@muhkoo/connect 0.15.0-alpha.3 → 0.15.0-alpha.5

package/dist/browser/index.js

@@ -2742,6 +2742,106 @@ class BroadcastChannel {
     }
 }
 
+/**
+ * `HttpError` — thrown for any non-2xx accelerator response.
+ *
+ * In a module of its own so that `PaymentRequiredError` can extend it while
+ * `HttpClient`, which throws both, imports `PaymentRequiredError`: with the
+ * class in `HttpClient.ts`, the two modules would import each other, and
+ * whichever loaded second would extend a class not yet defined. `HttpClient`
+ * re-exports it, so `import { HttpError } from "./HttpClient"` still works.
+ */
+/** Thrown for any non-2xx accelerator response. Carries the HTTP status. */
+class HttpError extends Error {
+    status;
+    body;
+    constructor(message, status, body) {
+        super(message);
+        this.status = status;
+        this.body = body;
+        this.name = "HttpError";
+    }
+}
+
+/**
+ * `PaymentRequiredError` — a write the accelerator refused for payment
+ * (accelerator spec 2026-10-06-paid-accounts-and-past-due, "Interfaces and
+ * contracts").
+ *
+ * The accelerator answers such a write with a 402 whose body carries one of
+ * three codes:
+ *   - `user_plan_required`: the app takes paid Muhkoo plans only, and the
+ *     signed-in user is on Free;
+ *   - `user_payment_past_due`: the user's own Muhkoo payment is past due. Only
+ *     first-party apps are told this; every other app is told
+ *     `user_plan_required` instead;
+ *   - `owner_payment_past_due`: the app owner's payment is past due, so the
+ *     app stores nothing new for anyone.
+ * Reads, sign-in and deletes still work in all three cases.
+ *
+ * Every other 402 — the Free-tier refusals that carry `quotaExceeded`,
+ * `requiresPaidTier` or `freeTierFull` — has no `code`, and stays a plain
+ * `HttpError`, as before.
+ */
+const CODES = new Set([
+    "user_plan_required",
+    "user_payment_past_due",
+    "owner_payment_past_due",
+]);
+/** True for one of the three {@link PaymentRequiredCode}s. */
+function isPaymentRequiredCode(value) {
+    return typeof value === "string" && CODES.has(value);
+}
+/** `url` when it is an absolute http(s) URL, else undefined: an app may put it straight into a link. */
+function absoluteHttpUrl(url) {
+    return typeof url === "string" && /^https?:\/\/[^/]/i.test(url) ? url : undefined;
+}
+/** Thrown for a 402 whose body carries one of the three {@link PaymentRequiredCode}s. */
+class PaymentRequiredError extends HttpError {
+    /** Why the write was refused. */
+    code;
+    /**
+     * Where to send the user: the portal's upgrade page or its billing page,
+     * as an absolute URL. Set only when the server sent an absolute http(s)
+     * URL. The relative `upgradeUrl` of the Free-tier refusals is never here:
+     * those are not this error.
+     */
+    upgradeUrl;
+    constructor(message, code, body, upgradeUrl) {
+        super(message, 402, body);
+        this.name = "PaymentRequiredError";
+        this.code = code;
+        if (upgradeUrl !== undefined)
+            this.upgradeUrl = upgradeUrl;
+    }
+}
+/**
+ * The error to throw for a refused response: a {@link PaymentRequiredError}
+ * for a 402 whose body carries one of the three codes, and null for anything
+ * else, so the caller throws what it threw before. `body` is the parsed JSON,
+ * or the raw text of the response, which is parsed here.
+ */
+function paymentRequiredFrom(status, body) {
+    if (status !== 402)
+        return null;
+    let parsed = body;
+    if (typeof parsed === "string") {
+        try {
+            parsed = JSON.parse(parsed);
+        }
+        catch {
+            return null;
+        }
+    }
+    if (!parsed || typeof parsed !== "object")
+        return null;
+    const { code, error, upgradeUrl } = parsed;
+    if (!isPaymentRequiredCode(code))
+        return null;
+    const message = typeof error === "string" && error ? error : `Payment required (${code})`;
+    return new PaymentRequiredError(message, code, parsed, absoluteHttpUrl(upgradeUrl));
+}
+
 function _loadWasmModule (sync, filepath, src, imports) {
   function _instantiateOrCompile(source, imports, stream) {
     var instantiateFunc = WebAssembly.instantiate;
@@ -5261,14 +5361,19 @@ function nonceHexToFieldString(nonceHex) {
  */
 async function parseOrThrow$1(response, label) {
     if (!response.ok) {
-        let detail = "";
+        let text = "";
         try {
-            const text = await response.text();
-            detail = text ? `: ${text}` : "";
+            text = await response.text();
         }
         catch {
             // ignore — we'll just use the status code
         }
+        // A put refused for payment: its own class. Every other failure is the
+        // plain Error it always was.
+        const refused = paymentRequiredFrom(response.status, text);
+        if (refused)
+            throw refused;
+        const detail = text ? `: ${text}` : "";
         throw new Error(`PersonalSpaceClient ${label} failed (${response.status})${detail}`);
     }
     return (await response.json());
@@ -5916,6 +6021,8 @@ class ShardClient {
     baseUrl;
     pathPrefix;
     fetchFn;
+    /** What a PUT goes through: {@link ShardClientOptions.fetchWithRecovery} when given, else {@link fetchFn}. */
+    putFn;
     cache;
     /** Hashes waiting for the next batch, each with everyone awaiting it and its size if a caller gave it. */
     pendingShards;
@@ -5940,6 +6047,7 @@ class ShardClient {
             throw new Error("ShardClient: `globalThis.fetch` is unavailable; pass an explicit fetch.");
         }
         this.fetchFn = f.bind(globalThis);
+        this.putFn = opts.fetchWithRecovery ?? this.fetchFn;
         this.cache = opts.cache;
         // Coalescing state. `batchSupported` latches false against a deployment
         // without the batch route, so we degrade once rather than per request.
@@ -5983,7 +6091,7 @@ class ShardClient {
         }
         let response;
         try {
-            response = await this.fetchFn(url, {
+            response = await this.putFn(url, {
                 method: "PUT",
                 headers: { "content-type": "application/octet-stream" },
                 // BufferSource is what fetch's body expects; a Uint8Array satisfies it.
@@ -6001,7 +6109,10 @@ class ShardClient {
         }
         if (!response.ok) {
             const text = await safeText(response);
-            throw new Error(`ShardClient.putShard(${hash}) failed (${response.status}): ${text}`);
+            // Refused for payment: its own class, which the offline queue keeps
+            // and an app can tell from any other failure.
+            throw paymentRequiredFrom(response.status, text)
+                ?? new Error(`ShardClient.putShard(${hash}) failed (${response.status}): ${text}`);
         }
         let dedup = false;
         try {
@@ -6053,14 +6164,15 @@ class ShardClient {
     /** PUT the shard bytes to origin, verifying the server accepted them.
      *  Used by the background-upload path; throws on network/HTTP failure. */
     async uploadToOrigin(url, hash, bytes) {
-        const response = await this.fetchFn(url, {
+        const response = await this.putFn(url, {
             method: "PUT",
             headers: { "content-type": "application/octet-stream" },
             body: bytes,
         });
         if (!response.ok) {
             const text = await safeText(response);
-            throw new Error(`ShardClient.putShard(${hash}) failed (${response.status}): ${text}`);
+            throw paymentRequiredFrom(response.status, text)
+                ?? new Error(`ShardClient.putShard(${hash}) failed (${response.status}): ${text}`);
         }
     }
     /**
@@ -6723,6 +6835,10 @@ async function parseOrThrow(response, op) {
         // non-JSON body
     }
     if (!response.ok) {
+        // A manifest write refused for payment (a gated Space write): its own class.
+        const refused = paymentRequiredFrom(response.status, parsed);
+        if (refused)
+            throw refused;
         const msg = parsed && typeof parsed === "object" && "error" in parsed
             ? String(parsed.error)
             : `${response.status} ${response.statusText}`;
@@ -6739,7 +6855,7 @@ async function parseOrThrow(response, op) {
  * expect (and isn't serving a stale cached bundle). Keep this in sync with
  * `package.json` `version`.
  */
-const VERSION = "0.15.0-alpha.3";
+const VERSION = "0.15.0-alpha.5";
 
 /**
  * `HttpClient` — the one place the unified {@link Client} talks to the
@@ -6784,17 +6900,6 @@ function reqPath(input) {
         return "?";
     }
 }
-/** Thrown for any non-2xx accelerator response. Carries the HTTP status. */
-class HttpError extends Error {
-    status;
-    body;
-    constructor(message, status, body) {
-        super(message);
-        this.status = status;
-        this.body = body;
-        this.name = "HttpError";
-    }
-}
 class HttpClient {
     baseUrl;
     /** Origin of {@link baseUrl} — credentials are only attached same-origin. */
@@ -6923,7 +7028,9 @@ class HttpClient {
             const msg = parsed && typeof parsed === "object" && "error" in parsed
                 ? String(parsed.error)
                 : `${res.status} ${res.statusText}`;
-            throw new HttpError(msg, res.status, parsed);
+            // A refusal for payment is its own class, so an app can tell it from
+            // any other 4xx; every other error is the HttpError it always was.
+            throw paymentRequiredFrom(res.status, parsed) ?? new HttpError(msg, res.status, parsed);
         }
         return parsed;
     }
@@ -9667,6 +9774,7 @@ class StorageNamespace {
                 baseUrl: this.deps.baseUrl,
                 pathPrefix: "/api/shards",
                 fetch: this.deps.http.fetch,
+                fetchWithRecovery: this.deps.http.fetchWithRecovery,
                 cache: this.deps.shardCache,
                 deferUpload: this.deps.deferShardUpload,
             });
@@ -9685,6 +9793,59 @@ class StorageNamespace {
     }
 }
 
+/**
+ * `POST /api/storage/commit` and `/api/storage/release`: take or drop a
+ * reference to a manifest's shards.
+ *
+ * The commit is what meters a file's bytes to the app and reference-counts
+ * its shards, so garbage collection keeps them; the release drops that
+ * reference. The body is `{ hashes, bytes }` and nothing else. The accelerator
+ * keys its reference ledger on the caller, the app, the bytes and the sorted
+ * hashes, so this body must not change: a commit sent in another shape would
+ * take a second reference instead of finding the first.
+ *
+ * Shared by `Space` (`putFile`, `commitFile`, `releaseFile`) and by
+ * `client.vfs`, which takes and drops references here directly. A reference
+ * names only shards and needs no Space; opening the content space to take one
+ * created that space for a user who had never written a file, which a
+ * paid-only app refuses for a Free user (accelerator spec
+ * 2026-10-06-paid-accounts-and-past-due, D12).
+ *
+ * Internal: not re-exported from any barrel.
+ */
+/**
+ * Commit or release `manifest`'s shards through `fetchFn`, which should be
+ * `HttpClient.fetchWithRecovery`, so a dead session is re-established once
+ * rather than refused three times. Best-effort: tries three times, or once
+ * for a 401, then warns and returns, without failing the caller's write.
+ */
+async function commitManifest(fetchFn, httpBaseUrl, manifest, action) {
+    const hashes = manifest.chunks.flatMap((c) => c.shardHashes);
+    if (hashes.length === 0)
+        return;
+    const body = JSON.stringify({ hashes, bytes: manifest.size });
+    for (let attempt = 0; attempt < 3; attempt++) {
+        try {
+            const res = await fetchFn(`${httpBaseUrl}/api/storage/${action}`, {
+                method: "POST", headers: { "Content-Type": "application/json" }, body,
+            });
+            if (res.ok)
+                return;
+            // A 401 that `fetchFn`'s recovery could not fix. Another try
+            // would only run that recovery again (`auth.zk.recover()`, and
+            // `onSessionExpired` for the app) and be refused again.
+            if (res.status === 401)
+                break;
+        }
+        catch { /* retry */ }
+        await new Promise((r) => setTimeout(r, 400 * (attempt + 1)));
+    }
+    // Best-effort: a missed commit leaves the shards to orphan-GC (still not
+    // durable-unmetered long-term); a missed release just delays GC. Reconciled
+    // by the platform sweep. Don't fail the caller's write on a metering hiccup.
+    console.warn(`[muhkoo] storage ${action} did not confirm for ${hashes.length} shard(s)`);
+}
+
 /**
  * SpaceCipher — pure crypto for the fan-out group-encryption layer.
  *
@@ -11068,25 +11229,10 @@ class Space {
     }
     /** Commit/release a manifest's shards with the accelerator (metering + refcount). */
     async commitShards(manifest, action) {
-        const hashes = manifest.chunks.flatMap((c) => c.shardHashes);
-        if (hashes.length === 0)
-            return;
-        const body = JSON.stringify({ hashes, bytes: manifest.size });
-        for (let attempt = 0; attempt < 3; attempt++) {
-            try {
-                const res = await this.deps.fetch(`${this.deps.httpBaseUrl}/api/storage/${action}`, {
-                    method: "POST", headers: { "Content-Type": "application/json" }, body,
-                });
-                if (res.ok)
-                    return;
-            }
-            catch { /* retry */ }
-            await new Promise((r) => setTimeout(r, 400 * (attempt + 1)));
-        }
-        // Best-effort: a missed commit leaves the shards to orphan-GC (still not
-        // durable-unmetered long-term); a missed release just delays GC. Reconciled
-        // by the platform sweep. Don't fail the caller's write on a metering hiccup.
-        console.warn(`[muhkoo] storage ${action} did not confirm for ${hashes.length} shard(s)`);
+        // Through the client's 401 recovery when there is one: the commit refuses
+        // a dead session with 401, and three tries with the same token only
+        // delayed the warning.
