@melite/estate-drafts 0.1.4-alpha → 0.1.5-pre-alpha

package/lib/remote.js

@@ -33,13 +33,13 @@ var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn,
     done = true;
 };
 import { Remote, RemoteError, TypertRemoteService, } from "@deepseek-ai/dsh-typert-protocol";
-import { admitWiring, benchBlockOf, strippedForAdmission } from "./bench.js";
+import { admitWiring, benchBlockOf, strippedForAdmission, toleratedByRow } from "./bench.js";
 import { STAGE_PATCH_KEYS, RESTORED_PROVENANCE_SPELLING } from "@melite/contracts/benchStage";
 export { STAGE_PATCH_KEYS };
 import { unwrapItemArrays } from "@melite/comfyui-card-kit";
 import { openDraftsDomain } from "./store.js";
 import { DRAFT_ID_RE } from "./spec.js";
-import { addStageBench, ensureBench, notifyBenchChange, notifyBenchDocWrite, onBenchChange, setBenchChangeSeam, getBench, groupBench, patchBench, clearBench, removeStageBench, reorderBench, rewireBench, undoBench, ungroupBench, } from "./bench.js";
+import { addStageBench, ensureBench, notifyBenchChange, notifyBenchDocWrite, onBenchChange, clearBenchChangeSeam, setBenchChangeSeam, getBench, groupBench, patchBench, clearBench, removeStageBench, reorderBench, rewireBench, undoBench, ungroupBench, } from "./bench.js";
 import { benchDraftIdOf } from "@melite/contracts/benchStage";
 
 
@@ -59,17 +59,21 @@ import { benchDraftIdOf } from "@melite/contracts/benchStage";
 
 
 
+
 export function installBenchChangeSeam(ctx) {
     let detach = null;
     ctx.effect(() => {
-        setBenchChangeSeam({
+        const mine = {
             emit: (session) => { ctx.emit("bench.changed", session); },
             on: (fn) => {
                 const stop = ctx.on("bench.changed", fn);
                 return () => { stop(); };
             },
-        });
-        detach = () => { setBenchChangeSeam(null); };
+        };
+        setBenchChangeSeam(mine);
+        // the ownership stamp: an older fiber's unwind clears only its own
+        // install — a displaced seam detaches nothing (clearBenchChangeSeam)
+        detach = () => { clearBenchChangeSeam(mine); };
         return detach;
     });
     return () => { detach?.(); };
@@ -84,34 +88,8 @@ function thrownMessage(error) {
     return error instanceof Error ? error.message : String(error);
 }
 /** ── THE OUTPUT HISTORY HELPERS (stroke 40) ──────────────────────
- * A result's OUTPUT urls, one spelling: the artifacts name→url map
- * first, the flat assetUrls list second, the lone url third (the
- * same harvest order the client's preview reads — the history and
- * the hero can never disagree about what a run produced). */
-export function resultOutputUrls(result) {
-    if (typeof result !== "object" || result === null || Array.isArray(result))
-        return [];
-    const row = result;
-    const urls = [];
-    if (row["artifacts"] !== null && typeof row["artifacts"] === "object" && !Array.isArray(row["artifacts"])) {
-        for (const v of Object.values(row["artifacts"])) {
-            if (typeof v === "string" && v !== "")
-                urls.push(v);
-        }
-    }
-    if (urls.length === 0 && Array.isArray(row["assetUrls"])) {
-        for (const v of row["assetUrls"]) {
-            if (typeof v === "string" && v !== "")
-                urls.push(v);
-        }
-    }
-    if (urls.length === 0 && typeof row["url"] === "string" && row["url"] !== "")
-        urls.push(row["url"]);
-    return urls;
-}
-/** Same OUTPUTS (the uniqueness key): two results match when their
- * url sets are equal — a re-run landing the same urls is not a new
- * history entry (the operator's "when it is unique"). */
+ *  resultOutputUrls now lives in trail.ts (the cycle-free seam) and
+ *  is re-exported below with the trail laws. ───────────────────── */
 export function sameResultOutputs(a, b) {
