@muhkoo/connect 0.15.0-alpha.2 → 0.15.0-alpha.4

package/dist/server/index.js

@@ -6739,7 +6739,7 @@ async function parseOrThrow(response, op) {
  * expect (and isn't serving a stale cached bundle). Keep this in sync with
  * `package.json` `version`.
  */
-const VERSION = "0.15.0-alpha.2";
+const VERSION = "0.15.0-alpha.4";
 
 /**
  * `HttpClient` — the one place the unified {@link Client} talks to the
@@ -9047,6 +9047,45 @@ class StorageCipher {
     }
 }
 
+/** The server's cap on `prefix`, in code points (accelerator `personalKv/list.ts`). */
+const MAX_SERVER_PREFIX_CHARS = 1024;
+/**
+ * The server handed back a cursor it had already given, so following it would
+ * page forever. A fault in the answer, not a failure to reach the server: the
+ * offline layer rethrows it instead of falling back to its cache.
+ */
+class RepeatedCursorError extends Error {
+    constructor() {
+        super("personal-space list: the server repeated a cursor; stopping instead of looping");
+        this.name = "RepeatedCursorError";
+    }
+}
+/** Every key under `prefix` ("" = every key), in the server's order. */
+async function listPersonalKeys(http, path, prefix) {
+    // A prefix over the server's cap would be refused with a 400. Every list
+    // was whole before the key index, so ask for everything instead; the
+    // caller filters. (`length` first: code points never outnumber units.)
+    const sent = prefix.length > MAX_SERVER_PREFIX_CHARS && [...prefix].length > MAX_SERVER_PREFIX_CHARS ? "" : prefix;
+    const keys = [];
+    const seen = new Set();
+    let cursor = null;
+    for (;;) {
+        const res = await http.post(path, cursor === null ? { prefix: sent } : { prefix: sent, cursor });
+        keys.push(...(res?.keys ?? []));
+        // Annotated: without it TypeScript infers `next` through `cursor` and
+        // the request body above, a loop it reports as TS7022.
+        const next = typeof res?.cursor === "string" && res.cursor !== "" ? res.cursor : null;
+        if (next === null)
+            return keys;
+        // A server (or a cache in front of one) that hands back a cursor it
+        // already gave would have this page forever.
+        if (seen.has(next))
+            throw new RepeatedCursorError();
+        seen.add(next);
+        cursor = next;
+    }
+}
+
 /**
  * `client.kv` — per-user key/value storage backed by the accelerator's personal
  * space.
@@ -9054,6 +9093,7 @@ class StorageCipher {
  *   await client.kv.set('todos', id, { title, completed })
  *   const todo = await client.kv.get('todos', id)
  *   const ids  = await client.kv.list('todos')
+ *   const keys = await client.kv.keys('todos/')   // full keys, any prefix
  *   await client.kv.delete('todos', id)
  *   const off  = client.kv.on('change', e => …)   // realtime, cross-device
  *
@@ -9156,25 +9196,45 @@ class KvNamespace {
             return true; // optimistic
         }
     }
-    /** List the ids present in `collection`. */
+    /**
+     * List the ids present in `collection`. The server filters by
+     * `${collection}/` and pages; values are not fetched.
+     */
     async list(collection) {
         const prefix = `${collection}/`;
+        return (await this.keys(prefix)).map((k) => k.slice(prefix.length));
+    }
+    /**
+     * Every key in the signed-in user's personal space that starts with
+     * `prefix` (all of them when it is ""), as full keys: `todos/t1`, not
+     * `t1`. Values are not fetched. The personal space is shared by every
+     * app the user signs into, so expect keys you did not write: the VFS's
+     * `vfs/…`, version control's `vcs/…`, the SDK's own `chat-keys` and
+     * `space-keys/…`.
+     *
+     * The local `startsWith` filter stays on purpose: a server older than
+     * the key index ignores `prefix` and returns every key.
+     */
+    async keys(prefix = "") {
         const offline = this.deps.offline;
-        const fromKeys = (keys) => keys.filter((k) => k.startsWith(prefix)).map((k) => k.slice(prefix.length));
-        if (!offline?.enabled) {
-            const res = await this.deps.http.post(this.spacePath("/list"), {});
-            return fromKeys(res.keys ?? []);
-        }
+        const under = (keys) => [...new Set(keys.filter((k) => k.startsWith(prefix)))];
+        const remote = () => listPersonalKeys(this.deps.http, this.spacePath("/list"), prefix);
+        if (!offline?.enabled)
+            return under(await remote());
         try {
-            const res = await this.deps.http.post(this.spacePath("/list"), {});
+            const fromServer = await remote();
             // Union with cached live keys so un-synced offline creates still show.
-            const cached = await offline.liveKeys(this.commitment());
-            return [...new Set([...(res.keys ?? []), ...cached].filter((k) => k.startsWith(prefix)))].map((k) => k.slice(prefix.length));
+            return under([...fromServer, ...(await offline.liveKeys(this.commitment(), prefix))]);
         }
         catch (err) {
-            if (err instanceof HttpError)
+            // A refusal, or a server that repeats its cursor, is an answer,
+            // not an outage: falling back would hand back a partial list as
+            // if it were whole. Only a failure to reach the server (even
+            // mid-paging) falls back to the cache, as a failed list did
+            // before paging.
+            if (err instanceof HttpError || err instanceof RepeatedCursorError)
                 throw err;
-            return fromKeys(await offline.liveKeys(this.commitment()));
+            return under(await offline.liveKeys(this.commitment(), prefix));
         }
     }
     /** Reserved — server-side query is deferred (see the overhaul plan). */
@@ -15145,20 +15205,25 @@ function nextTurn() {
  *
  * Every mutation is a read-modify-write of exactly ONE directory record, so a
  * write cannot leave the tree half-updated: either the parent names the new
- * child or it does not. Two tabs writing different directories never conflict;
- * two tabs (or devices) writing the SAME directory are last-writer-wins. A VFS
- * write sends no HLC and the personal space has no compare-and-swap: it applies
- * puts of one key in the order they arrive, so whichever arrives last is kept,
- * and the other tab's edit is lost. Orphaned records (a directory whose parent
- * entry lost the race) are unreachable rather than corrupting — they cost
- * storage until a future sweep, which is the trade this shape makes in
+ * child or it does not. A VFS write sends no HLC and the personal space has
+ * no compare-and-swap: of two writes of one key it keeps whichever arrives
+ * last.
+ *
+ * Within ONE namespace, writes of a record are sent one at a time, in the
+ * order they were made - edits made while one is in flight go out together
+ * in the next (see `queue`) - and a read that has to fetch a record waits for
+ * its write in flight (see `writing`). Every edit of a record is made to one
+ * in-memory copy of it, and that copy is what is written (see `mutate`).
+ *
+ * Between the tabs of an app on one device, a coordinator (`VfsCoordinator`;
+ * `Client` wires one in a browser tab) gives each record one lock, and a tab
+ * reads a record another tab has written again before its next write of it
+ * (see `sendLocked`). Between devices - or a browser and the CLI - two writes
+ * of the same directory are still last-writer-wins, and the other edit is
+ * lost: that takes a compare-and-swap at the server. Orphaned records (a
+ * directory whose parent entry lost the race) are unreachable rather than
+ * corrupting - they cost storage until a sweep, the trade this shape makes in
  * exchange for single-record writes.
- *
- * Within ONE tab, writes of a record are queued and sent one at a time, in the
- * order they were made, and a read that has to fetch a record waits for its
- * write in flight (see `writing`). That ordering is per namespace instance
- * only; nothing orders writes across tabs or devices - that would take a
- * compare-and-swap at the server.
  */
 /** Refuse a directory at `path` if it would be deeper than MAX_DEPTH from the root. */
 function assertWritableDepth(path) {
@@ -15362,6 +15427,50 @@ function assertNotHidden(dir, name, path) {
         throw new VfsConflictError(`${printable(path, 1024)} already exists, but this version cannot read it; a recursive delete removes it`);
     }
 }
+/**
+ * Is `now` still the entry an operation read at a name before it waited on
+ * something? The same kind and id, and for a file the same version; a move
+ * mark set or cleared in between does not count. Absent both times is the same.
+ * Where a decision rests on the mark, `markedMeanwhile` checks that as well.
+ */
+function sameEntry(before, now) {
+    if (!before || !now)
+        return before === now;
+    if (before.kind !== now.kind || before.id !== now.id)
+        return false;
+    return before.kind === "dir" || (now.kind === "file" && now.manifest.id === before.manifest.id);
+}
+/**
+ * Has a move marked the entry at a name since an operation read it there
+ * unmarked? Then a move of it is under way - see `DirEntry.moving` - and it is
+ * about to be named in a second place, which a decision made from the unmarked
+ * read did not allow for.
+ */
+function markedMeanwhile(before, now) {
+    return now.moving === true && before.moving !== true;
+}
+/** Refuse a write because another write changed `path` while this one waited. See `VfsNamespace.mutate`. */
+function changedMeanwhile(path) {
+    return new VfsConflictError(`${path} was changed by another write while this one was in progress; nothing was written over it`);
+}
+/**
+ * Refuse an operation on `path` because this namespace is moving it - or,
+ * `inside`, something in it. See `VfsNamespace.inMotion`.
+ */
+function beingMoved(path, inside = false) {
+    const what = inside ? `something in ${path} is` : `${path} is`;
+    return new VfsConflictError(`${what} being moved; nothing was changed - try again once the move has finished`);
+}
+/**
+ * Refuse an operation on `path` because a move or a delete of it - or,
+ * `inside`, of it or of something in it - holds its move lock on this
+ * device: in another tab of the app, or in this one. See
+ * `VfsCoordinator.holdMoving`.
+ */
+function heldElsewhere(path, inside = false) {
+    const what = inside ? `${path}, or something in it, is` : `${path} is`;
+    return new VfsConflictError(`${what} being moved or deleted in this app, in this tab or another; nothing was changed - try again once that has finished`);
+}
 /** A JSON object, as opposed to null, an array or a scalar. */
 function isObject$1(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -15519,6 +15628,13 @@ function followable(dir) {
 function unfollowable(dir) {
     return Object.values(dir.hidden).filter((value) => !readableEntry(value)).length;
 }
+/** The id of every entry `dir` follows, and whether an entry with that id is marked: `SubtreeShape`'s view of it. */
+function namedIn(dir) {
+    const named = new Map();
+    for (const [, entry] of followable(dir))
+        named.set(entry.id, named.get(entry.id) === true || entry.moving === true);
+    return named;
+}
 class VfsNamespace {
     deps;
     rootKey = null;
@@ -15528,8 +15644,25 @@ class VfsNamespace {
      * The file tree re-lists constantly while typing, and every miss is a
      * network round trip plus a decrypt. Invalidated precisely on write rather
      * than by TTL — a stale directory listing shows files that are not there.
+     *
+     * What a cached read resolves to is also THE copy of that record: the one
+     * every edit of it is made to, and the one written. See `mutate`.
      */
     cache = new Map();
+    /**
+     * Bumped by `clearCache`, which is for a change of identity.
+     *
+     * A read or write begun before it can finish after it, and what it read
+     * or wrote belongs to whoever was signed in before. So every record
+     * carries the generation it was read under, and none goes into the cache,
+     * or is edited as the cache's copy, under another.
+     */
+    generation = 0;
+    /**
+     * The record each promise in `cache` resolved to, and each write in
+     * `writing` is sending: what `editable` finds without waiting.
+     */
+    copyOf = new WeakMap();
     /**
      * The write of each directory record still in flight, by id.
      *
@@ -15544,6 +15677,81 @@ class VfsNamespace {
      * `openDirById`.
      */
     writing = new Map();
+    /**
+     * Every entry this namespace is moving right now, by id.
+     *
+     * A move between two directories marks the entry before it puts it in
+     * the second (see `rename`), and a mark is all a later operation can
+     * see. It cannot tell a move still writing from one that was
+     * interrupted, and was taken for the second: a delete that began after
+     * a move had marked a folder looked for the folder's other half, found
+     * none yet, and purged it while the move was putting it in its new
+     * place; a second move of a file finished the "interrupted" move and
+     * left it named in two places. So a move holds its entry here until it
+     * has taken it from where it was, and `rename` and `delete` refuse an
+     * entry that is here - or, for a delete, a folder holding one. A delete
+     * holds what it deletes the same way: see `deleting`.
+     *
+     * This set is one namespace's. With a coordinator, a move also holds
+     * the entry's move lock for every tab on the device, for as long as the
+     * entry is here: see `VfsCoordinator.holdMoving`.
+     */
+    inMotion = new Set();
+    /**
+     * What each delete under way in this namespace is deleting, by entry id,
+     * one set per delete: its target from the moment it has found the target
+     * not in `inMotion`, and everything it read below the target once it has
+     * read it. Each delete lets go of its own set when it is done.
+     *
+     * A delete waits after it has read what it will let go of: on more
+     * reads, and on a read of the whole tree for the other half of a move.
+     * A move of any of it that started meanwhile could put it in its new
+     * place, fail to take it from the old, and end, all before the delete's
+     * detach. Ended, it was no longer in `inMotion`; and an entry that was
+     * marked already showed no change. So the delete let go of what the
+     * move had just named somewhere else. Now `rename` refuses an entry that
+     * is here, or one on a way from the root that passes through a folder
+     * that is: everything below a delete's target, read yet or not.