+        await commitManifest(this.deps.fetchWithRecovery ?? this.deps.fetch, this.deps.httpBaseUrl, manifest, action);
     }
     fileStorage(backgroundUpload = false) {
         // Global, content-addressed shard store — same store `client.storage`
@@ -11097,6 +11243,7 @@ class Space {
             baseUrl: this.deps.httpBaseUrl,
             pathPrefix: "/api/shards",
             fetch: this.deps.fetch,
+            fetchWithRecovery: this.deps.fetchWithRecovery,
             cache: this.deps.shardCache,
             deferUpload: this.deps.deferShardUpload,
             peers: this.peerNet?.exchange,
@@ -11500,6 +11647,7 @@ class MessageNamespace {
             wsBaseUrl: this.deps.wsBaseUrl,
             httpBaseUrl: this.deps.http.baseUrl,
             fetch: this.deps.http.fetch,
+            fetchWithRecovery: this.deps.http.fetchWithRecovery,
             myId: () => this.myId(),
             fetchTicket: () => this.fetchTicket(),
         });
@@ -13821,6 +13969,7 @@ class SpaceNamespace {
                 wsBaseUrl: this.deps.wsBaseUrl,
                 httpBaseUrl: this.deps.http.baseUrl,
                 fetch: this.deps.http.fetch,
+                fetchWithRecovery: this.deps.http.fetchWithRecovery,
                 myId: () => memberId,
                 fetchTicket: () => this.fetchTicket(),
                 historyPolicy,
@@ -13876,6 +14025,7 @@ class SpaceNamespace {
             wsBaseUrl: this.deps.wsBaseUrl,
             httpBaseUrl: this.deps.http.baseUrl,
             fetch: this.deps.http.fetch,
+            fetchWithRecovery: this.deps.http.fetchWithRecovery,
             myId: () => memberId,
             fetchTicket: () => this.fetchTicket(),
             keyring,
@@ -14251,6 +14401,66 @@ class AccessTokensNamespace {
     }
 }
 
+/**
+ * `client.app` — what the signed-in user may do in this app (accelerator spec
+ * 2026-10-06-paid-accounts-and-past-due, B6 and B8).
+ *
+ * An app's owner can turn on "Paid Muhkoo accounts only" in the portal. The
+ * accelerator then refuses a Free user's writes that add data, with a 402 the
+ * SDK throws as `PaymentRequiredError`. Reads, sign-in and deletes still work.
+ * The same refusal reaches every user of an app whose owner's payment is past
+ * due, whether or not the setting is on.
+ *
+ * `access()` asks up front, so an app can show the right screen before the
+ * first refusal.
+ */
+class AppNamespace {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    /**
+     * Whether the signed-in user may add data in this app and, if not, why
+     * and where to send them. Needs the app key and a session; a stale session
+     * is re-established once, as for every request. The route is never
+     * refused for payment. Throws `HttpError` for anything else, among them a
+     * 401 without a session and a 404 from an accelerator older than the
+     * route.
+     *
+     * Each `allowed: true` also sends any writes the offline queue kept after
+     * a refusal for payment, without waiting for them. Call it after sign-in,
+     * and again when the user comes back from the portal.
+     */
+    async access() {
+        const body = await this.deps.http.get("/api/app/access");
+        const access = {
+            paidAccountsOnly: body?.paidAccountsOnly === true,
+            // Fail open on a malformed answer: the server enforces the gate
+            // whatever this says, so a wrong "allowed" costs a refused write,
+            // and a wrong "not allowed" would lock the user out for nothing.
+            allowed: body?.allowed !== false,
+        };
+        if (!access.allowed) {
+            if (isPaymentRequiredCode(body?.reason))
+                access.reason = body.reason;
+            const upgradeUrl = absoluteHttpUrl(body?.upgradeUrl);
+            if (upgradeUrl)
+                access.upgradeUrl = upgradeUrl;
+        }
+        else if (this.deps.onAllowed) {
+            // A drain that fails, or a callback that throws, must not turn a
+            // good answer into an error: the writes stay queued for the next
+            // reconnect.
+            Promise.resolve()
+                .then(() => this.deps.onAllowed())
+                .catch((err) => {
+                console.warn("[client.app] sending the kept writes failed (they stay queued):", err);
+            });
+        }
+        return access;
+    }
+}
+
 /**
  * POST /api/auth/identity (SpecA §4.1 as amended by CS-7). An unknown name
  * answers a deterministic decoy, so a lookup never says whether an account
@@ -15205,21 +15415,25 @@ function nextTurn() {
  *
  * Every mutation is a read-modify-write of exactly ONE directory record, so a
  * write cannot leave the tree half-updated: either the parent names the new
- * child or it does not. Two tabs writing different directories never conflict;
- * two tabs (or devices) writing the SAME directory are last-writer-wins. A VFS
- * write sends no HLC and the personal space has no compare-and-swap: it applies
- * puts of one key in the order they arrive, so whichever arrives last is kept,
- * and the other tab's edit is lost. Orphaned records (a directory whose parent
- * entry lost the race) are unreachable rather than corrupting — they cost
- * storage until a future sweep, which is the trade this shape makes in
+ * child or it does not. A VFS write sends no HLC and the personal space has
+ * no compare-and-swap: of two writes of one key it keeps whichever arrives
+ * last.
+ *
+ * Within ONE namespace, writes of a record are sent one at a time, in the
+ * order they were made - edits made while one is in flight go out together
+ * in the next (see `queue`) - and a read that has to fetch a record waits for
+ * its write in flight (see `writing`). Every edit of a record is made to one
+ * in-memory copy of it, and that copy is what is written (see `mutate`).
+ *
+ * Between the tabs of an app on one device, a coordinator (`VfsCoordinator`;
+ * `Client` wires one in a browser tab) gives each record one lock, and a tab
+ * reads a record another tab has written again before its next write of it
+ * (see `sendLocked`). Between devices - or a browser and the CLI - two writes
+ * of the same directory are still last-writer-wins, and the other edit is
+ * lost: that takes a compare-and-swap at the server. Orphaned records (a
+ * directory whose parent entry lost the race) are unreachable rather than
+ * corrupting - they cost storage until a sweep, the trade this shape makes in
  * exchange for single-record writes.
- *
- * Within ONE tab, writes of a record are queued and sent one at a time, in the
- * order they were made, and a read that has to fetch a record waits for its
- * write in flight (see `writing`). Every edit of a record is made to one
- * in-memory copy of it, and that copy is what is written (see `mutate`). All
- * of this is per namespace instance only; nothing orders writes across tabs
- * or devices - that would take a compare-and-swap at the server.
  */
 /** Refuse a directory at `path` if it would be deeper than MAX_DEPTH from the root. */
 function assertWritableDepth(path) {
@@ -15449,6 +15663,24 @@ function markedMeanwhile(before, now) {
 function changedMeanwhile(path) {
     return new VfsConflictError(`${path} was changed by another write while this one was in progress; nothing was written over it`);
 }
+/**
+ * Refuse an operation on `path` because this namespace is moving it - or,
+ * `inside`, something in it. See `VfsNamespace.inMotion`.
+ */
+function beingMoved(path, inside = false) {
+    const what = inside ? `something in ${path} is` : `${path} is`;
+    return new VfsConflictError(`${what} being moved; nothing was changed - try again once the move has finished`);
+}
+/**
+ * Refuse an operation on `path` because a move or a delete of it - or,
+ * `inside`, of it or of something in it - holds its move lock on this
+ * device: in another tab of the app, or in this one. See
+ * `VfsCoordinator.holdMoving`.
+ */
+function heldElsewhere(path, inside = false) {
+    const what = inside ? `${path}, or something in it, is` : `${path} is`;
+    return new VfsConflictError(`${what} being moved or deleted in this app, in this tab or another; nothing was changed - try again once that has finished`);
+}
 /** A JSON object, as opposed to null, an array or a scalar. */
 function isObject$1(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -15606,6 +15838,13 @@ function followable(dir) {
 function unfollowable(dir) {
     return Object.values(dir.hidden).filter((value) => !readableEntry(value)).length;
 }
+/** The id of every entry `dir` follows, and whether an entry with that id is marked: `SubtreeShape`'s view of it. */
+function namedIn(dir) {
+    const named = new Map();
+    for (const [, entry] of followable(dir))
+        named.set(entry.id, named.get(entry.id) === true || entry.moving === true);
+    return named;
+}
 class VfsNamespace {
     deps;
     rootKey = null;
@@ -15648,6 +15887,81 @@ class VfsNamespace {
      * `openDirById`.
      */
     writing = new Map();
+    /**
+     * Every entry this namespace is moving right now, by id.
+     *
+     * A move between two directories marks the entry before it puts it in
+     * the second (see `rename`), and a mark is all a later operation can
+     * see. It cannot tell a move still writing from one that was
+     * interrupted, and was taken for the second: a delete that began after
+     * a move had marked a folder looked for the folder's other half, found
+     * none yet, and purged it while the move was putting it in its new
+     * place; a second move of a file finished the "interrupted" move and
+     * left it named in two places. So a move holds its entry here until it
+     * has taken it from where it was, and `rename` and `delete` refuse an
+     * entry that is here - or, for a delete, a folder holding one. A delete
+     * holds what it deletes the same way: see `deleting`.
+     *
+     * This set is one namespace's. With a coordinator, a move also holds
+     * the entry's move lock for every tab on the device, for as long as the
+     * entry is here: see `VfsCoordinator.holdMoving`.
+     */
+    inMotion = new Set();
+    /**
+     * What each delete under way in this namespace is deleting, by entry id,
+     * one set per delete: its target from the moment it has found the target
+     * not in `inMotion`, and everything it read below the target once it has
+     * read it. Each delete lets go of its own set when it is done.
+     *
+     * A delete waits after it has read what it will let go of: on more
+     * reads, and on a read of the whole tree for the other half of a move.
+     * A move of any of it that started meanwhile could put it in its new
+     * place, fail to take it from the old, and end, all before the delete's
+     * detach. Ended, it was no longer in `inMotion`; and an entry that was
+     * marked already showed no change. So the delete let go of what the
+     * move had just named somewhere else. Now `rename` refuses an entry that
+     * is here, or one on a way from the root that passes through a folder
+     * that is: everything below a delete's target, read yet or not.
+     */
+    deleting = new Set();
+    /**
+     * The write of each record that has not gone out yet, by id: the one
+     * the next edit of that record joins. See `queue`.
+     */
+    waiting = new Map();
+    /**
+     * Announcements heard from other tabs, counted. `heardAt` is the count
+     * at the last one for each record, `missedAt` the count when some may
+     * have been missed. A copy read after both holds every write announced:
+     * see `current`.
+     */
+    hearing = 0;
+    missedAt = 0;
+    heardAt = new Map();
+    /**
+     * Each record a write of which this namespace marked as begun and could
+     * not count, and has said so, until one is counted. And whether it has
+     * said that a write it could not mark or count may be lost, which it
+     * says only once. See `notCounted`.
+     */
+    uncounted = new Set();
+    lossWarned = false;
+    /**
+     * The copy of each record this namespace is writing under the record's
+     * lock, by id, from when it has decided what to write until it has
+     * counted the write, or failed to. Its counter reads as unknown
+     * meanwhile, as this write has begun and is not counted yet, but the
+     * copy holds every write of the record another tab has counted, and no
+     * other tab can make one until this one lets go of the lock. See
+     * `dropStale`.
+     */
+    locked = new Map();
+    /**
+     * Each directory a `createDir` here has named whose write has not landed
+     * yet, by entry id: a promise that settles - and never rejects - once
+     * that write has landed or failed. See `mkdir`.
+     */
+    naming = new Map();
     historyLimit;
     maxEntries;
     maxPathChars;
@@ -15656,6 +15970,8 @@ class VfsNamespace {
         this.historyLimit = deps.historyLimit ?? DEFAULT_HISTORY_LIMIT;
         this.maxEntries = deps.limits?.entries ?? DEFAULT_MAX_ENTRIES;
         this.maxPathChars = deps.limits?.pathChars ?? DEFAULT_MAX_PATH_CHARS;
+        // Another tab's write of a record leaves this tab's copy of it out of date: see `heard`.
+        deps.coordinator?.onAnnounce((id) => this.heard(id));
     }
     /**
      * The working directory relative paths resolve against.
@@ -15708,6 +16024,7 @@ class VfsNamespace {
         // stays out of the cache from here on: see `generation`.
         this.generation++;
         this.cache.clear();
+        this.heardAt.clear();
         this.rootKey = null;
         this._cwd = "/"; // a different identity's tree has different directories
     }
@@ -16055,8 +16372,22 @@ class VfsNamespace {
             const name = parts[i];
             const isLast = i === parts.length - 1;
             const next = join(current, name);
-            const dir = await this.openDir(current);
-            const existing = entryIn(dir.node, name);
+            let dir = await this.openDir(current);
+            let existing = entryIn(dir.node, name);
+            // Named by a mkdir here whose write has not landed. Until it has,
+            // the name is a promise, not a fact: with a coordinator, that edit
+            // is made again under the lock to the folder as another tab left
+            // it, and comes to nothing when that tab named a directory there
+            // first - and whatever was saved meanwhile into the one named
+            // here is in a directory nothing names. A failed write drops it
+            // too. So wait for the write, and look again.
+            let unwritten = existing && this.naming.get(existing.id);
+            while (unwritten) {
+                await unwritten;
+                dir = await this.openDir(current);
+                existing = entryIn(dir.node, name);
+                unwritten = existing && this.naming.get(existing.id);
+            }
             if (!existing)
                 assertNotHidden(dir, name, next);
             if (existing) {
@@ -16182,89 +16513,219 @@ class VfsNamespace {
             this.warn(`removed ${where} without clearing out what it held: this version cannot read it`);
             return;
         }
-        // Every directory above the target, the root first. None of them is
-        // part of what is being deleted, whatever an entry below says.
-        const above = new Set(opened.chain);
-        // Three steps, in this order: read everything the delete will touch,
-        // detach the entry, then let go of what it held.
-        //
-        // Letting go came first once, and the entry was detached last. Any
-        // failure in between - a network error, most simply - left the entry
-        // in place with some of its content already released, and the obvious
-        // next step, trying again, released that content a SECOND time.
-        // Content is reference-counted and shared by copies, so that freed
-        // bytes another file still used. Now a failure before the detach has
-        // changed nothing, and nothing after it can fail: releasing is
-        // best-effort, and a leak is the safe way to be wrong.
-        let doomed = [];
-        // Whether any of it is half of an interrupted move. See below.
-        let moving = entry.kind === "file" && entry.moving === true;
-        if (entry.kind === "dir" && above.has(entry.id)) {
-            // The entry IS a pointer to a directory above it - the root, or
-            // this entry's own parent. Removing the pointer is what was asked
-            // for; clearing out what it points at would delete everything
-            // around the target, the target included.
-            if (!opts.recursive)
-                throw new VfsConflictError(`${target} is not empty`);
-            this.warn(`detaching ${target} without clearing it out: it is a directory above it in the tree`);
-        }
-        else if (entry.kind === "dir") {
-            const child = await this.openDirById(entry.id, fromBase64(entry.key), target).catch((err) => {
-                // An unreadable directory must still be removable, or the user
-                // is stuck with an error they can do nothing about. Its subtree
-                // cannot be enumerated, so it is detached rather than purged and
-                // whatever it holds is left for sweep(). Only when asked for
-                // recursively: without that we cannot know it is empty.
-                if (!(err instanceof VfsCorruptRecordError) || !opts.recursive)
-                    throw err;
-                this.warn(`detaching ${target} without clearing it out: its record cannot be read`);
-                return null;
-            });
-            if (child) {
-                // Entries this version cannot read still count: calling the
-                // directory empty would delete them along with it.
