@muhkoo/connect 0.15.0-alpha.3 → 0.15.0-alpha.4

package/dist/server/index.js

@@ -6739,7 +6739,7 @@ async function parseOrThrow(response, op) {
  * expect (and isn't serving a stale cached bundle). Keep this in sync with
  * `package.json` `version`.
  */
-const VERSION = "0.15.0-alpha.3";
+const VERSION = "0.15.0-alpha.4";
 
 /**
  * `HttpClient` — the one place the unified {@link Client} talks to the
@@ -15205,21 +15205,25 @@ function nextTurn() {
  *
  * Every mutation is a read-modify-write of exactly ONE directory record, so a
  * write cannot leave the tree half-updated: either the parent names the new
- * child or it does not. Two tabs writing different directories never conflict;
- * two tabs (or devices) writing the SAME directory are last-writer-wins. A VFS
- * write sends no HLC and the personal space has no compare-and-swap: it applies
- * puts of one key in the order they arrive, so whichever arrives last is kept,
- * and the other tab's edit is lost. Orphaned records (a directory whose parent
- * entry lost the race) are unreachable rather than corrupting — they cost
- * storage until a future sweep, which is the trade this shape makes in
+ * child or it does not. A VFS write sends no HLC and the personal space has
+ * no compare-and-swap: of two writes of one key it keeps whichever arrives
+ * last.
+ *
+ * Within ONE namespace, writes of a record are sent one at a time, in the
+ * order they were made - edits made while one is in flight go out together
+ * in the next (see `queue`) - and a read that has to fetch a record waits for
+ * its write in flight (see `writing`). Every edit of a record is made to one
+ * in-memory copy of it, and that copy is what is written (see `mutate`).
+ *
+ * Between the tabs of an app on one device, a coordinator (`VfsCoordinator`;
+ * `Client` wires one in a browser tab) gives each record one lock, and a tab
+ * reads a record another tab has written again before its next write of it
+ * (see `sendLocked`). Between devices - or a browser and the CLI - two writes
+ * of the same directory are still last-writer-wins, and the other edit is
+ * lost: that takes a compare-and-swap at the server. Orphaned records (a
+ * directory whose parent entry lost the race) are unreachable rather than
+ * corrupting - they cost storage until a sweep, the trade this shape makes in
  * exchange for single-record writes.
- *
- * Within ONE tab, writes of a record are queued and sent one at a time, in the
- * order they were made, and a read that has to fetch a record waits for its
- * write in flight (see `writing`). Every edit of a record is made to one
- * in-memory copy of it, and that copy is what is written (see `mutate`). All
- * of this is per namespace instance only; nothing orders writes across tabs
- * or devices - that would take a compare-and-swap at the server.
  */
 /** Refuse a directory at `path` if it would be deeper than MAX_DEPTH from the root. */
 function assertWritableDepth(path) {
@@ -15449,6 +15453,24 @@ function markedMeanwhile(before, now) {
 function changedMeanwhile(path) {
     return new VfsConflictError(`${path} was changed by another write while this one was in progress; nothing was written over it`);
 }
+/**
+ * Refuse an operation on `path` because this namespace is moving it - or,
+ * `inside`, something in it. See `VfsNamespace.inMotion`.
+ */
+function beingMoved(path, inside = false) {
+    const what = inside ? `something in ${path} is` : `${path} is`;
+    return new VfsConflictError(`${what} being moved; nothing was changed - try again once the move has finished`);
+}
+/**
+ * Refuse an operation on `path` because a move or a delete of it - or,
+ * `inside`, of it or of something in it - holds its move lock on this
+ * device: in another tab of the app, or in this one. See
+ * `VfsCoordinator.holdMoving`.
+ */
+function heldElsewhere(path, inside = false) {
+    const what = inside ? `${path}, or something in it, is` : `${path} is`;
+    return new VfsConflictError(`${what} being moved or deleted in this app, in this tab or another; nothing was changed - try again once that has finished`);
+}
 /** A JSON object, as opposed to null, an array or a scalar. */
 function isObject$1(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -15606,6 +15628,13 @@ function followable(dir) {
 function unfollowable(dir) {
     return Object.values(dir.hidden).filter((value) => !readableEntry(value)).length;
 }
+/** The id of every entry `dir` follows, and whether an entry with that id is marked: `SubtreeShape`'s view of it. */
+function namedIn(dir) {
+    const named = new Map();
+    for (const [, entry] of followable(dir))
+        named.set(entry.id, named.get(entry.id) === true || entry.moving === true);
+    return named;
+}
 class VfsNamespace {
     deps;
     rootKey = null;
@@ -15648,6 +15677,81 @@ class VfsNamespace {
      * `openDirById`.
      */
     writing = new Map();
+    /**
+     * Every entry this namespace is moving right now, by id.
+     *
+     * A move between two directories marks the entry before it puts it in
+     * the second (see `rename`), and a mark is all a later operation can
+     * see. It cannot tell a move still writing from one that was
+     * interrupted, and was taken for the second: a delete that began after
+     * a move had marked a folder looked for the folder's other half, found
+     * none yet, and purged it while the move was putting it in its new
+     * place; a second move of a file finished the "interrupted" move and
+     * left it named in two places. So a move holds its entry here until it
+     * has taken it from where it was, and `rename` and `delete` refuse an
+     * entry that is here - or, for a delete, a folder holding one. A delete
+     * holds what it deletes the same way: see `deleting`.
+     *
+     * This set is one namespace's. With a coordinator, a move also holds
+     * the entry's move lock for every tab on the device, for as long as the
+     * entry is here: see `VfsCoordinator.holdMoving`.
+     */
+    inMotion = new Set();
+    /**
+     * What each delete under way in this namespace is deleting, by entry id,
+     * one set per delete: its target from the moment it has found the target
+     * not in `inMotion`, and everything it read below the target once it has
+     * read it. Each delete lets go of its own set when it is done.
+     *
+     * A delete waits after it has read what it will let go of: on more
+     * reads, and on a read of the whole tree for the other half of a move.
+     * A move of any of it that started meanwhile could put it in its new
+     * place, fail to take it from the old, and end, all before the delete's
+     * detach. Ended, it was no longer in `inMotion`; and an entry that was
+     * marked already showed no change. So the delete let go of what the
+     * move had just named somewhere else. Now `rename` refuses an entry that
+     * is here, or one on a way from the root that passes through a folder
+     * that is: everything below a delete's target, read yet or not.
+     */
+    deleting = new Set();
+    /**
+     * The write of each record that has not gone out yet, by id: the one
+     * the next edit of that record joins. See `queue`.
+     */
+    waiting = new Map();
+    /**
+     * Announcements heard from other tabs, counted. `heardAt` is the count
+     * at the last one for each record, `missedAt` the count when some may
+     * have been missed. A copy read after both holds every write announced:
+     * see `current`.
+     */
+    hearing = 0;
+    missedAt = 0;
+    heardAt = new Map();
+    /**
+     * Each record a write of which this namespace marked as begun and could
+     * not count, and has said so, until one is counted. And whether it has
+     * said that a write it could not mark or count may be lost, which it
+     * says only once. See `notCounted`.
+     */
+    uncounted = new Set();
+    lossWarned = false;
+    /**
+     * The copy of each record this namespace is writing under the record's
+     * lock, by id, from when it has decided what to write until it has
+     * counted the write, or failed to. Its counter reads as unknown
+     * meanwhile, as this write has begun and is not counted yet, but the
+     * copy holds every write of the record another tab has counted, and no
+     * other tab can make one until this one lets go of the lock. See
+     * `dropStale`.
+     */
+    locked = new Map();
+    /**
+     * Each directory a `createDir` here has named whose write has not landed
+     * yet, by entry id: a promise that settles - and never rejects - once
+     * that write has landed or failed. See `mkdir`.
+     */
+    naming = new Map();
     historyLimit;
     maxEntries;
     maxPathChars;
@@ -15656,6 +15760,8 @@ class VfsNamespace {
         this.historyLimit = deps.historyLimit ?? DEFAULT_HISTORY_LIMIT;
         this.maxEntries = deps.limits?.entries ?? DEFAULT_MAX_ENTRIES;
         this.maxPathChars = deps.limits?.pathChars ?? DEFAULT_MAX_PATH_CHARS;
+        // Another tab's write of a record leaves this tab's copy of it out of date: see `heard`.
+        deps.coordinator?.onAnnounce((id) => this.heard(id));
     }
     /**
      * The working directory relative paths resolve against.
@@ -15708,6 +15814,7 @@ class VfsNamespace {
         // stays out of the cache from here on: see `generation`.
         this.generation++;
         this.cache.clear();
+        this.heardAt.clear();
         this.rootKey = null;
         this._cwd = "/"; // a different identity's tree has different directories
     }
@@ -16055,8 +16162,22 @@ class VfsNamespace {
             const name = parts[i];
             const isLast = i === parts.length - 1;
             const next = join(current, name);
-            const dir = await this.openDir(current);
-            const existing = entryIn(dir.node, name);
+            let dir = await this.openDir(current);
+            let existing = entryIn(dir.node, name);
+            // Named by a mkdir here whose write has not landed. Until it has,
+            // the name is a promise, not a fact: with a coordinator, that edit
+            // is made again under the lock to the folder as another tab left
+            // it, and comes to nothing when that tab named a directory there
+            // first - and whatever was saved meanwhile into the one named
+            // here is in a directory nothing names. A failed write drops it
+            // too. So wait for the write, and look again.
+            let unwritten = existing && this.naming.get(existing.id);
+            while (unwritten) {
+                await unwritten;
+                dir = await this.openDir(current);
+                existing = entryIn(dir.node, name);
+                unwritten = existing && this.naming.get(existing.id);
+            }
             if (!existing)
                 assertNotHidden(dir, name, next);
             if (existing) {
@@ -16182,89 +16303,219 @@ class VfsNamespace {
             this.warn(`removed ${where} without clearing out what it held: this version cannot read it`);
             return;
         }
-        // Every directory above the target, the root first. None of them is
-        // part of what is being deleted, whatever an entry below says.
-        const above = new Set(opened.chain);
-        // Three steps, in this order: read everything the delete will touch,
-        // detach the entry, then let go of what it held.
-        //
-        // Letting go came first once, and the entry was detached last. Any
-        // failure in between - a network error, most simply - left the entry
-        // in place with some of its content already released, and the obvious
-        // next step, trying again, released that content a SECOND time.
-        // Content is reference-counted and shared by copies, so that freed
-        // bytes another file still used. Now a failure before the detach has
-        // changed nothing, and nothing after it can fail: releasing is
-        // best-effort, and a leak is the safe way to be wrong.
-        let doomed = [];
-        // Whether any of it is half of an interrupted move. See below.
