@hydranium/protocol 1.0.0-next.28 → 1.0.0-next.281

package/src/errors.ts

@@ -9,62 +9,92 @@
 
 import { ResponseError } from 'vscode-jsonrpc';
 import { defineMessage, type HydraniumMessageData, messageData } from './messages/primitives';
+import { asModelVersion, type ModelVersion, type TextVersion } from './model-service/base-version';
+
+/*
+ * Every error here is a typed error: a caller reacts to it, so it has a class,
+ * a JSON-RPC code and an `is*` guard, and an English message. A typed error
+ * also carries a message identity where the framework can write an end-user
+ * sentence that needs no context. A URI may stay in that sentence; a client id
+ * or a raw version stays out of it, worded or left to `data`.
+ *
+ * An error nothing reacts to does not belong here: it stays a plain `Error`, or
+ * a named subclass without a code, at its throw site, since a code and a guard
+ * are public API that no caller would use.
+ */
 
 /**
- * The catalogue declaration behind {@link ConflictError}'s sentence.
+ * The catalogue declaration behind {@link ConflictError}'s sentence. It words
+ * the version mismatch rather than stating it: the two numbers mean nothing to
+ * an end user, and they stay in {@link ConflictErrorData}.
  *
  * Its English must keep containing {@link CONFLICT_ERROR_MESSAGE_MARKER}: the
  * marker is tier 3 of {@link isConflictError}'s ladder, and it matches on text.
  * That tier only ever works untranslated, which is why it is the last resort
  * behind the numeric code rather than the primary check.
  */
-export const STALE_BASED_UPDATE = defineMessage(
-   'hydranium/protocol/stale-based-update',
-   'Stale-based update for {uri}: expected v{expected}, server is at v{actual}'
+export const STALE_BASE_VERSION_UPDATE = defineMessage(
+   'hydranium/protocol/stale-base-version-update',
+   'The edit to {uri} was not applied: it was made to an older version of the document.'
 );
 
 /**
- * Application-specific JSON-RPC error code for {@link ConflictError}.
- * Outside the reserved range (-32768 .. -32000) per JSON-RPC 2.0.
+ * Every JSON-RPC error code the framework raises, from any package, keyed by
+ * the error it identifies.
+ *
+ * The framework reserves the block 42000 to 42999 for these, and an adopter's
+ * own codes stay outside it: after an RPC a guard matches on the code alone, so
+ * an adopter's error carrying one of these reads as the framework's. A new code
+ * takes the next unused number in the block, whichever package raises it, and
+ * is declared here, where tests hold every code distinct and inside the block.
+ * The block sits clear of the range JSON-RPC 2.0 reserves for itself, -32768
+ * to -32000.
+ */
+export const HYDRANIUM_ERROR_CODES = {
+   conflict: 42001,
+   noActiveProfile: 42002,
+   referenceSettleTimeout: 42003,
+   sessionClosed: 42004,
+   documentNotOpen: 42005,
+   duplicateClientId: 42006,
+   reservedClientId: 42007
+} as const;
+
+/**
+ * JSON-RPC error code for {@link ConflictError}.
  *
  * The code is the load-bearing identifier across realm boundaries —
  * `code` is a first-class field on the JSON-RPC error envelope and
  * survives wire reconstruction; the custom `Error` subclass name does
  * not.
  */
-export const CONFLICT_ERROR_CODE = 1001;
+export const CONFLICT_ERROR_CODE = HYDRANIUM_ERROR_CODES.conflict;
 
-/**
- * Structured payload carried in {@link ConflictError.data}, and the only place
- * a post-RPC caller can read the version mismatch from.
- */
+/** Structured payload carried in {@link ConflictError.data}. */
 export interface ConflictErrorData extends HydraniumMessageData {
    readonly uri: string;
-   /** The based-on version the caller authored against. */
-   readonly expected: number;
+   /** The base version the caller authored against. */
+   readonly baseVersion: ModelVersion;
    /** The server's current text-document version at the time of the throw. */
-   readonly actual: number;
+   readonly actualVersion: TextVersion;
 }
 