-                const empty = !Object.keys(child.node.entries).length && !Object.keys(child.hidden).length;
-                if (!empty && !opts.recursive)
+        // Being moved by this namespace: it is marked already, or about to be,
+        // and on its way to a second place. Letting go of it here would let
+        // go of what the move puts there. See `inMotion`.
+        if (this.inMotion.has(entry.id))
+            throw beingMoved(target);
+        // And from here until it is done, a move of it, or of anything below
+        // it, that begins in this namespace is refused. See `deleting`.
+        const claim = new Set([entry.id]);
+        this.deleting.add(claim);
+        // On this device, the move locks of the target and of everything read
+        // below it. See below.
+        let release = null;
+        try {
+            // Every directory above the target, the root first. None of them is
+            // part of what is being deleted, whatever an entry below says.
+            const above = new Set(opened.chain);
+            // Three steps, in this order: read everything the delete will touch,
+            // detach the entry, then let go of what it held.
+            //
+            // Letting go came first once, and the entry was detached last. Any
+            // failure in between - a network error, most simply - left the entry
+            // in place with some of its content already released, and the obvious
+            // next step, trying again, released that content a SECOND time.
+            // Content is reference-counted and shared by copies, so that freed
+            // bytes another file still used. Now a failure before the detach has
+            // changed nothing, and nothing after it can fail: releasing is
+            // best-effort, and a leak is the safe way to be wrong.
+            let doomed = [];
+            // What each of them named when it was read, for the check before the detach.
+            let shape = new Map();
+            // Every id found below the target: claimed once it has all been read,
+            // re-checked against `inMotion` at the detach and, with a coordinator,
+            // whose move locks it holds. See below.
+            let ids = new Set();
+            // Whether any of it is half of an interrupted move. See below.
+            let moving = entry.kind === "file" && entry.moving === true;
+            if (entry.kind === "dir" && above.has(entry.id)) {
+                // The entry IS a pointer to a directory above it - the root, or
+                // this entry's own parent. Removing the pointer is what was asked
+                // for; clearing out what it points at would delete everything
+                // around the target, the target included.
+                if (!opts.recursive)
                     throw new VfsConflictError(`${target} is not empty`);
-                const found = await this.subtree(child, target, above);
-                doomed = found.dirs;
-                moving = entry.moving === true || found.moving;
+                this.warn(`detaching ${target} without clearing it out: it is a directory above it in the tree`);
+            }
+            else if (entry.kind === "dir") {
+                const child = await this.openDirById(entry.id, fromBase64(entry.key), target).catch((err) => {
+                    // An unreadable directory must still be removable, or the user
+                    // is stuck with an error they can do nothing about. Its subtree
+                    // cannot be enumerated, so it is detached rather than purged and
+                    // whatever it holds is left for sweep(). Only when asked for
+                    // recursively: without that we cannot know it is empty.
+                    if (!(err instanceof VfsCorruptRecordError) || !opts.recursive)
+                        throw err;
+                    this.warn(`detaching ${target} without clearing it out: its record cannot be read`);
+                    return null;
+                });
+                if (child) {
+                    // Entries this version cannot read still count: calling the
+                    // directory empty would delete them along with it.
+                    const empty = !Object.keys(child.node.entries).length && !Object.keys(child.hidden).length;
+                    if (!empty && !opts.recursive)
+                        throw new VfsConflictError(`${target} is not empty`);
+                    const found = await this.subtree(child, target, above);
+                    // Something in it is being moved by this namespace: the same
+                    // as the target being moved, a level down.
+                    for (const id of found.ids)
+                        if (this.inMotion.has(id))
+                            throw beingMoved(target, true);
+                    for (const id of found.ids)
+                        claim.add(id);
+                    doomed = found.dirs;
+                    shape = found.shape;
+                    ids = found.ids;
+                    moving = entry.moving === true || found.moving;
+                }
+            }
+            // On this device, the move lock of the target and of everything read
+            // below it, held from here until what they held has been let go of.
+            // A move in another tab holds the lock of what it moves until it has
+            // taken it from where it was. A delete that found it marked looked
+            // for its other half before the move had put it there, found none,
+            // and let go of what the move then named in its new place; one that
+            // was writing the parent let a move of something below start, and
+            // then purged it. Held here, a move of any of it that is under way
+            // refuses this delete, and none can start until it is done. What it
+            // does not cover - anything named below since it was read - the check
+            // in the edit refuses. See `VfsCoordinator.holdMoving`.
+            //
+            // Taken before the look for the other half of a move below, not
+            // after it: a move in another tab that began during that look could
+            // put the entry in its new place, fail to take it from the old, and
+            // let go of its lock, all before this took it - and what it named
+            // was let go of here. Not before the reads above, which find what is
+            // below. A move in another tab that begins during them still holds
+            // its lock here if it is under way, and this delete is refused;
+            // ended, it came before the look and the checks below, which read
+            // again what it wrote. See below.
+            const coordinator = this.deps.coordinator;
+            // What the look and the checks below must read again.
+            let stale = new Set();
+            if (coordinator) {
+                release = await this.holdAll(coordinator, [entry.id, ...ids]);
+                if (!release)
+                    throw heldElsewhere(target, ids.size > 0);
+                // A move that let go of its lock just before this took it had
+                // counted its writes by then, though this tab may not have heard
+                // of them: what was read above that another tab has written
+                // since is read again - every record cached, for the look, which
+                // reads the whole tree. A move that took a file out of a folder
+                // read above, from this tab's old copy, had that file let go of
+                // with the folder; one that went from the other half of a move
+                // to a folder this tab's old copy did not show it in had the
+                // content it took with it let go of. See `dropStale`.
+                //
+                // And the way to the target, looked up before anything else.
+                // A delete in another tab of a folder on it had let go of the
+                // target's lock, which it held, only once it had counted its
+                // write of the folder above the one it deleted - but it purged
+                // that one, and all below, which counts nothing. Gone on from
+                // the old copies, this wrote the purged parent back and let go
+                // of what the target held a second time, while a copy of it, or
+                // a commit, still named that content. So what on the way has
+                // been written since it was read is read again, and the way is
+                // looked up again, as a move's way to where it goes is: it must
+                // lead to the same entry, through the same folders, not marked
+                // since.
+                //
+                // Looked up again even when nothing on it is out of date now:
+                // a write of this tab's own may have read a folder on it again,
+                // under that folder's lock, after the look above, and counted
+                // its write. That copy is current by now, and no longer what the
+                // look saw.
+                const read = doomed.map((dir) => dir.id);
+                stale = await this.dropStale(coordinator, [...opened.chain, ...(moving ? this.cache.keys() : []), ...read]);
+                const again = await this.openChain(dirname(target));
+                if (!again)
+                    throw new VfsNotFoundError(dirname(target));
+                if (again.chain.some((id, i) => id !== opened.chain[i]))
+                    throw changedMeanwhile(dirname(target));
+                const now = entryIn(again.dir.node, name);
+                if (!now)
+                    throw new VfsNotFoundError(target);
+                if (!sameEntry(entry, now) || markedMeanwhile(entry, now))
+                    throw changedMeanwhile(target);
+            }
+            // A move between two directories that was interrupted leaves what it
+            // moved named in both, and letting go of it here would take it from
+            // the other copy: the directory record purged with every file in it,
+            // or a file's content and history released. Only a marked entry can
+            // be one of those (see `rename`), so only then is the whole tree
+            // read, once, to find out what is still named elsewhere. Still before
+            // anything changes: a failure here leaves the tree as it was.
+            const elsewhere = moving ? await this.namedElsewhere(parent.id, name) : undefined;
+            // The check in the edit below looks at each record to be purged as it
+            // is then, which needs it to hand: a change reported meanwhile may
+            // have dropped one from the cache, and so may the counters above.
+            // Read again, it is still checked against what was read before.
+            for (const dir of doomed)
+                if (stale.has(dir.id) || !this.editable(dir))
+                    await this.reopen(dir);
+            let purging = doomed;
+            await this.mutate(parent, (node) => {
+                // What is let go of below is what `entry` held. Gone since, it
+                // was let go of already; replaced, the name holds something this
+                // delete has not read. Marked since, a move of it has begun, and
+                // what it holds is about to be named somewhere `elsewhere` did
+                // not see - if it was looked for at all.
+                const now = entryIn(node, name);
+                if (!now)
+                    throw new VfsNotFoundError(target);
+                if (!sameEntry(entry, now) || markedMeanwhile(entry, now))
+                    throw changedMeanwhile(target);
+                // Marked already when this delete read it, a move that has since
+                // taken the entry - or something below it - would not mark it a
+                // second time, so `markedMeanwhile` and `currentSubtree` would not
+                // see it either. `inMotion` is live, not a snapshot, so it still
+                // does: re-checked here, at the last moment before the detach.
+                // Since `deleting`, a move here cannot begin on any of it once
+                // this delete has claimed it, so these are a second guard.
+                if (this.inMotion.has(entry.id))
+                    throw beingMoved(target);
+                for (const id of ids)
+                    if (this.inMotion.has(id))
+                        throw beingMoved(target, true);
+                // And what is purged is what the records below hold now - unless
+                // something in them has been moved, or begun to move, since they
+                // were read; or, with a coordinator, named there since, as its
+                // move lock is not held. See `currentSubtree`.
+                const current = this.currentSubtree(doomed, shape, coordinator ? ids : undefined);
+                if (!current)
+                    throw changedMeanwhile(target);
+                purging = current;
+                delete node.entries[name];
+            });
+            if (elsewhere === null) {
+                // Part of the tree cannot be read, so it is unknown whether the
+                // other copy is in it. Keeping what may be its contents costs
+                // storage until a sweep; letting go of them could lose them.
+                this.warn(`detached ${target} but kept what it held: a move of it was interrupted, and part of the tree cannot be read to find the other copy`);
+                return;
             }
+            if (entry.kind === "dir")
+                await this.purge(purging, elsewhere, opts.keepContent);
+            else
+                await this.letGo(new Map([[entry.id, [{ dir: parent, entry }]]]), elsewhere, opts.keepContent);
+            if (elsewhere && entry.moving === true)
+                await this.settle(entry.id, elsewhere);
         }
-        // A move between two directories that was interrupted leaves what it
-        // moved named in both, and letting go of it here would take it from
-        // the other copy: the directory record purged with every file in it,
-        // or a file's content and history released. Only a marked entry can
-        // be one of those (see `rename`), so only then is the whole tree
-        // read, once, to find out what is still named elsewhere. Still before
-        // anything changes: a failure here leaves the tree as it was.
-        const elsewhere = moving ? await this.namedElsewhere(parent.id, name) : undefined;
-        await this.mutate(parent, (node) => {
-            // What is let go of below is what `entry` held. Gone since, it
-            // was let go of already; replaced, the name holds something this
-            // delete has not read. Marked since, a move of it has begun, and
-            // what it holds is about to be named somewhere `elsewhere` did
-            // not see - if it was looked for at all.
-            const now = entryIn(node, name);
-            if (!now)
-                throw new VfsNotFoundError(target);
-            if (!sameEntry(entry, now) || markedMeanwhile(entry, now))
-                throw changedMeanwhile(target);
-            delete node.entries[name];
-        });
-        if (elsewhere === null) {
-            // Part of the tree cannot be read, so it is unknown whether the
-            // other copy is in it. Keeping what may be its contents costs
-            // storage until a sweep; letting go of them could lose them.
-            this.warn(`detached ${target} but kept what it held: a move of it was interrupted, and part of the tree cannot be read to find the other copy`);
-            return;
+        finally {
+            release?.();
+            this.deleting.delete(claim);
         }
-        if (entry.kind === "dir")
-            await this.purge(doomed, elsewhere, opts.keepContent);
-        else
-            await this.letGo(new Map([[entry.id, [{ dir: parent, entry }]]]), elsewhere, opts.keepContent);
-        if (elsewhere && entry.moving === true)
-            await this.settle(entry.id, elsewhere);
     }
     /**
      * Move or rename. Works across directories, which is the same operation:
@@ -16287,83 +16748,216 @@ class VfsNamespace {
         const srcName = basename(src);
         const dstName = basename(dst);
         assertValidName(dstName);
-        const srcParent = await this.openDir(dirname(src));
+        const source = await this.openChain(dirname(src));
+        if (!source)
+            throw new VfsNotFoundError(dirname(src));
+        const srcParent = source.dir;
         const entry = entryIn(srcParent.node, srcName);
         if (!entry)
             throw new VfsNotFoundError(src);
-        if (entry.kind === "dir") {
-            assertWritableDepth(dst);
-            if (segments(dst).length > segments(src).length)
-                await this.assertFitsAt(src, dst);
-        }
-        await this.mkdir(dirname(dst), { recursive: true });
-        const dstParent = await this.openDir(dirname(dst));
-        if (entryIn(dstParent.node, dstName))
-            throw new VfsConflictError(`${dst} already exists`);
-        assertNotHidden(dstParent, dstName, dst);
+        // Another move of it is under way here. Its mark cannot tell that
+        // move from an interrupted one, and finishing it as one named the
+        // entry in two places. Held from here, before the first wait, so two
+        // moves begun together cannot both get past this. See `inMotion`.
+        if (this.inMotion.has(entry.id))
+            throw beingMoved(src);
+        // A delete here has begun on it, or on a folder on its way from the
+        // root. Moved now, it could be put in its new place just before the
+        // delete let go of what it holds. Not the root, which no delete is
+        // of: one claims it only through an entry below that names it, and
+        // lets go of nothing of it. In the same step as the check above, as
+        // a delete makes its claim in the same step as its own. See
+        // `deleting`.
+        const lineage = [entry.id, ...source.chain.slice(1)];
+        if ([...this.deleting].some((claim) => lineage.some((id) => claim.has(id))))
+            throw heldElsewhere(src);
+        this.inMotion.add(entry.id);
         // Each record is re-opened before it is written: creating the
-        // destination's parents above may have written to the source's.
+        // destination's parents below may have written to the source's.
         const edit = (path, change) => this.openDir(path).then((dir) => this.mutate(dir, change));
-        // Both ends were looked at before the waits above, and another write
-        // may have changed either since: replaced the entry being moved, or
-        // put something at the destination. Moving on regardless would write
-        // the old entry over the new one, or this one over the other. Or
-        // marked the entry: another move of it has begun. Taking it as well
-        // would name it in two places, and each move would unmark its own.