+     */
+    deleting = new Set();
+    /**
+     * The write of each record that has not gone out yet, by id: the one
+     * the next edit of that record joins. See `queue`.
+     */
+    waiting = new Map();
+    /**
+     * Announcements heard from other tabs, counted. `heardAt` is the count
+     * at the last one for each record, `missedAt` the count when some may
+     * have been missed. A copy read after both holds every write announced:
+     * see `current`.
+     */
+    hearing = 0;
+    missedAt = 0;
+    heardAt = new Map();
+    /**
+     * Each record a write of which this namespace marked as begun and could
+     * not count, and has said so, until one is counted. And whether it has
+     * said that a write it could not mark or count may be lost, which it
+     * says only once. See `notCounted`.
+     */
+    uncounted = new Set();
+    lossWarned = false;
+    /**
+     * The copy of each record this namespace is writing under the record's
+     * lock, by id, from when it has decided what to write until it has
+     * counted the write, or failed to. Its counter reads as unknown
+     * meanwhile, as this write has begun and is not counted yet, but the
+     * copy holds every write of the record another tab has counted, and no
+     * other tab can make one until this one lets go of the lock. See
+     * `dropStale`.
+     */
+    locked = new Map();
+    /**
+     * Each directory a `createDir` here has named whose write has not landed
+     * yet, by entry id: a promise that settles - and never rejects - once
+     * that write has landed or failed. See `mkdir`.
+     */
+    naming = new Map();
     historyLimit;
     maxEntries;
     maxPathChars;
@@ -15552,6 +15760,8 @@ class VfsNamespace {
         this.historyLimit = deps.historyLimit ?? DEFAULT_HISTORY_LIMIT;
         this.maxEntries = deps.limits?.entries ?? DEFAULT_MAX_ENTRIES;
         this.maxPathChars = deps.limits?.pathChars ?? DEFAULT_MAX_PATH_CHARS;
+        // Another tab's write of a record leaves this tab's copy of it out of date: see `heard`.
+        deps.coordinator?.onAnnounce((id) => this.heard(id));
     }
     /**
      * The working directory relative paths resolve against.
@@ -15600,7 +15810,11 @@ class VfsNamespace {
      * identity's directories to another would be the worst possible bug here.
      */
     clearCache() {
+        // Whatever is still being read or written for the identity before
+        // stays out of the cache from here on: see `generation`.
+        this.generation++;
         this.cache.clear();
+        this.heardAt.clear();
         this.rootKey = null;
         this._cwd = "/"; // a different identity's tree has different directories
     }
@@ -15905,21 +16119,26 @@ class VfsNamespace {
         assertValidName(name);
         await this.mkdir(dirname(target), { recursive: true });
         const parent = await this.openDir(dirname(target));
-        const prior = entryIn(parent.node, name);
-        if (prior?.kind === "dir")
+        if (entryIn(parent.node, name)?.kind === "dir")
             throw new VfsConflictError(`${target} is a directory`);
         await this.deps.content.retain(manifest);
-        const entry = {
-            kind: "file",
-            id: prior?.id ?? newId(),
-            manifest,
-            size,
-            mtime: Date.now(),
-            versions: asCount(prior?.versions),
-            // Still half of an interrupted move, if it was: see DirEntry.moving.
-            ...(prior?.moving === true ? { moving: true } : {}),
-        };
+        let entry;
         await this.mutate(parent, (node) => {
+            // Whatever is at the name now, after the wait above, is what
+            // this replaces - and what it takes the id and history from.
+            const prior = entryIn(node, name);
+            if (prior?.kind === "dir")
+                throw new VfsConflictError(`${target} is a directory`);
+            entry = {
+                kind: "file",
+                id: prior?.id ?? newId(),
+                manifest,
+                size,
+                mtime: Date.now(),
+                versions: asCount(prior?.versions),
+                // Still half of an interrupted move, if it was: see DirEntry.moving.
+                ...(prior?.moving === true ? { moving: true } : {}),
+            };
             node.entries[name] = entry;
         });
         return toStat(target, name, entry);
@@ -15943,8 +16162,22 @@ class VfsNamespace {
             const name = parts[i];
             const isLast = i === parts.length - 1;
             const next = join(current, name);
-            const dir = await this.openDir(current);
-            const existing = entryIn(dir.node, name);
+            let dir = await this.openDir(current);
+            let existing = entryIn(dir.node, name);
+            // Named by a mkdir here whose write has not landed. Until it has,
+            // the name is a promise, not a fact: with a coordinator, that edit
+            // is made again under the lock to the folder as another tab left
+            // it, and comes to nothing when that tab named a directory there
+            // first - and whatever was saved meanwhile into the one named
+            // here is in a directory nothing names. A failed write drops it
+            // too. So wait for the write, and look again.
+            let unwritten = existing && this.naming.get(existing.id);
+            while (unwritten) {
+                await unwritten;
+                dir = await this.openDir(current);
+                existing = entryIn(dir.node, name);
+                unwritten = existing && this.naming.get(existing.id);
+            }
             if (!existing)
                 assertNotHidden(dir, name, next);
             if (existing) {
@@ -15956,7 +16189,7 @@ class VfsNamespace {
             else {
                 if (!isLast && !opts.recursive)
                     throw new VfsNotFoundError(current);
-                await this.createDir(current, name);
+                await this.createDir(current, name, next, opts.recursive === true);
             }
             current = next;
         }
@@ -16016,12 +16249,22 @@ class VfsNamespace {
         let versions = asCount(prior?.versions);
         if (prior)
             versions = await this.pushHistory(parent, name, prior, target, manifest);
-        const entry = {
-            kind: "file", id, manifest, size, mtime: Date.now(), versions,
-            // Still half of an interrupted move, if it was: see DirEntry.moving.
-            ...(prior?.moving === true ? { moving: true } : {}),
-        };
+        let entry;
         await this.mutate(parent, (node) => {
+            // The version just pushed onto the history was `prior`. If
+            // another write has replaced or removed it since, it is not the
+            // version this one overwrites, and writing on regardless would
+            // lose that write - from the file, and from its history.
+            const now = entryIn(node, name);
+            if (now?.kind === "dir")
+                throw new VfsConflictError(`${target} is a directory`);
+            if (!sameEntry(prior, now))
+                throw changedMeanwhile(target);
+            entry = {
+                kind: "file", id, manifest, size, mtime: Date.now(), versions,
+                // Still half of an interrupted move, if it was: see DirEntry.moving.
+                ...(now?.moving === true ? { moving: true } : {}),
+            };
             node.entries[name] = entry;
         });
         return toStat(target, name, entry);
@@ -16056,83 +16299,223 @@ class VfsNamespace {
             const where = printable(target, 1024);
             if (!opts.recursive)
                 throw new VfsConflictError(`${where} cannot be read by this version; a recursive delete removes it`);
-            await this.mutate(parent, () => void delete parent.hidden[name]);
+            await this.mutate(parent, (_node, record) => void delete record.hidden[name]);
             this.warn(`removed ${where} without clearing out what it held: this version cannot read it`);
             return;
         }
-        // Every directory above the target, the root first. None of them is
-        // part of what is being deleted, whatever an entry below says.
-        const above = new Set(opened.chain);
-        // Three steps, in this order: read everything the delete will touch,
-        // detach the entry, then let go of what it held.
-        //
-        // Letting go came first once, and the entry was detached last. Any
-        // failure in between - a network error, most simply - left the entry
-        // in place with some of its content already released, and the obvious
-        // next step, trying again, released that content a SECOND time.
-        // Content is reference-counted and shared by copies, so that freed
-        // bytes another file still used. Now a failure before the detach has
-        // changed nothing, and nothing after it can fail: releasing is
-        // best-effort, and a leak is the safe way to be wrong.
-        let doomed = [];
-        // Whether any of it is half of an interrupted move. See below.
-        let moving = entry.kind === "file" && entry.moving === true;
-        if (entry.kind === "dir" && above.has(entry.id)) {
-            // The entry IS a pointer to a directory above it - the root, or
-            // this entry's own parent. Removing the pointer is what was asked
-            // for; clearing out what it points at would delete everything
-            // around the target, the target included.
-            if (!opts.recursive)
-                throw new VfsConflictError(`${target} is not empty`);
-            this.warn(`detaching ${target} without clearing it out: it is a directory above it in the tree`);
-        }
-        else if (entry.kind === "dir") {
-            const child = await this.openDirById(entry.id, fromBase64(entry.key), target).catch((err) => {
-                // An unreadable directory must still be removable, or the user
-                // is stuck with an error they can do nothing about. Its subtree
-                // cannot be enumerated, so it is detached rather than purged and
-                // whatever it holds is left for sweep(). Only when asked for
-                // recursively: without that we cannot know it is empty.
-                if (!(err instanceof VfsCorruptRecordError) || !opts.recursive)
-                    throw err;
-                this.warn(`detaching ${target} without clearing it out: its record cannot be read`);
-                return null;
-            });
-            if (child) {
-                // Entries this version cannot read still count: calling the
-                // directory empty would delete them along with it.
-                const empty = !Object.keys(child.node.entries).length && !Object.keys(child.hidden).length;
-                if (!empty && !opts.recursive)
+        // Being moved by this namespace: it is marked already, or about to be,
+        // and on its way to a second place. Letting go of it here would let
+        // go of what the move puts there. See `inMotion`.
+        if (this.inMotion.has(entry.id))
+            throw beingMoved(target);
+        // And from here until it is done, a move of it, or of anything below
+        // it, that begins in this namespace is refused. See `deleting`.
+        const claim = new Set([entry.id]);
+        this.deleting.add(claim);
+        // On this device, the move locks of the target and of everything read
+        // below it. See below.
+        let release = null;
+        try {
+            // Every directory above the target, the root first. None of them is
+            // part of what is being deleted, whatever an entry below says.
+            const above = new Set(opened.chain);
+            // Three steps, in this order: read everything the delete will touch,
+            // detach the entry, then let go of what it held.
+            //
+            // Letting go came first once, and the entry was detached last. Any
+            // failure in between - a network error, most simply - left the entry
+            // in place with some of its content already released, and the obvious
+            // next step, trying again, released that content a SECOND time.
+            // Content is reference-counted and shared by copies, so that freed
+            // bytes another file still used. Now a failure before the detach has
+            // changed nothing, and nothing after it can fail: releasing is
+            // best-effort, and a leak is the safe way to be wrong.
+            let doomed = [];
+            // What each of them named when it was read, for the check before the detach.
+            let shape = new Map();
+            // Every id found below the target: claimed once it has all been read,
+            // re-checked against `inMotion` at the detach and, with a coordinator,
+            // whose move locks it holds. See below.
+            let ids = new Set();
+            // Whether any of it is half of an interrupted move. See below.
+            let moving = entry.kind === "file" && entry.moving === true;
+            if (entry.kind === "dir" && above.has(entry.id)) {
+                // The entry IS a pointer to a directory above it - the root, or
+                // this entry's own parent. Removing the pointer is what was asked
+                // for; clearing out what it points at would delete everything
+                // around the target, the target included.
+                if (!opts.recursive)
                     throw new VfsConflictError(`${target} is not empty`);
-                const found = await this.subtree(child, target, above);
-                doomed = found.dirs;
-                moving = entry.moving === true || found.moving;
+                this.warn(`detaching ${target} without clearing it out: it is a directory above it in the tree`);
+            }
+            else if (entry.kind === "dir") {
+                const child = await this.openDirById(entry.id, fromBase64(entry.key), target).catch((err) => {
+                    // An unreadable directory must still be removable, or the user
+                    // is stuck with an error they can do nothing about. Its subtree
+                    // cannot be enumerated, so it is detached rather than purged and
+                    // whatever it holds is left for sweep(). Only when asked for
+                    // recursively: without that we cannot know it is empty.
+                    if (!(err instanceof VfsCorruptRecordError) || !opts.recursive)
+                        throw err;
+                    this.warn(`detaching ${target} without clearing it out: its record cannot be read`);
+                    return null;
+                });
+                if (child) {
+                    // Entries this version cannot read still count: calling the
+                    // directory empty would delete them along with it.
+                    const empty = !Object.keys(child.node.entries).length && !Object.keys(child.hidden).length;
+                    if (!empty && !opts.recursive)
+                        throw new VfsConflictError(`${target} is not empty`);
+                    const found = await this.subtree(child, target, above);
+                    // Something in it is being moved by this namespace: the same
+                    // as the target being moved, a level down.
+                    for (const id of found.ids)
+                        if (this.inMotion.has(id))
+                            throw beingMoved(target, true);
+                    for (const id of found.ids)
+                        claim.add(id);
+                    doomed = found.dirs;
+                    shape = found.shape;
+                    ids = found.ids;
+                    moving = entry.moving === true || found.moving;
+                }
             }
+            // On this device, the move lock of the target and of everything read
+            // below it, held from here until what they held has been let go of.
+            // A move in another tab holds the lock of what it moves until it has
+            // taken it from where it was. A delete that found it marked looked
+            // for its other half before the move had put it there, found none,
+            // and let go of what the move then named in its new place; one that
+            // was writing the parent let a move of something below start, and
+            // then purged it. Held here, a move of any of it that is under way
+            // refuses this delete, and none can start until it is done. What it
+            // does not cover - anything named below since it was read - the check
+            // in the edit refuses. See `VfsCoordinator.holdMoving`.