     return sameUrlSet(resultOutputUrls(a), resultOutputUrls(b));
 }
@@ -121,6 +99,15 @@ function sameUrlSet(a, b) {
     const sa = new Set(a);
     return b.every((u) => sa.has(u));
 }
+
+
+
+
+export { canonicalOutputUrl, resultOutputUrls, isTerminalTrailWord as isTerminalWord, trailDedupe } from "./trail.js";
+import { canonicalOutputUrl, isTerminalTrailWord as isTerminalWord, resultOutputUrls, sameTrailRunIdentity, } from "./trail.js";
+function sameRunIdentity(a, b) {
+    return sameTrailRunIdentity(a, b);
+}
 function resolverOf(ctx) {
     let seat;
     try {
@@ -263,6 +250,20 @@ export function laneAdmissionOf(ctx) {
 
 
 
+
+
+
+export function laneMigrationOf(ctx) {
+    const reg = resolverOf(ctx);
+    if (reg === null || reg.laneMigrate === undefined)
+        return undefined;
+    return reg.laneMigrate.bind(reg);
+}
+
+
+
+
+
 export function benchAdmissionOf(ctx) {
     const modelAdmit = admissionOf(ctx);
     const laneAdmit = laneAdmissionOf(ctx);
@@ -341,6 +342,37 @@ function docIndexFields(doc) {
     return { model, name: disp };
 }
 /** The drafts Remote owner: list/get over the storage domain. */
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+const benchTransactions = new Map();
+async function withBenchWrite(draftId, body) {
+    const prev = benchTransactions.get(draftId) ?? Promise.resolve();
+    let release;
+    const gate = new Promise((r) => { release = r; });
+    const mine = prev.then(() => gate);
+    benchTransactions.set(draftId, mine);
+    await prev;
+    try {
+        return await body();
+    }
+    finally {
+        release();
+        if (benchTransactions.get(draftId) === mine)
+            benchTransactions.delete(draftId);
+    }
+}
 let DraftsRemoteService = (() => {
     let _classSuper = TypertRemoteService;
     let _instanceExtraInitializers = [];
@@ -455,8 +487,14 @@ let DraftsRemoteService = (() => {
         async remoteExportPatch(draftId, stageId, patch, expectRev, signal) {
             return await this.patch(draftId, stageId, patch, expectRev, signal);
         }
-        /** The patch arm the adapter above delegates to. */
+        /** The patch arm the adapter above delegates to — one write
+         *  transaction on the draft's own key, shared with the bench
+         *  verbs (the round-14 race audit's R3: the author arm's
+         *  spread-copy of the log forked against their in-place push). */
         async patch(draftId, stageId, patch, expectRev, signal) {
+            return withBenchWrite(draftId, () => this.patchBody(draftId, stageId, patch, expectRev, signal));
+        }
+        async patchBody(draftId, stageId, patch, expectRev, signal) {
             signal.throwIfAborted();
             if (!DRAFT_ID_RE.test(draftId)) {
                 throw new RemoteError("draft/bad-id", `bad draft id ${JSON.stringify(draftId)}`, {
@@ -485,6 +523,27 @@ let DraftsRemoteService = (() => {
             if (Object.keys(patch).length === 0) {
                 throw new RemoteError("draft/bad-patch", "patch is empty (nothing to patch)", {});
             }
+            // THE INPUT KEYS ARE SHAPE-GATED AT THE DOOR (audit S-S8,
+            
+            // wire type permits any JsonValue) and the next compile refused
+            // the poisoned row far from the write; `inputOutputs` stored
+            // verbatim on BOTH seats while the bench verb refuses the key
+            // outright. One shape per key now: inputs is the channel ->
+            // wiring record (the bench arm's own isObj law), inputOutputs
+            // is the per-slot output-name list (string or null per slot —
+            // the wire contract FlowStage declares). The compile seat keeps
+            // the deep wiring law; this gate only refuses what could never
+            // compile, at the write that would have poisoned the doc.