 /**
- * Thrown by `ModelService.update` / `ModelService.save` when the caller-
- * supplied based-on version no longer matches the server's current text-
+ * Thrown by a client session's `update` / `save` when the caller-
+ * supplied base version no longer matches the server's current text-
  * document version for the same URI — i.e. the snapshot the caller
  * authored against has been superseded by an intervening edit.
  *
  * Extends vscode-jsonrpc's {@link ResponseError} so the typed
  * {@link ConflictErrorData} payload rides on the standard JSON-RPC
  * error envelope (`code`, `message`, `data`) — all three fields are
- * preserved by RPC reconstruction. Adopters that catch the error on
- * the receiving side of an RPC call read the version mismatch from
- * `err.data` (the instance is reconstructed as a generic
- * `ResponseError`, so subclass getters / fields do not survive).
+ * preserved by RPC reconstruction. `createRpcProxy` revives it into
+ * this class on the receiving side; a path that does not leaves a
+ * plain `ResponseError`, readable through `err.data` only.
  *
- * Detection is opt-in via the optional `baseVersion` field on
- * `TransferUpdateArgs` / `TransferSaveArgs`; callers that omit the field get
- * no gating. This mirrors LSP's `OptionalVersionedTextDocumentIdentifier`
- * posture, so headless / CLI / batch tooling with no meaningful based-on
- * version can opt out explicitly.
+ * Detection is driven by the required `baseVersion` field of every write
+ * request; a caller with no meaningful base version passes
+ * `'any'` and gets no gating.
  *
  * Three reasonable adopter recovery strategies:
  *
@@ -78,18 +108,23 @@ export interface ConflictErrorData extends HydraniumMessageData {
  * No auto-retry or auto-merge ships by default.
  */
 export class ConflictError extends ResponseError<ConflictErrorData> {
-   constructor(uri: string, expected: number, actual: number) {
-      const params = { uri, expected, actual };
+   constructor(uri: string, baseVersion: ModelVersion, actualVersion: TextVersion) {
       // The identity rides alongside the typed payload rather than replacing
-      // it: this class's getters and `isConflictError`'s name check are surface
-      // an adopter may bind, so the payload widens rather than changing shape.
-      super(CONFLICT_ERROR_CODE, STALE_BASED_UPDATE.format(params), { ...params, ...messageData(STALE_BASED_UPDATE, params) });
+      // it: `isConflictError`'s name check is surface an adopter may bind, so
+      // adding the identity widens the payload rather than reshaping it.
+      super(CONFLICT_ERROR_CODE, STALE_BASE_VERSION_UPDATE.format({ uri }), {
+         uri,
+         baseVersion,
+         actualVersion,
+         ...messageData(STALE_BASE_VERSION_UPDATE, { uri })
+      });
       this.name = 'ConflictError';
       // ResponseError's constructor calls `Object.setPrototypeOf(this,
       // ResponseError.prototype)` to keep its own prototype chain intact across
       // transpilation targets; that resets us to ResponseError, hiding the
       // ConflictError-specific getters. Restore the prototype here so
-      // `err.uri` / `.expected` / `.actual` resolve through this class.
+      // `err.uri` / `.baseVersion` / `.actualVersion` resolve through this
+      // class.
       Object.setPrototypeOf(this, ConflictError.prototype);
    }
 
@@ -97,19 +132,255 @@ export class ConflictError extends ResponseError<ConflictErrorData> {
       return this.data!.uri;
    }
 