-        let moving = entry.kind === "file" && entry.moving === true;
-        if (entry.kind === "dir" && above.has(entry.id)) {
-            // The entry IS a pointer to a directory above it - the root, or
-            // this entry's own parent. Removing the pointer is what was asked
-            // for; clearing out what it points at would delete everything
-            // around the target, the target included.
-            if (!opts.recursive)
-                throw new VfsConflictError(`${target} is not empty`);
-            this.warn(`detaching ${target} without clearing it out: it is a directory above it in the tree`);
-        }
-        else if (entry.kind === "dir") {
-            const child = await this.openDirById(entry.id, fromBase64(entry.key), target).catch((err) => {
-                // An unreadable directory must still be removable, or the user
-                // is stuck with an error they can do nothing about. Its subtree
-                // cannot be enumerated, so it is detached rather than purged and
-                // whatever it holds is left for sweep(). Only when asked for
-                // recursively: without that we cannot know it is empty.
-                if (!(err instanceof VfsCorruptRecordError) || !opts.recursive)
-                    throw err;
-                this.warn(`detaching ${target} without clearing it out: its record cannot be read`);
-                return null;
-            });
-            if (child) {
-                // Entries this version cannot read still count: calling the
-                // directory empty would delete them along with it.
-                const empty = !Object.keys(child.node.entries).length && !Object.keys(child.hidden).length;
-                if (!empty && !opts.recursive)
+        // Being moved by this namespace: it is marked already, or about to be,
+        // and on its way to a second place. Letting go of it here would let
+        // go of what the move puts there. See `inMotion`.
+        if (this.inMotion.has(entry.id))
+            throw beingMoved(target);
+        // And from here until it is done, a move of it, or of anything below
+        // it, that begins in this namespace is refused. See `deleting`.
+        const claim = new Set([entry.id]);
+        this.deleting.add(claim);
+        // On this device, the move locks of the target and of everything read
+        // below it. See below.
+        let release = null;
+        try {
+            // Every directory above the target, the root first. None of them is
+            // part of what is being deleted, whatever an entry below says.
+            const above = new Set(opened.chain);
+            // Three steps, in this order: read everything the delete will touch,
+            // detach the entry, then let go of what it held.
+            //
+            // Letting go came first once, and the entry was detached last. Any
+            // failure in between - a network error, most simply - left the entry
+            // in place with some of its content already released, and the obvious
+            // next step, trying again, released that content a SECOND time.
+            // Content is reference-counted and shared by copies, so that freed
+            // bytes another file still used. Now a failure before the detach has
+            // changed nothing, and nothing after it can fail: releasing is
+            // best-effort, and a leak is the safe way to be wrong.
+            let doomed = [];
+            // What each of them named when it was read, for the check before the detach.
+            let shape = new Map();
+            // Every id found below the target: claimed once it has all been read,
+            // re-checked against `inMotion` at the detach and, with a coordinator,
+            // whose move locks it holds. See below.
+            let ids = new Set();
+            // Whether any of it is half of an interrupted move. See below.
+            let moving = entry.kind === "file" && entry.moving === true;
+            if (entry.kind === "dir" && above.has(entry.id)) {
+                // The entry IS a pointer to a directory above it - the root, or
+                // this entry's own parent. Removing the pointer is what was asked
+                // for; clearing out what it points at would delete everything
+                // around the target, the target included.
+                if (!opts.recursive)
                     throw new VfsConflictError(`${target} is not empty`);
-                const found = await this.subtree(child, target, above);
-                doomed = found.dirs;
-                moving = entry.moving === true || found.moving;
+                this.warn(`detaching ${target} without clearing it out: it is a directory above it in the tree`);
+            }
+            else if (entry.kind === "dir") {
+                const child = await this.openDirById(entry.id, fromBase64(entry.key), target).catch((err) => {
+                    // An unreadable directory must still be removable, or the user
+                    // is stuck with an error they can do nothing about. Its subtree
+                    // cannot be enumerated, so it is detached rather than purged and
+                    // whatever it holds is left for sweep(). Only when asked for
+                    // recursively: without that we cannot know it is empty.
+                    if (!(err instanceof VfsCorruptRecordError) || !opts.recursive)
+                        throw err;
+                    this.warn(`detaching ${target} without clearing it out: its record cannot be read`);
+                    return null;
+                });
+                if (child) {
+                    // Entries this version cannot read still count: calling the
+                    // directory empty would delete them along with it.
+                    const empty = !Object.keys(child.node.entries).length && !Object.keys(child.hidden).length;
+                    if (!empty && !opts.recursive)
+                        throw new VfsConflictError(`${target} is not empty`);
+                    const found = await this.subtree(child, target, above);
+                    // Something in it is being moved by this namespace: the same
+                    // as the target being moved, a level down.
+                    for (const id of found.ids)
+                        if (this.inMotion.has(id))
+                            throw beingMoved(target, true);
+                    for (const id of found.ids)
+                        claim.add(id);
+                    doomed = found.dirs;
+                    shape = found.shape;
+                    ids = found.ids;
+                    moving = entry.moving === true || found.moving;
+                }
+            }
+            // On this device, the move lock of the target and of everything read
+            // below it, held from here until what they held has been let go of.
+            // A move in another tab holds the lock of what it moves until it has
+            // taken it from where it was. A delete that found it marked looked
+            // for its other half before the move had put it there, found none,
+            // and let go of what the move then named in its new place; one that
+            // was writing the parent let a move of something below start, and
+            // then purged it. Held here, a move of any of it that is under way
+            // refuses this delete, and none can start until it is done. What it
+            // does not cover - anything named below since it was read - the check
+            // in the edit refuses. See `VfsCoordinator.holdMoving`.
+            //
+            // Taken before the look for the other half of a move below, not
+            // after it: a move in another tab that began during that look could
+            // put the entry in its new place, fail to take it from the old, and
+            // let go of its lock, all before this took it - and what it named
+            // was let go of here. Not before the reads above, which find what is
+            // below. A move in another tab that begins during them still holds
+            // its lock here if it is under way, and this delete is refused;
+            // ended, it came before the look and the checks below, which read
+            // again what it wrote. See below.
+            const coordinator = this.deps.coordinator;
+            // What the look and the checks below must read again.
+            let stale = new Set();
+            if (coordinator) {
+                release = await this.holdAll(coordinator, [entry.id, ...ids]);
+                if (!release)
+                    throw heldElsewhere(target, ids.size > 0);
+                // A move that let go of its lock just before this took it had
+                // counted its writes by then, though this tab may not have heard
+                // of them: what was read above that another tab has written
+                // since is read again - every record cached, for the look, which
+                // reads the whole tree. A move that took a file out of a folder
+                // read above, from this tab's old copy, had that file let go of
+                // with the folder; one that went from the other half of a move
+                // to a folder this tab's old copy did not show it in had the
+                // content it took with it let go of. See `dropStale`.
+                //
+                // And the way to the target, looked up before anything else.
+                // A delete in another tab of a folder on it had let go of the
+                // target's lock, which it held, only once it had counted its
+                // write of the folder above the one it deleted - but it purged
+                // that one, and all below, which counts nothing. Gone on from
+                // the old copies, this wrote the purged parent back and let go
+                // of what the target held a second time, while a copy of it, or
+                // a commit, still named that content. So what on the way has
+                // been written since it was read is read again, and the way is
+                // looked up again, as a move's way to where it goes is: it must
+                // lead to the same entry, through the same folders, not marked
+                // since.
+                //
+                // Looked up again even when nothing on it is out of date now:
+                // a write of this tab's own may have read a folder on it again,
+                // under that folder's lock, after the look above, and counted
+                // its write. That copy is current by now, and no longer what the
+                // look saw.
+                const read = doomed.map((dir) => dir.id);
+                stale = await this.dropStale(coordinator, [...opened.chain, ...(moving ? this.cache.keys() : []), ...read]);
+                const again = await this.openChain(dirname(target));
+                if (!again)
+                    throw new VfsNotFoundError(dirname(target));
+                if (again.chain.some((id, i) => id !== opened.chain[i]))
+                    throw changedMeanwhile(dirname(target));
+                const now = entryIn(again.dir.node, name);
+                if (!now)
+                    throw new VfsNotFoundError(target);
+                if (!sameEntry(entry, now) || markedMeanwhile(entry, now))
+                    throw changedMeanwhile(target);
             }
+            // A move between two directories that was interrupted leaves what it
+            // moved named in both, and letting go of it here would take it from
+            // the other copy: the directory record purged with every file in it,
+            // or a file's content and history released. Only a marked entry can
+            // be one of those (see `rename`), so only then is the whole tree
+            // read, once, to find out what is still named elsewhere. Still before
+            // anything changes: a failure here leaves the tree as it was.
+            const elsewhere = moving ? await this.namedElsewhere(parent.id, name) : undefined;
+            // The check in the edit below looks at each record to be purged as it
+            // is then, which needs it to hand: a change reported meanwhile may
+            // have dropped one from the cache, and so may the counters above.
+            // Read again, it is still checked against what was read before.
+            for (const dir of doomed)
+                if (stale.has(dir.id) || !this.editable(dir))
+                    await this.reopen(dir);
+            let purging = doomed;
+            await this.mutate(parent, (node) => {
+                // What is let go of below is what `entry` held. Gone since, it
+                // was let go of already; replaced, the name holds something this
+                // delete has not read. Marked since, a move of it has begun, and
+                // what it holds is about to be named somewhere `elsewhere` did
+                // not see - if it was looked for at all.
+                const now = entryIn(node, name);
+                if (!now)
+                    throw new VfsNotFoundError(target);
+                if (!sameEntry(entry, now) || markedMeanwhile(entry, now))
+                    throw changedMeanwhile(target);
+                // Marked already when this delete read it, a move that has since
+                // taken the entry - or something below it - would not mark it a
+                // second time, so `markedMeanwhile` and `currentSubtree` would not
+                // see it either. `inMotion` is live, not a snapshot, so it still
+                // does: re-checked here, at the last moment before the detach.
+                // Since `deleting`, a move here cannot begin on any of it once
+                // this delete has claimed it, so these are a second guard.
+                if (this.inMotion.has(entry.id))
+                    throw beingMoved(target);
+                for (const id of ids)
+                    if (this.inMotion.has(id))
+                        throw beingMoved(target, true);
+                // And what is purged is what the records below hold now - unless
+                // something in them has been moved, or begun to move, since they
+                // were read; or, with a coordinator, named there since, as its
+                // move lock is not held. See `currentSubtree`.
+                const current = this.currentSubtree(doomed, shape, coordinator ? ids : undefined);
+                if (!current)
+                    throw changedMeanwhile(target);
+                purging = current;
+                delete node.entries[name];
+            });
+            if (elsewhere === null) {
+                // Part of the tree cannot be read, so it is unknown whether the
+                // other copy is in it. Keeping what may be its contents costs
+                // storage until a sweep; letting go of them could lose them.