+            if ("inputs" in patch && !isObj(patch["inputs"])) {
+                throw new RemoteError("draft/bad-patch", "inputs must be an object (channel -> wiring)", {});
+            }
+            if ("inputOutputs" in patch) {
+                const io = patch["inputOutputs"];
+                if (!Array.isArray(io) ||
+                    !io.every((entry) => entry === null || typeof entry === "string")) {
+                    throw new RemoteError("draft/bad-patch", "inputOutputs must be a list of output names (string or null per input slot)", {});
+                }
+            }
             let drafts;
             try {
                 drafts = await openDraftsDomain(this.ctx);
@@ -534,18 +593,26 @@ let DraftsRemoteService = (() => {
             // the domain's cached object; a refusal must leave no trace),
             // then bump and log below. A bench that moved under the caller
             // refuses loud, never merges under it.
-            if (!telemetry && expectRev !== null && bench.rev !== expectRev) {
-                throw new RemoteError("bench/cas-conflict", `bench moved under the patch (expect_rev ${expectRev}, current ${bench.rev}) — re-read and re-apply`, { current_rev: bench.rev, expect_rev: expectRev });
+            if (!telemetry) {
+                
+                // null skipped the CAS fence the bench verbs mandate (their
+                // law: a non-number expect_rev is a guaranteed refusal) — an
+                // unfenced author write merged silently under a moved bench.
+                // The door speaks the bench's voice, and the refusal carries
+                // current_rev so a rebase-and-retry lands (the client's CAS
+                // predicate already names this code).
+                if (expectRev === null) {
+                    throw new RemoteError("bench/cas-conflict", "expect_rev is required (the CAS law)", { current_rev: bench.rev });
+                }
+                if (bench.rev !== expectRev) {
+                    throw new RemoteError("bench/cas-conflict", `bench moved under the patch (expect_rev ${expectRev}, current ${bench.rev}) — re-read and re-apply`, { current_rev: bench.rev, expect_rev: expectRev });
+                }
             }
             // THE TELEMETRY WRITE IS DEFERRED (the bench audit's gap 1,
-            
-            // assigned into the CACHED record here, ABOVE the model and
-            // wiring gates — so a patch carrying a result AND a bad model
-            // wrote the result into the live doc and then threw, leaving a
-            // result with no rev and no log (the copy-on-judge law's exact
-            // shape: a refused write must leave NOTHING behind). The arms
-            // now run as one closure AFTER both gates pass.
-            const writeTelemetry = () => {
+            // The arms run as one closure AFTER both gates pass. The closure
+            // takes the row as its PARAM (shadowing this section's binding):
+            // the R6 cure below re-resolves the LIVE row at call time.
+            const writeTelemetry = (stage) => {
                 if ("result" in patch) {
                     // THE OUTPUT HISTORY (stroke 40 — the operator's QOL law: the
                     // preview's mini row is a CARD OUTPUT HISTORY): a stage's
@@ -566,6 +633,29 @@ let DraftsRemoteService = (() => {
                     // edited between runs must not retroactively re-label the old
                     // generation. The archive entry carries the snapshot; the
                     // client diffs it against the live params for the chip.
+                    // THE TERMINAL-HOLDS LAW (bench-trail W3, judged PRE-write): a
+                    // settled run's row never un-settles — a stale poll/tail pass
+                    // re-stamping a non-terminal word for the SAME run_id writes
+                    // NOTHING (result included; the tile's stuck face). A
+                    // different run_id is a fresh press and runs.
+                    const settledRunId = typeof stage["result"] === "object" && stage["result"] !== null && !Array.isArray(stage["result"])
+                        ? stage["result"]["run_id"]
+                        : undefined;
+                    const patchRunId = typeof patch["result"] === "object" && patch["result"] !== null && !Array.isArray(patch["result"])
+                        ? patch["result"]["run_id"]
+                        : undefined;
+                    if (isTerminalWord(stage["runStatus"]) && !isTerminalWord(patch["runStatus"])
+                        && typeof patchRunId === "string" && sameRunIdentity(settledRunId, patchRunId))
+                        return;
+                    // THE HUSK-DOWNGRADE REFUSAL (trail-defect-hunt §2): a
+                    // terminal, url-less result for a run whose settled face
+                    // carries urls is bookkeeping (the seat's own mirror husk
+                    // racing the client's rich patch) — the hero slot never
+                    // downgrades. A DIFFERENT run_id is a fresh press and runs.