-   get expected(): number {
-      return this.data!.expected;
+   /**
+    * The base version the caller authored against.
+    *
+    * Must not be renamed to `expected`, nor its sibling to `actual`: a test
+    * reporter reads an error carrying both as an assertion failure, and
+    * vitest's formatter then ASSIGNS to them, which throws on an accessor and
+    * replaces the real failure with a `TypeError`.
+    */
+   get baseVersion(): ModelVersion {
+      return this.data!.baseVersion;
+   }
+
+   /** The server's version at the time of the throw. Not `actual` — see {@link baseVersion}. */
+   get actualVersion(): TextVersion {
+      return this.data!.actualVersion;
+   }
+}
+
+/**
+ * JSON-RPC code for {@link SessionClosedError}, beside {@link CONFLICT_ERROR_CODE}
+ * and for the same reason: the code survives reconstruction, the class does not.
+ */
+export const SESSION_CLOSED_ERROR_CODE = HYDRANIUM_ERROR_CODES.sessionClosed;
+/** JSON-RPC code for {@link DocumentNotOpenError}. */
+export const DOCUMENT_NOT_OPEN_ERROR_CODE = HYDRANIUM_ERROR_CODES.documentNotOpen;
+/** JSON-RPC code for {@link DuplicateClientIdError}. */
+export const DUPLICATE_CLIENT_ID_ERROR_CODE = HYDRANIUM_ERROR_CODES.duplicateClientId;
+/** JSON-RPC code for {@link ReservedClientIdError}. */
+export const RESERVED_CLIENT_ID_ERROR_CODE = HYDRANIUM_ERROR_CODES.reservedClientId;
+
+/**
+ * The catalogue declaration behind {@link SessionClosedError}'s default
+ * sentence. It names no client id: the sentence can reach an end user, and the
+ * id stays in {@link SessionClosedErrorData.clientId} for whoever needs it.
+ */
+export const SESSION_CLOSED = defineMessage('hydranium/protocol/session-closed', 'The editing session has ended.');
+
+/** Structured payload carried in {@link SessionClosedError.data}. */
+export interface SessionClosedErrorData extends HydraniumMessageData {
+   readonly clientId: string;
+}
+
+/**
+ * Thrown by every call on a client session after it ended, and by an open that
+ * was still in flight when its session ended: by the server for its sessions,
+ * and by a client-side `DataSession` once disposed, so a caller handles both
+ * the same way. A caller recognises it with {@link isSessionClosedError}, never
+ * by its sentence.
+ */
+export class SessionClosedError extends ResponseError<SessionClosedErrorData> {
+   /**
+    * `message` replaces the default English, for a caller that knows more than
+    * that the session is gone. The identity stays {@link SESSION_CLOSED}'s, so a
+    * translating renderer renders the catalogue sentence in its place.
+    */
+   constructor(clientId: string, message = SESSION_CLOSED.format()) {
+      super(SESSION_CLOSED_ERROR_CODE, message, { clientId, ...messageData(SESSION_CLOSED) });
+      this.name = 'SessionClosedError';
+      // `ResponseError` resets the prototype to its own; see `ConflictError`.
+      Object.setPrototypeOf(this, SessionClosedError.prototype);
+   }
+
+   get clientId(): string {
+      return this.data!.clientId;
    }
+}
+
+/**
+ * The catalogue declaration behind {@link DocumentNotOpenError}'s sentence. The
+ * client id stays in {@link DocumentNotOpenErrorData.clientId}.
+ */
+export const DOCUMENT_NOT_OPEN = defineMessage(
+   'hydranium/protocol/document-not-open',
+   'The document {uri} is not open in this editing session.'
+);
+
+/** Structured payload carried in {@link DocumentNotOpenError.data}. */
+export interface DocumentNotOpenErrorData extends HydraniumMessageData {
+   readonly uri: string;
+   readonly clientId: string;
+}
 