+            //
+            // Taken before the look for the other half of a move below, not
+            // after it: a move in another tab that began during that look could
+            // put the entry in its new place, fail to take it from the old, and
+            // let go of its lock, all before this took it - and what it named
+            // was let go of here. Not before the reads above, which find what is
+            // below. A move in another tab that begins during them still holds
+            // its lock here if it is under way, and this delete is refused;
+            // ended, it came before the look and the checks below, which read
+            // again what it wrote. See below.
+            const coordinator = this.deps.coordinator;
+            // What the look and the checks below must read again.
+            let stale = new Set();
+            if (coordinator) {
+                release = await this.holdAll(coordinator, [entry.id, ...ids]);
+                if (!release)
+                    throw heldElsewhere(target, ids.size > 0);
+                // A move that let go of its lock just before this took it had
+                // counted its writes by then, though this tab may not have heard
+                // of them: what was read above that another tab has written
+                // since is read again - every record cached, for the look, which
+                // reads the whole tree. A move that took a file out of a folder
+                // read above, from this tab's old copy, had that file let go of
+                // with the folder; one that went from the other half of a move
+                // to a folder this tab's old copy did not show it in had the
+                // content it took with it let go of. See `dropStale`.
+                //
+                // And the way to the target, looked up before anything else.
+                // A delete in another tab of a folder on it had let go of the
+                // target's lock, which it held, only once it had counted its
+                // write of the folder above the one it deleted - but it purged
+                // that one, and all below, which counts nothing. Gone on from
+                // the old copies, this wrote the purged parent back and let go
+                // of what the target held a second time, while a copy of it, or
+                // a commit, still named that content. So what on the way has
+                // been written since it was read is read again, and the way is
+                // looked up again, as a move's way to where it goes is: it must
+                // lead to the same entry, through the same folders, not marked
+                // since.
+                //
+                // Looked up again even when nothing on it is out of date now:
+                // a write of this tab's own may have read a folder on it again,
+                // under that folder's lock, after the look above, and counted
+                // its write. That copy is current by now, and no longer what the
+                // look saw.
+                const read = doomed.map((dir) => dir.id);
+                stale = await this.dropStale(coordinator, [...opened.chain, ...(moving ? this.cache.keys() : []), ...read]);
+                const again = await this.openChain(dirname(target));
+                if (!again)
+                    throw new VfsNotFoundError(dirname(target));
+                if (again.chain.some((id, i) => id !== opened.chain[i]))
+                    throw changedMeanwhile(dirname(target));
+                const now = entryIn(again.dir.node, name);
+                if (!now)
+                    throw new VfsNotFoundError(target);
+                if (!sameEntry(entry, now) || markedMeanwhile(entry, now))
+                    throw changedMeanwhile(target);
+            }
+            // A move between two directories that was interrupted leaves what it
+            // moved named in both, and letting go of it here would take it from
+            // the other copy: the directory record purged with every file in it,
+            // or a file's content and history released. Only a marked entry can
+            // be one of those (see `rename`), so only then is the whole tree
+            // read, once, to find out what is still named elsewhere. Still before
+            // anything changes: a failure here leaves the tree as it was.
+            const elsewhere = moving ? await this.namedElsewhere(parent.id, name) : undefined;
+            // The check in the edit below looks at each record to be purged as it
+            // is then, which needs it to hand: a change reported meanwhile may
+            // have dropped one from the cache, and so may the counters above.
+            // Read again, it is still checked against what was read before.
+            for (const dir of doomed)
+                if (stale.has(dir.id) || !this.editable(dir))
+                    await this.reopen(dir);
+            let purging = doomed;
+            await this.mutate(parent, (node) => {
+                // What is let go of below is what `entry` held. Gone since, it
+                // was let go of already; replaced, the name holds something this
+                // delete has not read. Marked since, a move of it has begun, and
+                // what it holds is about to be named somewhere `elsewhere` did
+                // not see - if it was looked for at all.
+                const now = entryIn(node, name);
+                if (!now)
+                    throw new VfsNotFoundError(target);
+                if (!sameEntry(entry, now) || markedMeanwhile(entry, now))
+                    throw changedMeanwhile(target);
+                // Marked already when this delete read it, a move that has since
+                // taken the entry - or something below it - would not mark it a
+                // second time, so `markedMeanwhile` and `currentSubtree` would not
+                // see it either. `inMotion` is live, not a snapshot, so it still
+                // does: re-checked here, at the last moment before the detach.
+                // Since `deleting`, a move here cannot begin on any of it once
+                // this delete has claimed it, so these are a second guard.
+                if (this.inMotion.has(entry.id))
+                    throw beingMoved(target);
+                for (const id of ids)
+                    if (this.inMotion.has(id))
+                        throw beingMoved(target, true);
+                // And what is purged is what the records below hold now - unless
+                // something in them has been moved, or begun to move, since they
+                // were read; or, with a coordinator, named there since, as its
+                // move lock is not held. See `currentSubtree`.
+                const current = this.currentSubtree(doomed, shape, coordinator ? ids : undefined);
+                if (!current)
+                    throw changedMeanwhile(target);
+                purging = current;
+                delete node.entries[name];
+            });
+            if (elsewhere === null) {
+                // Part of the tree cannot be read, so it is unknown whether the
+                // other copy is in it. Keeping what may be its contents costs
+                // storage until a sweep; letting go of them could lose them.
+                this.warn(`detached ${target} but kept what it held: a move of it was interrupted, and part of the tree cannot be read to find the other copy`);
+                return;
+            }
+            if (entry.kind === "dir")
+                await this.purge(purging, elsewhere, opts.keepContent);
+            else
+                await this.letGo(new Map([[entry.id, [{ dir: parent, entry }]]]), elsewhere, opts.keepContent);
+            if (elsewhere && entry.moving === true)
+                await this.settle(entry.id, elsewhere);
         }
-        // A move between two directories that was interrupted leaves what it
-        // moved named in both, and letting go of it here would take it from
-        // the other copy: the directory record purged with every file in it,
-        // or a file's content and history released. Only a marked entry can
-        // be one of those (see `rename`), so only then is the whole tree
-        // read, once, to find out what is still named elsewhere. Still before
-        // anything changes: a failure here leaves the tree as it was.
-        const elsewhere = moving ? await this.namedElsewhere(parent.id, name) : undefined;
-        await this.mutate(parent, (node) => {
-            delete node.entries[name];
-        });
-        if (elsewhere === null) {
-            // Part of the tree cannot be read, so it is unknown whether the
-            // other copy is in it. Keeping what may be its contents costs
-            // storage until a sweep; letting go of them could lose them.
-            this.warn(`detached ${target} but kept what it held: a move of it was interrupted, and part of the tree cannot be read to find the other copy`);
-            return;
+        finally {
+            release?.();
+            this.deleting.delete(claim);
         }
-        if (entry.kind === "dir")
-            await this.purge(doomed, elsewhere, opts.keepContent);
-        else
-            await this.letGo(new Map([[entry.id, [{ dir: parent, entry }]]]), elsewhere, opts.keepContent);
-        if (elsewhere && entry.moving === true)
-            await this.settle(entry.id, elsewhere);
     }
     /**
      * Move or rename. Works across directories, which is the same operation:
@@ -16155,47 +16538,216 @@ class VfsNamespace {
         const srcName = basename(src);
         const dstName = basename(dst);
         assertValidName(dstName);
-        const srcParent = await this.openDir(dirname(src));
+        const source = await this.openChain(dirname(src));
+        if (!source)
+            throw new VfsNotFoundError(dirname(src));
+        const srcParent = source.dir;
         const entry = entryIn(srcParent.node, srcName);
         if (!entry)
             throw new VfsNotFoundError(src);
-        if (entry.kind === "dir") {
-            assertWritableDepth(dst);
-            if (segments(dst).length > segments(src).length)
-                await this.assertFitsAt(src, dst);
-        }
-        await this.mkdir(dirname(dst), { recursive: true });
-        const dstParent = await this.openDir(dirname(dst));
-        if (entryIn(dstParent.node, dstName))
-            throw new VfsConflictError(`${dst} already exists`);
-        assertNotHidden(dstParent, dstName, dst);
+        // Another move of it is under way here. Its mark cannot tell that
+        // move from an interrupted one, and finishing it as one named the
+        // entry in two places. Held from here, before the first wait, so two
+        // moves begun together cannot both get past this. See `inMotion`.
+        if (this.inMotion.has(entry.id))
+            throw beingMoved(src);
+        // A delete here has begun on it, or on a folder on its way from the
+        // root. Moved now, it could be put in its new place just before the
+        // delete let go of what it holds. Not the root, which no delete is
+        // of: one claims it only through an entry below that names it, and
+        // lets go of nothing of it. In the same step as the check above, as
+        // a delete makes its claim in the same step as its own. See
+        // `deleting`.
+        const lineage = [entry.id, ...source.chain.slice(1)];
+        if ([...this.deleting].some((claim) => lineage.some((id) => claim.has(id))))
+            throw heldElsewhere(src);
+        this.inMotion.add(entry.id);
         // Each record is re-opened before it is written: creating the
-        // destination's parents above may have written to the source's.
+        // destination's parents below may have written to the source's.
         const edit = (path, change) => this.openDir(path).then((dir) => this.mutate(dir, change));
-        if (dstParent.id === srcParent.id) {
-            // One record, so one write: the move happens entirely or not at all.
+        let unmarkLanded = false;
+        // The same for every tab of the app on this device: the entry's move
+        // lock, held for as long as it is in `inMotion`. Another tab's move
+        // or delete of it holds it, and taking that move's mark for an
+        // interrupted one named the entry in two places, or purged it. See
+        // `VfsCoordinator.holdMoving`.
+        let release = null;
+        // And the locks of the folders on the way to where it goes, shared,
+        // for as long. See below.
+        let into = null;
+        try {
+            const coordinator = this.deps.coordinator;
+            if (coordinator) {
+                release = await coordinator.holdMoving(entry.id);
+                if (!release)
+                    throw heldElsewhere(src);
+                // The look above was at this tab's copies of the folders on the
+                // way to the entry. A delete in another tab of the entry, or of
+                // a folder on that way, may have finished before this took the
+                // lock, which the delete held: it had counted its writes by
+                // then, though this tab may not have heard of them. Moved
+                // regardless, the entry was marked in a record the delete had
+                // purged, and named in its new place with its content let go
+                // of. So whatever on the way another tab has written since it
+                // was read is read again, and the entry looked for again.
+                if ((await this.dropStale(coordinator, source.chain)).size) {
+                    const again = await this.openChain(dirname(src));
+                    if (!again)
+                        throw new VfsNotFoundError(dirname(src));
+                    if (again.chain.some((id, i) => id !== source.chain[i]))
+                        throw changedMeanwhile(dirname(src));
+                    const now = entryIn(again.dir.node, srcName);
+                    if (!now)
+                        throw new VfsNotFoundError(src);
+                    if (!sameEntry(entry, now) || markedMeanwhile(entry, now))
+                        throw changedMeanwhile(src);
+                }
+            }
+            if (entry.kind === "dir") {
+                assertWritableDepth(dst);
+                if (segments(dst).length > segments(src).length)
+                    await this.assertFitsAt(src, dst);
+            }
+            await this.mkdir(dirname(dst), { recursive: true });
+            const way = await this.openChain(dirname(dst));
+            if (!way)
+                throw new VfsNotFoundError(dirname(dst));
+            let dstParent = way.dir;
+            if (coordinator && dstParent.id !== ROOT_ID) {
+                // The folder it goes into, and every folder above that one
+                // but the root, held shared: other moves into any of them
+                // share them, and a delete of one - which holds the lock of
+                // its target and of everything it read below - holds it
+                // alone. A move into a folder that another tab was deleting
+                // put what it moved in a record the delete then purged: in no
+                // listing, its content kept. Not that folder alone: it may be
+                // new since the delete read the tree - made by the `mkdir`
+                // above, or by another tab - and the delete does not hold a
+                // lock it did not read. Its target's is on the way here. The
+                // root is never deleted.
+                into = await this.holdAll(coordinator, way.chain.slice(1), true);
+                if (!into)
+                    throw heldElsewhere(dirname(dst));
+                // A delete of one of them may have finished since they were
+                // looked up, and counted its write of the folder above before
+                // it let go of their locks, though this tab may not have
+                // heard of it: read again whatever on the way another tab has
+                // written since it was read, and look again. Gone, or another
+                // folder anywhere on the way, the move stops here, before its
+                // mark.
+                await this.dropStale(coordinator, way.chain);
+                const again = await this.openChain(dirname(dst));
+                if (!again)
+                    throw new VfsNotFoundError(dirname(dst));
+                if (again.chain.some((id, i) => id !== way.chain[i]))
+                    throw changedMeanwhile(dirname(dst));
+                dstParent = again.dir;
+            }
+            if (entryIn(dstParent.node, dstName))
+                throw new VfsConflictError(`${dst} already exists`);
+            assertNotHidden(dstParent, dstName, dst);
+            // Both ends were looked at before the waits above, and another write
+            // may have changed either since: replaced the entry being moved, or
+            // put something at the destination. Moving on regardless would write
+            // the old entry over the new one, or this one over the other. Or
+            // marked the entry: another move of it has begun. Taking it as well
+            // would name it in two places, and each move would unmark its own.
