its last client.
+     */
+    departedSecondaries = new Set();
+    /**
+     * How long a load waits for a client id another participant holds to free
+     * before refusing. A reloaded client can reconnect under its old id before
+     * the server has noticed the old connection close, which ends that
+     * connection's sessions a moment later.
+     */
+    sessionWaitMs = 2_000;
+    /** Set by {@link dispose}; a disposed storage registers no session again. */
+    disposed = false;
+    /** Saves of the diagram's own that GLSP's save handler awaits; see {@link handleDirtyChanged}. */
+    ownSavesPending = 0;
     /**
      * Whether an external resubmit has ever been dispatched. Gates the
      * keep-the-last-valid-GModel branch, which needs to know a canvas is already
@@ -155,6 +229,7 @@ let HydraniumGlspStorage = class HydraniumGlspStorage {
         if (this.state.clientId === TEMPORARY_CLIENT_ID) {
             return;
         }
+        this.state.modelSession = this.registerModelSession();
         this.sessionManager.addListener(this, this.state.clientId);
         // Watched for this storage's whole lifetime rather than per load. The load
         // flow is a documented override point, so a subscription parked there would
@@ -162,6 +237,88 @@ let HydraniumGlspStorage = class HydraniumGlspStorage {
         // run long after any load.
         this.toDispose.push(this.state.onSecondaryUrisChanged(() => this.reconcileSecondarySubscriptions()));
     }
+    /**
+     * Register the diagram's client session under the GLSP client id, or
+     * `undefined` when another participant holds that id, which is logged.
+     *
+     * The diagram then refuses to load ({@link requireModelSession}). Taking
+     * the id over would end the other participant's session under it, and
+     * working without a session would share that participant's opens and
+     * echoes, so its close would take the diagram's documents with it.
+     */
+    registerModelSession() {
+        try {
+            return this.sharedServices.model.ModelService.createSession('diagram', this.state.clientId);
+        }
+        catch (error) {
+            if (!isDuplicateClientIdError(error)) {
+                throw error;
+            }
+            this.logger.warn(`Client id ${this.state.clientId} is held by another participant: this diagram has no session yet`);
+            return undefined;
+        }
+    }
+    /**
+     * The diagram's client session, registering it again when the id was held
+     * earlier. Throws `SessionClosedError` once the storage is disposed, and the
+     * refusal when the id is still held.
+     */
+    requireModelSession() {
+        if (this.disposed) {
+            throw new SessionClosedError(this.state.clientId, 'The diagram has closed; its client session has ended.');
+        }
+        if (!this.state.modelSession) {
+            this.state.modelSession = this.registerModelSession();
+        }
+        const session = this.state.modelSession;
+        if (!session) {
+            throw new GLSPServerError(this.sharedServices.MessageRenderer.renderMessage(DIAGRAM_SESSION_REFUSED), `clientId=${this.state.clientId} is still held by another participant, so this diagram has no client session`);
+        }
+        return session;
+    }
+    /**
+     * {@link requireModelSession} for the load: while the id is held, wait up to
+     * {@link sessionWaitMs} for its holder to end before refusing, and tell the
+     * user when it does not.
+     */
+    async awaitModelSession() {
+        if (!this.state.modelSession && !this.disposed) {
+            this.state.modelSession = this.registerModelSession();
+        }
+        if (!this.state.modelSession && !this.disposed) {
+            await this.waitForSessionEnd(this.state.clientId, this.sessionWaitMs);
+        }
+        try {
+            return this.requireModelSession();
+        }
+        catch (error) {
+            // A diagram closed while it waited has no client left to tell.
+            if (isSessionClosedError(error)) {
+                throw error;
+            }
+            this.logger.error(`Client id ${this.state.clientId} is still held by another participant: this diagram does not load`);
+            this.actionDispatcher
+                .dispatch(MessageAction.create(this.sharedServices.MessageRenderer.renderMessage(DIAGRAM_SESSION_REFUSED), { severity: 'ERROR' }))
+                .catch((dispatchError) => this.logger.warn(`Could not tell the client the diagram was refused: ${String(dispatchError)}`));
+            throw error;
+        }
+    }
+    /** Resolve once the client session under `clientId` ends, or after `timeoutMs`. */
+    waitForSessionEnd(clientId, timeoutMs) {
+        return new Promise(resolve => {
+            const subscriptions = new DisposableCollection();
+            const done = () => {
+                subscriptions.dispose();
+                resolve();
+            };
+            subscriptions.push(this.sharedServices.Clock.setTimer(done, timeoutMs));
+            subscriptions.push(this.sharedServices.workspace.TextDocuments.onDidCloseSession(event => {
+                if (event.clientId === clientId) {
+                    done();
+                }
+            }));
+        });
+    }
     /**
      * Default load flow — {@link doLoadSourceModel}. Adopters whose load flow
      * needs more than the seams allow override this method.