-   get actual(): number {
-      return this.data!.actual;
+/**
+ * Thrown when a client session writes a document it does not have open.
+ *
+ * A session writes only what it has open, so this is the answer both to a write
+ * that never opened and to one whose open was closed underneath it — by the
+ * session itself, or by the document being deleted.
+ */
+export class DocumentNotOpenError extends ResponseError<DocumentNotOpenErrorData> {
+   constructor(uri: string, clientId: string) {
+      super(DOCUMENT_NOT_OPEN_ERROR_CODE, DOCUMENT_NOT_OPEN.format({ uri }), {
+         uri,
+         clientId,
+         ...messageData(DOCUMENT_NOT_OPEN, { uri })
+      });
+      this.name = 'DocumentNotOpenError';
+      Object.setPrototypeOf(this, DocumentNotOpenError.prototype);
+   }
+
+   get uri(): string {
+      return this.data!.uri;
    }
+
+   get clientId(): string {
+      return this.data!.clientId;
+   }
+}
+
+/**
+ * The catalogue declaration behind {@link DuplicateClientIdError}'s sentence.
+ * The client id stays in {@link DuplicateClientIdErrorData.clientId}.
+ */
+export const DUPLICATE_CLIENT_ID = defineMessage(
+   'hydranium/protocol/duplicate-client-id',
+   'Could not start an editing session: its identifier is still in use by another editor.'
+);
+
+/** Structured payload carried in {@link DuplicateClientIdError.data}. */
+export interface DuplicateClientIdErrorData extends HydraniumMessageData {
+   readonly clientId: string;
+}
+
+/**
+ * Thrown when a client session is started under an id that is already live in
+ * the process. The id frees up once its holder ends or closes its last
+ * document, so a caller may retry.
+ *
+ * Ids are unique process-wide because the id is also the author label on every
+ * version and the key a client recognises its own echoes by; two participants
+ * sharing one would each take the other's writes for their own.
+ */
+export class DuplicateClientIdError extends ResponseError<DuplicateClientIdErrorData> {
+   constructor(clientId: string) {
+      super(DUPLICATE_CLIENT_ID_ERROR_CODE, DUPLICATE_CLIENT_ID.format(), { clientId, ...messageData(DUPLICATE_CLIENT_ID) });
+      this.name = 'DuplicateClientIdError';
+      Object.setPrototypeOf(this, DuplicateClientIdError.prototype);
+   }
+
+   get clientId(): string {
+      return this.data!.clientId;
+   }
+}
+
+/**
+ * Thrown when a client session is started under an id the framework reserves
+ * for one of its own participants. A reserved id never frees up, so a caller
+ * that retries on {@link DuplicateClientIdError} stops on this one.
+ *
+ * It carries no message identity: a host that picks a reserved id has a bug,
+ * and no sentence addressed to an end user is true for it.
+ */
+export class ReservedClientIdError extends ResponseError<{ readonly clientId: string }> {
+   constructor(clientId: string) {
+      super(RESERVED_CLIENT_ID_ERROR_CODE, `Client id ${clientId} is reserved for a framework participant`, { clientId });
+      this.name = 'ReservedClientIdError';
+      Object.setPrototypeOf(this, ReservedClientIdError.prototype);
+   }
+
+   get clientId(): string {
+      return this.data!.clientId;
+   }
+}
+
+/**
+ * Rebuilds one typed error from the `data` that crossed the wire, or
+ * `undefined` when `data` lacks the fields the class reads.
+ */
+type ProtocolErrorReviver = (data: Readonly<Record<string, unknown>>) => ResponseError<unknown> | undefined;
+
+/** One entry per typed error class, keyed by its code; a class without one reaches a caller as a plain `ResponseError`. */
+const PROTOCOL_ERROR_REVIVERS: ReadonlyMap<number, ProtocolErrorReviver> = new Map<number, ProtocolErrorReviver>([