+            const take = (node) => {
+                const now = entryIn(node, srcName);
+                if (!now || !sameEntry(entry, now) || markedMeanwhile(entry, now))
+                    throw changedMeanwhile(src);
+                return now;
+            };
+            const free = (node, record) => {
+                if (entryIn(node, dstName))
+                    throw new VfsConflictError(`${dst} already exists`);
+                assertNotHidden(record, dstName, dst);
+            };
+            if (dstParent.id === srcParent.id) {
+                // One record, so one write: the move happens entirely or not at all.
+                await edit(dirname(src), (node, record) => {
+                    const moved = take(node);
+                    free(node, record);
+                    delete node.entries[srcName];
+                    node.entries[dstName] = { ...moved, mtime: Date.now() };
+                });
+                return;
+            }
+            // Two records, attached before detaching: interrupted, the entry is
+            // in both rather than in neither. Both copies are marked for as long
+            // as that can be so, because they share everything below them, and a
+            // delete of either would otherwise let go of the other's contents.
+            // An entry already marked is half of an earlier interrupted move, and
+            // keeps its mark.
+            const marked = entry.moving === true;
+            let moved = entry;
+            if (!marked) {
+                await edit(dirname(src), (node) => {
+                    moved = take(node);
+                    node.entries[srcName] = { ...moved, moving: true };
+                });
+            }
+            // Whether the edit below has put the entry at the destination: set
+            // as its last step, after every check, each time it runs.
+            let attached = false;
+            try {
+                await edit(dirname(dst), (node, record) => {
+                    attached = false;
+                    free(node, record);
+                    node.entries[dstName] = { ...moved, moving: true, mtime: Date.now() };
+                    attached = true;
+                });
+            }
+            catch (err) {
+                // Refused before it put anything at the destination - another
+                // write took the name first - so the entry is still in one
+                // place only, and the mark this move put on it would stay for
+                // good: on a file, every version that falls off its history
+                // kept; on either, every delete of it reading the whole tree.
+                // Not when the write failed instead: the destination may hold
+                // the entry by now, and the mark is what keeps a delete of
+                // either copy from letting go of the other's. Best-effort.
+                if (!marked && !attached) {
+                    await edit(dirname(src), (node) => {
+                        const now = entryIn(node, srcName);
+                        if (now?.id !== entry.id || now.moving !== true)
+                            return false;
+                        node.entries[srcName] = unmarked(now);
+                        return true;
+                    }).catch(() => { });
+                }
+                throw err;
+            }
+            // A file's history is sealed with its directory's key, and from here
+            // on the directory that opens it is this one.
+            if (entry.kind === "file")
+                await this.rekeyHistory(entry.id, [srcParent.key], dstParent.key);
             await edit(dirname(src), (node) => {
+                // Gone already leaves nothing to detach, and nothing to write.
+                // Replaced, it is not this entry to take away: the move stops
+                // here, in both places. Not `take`: the entry is marked by now,
+                // by this move or the earlier one it finishes.
+                const now = entryIn(node, srcName);
+                if (!now)
+                    return false;
+                if (!sameEntry(entry, now))
+                    throw changedMeanwhile(src);
                 delete node.entries[srcName];
-                node.entries[dstName] = { ...entry, mtime: Date.now() };
+                // Explicit, as in `createDir` and `settle`: noImplicitReturns.
+                return true;
             });
-            return;
+            unmarkLanded = !marked;
         }
-        // Two records, attached before detaching: interrupted, the entry is
-        // in both rather than in neither. Both copies are marked for as long
-        // as that can be so, because they share everything below them, and a
-        // delete of either would otherwise let go of the other's contents.
-        // An entry already marked is half of an earlier interrupted move, and
-        // keeps its mark.
-        const marked = entry.moving === true;
-        if (!marked)
-            await edit(dirname(src), (node) => void (node.entries[srcName] = { ...entry, moving: true }));
-        await edit(dirname(dst), (node) => void (node.entries[dstName] = { ...entry, moving: true, mtime: Date.now() }));
-        // A file's history is sealed with its directory's key, and from here
-        // on the directory that opens it is this one.
-        if (entry.kind === "file")
-            await this.rekeyHistory(entry.id, [srcParent.key], dstParent.key);
-        await edit(dirname(src), (node) => void delete node.entries[srcName]);
-        if (!marked) {
+        finally {
+            // Named in one place from here, the destination. A delete of it
+            // there goes ahead as for an entry an interrupted move left marked
+            // - which the Trash's "delete forever" relies on while the mark is
+            // still being cleared.
+            this.inMotion.delete(entry.id);
+            release?.();
+            into?.();
+        }
+        if (unmarkLanded) {
             await edit(dirname(dst), (node) => {
                 const landed = entryIn(node, dstName);
                 if (landed?.id === entry.id)
@@ -16267,13 +16819,19 @@ class VfsNamespace {
         // its first write, instead of after up to a whole budget's worth of
         // records and references, all left unreachable. The records are
         // cached by then, so the real pass costs writes, not fetches.
+        const gen = this.generation;
         const run = (write) => ({
-            from: src, to: dst, write, entries: this.maxEntries, pathChars: this.maxPathChars, reached: new Map(), sinceTurn: 0,
+            from: src, to: dst, write, entries: this.maxEntries, pathChars: this.maxPathChars, reached: new Map(), sinceTurn: 0, gen,
         });
         const depth = segments(dst).length;
         await this.cloneEntry(found.entry, src, run(false), null, depth);
         const copied = await this.cloneEntry(found.entry, src, run(true), null, depth);
-        await this.mutate(dstParent, (node) => {
+        await this.mutate(dstParent, (node, record) => {
+            // Looked at before the copy was made, which takes as long as the
+            // tree is big: another write may have taken the name since.
+            if (entryIn(node, dstName))
+                throw new VfsConflictError(`${dst} already exists`);
+            assertNotHidden(record, dstName, dst);
             node.entries[dstName] = copied;
         });
         return toStat(dst, dstName, copied);
@@ -16294,11 +16852,12 @@ class VfsNamespace {
      * Delete metadata records no longer reachable from the root.
      *
      * These accumulate because every write touches exactly one record: if two
-     * tabs or devices edit the same directory, the personal space keeps
-     * whichever put arrives last (a VFS write sends no HLC, and the space
-     * applies puts of one key in arrival order), which can leave a child whose
-     * parent entry lost the race. The per-record write queue (`writing`) only
-     * orders writes within one tab. Unreachable is harmless —
+     * devices edit the same directory - or two tabs, where there is no
+     * coordinator - the personal space keeps whichever put arrives last (a
+     * VFS write sends no HLC, and the space applies puts of one key in arrival
+     * order), which can leave a child whose parent entry lost the race. The
+     * per-record queue and the coordinator order writes within one device
+     * only. Unreachable is harmless —
      * it is invisible and undecryptable-by-nobody — but it costs storage, so
      * this reclaims it.
      *
@@ -16307,6 +16866,12 @@ class VfsNamespace {
      * Run it when the filesystem is idle.
      */
     async sweep(opts = {}) {
+        // With a coordinator: what another tab has written since this tab
+        // read it is read again, not followed in an old copy that may not
+        // name what it now names - which would then be deleted here.
+        const coordinator = this.deps.coordinator;
+        if (coordinator)
+            await this.dropStale(coordinator, [...this.cache.keys()]);
         const root = await this.root();
         // A record that cannot be read throws out of here, before anything is
         // deleted: with part of the tree unknown, "unreachable" is a guess.
@@ -16331,8 +16896,10 @@ class VfsNamespace {
         }
         // Only ever consider OUR records: the personal space is shared with
         // chat keys, space keys and the legacy file mirror, and a sweep that
-        // reached beyond its own namespace would be a data-loss bug.
-        const mine = (await this.deps.store.list()).filter((k) => /^vfs\/[dh]\//.test(k));
+        // reached beyond its own namespace would be a data-loss bug. The store
+        // is asked for `vfs/` only; the regex stays, because `vfs/space` is
+        // under `vfs/` too and a store may ignore the prefix.
+        const mine = (await this.deps.store.list("vfs/")).filter((k) => /^vfs\/[dh]\//.test(k));
         const orphans = mine.filter((k) => !reachable.has(k));
         // A root that read as EMPTY while orphans exist is the shape of a failed
         // load, not of a fresh filesystem — deleting here would wipe a tree we
@@ -16372,16 +16939,21 @@ class VfsNamespace {
         if (!version)
             throw new VfsNotFoundError(`${target} version ${index}`);
         const versions = await this.pushHistory(parent, name, entry, target, version.manifest);
-        const restored = {
-            kind: "file",
-            id: entry.id,
-            manifest: version.manifest,
-            size: asCount(version.size),
-            mtime: Date.now(),
-            versions,
-            ...(entry.moving === true ? { moving: true } : {}),
-        };
+        let restored;
         await this.mutate(parent, (node) => {
+            // As for writeFile: the version pushed onto the history was `entry`.
+            const now = entryIn(node, name);
+            if (!sameEntry(entry, now))
+                throw changedMeanwhile(target);
+            restored = {
+                kind: "file",
+                id: entry.id,
+                manifest: version.manifest,
+                size: asCount(version.size),
+                mtime: Date.now(),
+                versions,
+                ...(now?.moving === true ? { moving: true } : {}),
+            };
             node.entries[name] = restored;
         });
         return toStat(target, name, restored);
@@ -16411,8 +16983,15 @@ class VfsNamespace {
         const seed = this.deps.seed();
         if (!seed)
             throw new VfsLockedError();
-        if (!this.rootKey)
-            this.rootKey = await deriveRootKey(seed);
+        if (!this.rootKey) {
+            const gen = this.generation;
+            const key = await deriveRootKey(seed);
+            // Derived from the seed of whoever was signed in before a
+            // clearCache: start again, with the seed of whoever is now.
+            if (gen !== this.generation)
+                return this.root();
+            this.rootKey = key;
+        }
         return this.openDirById(ROOT_ID, this.rootKey, "/");
     }
     /** Open a directory by path, creating nothing. Throws if it is missing. */
@@ -16449,6 +17028,11 @@ class VfsNamespace {
         const hit = this.cache.get(id);
         if (hit)
             return hit;
+        // Before anything is read, so that from here on this namespace hears
+        // of any later write of the record by another tab. Starting to hear -
+        // for the first time, or for someone else - clears the cache (see
+        // `heard`), which is why it comes before this read is cached.
+        this.deps.coordinator?.listen();
         // The PROMISE goes in the cache, not the resolved value.
         //
         // Reading a project means resolving hundreds of paths that share the
@@ -16456,6 +17040,7 @@ class VfsNamespace {
         // every concurrent reader to miss and fire its own request for the same
         // record — which is how loading one project turned into thousands of
         // identical `vfs/d/<id>` fetches, most of them in flight at once.
+        const gen = this.generation;
         // Reads `pending` only after its first `await`: before that, the const is not yet initialised.
         const load = async () => {
             // Not while a write of this record is still in flight: see
@@ -16474,7 +17059,9 @@ class VfsNamespace {
                 awaited = inFlight;
                 await inFlight.catch(() => { });
             }
-            if (awaited) {
+            // Not after a clearCache, though: the cache now is the next
+            // identity's, and this read only answers whoever asked for it.
+            if (awaited && gen === this.generation) {
                 // A write that landed put the record it wrote back in the
                 // cache, and the next edit of this directory is made to that.
                 // Answer with it rather than fetch a second copy: two copies
@@ -16491,31 +17078,7 @@ class VfsNamespace {
                 if (!now)
                     this.cache.set(id, pending);
             }
-            const raw = await this.deps.store.get(dirKey(id));
-            // An absent record is an EMPTY directory, not an error: the root
-            // exists before anything has been written to it, and a directory is
-            // created by its parent naming it rather than by its own record
-            // appearing.
-            if (raw === null || raw === undefined) {
-                const node = { v: 1, entries: emptyEntries(), mtime: Date.now() };
-                return { id, key, path, node, hidden: Object.create(null) };
-            }
-            // Present but unopenable is NOT absent. `unseal` folds the two
-            // together, which suits a record that can simply be rebuilt; a
-            // directory cannot, because rebuilding it means sealing an empty
-            // one over whatever is really there. And it is not a raw
-            // DOMException either: the typed error is what delete, purge and
-            // sweep know how to step around, and it names the record.
-            let value;
-            try {
-                value = await openSealed(key, raw);
-            }
-            catch (err) {
-                if (err instanceof SealedRecordError)
-                    throw new VfsCorruptRecordError(id, path, err.message);
-                throw err;
-            }
-            return this.readRecord(id, key, value, path);
+            return this.fetchRecord(id, key, gen, path);
         };
         const pending = load().catch((err) => {
             // A failed read must not be remembered, or one blip poisons the
@@ -16524,9 +17087,61 @@ class VfsNamespace {
                 this.cache.delete(id);
             throw err;
         });
+        // Registered before anyone else can wait on it, so it is known by
+        // the time any of them goes on to edit the record: see `editable`.
+        pending.then((dir) => void this.copyOf.set(pending, dir), () => { });
         this.cache.set(id, pending);
         return pending;
     }
+    /**
+     * Fetch record `id` from the store and open it. Whatever another tab
+     * announced before the fetch began is in what it returns (see
+     * `current`), and so is every write its counter counts: read here, or
+     * given as `counter` (see `OpenDir.counter`).