@@ -175,8 +332,8 @@ let HydraniumGlspStorage = class HydraniumGlspStorage {
         const modelService = this.sharedServices.model.ModelService;
         // Open FIRST: a workspace-scanned-but-never-didOpened document rebuilds here,
         // so the capture below settles on a built root rather than a transient
-        // mid-rebuild one.
-        this.toDispose.push(await modelService.open({ uri: rootUri, clientId: this.state.clientId }));
+        // mid-rebuild one. Closed when the session ends.
+        await (await this.awaitModelSession()).open(rootUri);
         // GLSP's sessionDisposed is unreliable on Theia tab-close; dispose on client
         // detach so reopens don't accumulate stale onModelUpdated listeners.
         this.toDispose.push(modelService.onClientClosed(rootUri, this.state.clientId, () => {
@@ -185,19 +342,38 @@ let HydraniumGlspStorage = class HydraniumGlspStorage {
         }));
         // React to external rebuilds: settle-gated capture + debounced/deduped resubmit.
         this.toDispose.push(modelService.onModelUpdated(rootUri, event => this.handleModelUpdated(rootUri, event)));
-        // Coordinate the command stack's dirty state when another client saves.
+        // GLSP's own command stack counts commands; tell it of another client's save.
         this.toDispose.push(modelService.onModelSaved(rootUri, event => this.handleModelSaved(event)));
+        // Tell the client of each dirty flip, one the diagram did not cause included.
+        this.toDispose.push(this.sharedServices.workspace.TextDocuments.onDidChangeDirty(event => this.handleDirtyChanged(event)));
         // Capture the initial settled root.
         const document = await modelService.settled(rootUri);
         await this.captureSettledRoot(rootUri, document);
     }
     /**
-     * Capture the initial settled root and apply the initial edit mode. `settled()`
-     * strips diagnostics by phase contract, so the first edit mode is `EDITABLE`;
-     * the first {@link handleModelUpdated} (at `Validated`, with diagnostics) flips
-     * it READONLY if the document has structural parse errors. Edit-mode +
-     * settle-hook actions are dispatched on a macrotask so the initial
+     * Capture the initial settled root and apply the initial edit mode. Edit-mode
+     * + settle-hook actions are dispatched on a macrotask so the initial
      * `requestModel → setModel` handshake isn't perturbed.
+     *
+     * **Whether the settled document carries diagnostics depends on how far it
+     * had already got, so the initial edit mode has two correct outcomes rather
+     * than one.** `settled()` strips nothing: it resolves AT OR ABOVE the
+     * integrity landmark and hands back the live document's own array. Its
+     * `AstDocument<TAst, never>` return type asserts emptiness for a document the
+     * wait had to DRIVE to that landmark, which is pre-validation — and for that
+     * one the mode here is `EDITABLE` and the flip to READONLY arrives with the
+     * first {@link handleModelUpdated}. A document already past `Validated` when
+     * the session opened resolves immediately with its diagnostics intact, and is
+     * decided correctly here with no later update owed. Any host that validates
+     * its workspace before a diagram is opened produces the second case, so
+     * neither is exceptional.
+     *
+     * **A correct decision is not a delivered one.** This dispatch happens inside
+     * the initial `requestModel`, before the client has the model — so the UI
+     * extensions that answer {@link onParseErrorChanged}'s actions are not yet
+     * constructed, and a canvas that opens READONLY over a broken document shows
+     * none of that feedback. The same timer carries {@link onSourceModelSettled},
+     * so an adopter's own initial actions have it too.