+                    if (isTerminalWord(patch["runStatus"]) && sameRunIdentity(settledRunId, patchRunId)
+                        && resultOutputUrls(stage["result"]).length > 0
+                        && resultOutputUrls(patch["result"]).length === 0)
+                        return;
                     const prev = stage["result"];
                     const next = patch["result"];
                     
@@ -575,25 +665,49 @@ let DraftsRemoteService = (() => {
                     // archives ride the SAME write, oldest-first so the order in
                     // the list is append-stable:
                     //   1. SUPERSEDE — a cleared/overwritten result that carried
-                    //      outputs is archived (the stroke-40 law, unchanged).
+                    //      outputs is archived (the stroke-40 law, unchanged: a
+                    //      face that would LOSE urls never drops them).
                     //   2. LANDING — the incoming result itself, when it CARRIES
-                    //      outputs, enters the trail at its own landing. The old
-                    //      supersede-only law kept the CURRENT generation outside
-                    //      history (it lived only in the result slot, one
-                    //      view-pick away from unreachable). With the landing
-                    //      archived, history[0] is ALWAYS the newest gen — no
-                    //      pick, overwrite, or crash can orphan it. Live mid-run
-                    //      patches ({run_id, progress} — no urls) archive
-                    //      nothing, and the url-set dedup makes re-landings of
-                    //      the same outputs idempotent.
+                    //      outputs AND the write is not a LIVE face (the
+                    //      settled-landing law, bench-trail W1: the current run's
+                    //      urls never enter history before the card finishes; a
+                    //      mid-run face archives nothing). A result-only patch (no
+                    //      runStatus arm) is a pick/manual spell, not a run face —
+                    //      it lands unless the row reads a live word (the landing
+                    //      gate below).
+                    //      History[0] is ALWAYS the newest SETTLED gen. Live
+                    //      mid-run patches ({run_id, progress} — no urls) archive
+                    //      nothing either way, and the dedup makes re-landings
+                    //      idempotent.
                     const archiveInto = (urls, entry) => {
                         const hist = Array.isArray(stage["history"]) ? [...stage["history"]] : [];
-                        const already = hist.some((e) => sameUrlSet(resultOutputUrls(e), urls));
+                        // THE ONE-ROW-PER-RUN LAW (bench-trail W2): a run is one
+                        // history entry — the media route and the gallery proxy
+                        // spell the same file differently, so identity is the
+                        // run_id, with the canonical-url set as the no-id fallback
+                        const entryRunId = typeof entry["run_id"] === "string" ? entry["run_id"] : undefined;
+                        if (entryRunId !== undefined) {
+                            const already = hist.some((e) => sameRunIdentity(e["run_id"], entryRunId));
+                            if (already)
+                                return;
+                        }
+                        const canon = urls.map(canonicalOutputUrl);
+                        const already = hist.some((e) => sameUrlSet(resultOutputUrls(e).map(canonicalOutputUrl), canon));
                         if (!already) {
                             hist.unshift(entry);
                             stage["history"] = hist.slice(0, 12);
                         }
                     };
+                    // the landing gate (bench-trail W1 vs the pinned pick-spell
+                    // contract, remote.spec "empty {} snapshot"): a write that
+                    // DECLARES a live run face (a non-terminal runStatus arm)
+                    // never lands; a terminal arm lands; and a patch with NO
+                    // runStatus arm at all is not a run face — it lands unless the
+                    // row is mid-run (a live word), which is the stuck-row wound's
+                    // re-add shape.