+                this.warn(`detached ${target} but kept what it held: a move of it was interrupted, and part of the tree cannot be read to find the other copy`);
+                return;
+            }
+            if (entry.kind === "dir")
+                await this.purge(purging, elsewhere, opts.keepContent);
+            else
+                await this.letGo(new Map([[entry.id, [{ dir: parent, entry }]]]), elsewhere, opts.keepContent);
+            if (elsewhere && entry.moving === true)
+                await this.settle(entry.id, elsewhere);
         }
-        // A move between two directories that was interrupted leaves what it
-        // moved named in both, and letting go of it here would take it from
-        // the other copy: the directory record purged with every file in it,
-        // or a file's content and history released. Only a marked entry can
-        // be one of those (see `rename`), so only then is the whole tree
-        // read, once, to find out what is still named elsewhere. Still before
-        // anything changes: a failure here leaves the tree as it was.
-        const elsewhere = moving ? await this.namedElsewhere(parent.id, name) : undefined;
-        await this.mutate(parent, (node) => {
-            // What is let go of below is what `entry` held. Gone since, it
-            // was let go of already; replaced, the name holds something this
-            // delete has not read. Marked since, a move of it has begun, and
-            // what it holds is about to be named somewhere `elsewhere` did
-            // not see - if it was looked for at all.
-            const now = entryIn(node, name);
-            if (!now)
-                throw new VfsNotFoundError(target);
-            if (!sameEntry(entry, now) || markedMeanwhile(entry, now))
-                throw changedMeanwhile(target);
-            delete node.entries[name];
-        });
-        if (elsewhere === null) {
-            // Part of the tree cannot be read, so it is unknown whether the
-            // other copy is in it. Keeping what may be its contents costs
-            // storage until a sweep; letting go of them could lose them.
-            this.warn(`detached ${target} but kept what it held: a move of it was interrupted, and part of the tree cannot be read to find the other copy`);
-            return;
+        finally {
+            release?.();
+            this.deleting.delete(claim);
         }
-        if (entry.kind === "dir")
-            await this.purge(doomed, elsewhere, opts.keepContent);
-        else
-            await this.letGo(new Map([[entry.id, [{ dir: parent, entry }]]]), elsewhere, opts.keepContent);
-        if (elsewhere && entry.moving === true)
-            await this.settle(entry.id, elsewhere);
     }
     /**
      * Move or rename. Works across directories, which is the same operation:
@@ -16287,83 +16538,216 @@ class VfsNamespace {
         const srcName = basename(src);
         const dstName = basename(dst);
         assertValidName(dstName);
-        const srcParent = await this.openDir(dirname(src));
+        const source = await this.openChain(dirname(src));
+        if (!source)
+            throw new VfsNotFoundError(dirname(src));
+        const srcParent = source.dir;
         const entry = entryIn(srcParent.node, srcName);
         if (!entry)
             throw new VfsNotFoundError(src);
-        if (entry.kind === "dir") {
-            assertWritableDepth(dst);
-            if (segments(dst).length > segments(src).length)
-                await this.assertFitsAt(src, dst);
-        }
-        await this.mkdir(dirname(dst), { recursive: true });
-        const dstParent = await this.openDir(dirname(dst));
-        if (entryIn(dstParent.node, dstName))
-            throw new VfsConflictError(`${dst} already exists`);
-        assertNotHidden(dstParent, dstName, dst);
+        // Another move of it is under way here. Its mark cannot tell that
+        // move from an interrupted one, and finishing it as one named the
+        // entry in two places. Held from here, before the first wait, so two
+        // moves begun together cannot both get past this. See `inMotion`.
+        if (this.inMotion.has(entry.id))
+            throw beingMoved(src);
+        // A delete here has begun on it, or on a folder on its way from the
+        // root. Moved now, it could be put in its new place just before the
+        // delete let go of what it holds. Not the root, which no delete is
+        // of: one claims it only through an entry below that names it, and
+        // lets go of nothing of it. In the same step as the check above, as
+        // a delete makes its claim in the same step as its own. See
+        // `deleting`.
+        const lineage = [entry.id, ...source.chain.slice(1)];
+        if ([...this.deleting].some((claim) => lineage.some((id) => claim.has(id))))
+            throw heldElsewhere(src);
+        this.inMotion.add(entry.id);
         // Each record is re-opened before it is written: creating the
-        // destination's parents above may have written to the source's.
+        // destination's parents below may have written to the source's.
         const edit = (path, change) => this.openDir(path).then((dir) => this.mutate(dir, change));
-        // Both ends were looked at before the waits above, and another write
-        // may have changed either since: replaced the entry being moved, or
-        // put something at the destination. Moving on regardless would write
-        // the old entry over the new one, or this one over the other. Or
-        // marked the entry: another move of it has begun. Taking it as well
-        // would name it in two places, and each move would unmark its own.
-        const take = (node) => {
-            const now = entryIn(node, srcName);
-            if (!now || !sameEntry(entry, now) || markedMeanwhile(entry, now))
-                throw changedMeanwhile(src);
-            return now;
-        };
-        const free = (node, record) => {
-            if (entryIn(node, dstName))
+        let unmarkLanded = false;
+        // The same for every tab of the app on this device: the entry's move
+        // lock, held for as long as it is in `inMotion`. Another tab's move
+        // or delete of it holds it, and taking that move's mark for an
+        // interrupted one named the entry in two places, or purged it. See
+        // `VfsCoordinator.holdMoving`.
+        let release = null;
+        // And the locks of the folders on the way to where it goes, shared,
+        // for as long. See below.
+        let into = null;
+        try {
+            const coordinator = this.deps.coordinator;
+            if (coordinator) {
+                release = await coordinator.holdMoving(entry.id);
+                if (!release)
+                    throw heldElsewhere(src);
+                // The look above was at this tab's copies of the folders on the
+                // way to the entry. A delete in another tab of the entry, or of
+                // a folder on that way, may have finished before this took the
+                // lock, which the delete held: it had counted its writes by
+                // then, though this tab may not have heard of them. Moved
+                // regardless, the entry was marked in a record the delete had
+                // purged, and named in its new place with its content let go
+                // of. So whatever on the way another tab has written since it
+                // was read is read again, and the entry looked for again.
+                if ((await this.dropStale(coordinator, source.chain)).size) {
+                    const again = await this.openChain(dirname(src));
+                    if (!again)
+                        throw new VfsNotFoundError(dirname(src));
+                    if (again.chain.some((id, i) => id !== source.chain[i]))
+                        throw changedMeanwhile(dirname(src));
+                    const now = entryIn(again.dir.node, srcName);
+                    if (!now)
+                        throw new VfsNotFoundError(src);
+                    if (!sameEntry(entry, now) || markedMeanwhile(entry, now))
+                        throw changedMeanwhile(src);
+                }
+            }
+            if (entry.kind === "dir") {
+                assertWritableDepth(dst);
+                if (segments(dst).length > segments(src).length)
+                    await this.assertFitsAt(src, dst);
+            }
+            await this.mkdir(dirname(dst), { recursive: true });
+            const way = await this.openChain(dirname(dst));
+            if (!way)
+                throw new VfsNotFoundError(dirname(dst));
+            let dstParent = way.dir;
+            if (coordinator && dstParent.id !== ROOT_ID) {
+                // The folder it goes into, and every folder above that one
+                // but the root, held shared: other moves into any of them
+                // share them, and a delete of one - which holds the lock of
+                // its target and of everything it read below - holds it
+                // alone. A move into a folder that another tab was deleting
+                // put what it moved in a record the delete then purged: in no
+                // listing, its content kept. Not that folder alone: it may be
+                // new since the delete read the tree - made by the `mkdir`
+                // above, or by another tab - and the delete does not hold a
+                // lock it did not read. Its target's is on the way here. The
+                // root is never deleted.
+                into = await this.holdAll(coordinator, way.chain.slice(1), true);
+                if (!into)
+                    throw heldElsewhere(dirname(dst));
+                // A delete of one of them may have finished since they were
+                // looked up, and counted its write of the folder above before
+                // it let go of their locks, though this tab may not have
+                // heard of it: read again whatever on the way another tab has
+                // written since it was read, and look again. Gone, or another
+                // folder anywhere on the way, the move stops here, before its
+                // mark.
+                await this.dropStale(coordinator, way.chain);
+                const again = await this.openChain(dirname(dst));
+                if (!again)
+                    throw new VfsNotFoundError(dirname(dst));
+                if (again.chain.some((id, i) => id !== way.chain[i]))
+                    throw changedMeanwhile(dirname(dst));
+                dstParent = again.dir;
+            }
+            if (entryIn(dstParent.node, dstName))
                 throw new VfsConflictError(`${dst} already exists`);
-            assertNotHidden(record, dstName, dst);
-        };
-        if (dstParent.id === srcParent.id) {
-            // One record, so one write: the move happens entirely or not at all.
-            await edit(dirname(src), (node, record) => {
-                const moved = take(node);
-                free(node, record);
-                delete node.entries[srcName];
-                node.entries[dstName] = { ...moved, mtime: Date.now() };
-            });
-            return;
-        }
-        // Two records, attached before detaching: interrupted, the entry is
-        // in both rather than in neither. Both copies are marked for as long
-        // as that can be so, because they share everything below them, and a
-        // delete of either would otherwise let go of the other's contents.
-        // An entry already marked is half of an earlier interrupted move, and
-        // keeps its mark.
-        const marked = entry.moving === true;
-        let moved = entry;
-        if (!marked) {
+            assertNotHidden(dstParent, dstName, dst);
+            // Both ends were looked at before the waits above, and another write
+            // may have changed either since: replaced the entry being moved, or
+            // put something at the destination. Moving on regardless would write
+            // the old entry over the new one, or this one over the other. Or
+            // marked the entry: another move of it has begun. Taking it as well
+            // would name it in two places, and each move would unmark its own.
+            const take = (node) => {
+                const now = entryIn(node, srcName);
+                if (!now || !sameEntry(entry, now) || markedMeanwhile(entry, now))
+                    throw changedMeanwhile(src);
+                return now;
+            };
+            const free = (node, record) => {
+                if (entryIn(node, dstName))
+                    throw new VfsConflictError(`${dst} already exists`);
+                assertNotHidden(record, dstName, dst);
+            };
+            if (dstParent.id === srcParent.id) {
+                // One record, so one write: the move happens entirely or not at all.