      */
     async captureSettledRoot(rootUri, document) {
         this.state.setSourceRoot(rootUri, document.root);
@@ -231,14 +407,40 @@ let HydraniumGlspStorage = class HydraniumGlspStorage {
             if (!current.has(uri)) {
                 subscription.dispose();
                 this.secondarySubscriptions.delete(uri);
+                this.departedSecondaries.add(uri);
             }
         }
         for (const uri of current) {
             if (!this.secondarySubscriptions.has(uri)) {
+                this.departedSecondaries.delete(uri);
                 this.secondarySubscriptions.set(uri, this.sharedServices.model.ModelService.onModelUpdated(uri, event => this.handleSecondaryUpdated(uri, event)));
+                this.openSecondary(uri);
             }
         }
     }
+    /**
+     * Open a document that joined the write set through the diagram's session,
+     * where it stays open until the diagram's next save after it leaves the set,
+     * or the diagram's end. A document that does not exist yet is left to the
+     * write that creates it, and a failed open is logged: the write that needs
+     * the document opens it again and fails there.
+     */
+    openSecondary(uri) {
+        const session = this.state.modelSession;
+        if (!session || !this.sharedServices.model.ModelService.getDocument(uri)) {
+            return;
+        }
+        session.open(uri).catch((error) => {
+            const detail = `Could not open ${uri} for ${this.state.clientId}: ${error instanceof Error ? error.message : String(error)}`;
+            // A session ending while the open reads is the diagram closing.
+            if (isSessionClosedError(error)) {
+                this.logger.debug(detail);
+            }
+            else {
+                this.logger.warn(detail);
+            }
+        });
+    }
     /**
      * React to a rebuild of a SECONDARY document by resubmitting the diagram, so
      * an external edit to (say) a layout file reaches the canvas.
@@ -284,9 +486,10 @@ let HydraniumGlspStorage = class HydraniumGlspStorage {
      *
      * Synchronous by construction — the phase-agnostic lookup door plus the shared
      * projection — so reacting to a secondary neither waits nor can force a build.
-     * `settled()` is not an alternative: it strips diagnostics by phase contract,
-     * and diagnostics are the reason {@link doUpdateAndSubmit} takes a separate
-     * event document at all.
+     * `settled()` is not an alternative: besides being asynchronous, it cannot be
+     * relied on to carry diagnostics — a document it has to drive to the landmark
+     * arrives pre-validation with an empty array — and diagnostics are the reason
+     * {@link doUpdateAndSubmit} takes a separate event document at all.
      */
     currentPrimaryDocument() {
         const document = this.sharedServices.model.ModelService.getDocument(this.state.sourceUri);
@@ -348,20 +551,50 @@ let HydraniumGlspStorage = class HydraniumGlspStorage {
         this.doUpdateAndSubmit(rootUri, document).then(actions => this.actionDispatcher.dispatchAll(actions), error => this.logger.error(`Update-and-submit failed for ${rootUri}: ${error instanceof Error ? error.message : String(error)}`));
     }
     /**
-     * Coordinate the command stack when another client persists the document:
-     * mark our stack clean so the editor doesn't prompt to re-save identical
-     * content. Our own saves already settle the stack through the save flow.
+     * For a diagram module on GLSP's own command stack, which counts commands:
+     * mark it clean when another client persists the document.
+     * `HydraniumGlspCommandStack` reads the text store instead, and this does
+     * not move it.
      */
     handleModelSaved(event) {
         if (this.state.clientId !== event.sourceClientId) {
             this.commandStack.saveIsDone();
         }
     }
+    /**
+     * Send the diagram's dirty state when a document it has open turns dirty or
+     * clean, the answer being the command stack's. GLSP sends it only with a
+     * model submission or a save of the diagram's own, so a save by another
+     * client, an editor included, or an edit that changes nothing the diagram
+     * shows would otherwise leave the client's marker wrong until the next
+     * gesture. A flip the diagram's own operation causes is sent twice, once
+     * here and once with the submission, and the client keeps the one state.
+     *
+     * Nothing is sent while a save of the diagram's own is awaited: GLSP's save
+     * handler sends the state once the save settles, reason `save`, and GLSP's
+     * client keeps a state only when it changes, so the save's own flip sent
+     * here first would leave that answer changing nothing. GLSP's saveable
+     * waits for exactly that answer, and times out without it.