+     */
+    async fetchRecord(id, key, gen, path, counter) {
+        const seen = this.hearing;
+        // Before the fetch, never after it. A write that lands in between
+        // then only makes this copy look out of date, which costs a read;
+        // read after, the counter could count a write the answer missed.
+        // Without a coordinator there is none, and nothing is awaited: a read
+        // in Node takes the turns it always took.
+        if (counter === undefined)
+            counter = this.deps.coordinator ? await this.counterOf(id) : null;
+        const raw = await this.deps.store.get(dirKey(id));
+        // An absent record is an EMPTY directory, not an error: the root
+        // exists before anything has been written to it, and a directory is
+        // created by its parent naming it rather than by its own record
+        // appearing.
+        if (raw === null || raw === undefined) {
+            const node = { v: 1, entries: emptyEntries(), mtime: Date.now() };
+            return { id, key, path, node, hidden: Object.create(null), gen, seen, counter };
+        }
+        // Present but unopenable is NOT absent. `unseal` folds the two
+        // together, which suits a record that can simply be rebuilt; a
+        // directory cannot, because rebuilding it means sealing an empty
+        // one over whatever is really there. And it is not a raw
+        // DOMException either: the typed error is what delete, purge and
+        // sweep know how to step around, and it names the record.
+        let value;
+        try {
+            value = await openSealed(key, raw);
+        }
+        catch (err) {
+            if (err instanceof SealedRecordError)
+                throw new VfsCorruptRecordError(id, path, err.message);
+            throw err;
+        }
+        return this.readRecord(id, key, value, gen, seen, counter, path);
+    }
+    /** Record `id`'s write counter now: see `OpenDir.counter`. */
+    async counterOf(id) {
+        const coordinator = this.deps.coordinator;
+        if (!coordinator)
+            return null;
+        const [counter] = await coordinator.counters([id]).catch(() => [null]);
+        return counter ?? null;
+    }
     /**
      * Turn a decrypted record into an OpenDir, or throw.
      *
@@ -16534,7 +17149,7 @@ class VfsNamespace {
      * see VfsCorruptRecordError. An individual entry of the wrong shape is set
      * aside in `hidden` instead: out of every read, but kept for the write.
      */
-    readRecord(id, key, value, path) {
+    readRecord(id, key, value, gen, seen, counter, path) {
         const problem = recordProblem(value);
         if (problem)
             throw new VfsCorruptRecordError(id, path, problem);
@@ -16590,25 +17205,46 @@ class VfsNamespace {
             this.warn(`ignoring ${what} in ${path ?? `record ${printable(id, 40)}`}`);
         }
         // A v1 record's unknown top-level fields survive a write too.
-        return { id, key, path, node: { ...top, entries }, hidden };
+        return { id, key, path, node: { ...top, entries }, hidden, gen, seen, counter };
     }
-    /** Apply an edit to a directory record and persist it. */
+    /**
+     * Apply an edit to a directory record and persist it.
+     *
+     * `dir` says which record - its id, key and path - and nothing more. The
+     * edit is made to THE copy of that record (see `editable`), which `dir`
+     * may no longer be, and that copy is what is written. Editing whichever
+     * copy the caller held let two copies of one record exist at once: an
+     * overwrite held its directory across storing the old version's
+     * history, a write of the directory failed meanwhile and dropped it from
+     * the cache, and a save that then read a second copy and stored it,
+     * successfully, was undone when the overwrite stored the first.
+     *
+     * So `edit` must take what it writes from the record it is given, not
+     * from anything read off `dir` before an await - and re-check whatever it
+     * relies on from then, throwing if another write changed it, before it
+     * changes anything. Returning false writes nothing after all.
+     *
+     * The write that carries the edit may carry others, made while an
+     * earlier write of the record was in flight (see `queue`): it lands, or
+     * fails, for all of them at once.
+     *
+     * With a coordinator, the edit may be made a second time, to the record
+     * as another tab left it, and refused then (see `replay`): an edit must
+     * check everything before it changes anything, and whatever it sets
+     * outside `node` and `record` must be safe to set again, since each run
+     * overwrites the last.
+     */
     async mutate(dir, edit) {
-        edit(dir.node);
-        dir.node.mtime = Date.now();
-        // A write to a hidden entry's exact name replaces it: that name now
-        // means what this version wrote. Forgetting the old one here is also
-        // what stops a later delete of the replacement from resurrecting it.
-        for (const name of Object.keys(dir.hidden)) {
-            if (Object.hasOwn(dir.node.entries, name))
-                delete dir.hidden[name];
-        }
-        // Not sent until any earlier write of this record has landed: see
-        // `writing`. Whether that one worked or not, this one still goes.
-        const before = this.writing.get(dir.id);
-        const send = () => this.writeRecord(dir);
-        const write = before ? before.then(send, send) : send();
-        this.writing.set(dir.id, write);
+        // At once when the copy is to hand, which it almost always is, so
+        // that what the caller checked just before is still true when the
+        // edit is made.
+        const target = this.editable(dir) ?? await this.reopen(dir);
+        if (edit(target.node, target) === false)
+            return;
+        this.touch(target);
+        const ticket = { edit };
+        const batch = this.queue(target, ticket);
+        const { write } = batch;
         try {
             await write;
         }
@@ -16624,15 +17260,309 @@ class VfsNamespace {
             // included, so the cache shows what is about to be stored, and
             // dropping it would only send readers to the store for an older
             // copy. If that write fails too, it drops the cache itself.
-            if (this.writing.get(dir.id) === write)
-                this.cache.delete(dir.id);
+            //
+            // Nor from a cache cleared since: that is the next identity's.
+            if (this.writing.get(target.id) === write && target.gen === this.generation)
+                this.cache.delete(target.id);
             throw err;
         }
         finally {
-            if (this.writing.get(dir.id) === write)
-                this.writing.delete(dir.id);
+            if (this.writing.get(target.id) === write)
+                this.writing.delete(target.id);
+        }
+        this.adopt(target);
+        // Made again to the record as another tab left it, it no longer
+        // applied - see `replay` - and nothing of it was written.
+        if (batch.refused.has(ticket))
+            throw batch.refused.get(ticket);
+    }
+    /**
+     * The copy of `dir`'s record that edits are made to, if there is one
+     * without waiting: the one the cache holds, once read.
+     *
+     * Failing that, the one a write in flight is sending. The record was
+     * dropped from the cache - a change was reported, our own write's echo
+     * among them - and a read that came in since is waiting for that write,
+     * to answer with this very copy if it lands (see `openDirById`); if it
+     * fails, the write an edit now queues behind it carries the copy instead.
+     *
+     * Undefined when the record is not cached and nothing is writing it, or
+     * it is still being read: `reopen` waits for that. A record read before
+     * `clearCache` is edited as it is, as it always was. It is not the copy of
+     * anything the cache holds now, and must not be handed the next identity's.
+     */
+    editable(dir) {
+        if (dir.gen !== this.generation)
+            return dir;
+        const cached = this.cache.get(dir.id);
+        const write = this.writing.get(dir.id);
+        const copy = (cached && this.copyOf.get(cached)) ?? (write && this.copyOf.get(write));
+        return copy?.gen === this.generation ? copy : undefined;
+    }
+    /**
+     * Read `dir`'s record - the cached read, or a fetch made once any write of
+     * it in flight has settled - and then find the copy edits are made to.
+     */
+    async reopen(dir) {
+        for (;;) {
+            await this.openDirById(dir.id, dir.key, dir.path);
+            // What that read answered with, unless a change has dropped it
+            // from the cache again since: then read it again.
+            const copy = this.editable(dir);
+            if (copy)
+                return copy;
+        }
+    }
+    /** Make `dir` the cached copy of its record - unless the cache has been cleared since it was read. */
+    adopt(dir) {
+        if (dir.gen !== this.generation)
+            return;
+        const cached = Promise.resolve(dir);
+        this.copyOf.set(cached, dir);
+        this.cache.set(dir.id, cached);
+    }
+    /** After an edit of `copy`: its time, and any entry it cannot read that the edit replaced. */
+    touch(copy) {
+        copy.node.mtime = Date.now();
+        // A write to a hidden entry's exact name replaces it: that name now
+        // means what this version wrote. Forgetting the old one here is also
+        // what stops a later delete of the replacement from resurrecting it.
+        for (const name of Object.keys(copy.hidden)) {
+            if (Object.hasOwn(copy.node.entries, name))
+                delete copy.hidden[name];
+        }
+    }
+    /**
+     * The write that will carry the edit just made to `copy`.
+     *
+     * Writes of a record go out one at a time, each once the one before it
+     * has landed or failed (see `writing`), and each seals the record as it
+     * stands when it goes out. So a write still waiting carries every edit
+     * made while it waits, and an edit made then joins it instead of
+     * queueing a write of its own: a burst of edits of one directory while a
+     * write of it is in flight costs two writes, not one per edit. Each is a
+     * billed write; a 20-file upload into one folder cost twenty.
+     */
+    queue(copy, ticket) {
+        const open = this.waiting.get(copy.id);
+        if (open?.copy === copy) {
+            open.edits.push(ticket);
+            return open;
+        }
+        const before = this.writing.get(copy.id);
+        const batch = { copy, edits: [ticket], refused: new Map() };
+        this.waiting.set(copy.id, batch);
+        // Not sent until any earlier write of this record has landed: see
+        // `writing`. Whether that one worked or not, this one still goes.
+        const send = () => this.send(batch);
+        batch.write = before ? before.then(send, send) : send();
+        this.copyOf.set(batch.write, copy);
+        this.writing.set(copy.id, batch.write);
+        return batch;
+    }
+    /**
+     * Send `batch`: from here on, an edit of its record goes in the next
+     * write. With a coordinator, holding the lock every tab of the device
+     * takes to write this record - see `sendLocked`.
+     */
+    send(batch) {
+        const coordinator = this.deps.coordinator;
+        if (!coordinator) {
+            this.close(batch);
+            return this.writeRecord(batch.copy);
+        }
+        // Closed under the lock once it is sealed (see `sendLocked`), and
+        // here too, for a lock never granted or a re-read that failed: left
+        // open, a later edit of the same copy would join a write that has
+        // already failed, and fail with it.
+        return coordinator.lock(batch.copy.id, () => this.sendLocked(batch, coordinator)).finally(() => this.close(batch));
+    }
+    /** Stop `batch` taking more edits, as it is sealed. */
+    close(batch) {
+        if (this.waiting.get(batch.copy.id) === batch)
+            this.waiting.delete(batch.copy.id);
+    }
+    /**
+     * Send `batch` while no other tab can write its record.
+     *
+     * If another tab wrote the record since this copy was read, the copy is
+     * out of date, and writing it would undo that tab's write. So it is read
+     * again, here, under the lock, and every edit the batch carries is made
+     * again to what was read (see `replay`). A copy no other tab has written
+     * over is sent as it is: one tab on its own costs no extra request.
+     *
+     * Which it is, the record's write counter says (see
+     * `VfsCoordinator.counters`). Read once the lock is granted, it counts
+     * every write of the record another tab made, because each counts its
+     * write, and waits for the count to be stored, before it lets go of the
+     * lock. If it has moved since the copy was read, or cannot be told, the
+     * copy is read again. Whether this tab has heard of another tab's write
+     * does not decide it: an announcement can reach this tab after the
+     * lock does, or never. One it has heard of can only add a read.
+     *
+     * The write is counted once it has landed or failed - one that failed
+     * may have landed even so - and the other tabs are then told of it,
+     * all before the lock is let go of.
+     */
+    async sendLocked(batch, coordinator) {
+        const { copy } = batch;
+        // Hearing for whoever is signed in now, before deciding: starting to
+        // hear - or hearing someone else - marks every copy out of date.
+        coordinator.listen();
+        const now = await coordinator.begin(copy.id).catch(() => null);
+        // Whether `copy` is, from here, the record as this tab leaves it.
+        let decided = false;
+        let sent = false;
+        try {
+            const current = now !== null && copy.counter === now && this.current(copy);
+            const fresh = copy.gen === this.generation && !current
+                ? await this.fetchRecord(copy.id, copy.key, copy.gen, copy.path, null)
+                : null;
+            // Nothing waits from here to the seal, so no edit can come in between.
+            this.close(batch);
+            decided = true;
+            this.locked.set(copy.id, copy);
+            if (fresh && !this.replay(batch, fresh))
+                return;
+            sent = true;
+            await this.writeRecord(copy);
+            copy.seen = this.hearing;
+        }
+        finally {
+            const counted = await coordinator.bump(copy.id).catch(() => null);
+            // Not when the read above failed: the copy is what it was, and
+            // the counter it held is out of date now.
+            if (decided)
+                copy.counter = counted;
+            if (this.locked.get(copy.id) === copy)
+                this.locked.delete(copy.id);
+            if (counted === null)
+                this.notCounted(copy, now !== null);
+            else
+                this.uncounted.delete(copy.id);
+            if (sent)
+                coordinator.announce(copy.id);
+        }
+    }
+    /**
+     * Say that a write of `copy`'s record could not be counted.
+     *
+     * `marked`: `VfsCoordinator.begin` stored its mark, which stays until a
+     * count can be stored, so every tab reads the record again before it
+     * writes it. Said once for each record, until a write of it is counted.
+     *
+     * Not marked, a tab whose IndexedDB works may take its copy for current
+     * and write it over this write. Said once for this namespace, whatever
+     * the record: where IndexedDB cannot be used at all, no write of any
+     * folder is counted, and a warning for each said nothing new. And only
+     * where another tab can count its writes can one be lost, which the
+     * warning says: where no tab can, every tab reads each folder again.