+                await edit(dirname(src), (node, record) => {
+                    const moved = take(node);
+                    free(node, record);
+                    delete node.entries[srcName];
+                    node.entries[dstName] = { ...moved, mtime: Date.now() };
+                });
+                return;
+            }
+            // Two records, attached before detaching: interrupted, the entry is
+            // in both rather than in neither. Both copies are marked for as long
+            // as that can be so, because they share everything below them, and a
+            // delete of either would otherwise let go of the other's contents.
+            // An entry already marked is half of an earlier interrupted move, and
+            // keeps its mark.
+            const marked = entry.moving === true;
+            let moved = entry;
+            if (!marked) {
+                await edit(dirname(src), (node) => {
+                    moved = take(node);
+                    node.entries[srcName] = { ...moved, moving: true };
+                });
+            }
+            // Whether the edit below has put the entry at the destination: set
+            // as its last step, after every check, each time it runs.
+            let attached = false;
+            try {
+                await edit(dirname(dst), (node, record) => {
+                    attached = false;
+                    free(node, record);
+                    node.entries[dstName] = { ...moved, moving: true, mtime: Date.now() };
+                    attached = true;
+                });
+            }
+            catch (err) {
+                // Refused before it put anything at the destination - another
+                // write took the name first - so the entry is still in one
+                // place only, and the mark this move put on it would stay for
+                // good: on a file, every version that falls off its history
+                // kept; on either, every delete of it reading the whole tree.
+                // Not when the write failed instead: the destination may hold
+                // the entry by now, and the mark is what keeps a delete of
+                // either copy from letting go of the other's. Best-effort.
+                if (!marked && !attached) {
+                    await edit(dirname(src), (node) => {
+                        const now = entryIn(node, srcName);
+                        if (now?.id !== entry.id || now.moving !== true)
+                            return false;
+                        node.entries[srcName] = unmarked(now);
+                        return true;
+                    }).catch(() => { });
+                }
+                throw err;
+            }
+            // A file's history is sealed with its directory's key, and from here
+            // on the directory that opens it is this one.
+            if (entry.kind === "file")
+                await this.rekeyHistory(entry.id, [srcParent.key], dstParent.key);
             await edit(dirname(src), (node) => {
-                moved = take(node);
-                node.entries[srcName] = { ...moved, moving: true };
+                // Gone already leaves nothing to detach, and nothing to write.
+                // Replaced, it is not this entry to take away: the move stops
+                // here, in both places. Not `take`: the entry is marked by now,
+                // by this move or the earlier one it finishes.
+                const now = entryIn(node, srcName);
+                if (!now)
+                    return false;
+                if (!sameEntry(entry, now))
+                    throw changedMeanwhile(src);
+                delete node.entries[srcName];
+                // Explicit, as in `createDir` and `settle`: noImplicitReturns.
+                return true;
             });
+            unmarkLanded = !marked;
         }
-        await edit(dirname(dst), (node, record) => {
-            free(node, record);
-            node.entries[dstName] = { ...moved, moving: true, mtime: Date.now() };
-        });
-        // A file's history is sealed with its directory's key, and from here
-        // on the directory that opens it is this one.
-        if (entry.kind === "file")
-            await this.rekeyHistory(entry.id, [srcParent.key], dstParent.key);
-        await edit(dirname(src), (node) => {
-            // Gone already leaves nothing to detach. Replaced, it is not this
-            // entry to take away: the move stops here, in both places. Not
-            // `take`: the entry is marked by now, by this move or the earlier
-            // one it finishes.
-            const now = entryIn(node, srcName);
-            if (now && !sameEntry(entry, now))
-                throw changedMeanwhile(src);
-            delete node.entries[srcName];
-        });
-        if (!marked) {
+        finally {
+            // Named in one place from here, the destination. A delete of it
+            // there goes ahead as for an entry an interrupted move left marked
+            // - which the Trash's "delete forever" relies on while the mark is
+            // still being cleared.
+            this.inMotion.delete(entry.id);
+            release?.();
+            into?.();
+        }
+        if (unmarkLanded) {
             await edit(dirname(dst), (node) => {
                 const landed = entryIn(node, dstName);
                 if (landed?.id === entry.id)
@@ -16468,11 +16852,12 @@ class VfsNamespace {
      * Delete metadata records no longer reachable from the root.
      *
      * These accumulate because every write touches exactly one record: if two
-     * tabs or devices edit the same directory, the personal space keeps
-     * whichever put arrives last (a VFS write sends no HLC, and the space
-     * applies puts of one key in arrival order), which can leave a child whose
-     * parent entry lost the race. The per-record write queue (`writing`) only
-     * orders writes within one tab. Unreachable is harmless —
+     * devices edit the same directory - or two tabs, where there is no
+     * coordinator - the personal space keeps whichever put arrives last (a
+     * VFS write sends no HLC, and the space applies puts of one key in arrival
+     * order), which can leave a child whose parent entry lost the race. The
+     * per-record queue and the coordinator order writes within one device
+     * only. Unreachable is harmless —
      * it is invisible and undecryptable-by-nobody — but it costs storage, so
      * this reclaims it.
      *
@@ -16481,6 +16866,12 @@ class VfsNamespace {
      * Run it when the filesystem is idle.
      */
     async sweep(opts = {}) {
+        // With a coordinator: what another tab has written since this tab
+        // read it is read again, not followed in an old copy that may not
+        // name what it now names - which would then be deleted here.
+        const coordinator = this.deps.coordinator;
+        if (coordinator)
+            await this.dropStale(coordinator, [...this.cache.keys()]);
         const root = await this.root();
         // A record that cannot be read throws out of here, before anything is
         // deleted: with part of the tree unknown, "unreachable" is a guess.
@@ -16637,6 +17028,11 @@ class VfsNamespace {
         const hit = this.cache.get(id);
         if (hit)
             return hit;
+        // Before anything is read, so that from here on this namespace hears
+        // of any later write of the record by another tab. Starting to hear -
+        // for the first time, or for someone else - clears the cache (see
+        // `heard`), which is why it comes before this read is cached.
+        this.deps.coordinator?.listen();
         // The PROMISE goes in the cache, not the resolved value.
         //
         // Reading a project means resolving hundreds of paths that share the
@@ -16682,31 +17078,7 @@ class VfsNamespace {
                 if (!now)
                     this.cache.set(id, pending);
             }
-            const raw = await this.deps.store.get(dirKey(id));
-            // An absent record is an EMPTY directory, not an error: the root
-            // exists before anything has been written to it, and a directory is
-            // created by its parent naming it rather than by its own record
-            // appearing.
-            if (raw === null || raw === undefined) {
-                const node = { v: 1, entries: emptyEntries(), mtime: Date.now() };
-                return { id, key, path, node, hidden: Object.create(null), gen };
-            }
-            // Present but unopenable is NOT absent. `unseal` folds the two
-            // together, which suits a record that can simply be rebuilt; a
-            // directory cannot, because rebuilding it means sealing an empty
-            // one over whatever is really there. And it is not a raw
-            // DOMException either: the typed error is what delete, purge and
-            // sweep know how to step around, and it names the record.
-            let value;
-            try {
-                value = await openSealed(key, raw);
-            }
-            catch (err) {
-                if (err instanceof SealedRecordError)
-                    throw new VfsCorruptRecordError(id, path, err.message);
-                throw err;
-            }
-            return this.readRecord(id, key, value, gen, path);
+            return this.fetchRecord(id, key, gen, path);
         };
         const pending = load().catch((err) => {
             // A failed read must not be remembered, or one blip poisons the
@@ -16721,6 +17093,55 @@ class VfsNamespace {
         this.cache.set(id, pending);
         return pending;
     }
+    /**
+     * Fetch record `id` from the store and open it. Whatever another tab
+     * announced before the fetch began is in what it returns (see
+     * `current`), and so is every write its counter counts: read here, or
+     * given as `counter` (see `OpenDir.counter`).
+     */
+    async fetchRecord(id, key, gen, path, counter) {
+        const seen = this.hearing;
+        // Before the fetch, never after it. A write that lands in between
+        // then only makes this copy look out of date, which costs a read;
+        // read after, the counter could count a write the answer missed.
+        // Without a coordinator there is none, and nothing is awaited: a read
+        // in Node takes the turns it always took.
+        if (counter === undefined)
+            counter = this.deps.coordinator ? await this.counterOf(id) : null;
+        const raw = await this.deps.store.get(dirKey(id));
+        // An absent record is an EMPTY directory, not an error: the root
+        // exists before anything has been written to it, and a directory is
+        // created by its parent naming it rather than by its own record
+        // appearing.
+        if (raw === null || raw === undefined) {
+            const node = { v: 1, entries: emptyEntries(), mtime: Date.now() };
+            return { id, key, path, node, hidden: Object.create(null), gen, seen, counter };
+        }
+        // Present but unopenable is NOT absent. `unseal` folds the two
+        // together, which suits a record that can simply be rebuilt; a
+        // directory cannot, because rebuilding it means sealing an empty
+        // one over whatever is really there. And it is not a raw
+        // DOMException either: the typed error is what delete, purge and
+        // sweep know how to step around, and it names the record.
+        let value;
+        try {
+            value = await openSealed(key, raw);
+        }
+        catch (err) {
+            if (err instanceof SealedRecordError)
+                throw new VfsCorruptRecordError(id, path, err.message);
+            throw err;
+        }
+        return this.readRecord(id, key, value, gen, seen, counter, path);
+    }
+    /** Record `id`'s write counter now: see `OpenDir.counter`. */
+    async counterOf(id) {
+        const coordinator = this.deps.coordinator;
+        if (!coordinator)
+            return null;
+        const [counter] = await coordinator.counters([id]).catch(() => [null]);
+        return counter ?? null;
+    }
     /**
      * Turn a decrypted record into an OpenDir, or throw.
      *
@@ -16728,7 +17149,7 @@ class VfsNamespace {
      * see VfsCorruptRecordError. An individual entry of the wrong shape is set
      * aside in `hidden` instead: out of every read, but kept for the write.
      */
-    readRecord(id, key, value, gen, path) {
+    readRecord(id, key, value, gen, seen, counter, path) {
         const problem = recordProblem(value);
         if (problem)
             throw new VfsCorruptRecordError(id, path, problem);
@@ -16784,7 +17205,7 @@ class VfsNamespace {
             this.warn(`ignoring ${what} in ${path ?? `record ${printable(id, 40)}`}`);
         }
         // A v1 record's unknown top-level fields survive a write too.
-        return { id, key, path, node: { ...top, entries }, hidden, gen };
+        return { id, key, path, node: { ...top, entries }, hidden, gen, seen, counter };
     }
     /**
      * Apply an edit to a directory record and persist it.
@@ -16800,8 +17221,18 @@ class VfsNamespace {
      *
      * So `edit` must take what it writes from the record it is given, not
      * from anything read off `dir` before an await - and re-check whatever it
-     * relies on from then, throwing if another write changed it. Returning
-     * false writes nothing after all.