+   [
+      CONFLICT_ERROR_CODE,
+      ({ uri, baseVersion, actualVersion }) =>
+         typeof uri === 'string' && typeof baseVersion === 'number' && typeof actualVersion === 'number'
+            ? new ConflictError(uri, asModelVersion(baseVersion), actualVersion)
+            : undefined
+   ],
+   [SESSION_CLOSED_ERROR_CODE, ({ clientId }) => (typeof clientId === 'string' ? new SessionClosedError(clientId) : undefined)],
+   [
+      DOCUMENT_NOT_OPEN_ERROR_CODE,
+      ({ uri, clientId }) => (typeof uri === 'string' && typeof clientId === 'string' ? new DocumentNotOpenError(uri, clientId) : undefined)
+   ],
+   [DUPLICATE_CLIENT_ID_ERROR_CODE, ({ clientId }) => (typeof clientId === 'string' ? new DuplicateClientIdError(clientId) : undefined)],
+   [RESERVED_CLIENT_ID_ERROR_CODE, ({ clientId }) => (typeof clientId === 'string' ? new ReservedClientIdError(clientId) : undefined)]
+]);
+
+/**
+ * Whether `error` is a `ResponseError` from any copy of `vscode-jsonrpc`. An
+ * install holds several copies, and `instanceof` recognises only its own. An
+ * error that merely carries an integer `code` has no `toJson`, and is not one.
+ */
+export function isResponseError(error: unknown): error is ResponseError<unknown> {
+   return (
+      error instanceof Error && 'code' in error && Number.isInteger(error.code) && 'toJson' in error && typeof error.toJson === 'function'
+   );
+}
+
+/**
+ * `error` as an instance of the typed error class its code names, with its
+ * message, data and stack kept, or `error` itself when its code names none or
+ * its data lacks the fields that class reads.
+ * An RPC reconstructs every rejection as a plain `ResponseError`, which has
+ * none of the class getters.
+ */
+export function reviveProtocolError(error: unknown): unknown {
+   if (!isResponseError(error) || error.data === null || typeof error.data !== 'object') {
+      return error;
+   }
+   const revived = PROTOCOL_ERROR_REVIVERS.get(error.code)?.({ ...error.data });
+   if (!revived) {
+      return error;
+   }
+   return Object.assign(revived, { message: error.message, data: error.data, stack: error.stack });
+}
+
+/**
+ * Whether `error` is a {@link SessionClosedError}: by name in-process, by code
+ * when it arrives as a plain `ResponseError`, through a path that does not
+ * {@link reviveProtocolError revive} it.
+ */
+export function isSessionClosedError(error: unknown): error is SessionClosedError {
+   return hasErrorIdentity(error, 'SessionClosedError', SESSION_CLOSED_ERROR_CODE);
+}
+
+/** Whether `error` is a {@link DocumentNotOpenError}; see {@link isSessionClosedError}. */
+export function isDocumentNotOpenError(error: unknown): error is DocumentNotOpenError {
+   return hasErrorIdentity(error, 'DocumentNotOpenError', DOCUMENT_NOT_OPEN_ERROR_CODE);
+}
+
+/** Whether `error` is a {@link DuplicateClientIdError}; see {@link isSessionClosedError}. */
+export function isDuplicateClientIdError(error: unknown): error is DuplicateClientIdError {
+   return hasErrorIdentity(error, 'DuplicateClientIdError', DUPLICATE_CLIENT_ID_ERROR_CODE);
+}
+
+/** Whether `error` is a {@link ReservedClientIdError}; see {@link isSessionClosedError}. */
+export function isReservedClientIdError(error: unknown): error is ReservedClientIdError {
+   return hasErrorIdentity(error, 'ReservedClientIdError', RESERVED_CLIENT_ID_ERROR_CODE);
+}
+
+function hasErrorIdentity(error: unknown, name: string, code: number): boolean {
+   return error instanceof Error && (error.name === name || (error as Partial<ResponseError<unknown>>).code === code);
 }
 