+     */
+    handleDirtyChanged(event) {
+        if (this.ownSavesPending > 0 || !this.sharedServices.workspace.TextDocuments.isOpenInClient(event.uri, this.state.clientId)) {
+            return;
+        }
+        this.sendDirtyState();
+    }
+    /** Send the command stack's dirty state, reason `external`. */
+    sendDirtyState() {
+        this.actionDispatcher
+            .dispatch(SetDirtyStateAction.create(this.commandStack.isDirty, { reason: 'external' }))
+            .catch((error) => this.logger.warn(`Could not send the dirty state of ${this.state.sourceUri}: ${String(error)}`));
+    }
     /**
      * Re-settle to a guaranteed fully-linked + reprojected root, capture it, and
      * (unless suppressed) resubmit a deduped external GModel. Diagnostics for the
-     * edit-mode decision come from the event document (`settled()` strips them by
-     * phase contract).
+     * edit-mode decision come from the event document, because the re-settled one
+     * cannot be relied on to have any: a document driven to the landmark arrives
+     * pre-validation, and this path re-settles precisely to escape a transient
+     * mid-rebuild snapshot.
      */
     async doUpdateAndSubmit(rootUri, eventDocument) {
         // Settle-gate the capture: never setSourceRoot off the event's possibly-transient
@@ -419,15 +652,48 @@ let HydraniumGlspStorage = class HydraniumGlspStorage {
         return document.diagnostics.some(diagnostic => isStructuralDiagnostic(diagnostic));
     }
     /**
-     * Seam: actions to emit when the structural-broken state transitions. Default:
-     * a single {@link SetEditModeAction} toggling READONLY ↔ EDITABLE — editing is
-     * disabled while the syntax is broken but re-enabled once it parses, a sound
-     * generic for any Langium-backed diagram. Adopters override to add or replace
-     * the transition feedback. The {@link AbstractHydraniumGlspState.editMode}
-     * flip itself is owned by {@link refreshEditMode}.
+     * Seam: actions to emit when the structural-broken state transitions.
+     * Default: a {@link SetEditModeAction} toggling READONLY ↔ EDITABLE — editing
+     * is disabled while the syntax is broken but re-enabled once it parses, a
+     * sound generic for any Langium-backed diagram — plus the
+     * {@link DIAGRAM_READONLY_PARSE_ERROR} band that says why, cleared on the way
+     * back. Adopters override to add or replace the transition feedback. The
+     * {@link AbstractHydraniumGlspState.editMode} flip itself is owned by
+     * {@link refreshEditMode}.
+     *
+     * **Both actions or neither, which is why they are one seam rather than
+     * two.** The mode flip removes the tool palette and the band is the only
+     * account of that, so an override that keeps one and drops the other produces
+     * either an unexplained loss of the palette or a warning about a restriction
+     * that is not in force.
+     *
+     * **The status is dispatched with no `timeout`, so it persists** — a
+     * time-limited band would describe a condition that outlasts it.
+     *
+     * **The slot is SHARED, and the other writer wins on one path.**
+     * `ModelSubmissionHandler`'s live validation writes the same slot, clearing
+     * it with `severity: 'NONE'` when it finishes, and an adopter dispatching its
+     * own `StatusAction` replaces this one too. Nothing re-asserts it. That is
+     * harmless while a document is being edited, because a resubmit is skipped
+     * once the AST is broken (see {@link doUpdateAndSubmit}) — but NOT at load:
+     * the initial `requestModel` submit is not that skipped path, so a diagram
+     * opened on an already-broken document shows this band and then loses it to
+     * the validation clear a moment later. Measured on a browser host, polling the
+     * overlay: no element, empty, the sentence, empty again.
      */
     onParseErrorChanged(_document, broken) {
-        return [SetEditModeAction.create(broken ? EditMode.READONLY : EditMode.EDITABLE)];
+        return [
+            SetEditModeAction.create(broken ? EditMode.READONLY : EditMode.EDITABLE),
+            broken
+                ? StatusAction.create(this.sharedServices.MessageRenderer.renderMessage(DIAGRAM_READONLY_PARSE_ERROR), {
+                    severity: 'WARNING'
+                })
+                : // `NONE` is the client's own spelling for "clear", not a severity it
+                    // renders: `StatusOverlay.handle` branches on it before touching the
+                    // DOM. An empty message at any other severity leaves an empty band
+                    // with a warning icon standing on the canvas.