-        const take = (node) => {
-            const now = entryIn(node, srcName);
-            if (!now || !sameEntry(entry, now) || markedMeanwhile(entry, now))
-                throw changedMeanwhile(src);
-            return now;
-        };
-        const free = (node, record) => {
-            if (entryIn(node, dstName))
+        let unmarkLanded = false;
+        // The same for every tab of the app on this device: the entry's move
+        // lock, held for as long as it is in `inMotion`. Another tab's move
+        // or delete of it holds it, and taking that move's mark for an
+        // interrupted one named the entry in two places, or purged it. See
+        // `VfsCoordinator.holdMoving`.
+        let release = null;
+        // And the locks of the folders on the way to where it goes, shared,
+        // for as long. See below.
+        let into = null;
+        try {
+            const coordinator = this.deps.coordinator;
+            if (coordinator) {
+                release = await coordinator.holdMoving(entry.id);
+                if (!release)
+                    throw heldElsewhere(src);
+                // The look above was at this tab's copies of the folders on the
+                // way to the entry. A delete in another tab of the entry, or of
+                // a folder on that way, may have finished before this took the
+                // lock, which the delete held: it had counted its writes by
+                // then, though this tab may not have heard of them. Moved
+                // regardless, the entry was marked in a record the delete had
+                // purged, and named in its new place with its content let go
+                // of. So whatever on the way another tab has written since it
+                // was read is read again, and the entry looked for again.
+                if ((await this.dropStale(coordinator, source.chain)).size) {
+                    const again = await this.openChain(dirname(src));
+                    if (!again)
+                        throw new VfsNotFoundError(dirname(src));
+                    if (again.chain.some((id, i) => id !== source.chain[i]))
+                        throw changedMeanwhile(dirname(src));
+                    const now = entryIn(again.dir.node, srcName);
+                    if (!now)
+                        throw new VfsNotFoundError(src);
+                    if (!sameEntry(entry, now) || markedMeanwhile(entry, now))
+                        throw changedMeanwhile(src);
+                }
+            }
+            if (entry.kind === "dir") {
+                assertWritableDepth(dst);
+                if (segments(dst).length > segments(src).length)
+                    await this.assertFitsAt(src, dst);
+            }
+            await this.mkdir(dirname(dst), { recursive: true });
+            const way = await this.openChain(dirname(dst));
+            if (!way)
+                throw new VfsNotFoundError(dirname(dst));
+            let dstParent = way.dir;
+            if (coordinator && dstParent.id !== ROOT_ID) {
+                // The folder it goes into, and every folder above that one
+                // but the root, held shared: other moves into any of them
+                // share them, and a delete of one - which holds the lock of
+                // its target and of everything it read below - holds it
+                // alone. A move into a folder that another tab was deleting
+                // put what it moved in a record the delete then purged: in no
+                // listing, its content kept. Not that folder alone: it may be
+                // new since the delete read the tree - made by the `mkdir`
+                // above, or by another tab - and the delete does not hold a
+                // lock it did not read. Its target's is on the way here. The
+                // root is never deleted.
+                into = await this.holdAll(coordinator, way.chain.slice(1), true);
+                if (!into)
+                    throw heldElsewhere(dirname(dst));
+                // A delete of one of them may have finished since they were
+                // looked up, and counted its write of the folder above before
+                // it let go of their locks, though this tab may not have
+                // heard of it: read again whatever on the way another tab has
+                // written since it was read, and look again. Gone, or another
+                // folder anywhere on the way, the move stops here, before its
+                // mark.
+                await this.dropStale(coordinator, way.chain);
+                const again = await this.openChain(dirname(dst));
+                if (!again)
+                    throw new VfsNotFoundError(dirname(dst));
+                if (again.chain.some((id, i) => id !== way.chain[i]))
+                    throw changedMeanwhile(dirname(dst));
+                dstParent = again.dir;
+            }
+            if (entryIn(dstParent.node, dstName))
                 throw new VfsConflictError(`${dst} already exists`);
-            assertNotHidden(record, dstName, dst);
-        };
-        if (dstParent.id === srcParent.id) {
-            // One record, so one write: the move happens entirely or not at all.
-            await edit(dirname(src), (node, record) => {
-                const moved = take(node);
-                free(node, record);
-                delete node.entries[srcName];
-                node.entries[dstName] = { ...moved, mtime: Date.now() };
-            });
-            return;
-        }
-        // Two records, attached before detaching: interrupted, the entry is
-        // in both rather than in neither. Both copies are marked for as long
-        // as that can be so, because they share everything below them, and a
-        // delete of either would otherwise let go of the other's contents.
-        // An entry already marked is half of an earlier interrupted move, and
-        // keeps its mark.
-        const marked = entry.moving === true;
-        let moved = entry;
-        if (!marked) {
+            assertNotHidden(dstParent, dstName, dst);
+            // Both ends were looked at before the waits above, and another write
+            // may have changed either since: replaced the entry being moved, or
+            // put something at the destination. Moving on regardless would write
+            // the old entry over the new one, or this one over the other. Or
+            // marked the entry: another move of it has begun. Taking it as well
+            // would name it in two places, and each move would unmark its own.
+            const take = (node) => {
+                const now = entryIn(node, srcName);
+                if (!now || !sameEntry(entry, now) || markedMeanwhile(entry, now))
+                    throw changedMeanwhile(src);
+                return now;
+            };
+            const free = (node, record) => {
+                if (entryIn(node, dstName))
+                    throw new VfsConflictError(`${dst} already exists`);
+                assertNotHidden(record, dstName, dst);
+            };
+            if (dstParent.id === srcParent.id) {
+                // One record, so one write: the move happens entirely or not at all.
+                await edit(dirname(src), (node, record) => {
+                    const moved = take(node);
+                    free(node, record);
+                    delete node.entries[srcName];
+                    node.entries[dstName] = { ...moved, mtime: Date.now() };
+                });
+                return;
+            }
+            // Two records, attached before detaching: interrupted, the entry is
+            // in both rather than in neither. Both copies are marked for as long
+            // as that can be so, because they share everything below them, and a
+            // delete of either would otherwise let go of the other's contents.
+            // An entry already marked is half of an earlier interrupted move, and
+            // keeps its mark.
+            const marked = entry.moving === true;
+            let moved = entry;
+            if (!marked) {
+                await edit(dirname(src), (node) => {
+                    moved = take(node);
+                    node.entries[srcName] = { ...moved, moving: true };
+                });
+            }
+            // Whether the edit below has put the entry at the destination: set
+            // as its last step, after every check, each time it runs.
+            let attached = false;
+            try {
+                await edit(dirname(dst), (node, record) => {
+                    attached = false;
+                    free(node, record);
+                    node.entries[dstName] = { ...moved, moving: true, mtime: Date.now() };
+                    attached = true;
+                });
+            }
+            catch (err) {
+                // Refused before it put anything at the destination - another
+                // write took the name first - so the entry is still in one
+                // place only, and the mark this move put on it would stay for
+                // good: on a file, every version that falls off its history
+                // kept; on either, every delete of it reading the whole tree.
+                // Not when the write failed instead: the destination may hold
+                // the entry by now, and the mark is what keeps a delete of
+                // either copy from letting go of the other's. Best-effort.
+                if (!marked && !attached) {
+                    await edit(dirname(src), (node) => {
+                        const now = entryIn(node, srcName);
+                        if (now?.id !== entry.id || now.moving !== true)
+                            return false;
+                        node.entries[srcName] = unmarked(now);
+                        return true;
+                    }).catch(() => { });
+                }
+                throw err;
+            }
+            // A file's history is sealed with its directory's key, and from here
+            // on the directory that opens it is this one.
+            if (entry.kind === "file")
+                await this.rekeyHistory(entry.id, [srcParent.key], dstParent.key);
             await edit(dirname(src), (node) => {
-                moved = take(node);
-                node.entries[srcName] = { ...moved, moving: true };
+                // Gone already leaves nothing to detach, and nothing to write.
+                // Replaced, it is not this entry to take away: the move stops
+                // here, in both places. Not `take`: the entry is marked by now,
+                // by this move or the earlier one it finishes.
+                const now = entryIn(node, srcName);
+                if (!now)
+                    return false;
+                if (!sameEntry(entry, now))
+                    throw changedMeanwhile(src);
+                delete node.entries[srcName];
+                // Explicit, as in `createDir` and `settle`: noImplicitReturns.
+                return true;
             });
+            unmarkLanded = !marked;
         }
-        await edit(dirname(dst), (node, record) => {
-            free(node, record);
-            node.entries[dstName] = { ...moved, moving: true, mtime: Date.now() };
-        });
-        // A file's history is sealed with its directory's key, and from here
-        // on the directory that opens it is this one.
-        if (entry.kind === "file")
-            await this.rekeyHistory(entry.id, [srcParent.key], dstParent.key);
-        await edit(dirname(src), (node) => {
-            // Gone already leaves nothing to detach. Replaced, it is not this
-            // entry to take away: the move stops here, in both places. Not
-            // `take`: the entry is marked by now, by this move or the earlier
-            // one it finishes.
-            const now = entryIn(node, srcName);
-            if (now && !sameEntry(entry, now))
-                throw changedMeanwhile(src);
-            delete node.entries[srcName];
-        });
-        if (!marked) {
+        finally {
+            // Named in one place from here, the destination. A delete of it
+            // there goes ahead as for an entry an interrupted move left marked
+            // - which the Trash's "delete forever" relies on while the mark is
+            // still being cleared.
+            this.inMotion.delete(entry.id);
+            release?.();
+            into?.();
+        }
+        if (unmarkLanded) {
             await edit(dirname(dst), (node) => {
                 const landed = entryIn(node, dstName);
                 if (landed?.id === entry.id)
@@ -16468,11 +17062,12 @@ class VfsNamespace {
      * Delete metadata records no longer reachable from the root.
      *
      * These accumulate because every write touches exactly one record: if two
-     * tabs or devices edit the same directory, the personal space keeps
-     * whichever put arrives last (a VFS write sends no HLC, and the space
-     * applies puts of one key in arrival order), which can leave a child whose
-     * parent entry lost the race. The per-record write queue (`writing`) only
-     * orders writes within one tab. Unreachable is harmless —
+     * devices edit the same directory - or two tabs, where there is no
+     * coordinator - the personal space keeps whichever put arrives last (a
+     * VFS write sends no HLC, and the space applies puts of one key in arrival
+     * order), which can leave a child whose parent entry lost the race. The
+     * per-record queue and the coordinator order writes within one device
+     * only. Unreachable is harmless —
      * it is invisible and undecryptable-by-nobody — but it costs storage, so
      * this reclaims it.
      *
@@ -16481,6 +17076,12 @@ class VfsNamespace {
      * Run it when the filesystem is idle.
      */
     async sweep(opts = {}) {
+        // With a coordinator: what another tab has written since this tab
+        // read it is read again, not followed in an old copy that may not
+        // name what it now names - which would then be deleted here.
+        const coordinator = this.deps.coordinator;
+        if (coordinator)
+            await this.dropStale(coordinator, [...this.cache.keys()]);
         const root = await this.root();
         // A record that cannot be read throws out of here, before anything is
         // deleted: with part of the tree unknown, "unreachable" is a guess.
@@ -16637,6 +17238,11 @@ class VfsNamespace {
         const hit = this.cache.get(id);
         if (hit)
             return hit;
+        // Before anything is read, so that from here on this namespace hears
+        // of any later write of the record by another tab. Starting to hear -
+        // for the first time, or for someone else - clears the cache (see
+        // `heard`), which is why it comes before this read is cached.
+        this.deps.coordinator?.listen();
         // The PROMISE goes in the cache, not the resolved value.
         //
         // Reading a project means resolving hundreds of paths that share the
@@ -16682,31 +17288,7 @@ class VfsNamespace {
                 if (!now)
                     this.cache.set(id, pending);
             }
-            const raw = await this.deps.store.get(dirKey(id));
-            // An absent record is an EMPTY directory, not an error: the root
-            // exists before anything has been written to it, and a directory is
-            // created by its parent naming it rather than by its own record
-            // appearing.
-            if (raw === null || raw === undefined) {
-                const node = { v: 1, entries: emptyEntries(), mtime: Date.now() };
-                return { id, key, path, node, hidden: Object.create(null), gen };
-            }
-            // Present but unopenable is NOT absent. `unseal` folds the two
-            // together, which suits a record that can simply be rebuilt; a
-            // directory cannot, because rebuilding it means sealing an empty
-            // one over whatever is really there. And it is not a raw
-            // DOMException either: the typed error is what delete, purge and
-            // sweep know how to step around, and it names the record.
-            let value;
-            try {
-                value = await openSealed(key, raw);
-            }
-            catch (err) {
-                if (err instanceof SealedRecordError)
-                    throw new VfsCorruptRecordError(id, path, err.message);
-                throw err;
-            }
-            return this.readRecord(id, key, value, gen, path);
+            return this.fetchRecord(id, key, gen, path);
         };
         const pending = load().catch((err) => {
             // A failed read must not be remembered, or one blip poisons the
@@ -16721,6 +17303,55 @@ class VfsNamespace {
         this.cache.set(id, pending);
         return pending;
     }
+    /**
+     * Fetch record `id` from the store and open it. Whatever another tab
+     * announced before the fetch began is in what it returns (see
+     * `current`), and so is every write its counter counts: read here, or
+     * given as `counter` (see `OpenDir.counter`).
+     */
+    async fetchRecord(id, key, gen, path, counter) {
+        const seen = this.hearing;
+        // Before the fetch, never after it. A write that lands in between
+        // then only makes this copy look out of date, which costs a read;
+        // read after, the counter could count a write the answer missed.
+        // Without a coordinator there is none, and nothing is awaited: a read
+        // in Node takes the turns it always took.
+        if (counter === undefined)
+            counter = this.deps.coordinator ? await this.counterOf(id) : null;
+        const raw = await this.deps.store.get(dirKey(id));
+        // An absent record is an EMPTY directory, not an error: the root
+        // exists before anything has been written to it, and a directory is
+        // created by its parent naming it rather than by its own record
+        // appearing.
+        if (raw === null || raw === undefined) {
+            const node = { v: 1, entries: emptyEntries(), mtime: Date.now() };
+            return { id, key, path, node, hidden: Object.create(null), gen, seen, counter };
+        }
+        // Present but unopenable is NOT absent. `unseal` folds the two
+        // together, which suits a record that can simply be rebuilt; a
+        // directory cannot, because rebuilding it means sealing an empty
+        // one over whatever is really there. And it is not a raw
+        // DOMException either: the typed error is what delete, purge and
+        // sweep know how to step around, and it names the record.
+        let value;
+        try {
+            value = await openSealed(key, raw);
+        }
+        catch (err) {
+            if (err instanceof SealedRecordError)
+                throw new VfsCorruptRecordError(id, path, err.message);
+            throw err;
+        }
+        return this.readRecord(id, key, value, gen, seen, counter, path);
+    }
+    /** Record `id`'s write counter now: see `OpenDir.counter`. */
+    async counterOf(id) {
+        const coordinator = this.deps.coordinator;
+        if (!coordinator)
+            return null;
+        const [counter] = await coordinator.counters([id]).catch(() => [null]);
+        return counter ?? null;
+    }
     /**
      * Turn a decrypted record into an OpenDir, or throw.