+     */
+    notCounted(copy, marked) {
+        const where = copy.path ?? `record ${printable(copy.id, 40)}`;
+        if (!marked) {
+            if (this.lossWarned)
+                return;
+            this.lossWarned = true;
+            this.warn(`a write of ${where} by this tab could not be counted in IndexedDB, where this app's other tabs look before writing a folder. Such a write may be lost only if another tab of this app can count its writes: that tab may write the folder without reading it again. Said once per Client, for every write of a folder that cannot be counted`);
+            return;
+        }
+        if (this.uncounted.has(copy.id))
+            return;
+        this.uncounted.add(copy.id);
+        this.warn(`a write of ${where} by this tab could not be counted in IndexedDB; until one can be, every tab of this app reads ${where} again before writing it`);
+    }
+    /**
+     * Make every edit in `batch` again, in order, to `fresh` - the record as
+     * another tab left it - and make that the copy. An edit that no longer
+     * applies throws, as it would have the first time, and is left out; its
+     * caller gets what it threw. Every edit checks before it changes
+     * anything (see `mutate`), so one that throws has changed nothing. True
+     * when what is left changes the record, and so needs writing.
+     */
+    replay(batch, fresh) {
+        const { copy } = batch;
+        copy.node = fresh.node;
+        copy.hidden = fresh.hidden;
+        copy.seen = fresh.seen;
+        copy.counter = fresh.counter;
+        let changed = false;
+        for (const ticket of batch.edits) {
+            try {
+                if (ticket.edit(copy.node, copy) !== false)
+                    changed = true;
+            }
+            catch (err) {
+                batch.refused.set(ticket, err);
+            }
+        }
+        if (changed)
+            this.touch(copy);
+        return changed;
+    }
+    /**
+     * Another tab wrote record `id` - or, null, this namespace may have
+     * missed some announcements. What the cache holds is read again when
+     * next asked for, as a change frame from the personal space would have
+     * it, and a copy read before then is read again before the next write
+     * of its record (see `current`). A hint, not a guarantee: an
+     * announcement can reach this tab after the next lock does, or never.
+     * What decides whether a copy may be written over, or relied on under a
+     * move's or a delete's locks, is the record's counter: see `sendLocked`
+     * and `dropStale`.
+     */
+    heard(id) {
+        const at = ++this.hearing;
+        if (id === null) {
+            this.missedAt = at;
+            this.cache.clear();
+            return;
         }
-        this.cache.set(dir.id, Promise.resolve(dir));
+        this.heardAt.set(id, at);
+        this.cache.delete(id);
+    }
+    /**
+     * Does `copy` hold every write of its record another tab has announced
+     * that this one has heard of? See `heard`. Only ever a reason to read it
+     * again, never to take it for current: see `sendLocked`.
+     */
+    current(copy) {
+        return copy.seen >= Math.max(this.missedAt, this.heardAt.get(copy.id) ?? 0);
+    }
+    /**
+     * Drop from the cache every copy of a record in `ids` that may not hold
+     * every write of it another tab has made: its counter has moved since
+     * the copy was read, or cannot be told, or the copy is still being read.
+     * Returns every id whose copy here is not known to be current - those,
+     * and those not cached - so that the next read of each fetches it again,
+     * once any write of it in flight here has landed or failed. Not a copy
+     * this tab is writing under its lock (see `locked`): its counter reads
+     * as unknown only because that write is not counted yet, and dropped,
+     * the next read would wait for the write.
+     *
+     * The counters are read in one go, after the caller has taken the locks
+     * it relies on: another tab counts each write of a record before it lets
+     * go of the locks it held while writing it, the record's own and any
+     * move lock, so what it wrote before letting go of one of them is
+     * counted by then. Its announcements may not have reached this tab yet,
+     * or ever. See `sendLocked`.
+     */
+    async dropStale(coordinator, ids) {
+        const asked = [...new Set(ids)];
+        const now = asked.length ? await coordinator.counters(asked).catch(() => asked.map(() => null)) : [];
+        const stale = new Set();
+        asked.forEach((id, i) => {
+            const cached = this.cache.get(id);
+            const copy = cached && this.copyOf.get(cached);
+            if (copy && copy.gen === this.generation && copy.counter !== null && copy.counter === now[i])
+                return;
+            if (copy && copy.gen === this.generation && this.locked.get(id) === copy)
+                return;
+            if (cached)
+                this.cache.delete(id);
+            stale.add(id);
+        });
+        return stale;
     }
     /**
      * Seal a directory record as it stands NOW and put it in the store.
@@ -16660,13 +17590,38 @@ class VfsNamespace {
         }
         await this.deps.store.put(dirKey(dir.id), sealed);
     }
-    async createDir(parentPath, name) {
+    /** For `mkdir`: name a new, empty directory `path` in the one at `parentPath`. */
+    async createDir(parentPath, name, path, recursive) {
         assertValidName(name);
         const parent = await this.openDir(parentPath);
         const entry = { kind: "dir", id: newId(), key: toBase64(newDirKey()), mtime: Date.now() };
-        await this.mutate(parent, (node) => {
+        // The directory the edit below last found there, if any.
+        let there;
+        const named = this.mutate(parent, (node, record) => {
+            // mkdir looked before the wait above. A directory made there
+            // since, by another `mkdir -p` of the same path - files saved
+            // at once into a new folder - is kept, not replaced: whatever
+            // was saved into it would go with it.
+            const now = entryIn(node, name);
+            there = now;
+            if (now?.kind === "dir" && recursive)
+                return false;
+            if (now)
+                throw new VfsConflictError(`${path} ${now.kind === "dir" ? "already exists" : "is a file"}`);
+            assertNotHidden(record, name, path);
             node.entries[name] = entry;
+            return true;
         });
+        // Set before anyone can find the entry in the cached parent - `mutate`
+        // makes the edit at once, or after a re-read - so a mkdir that finds
+        // it there waits for this write. See `naming`.
+        this.naming.set(entry.id, named.then(() => { }, () => { }).then(() => void this.naming.delete(entry.id)));
+        await named;
+        // The directory kept instead may be one another mkdir here named,
+        // its write not landed yet: wait for that too, as `mkdir` does.
+        const kept = there && this.naming.get(there.id);
+        if (kept)
+            await kept;
     }
     /**
      * Every directory record in a subtree, each once, opened - and nothing
@@ -16682,14 +17637,22 @@ class VfsNamespace {
      *
      * `moving` says whether anything in it is marked as half of an
      * interrupted move, which is what makes a delete look for the other half.
+     *
+     * `ids` is every entry id in it, and `shape` what each record named when
+     * it was read: see `currentSubtree`.
      */
     async subtree(top, target, above) {
         const found = new Map([[top.id, top]]);
         const pending = [top];
+        // Every entry id in it, and what each record named as it was read.
+        const ids = new Set();
+        const shape = new Map();
         let spared = 0;
         let moving = false;
         for (let dir = pending.pop(); dir; dir = pending.pop()) {
+            shape.set(dir.id, namedIn(dir));
             for (const [, entry] of followable(dir)) {
+                ids.add(entry.id);
                 if (entry.moving === true)
                     moving = true;
                 if (entry.kind !== "dir" || found.has(entry.id))
@@ -16719,7 +17682,79 @@ class VfsNamespace {
             const what = spared === 1 ? "a directory that is" : `${spared} directories that are`;
             this.warn(`leaving ${what} above ${target} in the tree alone while deleting it`);
         }
-        return { dirs: [...found.values()], moving };
+        return { dirs: [...found.values()], moving, ids, shape };
+    }
+    /**
+     * The records a recursive delete read, as they are now - or null when
+     * one has changed since in a way that purging it would get wrong.
+     *
+     * The delete decided what to let go of, and whether to look for the
+     * other half of a move, from what it read; then it waited, on reads and
+     * on the write of its parent. A record that is no longer named by the
+     * record it was read in has been moved out, and is not this delete's to
+     * purge; an entry marked since it was read is being moved, and is about
+     * to be named somewhere the delete never looked. Purging either purged
+     * the folder a move had just put somewhere else. Anything else - a file
+     * saved into one of them, or moved out - is purged as it now stands,
+     * which is why the copies to purge are what this returns.
+     *
+     * Synchronous, for an edit. A record whose copy is not to hand counts as
+     * changed.
+     *
+     * `held`, with a coordinator, is every entry whose move lock the delete
+     * holds. An entry named since the records were read - saved or moved in
+     * - is not among them, so nothing stops another tab moving it out while
+     * the delete writes the parent, and purging it then let go of what that
+     * move had put somewhere else. So with `held`, that counts as changed
+     * too, and the delete is tried again from the start.
+     */
+    currentSubtree(dirs, shape, held) {
+        const doomed = new Set(dirs.map((dir) => dir.id));
+        const current = [];
+        for (const dir of dirs) {
+            const now = this.editable(dir);
+            if (!now)
+                return null;
+            const read = shape.get(dir.id) ?? new Map();
+            const named = namedIn(now);
+            for (const [id, marked] of named)
+                if (marked && read.get(id) !== true)
+                    return null;
+            for (const id of read.keys())
+                if (doomed.has(id) && !named.has(id))
+                    return null;
+            if (held)
+                for (const id of named.keys())
+                    if (!held.has(id))
+                        return null;
+            current.push(now);
+        }
+        return current;
+    }
+    /**
+     * Hold the move lock of every entry in `ids` - see
+     * `VfsCoordinator.holdMoving` - or of none: null when another holder has
+     * any of them, and then nothing is held. Otherwise the function that
+     * lets go of them all. Asked for all at once: none of them waits.
+     * `shared` holds them as the folders a move goes into.
+     */
+    async holdAll(coordinator, ids, shared = false) {
+        const tries = await Promise.allSettled([...new Set(ids)].map((id) => coordinator.holdMoving(id, shared)));
+        const held = tries.flatMap((tried) => (tried.status === "fulfilled" && tried.value ? [tried.value] : []));
+        const release = () => {
+            for (const letGo of held)
+                letGo();
+        };
+        const failed = tries.find((tried) => tried.status === "rejected");
+        if (failed) {
+            release();
+            throw failed.reason;
+        }
+        if (held.length < tries.length) {
+            release();
+            return null;
+        }
+        return release;
     }
     /**
      * Delete these records and let go of every file in them. The second half
@@ -16775,8 +17810,15 @@ class VfsNamespace {
             // Opened again: this delete may have written to it since the tree was read.
             const dir = await this.openDirById(holding[0].id, holding[0].key);
             const name = Object.keys(dir.node.entries).find((n) => dir.node.entries[n].id === id && dir.node.entries[n].moving === true);
-            if (name !== undefined)
-                await this.mutate(dir, (node) => void (node.entries[name] = unmarked(node.entries[name])));
+            if (name === undefined)
+                return;
+            await this.mutate(dir, (node) => {
+                const now = entryIn(node, name);
+                if (now?.id !== id || now.moving !== true)
+                    return false;
+                node.entries[name] = unmarked(now);
+                return true;
+            });
         }
         catch {
             // It stays marked.
@@ -16973,9 +18015,12 @@ class VfsNamespace {
         }
         if (!run.write)
             return clone;
-        const open = { id: clone.id, key: fromBase64(clone.key), node, hidden: Object.create(null) };
+        const counter = this.deps.coordinator ? await this.counterOf(clone.id) : null;
+        const open = {
+            id: clone.id, key: fromBase64(clone.key), node, hidden: Object.create(null), gen: run.gen, seen: this.hearing, counter,
+        };
         await this.deps.store.put(dirKey(open.id), await seal(open.key, node));
-        this.cache.set(open.id, Promise.resolve(open));
+        this.adopt(open);
         return clone;
     }
     /**
@@ -17972,8 +19017,11 @@ class Repo {
     async expand(prefix) {
         if (!/^[0-9a-f]{4,}$/.test(prefix))
             return null;
-        const keys = await this.deps.store.list();
         const wanted = objectKey(this.slug, prefix);
+        // Only the keys under the abbreviation (usually none or one), not the
+        // whole personal space. The filter below stays, for a store that
+        // ignores the prefix.
+        const keys = await this.deps.store.list(wanted);
         // Only keys that could be objects: a stray key under the prefix would
         // otherwise make every abbreviation of it "ambiguous".
         const hits = keys.filter((k) => k.startsWith(wanted) && HASH.test(k.slice(objectKey(this.slug, "").length)));
@@ -18320,6 +19368,519 @@ class VcsNamespace {
     }
 }
 
+/**
+ * Coordination between the tabs of an app on one device: Web Locks, the
+ * Web BroadcastChannel, and IndexedDB.
+ *
+ * Every factory here returns undefined unless the runtime is a browser tab
+ * with both Web Locks and a BroadcastChannel - not Node (which has
+ * `navigator.locks` from 24.5, but per process), not a Worker, not an old
+ * WebView - and its callers then keep the behaviour they had before: one
+ * tab's writes ordered among themselves only. IndexedDB is not required:
+ * without it no count can be told, and every write reads its folder again
+ * first. A storage-partitioned iframe gets locks, a channel and IndexedDB of
+ * its own, as it gets storage of its own; to the app's other tabs it is
+ * another device.