+                    const LIVE_TRAIL_WORDS = new Set(["running", "queued", "pending", "stopping"]);
+                    const landingTerminal = isTerminalWord(patch["runStatus"]) ||
+                        (!("runStatus" in patch) && !LIVE_TRAIL_WORDS.has(String(stage["runStatus"])));
                     // the params arm rides only when the snapshot NAMES something —
                     // an undefined or empty {} snapshot carries no key (the chip
                     // diffs against live params; an empty diff is no chip at all)
@@ -610,7 +724,7 @@ let DraftsRemoteService = (() => {
                     stage["result"] = patch["result"];
                     stage["resultParams"] = stage["params"];
                     const landingUrls = resultOutputUrls(next);
-                    if (landingUrls.length > 0) {
+                    if (landingUrls.length > 0 && landingTerminal) {
                         archiveInto(landingUrls, {
                             ...next,
                             ...paramsArm(stage["resultParams"]),
@@ -634,6 +748,24 @@ let DraftsRemoteService = (() => {
             // when the body carries no params arm) — judged as half of the
             // (params, inputs) PAIR before either assignment rides.
             let pendingParams;
+            
+            
+            // array (the batch-P corruption family) or boolean body answered
+            // delivered:true with a rev bump while merging NOTHING, and the
+            // bench verb refuses the identical body. The GUI's keystroke
+            // door speaks the bench's voice.
+            if ("params" in patch && patch["params"] !== null &&
+                (typeof patch["params"] !== "object" || Array.isArray(patch["params"]))) {
+                throw new RemoteError("bench/bad-body", "params must be an object", {});
+            }
+            // WHOLE-MAP DELETE (the type comment's promise, S-E1's second
+            // half): the per-key law at map scale — presence IS the write,
+            // and a null params value DELETES the whole map. The empty view
+            // rides the SAME pair-gate below (a delete can orphan a $spell
+            // into a dead wire exactly like a per-key null can).
+            const paramsWholeDelete = "params" in patch && patch["params"] === null;
+            if (paramsWholeDelete)
+                pendingParams = {};
             if ("params" in patch && patch["params"] !== null && typeof patch["params"] === "object" && !Array.isArray(patch["params"])) {
                 // PER-KEY merge (never replace) — the old door's law, now with
                 // JSON Merge Patch null semantics: a null value DELETES the
@@ -745,7 +877,16 @@ let DraftsRemoteService = (() => {
                         .filter((id) => id !== stageId);
                     admitWiring(stage, pendingParams !== undefined
                         ? pendingParams
-                        : (isObj(stage["params"]) ? stage["params"] : {}), mergedInputs, liveIds, stageId, draftId.replace(/^bench-/, ""));
+                        : (isObj(stage["params"]) ? stage["params"] : {}), mergedInputs, liveIds, stageId, draftId.replace(/^bench-/, ""), 
+                    
+                    // author seat tolerates the row's PRE wounds — a
+                    // pre-broken input ref (dead before this patch) must not
+                    // wedge every later keystroke with a 400 on the GUI's own
+                    // param door. The tolerate set is built from the PRE row's
+                    // inputs against the pre-live ids (the assignments below
+                    // have not landed yet), so a fresh dead ref this patch
+                    // introduces stays strict.
+                    toleratedByRow([stage], new Set(liveIds)).get(stageId));
                 }
                 stage["inputs"] = mergedInputs;
             }
@@ -755,16 +896,30 @@ let DraftsRemoteService = (() => {
                 // the raw one — so a doc written here held a self-naming model
                 // key that add/load never store, and the next reader judged a
                 // different object than the one on disk. Strip once, judge that,
-                // store that.
-                stage["params"] = strippedForAdmission(typeof stage["card"] === "string" ? stage["card"] : "", pendingParams);
+                // store that. The whole-map delete takes the key out entirely —
+                // the row goes bare, the same shape a fresh add carries.
+                if (paramsWholeDelete)
+                    delete stage["params"];
+                else
+                    stage["params"] = strippedForAdmission(typeof stage["card"] === "string" ? stage["card"] : "", pendingParams);
             }
             if ("inputOutputs" in patch)
                 stage["inputOutputs"] = patch["inputOutputs"];
             // EVERY GATE PASSED — the telemetry write lands now (deferred
             // above so a refusal left no result behind; the run seat's own
             // polls ride the same door and are judged by nothing, which is
-            // correct: a poll is not a composition)
-            writeTelemetry();
+            // correct: a poll is not a composition).