 /** Marker substring present in every {@link ConflictError} message, used by
  *  {@link isConflictError} as a fallback when a transport re-wraps the error
  *  and drops the JSON-RPC code. */
-const CONFLICT_ERROR_MESSAGE_MARKER = 'Stale-based update for ';
+const CONFLICT_ERROR_MESSAGE_MARKER = ': it was made to an older version of the document';
 
 /**
  * Type guard for {@link ConflictError}. Detection ladder:
@@ -120,11 +391,12 @@ const CONFLICT_ERROR_MESSAGE_MARKER = 'Stale-based update for ';
  *     canonical wire-side check; the JSON-RPC `code` field is preserved
  *     across reconstruction, so any adopter catching after an RPC call
  *     hits this branch.
- *  3. `error.message.includes('Stale-based update for ')` — fallback
- *     for transports that re-wrap the message and drop the code (rare).
+ *  3. `error.message` contains the marker {@link STALE_BASE_VERSION_UPDATE}'s
+ *     English carries — fallback for transports that re-wrap the message
+ *     and drop the code (rare).
  *
- * `instanceof ConflictError` alone would silently return `false` on the
- * reconstructed shape, so callers do not use it.
+ * `instanceof ConflictError` alone returns `false` on a rejection that was
+ * not {@link reviveProtocolError revived}, so callers do not use it.
  */
 export function isConflictError(error: unknown): error is ConflictError {
    if (!(error instanceof Error)) {

package/src/glsp-request-model-args.ts

@@ -0,0 +1,16 @@
+/********************************************************************************
+ * Copyright (c) 2026 CrossBreeze, EclipseSource and others.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the MIT License which is available in the project root.
+ *
+ * SPDX-License-Identifier: MIT
+ ********************************************************************************/
+
+/**
+ * The `RequestModelAction` option carrying a diagram's resume token. A load
+ * whose token matches the one the live session under its client id was started
+ * with takes that session over, so a diagram that reconnects or reloads keeps
+ * its unsaved text; without it, the id held by another session is refused.
+ */
+export const RESUME_TOKEN_ARG = 'hydraniumResumeToken';

package/src/glsp-save-model-actions.ts

@@ -0,0 +1,59 @@
+/********************************************************************************
+ * Copyright (c) 2026 CrossBreeze, EclipseSource and others.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the MIT License which is available in the project root.
+ *
+ * SPDX-License-Identifier: MIT
+ ********************************************************************************/
+
+// Declared field by field rather than extending GLSP's action types: this
+// package carries no GLSP dependency, and both GLSP heads already depend on it.
+// The fields are GLSP's own, so both actions are assignable to GLSP's
+// `RequestAction` and `ResponseAction`.
+
+/**
+ * A save of a diagram's model that the server answers, with a
+ * {@link ModelSavedAction} once the save has finished or a GLSP
+ * `RejectAction` when it fails.
+ *
+ * It carries what GLSP's `SaveModelAction` carries, and the server saves it the
+ * same way. GLSP's `SaveModelAction` is not answered: the server's only
+ * reply is a dirty-state change, which the client drops when the dirty flag
+ * does not change, so a client cannot tell which save an answer belongs to or
+ * whether a save failed.
+ */
+export interface RequestSaveModelAction {
+   kind: typeof RequestSaveModelAction.KIND;
+   /** The id the response echoes as its `responseId`. Empty until the dispatcher assigns one. */
+   requestId: string;
+   /** How long the receiver waits for its own handler, in milliseconds. */
+   timeout?: number;
+   /** The file to save to, as in GLSP's `SaveModelAction`; absent saves to the diagram's source. */
+   fileUri?: string;
+   /** GLSP's typing marker for the response. Never set. */
+   readonly _?: ModelSavedAction;
+}
+
+export namespace RequestSaveModelAction {
+   export const KIND = 'hydraniumRequestSaveModel';
+
+   export function create(options: { fileUri?: string; requestId?: string } = {}): RequestSaveModelAction {
+      return { kind: KIND, requestId: '', ...options };
+   }
+}
+
+/** The server's answer to a {@link RequestSaveModelAction} that saved. */
+export interface ModelSavedAction {
+   kind: typeof ModelSavedAction.KIND;
+   /** The `requestId` of the save this answers. The server's dispatcher sets it. */
+   responseId: string;
+}
+
+export namespace ModelSavedAction {
+   export const KIND = 'hydraniumModelSaved';
+
+   export function create(options: { responseId?: string } = {}): ModelSavedAction {
+      return { kind: KIND, responseId: '', ...options };
+   }
+}

package/src/index.ts

@@ -15,11 +15,15 @@
 // every production bundle that imports the root.
 