+ *
+ * A browser can also have these and refuse them to a document: an opaque
+ * origin (a sandboxed iframe, a `data:` document), or a site whose data the
+ * user has blocked. Refused Web Locks, the coordinator goes on without
+ * them, as in Node (see `refusesLocks`); refused a channel, it hears
+ * nothing; and an IndexedDB that does not answer in time counts nothing
+ * (see `writeCounts`). `client.vfs` needed none of the three before it
+ * coordinated tabs, and none of them may stop it now.
+ *
+ * `globalThis.BroadcastChannel` is named in full on purpose: this package
+ * exports a class of its own called BroadcastChannel (the E2E room channel),
+ * and an import of that in scope would silently take the Web API's place.
+ */
+/** How long a write waits for another tab to finish writing the same folder before it gives up. */
+const LOCK_WAIT_MS = 30_000;
+/**
+ * How long each call to the write counts - `counters`, `begin` or `bump` -
+ * may take before it gives up, telling nothing, as one that failed: the
+ * wait for the IndexedDB open and the call's transaction together, not
+ * each. Only the call gives up, not the open: one that succeeds later,
+ * within `OPEN_DROP_MS`, is kept for every later call (see `writeCounts`).
+ */
+const COUNT_WAIT_MS = 3_000;
+/**
+ * How long an IndexedDB open of the write counts may go without any answer
+ * - no success, error or blocked - before it is dropped, as one that
+ * failed, and the next call asks for another. See `writeCounts`.
+ */
+const OPEN_DROP_MS = 30_000;
+/**
+ * Whether `err`, from a Web Locks request that was never granted, is the
+ * browser refusing Web Locks to this document altogether: an opaque origin,
+ * or a site whose data the user has blocked. The browser makes that
+ * decision for the site's storage, so it refuses every tab of the app
+ * alike, and no tab holds the lock. The tab then goes on without it, as in
+ * Node. Any other error - a document no longer fully active, say - is
+ * passed on.
+ */
+function refusesLocks(err) {
+    return err?.name === "SecurityError";
+}
+// Through `unknown`: the DOM's own LockManager and BroadcastChannel types do
+// not line up with these slices closely enough for a direct cast.
+function webLocks() {
+    if (typeof window === "undefined")
+        return undefined;
+    const locks = globalThis.navigator?.locks;
+    return typeof locks?.request === "function" ? locks : undefined;
+}
+function webChannel() {
+    const Channel = globalThis.BroadcastChannel;
+    return typeof Channel === "function" ? Channel : undefined;
+}
+function webIndexedDB() {
+    const idb = globalThis.indexedDB;
+    return typeof idb?.open === "function" ? idb : undefined;
+}
+/**
+ * The IndexedDB database the write counts are kept in, one per origin, as
+ * the locks are. Not one connect keeps for anything else: those are
+ * `muhkoo.offline` (the offline layer), `muhkoo.trust` and `muhkoo.device.v1`.
+ *
+ * Its version stays 1 for good. A tab still running code that opens it at
+ * version 1 would fail with a VersionError once a newer tab had made it at
+ * version 2, count nothing, and so write a folder without the newer tabs
+ * knowing: the writer whose write may be lost. A new store goes in a new
+ * database.
+ */
+const COUNTS_DB = "muhkoo.vfs";
+/** Its one store: `[commitment, record id]` to a count, and `CREATED` to a random id. */
+const COUNTS = "counts";
+const CREATED = "created";
+/**
+ * How often each user's directory records have been written on this
+ * device: `VfsCoordinator.counters`, `begin` and `bump`, kept in IndexedDB
+ * for every tab of the origin.
+ *
+ * A count is odd from `begin` to `bump`, while a write is under way, and
+ * even once it is counted; `counters` reports an odd one as unknown. It is
+ * read as `<created>:<count>`, where `created` is a random id stored when
+ * the database was made: deleted - the site's data cleared - every count
+ * starts again from nothing, and a counter read before could otherwise
+ * come round again with writes in between that its copy does not hold.
+ *
+ * Each operation is one transaction, and settles once that has completed.
+ * Every failure - IndexedDB missing, an open refused, blocked or failed, a
+ * transaction aborted - resolves to null, which the namespace takes for out
+ * of date: it reads the record again. A failed or blocked open is not kept,
+ * and nor is a connection closed under it, by a newer version of this code
+ * in another tab or by the database being deleted: the next operation opens
+ * the database again.
+ *
+ * So does an operation that has not settled within `waitMs`, the open it
+ * waits for and its transaction together: these are awaited inside the
+ * record locks, and one waited for without end would hold the lock, and
+ * stop every read and write of the tab's folders, for as long. Only the
+ * operation gives up, though, not the open: there is one open under way at
+ * a time, every operation waits for that one, and once it has opened the
+ * database it is kept for every later operation. Given up on too, and closed
+ * when it opened at last, an open that always takes longer than `waitMs`
+ * would never give the tab its counts. An open that has not answered at all
+ * within `OPEN_DROP_MS` is dropped, though, as one that failed: one that
+ * never will would otherwise leave the tab without counts for as long as it
+ * lives. Until then every operation waits for it, `waitMs` at most, and
+ * tells nothing; the next operation after that asks for one new open; and
+ * the dropped one, if it opens after all, is closed. The new open is
+ * dropped in turn if it goes `OPEN_DROP_MS` without an answer too, and so
+ * on: where IndexedDB never answers, the tab leaves behind one more open
+ * that never settles every `OPEN_DROP_MS` or a little more, for as long as
+ * operations keep coming, and none while none come. An operation that
+ * gives up before the database has opened makes no transaction. A
+ * transaction given up on is not aborted, and may still complete: IndexedDB
+ * runs the read-write transactions of one store in the order they were
+ * made, so a late `begin` still marks the count before any later `bump`,
+ * and a late `bump` still counts its write before any later `begin`. A tab
+ * that asks meanwhile waits behind it, gives up, and reads the record
+ * again.
+ */
+function writeCounts(idb, waitMs) {
+    // The open under way, or the one that opened `opened`: one at a time.
+    let connection = null;
+    // The database `connection` opened, once it has.
+    let opened = null;
+    // Drops `connection` while it is under way, once `OPEN_DROP_MS` have passed.
+    let dropping;
+    const forget = (db) => {
+        if (opened !== db)
+            return;
+        opened = null;
+        connection = null;
+        db.close();
+    };
+    const open = () => {
+        if (connection)
+            return connection;
+        let request;
+        try {
+            if (!idb)
+                throw new Error("no IndexedDB");
+            request = idb.open(COUNTS_DB, 1);
+        }
+        catch {
+            // Not kept: the next operation tries again.
+            return Promise.resolve(null);
+        }
+        const pending = new Promise((resolve) => {
+            // Not kept when it failed, or was dropped: the next operation
+            // tries again. Failed after it was dropped, it changes nothing.
+            const fail = () => {
+                if (connection === pending) {
+                    clearTimeout(dropping);
+                    connection = null;
+                }
+                resolve(null);
+            };
+            request.onupgradeneeded = () => {
+                request.result.createObjectStore(COUNTS).put(generateId(), CREATED);
+            };
+            request.onsuccess = () => {
+                const db = request.result;
+                // Blocked or dropped, and given up on, before it opened - or
+                // closed by `close`. Another open may be under way by now.
+                if (connection !== pending) {
+                    db.close();
+                    resolve(null);
+                    return;
+                }
+                clearTimeout(dropping);
+                db.onversionchange = () => forget(db);
+                db.onclose = () => forget(db);
+                opened = db;
+                resolve(db);
+            };
+            // Blocked: another tab holds an older version open. Not waited for.
+            request.onerror = fail;
+            request.onblocked = fail;
+            // No answer at all: dropped, as one that failed, and the next
+            // operation asks for another - dropped in turn if it does not
+            // answer either. See above.
+            dropping = setTimeout(fail, OPEN_DROP_MS);
+        });
+        connection = pending;
+        return pending;
+    };
+    /**
+     * Run `body` in one transaction, and resolve once that has completed to
+     * what the function it returns gives then - or to null, if anything
+     * fails, or the database has not opened and the transaction completed
+     * within `waitMs`.
+     */
+    const run = (mode, body) => new Promise((resolve) => {
+        let done = false;
+        const settle = (value) => {
+            if (done)
+                return;
+            done = true;
+            clearTimeout(timer);
+            resolve(value);
+        };
+        // Given up on, but neither the open nor the transaction aborted: see above.
+        const timer = setTimeout(() => settle(null), waitMs);
+        void open().then((db) => {
+            // Given up on while it opened: nothing to do.
+            if (done)
+                return;
+            if (!db) {
+                settle(null);
+                return;
+            }
+            let tx;
+            try {
+                tx = db.transaction(COUNTS, mode);
+                const result = body(tx.objectStore(COUNTS));
+                tx.oncomplete = () => settle(result());
+                tx.onabort = () => settle(null);
+            }
+            catch {
+                try {
+                    tx?.abort();
+                }
+                catch {
+                    // Finished already.
+                }
+                // Closed under it, most likely: the next operation opens it again.
+                forget(db);
+                settle(null);
+            }
+        });
+    });
+    const count = (value) => (typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : 0);
+    const counter = (created, n) => (typeof created === "string" ? `${created}:${n}` : null);
+    return {
+        async counters(who, ids) {
+            const read = await run("readonly", (store) => {
+                const created = store.get(CREATED);
+                const counts = ids.map((id) => store.get([who, id]));
+                return () => counts.map((at) => {
+                    const n = count(at.result);
+                    return n % 2 === 0 ? counter(created.result, n) : null;
+                });
+            });
+            return read ?? ids.map(() => null);
+        },
+        begin(who, id) {
+            return run("readwrite", (store) => {
+                const created = store.get(CREATED);
+                const at = store.get([who, id]);
+                let n = 0;
+                at.onsuccess = () => {
+                    n = count(at.result);
+                    // Odd already, a write began and was never counted: its mark stays.
+                    if (n % 2 === 0)
+                        store.put(n + 1, [who, id]);
+                };
+                return () => counter(created.result, n);
+            });
+        },
+        bump(who, id) {
+            return run("readwrite", (store) => {
+                const created = store.get(CREATED);
+                const at = store.get([who, id]);
+                let next = 0;
+                at.onsuccess = () => {
+                    const n = count(at.result);
+                    // Past the mark `begin` stored - or, when it could not
+                    // store one, past the count it found.
+                    next = n % 2 === 0 ? n + 2 : n + 1;
+                    store.put(next, [who, id]);
+                };
+                return () => counter(created.result, next);
+            });
+        },
+        close() {
+            // An open still under way is closed once it opens.
+            connection = null;
+            clearTimeout(dropping);
+            if (opened)
+                forget(opened);
+        },
+    };
+}
+/**
+ * The offline queue's drain lock: `fn` runs only if no other tab is
+ * draining, and `false` says another one is. See `OutboundQueue`. Where the
+ * browser refuses Web Locks, `fn` runs without it, as in Node, and the
+ * lock is not asked for again: see `refusesLocks`.
+ */
+function drainLock() {
+    const locks = webLocks();
+    if (!locks)
+        return undefined;
+    let refused = false;
+    return async (name, fn) => {
+        if (!refused) {
+            let answered = false;
+            try {
+                return await locks.request(name, { ifAvailable: true }, async (lock) => {
+                    answered = true;
+                    if (!lock)
+                        return false;
+                    await fn();
+                    return true;
+                });
+            }
+            catch (err) {
+                if (answered || !refusesLocks(err))
+                    throw err;
+                refused = true;
+            }
+        }
+        await fn();
+        return true;
+    };
+}
+/**
+ * The `VfsCoordinator` for whoever `commitment()` names: a lock per record,
+ * `muhkoo:vfs:<commitment>:<record id>`; a move lock per entry,
+ * `muhkoo:vfs:<commitment>:moving:<entry id>`, taken only if free, and
+ * shared by the moves into a folder; a count of each record's writes, in
+ * IndexedDB `muhkoo.vfs` under `[commitment, record id]` (see
+ * `writeCounts`); and announcements on the channel `muhkoo:vfs:<commitment>`
+ * as `{ id, writer }`, where `writer` is this tab's random id. `close` is
+ * for tests, as are `lockWaitMs` (see `LOCK_WAIT_MS`) and `countWaitMs`
+ * (see `COUNT_WAIT_MS`).
+ *
+ * Where the browser refuses Web Locks (see `refusesLocks`), it holds no
+ * lock - every write runs as it would without a coordinator, and every
+ * move lock is had at once - and asks for none again.
+ */
+function vfsCoordinator(commitment, opts = {}) {
+    const locks = webLocks();
+    const Channel = webChannel();
+    if (!locks || !Channel)
+        return undefined;
+    const lockWaitMs = opts.lockWaitMs ?? LOCK_WAIT_MS;
+    const tab = generateId();
+    const counts = writeCounts(webIndexedDB(), opts.countWaitMs ?? COUNT_WAIT_MS);
+    const handlers = new Set();
+    // `channel` is null where the browser would not make one: see `listen`.
+    let open = null;
+    // Move locks this tab has let go of, until the browser has too. See `holdMoving`.
+    const leaving = new Map();
+    // The browser refused Web Locks: see `refusesLocks`.
+    let refused = false;
+    /**
+     * Hear the channel of whoever is signed in now: opened the first time,
+     * and opened again for someone else after a sign-in. What was announced
+     * before it opened was not heard, which every handler is told.