      *
@@ -16728,7 +17359,7 @@ class VfsNamespace {
      * see VfsCorruptRecordError. An individual entry of the wrong shape is set
      * aside in `hidden` instead: out of every read, but kept for the write.
      */
-    readRecord(id, key, value, gen, path) {
+    readRecord(id, key, value, gen, seen, counter, path) {
         const problem = recordProblem(value);
         if (problem)
             throw new VfsCorruptRecordError(id, path, problem);
@@ -16784,7 +17415,7 @@ class VfsNamespace {
             this.warn(`ignoring ${what} in ${path ?? `record ${printable(id, 40)}`}`);
         }
         // A v1 record's unknown top-level fields survive a write too.
-        return { id, key, path, node: { ...top, entries }, hidden, gen };
+        return { id, key, path, node: { ...top, entries }, hidden, gen, seen, counter };
     }
     /**
      * Apply an edit to a directory record and persist it.
@@ -16800,8 +17431,18 @@ class VfsNamespace {
      *
      * So `edit` must take what it writes from the record it is given, not
      * from anything read off `dir` before an await - and re-check whatever it
-     * relies on from then, throwing if another write changed it. Returning
-     * false writes nothing after all.
+     * relies on from then, throwing if another write changed it, before it
+     * changes anything. Returning false writes nothing after all.
+     *
+     * The write that carries the edit may carry others, made while an
+     * earlier write of the record was in flight (see `queue`): it lands, or
+     * fails, for all of them at once.
+     *
+     * With a coordinator, the edit may be made a second time, to the record
+     * as another tab left it, and refused then (see `replay`): an edit must
+     * check everything before it changes anything, and whatever it sets
+     * outside `node` and `record` must be safe to set again, since each run
+     * overwrites the last.
      */
     async mutate(dir, edit) {
         // At once when the copy is to hand, which it almost always is, so
@@ -16810,21 +17451,10 @@ class VfsNamespace {
         const target = this.editable(dir) ?? await this.reopen(dir);
         if (edit(target.node, target) === false)
             return;
-        target.node.mtime = Date.now();
-        // A write to a hidden entry's exact name replaces it: that name now
-        // means what this version wrote. Forgetting the old one here is also
-        // what stops a later delete of the replacement from resurrecting it.
-        for (const name of Object.keys(target.hidden)) {
-            if (Object.hasOwn(target.node.entries, name))
-                delete target.hidden[name];
-        }
-        // Not sent until any earlier write of this record has landed: see
-        // `writing`. Whether that one worked or not, this one still goes.
-        const before = this.writing.get(target.id);
-        const send = () => this.writeRecord(target);
-        const write = before ? before.then(send, send) : send();
-        this.copyOf.set(write, target);
-        this.writing.set(target.id, write);
+        this.touch(target);
+        const ticket = { edit };
+        const batch = this.queue(target, ticket);
+        const { write } = batch;
         try {
             await write;
         }
@@ -16851,6 +17481,10 @@ class VfsNamespace {
                 this.writing.delete(target.id);
         }
         this.adopt(target);
+        // Made again to the record as another tab left it, it no longer
+        // applied - see `replay` - and nothing of it was written.
+        if (batch.refused.has(ticket))
+            throw batch.refused.get(ticket);
     }
     /**
      * The copy of `dir`'s record that edits are made to, if there is one
@@ -16897,6 +17531,249 @@ class VfsNamespace {
         this.copyOf.set(cached, dir);
         this.cache.set(dir.id, cached);
     }
+    /** After an edit of `copy`: its time, and any entry it cannot read that the edit replaced. */
+    touch(copy) {
+        copy.node.mtime = Date.now();
+        // A write to a hidden entry's exact name replaces it: that name now
+        // means what this version wrote. Forgetting the old one here is also
+        // what stops a later delete of the replacement from resurrecting it.
+        for (const name of Object.keys(copy.hidden)) {
+            if (Object.hasOwn(copy.node.entries, name))
+                delete copy.hidden[name];
+        }
+    }
+    /**
+     * The write that will carry the edit just made to `copy`.
+     *
+     * Writes of a record go out one at a time, each once the one before it
+     * has landed or failed (see `writing`), and each seals the record as it
+     * stands when it goes out. So a write still waiting carries every edit
+     * made while it waits, and an edit made then joins it instead of
+     * queueing a write of its own: a burst of edits of one directory while a
+     * write of it is in flight costs two writes, not one per edit. Each is a
+     * billed write; a 20-file upload into one folder cost twenty.
+     */
+    queue(copy, ticket) {
+        const open = this.waiting.get(copy.id);
+        if (open?.copy === copy) {
+            open.edits.push(ticket);
+            return open;
+        }
+        const before = this.writing.get(copy.id);
+        const batch = { copy, edits: [ticket], refused: new Map() };
+        this.waiting.set(copy.id, batch);
+        // Not sent until any earlier write of this record has landed: see
+        // `writing`. Whether that one worked or not, this one still goes.
+        const send = () => this.send(batch);
+        batch.write = before ? before.then(send, send) : send();
+        this.copyOf.set(batch.write, copy);
+        this.writing.set(copy.id, batch.write);
+        return batch;
+    }
+    /**
+     * Send `batch`: from here on, an edit of its record goes in the next
+     * write. With a coordinator, holding the lock every tab of the device
+     * takes to write this record - see `sendLocked`.
+     */
+    send(batch) {
+        const coordinator = this.deps.coordinator;
+        if (!coordinator) {
+            this.close(batch);
+            return this.writeRecord(batch.copy);
+        }
+        // Closed under the lock once it is sealed (see `sendLocked`), and
+        // here too, for a lock never granted or a re-read that failed: left
+        // open, a later edit of the same copy would join a write that has
+        // already failed, and fail with it.
+        return coordinator.lock(batch.copy.id, () => this.sendLocked(batch, coordinator)).finally(() => this.close(batch));
+    }
+    /** Stop `batch` taking more edits, as it is sealed. */
+    close(batch) {
+        if (this.waiting.get(batch.copy.id) === batch)
+            this.waiting.delete(batch.copy.id);
+    }
+    /**
+     * Send `batch` while no other tab can write its record.
+     *
+     * If another tab wrote the record since this copy was read, the copy is
+     * out of date, and writing it would undo that tab's write. So it is read
+     * again, here, under the lock, and every edit the batch carries is made
+     * again to what was read (see `replay`). A copy no other tab has written
+     * over is sent as it is: one tab on its own costs no extra request.
+     *
+     * Which it is, the record's write counter says (see
+     * `VfsCoordinator.counters`). Read once the lock is granted, it counts
+     * every write of the record another tab made, because each counts its
+     * write, and waits for the count to be stored, before it lets go of the
+     * lock. If it has moved since the copy was read, or cannot be told, the
+     * copy is read again. Whether this tab has heard of another tab's write
+     * does not decide it: an announcement can reach this tab after the
+     * lock does, or never. One it has heard of can only add a read.
+     *
+     * The write is counted once it has landed or failed - one that failed
+     * may have landed even so - and the other tabs are then told of it,
+     * all before the lock is let go of.
+     */
+    async sendLocked(batch, coordinator) {
+        const { copy } = batch;
+        // Hearing for whoever is signed in now, before deciding: starting to
+        // hear - or hearing someone else - marks every copy out of date.
+        coordinator.listen();
+        const now = await coordinator.begin(copy.id).catch(() => null);
+        // Whether `copy` is, from here, the record as this tab leaves it.
+        let decided = false;
+        let sent = false;
+        try {
+            const current = now !== null && copy.counter === now && this.current(copy);
+            const fresh = copy.gen === this.generation && !current
+                ? await this.fetchRecord(copy.id, copy.key, copy.gen, copy.path, null)
+                : null;
+            // Nothing waits from here to the seal, so no edit can come in between.
+            this.close(batch);
+            decided = true;
+            this.locked.set(copy.id, copy);
+            if (fresh && !this.replay(batch, fresh))
+                return;
+            sent = true;
+            await this.writeRecord(copy);
+            copy.seen = this.hearing;
+        }
+        finally {
+            const counted = await coordinator.bump(copy.id).catch(() => null);
+            // Not when the read above failed: the copy is what it was, and
+            // the counter it held is out of date now.
+            if (decided)
+                copy.counter = counted;
+            if (this.locked.get(copy.id) === copy)
+                this.locked.delete(copy.id);
+            if (counted === null)
+                this.notCounted(copy, now !== null);
+            else
+                this.uncounted.delete(copy.id);
+            if (sent)
+                coordinator.announce(copy.id);
+        }
+    }
+    /**
+     * Say that a write of `copy`'s record could not be counted.
+     *
+     * `marked`: `VfsCoordinator.begin` stored its mark, which stays until a
+     * count can be stored, so every tab reads the record again before it
+     * writes it. Said once for each record, until a write of it is counted.
+     *
+     * Not marked, a tab whose IndexedDB works may take its copy for current
+     * and write it over this write. Said once for this namespace, whatever
+     * the record: where IndexedDB cannot be used at all, no write of any
+     * folder is counted, and a warning for each said nothing new. And only
+     * where another tab can count its writes can one be lost, which the
+     * warning says: where no tab can, every tab reads each folder again.
+     */
+    notCounted(copy, marked) {
+        const where = copy.path ?? `record ${printable(copy.id, 40)}`;
+        if (!marked) {
+            if (this.lossWarned)
+                return;
+            this.lossWarned = true;
+            this.warn(`a write of ${where} by this tab could not be counted in IndexedDB, where this app's other tabs look before writing a folder. Such a write may be lost only if another tab of this app can count its writes: that tab may write the folder without reading it again. Said once per Client, for every write of a folder that cannot be counted`);
+            return;
+        }
+        if (this.uncounted.has(copy.id))
+            return;
+        this.uncounted.add(copy.id);
+        this.warn(`a write of ${where} by this tab could not be counted in IndexedDB; until one can be, every tab of this app reads ${where} again before writing it`);
+    }
+    /**
+     * Make every edit in `batch` again, in order, to `fresh` - the record as
+     * another tab left it - and make that the copy. An edit that no longer
+     * applies throws, as it would have the first time, and is left out; its
+     * caller gets what it threw. Every edit checks before it changes
+     * anything (see `mutate`), so one that throws has changed nothing. True
+     * when what is left changes the record, and so needs writing.
+     */
+    replay(batch, fresh) {
+        const { copy } = batch;
+        copy.node = fresh.node;
+        copy.hidden = fresh.hidden;
+        copy.seen = fresh.seen;
+        copy.counter = fresh.counter;
+        let changed = false;
+        for (const ticket of batch.edits) {
+            try {
+                if (ticket.edit(copy.node, copy) !== false)
+                    changed = true;
+            }
+            catch (err) {
+                batch.refused.set(ticket, err);
+            }
+        }
+        if (changed)
+            this.touch(copy);
+        return changed;
+    }
+    /**
+     * Another tab wrote record `id` - or, null, this namespace may have
+     * missed some announcements. What the cache holds is read again when
+     * next asked for, as a change frame from the personal space would have
+     * it, and a copy read before then is read again before the next write
+     * of its record (see `current`). A hint, not a guarantee: an
+     * announcement can reach this tab after the next lock does, or never.
+     * What decides whether a copy may be written over, or relied on under a
+     * move's or a delete's locks, is the record's counter: see `sendLocked`
+     * and `dropStale`.
+     */
+    heard(id) {
+        const at = ++this.hearing;
+        if (id === null) {
+            this.missedAt = at;
+            this.cache.clear();
+            return;
+        }
+        this.heardAt.set(id, at);
+        this.cache.delete(id);
+    }
+    /**
+     * Does `copy` hold every write of its record another tab has announced
+     * that this one has heard of? See `heard`. Only ever a reason to read it
+     * again, never to take it for current: see `sendLocked`.
+     */
+    current(copy) {
+        return copy.seen >= Math.max(this.missedAt, this.heardAt.get(copy.id) ?? 0);
+    }
+    /**
+     * Drop from the cache every copy of a record in `ids` that may not hold
+     * every write of it another tab has made: its counter has moved since
+     * the copy was read, or cannot be told, or the copy is still being read.
+     * Returns every id whose copy here is not known to be current - those,
+     * and those not cached - so that the next read of each fetches it again,
+     * once any write of it in flight here has landed or failed. Not a copy
+     * this tab is writing under its lock (see `locked`): its counter reads
+     * as unknown only because that write is not counted yet, and dropped,
+     * the next read would wait for the write.
+     *
+     * The counters are read in one go, after the caller has taken the locks
+     * it relies on: another tab counts each write of a record before it lets
+     * go of the locks it held while writing it, the record's own and any
+     * move lock, so what it wrote before letting go of one of them is
+     * counted by then. Its announcements may not have reached this tab yet,
+     * or ever. See `sendLocked`.
+     */
+    async dropStale(coordinator, ids) {
+        const asked = [...new Set(ids)];
+        const now = asked.length ? await coordinator.counters(asked).catch(() => asked.map(() => null)) : [];
+        const stale = new Set();
+        asked.forEach((id, i) => {
+            const cached = this.cache.get(id);
+            const copy = cached && this.copyOf.get(cached);
+            if (copy && copy.gen === this.generation && copy.counter !== null && copy.counter === now[i])
+                return;
+            if (copy && copy.gen === this.generation && this.locked.get(id) === copy)
+                return;
+            if (cached)
+                this.cache.delete(id);
+            stale.add(id);
+        });
+        return stale;
+    }
     /**
      * Seal a directory record as it stands NOW and put it in the store.
      *
@@ -16928,12 +17805,15 @@ class VfsNamespace {
         assertValidName(name);
         const parent = await this.openDir(parentPath);
         const entry = { kind: "dir", id: newId(), key: toBase64(newDirKey()), mtime: Date.now() };
-        await this.mutate(parent, (node, record) => {
+        // The directory the edit below last found there, if any.
+        let there;
+        const named = this.mutate(parent, (node, record) => {
             // mkdir looked before the wait above. A directory made there
             // since, by another `mkdir -p` of the same path - files saved
             // at once into a new folder - is kept, not replaced: whatever
             // was saved into it would go with it.
             const now = entryIn(node, name);
+            there = now;
             if (now?.kind === "dir" && recursive)
                 return false;
             if (now)
@@ -16942,6 +17822,16 @@ class VfsNamespace {
             node.entries[name] = entry;
             return true;
         });
+        // Set before anyone can find the entry in the cached parent - `mutate`
+        // makes the edit at once, or after a re-read - so a mkdir that finds
+        // it there waits for this write. See `naming`.