 export * from './abstract-logger';
+export * from './console-logger';
 export * from './client';
+export * from './client-ids';
 export * from './clock';
 export * from './data';
 export * from './browser-runtime';
 export * from './debouncer';
+export * from './glsp-request-model-args';
+export * from './glsp-save-model-actions';
 export * from './errors';
 export * from './host-diagnostics';
 export * from './logger';
@@ -29,6 +33,7 @@ export * from './latency-collector';
 // the modules that raise them.
 export * from './messages/primitives';
 export * from './patch-merge';
+export * from './reconcile-write';
 export * from './noop-logger';
 export * from './observable-value';
 export * from './profile-session';
@@ -40,6 +45,7 @@ export * from './model-service';
 export * from './transfer-document';
 export * from './model-server';
 export * from './project';
+export * from './random-uuid';
 export * from './rpc';
 export * from './uri';
 export * from './util';

package/src/latency-collector.ts

@@ -87,8 +87,13 @@ export interface LatencyReport {
  */
 export type LatencyRetention = { readonly kind: 'keep-all' } | { readonly kind: 'ring-buffer'; readonly maxSamplesPerMethod: number };
 
-/** Per-method state: retained samples (bounded in ring-buffer mode) plus lifetime totals. */
-interface MethodAccumulator {
+/**
+ * Per-method state: retained samples (bounded in ring-buffer mode) plus lifetime
+ * totals. The mutable tally behind {@link MethodLatency}, which is the derived
+ * report row. Held by the `protected` {@link LatencyCollector.durations}, so a
+ * subclass recording its own samples has to name it.
+ */
+export interface MethodLatencyTally {
    /** Retained durations for percentile estimation; capped in ring-buffer mode. Order is irrelevant (report sorts). */
    readonly samples: number[];
    /** Next slot to overwrite once the ring buffer is full (ring-buffer mode only). */
@@ -119,7 +124,7 @@ function percentile(sortedAscending: readonly number[], percent: number): number
  * deterministic on a fake clock.
  */
 export class LatencyCollector {
-   protected readonly durations = new Map<string, MethodAccumulator>();
+   protected readonly durations = new Map<string, MethodLatencyTally>();
    protected window: Stopwatch;
 
    constructor(

package/src/logger.ts

@@ -24,6 +24,7 @@ export const LEVEL_LABELS: Record<LogLevel, string> = {
 /** Module-global threshold; shared by every `AbstractLogger` instance so derived child
  *  loggers pick up live updates without each having to subscribe to a configuration source. */
 let currentLevel: LogThreshold = 'info';
+let fileLevel: LogThreshold | undefined;
 