+            // R6 CURE (round-14 race audit, LOW — telemetry-vs-remove window):
+            // the row this section resolved at its top can be REMOVED while
+            // the gates ran (remove_stage's resume section between the lookup
+            // and this call) — writing into the detached row then persisted
+            // the removal with the outcome written nowhere. Re-resolve the
+            // LIVE row here, immediately before the write: a still-present
+            // row takes the telemetry; a removed row skips the write (its
+            // next poll reads the honest delivered:false at the top lookup).
+            const liveStage = doc["stages"].find((s) => typeof s === "object" && s !== null && s["id"] === stageId);
+            if (liveStage !== undefined)
+                writeTelemetry(liveStage);
             // THE BUMP (author patches only — the telemetry law above): the
             // rev advances and the log carries the entry; a telemetry write
             // persists the row WITHOUT touching the bench block (no bump, no
@@ -899,69 +1054,86 @@ let BenchRemoteService = (() => {
         async *subscribe(sessionKey, signal) {
             signal.throwIfAborted();
             for (;;) {
-                // THE ZERO-STATE LAW (the stream tail's birth watch): a fresh
-                // conversation's bench does not exist until its first write.
-                // The gateway's RemoteStream classifies a REJECTED open as
-                // TERMINAL (no retry — terminalStreamFailure), so a throwing
-                // first read here would kill the browser's whole bench stream
-                // the moment a conversation starts. The watch instead serves
-                // the ZERO STATE (rev 0, empty stages — the same row shape the
-                // client's emptyBench served in the poll era) and stays open:
-                // the birth (ensure's notifyBenchChange) wakes the park and the
-                // next read serves the born bench. `bench/get` still refuses
-                // not-found for direct unary callers — only the WATCH degrades.
-                let row;
+                
+                // watch attaches BEFORE the read, not after the yield. A write
+                // landing while the consumer still holds the delivered row (the
+                // generator suspended at the yield — no park listener attached)
+                // once matched no listener and the park slept until the NEXT
+                // write; the flag re-loops at once instead of parking past it.
+                let changedMidFlight = false;
+                const offWatch = onBenchChange((session) => {
+                    if (session === sessionKey)
+                        changedMidFlight = true;
+                });
                 try {
-                    row = await this.get(sessionKey, signal);
-                }
-                catch (error) {
-                    if (error instanceof RemoteError &&
-                        error.code === "bench/not-found") {
-                        row = {
-                            draft_id: benchDraftIdOf(sessionKey),
-                            session: sessionKey,
-                            rev: 0,
-                            intent: "",
-                            stages: [],
-                            log: [],
-                        };
-                    }
-                    else {
-                        throw error;
+                    // THE ZERO-STATE LAW (the stream tail's birth watch): a fresh
+                    // conversation's bench does not exist until its first write.
+                    // The gateway's RemoteStream classifies a REJECTED open as
+                    // TERMINAL (no retry — terminalStreamFailure), so a throwing
+                    // first read here would kill the browser's whole bench stream
+                    // the moment a conversation starts. The watch instead serves
+                    // the ZERO STATE (rev 0, empty stages — the same row shape the
+                    // client's emptyBench served in the poll era) and stays open:
+                    // the birth (ensure's notifyBenchChange) wakes the park and the
+                    // next read serves the born bench. `bench/get` still refuses
+                    // not-found for direct unary callers — only the WATCH degrades.
+                    let row;
+                    try {
+                        row = await this.get(sessionKey, signal);
                     }
-                }
-                yield row;
-                // wake on the session's next write (or abort). An abort that
-                // landed while the generator was suspended AT A YIELD has no
-                // listener attached — the executor re-checks signal.aborted so
-                // the missed event still wakes the park. The stream then ends
-                // CLEAN on abort (done: true — the holder released; a throw
-                // would surface as an error on a normal close). One finish arm
-                // removes BOTH listeners: no stale abort listener per park.