+     * relies on from then, throwing if another write changed it, before it
+     * changes anything. Returning false writes nothing after all.
+     *
+     * The write that carries the edit may carry others, made while an
+     * earlier write of the record was in flight (see `queue`): it lands, or
+     * fails, for all of them at once.
+     *
+     * With a coordinator, the edit may be made a second time, to the record
+     * as another tab left it, and refused then (see `replay`): an edit must
+     * check everything before it changes anything, and whatever it sets
+     * outside `node` and `record` must be safe to set again, since each run
+     * overwrites the last.
      */
     async mutate(dir, edit) {
         // At once when the copy is to hand, which it almost always is, so
@@ -16810,21 +17241,10 @@ class VfsNamespace {
         const target = this.editable(dir) ?? await this.reopen(dir);
         if (edit(target.node, target) === false)
             return;
-        target.node.mtime = Date.now();
-        // A write to a hidden entry's exact name replaces it: that name now
-        // means what this version wrote. Forgetting the old one here is also
-        // what stops a later delete of the replacement from resurrecting it.
-        for (const name of Object.keys(target.hidden)) {
-            if (Object.hasOwn(target.node.entries, name))
-                delete target.hidden[name];
-        }
-        // Not sent until any earlier write of this record has landed: see
-        // `writing`. Whether that one worked or not, this one still goes.
-        const before = this.writing.get(target.id);
-        const send = () => this.writeRecord(target);
-        const write = before ? before.then(send, send) : send();
-        this.copyOf.set(write, target);
-        this.writing.set(target.id, write);
+        this.touch(target);
+        const ticket = { edit };
+        const batch = this.queue(target, ticket);
+        const { write } = batch;
         try {
             await write;
         }
@@ -16851,6 +17271,10 @@ class VfsNamespace {
                 this.writing.delete(target.id);
         }
         this.adopt(target);
+        // Made again to the record as another tab left it, it no longer
+        // applied - see `replay` - and nothing of it was written.
+        if (batch.refused.has(ticket))
+            throw batch.refused.get(ticket);
     }
     /**
      * The copy of `dir`'s record that edits are made to, if there is one
@@ -16897,6 +17321,249 @@ class VfsNamespace {
         this.copyOf.set(cached, dir);
         this.cache.set(dir.id, cached);
     }
+    /** After an edit of `copy`: its time, and any entry it cannot read that the edit replaced. */
+    touch(copy) {
+        copy.node.mtime = Date.now();
+        // A write to a hidden entry's exact name replaces it: that name now
+        // means what this version wrote. Forgetting the old one here is also
+        // what stops a later delete of the replacement from resurrecting it.
+        for (const name of Object.keys(copy.hidden)) {
+            if (Object.hasOwn(copy.node.entries, name))
+                delete copy.hidden[name];
+        }
+    }
+    /**
+     * The write that will carry the edit just made to `copy`.
+     *
+     * Writes of a record go out one at a time, each once the one before it
+     * has landed or failed (see `writing`), and each seals the record as it
+     * stands when it goes out. So a write still waiting carries every edit
+     * made while it waits, and an edit made then joins it instead of
+     * queueing a write of its own: a burst of edits of one directory while a
+     * write of it is in flight costs two writes, not one per edit. Each is a
+     * billed write; a 20-file upload into one folder cost twenty.
+     */
+    queue(copy, ticket) {
+        const open = this.waiting.get(copy.id);
+        if (open?.copy === copy) {
+            open.edits.push(ticket);
+            return open;
+        }
+        const before = this.writing.get(copy.id);
+        const batch = { copy, edits: [ticket], refused: new Map() };
+        this.waiting.set(copy.id, batch);
+        // Not sent until any earlier write of this record has landed: see
+        // `writing`. Whether that one worked or not, this one still goes.
+        const send = () => this.send(batch);
+        batch.write = before ? before.then(send, send) : send();
+        this.copyOf.set(batch.write, copy);
+        this.writing.set(copy.id, batch.write);
+        return batch;
+    }
+    /**
+     * Send `batch`: from here on, an edit of its record goes in the next
+     * write. With a coordinator, holding the lock every tab of the device
+     * takes to write this record - see `sendLocked`.
+     */
+    send(batch) {
+        const coordinator = this.deps.coordinator;
+        if (!coordinator) {
+            this.close(batch);
+            return this.writeRecord(batch.copy);
+        }
+        // Closed under the lock once it is sealed (see `sendLocked`), and
+        // here too, for a lock never granted or a re-read that failed: left
+        // open, a later edit of the same copy would join a write that has
+        // already failed, and fail with it.
+        return coordinator.lock(batch.copy.id, () => this.sendLocked(batch, coordinator)).finally(() => this.close(batch));
+    }
+    /** Stop `batch` taking more edits, as it is sealed. */
+    close(batch) {
+        if (this.waiting.get(batch.copy.id) === batch)
+            this.waiting.delete(batch.copy.id);
+    }
+    /**
+     * Send `batch` while no other tab can write its record.
+     *
+     * If another tab wrote the record since this copy was read, the copy is
+     * out of date, and writing it would undo that tab's write. So it is read
+     * again, here, under the lock, and every edit the batch carries is made
+     * again to what was read (see `replay`). A copy no other tab has written
+     * over is sent as it is: one tab on its own costs no extra request.
+     *
+     * Which it is, the record's write counter says (see
+     * `VfsCoordinator.counters`). Read once the lock is granted, it counts
+     * every write of the record another tab made, because each counts its
+     * write, and waits for the count to be stored, before it lets go of the
+     * lock. If it has moved since the copy was read, or cannot be told, the
+     * copy is read again. Whether this tab has heard of another tab's write
+     * does not decide it: an announcement can reach this tab after the
+     * lock does, or never. One it has heard of can only add a read.
+     *
+     * The write is counted once it has landed or failed - one that failed
+     * may have landed even so - and the other tabs are then told of it,
+     * all before the lock is let go of.
+     */
+    async sendLocked(batch, coordinator) {
+        const { copy } = batch;
+        // Hearing for whoever is signed in now, before deciding: starting to
+        // hear - or hearing someone else - marks every copy out of date.
+        coordinator.listen();
+        const now = await coordinator.begin(copy.id).catch(() => null);
+        // Whether `copy` is, from here, the record as this tab leaves it.
+        let decided = false;
+        let sent = false;
+        try {
+            const current = now !== null && copy.counter === now && this.current(copy);
+            const fresh = copy.gen === this.generation && !current
+                ? await this.fetchRecord(copy.id, copy.key, copy.gen, copy.path, null)
+                : null;
+            // Nothing waits from here to the seal, so no edit can come in between.
+            this.close(batch);
+            decided = true;
+            this.locked.set(copy.id, copy);
+            if (fresh && !this.replay(batch, fresh))
+                return;
+            sent = true;
+            await this.writeRecord(copy);
+            copy.seen = this.hearing;
+        }
+        finally {
+            const counted = await coordinator.bump(copy.id).catch(() => null);
+            // Not when the read above failed: the copy is what it was, and
+            // the counter it held is out of date now.
+            if (decided)
+                copy.counter = counted;
+            if (this.locked.get(copy.id) === copy)
+                this.locked.delete(copy.id);
+            if (counted === null)
+                this.notCounted(copy, now !== null);
+            else
+                this.uncounted.delete(copy.id);
+            if (sent)
+                coordinator.announce(copy.id);
+        }
+    }
+    /**
+     * Say that a write of `copy`'s record could not be counted.
+     *
+     * `marked`: `VfsCoordinator.begin` stored its mark, which stays until a
+     * count can be stored, so every tab reads the record again before it
+     * writes it. Said once for each record, until a write of it is counted.
+     *
+     * Not marked, a tab whose IndexedDB works may take its copy for current
+     * and write it over this write. Said once for this namespace, whatever
+     * the record: where IndexedDB cannot be used at all, no write of any
+     * folder is counted, and a warning for each said nothing new. And only
+     * where another tab can count its writes can one be lost, which the
+     * warning says: where no tab can, every tab reads each folder again.
+     */
+    notCounted(copy, marked) {
+        const where = copy.path ?? `record ${printable(copy.id, 40)}`;
+        if (!marked) {
+            if (this.lossWarned)
+                return;
+            this.lossWarned = true;
+            this.warn(`a write of ${where} by this tab could not be counted in IndexedDB, where this app's other tabs look before writing a folder. Such a write may be lost only if another tab of this app can count its writes: that tab may write the folder without reading it again. Said once per Client, for every write of a folder that cannot be counted`);
+            return;
+        }
+        if (this.uncounted.has(copy.id))
+            return;
+        this.uncounted.add(copy.id);
+        this.warn(`a write of ${where} by this tab could not be counted in IndexedDB; until one can be, every tab of this app reads ${where} again before writing it`);
+    }
+    /**
+     * Make every edit in `batch` again, in order, to `fresh` - the record as
+     * another tab left it - and make that the copy. An edit that no longer
+     * applies throws, as it would have the first time, and is left out; its
+     * caller gets what it threw. Every edit checks before it changes
+     * anything (see `mutate`), so one that throws has changed nothing. True
+     * when what is left changes the record, and so needs writing.
+     */
+    replay(batch, fresh) {
+        const { copy } = batch;
+        copy.node = fresh.node;
+        copy.hidden = fresh.hidden;
+        copy.seen = fresh.seen;
+        copy.counter = fresh.counter;
+        let changed = false;
+        for (const ticket of batch.edits) {
+            try {
+                if (ticket.edit(copy.node, copy) !== false)
+                    changed = true;
+            }
+            catch (err) {
+                batch.refused.set(ticket, err);
+            }
+        }
+        if (changed)
+            this.touch(copy);
+        return changed;
+    }
+    /**
+     * Another tab wrote record `id` - or, null, this namespace may have
+     * missed some announcements. What the cache holds is read again when
+     * next asked for, as a change frame from the personal space would have
+     * it, and a copy read before then is read again before the next write
+     * of its record (see `current`). A hint, not a guarantee: an
+     * announcement can reach this tab after the next lock does, or never.
+     * What decides whether a copy may be written over, or relied on under a
+     * move's or a delete's locks, is the record's counter: see `sendLocked`
+     * and `dropStale`.
+     */
+    heard(id) {
+        const at = ++this.hearing;
+        if (id === null) {
+            this.missedAt = at;
+            this.cache.clear();
+            return;
+        }
+        this.heardAt.set(id, at);
+        this.cache.delete(id);
+    }
+    /**
+     * Does `copy` hold every write of its record another tab has announced
+     * that this one has heard of? See `heard`. Only ever a reason to read it
+     * again, never to take it for current: see `sendLocked`.