+                    StatusAction.create('', { severity: 'NONE' })
+        ];
     }
     /**
      * Seam: extra actions to dispatch right after the initial settled root is
@@ -436,31 +702,47 @@ let HydraniumGlspStorage = class HydraniumGlspStorage {
     onSourceModelSettled(_document) {
         return [];
     }
-    /** The effective {@link SaveConflictPolicy}: the bound option, or {@link DEFAULT_SAVE_CONFLICT_POLICY} when unbound. */
-    get saveConflictPolicy() {
-        return this.boundSaveConflictPolicy ?? DEFAULT_SAVE_CONFLICT_POLICY;
+    /** The effective {@link SaveDeliveryPolicy}: the bound option, or {@link DEFAULT_SAVE_DELIVERY_POLICY} when unbound. */
+    get saveDeliveryPolicy() {
+        return this.boundSaveDeliveryPolicy ?? DEFAULT_SAVE_DELIVERY_POLICY;
     }
     /**
-     * Default save flow: route through `ModelService.save`. The framework
-     * serialise-and-persist machinery handles serialisation (via the
-     * language-specific `Serializer` bound at `services.serializer.Serializer`),
-     * the multi-client text-document update, the rebuild, and the eventual
-     * `WritableFileSystemProvider.writeFile`.
+     * Default save flow: persist the store's current text for every document the
+     * diagram's session has open.
      *
-     * The configured {@link SaveConflictPolicy} (see {@link saveConflictPolicy})
-     * decides how a concurrent edit that advanced the document is handled:
-     * - `overwrite` (default): no based-on guard, await, propagate failures —
-     *   last-write-wins, correct for a single-editor head.
-     * - `reject`: guard on the captured `state.version`, await, surface a
-     *   `ConflictError` (and any other failure) to the GLSP save action.
-     * - `drop-and-log`: guard, fire-and-forget, log + swallow failures — a stale
-     *   diagram save is dropped because a concurrent form/code edit already wrote
-     *   the truth, and GLSP exposes no save-failure back-channel.
+     * **A save persists, it does not author.** Every diagram gesture already
+     * reached the store through the diagram's session, so the store holds the
+     * settled text and disk is the only thing behind. Re-serializing from the AST
+     * here cannot improve on that text and can only damage it: a serializer
+     * normalises formatting, and the comments the write path carries over keep
+     * none of the hand-formatting around them, so a save would reflow a document
+     * nothing changed — which is what a pure bounds drag does to the semantic
+     * file when only its layout moved.
+     *
+     * **What is saved is the primary, every tracked secondary
+     * (`AbstractHydraniumGlspState.trackSecondaryDocument`) and every document
+     * that left the write set since the last save**, so a document the diagram
+     * wrote is persisted whether or not it is the one the client named. One the
+     * diagram's session does not have open is skipped, even when another client
+     * has it open: that client's unsaved edits are not the diagram's to persist.
+     *
+     * **A save therefore names documents the gesture did not aim at**, which is
+     * why an unchanged one is not rewritten even though the user asked for a
+     * save: the mtime would move on a file they never touched.
+     * `AstDocumentManager.save` decides that per document and announces the save
+     * either way.
+     *
+     * The configured {@link SaveDeliveryPolicy} (see {@link saveDeliveryPolicy})
+     * decides await-vs-fire-and-forget and failure handling. It carries no
+     * based-on guard: the guard exists to stop a stale writer overwriting a newer
+     * document, and a flush persists the store — which already holds every other
+     * client's change, including the one that advanced the version.
      *
      * Returns `MaybePromise<void>` to match upstream `SourceModelStorage`:
-     * resolves with the persist under `overwrite`/`reject`, returns synchronously
-     * under `drop-and-log`. Adopters that bypass `ModelService` (writing through
-     * `WritableFileSystemProvider` directly) still override the whole method.
+     * resolves with the flush under `await`, returns synchronously under
+     * `fire-and-forget`. Adopters that bypass `AstDocumentManager` (writing
+     * through `WritableFileSystemProvider` directly) still override the whole
+     * method.