+        this.naming.set(entry.id, named.then(() => { }, () => { }).then(() => void this.naming.delete(entry.id)));
+        await named;
+        // The directory kept instead may be one another mkdir here named,
+        // its write not landed yet: wait for that too, as `mkdir` does.
+        const kept = there && this.naming.get(there.id);
+        if (kept)
+            await kept;
     }
     /**
      * Every directory record in a subtree, each once, opened - and nothing
@@ -16957,14 +17847,22 @@ class VfsNamespace {
      *
      * `moving` says whether anything in it is marked as half of an
      * interrupted move, which is what makes a delete look for the other half.
+     *
+     * `ids` is every entry id in it, and `shape` what each record named when
+     * it was read: see `currentSubtree`.
      */
     async subtree(top, target, above) {
         const found = new Map([[top.id, top]]);
         const pending = [top];
+        // Every entry id in it, and what each record named as it was read.
+        const ids = new Set();
+        const shape = new Map();
         let spared = 0;
         let moving = false;
         for (let dir = pending.pop(); dir; dir = pending.pop()) {
+            shape.set(dir.id, namedIn(dir));
             for (const [, entry] of followable(dir)) {
+                ids.add(entry.id);
                 if (entry.moving === true)
                     moving = true;
                 if (entry.kind !== "dir" || found.has(entry.id))
@@ -16994,7 +17892,79 @@ class VfsNamespace {
             const what = spared === 1 ? "a directory that is" : `${spared} directories that are`;
             this.warn(`leaving ${what} above ${target} in the tree alone while deleting it`);
         }
-        return { dirs: [...found.values()], moving };
+        return { dirs: [...found.values()], moving, ids, shape };
+    }
+    /**
+     * The records a recursive delete read, as they are now - or null when
+     * one has changed since in a way that purging it would get wrong.
+     *
+     * The delete decided what to let go of, and whether to look for the
+     * other half of a move, from what it read; then it waited, on reads and
+     * on the write of its parent. A record that is no longer named by the
+     * record it was read in has been moved out, and is not this delete's to
+     * purge; an entry marked since it was read is being moved, and is about
+     * to be named somewhere the delete never looked. Purging either purged
+     * the folder a move had just put somewhere else. Anything else - a file
+     * saved into one of them, or moved out - is purged as it now stands,
+     * which is why the copies to purge are what this returns.
+     *
+     * Synchronous, for an edit. A record whose copy is not to hand counts as
+     * changed.
+     *
+     * `held`, with a coordinator, is every entry whose move lock the delete
+     * holds. An entry named since the records were read - saved or moved in
+     * - is not among them, so nothing stops another tab moving it out while
+     * the delete writes the parent, and purging it then let go of what that
+     * move had put somewhere else. So with `held`, that counts as changed
+     * too, and the delete is tried again from the start.
+     */
+    currentSubtree(dirs, shape, held) {
+        const doomed = new Set(dirs.map((dir) => dir.id));
+        const current = [];
+        for (const dir of dirs) {
+            const now = this.editable(dir);
+            if (!now)
+                return null;
+            const read = shape.get(dir.id) ?? new Map();
+            const named = namedIn(now);
+            for (const [id, marked] of named)
+                if (marked && read.get(id) !== true)
+                    return null;
+            for (const id of read.keys())
+                if (doomed.has(id) && !named.has(id))
+                    return null;
+            if (held)
+                for (const id of named.keys())
+                    if (!held.has(id))
+                        return null;
+            current.push(now);
+        }
+        return current;
+    }
+    /**
+     * Hold the move lock of every entry in `ids` - see
+     * `VfsCoordinator.holdMoving` - or of none: null when another holder has
+     * any of them, and then nothing is held. Otherwise the function that
+     * lets go of them all. Asked for all at once: none of them waits.
+     * `shared` holds them as the folders a move goes into.
+     */
+    async holdAll(coordinator, ids, shared = false) {
+        const tries = await Promise.allSettled([...new Set(ids)].map((id) => coordinator.holdMoving(id, shared)));
+        const held = tries.flatMap((tried) => (tried.status === "fulfilled" && tried.value ? [tried.value] : []));
+        const release = () => {
+            for (const letGo of held)
+                letGo();
+        };
+        const failed = tries.find((tried) => tried.status === "rejected");
+        if (failed) {
+            release();
+            throw failed.reason;
+        }
+        if (held.length < tries.length) {
+            release();
+            return null;
+        }
+        return release;
     }
     /**
      * Delete these records and let go of every file in them. The second half
@@ -17255,7 +18225,10 @@ class VfsNamespace {
         }
         if (!run.write)
             return clone;
-        const open = { id: clone.id, key: fromBase64(clone.key), node, hidden: Object.create(null), gen: run.gen };
+        const counter = this.deps.coordinator ? await this.counterOf(clone.id) : null;
+        const open = {
+            id: clone.id, key: fromBase64(clone.key), node, hidden: Object.create(null), gen: run.gen, seen: this.hearing, counter,
+        };
         await this.deps.store.put(dirKey(open.id), await seal(open.key, node));
         this.adopt(open);
         return clone;
@@ -18605,6 +19578,519 @@ class VcsNamespace {
     }
 }
 
+/**
+ * Coordination between the tabs of an app on one device: Web Locks, the
+ * Web BroadcastChannel, and IndexedDB.
+ *
+ * Every factory here returns undefined unless the runtime is a browser tab
+ * with both Web Locks and a BroadcastChannel - not Node (which has
+ * `navigator.locks` from 24.5, but per process), not a Worker, not an old
+ * WebView - and its callers then keep the behaviour they had before: one
+ * tab's writes ordered among themselves only. IndexedDB is not required:
+ * without it no count can be told, and every write reads its folder again
+ * first. A storage-partitioned iframe gets locks, a channel and IndexedDB of
+ * its own, as it gets storage of its own; to the app's other tabs it is
+ * another device.
+ *
+ * A browser can also have these and refuse them to a document: an opaque
+ * origin (a sandboxed iframe, a `data:` document), or a site whose data the
+ * user has blocked. Refused Web Locks, the coordinator goes on without
+ * them, as in Node (see `refusesLocks`); refused a channel, it hears
+ * nothing; and an IndexedDB that does not answer in time counts nothing
+ * (see `writeCounts`). `client.vfs` needed none of the three before it
+ * coordinated tabs, and none of them may stop it now.
+ *
+ * `globalThis.BroadcastChannel` is named in full on purpose: this package
+ * exports a class of its own called BroadcastChannel (the E2E room channel),
+ * and an import of that in scope would silently take the Web API's place.
+ */
+/** How long a write waits for another tab to finish writing the same folder before it gives up. */
+const LOCK_WAIT_MS = 30_000;
+/**
+ * How long each call to the write counts - `counters`, `begin` or `bump` -
+ * may take before it gives up, telling nothing, as one that failed: the
+ * wait for the IndexedDB open and the call's transaction together, not
+ * each. Only the call gives up, not the open: one that succeeds later,
+ * within `OPEN_DROP_MS`, is kept for every later call (see `writeCounts`).
+ */
+const COUNT_WAIT_MS = 3_000;
+/**
+ * How long an IndexedDB open of the write counts may go without any answer
+ * - no success, error or blocked - before it is dropped, as one that
+ * failed, and the next call asks for another. See `writeCounts`.
+ */
+const OPEN_DROP_MS = 30_000;
+/**
+ * Whether `err`, from a Web Locks request that was never granted, is the
+ * browser refusing Web Locks to this document altogether: an opaque origin,
+ * or a site whose data the user has blocked. The browser makes that
+ * decision for the site's storage, so it refuses every tab of the app
+ * alike, and no tab holds the lock. The tab then goes on without it, as in
+ * Node. Any other error - a document no longer fully active, say - is
+ * passed on.
+ */
+function refusesLocks(err) {
+    return err?.name === "SecurityError";
+}
+// Through `unknown`: the DOM's own LockManager and BroadcastChannel types do
+// not line up with these slices closely enough for a direct cast.
+function webLocks() {
+    if (typeof window === "undefined")
+        return undefined;
+    const locks = globalThis.navigator?.locks;
+    return typeof locks?.request === "function" ? locks : undefined;
+}
+function webChannel() {
+    const Channel = globalThis.BroadcastChannel;
+    return typeof Channel === "function" ? Channel : undefined;
+}
+function webIndexedDB() {
+    const idb = globalThis.indexedDB;
+    return typeof idb?.open === "function" ? idb : undefined;
+}
+/**
+ * The IndexedDB database the write counts are kept in, one per origin, as
+ * the locks are. Not one connect keeps for anything else: those are
+ * `muhkoo.offline` (the offline layer), `muhkoo.trust` and `muhkoo.device.v1`.
+ *
+ * Its version stays 1 for good. A tab still running code that opens it at
+ * version 1 would fail with a VersionError once a newer tab had made it at
+ * version 2, count nothing, and so write a folder without the newer tabs
+ * knowing: the writer whose write may be lost. A new store goes in a new
+ * database.
+ */
+const COUNTS_DB = "muhkoo.vfs";
+/** Its one store: `[commitment, record id]` to a count, and `CREATED` to a random id. */
+const COUNTS = "counts";
+const CREATED = "created";
+/**
+ * How often each user's directory records have been written on this
+ * device: `VfsCoordinator.counters`, `begin` and `bump`, kept in IndexedDB
+ * for every tab of the origin.
+ *
+ * A count is odd from `begin` to `bump`, while a write is under way, and
+ * even once it is counted; `counters` reports an odd one as unknown. It is
+ * read as `<created>:<count>`, where `created` is a random id stored when
+ * the database was made: deleted - the site's data cleared - every count
+ * starts again from nothing, and a counter read before could otherwise
+ * come round again with writes in between that its copy does not hold.
+ *
+ * Each operation is one transaction, and settles once that has completed.
+ * Every failure - IndexedDB missing, an open refused, blocked or failed, a
+ * transaction aborted - resolves to null, which the namespace takes for out
+ * of date: it reads the record again. A failed or blocked open is not kept,
+ * and nor is a connection closed under it, by a newer version of this code
+ * in another tab or by the database being deleted: the next operation opens
+ * the database again.
+ *
+ * So does an operation that has not settled within `waitMs`, the open it
+ * waits for and its transaction together: these are awaited inside the
+ * record locks, and one waited for without end would hold the lock, and
+ * stop every read and write of the tab's folders, for as long. Only the
+ * operation gives up, though, not the open: there is one open under way at
+ * a time, every operation waits for that one, and once it has opened the
+ * database it is kept for every later operation. Given up on too, and closed
+ * when it opened at last, an open that always takes longer than `waitMs`
+ * would never give the tab its counts. An open that has not answered at all
+ * within `OPEN_DROP_MS` is dropped, though, as one that failed: one that
+ * never will would otherwise leave the tab without counts for as long as it
+ * lives. Until then every operation waits for it, `waitMs` at most, and
+ * tells nothing; the next operation after that asks for one new open; and
+ * the dropped one, if it opens after all, is closed. The new open is
+ * dropped in turn if it goes `OPEN_DROP_MS` without an answer too, and so
+ * on: where IndexedDB never answers, the tab leaves behind one more open
+ * that never settles every `OPEN_DROP_MS` or a little more, for as long as
+ * operations keep coming, and none while none come. An operation that
+ * gives up before the database has opened makes no transaction. A
+ * transaction given up on is not aborted, and may still complete: IndexedDB
+ * runs the read-write transactions of one store in the order they were
+ * made, so a late `begin` still marks the count before any later `bump`,
+ * and a late `bump` still counts its write before any later `begin`. A tab
+ * that asks meanwhile waits behind it, gives up, and reads the record
+ * again.
+ */
+function writeCounts(idb, waitMs) {
+    // The open under way, or the one that opened `opened`: one at a time.
+    let connection = null;
+    // The database `connection` opened, once it has.
+    let opened = null;
+    // Drops `connection` while it is under way, once `OPEN_DROP_MS` have passed.
+    let dropping;
+    const forget = (db) => {
+        if (opened !== db)
+            return;
+        opened = null;
+        connection = null;
+        db.close();
+    };
+    const open = () => {
+        if (connection)
+            return connection;
+        let request;
+        try {
+            if (!idb)
+                throw new Error("no IndexedDB");
+            request = idb.open(COUNTS_DB, 1);
+        }
+        catch {
+            // Not kept: the next operation tries again.
+            return Promise.resolve(null);
+        }
+        const pending = new Promise((resolve) => {
+            // Not kept when it failed, or was dropped: the next operation
+            // tries again. Failed after it was dropped, it changes nothing.
+            const fail = () => {
+                if (connection === pending) {
+                    clearTimeout(dropping);
+                    connection = null;
+                }
+                resolve(null);
+            };
+            request.onupgradeneeded = () => {
+                request.result.createObjectStore(COUNTS).put(generateId(), CREATED);
+            };
+            request.onsuccess = () => {
+                const db = request.result;
+                // Blocked or dropped, and given up on, before it opened - or
+                // closed by `close`. Another open may be under way by now.
+                if (connection !== pending) {
+                    db.close();
+                    resolve(null);
+                    return;
+                }
+                clearTimeout(dropping);
+                db.onversionchange = () => forget(db);
+                db.onclose = () => forget(db);
+                opened = db;
+                resolve(db);
+            };
+            // Blocked: another tab holds an older version open. Not waited for.
+            request.onerror = fail;
+            request.onblocked = fail;
+            // No answer at all: dropped, as one that failed, and the next
+            // operation asks for another - dropped in turn if it does not
+            // answer either. See above.
+            dropping = setTimeout(fail, OPEN_DROP_MS);
+        });
+        connection = pending;
+        return pending;
+    };
+    /**
+     * Run `body` in one transaction, and resolve once that has completed to
+     * what the function it returns gives then - or to null, if anything
+     * fails, or the database has not opened and the transaction completed
+     * within `waitMs`.
+     */
+    const run = (mode, body) => new Promise((resolve) => {
+        let done = false;
+        const settle = (value) => {
+            if (done)
+                return;
+            done = true;
+            clearTimeout(timer);
+            resolve(value);
+        };
+        // Given up on, but neither the open nor the transaction aborted: see above.
+        const timer = setTimeout(() => settle(null), waitMs);
+        void open().then((db) => {
+            // Given up on while it opened: nothing to do.
+            if (done)
+                return;
+            if (!db) {
+                settle(null);
+                return;
+            }
+            let tx;
+            try {
+                tx = db.transaction(COUNTS, mode);
+                const result = body(tx.objectStore(COUNTS));
+                tx.oncomplete = () => settle(result());
+                tx.onabort = () => settle(null);
+            }
+            catch {
+                try {
+                    tx?.abort();
+                }
+                catch {
+                    // Finished already.