+     */
+    current(copy) {
+        return copy.seen >= Math.max(this.missedAt, this.heardAt.get(copy.id) ?? 0);
+    }
+    /**
+     * Drop from the cache every copy of a record in `ids` that may not hold
+     * every write of it another tab has made: its counter has moved since
+     * the copy was read, or cannot be told, or the copy is still being read.
+     * Returns every id whose copy here is not known to be current - those,
+     * and those not cached - so that the next read of each fetches it again,
+     * once any write of it in flight here has landed or failed. Not a copy
+     * this tab is writing under its lock (see `locked`): its counter reads
+     * as unknown only because that write is not counted yet, and dropped,
+     * the next read would wait for the write.
+     *
+     * The counters are read in one go, after the caller has taken the locks
+     * it relies on: another tab counts each write of a record before it lets
+     * go of the locks it held while writing it, the record's own and any
+     * move lock, so what it wrote before letting go of one of them is
+     * counted by then. Its announcements may not have reached this tab yet,
+     * or ever. See `sendLocked`.
+     */
+    async dropStale(coordinator, ids) {
+        const asked = [...new Set(ids)];
+        const now = asked.length ? await coordinator.counters(asked).catch(() => asked.map(() => null)) : [];
+        const stale = new Set();
+        asked.forEach((id, i) => {
+            const cached = this.cache.get(id);
+            const copy = cached && this.copyOf.get(cached);
+            if (copy && copy.gen === this.generation && copy.counter !== null && copy.counter === now[i])
+                return;
+            if (copy && copy.gen === this.generation && this.locked.get(id) === copy)
+                return;
+            if (cached)
+                this.cache.delete(id);
+            stale.add(id);
+        });
+        return stale;
+    }
     /**
      * Seal a directory record as it stands NOW and put it in the store.
      *
@@ -16928,12 +17595,15 @@ class VfsNamespace {
         assertValidName(name);
         const parent = await this.openDir(parentPath);
         const entry = { kind: "dir", id: newId(), key: toBase64(newDirKey()), mtime: Date.now() };
-        await this.mutate(parent, (node, record) => {
+        // The directory the edit below last found there, if any.
+        let there;
+        const named = this.mutate(parent, (node, record) => {
             // mkdir looked before the wait above. A directory made there
             // since, by another `mkdir -p` of the same path - files saved
             // at once into a new folder - is kept, not replaced: whatever
             // was saved into it would go with it.
             const now = entryIn(node, name);
+            there = now;
             if (now?.kind === "dir" && recursive)
                 return false;
             if (now)
@@ -16942,6 +17612,16 @@ class VfsNamespace {
             node.entries[name] = entry;
             return true;
         });
+        // Set before anyone can find the entry in the cached parent - `mutate`
+        // makes the edit at once, or after a re-read - so a mkdir that finds
+        // it there waits for this write. See `naming`.
+        this.naming.set(entry.id, named.then(() => { }, () => { }).then(() => void this.naming.delete(entry.id)));
+        await named;
+        // The directory kept instead may be one another mkdir here named,
+        // its write not landed yet: wait for that too, as `mkdir` does.
+        const kept = there && this.naming.get(there.id);
+        if (kept)
+            await kept;
     }
     /**
      * Every directory record in a subtree, each once, opened - and nothing
@@ -16957,14 +17637,22 @@ class VfsNamespace {
      *
      * `moving` says whether anything in it is marked as half of an
      * interrupted move, which is what makes a delete look for the other half.
+     *
+     * `ids` is every entry id in it, and `shape` what each record named when
+     * it was read: see `currentSubtree`.
      */
     async subtree(top, target, above) {
         const found = new Map([[top.id, top]]);
         const pending = [top];
+        // Every entry id in it, and what each record named as it was read.
+        const ids = new Set();
+        const shape = new Map();
         let spared = 0;
         let moving = false;
         for (let dir = pending.pop(); dir; dir = pending.pop()) {
+            shape.set(dir.id, namedIn(dir));
             for (const [, entry] of followable(dir)) {
+                ids.add(entry.id);
                 if (entry.moving === true)
                     moving = true;
                 if (entry.kind !== "dir" || found.has(entry.id))
@@ -16994,7 +17682,79 @@ class VfsNamespace {
             const what = spared === 1 ? "a directory that is" : `${spared} directories that are`;
             this.warn(`leaving ${what} above ${target} in the tree alone while deleting it`);
         }
-        return { dirs: [...found.values()], moving };
+        return { dirs: [...found.values()], moving, ids, shape };
+    }
+    /**
+     * The records a recursive delete read, as they are now - or null when
+     * one has changed since in a way that purging it would get wrong.
+     *
+     * The delete decided what to let go of, and whether to look for the
+     * other half of a move, from what it read; then it waited, on reads and
+     * on the write of its parent. A record that is no longer named by the
+     * record it was read in has been moved out, and is not this delete's to
+     * purge; an entry marked since it was read is being moved, and is about
+     * to be named somewhere the delete never looked. Purging either purged
+     * the folder a move had just put somewhere else. Anything else - a file
+     * saved into one of them, or moved out - is purged as it now stands,
+     * which is why the copies to purge are what this returns.
+     *
+     * Synchronous, for an edit. A record whose copy is not to hand counts as
+     * changed.
+     *
+     * `held`, with a coordinator, is every entry whose move lock the delete
+     * holds. An entry named since the records were read - saved or moved in
+     * - is not among them, so nothing stops another tab moving it out while
+     * the delete writes the parent, and purging it then let go of what that
+     * move had put somewhere else. So with `held`, that counts as changed
+     * too, and the delete is tried again from the start.
+     */
+    currentSubtree(dirs, shape, held) {
+        const doomed = new Set(dirs.map((dir) => dir.id));
+        const current = [];
+        for (const dir of dirs) {
+            const now = this.editable(dir);
+            if (!now)
+                return null;
+            const read = shape.get(dir.id) ?? new Map();
+            const named = namedIn(now);
+            for (const [id, marked] of named)
+                if (marked && read.get(id) !== true)
+                    return null;
+            for (const id of read.keys())
+                if (doomed.has(id) && !named.has(id))
+                    return null;
+            if (held)
+                for (const id of named.keys())
+                    if (!held.has(id))
+                        return null;
+            current.push(now);
+        }
+        return current;
+    }
+    /**
+     * Hold the move lock of every entry in `ids` - see
+     * `VfsCoordinator.holdMoving` - or of none: null when another holder has
+     * any of them, and then nothing is held. Otherwise the function that
+     * lets go of them all. Asked for all at once: none of them waits.
+     * `shared` holds them as the folders a move goes into.
+     */
+    async holdAll(coordinator, ids, shared = false) {
+        const tries = await Promise.allSettled([...new Set(ids)].map((id) => coordinator.holdMoving(id, shared)));
+        const held = tries.flatMap((tried) => (tried.status === "fulfilled" && tried.value ? [tried.value] : []));
+        const release = () => {
+            for (const letGo of held)
+                letGo();
+        };
+        const failed = tries.find((tried) => tried.status === "rejected");
+        if (failed) {
+            release();
+            throw failed.reason;
+        }
+        if (held.length < tries.length) {
+            release();
+            return null;
+        }
+        return release;
     }
     /**
      * Delete these records and let go of every file in them. The second half
@@ -17255,7 +18015,10 @@ class VfsNamespace {
         }
         if (!run.write)
             return clone;
-        const open = { id: clone.id, key: fromBase64(clone.key), node, hidden: Object.create(null), gen: run.gen };
+        const counter = this.deps.coordinator ? await this.counterOf(clone.id) : null;
+        const open = {
+            id: clone.id, key: fromBase64(clone.key), node, hidden: Object.create(null), gen: run.gen, seen: this.hearing, counter,
+        };
         await this.deps.store.put(dirKey(open.id), await seal(open.key, node));
         this.adopt(open);
         return clone;
@@ -18605,6 +19368,519 @@ class VcsNamespace {
     }
 }
 
+/**
+ * Coordination between the tabs of an app on one device: Web Locks, the
+ * Web BroadcastChannel, and IndexedDB.
+ *
+ * Every factory here returns undefined unless the runtime is a browser tab
+ * with both Web Locks and a BroadcastChannel - not Node (which has
+ * `navigator.locks` from 24.5, but per process), not a Worker, not an old
+ * WebView - and its callers then keep the behaviour they had before: one
+ * tab's writes ordered among themselves only. IndexedDB is not required:
+ * without it no count can be told, and every write reads its folder again
+ * first. A storage-partitioned iframe gets locks, a channel and IndexedDB of
+ * its own, as it gets storage of its own; to the app's other tabs it is
+ * another device.
+ *
+ * A browser can also have these and refuse them to a document: an opaque
+ * origin (a sandboxed iframe, a `data:` document), or a site whose data the
+ * user has blocked. Refused Web Locks, the coordinator goes on without
+ * them, as in Node (see `refusesLocks`); refused a channel, it hears
+ * nothing; and an IndexedDB that does not answer in time counts nothing
+ * (see `writeCounts`). `client.vfs` needed none of the three before it
+ * coordinated tabs, and none of them may stop it now.
+ *
+ * `globalThis.BroadcastChannel` is named in full on purpose: this package
+ * exports a class of its own called BroadcastChannel (the E2E room channel),
+ * and an import of that in scope would silently take the Web API's place.
+ */
+/** How long a write waits for another tab to finish writing the same folder before it gives up. */
+const LOCK_WAIT_MS = 30_000;
+/**
+ * How long each call to the write counts - `counters`, `begin` or `bump` -
+ * may take before it gives up, telling nothing, as one that failed: the
+ * wait for the IndexedDB open and the call's transaction together, not
+ * each. Only the call gives up, not the open: one that succeeds later,
+ * within `OPEN_DROP_MS`, is kept for every later call (see `writeCounts`).
+ */
+const COUNT_WAIT_MS = 3_000;
+/**
+ * How long an IndexedDB open of the write counts may go without any answer
+ * - no success, error or blocked - before it is dropped, as one that
+ * failed, and the next call asks for another. See `writeCounts`.
+ */
+const OPEN_DROP_MS = 30_000;
+/**
+ * Whether `err`, from a Web Locks request that was never granted, is the
+ * browser refusing Web Locks to this document altogether: an opaque origin,
+ * or a site whose data the user has blocked. The browser makes that
+ * decision for the site's storage, so it refuses every tab of the app
+ * alike, and no tab holds the lock. The tab then goes on without it, as in
+ * Node. Any other error - a document no longer fully active, say - is
+ * passed on.
+ */
+function refusesLocks(err) {
+    return err?.name === "SecurityError";
+}
+// Through `unknown`: the DOM's own LockManager and BroadcastChannel types do
+// not line up with these slices closely enough for a direct cast.