      */
     saveSourceModel(action) {
         // Normalised for the same reason the load path is: `SaveModelAction.fileUri`
@@ -470,23 +752,58 @@ let HydraniumGlspStorage = class HydraniumGlspStorage {
         // the call site rather than inside `getFileUri` so that method's contract —
         // return what the action said — is unchanged for adopters overriding it.
         const uri = this.toSourceModelUri(this.getFileUri(action));
-        const policy = this.saveConflictPolicy;
-        const persisted = this.sharedServices.model.ModelService.save({
-            uri,
-            model: this.state.sourceRoot,
-            clientId: this.state.clientId,
-            baseVersion: policy.kind === 'overwrite' ? undefined : this.state.version
-        }).then(() => undefined);
-        if (policy.kind === 'drop-and-log') {
-            // Fire-and-forget: the diagram save lost the race to a concurrent edit
-            // that already persisted the truth, so it must neither block the action
-            // nor surface. Log rather than leave an unhandled rejection.
-            persisted.catch(error => this.logger.error(`Save failed for ${uri}: ${error instanceof Error ? error.message : String(error)}`));
+        if (this.saveDeliveryPolicy.kind === 'fire-and-forget') {
+            // Log rather than leave an unhandled rejection: the promise is not
+            // returned, so nothing else will observe a failure.
+            this.flushWriteSet(uri).catch(error => this.logger.error(`Save failed for ${uri}: ${error instanceof Error ? error.message : String(error)}`));
             return undefined;
         }
-        // overwrite / reject: await; a ConflictError (reject) or any other failure
-        // propagates to GLSP's save-action handler.
-        return persisted;
+        // Awaited: any failure propagates to GLSP's save-action handler, which
+        // then sends no dirty state, so the one the save held back goes here.
+        // An override that throws before it returns a promise throws inside the
+        // async function too, so the hold always ends.
+        this.ownSavesPending++;
+        return (async () => {
+            try {
+                await this.flushWriteSet(uri);
+            }
+            catch (error) {
+                this.sendDirtyState();
+                throw error;
+            }
+            finally {
+                this.ownSavesPending--;
+            }
+        })();
+    }
+    /**
+     * Save the stored text of `primaryUri`, every tracked secondary and every
+     * document that left the write set since the last save, each only where
+     * the diagram's session has it open; then close those that left.
+     *
+     * Deduplicated, because a state that tracks its own primary as a secondary
+     * would otherwise save it twice and fire two save notifications for one
+     * save. Every save is called in one synchronous step, so each takes its text
+     * before anything can close a document of the set: saved one after another,
+     * a GLSP session ending during the first write closes the rest unsaved.
+     */
+    async flushWriteSet(primaryUri) {
+        // Refused like the load: without a session the client id's opens are
+        // another participant's, and this would save them.
+        this.requireModelSession();
+        const documents = this.sharedServices.workspace.AstDocumentManager;
+        const textDocuments = this.sharedServices.workspace.TextDocuments;
+        const clientId = this.state.clientId;
+        // Taken with the targets: a document leaving the set during the writes
+        // was not saved by them, and stays open for the next save.
+        const departed = [...this.departedSecondaries];
+        const targets = [...new Set([primaryUri, ...this.state.secondaryUris, ...departed])].filter(uri => textDocuments.isOpenInClient(uri, clientId));
+        await Promise.all(targets.map(target => documents.save(target, clientId)));
+        for (const uri of departed) {
+            if (this.departedSecondaries.delete(uri) && uri !== this.state.sourceUri) {
+                await this.state.modelSession?.close(uri);
+            }
+        }
     }
     /**
      * Normalise GLSP's `sourceUri` — which may be a filesystem PATH or a URI
@@ -516,11 +833,22 @@ let HydraniumGlspStorage = class HydraniumGlspStorage {
      *
      * Returns it VERBATIM, in whatever form the client sent;
      * {@link toSourceModelUri} is what normalises it.
+     *
+     * A model request DOES carry a request id, so a throw here takes the
+     * client-request path rather than the toast path — and on that path `detail`
+     * comes from `cause?.toString?.()`. A single-argument throw therefore reaches
+     * neither the server log nor the client console: both print `undefined`. So
+     * the two readers are addressed separately, as on the save path: `message`
+     * names what failed in the user's terms and is rendered, `cause` names the
+     * action and the option key that was missing and stays English. On THIS path
+     * the cause reaches only logs — `RejectAction.detail` is read by nothing but
+     * the client action-dispatcher's `logger.warn` — which is not what makes it
+     * English; its content is.