-                await new Promise((resolve) => {
-                    if (signal.aborted) {
-                        resolve();
-                        return;
+                    catch (error) {
+                        if (error instanceof RemoteError &&
+                            error.code === "bench/not-found") {
+                            row = {
+                                draft_id: benchDraftIdOf(sessionKey),
+                                session: sessionKey,
+                                rev: 0,
+                                intent: "",
+                                stages: [],
+                                log: [],
+                            };
+                        }
+                        else {
+                            throw error;
+                        }
                     }
-                    // One finish arm, no re-entry guard needed: finish detaches
-                    // BOTH listeners before resolving, so it can never run twice
-                    // (the old settled-guard was unreachable by construction).
-                    const offAbort = () => { signal.removeEventListener("abort", onAbort); };
-                    const finish = () => {
-                        offChange();
-                        offAbort();
-                        resolve();
-                    };
-                    const offChange = onBenchChange((session) => {
-                        if (session !== sessionKey)
+                    yield row;
+                    // wake on the session's next write (or abort). An abort that
+                    // landed while the generator was suspended AT A YIELD has no
+                    // park listener attached — the executor re-checks
+                    // signal.aborted AND the mid-flight watch flag (S-S3) so the
+                    // missed event still wakes the park. The stream then ends
+                    // CLEAN on abort (done: true — the holder released; a throw
+                    // would surface as an error on a normal close). One finish arm
+                    // removes BOTH listeners: no stale abort listener per park.
+                    await new Promise((resolve) => {
+                        if (signal.aborted || changedMidFlight) {
+                            resolve();
                             return;
-                        finish();
+                        }
+                        // One finish arm, no re-entry guard needed: finish detaches
+                        // BOTH listeners before resolving, so it can never run twice
+                        // (the old settled-guard was unreachable by construction).
+                        const offAbort = () => { signal.removeEventListener("abort", onAbort); };
+                        const finish = () => {
+                            offChange();
+                            offAbort();
+                            resolve();
+                        };
+                        const offChange = onBenchChange((session) => {
+                            if (session !== sessionKey)
+                                return;
+                            finish();
+                        });
+                        const onAbort = () => { finish(); };
+                        signal.addEventListener("abort", onAbort, { once: true });
                     });
-                    const onAbort = () => { finish(); };
-                    signal.addEventListener("abort", onAbort, { once: true });
-                });
-                if (signal.aborted)
-                    return;
+                    if (signal.aborted)
+                        return;
+                }
+                finally {
+                    offWatch();
+                }
             }
         }
         /** Endpoint `bench/ensure` — birth or load (the only creating arm). */
@@ -996,7 +1168,8 @@ let BenchRemoteService = (() => {
             catch (error) {
                 throw new RemoteError("bench/store-failed", thrownMessage(error), {}, { cause: error });
             }
-            const row = await ensureBench(drafts, doc, benchAdmissionOf(this.ctx));
+            const session = typeof doc["session"] === "string" ? doc["session"] : "";
+            const row = await withBenchWrite(benchDraftIdOf(session), () => ensureBench(drafts, doc, benchAdmissionOf(this.ctx)));
             // ensureBench gates doc.session as a valid key before this line —
             // the row's own session can never differ here (no dead fallback).