+function webLocks() {
+    if (typeof window === "undefined")
+        return undefined;
+    const locks = globalThis.navigator?.locks;
+    return typeof locks?.request === "function" ? locks : undefined;
+}
+function webChannel() {
+    const Channel = globalThis.BroadcastChannel;
+    return typeof Channel === "function" ? Channel : undefined;
+}
+function webIndexedDB() {
+    const idb = globalThis.indexedDB;
+    return typeof idb?.open === "function" ? idb : undefined;
+}
+/**
+ * The IndexedDB database the write counts are kept in, one per origin, as
+ * the locks are. Not one connect keeps for anything else: those are
+ * `muhkoo.offline` (the offline layer), `muhkoo.trust` and `muhkoo.device.v1`.
+ *
+ * Its version stays 1 for good. A tab still running code that opens it at
+ * version 1 would fail with a VersionError once a newer tab had made it at
+ * version 2, count nothing, and so write a folder without the newer tabs
+ * knowing: the writer whose write may be lost. A new store goes in a new
+ * database.
+ */
+const COUNTS_DB = "muhkoo.vfs";
+/** Its one store: `[commitment, record id]` to a count, and `CREATED` to a random id. */
+const COUNTS = "counts";
+const CREATED = "created";
+/**
+ * How often each user's directory records have been written on this
+ * device: `VfsCoordinator.counters`, `begin` and `bump`, kept in IndexedDB
+ * for every tab of the origin.
+ *
+ * A count is odd from `begin` to `bump`, while a write is under way, and
+ * even once it is counted; `counters` reports an odd one as unknown. It is
+ * read as `<created>:<count>`, where `created` is a random id stored when
+ * the database was made: deleted - the site's data cleared - every count
+ * starts again from nothing, and a counter read before could otherwise
+ * come round again with writes in between that its copy does not hold.
+ *
+ * Each operation is one transaction, and settles once that has completed.
+ * Every failure - IndexedDB missing, an open refused, blocked or failed, a
+ * transaction aborted - resolves to null, which the namespace takes for out
+ * of date: it reads the record again. A failed or blocked open is not kept,
+ * and nor is a connection closed under it, by a newer version of this code
+ * in another tab or by the database being deleted: the next operation opens
+ * the database again.
+ *
+ * So does an operation that has not settled within `waitMs`, the open it
+ * waits for and its transaction together: these are awaited inside the
+ * record locks, and one waited for without end would hold the lock, and
+ * stop every read and write of the tab's folders, for as long. Only the
+ * operation gives up, though, not the open: there is one open under way at
+ * a time, every operation waits for that one, and once it has opened the
+ * database it is kept for every later operation. Given up on too, and closed
+ * when it opened at last, an open that always takes longer than `waitMs`
+ * would never give the tab its counts. An open that has not answered at all
+ * within `OPEN_DROP_MS` is dropped, though, as one that failed: one that
+ * never will would otherwise leave the tab without counts for as long as it
+ * lives. Until then every operation waits for it, `waitMs` at most, and
+ * tells nothing; the next operation after that asks for one new open; and
+ * the dropped one, if it opens after all, is closed. The new open is
+ * dropped in turn if it goes `OPEN_DROP_MS` without an answer too, and so
+ * on: where IndexedDB never answers, the tab leaves behind one more open
+ * that never settles every `OPEN_DROP_MS` or a little more, for as long as
+ * operations keep coming, and none while none come. An operation that
+ * gives up before the database has opened makes no transaction. A
+ * transaction given up on is not aborted, and may still complete: IndexedDB
+ * runs the read-write transactions of one store in the order they were
+ * made, so a late `begin` still marks the count before any later `bump`,
+ * and a late `bump` still counts its write before any later `begin`. A tab
+ * that asks meanwhile waits behind it, gives up, and reads the record
+ * again.
+ */
+function writeCounts(idb, waitMs) {
+    // The open under way, or the one that opened `opened`: one at a time.
+    let connection = null;
+    // The database `connection` opened, once it has.
+    let opened = null;
+    // Drops `connection` while it is under way, once `OPEN_DROP_MS` have passed.
+    let dropping;
+    const forget = (db) => {
+        if (opened !== db)
+            return;
+        opened = null;
+        connection = null;
+        db.close();
+    };
+    const open = () => {
+        if (connection)
+            return connection;
+        let request;
+        try {
+            if (!idb)
+                throw new Error("no IndexedDB");
+            request = idb.open(COUNTS_DB, 1);
+        }
+        catch {
+            // Not kept: the next operation tries again.
+            return Promise.resolve(null);
+        }
+        const pending = new Promise((resolve) => {
+            // Not kept when it failed, or was dropped: the next operation
+            // tries again. Failed after it was dropped, it changes nothing.
+            const fail = () => {
+                if (connection === pending) {
+                    clearTimeout(dropping);
+                    connection = null;
+                }
+                resolve(null);
+            };
+            request.onupgradeneeded = () => {
+                request.result.createObjectStore(COUNTS).put(generateId(), CREATED);
+            };
+            request.onsuccess = () => {
+                const db = request.result;
+                // Blocked or dropped, and given up on, before it opened - or
+                // closed by `close`. Another open may be under way by now.
+                if (connection !== pending) {
+                    db.close();
+                    resolve(null);
+                    return;
+                }
+                clearTimeout(dropping);
+                db.onversionchange = () => forget(db);
+                db.onclose = () => forget(db);
+                opened = db;
+                resolve(db);
+            };
+            // Blocked: another tab holds an older version open. Not waited for.
+            request.onerror = fail;
+            request.onblocked = fail;
+            // No answer at all: dropped, as one that failed, and the next
+            // operation asks for another - dropped in turn if it does not
+            // answer either. See above.
+            dropping = setTimeout(fail, OPEN_DROP_MS);
+        });
+        connection = pending;
+        return pending;
+    };
+    /**
+     * Run `body` in one transaction, and resolve once that has completed to
+     * what the function it returns gives then - or to null, if anything
+     * fails, or the database has not opened and the transaction completed
+     * within `waitMs`.
+     */
+    const run = (mode, body) => new Promise((resolve) => {
+        let done = false;
+        const settle = (value) => {
+            if (done)
+                return;
+            done = true;
+            clearTimeout(timer);
+            resolve(value);
+        };
+        // Given up on, but neither the open nor the transaction aborted: see above.
+        const timer = setTimeout(() => settle(null), waitMs);
+        void open().then((db) => {
+            // Given up on while it opened: nothing to do.
+            if (done)
+                return;
+            if (!db) {
+                settle(null);
+                return;
+            }
+            let tx;
+            try {
+                tx = db.transaction(COUNTS, mode);
+                const result = body(tx.objectStore(COUNTS));
+                tx.oncomplete = () => settle(result());
+                tx.onabort = () => settle(null);
+            }
+            catch {
+                try {
+                    tx?.abort();
+                }
+                catch {
+                    // Finished already.
+                }
+                // Closed under it, most likely: the next operation opens it again.
+                forget(db);
+                settle(null);
+            }
+        });
+    });
+    const count = (value) => (typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : 0);
+    const counter = (created, n) => (typeof created === "string" ? `${created}:${n}` : null);
+    return {
+        async counters(who, ids) {
+            const read = await run("readonly", (store) => {
+                const created = store.get(CREATED);
+                const counts = ids.map((id) => store.get([who, id]));
+                return () => counts.map((at) => {
+                    const n = count(at.result);
+                    return n % 2 === 0 ? counter(created.result, n) : null;
+                });
+            });
+            return read ?? ids.map(() => null);
+        },
+        begin(who, id) {
+            return run("readwrite", (store) => {
+                const created = store.get(CREATED);
+                const at = store.get([who, id]);
+                let n = 0;
+                at.onsuccess = () => {
+                    n = count(at.result);
+                    // Odd already, a write began and was never counted: its mark stays.
+                    if (n % 2 === 0)
+                        store.put(n + 1, [who, id]);
+                };
+                return () => counter(created.result, n);
+            });
+        },
+        bump(who, id) {
+            return run("readwrite", (store) => {
+                const created = store.get(CREATED);
+                const at = store.get([who, id]);
+                let next = 0;
+                at.onsuccess = () => {
+                    const n = count(at.result);
+                    // Past the mark `begin` stored - or, when it could not
+                    // store one, past the count it found.
+                    next = n % 2 === 0 ? n + 2 : n + 1;
+                    store.put(next, [who, id]);
+                };
+                return () => counter(created.result, next);
+            });
+        },
+        close() {
+            // An open still under way is closed once it opens.
+            connection = null;
+            clearTimeout(dropping);
+            if (opened)
+                forget(opened);
+        },
+    };
+}
+/**
+ * The offline queue's drain lock: `fn` runs only if no other tab is
+ * draining, and `false` says another one is. See `OutboundQueue`. Where the
+ * browser refuses Web Locks, `fn` runs without it, as in Node, and the
+ * lock is not asked for again: see `refusesLocks`.
+ */
+function drainLock() {
+    const locks = webLocks();
+    if (!locks)
+        return undefined;
+    let refused = false;
+    return async (name, fn) => {
+        if (!refused) {
+            let answered = false;
+            try {
+                return await locks.request(name, { ifAvailable: true }, async (lock) => {
+                    answered = true;
+                    if (!lock)
+                        return false;
+                    await fn();
+                    return true;
+                });
+            }
+            catch (err) {
+                if (answered || !refusesLocks(err))
+                    throw err;
+                refused = true;
+            }
+        }
+        await fn();
+        return true;
+    };
+}
+/**
+ * The `VfsCoordinator` for whoever `commitment()` names: a lock per record,
+ * `muhkoo:vfs:<commitment>:<record id>`; a move lock per entry,
+ * `muhkoo:vfs:<commitment>:moving:<entry id>`, taken only if free, and
+ * shared by the moves into a folder; a count of each record's writes, in
+ * IndexedDB `muhkoo.vfs` under `[commitment, record id]` (see
+ * `writeCounts`); and announcements on the channel `muhkoo:vfs:<commitment>`
+ * as `{ id, writer }`, where `writer` is this tab's random id. `close` is
+ * for tests, as are `lockWaitMs` (see `LOCK_WAIT_MS`) and `countWaitMs`
+ * (see `COUNT_WAIT_MS`).
+ *
+ * Where the browser refuses Web Locks (see `refusesLocks`), it holds no
+ * lock - every write runs as it would without a coordinator, and every
+ * move lock is had at once - and asks for none again.
+ */
+function vfsCoordinator(commitment, opts = {}) {
+    const locks = webLocks();
+    const Channel = webChannel();
+    if (!locks || !Channel)
+        return undefined;
+    const lockWaitMs = opts.lockWaitMs ?? LOCK_WAIT_MS;
+    const tab = generateId();
+    const counts = writeCounts(webIndexedDB(), opts.countWaitMs ?? COUNT_WAIT_MS);
+    const handlers = new Set();
+    // `channel` is null where the browser would not make one: see `listen`.