+     *
+     * Where the browser will not make the channel - an opaque origin, or a
+     * site whose data is blocked - this tab hears nothing and tells no one,
+     * and does not ask again for the same user. That is safe: the counts,
+     * not the announcements, decide whether a copy may be written over.
+     */
+    const listen = () => {
+        const who = commitment();
+        if (open?.who === who)
+            return;
+        open?.channel?.close();
+        open = null;
+        if (!who)
+            return;
+        let channel = null;
+        try {
+            channel = new Channel(`muhkoo:vfs:${who}`);
+            channel.onmessage = (event) => {
+                const data = event.data;
+                if (typeof data?.id !== "string" || data.writer === tab)
+                    return;
+                for (const handler of handlers)
+                    handler(data.id);
+            };
+        }
+        catch {
+            channel = null;
+        }
+        open = { who, channel };
+        for (const handler of handlers)
+            handler(null);
+    };
+    return {
+        async lock(id, fn) {
+            listen();
+            const who = commitment();
+            // Signed out: the store refuses the write itself, with a clearer
+            // message. Refused Web Locks: no tab of the app can hold this
+            // lock, and the write goes ahead as it would without one.
+            if (!who || refused)
+                return fn();
+            // Only the WAIT is bounded. Once granted, the lock is held until
+            // the write has landed or failed: let go of while a write is still
+            // on its way, the next tab's write could land first and then be
+            // undone by it - the very loss this lock is for.
+            const waiting = new AbortController();
+            const timer = setTimeout(() => waiting.abort(), lockWaitMs);
+            let granted = false;
+            try {
+                return await locks.request(`muhkoo:vfs:${who}:${id}`, { signal: waiting.signal }, () => {
+                    granted = true;
+                    clearTimeout(timer);
+                    return fn();
+                });
+            }
+            catch (err) {
+                if (!granted && waiting.signal.aborted) {
+                    throw new VfsConflictError(`another tab of this app has been writing this folder for over ${Math.round(lockWaitMs / 1000)} seconds; nothing was written - try again`);
+                }
+                if (granted || !refusesLocks(err))
+                    throw err;
+                refused = true;
+            }
+            finally {
+                clearTimeout(timer);
+            }
+            // Refused Web Locks, before anything was written: written without one.
+            return fn();
+        },
+        announce(id) {
+            listen();
+            open?.channel?.postMessage({ id, writer: tab });
+        },
+        onAnnounce(handler) {
+            handlers.add(handler);
+            return () => void handlers.delete(handler);
+        },
+        listen,
+        // Signed out, nothing is counted: the store refuses the reads and
+        // writes themselves.
+        async counters(ids) {
+            const who = commitment();
+            return who ? counts.counters(who, ids) : ids.map(() => null);
+        },
+        async begin(id) {
+            const who = commitment();
+            return who ? counts.begin(who, id) : null;
+        },
+        async bump(id) {
+            const who = commitment();
+            return who ? counts.bump(who, id) : null;
+        },
+        async holdMoving(id, shared = false) {
+            const who = commitment();
+            // Signed out: the store refuses the writes themselves. Refused Web
+            // Locks, no tab of the app can hold this lock.
+            if (!who || refused)
+                return () => { };
+            const name = `muhkoo:vfs:${who}:moving:${id}`;
+            // Let go of by this tab, but perhaps not yet by the browser, which
+            // lets go only once the callback below has settled. Asked for
+            // before then - a move or a delete straight after another of the
+            // same entry - it is still held, and this tab refuses itself.
+            const before = leaving.get(name);
+            if (before)
+                await before;
+            return new Promise((resolve, reject) => {
+                let answered = false;
+                const request = locks.request(name, { ifAvailable: true, mode: shared ? "shared" : "exclusive" }, async (lock) => {
+                    answered = true;
+                    if (!lock) {
+                        resolve(null);
+                        return;
+                    }
+                    // Held until this settles: when the function handed back
+                    // is called, or when the tab goes and the browser lets go
+                    // of everything it held.
+                    let held = true;
+                    await new Promise((letGo) => resolve(() => {
+                        if (!held)
+                            return;
+                        held = false;
+                        // Settles once the browser has let go of it too,
+                        // and of every other hold of it this tab has let
+                        // go of: two moves into one folder hold it at once.
+                        const gone = Promise.all([leaving.get(name), request.then(() => { }, () => { })]).then(() => { });
+                        leaving.set(name, gone);
+                        void gone.then(() => {
+                            if (leaving.get(name) === gone)
+                                leaving.delete(name);
+                        });
+                        letGo();
+                    }));
+                });
+                request.catch((err) => {
+                    if (answered || !refusesLocks(err)) {
+                        reject(err);
+                        return;
+                    }
+                    refused = true;
+                    resolve(() => { });
+                });
+            });
+        },
+        close() {
+            open?.channel?.close();
+            open = null;
+            counts.close();
+        },
+    };
+}
+
 /**
  * `HlcTimestamp` — a Hybrid Logical Clock reading, packed into a single
  * lexicographically-sortable string so the whole offline layer (and the
@@ -18606,13 +20167,19 @@ class ConnectivityManager {
  * Replays are idempotent by construction (kv/db are LWW-by-key, messages dedupe
  * by `clientId`, file PUTs are content-addressed), so re-running a partially
  * drained queue is safe.
+ *
+ * Every tab of an origin shares the queue. Given a `tryLock`, a drain runs
+ * only while holding `muhkoo:offline-drain:<commitment>`, so two tabs coming
+ * back online replay it once between them, not once each.
  */
 class OutboundQueue {
     store;
+    opts;
     replayers = new Map();
     draining = null;
-    constructor(store) {
+    constructor(store, opts = {}) {
         this.store = store;
+        this.opts = opts;
     }
     /** A domain registers how to replay its mutations. */
     register(domain, replayer) {
@@ -18634,11 +20201,31 @@ class OutboundQueue {
     drain() {
         if (this.draining)
             return this.draining;
-        this.draining = this.runDrain().finally(() => {
+        this.draining = this.drainOnce().finally(() => {
             this.draining = null;
         });
         return this.draining;
     }
+    /**
+     * One drain, holding the device-wide drain lock where there is one. A
+     * tab that finds another tab holding it leaves the queue to that one,
+     * which is replaying it already and removes each entry as it lands - so
+     * a drain after it finds only what it left.
+     */
+    async drainOnce() {
+        const who = this.opts.commitment?.();
+        if (!this.opts.tryLock || !who)
+            return this.runDrain();
+        await this.opts.tryLock(`muhkoo:offline-drain:${who}`, async () => {
+            // A tab that found this one draining skipped its own drain, and
+            // what it queued after this pass read the queue was left to this
+            // tab. So drain until a pass leaves nothing; a transient failure
+            // still stops it, by throwing.
+            do {
+                await this.runDrain();
+            } while ((await this.store.queued()).length > 0);
+        });
+    }
     async runDrain() {
         const entries = await this.store.queued();
         for (const entry of entries) {
@@ -18885,6 +20472,14 @@ const META_NODE_ID = "nodeId";
  * stay decoupled from IndexedDB and the clock.
  */
 const HLC_STATE_KEY = "global";
+/**
+ * A random suffix for this tab's HLC node id, held in memory only - see
+ * `OfflineManager.boot`. 48 bits: two tabs of one device never draw the same.
+ */
+function tabSuffix() {
+    const bytes = crypto.getRandomValues(new Uint8Array(6));
+    return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
 class OfflineManager {
     /** True in browsers with IndexedDB; false when running over a NoopStore. */
     enabled;
@@ -18903,7 +20498,10 @@ class OfflineManager {
     constructor(deps) {
         this.enabled = deps.enabled;
         this.store = deps.store;
-        this.queue = new OutboundQueue(deps.store);
+        this.queue = new OutboundQueue(deps.store, {
+            tryLock: deps.locks,
+            commitment: () => deps.session.commitment,
+        });
         this.connectivity = new ConnectivityManager({
             onReconnect: () => void this.sync.run(),
         });
@@ -19001,14 +20599,22 @@ class OfflineManager {
             this.hlc = new HLC(this.nodeId);
             return;
         }
-        let nodeId = await this.store.get("meta", META_NODE_ID);
-        if (!nodeId) {
-            nodeId = generateId();
-            await this.store.put("meta", META_NODE_ID, nodeId);
-        }
-        this.nodeId = nodeId;
+        let deviceId = await this.store.get("meta", META_NODE_ID);
+        if (!deviceId) {
+            deviceId = generateId();
+            await this.store.put("meta", META_NODE_ID, deviceId);
+        }
+        // One node id per TAB, under the device's. Every tab of an origin
+        // loads the same stored id, and two tabs stamping with it in the same
+        // millisecond minted identical HLCs: the node id is the tiebreak, and
+        // the server keeps the first of two equal stamps, so the second write
+        // was dropped. The suffix lives in memory only. The clock state below
+        // stays shared, so the clock never goes back across tabs, and stamps
+        // stored already stay valid: every comparison reads a packed stamp as
+        // one string and never parses the node id.
+        this.nodeId = `${deviceId}.${tabSuffix()}`;
         const state = await this.store.get("hlc-state", HLC_STATE_KEY);
-        this.hlc = new HLC(nodeId, { state });
+        this.hlc = new HLC(this.nodeId, { state });
     }
     /** Coalesce HLC-state writes — a burst of stamps persists once. */
     schedulePersist() {
@@ -19325,11 +20931,15 @@ class KvCache {
         const local = (await this.store.get("kv-cache", k)) ?? emptyRegister();
         await this.store.put("kv-cache", k, mergeRegister(local, incoming));
     }
-    /** Non-tombstoned full keys for a commitment (used for offline `list`). */
-    async liveKeys(commitment) {
-        const prefix = `${commitment}|`;
-        const rows = await this.store.prefix("kv-cache", prefix);
-        return rows.filter((r) => !r.value.deleted).map((r) => r.key.slice(prefix.length));
+    /**
+     * Non-tombstoned full keys for a commitment that start with `prefix` (all
+     * of them by default), for offline `list`. The store scans the key range
+     * `${commitment}|${prefix}`, so other collections are never read.
+     */
+    async liveKeys(commitment, prefix = "") {
+        const scope = `${commitment}|`;
+        const rows = await this.store.prefix("kv-cache", scope + prefix);
+        return rows.filter((r) => !r.value.deleted).map((r) => r.key.slice(scope.length));
     }
     /** Queue a kv mutation for replay on reconnect. */
     async enqueue(method, args, hlc, clientId) {
@@ -19485,13 +21095,17 @@ class Client {
     /** Shared in-flight recovery so a burst of 401s triggers one re-auth. */
     recoverInFlight = null;
     constructor(options = {}) {
-        // Build stamp — always logged (independent of logLevel) so the running
-        // build is identifiable in the console. Catches stale cached bundles
-        // during development; bump `VERSION` (and package.json) each build.
-        try {
-            console.info(`[@muhkoo/connect] initialized — v${VERSION}`);
+        // Build stamp — logged (independent of logLevel) so the running build
+        // is identifiable in the console. Catches stale cached bundles during
+        // development; bump `VERSION` (and package.json) each build.
+        // Browser console only: in Node it lands on stdout, in front of a
+        // CLI's own output (`muhkoo kv ls --json | jq`).
+        if (typeof window !== "undefined" && typeof document !== "undefined") {
+            try {
+                console.info(`[@muhkoo/connect] initialized — v${VERSION}`);
+            }
+            catch { /* console may be unavailable in some runtimes */ }
         }
-        catch { /* console may be unavailable in some runtimes */ }
         if (options.logLevel && typeof globalThis.appLogger?.setLevel === "function") {
             globalThis.appLogger.setLevel(options.logLevel);
         }
@@ -19508,6 +21122,8 @@ class Client {
             store: offlineStore,
             session: this.session,
             enabled: offlineEnabled,
+            // Every tab of the origin shares the queue: one drains it at a time.
+            locks: drainLock(),
         });
         // Wrap fetch so every accelerator round-trip feeds the connectivity
         // detector: a thrown fetch is the strongest "offline" signal, a 2xx the
@@ -19593,12 +21209,13 @@ class Client {
                     throw new Error("client.vfs: no session — sign in first.");
                 await this.http.del(`/api/personal/${encodeURIComponent(c)}/kv/${encodeURIComponent(key)}`);
             },
-            list: async () => {
+            list: async (prefix) => {
                 const c = this.session.commitment;
                 if (!c)
                     throw new Error("client.vfs: no session — sign in first.");
-                const res = await this.http.post(`/api/personal/${encodeURIComponent(c)}/list`, {});
-                return res?.keys ?? [];
+                // The server filters by prefix and pages. An older server ignores
+                // the prefix and returns every key, which is why callers filter.
+                return listPersonalKeys(this.http, `/api/personal/${encodeURIComponent(c)}/list`, prefix ?? "");
             },
         };
         let contentSpace = null;
@@ -19627,6 +21244,9 @@ class Client {
         this.vfs = new VfsNamespace({
             store: personalStore,
             seed: () => this.session.seed,
+            // Orders writes of a folder with this app's other tabs on the
+            // device - undefined outside a browser tab with Web Locks.
+            coordinator: vfsCoordinator(() => this.session.commitment),
             // Share the personal space's socket with `client.kv` rather than
             // opening a second one to the same Durable Object.
             subscribe: (handler) => this.kv.onRaw(handler),