      */
     getSourceUri(action) {
         const sourceUri = action.options?.[SOURCE_URI_ARG];
         if (typeof sourceUri !== 'string') {
-            throw new GLSPServerError(`Invalid RequestModelAction! Missing argument with key '${SOURCE_URI_ARG}'`);
+            throw new GLSPServerError(this.sharedServices.MessageRenderer.renderMessage(SOURCE_URI_MISSING), `no '${SOURCE_URI_ARG}' option on the ${action.kind} action (received ${typeof sourceUri})`);
         }
         return sourceUri;
     }
@@ -531,17 +859,23 @@ let HydraniumGlspStorage = class HydraniumGlspStorage {
      * {@link AbstractHydraniumGlspState.setSourceRoot}.
      *
      * A save action carries no request id, so a throw here reaches the user as a
-     * toast built from `message`, with `cause` behind its details control. The
-     * two therefore address different readers and must not be collapsed: the
-     * message names what failed in the user's terms, and the cause names which
-     * lookups came back empty for whom. Neither can name the URI — not having
-     * one IS the failure, and both sources are written together, so the typed
-     * `sourceUri` is equally empty whenever this fires.
+     * toast built from `message`, while `cause` travels in
+     * `MessageAction.details` — **which a Theia host DOES put in front of a
+     * user**, as a "Show details" button on the toast opening a dialog. So the
+     * two are not split by reachability; they are split by AUDIENCE, which is
+     * the older rule and the one that holds here. The message names what failed
+     * in the user's terms and is rendered; the cause names which lookups came
+     * back empty for whom, and stays English because a wire action kind, an
+     * option key and a client id address whoever composes the system — a
+     * translated developer string is a worse outcome than an untranslated one.
+     * Neither can name the URI — not having one IS the failure, and both sources
+     * are written together, so the typed `sourceUri` is equally empty whenever
+     * this fires.
      */
     getFileUri(action) {
         const uri = action.fileUri ?? this.state.get(SOURCE_URI_ARG);
         if (!uri) {
-            throw new GLSPServerError('Could not determine where to save this model', `no fileUri on the save action and no ${SOURCE_URI_ARG} in the model state (clientId=${this.state.clientId})`);
+            throw new GLSPServerError(this.sharedServices.MessageRenderer.renderMessage(SAVE_TARGET_UNKNOWN), `no fileUri on the save action and no ${SOURCE_URI_ARG} in the model state (clientId=${this.state.clientId})`);
         }
         return uri;
     }
@@ -569,10 +903,14 @@ let HydraniumGlspStorage = class HydraniumGlspStorage {
         this.dispose();
     }
     /**
-     * Cancel any pending resubmit and drain every subscription — those registered
+     * Cancel any pending resubmit, drain every subscription — those registered
      * during {@link doLoadSourceModel} and the per-secondary ones, which live
-     * outside {@link toDispose} because they come and go with the write set.
+     * outside {@link toDispose} because they come and go with the write set —
+     * and end the diagram's client session, closing everything it has open.
      * Idempotent.
+     *
+     * The session ends last, once the detach listener is gone: its closes would
+     * otherwise report this storage's own teardown as a client detaching.
      */
     dispose() {
         this.resubmitDebouncer?.dispose();
@@ -581,6 +919,9 @@ let HydraniumGlspStorage = class HydraniumGlspStorage {
         }
         this.secondarySubscriptions.clear();
         this.toDispose.dispose();
+        this.disposed = true;
+        this.state.modelSession?.dispose();
+        this.state.modelSession = undefined;
     }
 };
 __decorate([
@@ -617,10 +958,10 @@ __decorate([
     __metadata("design:type", Object)
 ], HydraniumGlspStorage.prototype, "modelValidator", void 0);
 __decorate([
-    inject(SaveConflictPolicy),
+    inject(SaveDeliveryPolicy),
     optional(),
     __metadata("design:type", Object)
-], HydraniumGlspStorage.prototype, "boundSaveConflictPolicy", void 0);
+], HydraniumGlspStorage.prototype, "boundSaveDeliveryPolicy", void 0);
 __decorate([
     postConstruct(),
     __metadata("design:type", Function),