             notifyBenchChange(String(doc["session"]));
@@ -1030,27 +1203,33 @@ let BenchRemoteService = (() => {
 
         async remoteExportReorder(sessionKey, doc, signal) {
             signal.throwIfAborted();
-            const drafts = await this.open(signal);
-            const row = await reorderBench(drafts, sessionKey, doc);
-            notifyBenchChange(sessionKey);
-            return row;
+            return withBenchWrite(benchDraftIdOf(sessionKey), async () => {
+                const drafts = await this.open(signal);
+                const row = await reorderBench(drafts, sessionKey, doc);
+                notifyBenchChange(sessionKey);
+                return row;
+            });
         }
         
 
         async remoteExportGroup(sessionKey, doc, signal) {
             signal.throwIfAborted();
-            const drafts = await this.open(signal);
-            const row = await groupBench(drafts, sessionKey, doc, benchAdmissionOf(this.ctx));
-            notifyBenchChange(sessionKey);
-            return row;
+            return withBenchWrite(benchDraftIdOf(sessionKey), async () => {
+                const drafts = await this.open(signal);
+                const row = await groupBench(drafts, sessionKey, doc, benchAdmissionOf(this.ctx));
+                notifyBenchChange(sessionKey);
+                return row;
+            });
         }
         /** Endpoint `bench/ungroup` — spill a compound's children back. */
         async remoteExportUngroup(sessionKey, doc, signal) {
             signal.throwIfAborted();
-            const drafts = await this.open(signal);
-            const row = await ungroupBench(drafts, sessionKey, doc, benchAdmissionOf(this.ctx));
-            notifyBenchChange(sessionKey);
-            return row;
+            return withBenchWrite(benchDraftIdOf(sessionKey), async () => {
+                const drafts = await this.open(signal);
+                const row = await ungroupBench(drafts, sessionKey, doc, benchAdmissionOf(this.ctx));
+                notifyBenchChange(sessionKey);
+                return row;
+            });
         }
         /** Endpoint `bench/undo` — walk the log tail, apply inverses. */
         async remoteExportUndo(sessionKey, doc, signal) {
@@ -1070,45 +1249,57 @@ let BenchRemoteService = (() => {
         }
         async patch(session, doc, signal) {
             signal.throwIfAborted();
-            const drafts = await this.open(signal);
-            const row = await patchBench(drafts, session, doc, benchAdmissionOf(this.ctx));
-            notifyBenchChange(session);
-            return row;
+            return withBenchWrite(benchDraftIdOf(session), async () => {
+                const drafts = await this.open(signal);
+                const row = await patchBench(drafts, session, doc, benchAdmissionOf(this.ctx), laneMigrationOf(this.ctx));
+                notifyBenchChange(session);
+                return row;
+            });
         }
         async addStage(session, doc, signal) {
             signal.throwIfAborted();
-            const drafts = await this.open(signal);
-            const row = await addStageBench(drafts, session, doc, benchAdmissionOf(this.ctx));
-            notifyBenchChange(session);
-            return row;
+            return withBenchWrite(benchDraftIdOf(session), async () => {
+                const drafts = await this.open(signal);
+                const row = await addStageBench(drafts, session, doc, benchAdmissionOf(this.ctx));
+                notifyBenchChange(session);
+                return row;
+            });
         }
         async removeStage(session, doc, signal) {
             signal.throwIfAborted();
-            const drafts = await this.open(signal);
-            const row = await removeStageBench(drafts, session, doc);
-            notifyBenchChange(session);
-            return row;
+            return withBenchWrite(benchDraftIdOf(session), async () => {
+                const drafts = await this.open(signal);
+                const row = await removeStageBench(drafts, session, doc);
+                notifyBenchChange(session);
+                return row;
+            });
         }
         async clear(session, doc, signal) {
             signal.throwIfAborted();
-            const drafts = await this.open(signal);
-            const row = await clearBench(drafts, session, doc);
-            notifyBenchChange(session);
-            return row;
+            return withBenchWrite(benchDraftIdOf(session), async () => {
+                const drafts = await this.open(signal);
+                const row = await clearBench(drafts, session, doc);
+                notifyBenchChange(session);
+                return row;
+            });
         }
         async rewire(session, doc, signal) {
             signal.throwIfAborted();
-            const drafts = await this.open(signal);
-            const row = await rewireBench(drafts, session, doc);
-            notifyBenchChange(session);
-            return row;
+            return withBenchWrite(benchDraftIdOf(session), async () => {
+                const drafts = await this.open(signal);
+                const row = await rewireBench(drafts, session, doc);
+                notifyBenchChange(session);
+                return row;
+            });
         }
         async undo(session, doc, signal) {
             signal.throwIfAborted();
-            const drafts = await this.open(signal);
-            const row = await undoBench(drafts, session, doc, benchAdmissionOf(this.ctx));
-            notifyBenchChange(session);
-            return row;
+            return withBenchWrite(benchDraftIdOf(session), async () => {
+                const drafts = await this.open(signal);
+                const row = await undoBench(drafts, session, doc, benchAdmissionOf(this.ctx));
+                notifyBenchChange(session);
+                return row;
+            });
         }
     };
 })();