+    let open = null;
+    // Move locks this tab has let go of, until the browser has too. See `holdMoving`.
+    const leaving = new Map();
+    // The browser refused Web Locks: see `refusesLocks`.
+    let refused = false;
+    /**
+     * Hear the channel of whoever is signed in now: opened the first time,
+     * and opened again for someone else after a sign-in. What was announced
+     * before it opened was not heard, which every handler is told.
+     *
+     * Where the browser will not make the channel - an opaque origin, or a
+     * site whose data is blocked - this tab hears nothing and tells no one,
+     * and does not ask again for the same user. That is safe: the counts,
+     * not the announcements, decide whether a copy may be written over.
+     */
+    const listen = () => {
+        const who = commitment();
+        if (open?.who === who)
+            return;
+        open?.channel?.close();
+        open = null;
+        if (!who)
+            return;
+        let channel = null;
+        try {
+            channel = new Channel(`muhkoo:vfs:${who}`);
+            channel.onmessage = (event) => {
+                const data = event.data;
+                if (typeof data?.id !== "string" || data.writer === tab)
+                    return;
+                for (const handler of handlers)
+                    handler(data.id);
+            };
+        }
+        catch {
+            channel = null;
+        }
+        open = { who, channel };
+        for (const handler of handlers)
+            handler(null);
+    };
+    return {
+        async lock(id, fn) {
+            listen();
+            const who = commitment();
+            // Signed out: the store refuses the write itself, with a clearer
+            // message. Refused Web Locks: no tab of the app can hold this
+            // lock, and the write goes ahead as it would without one.
+            if (!who || refused)
+                return fn();
+            // Only the WAIT is bounded. Once granted, the lock is held until
+            // the write has landed or failed: let go of while a write is still
+            // on its way, the next tab's write could land first and then be
+            // undone by it - the very loss this lock is for.
+            const waiting = new AbortController();
+            const timer = setTimeout(() => waiting.abort(), lockWaitMs);
+            let granted = false;
+            try {
+                return await locks.request(`muhkoo:vfs:${who}:${id}`, { signal: waiting.signal }, () => {
+                    granted = true;
+                    clearTimeout(timer);
+                    return fn();
+                });
+            }
+            catch (err) {
+                if (!granted && waiting.signal.aborted) {
+                    throw new VfsConflictError(`another tab of this app has been writing this folder for over ${Math.round(lockWaitMs / 1000)} seconds; nothing was written - try again`);
+                }
+                if (granted || !refusesLocks(err))
+                    throw err;
+                refused = true;
+            }
+            finally {
+                clearTimeout(timer);
+            }
+            // Refused Web Locks, before anything was written: written without one.
+            return fn();
+        },
+        announce(id) {
+            listen();
+            open?.channel?.postMessage({ id, writer: tab });
+        },
+        onAnnounce(handler) {
+            handlers.add(handler);
+            return () => void handlers.delete(handler);
+        },
+        listen,
+        // Signed out, nothing is counted: the store refuses the reads and
+        // writes themselves.
+        async counters(ids) {
+            const who = commitment();
+            return who ? counts.counters(who, ids) : ids.map(() => null);
+        },
+        async begin(id) {
+            const who = commitment();
+            return who ? counts.begin(who, id) : null;
+        },
+        async bump(id) {
+            const who = commitment();
+            return who ? counts.bump(who, id) : null;
+        },
+        async holdMoving(id, shared = false) {
+            const who = commitment();
+            // Signed out: the store refuses the writes themselves. Refused Web
+            // Locks, no tab of the app can hold this lock.
+            if (!who || refused)
+                return () => { };
+            const name = `muhkoo:vfs:${who}:moving:${id}`;
+            // Let go of by this tab, but perhaps not yet by the browser, which
+            // lets go only once the callback below has settled. Asked for
+            // before then - a move or a delete straight after another of the
+            // same entry - it is still held, and this tab refuses itself.
+            const before = leaving.get(name);
+            if (before)
+                await before;
+            return new Promise((resolve, reject) => {
+                let answered = false;
+                const request = locks.request(name, { ifAvailable: true, mode: shared ? "shared" : "exclusive" }, async (lock) => {
+                    answered = true;
+                    if (!lock) {
+                        resolve(null);
+                        return;
+                    }
+                    // Held until this settles: when the function handed back
+                    // is called, or when the tab goes and the browser lets go
+                    // of everything it held.
+                    let held = true;
+                    await new Promise((letGo) => resolve(() => {
+                        if (!held)
+                            return;
+                        held = false;
+                        // Settles once the browser has let go of it too,
+                        // and of every other hold of it this tab has let
+                        // go of: two moves into one folder hold it at once.
+                        const gone = Promise.all([leaving.get(name), request.then(() => { }, () => { })]).then(() => { });
+                        leaving.set(name, gone);
+                        void gone.then(() => {
+                            if (leaving.get(name) === gone)
+                                leaving.delete(name);
+                        });
+                        letGo();
+                    }));
+                });
+                request.catch((err) => {
+                    if (answered || !refusesLocks(err)) {
+                        reject(err);
+                        return;
+                    }
+                    refused = true;
+                    resolve(() => { });
+                });
+            });
+        },
+        close() {
+            open?.channel?.close();
+            open = null;
+            counts.close();
+        },
+    };
+}
+
 /**
  * `HlcTimestamp` — a Hybrid Logical Clock reading, packed into a single
  * lexicographically-sortable string so the whole offline layer (and the
@@ -18891,13 +20167,19 @@ class ConnectivityManager {
  * Replays are idempotent by construction (kv/db are LWW-by-key, messages dedupe
  * by `clientId`, file PUTs are content-addressed), so re-running a partially
  * drained queue is safe.
+ *
+ * Every tab of an origin shares the queue. Given a `tryLock`, a drain runs
+ * only while holding `muhkoo:offline-drain:<commitment>`, so two tabs coming
+ * back online replay it once between them, not once each.
  */
 class OutboundQueue {
     store;
+    opts;
     replayers = new Map();
     draining = null;
-    constructor(store) {
+    constructor(store, opts = {}) {
         this.store = store;
+        this.opts = opts;
     }
     /** A domain registers how to replay its mutations. */
     register(domain, replayer) {
@@ -18919,11 +20201,31 @@ class OutboundQueue {
     drain() {
         if (this.draining)
             return this.draining;
-        this.draining = this.runDrain().finally(() => {
+        this.draining = this.drainOnce().finally(() => {
             this.draining = null;
         });
         return this.draining;
     }
+    /**
+     * One drain, holding the device-wide drain lock where there is one. A
+     * tab that finds another tab holding it leaves the queue to that one,
+     * which is replaying it already and removes each entry as it lands - so
+     * a drain after it finds only what it left.
+     */
+    async drainOnce() {
+        const who = this.opts.commitment?.();
+        if (!this.opts.tryLock || !who)
+            return this.runDrain();
+        await this.opts.tryLock(`muhkoo:offline-drain:${who}`, async () => {
+            // A tab that found this one draining skipped its own drain, and
+            // what it queued after this pass read the queue was left to this
+            // tab. So drain until a pass leaves nothing; a transient failure
+            // still stops it, by throwing.
+            do {
+                await this.runDrain();
+            } while ((await this.store.queued()).length > 0);
+        });
+    }
     async runDrain() {
         const entries = await this.store.queued();
         for (const entry of entries) {
@@ -19170,6 +20472,14 @@ const META_NODE_ID = "nodeId";
  * stay decoupled from IndexedDB and the clock.
  */
 const HLC_STATE_KEY = "global";
+/**
+ * A random suffix for this tab's HLC node id, held in memory only - see
+ * `OfflineManager.boot`. 48 bits: two tabs of one device never draw the same.
+ */
+function tabSuffix() {
+    const bytes = crypto.getRandomValues(new Uint8Array(6));
+    return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
 class OfflineManager {
     /** True in browsers with IndexedDB; false when running over a NoopStore. */
     enabled;
@@ -19188,7 +20498,10 @@ class OfflineManager {
     constructor(deps) {
         this.enabled = deps.enabled;
         this.store = deps.store;
-        this.queue = new OutboundQueue(deps.store);
+        this.queue = new OutboundQueue(deps.store, {
+            tryLock: deps.locks,
+            commitment: () => deps.session.commitment,
+        });
         this.connectivity = new ConnectivityManager({
             onReconnect: () => void this.sync.run(),
         });
@@ -19286,14 +20599,22 @@ class OfflineManager {
             this.hlc = new HLC(this.nodeId);
             return;
         }
-        let nodeId = await this.store.get("meta", META_NODE_ID);
-        if (!nodeId) {
-            nodeId = generateId();
-            await this.store.put("meta", META_NODE_ID, nodeId);
-        }
-        this.nodeId = nodeId;
+        let deviceId = await this.store.get("meta", META_NODE_ID);
+        if (!deviceId) {
+            deviceId = generateId();
+            await this.store.put("meta", META_NODE_ID, deviceId);
+        }
+        // One node id per TAB, under the device's. Every tab of an origin
+        // loads the same stored id, and two tabs stamping with it in the same
+        // millisecond minted identical HLCs: the node id is the tiebreak, and
+        // the server keeps the first of two equal stamps, so the second write
+        // was dropped. The suffix lives in memory only. The clock state below
+        // stays shared, so the clock never goes back across tabs, and stamps
+        // stored already stay valid: every comparison reads a packed stamp as
+        // one string and never parses the node id.
+        this.nodeId = `${deviceId}.${tabSuffix()}`;
         const state = await this.store.get("hlc-state", HLC_STATE_KEY);
-        this.hlc = new HLC(nodeId, { state });
+        this.hlc = new HLC(this.nodeId, { state });
     }
     /** Coalesce HLC-state writes — a burst of stamps persists once. */
     schedulePersist() {
@@ -19801,6 +21122,8 @@ class Client {
             store: offlineStore,
             session: this.session,
             enabled: offlineEnabled,
+            // Every tab of the origin shares the queue: one drains it at a time.
+            locks: drainLock(),
         });
         // Wrap fetch so every accelerator round-trip feeds the connectivity
         // detector: a thrown fetch is the strongest "offline" signal, a 2xx the
@@ -19921,6 +21244,9 @@ class Client {
         this.vfs = new VfsNamespace({
             store: personalStore,
             seed: () => this.session.seed,
+            // Orders writes of a folder with this app's other tabs on the
+            // device - undefined outside a browser tab with Web Locks.
+            coordinator: vfsCoordinator(() => this.session.commitment),
             // Share the personal space's socket with `client.kv` rather than
             // opening a second one to the same Durable Object.
             subscribe: (handler) => this.kv.onRaw(handler),