 /**
  * Cross-side public logger contract. Every consumer of the framework — browser
@@ -38,15 +39,15 @@ let currentLevel: LogThreshold = 'info';
  * and every `for` / `sub` / `with` derivation preserves the implementation type.
  */
 export interface Logger {
-   /** Log a message at error level. */
+   /** Requested work failed; logged once, by the code that ends the failure, not by one that rethrows it. */
    error(message?: string, ...args: unknown[]): this;
-   /** Log a message at warn level. */
+   /** An anomaly that was handled, or work declined by design, such as a conflict or a cap; a clean run logs none. */
    warn(message?: string, ...args: unknown[]): this;
-   /** Log a message at info level. */
+   /** A milestone the person running the server would recognise without knowing the internals. */
    info(message?: string, ...args: unknown[]): this;
-   /** Log a message at debug level. */
+   /** Diagnosis; its level decides whether the line is built, never which code runs. */
    debug(message?: string, ...args: unknown[]): this;
-   /** High-volume diagnostic lines, only emitted at the `'trace'` threshold. */
+   /** High-volume diagnosis, emitted only at the `'trace'` threshold; as for `debug`, no code runs only for it. */
    trace(message?: string, ...args: unknown[]): this;
    /** Log a message at info-level threshold with a `Log` label (rather than `Info`). */
    log(message?: string, ...args: unknown[]): this;
@@ -93,12 +94,32 @@ export namespace Logger {
       return currentLevel;
    }
    /**
-    * Whether a message at `level` would be emitted at the current threshold.
+    * Set the log file's own threshold, which {@link setLevel} does not move;
+    * `undefined` makes the file follow {@link getLevel}. A file sink compares
+    * against `getFileLevel() ?? getLevel()`, every other sink against
+    * {@link getLevel}.
+    *
+    * Set it through the file sink's own configuration, which clears it with
+    * the file: set here with no file configured, it widens
+    * {@link isLevelEnabled} for lines nothing writes.
+    */
+   export function setFileLevel(level: LogThreshold | undefined): void {
+      fileLevel = level;
+   }
+   /** Read the log file's own threshold, `undefined` while it follows {@link getLevel}. */
+   export function getFileLevel(): LogThreshold | undefined {
+      return fileLevel;
+   }
+   /**
+    * Whether any sink takes a message at `level`: the more verbose of
+    * {@link getLevel} and {@link getFileLevel} decides. A sink that admits less
+    * re-checks its own threshold before writing.
+    *
     * Use to guard expensive log-line construction:
     * `if (Logger.isLevelEnabled('trace')) logger.trace(buildPayload())`.
     */
    export function isLevelEnabled(level: LogLevel): boolean {
-      return LEVEL_ORDER[level] <= LEVEL_ORDER[currentLevel];
+      return LEVEL_ORDER[level] <= Math.max(LEVEL_ORDER[currentLevel], fileLevel ? LEVEL_ORDER[fileLevel] : 0);
    }
    /**
     * Whether a message at `threshold` would be emitted: `false` for `'off'`,
@@ -136,6 +157,11 @@ export function parseLogLevel(value: unknown): LogThreshold | undefined {
 export const DEFAULT_LOG_LEVEL_ENV = 'HYDRANIUM_LOG_LEVEL';
 /** Env var the server reads its log file-tee target from. See {@link DEFAULT_LOG_LEVEL_ENV}. */
 export const DEFAULT_LOG_FILE_ENV = 'HYDRANIUM_LOG_FILE';
+/**
+ * Env var the server reads the file tee's own threshold from, which the LSP
+ * log-level setting does not change. See {@link Logger.setFileLevel}.
+ */
+export const DEFAULT_LOG_FILE_LEVEL_ENV = 'HYDRANIUM_LOG_FILE_LEVEL';
 
 /**
  * Human-readable formatting helpers used in log lines and diagnostic output.

package/src/messages/index.ts

@@ -25,8 +25,10 @@
 
 export * from './primitives';
 
-export { STALE_BASED_UPDATE } from '../errors';
-export { DATA_SERVER_CONNECT_FAILED, DATA_SERVER_NOT_READY } from '../client/data-session';
+export { DOCUMENT_NOT_OPEN, DUPLICATE_CLIENT_ID, SESSION_CLOSED, STALE_BASE_VERSION_UPDATE } from '../errors';
+export { DATA_CONNECTION_SESSION_RESTORE_FAILED, DATA_CONNECTION_WATCH_RESTORE_FAILED } from '../client/data-connection';
+export { DATA_SERVER_CONNECT_FAILED, DATA_SERVER_NOT_READY } from '../client/rpc-connection';
+export { DATA_SESSION_ANSWER_WITHOUT_MODEL, DATA_SESSION_RESTORE_FAILED, DATA_SESSION_UNSAVED_LOST } from '../client/data-session';
 export {
    RELAY_REPLAY_FAILED,
    RELAY_TRANSPORT_OPEN_FAILED,