+                }
+                // Closed under it, most likely: the next operation opens it again.
+                forget(db);
+                settle(null);
+            }
+        });
+    });
+    const count = (value) => (typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : 0);
+    const counter = (created, n) => (typeof created === "string" ? `${created}:${n}` : null);
+    return {
+        async counters(who, ids) {
+            const read = await run("readonly", (store) => {
+                const created = store.get(CREATED);
+                const counts = ids.map((id) => store.get([who, id]));
+                return () => counts.map((at) => {
+                    const n = count(at.result);
+                    return n % 2 === 0 ? counter(created.result, n) : null;
+                });
+            });
+            return read ?? ids.map(() => null);
+        },
+        begin(who, id) {
+            return run("readwrite", (store) => {
+                const created = store.get(CREATED);
+                const at = store.get([who, id]);
+                let n = 0;
+                at.onsuccess = () => {
+                    n = count(at.result);
+                    // Odd already, a write began and was never counted: its mark stays.
+                    if (n % 2 === 0)
+                        store.put(n + 1, [who, id]);
+                };
+                return () => counter(created.result, n);
+            });
+        },
+        bump(who, id) {
+            return run("readwrite", (store) => {
+                const created = store.get(CREATED);
+                const at = store.get([who, id]);
+                let next = 0;
+                at.onsuccess = () => {
+                    const n = count(at.result);
+                    // Past the mark `begin` stored - or, when it could not
+                    // store one, past the count it found.
+                    next = n % 2 === 0 ? n + 2 : n + 1;
+                    store.put(next, [who, id]);
+                };
+                return () => counter(created.result, next);
+            });
+        },
+        close() {
+            // An open still under way is closed once it opens.
+            connection = null;
+            clearTimeout(dropping);
+            if (opened)
+                forget(opened);
+        },
+    };
+}
+/**
+ * The offline queue's drain lock: `fn` runs only if no other tab is
+ * draining, and `false` says another one is. See `OutboundQueue`. Where the
+ * browser refuses Web Locks, `fn` runs without it, as in Node, and the
+ * lock is not asked for again: see `refusesLocks`.
+ */
+function drainLock() {
+    const locks = webLocks();
+    if (!locks)
+        return undefined;
+    let refused = false;
+    return async (name, fn) => {
+        if (!refused) {
+            let answered = false;
+            try {
+                return await locks.request(name, { ifAvailable: true }, async (lock) => {
+                    answered = true;
+                    if (!lock)
+                        return false;
+                    await fn();
+                    return true;
+                });
+            }
+            catch (err) {
+                if (answered || !refusesLocks(err))
+                    throw err;
+                refused = true;
+            }
+        }
+        await fn();
+        return true;
+    };
+}
+/**
+ * The `VfsCoordinator` for whoever `commitment()` names: a lock per record,
+ * `muhkoo:vfs:<commitment>:<record id>`; a move lock per entry,
+ * `muhkoo:vfs:<commitment>:moving:<entry id>`, taken only if free, and
+ * shared by the moves into a folder; a count of each record's writes, in
+ * IndexedDB `muhkoo.vfs` under `[commitment, record id]` (see
+ * `writeCounts`); and announcements on the channel `muhkoo:vfs:<commitment>`
+ * as `{ id, writer }`, where `writer` is this tab's random id. `close` is
+ * for tests, as are `lockWaitMs` (see `LOCK_WAIT_MS`) and `countWaitMs`
+ * (see `COUNT_WAIT_MS`).
+ *
+ * Where the browser refuses Web Locks (see `refusesLocks`), it holds no
+ * lock - every write runs as it would without a coordinator, and every
+ * move lock is had at once - and asks for none again.
+ */
+function vfsCoordinator(commitment, opts = {}) {
+    const locks = webLocks();
+    const Channel = webChannel();
+    if (!locks || !Channel)
+        return undefined;
+    const lockWaitMs = opts.lockWaitMs ?? LOCK_WAIT_MS;
+    const tab = generateId();
+    const counts = writeCounts(webIndexedDB(), opts.countWaitMs ?? COUNT_WAIT_MS);
+    const handlers = new Set();
+    // `channel` is null where the browser would not make one: see `listen`.
+    let open = null;
+    // Move locks this tab has let go of, until the browser has too. See `holdMoving`.
+    const leaving = new Map();
+    // The browser refused Web Locks: see `refusesLocks`.
+    let refused = false;
+    /**
+     * Hear the channel of whoever is signed in now: opened the first time,
+     * and opened again for someone else after a sign-in. What was announced
+     * before it opened was not heard, which every handler is told.
+     *
+     * Where the browser will not make the channel - an opaque origin, or a
+     * site whose data is blocked - this tab hears nothing and tells no one,
+     * and does not ask again for the same user. That is safe: the counts,
+     * not the announcements, decide whether a copy may be written over.
+     */
+    const listen = () => {
+        const who = commitment();
+        if (open?.who === who)
+            return;
+        open?.channel?.close();
+        open = null;
+        if (!who)
+            return;
+        let channel = null;
+        try {
+            channel = new Channel(`muhkoo:vfs:${who}`);
+            channel.onmessage = (event) => {
+                const data = event.data;
+                if (typeof data?.id !== "string" || data.writer === tab)
+                    return;
+                for (const handler of handlers)
+                    handler(data.id);
+            };
+        }
+        catch {
+            channel = null;
+        }
+        open = { who, channel };
+        for (const handler of handlers)
+            handler(null);
+    };
+    return {
+        async lock(id, fn) {
+            listen();
+            const who = commitment();
+            // Signed out: the store refuses the write itself, with a clearer
+            // message. Refused Web Locks: no tab of the app can hold this
+            // lock, and the write goes ahead as it would without one.
+            if (!who || refused)
+                return fn();
+            // Only the WAIT is bounded. Once granted, the lock is held until
+            // the write has landed or failed: let go of while a write is still
+            // on its way, the next tab's write could land first and then be
+            // undone by it - the very loss this lock is for.
+            const waiting = new AbortController();
+            const timer = setTimeout(() => waiting.abort(), lockWaitMs);
+            let granted = false;
+            try {
+                return await locks.request(`muhkoo:vfs:${who}:${id}`, { signal: waiting.signal }, () => {
+                    granted = true;
+                    clearTimeout(timer);
+                    return fn();
+                });
+            }
+            catch (err) {
+                if (!granted && waiting.signal.aborted) {
+                    throw new VfsConflictError(`another tab of this app has been writing this folder for over ${Math.round(lockWaitMs / 1000)} seconds; nothing was written - try again`);
+                }
+                if (granted || !refusesLocks(err))
+                    throw err;
+                refused = true;
+            }
+            finally {
+                clearTimeout(timer);
+            }
+            // Refused Web Locks, before anything was written: written without one.
+            return fn();
+        },
+        announce(id) {
+            listen();
+            open?.channel?.postMessage({ id, writer: tab });
+        },
+        onAnnounce(handler) {
+            handlers.add(handler);
+            return () => void handlers.delete(handler);
+        },
+        listen,
+        // Signed out, nothing is counted: the store refuses the reads and
+        // writes themselves.
+        async counters(ids) {
+            const who = commitment();
+            return who ? counts.counters(who, ids) : ids.map(() => null);
+        },
+        async begin(id) {
+            const who = commitment();
+            return who ? counts.begin(who, id) : null;
+        },
+        async bump(id) {
+            const who = commitment();
+            return who ? counts.bump(who, id) : null;
+        },
+        async holdMoving(id, shared = false) {
+            const who = commitment();
+            // Signed out: the store refuses the writes themselves. Refused Web
+            // Locks, no tab of the app can hold this lock.
+            if (!who || refused)
+                return () => { };
+            const name = `muhkoo:vfs:${who}:moving:${id}`;
+            // Let go of by this tab, but perhaps not yet by the browser, which
+            // lets go only once the callback below has settled. Asked for
+            // before then - a move or a delete straight after another of the
+            // same entry - it is still held, and this tab refuses itself.
+            const before = leaving.get(name);
+            if (before)
+                await before;
+            return new Promise((resolve, reject) => {
+                let answered = false;
+                const request = locks.request(name, { ifAvailable: true, mode: shared ? "shared" : "exclusive" }, async (lock) => {
+                    answered = true;
+                    if (!lock) {
+                        resolve(null);
+                        return;
+                    }
+                    // Held until this settles: when the function handed back
+                    // is called, or when the tab goes and the browser lets go
+                    // of everything it held.
+                    let held = true;
+                    await new Promise((letGo) => resolve(() => {
+                        if (!held)
+                            return;
+                        held = false;
+                        // Settles once the browser has let go of it too,
+                        // and of every other hold of it this tab has let
+                        // go of: two moves into one folder hold it at once.
+                        const gone = Promise.all([leaving.get(name), request.then(() => { }, () => { })]).then(() => { });
+                        leaving.set(name, gone);
+                        void gone.then(() => {
+                            if (leaving.get(name) === gone)
+                                leaving.delete(name);
+                        });
+                        letGo();
+                    }));
+                });
+                request.catch((err) => {
+                    if (answered || !refusesLocks(err)) {
+                        reject(err);
+                        return;
+                    }
+                    refused = true;
+                    resolve(() => { });
+                });
+            });
+        },
+        close() {
+            open?.channel?.close();
+            open = null;
+            counts.close();
+        },
+    };
+}
+
 /**
  * `HlcTimestamp` — a Hybrid Logical Clock reading, packed into a single
  * lexicographically-sortable string so the whole offline layer (and the
@@ -18882,35 +20368,66 @@ class ConnectivityManager {
  * mutation by re-invoking the real namespace method (with an `isReplay` flag so
  * it doesn't re-enqueue). `drain()` replays entries in HLC order:
  *   - success → remove the entry;
- *   - permanent failure (4xx, or a Space whose member list refuses this user)
- *     → drop it and surface a `SYNC_ERROR` (a write the server will never
- *     accept must not wedge the queue forever);
+ *   - refused for payment (`PaymentRequiredError`: the app takes paid plans
+ *     only, or someone's payment is past due) → keep it and everything after
+ *     it, stop, and surface a `SYNC_ERROR` with `dropped: false`. The server
+ *     accepts it once the user or the app owner pays, so it waits for the next
+ *     reconnect, or for `client.app.access()` to report the app allowed;
+ *   - permanent failure (any other 4xx, or a Space whose member list refuses
+ *     this user) → drop it and surface a `SYNC_ERROR` (a write the server will
+ *     never accept must not wedge the queue forever);
  *   - transient/network failure → stop draining and leave the rest for the next
  *     reconnect.
  *
  * Replays are idempotent by construction (kv/db are LWW-by-key, messages dedupe
  * by `clientId`, file PUTs are content-addressed), so re-running a partially
  * drained queue is safe.
+ *
+ * Every tab of an origin shares the queue. Given a `tryLock`, a drain runs
+ * only while holding `muhkoo:offline-drain:<commitment>`, so two tabs coming
+ * back online replay it once between them, not once each.
  */
 class OutboundQueue {
     store;
+    opts;
     replayers = new Map();
     draining = null;
-    constructor(store) {
+    constructor(store, opts = {}) {
         this.store = store;
+        this.opts = opts;
     }
     /** A domain registers how to replay its mutations. */
     register(domain, replayer) {
         this.replayers.set(domain, replayer);
     }
-    /** Record a mutation for later replay; resolves with its assigned seq. */
+    /**
+     * Record a mutation for later replay; resolves with its assigned seq.
+     * Stamped with the signed-in user's commitment, so that it is only ever
+     * sent under their session (see {@link waiting}).
+     */
     enqueue(entry) {
-        return this.store.enqueue(entry);
+        const who = entry.commitment ?? this.opts.commitment?.();
+        return this.store.enqueue(who ? { ...entry, commitment: who } : entry);
     }
-    /** Number of writes still awaiting sync. */
+    /** Number of writes still awaiting sync, every user's. */
     async pending() {
         return (await this.store.queued()).length;
     }
+    /**
+     * The writes a drain would send now, in order: the signed-in user's, and
+     * any an older SDK queued without saying whose they are. Every tab of an
+     * origin shares this queue, and every replayer builds its request from
+     * the session signed in when it runs, so another user's write sent now
+     * would land in this user's space, or overwrite their data. It stays
+     * queued, as it is, until its own user signs in on this device again.
+     */
+    async waiting() {
+        return (await this.store.queued()).filter((entry) => this.sendable(entry));
+    }
+    /** True for an entry this drain may send: the signed-in user's, or one with no user. */
+    sendable(entry) {
+        return !entry.commitment || entry.commitment === this.opts.commitment?.();
+    }
     /**
      * Replay queued mutations in HLC order. Coalesces concurrent calls into a
      * single in-flight drain. Stops on the first transient failure, leaving the
@@ -18919,14 +20436,49 @@ class OutboundQueue {
     drain() {
         if (this.draining)
             return this.draining;
-        this.draining = this.runDrain().finally(() => {
+        this.draining = this.drainOnce().finally(() => {
             this.draining = null;
         });
         return this.draining;
     }
+    /**
+     * One drain, holding the device-wide drain lock where there is one. A
+     * tab that finds another tab holding it leaves the queue to that one,
+     * which is replaying it already and removes each entry as it lands - so
+     * a drain after it finds only what it left.
+     */
+    async drainOnce() {
+        const who = this.opts.commitment?.();
+        if (!this.opts.tryLock || !who) {
+            await this.runDrain();
+            return;
+        }
+        await this.opts.tryLock(`muhkoo:offline-drain:${who}`, async () => {
+            // A tab that found this one draining skipped its own drain, and
+            // what it queued after this pass read the queue was left to this
+            // tab. So drain until a pass leaves nothing of this user's; a
+            // transient failure still stops it, by throwing. So does a write
+            // refused for payment, which stays queued: another pass would
+            // only be refused again, at once and without end. Another user's
+            // writes never leave, so counting them would loop for ever too.
+            do {
+                if (!(await this.runDrain()))
+                    return;
+            } while ((await this.waiting()).length > 0);
+        });
+    }
+    /**
+     * One pass over the queue. False when a write refused for payment stopped
+     * it, which leaves that write and everything after it queued.
+     */
     async runDrain() {
         const entries = await this.store.queued();
         for (const entry of entries) {
+            // Another user's write, theirs to send under their own session.
+            // Asked per entry, so a sign-out in the middle of a pass stops
+            // the rest of it going out under the next user's session.
+            if (!this.sendable(entry))
+                continue;
             const replayer = this.replayers.get(entry.domain);
             if (!replayer) {
                 // No handler registered (namespace not wired) — drop it rather
@@ -18943,6 +20495,22 @@ class OutboundQueue {
                 });
             }
             catch (err) {
+                // Asked before `isPermanent`, which would drop it as a 4xx.
+                if (err instanceof PaymentRequiredError) {
+                    // The user's plan, or a payment past due: the server will
+                    // accept this write once that changes. Keep it, and keep
+                    // every write after it in order; a delete queued after an
+                    // upload never goes first. Stop rather than send the rest,
+                    // which the server would refuse for the same reason.
+                    EventCore.emit(EventCoreEvents.SYNC_ERROR, {
+                        domain: entry.domain,
+                        method: entry.method,
+                        error: err.message,
+                        code: err.code,
+                        dropped: false,
+                    });
+                    return false;
+                }
                 if (isPermanent(err)) {
                     await this.store.dequeue(entry.seq);
                     EventCore.emit(EventCoreEvents.SYNC_ERROR, {
@@ -18957,12 +20525,14 @@ class OutboundQueue {
                 throw err;
             }
         }
+        return true;
     }
 }
 /** A 4xx is the server permanently refusing the write, and so is a Space whose
  *  member list does not admit this user (design §4.5.12): the relay refuses
  *  their frames. Anything else, a locked session included, is worth retrying
- *  on the next reconnect. */
+ *  on the next reconnect. A refusal for payment is a 4xx that is not
+ *  permanent; `runDrain` keeps it before asking this. */
 function isPermanent(err) {
     if (err instanceof AdmissionDeniedError)
         return true;
@@ -19170,6 +20740,14 @@ const META_NODE_ID = "nodeId";
  * stay decoupled from IndexedDB and the clock.
  */
 const HLC_STATE_KEY = "global";
+/**
+ * A random suffix for this tab's HLC node id, held in memory only - see
+ * `OfflineManager.boot`. 48 bits: two tabs of one device never draw the same.
+ */
+function tabSuffix() {
+    const bytes = crypto.getRandomValues(new Uint8Array(6));
+    return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
 class OfflineManager {
     /** True in browsers with IndexedDB; false when running over a NoopStore. */
     enabled;
@@ -19188,7 +20766,10 @@ class OfflineManager {
     constructor(deps) {
         this.enabled = deps.enabled;
         this.store = deps.store;
-        this.queue = new OutboundQueue(deps.store);
+        this.queue = new OutboundQueue(deps.store, {
+            tryLock: deps.locks,
+            commitment: () => deps.session.commitment,
+        });
         this.connectivity = new ConnectivityManager({
             onReconnect: () => void this.sync.run(),
         });
@@ -19224,6 +20805,22 @@ class OfflineManager {
             args: { hash },
         });
     }
+    /**
+     * Replay the queue now, as a reconnect does, if anything is waiting in it.
+     * `client.app.access()` calls this each time it reports the app allowed,
+     * so writes kept after a refusal for payment go out once the user or the
+     * app owner has paid, without waiting for the next reconnect. One drain per
+     * call, never on a timer. With nothing of the signed-in user's queued it
+     * does not drain at all, so the app sees no "syncing". A drain also runs the
+     * catch-up tasks (Space history paging), as a reconnect does.
+     */
+    async resume() {
+        if (!this.enabled)
+            return;
+        if ((await this.queue.waiting()).length === 0)
+            return;
+        await this.sync.run();
+    }
     /** Resolve once the clock + node id are loaded. */
     ready() {
         return this.bootPromise;
@@ -19286,14 +20883,22 @@ class OfflineManager {
             this.hlc = new HLC(this.nodeId);
             return;
         }
-        let nodeId = await this.store.get("meta", META_NODE_ID);
-        if (!nodeId) {
-            nodeId = generateId();
-            await this.store.put("meta", META_NODE_ID, nodeId);
-        }
-        this.nodeId = nodeId;
+        let deviceId = await this.store.get("meta", META_NODE_ID);
+        if (!deviceId) {
+            deviceId = generateId();
+            await this.store.put("meta", META_NODE_ID, deviceId);
+        }
+        // One node id per TAB, under the device's. Every tab of an origin
+        // loads the same stored id, and two tabs stamping with it in the same
+        // millisecond minted identical HLCs: the node id is the tiebreak, and
+        // the server keeps the first of two equal stamps, so the second write
+        // was dropped. The suffix lives in memory only. The clock state below
+        // stays shared, so the clock never goes back across tabs, and stamps
+        // stored already stay valid: every comparison reads a packed stamp as
+        // one string and never parses the node id.
+        this.nodeId = `${deviceId}.${tabSuffix()}`;
         const state = await this.store.get("hlc-state", HLC_STATE_KEY);
-        this.hlc = new HLC(nodeId, { state });
+        this.hlc = new HLC(this.nodeId, { state });
     }
     /** Coalesce HLC-state writes — a burst of stamps persists once. */
     schedulePersist() {
@@ -19765,6 +21370,8 @@ class Client {
     functions;
     /** Access tokens — `client.accessTokens.create(appId, …)`, etc. */
     accessTokens;
+    /** This app — `client.app.access()`: may the signed-in user add data here? */
+    app;
     /** Offline cache + sync — `client.offline.status`, `client.offline.snapshot`, etc. */
     offline;
     session;
@@ -19801,6 +21408,8 @@ class Client {
             store: offlineStore,
             session: this.session,
             enabled: offlineEnabled,
+            // Every tab of the origin shares the queue: one drains it at a time.
+            locks: drainLock(),
         });
         // Wrap fetch so every accelerator round-trip feeds the connectivity
         // detector: a thrown fetch is the strongest "offline" signal, a 2xx the
@@ -19921,6 +21530,9 @@ class Client {
         this.vfs = new VfsNamespace({
             store: personalStore,
             seed: () => this.session.seed,
+            // Orders writes of a folder with this app's other tabs on the
+            // device - undefined outside a browser tab with Web Locks.
+            coordinator: vfsCoordinator(() => this.session.commitment),
             // Share the personal space's socket with `client.kv` rather than
             // opening a second one to the same Durable Object.
             subscribe: (handler) => this.kv.onRaw(handler),
@@ -19939,12 +21551,15 @@ class Client {
                 // the capability path, so it keeps working for a file whose
                 // handle was shared from someone else's filesystem.
                 read: async (manifest) => (await this.storage.readByManifest(manifest)).data,
-                release: async (manifest) => {
-                    await (await resolveContentSpace()).releaseFile(manifest);
-                },
-                retain: async (manifest) => {
-                    await (await resolveContentSpace()).commitFile(manifest);
-                },
+                // A reference names only shards, so taking or dropping one needs
+                // no Space. Opening the content space here created it for a user
+                // who had never written a file: a checkout, a copy, a delete, or
+                // Cloud Drive's move of its pre-VFS files. A paid-only app refuses
+                // that creation for a Free user (accelerator spec
+                // 2026-10-06-paid-accounts-and-past-due, D12). Same body as
+                // `Space.commitFile`, so it is the same reference.
+                release: (manifest) => commitManifest(this.http.fetchWithRecovery, this.baseUrl, manifest, "release"),
+                retain: (manifest) => commitManifest(this.http.fetchWithRecovery, this.baseUrl, manifest, "commit"),
             },
         });
         // Sealed into the SAME personal store as the VFS metadata, so a project
@@ -20013,6 +21628,9 @@ class Client {
         this.agents = new AgentsNamespace({ http: this.http });
         this.functions = new FunctionsNamespace({ http: this.http, fnHostSuffix: options.functionsHostSuffix });
         this.accessTokens = new AccessTokensNamespace({ http: this.http });
+        // Each "allowed" sends what the offline queue kept after a refusal for
+        // payment, without waiting for the next reconnect.
+        this.app = new AppNamespace({ http: this.http, onAllowed: () => this.offline.resume() });
         // Replay deferred shard uploads on reconnect. The bytes live in the
         // Cache API keyed by hash; re-PUT them through a (defer-free) shard
         // client so a failure surfaces as transient and the entry stays queued.
@@ -20021,6 +21639,7 @@ class Client {
                 baseUrl: this.baseUrl,
                 pathPrefix: "/api/shards",
                 fetch: this.http.fetch,
+                fetchWithRecovery: this.http.fetchWithRecovery,
                 cache: this.offline.fileCache,
             });
             this.offline.registerReplayer("file", async (entry) => {
@@ -20432,5 +22051,5 @@ var bundledLoader = /*#__PURE__*/Object.freeze({
   default: loadRsWasm
 });
 
-export { ACCESS_TOKEN_SCOPES, AES_GCM_IV_BYTES$1 as AES_GCM_IV_BYTES, AES_GCM_KEY_BYTES, AES_GCM_TAG_BYTES$1 as AES_GCM_TAG_BYTES, AccessTokensNamespace, AdmissionDeniedError, AgentsNamespace, AuthClient, AuthHttpError, AuthNamespace, AuthPublicInput, Authenticator, BlockEngine, BroadcastChannel, BroadcastChannelEvents, ChannelExistsError, ChannelNotFoundError, ChunkCipher, CircuitIntegrityError, Client, ConnectivityManager, DEFAULT_AUTH_BASE_URL, DEFAULT_BASE_URL, DEFAULT_BRANCH, DEFAULT_FN_HOST_SUFFIX, DEVICE_IDENTITY_STORAGE_KEY, DEVICE_KEY_DB_NAME, DbCache, DbNamespace, DbTable, DevicePairingError, DeviceRevokedError, DeviceStoreUnavailableError, DoubleRatchet, DoubleRatchetCipher, DoubleRatchetManager, EncryptedSession, EventCore, EventCoreEvents, Field, Field as FieldElement, FileStorage, FunctionsNamespace, HLC, HashKnowledge, HostedAuth, HttpClient, HttpError, IdentityLockedError, IdentityUnavailableError, IndexedDbStore, KEEPER_MEMBER_ID$1 as KEEPER_MEMBER_ID, KeyStore, KeyringClient, KeyringHttpError, KvCache, KvNamespace, LocalEngineHost, LocalStorageSessionStore, Logger, MemorySessionStore, Message, Message as MessageDefault, MessageNamespace, MuhkooAgent, MuhkooDB, MuhkooFunction, MuhkooSpace, NOT_MEMBER_CLOSE_CODE, NOT_MEMBER_RECHECK_MS, NoopStore, OfflineLockedError, OfflineManager, OutboundQueue, P2P_SUBJECT, PAIRING_CODE_ALPHABET, PAIRING_CODE_LENGTH, PBKDF2_DEFAULT_ITERATIONS, PINNED_CIRCUIT_DIGESTS, PREIMAGE_POK_VERIFICATION_KEY, Packet, PasskeyOriginError, PeerExchange, PeerNetwork, PersonalSpaceClient, Poseidon, PreimagePoK, ROOT_ID, Ready, ReauthRequiredError, ReedSolomonCodec, Repo, Retry, Space as Room, SerializeMessage, SessionState, ShardCache, ShardClient, SharedSpaceClient, SnapshotNamespace, Space, SpaceCache, SpaceKeyring, SpaceNamespace, SpacePacketCipher, SpaceSignaler, SpaceTrustError, StorageNamespace, SyncEngine, VERSION, VFS_ROOT_INFO, VaultProtocolMismatchError, VaultUnavailableError, VcsError, VcsNamespace, VfsConflictError, VfsCorruptRecordError, VfsLimitError, VfsLockedError, VfsNamespace, VfsNotFoundError, WSTransport, WebRtcTransport, WorkerEngineHost, ZERO_HLC, ZkAuth, _accountId, _formatBytes, _messageId, _objectId, _packetId, _socketId, _userId, appLogger$1 as appLogger, assertType, base58Decode, base58Encode, buildCommitment, canonicalUserCode, clearDeviceIdentity, compareHlc, compilePrograms, concatBytes$1 as concatBytes, configureDeviceStore, createPasskeyWithPrf, decodeFromHex, decorators, decryptAesGcm, defaultCircuitUrls, defaultRpId, defaultSessionStore, deleteBeatsWrite, deleteRegister, deriveAesKeyFromPassphrase, deriveBitsHkdf, deriveIdentity, deriveIdentityFromSeed, deriveMasterSeedFromPassword, deserialize, deviceFingerprint, deviceIdentityIsEphemeral, deviceIdentityKey, dirKey, ejectAgentPrompt, ejectAgentTools, emptyMap, emptyRegister, encodeToHex, encryptAesGcm, evaluatePasskeyPrf, exportPublicKeyBase64, exportPublicKeyHex, formatUserCode, fromBase64$2 as fromBase64, fromBase64Url, fromHex, generateAuthProof, generateChecksum, generateDevicePairingKeypair, generateId, generatePkce, getIPAddress, getId, getMuhkooAppDescriptor, getSubtle, hasDeviceIdentity, headKey, historyKey, initBn128Wasm, initRsWasm, initializeCircuits, isNewer, isNumber, isOfflineCapable, isP2pCapable, isProvisional, isSameOriginPath, loadDeviceIdentity, log, manifestToStat, materializeRow, merge3, merge3Text, mergeKey, mergeMap, mergeMessage, mergeRegister, messageKey, objectKey, pack, padHandle, pairingVerificationCode, passkeyPrfCapable, passkeySupported, passkeyUsableFromOrigin, persistDeviceIdentity, poseidonHash, protocol, provisionalHandle, quickVerify, randomBytes, randomState, refKey, refsIndexKey, rpIdUsableForOrigin, sealSeed, sealSeedToDevice, serialize, shardHash, signMessage, stableStringify, toBase64$2 as toBase64, toBase64Url, toField, toHex, tombstoneRow, unpack, unsealSeed, unsealSeedFromDevice, unwrapWithPassphrase, utf8Decode, utf8Encode, verify, verifyChecksum, verifyGroth16, verifyHashKnowledge, verifyPreimagePoK, wrapWithPassphrase, writeBeatsTombstone, writeColumns, writeRegister };
+export { ACCESS_TOKEN_SCOPES, AES_GCM_IV_BYTES$1 as AES_GCM_IV_BYTES, AES_GCM_KEY_BYTES, AES_GCM_TAG_BYTES$1 as AES_GCM_TAG_BYTES, AccessTokensNamespace, AdmissionDeniedError, AgentsNamespace, AppNamespace, AuthClient, AuthHttpError, AuthNamespace, AuthPublicInput, Authenticator, BlockEngine, BroadcastChannel, BroadcastChannelEvents, ChannelExistsError, ChannelNotFoundError, ChunkCipher, CircuitIntegrityError, Client, ConnectivityManager, DEFAULT_AUTH_BASE_URL, DEFAULT_BASE_URL, DEFAULT_BRANCH, DEFAULT_FN_HOST_SUFFIX, DEVICE_IDENTITY_STORAGE_KEY, DEVICE_KEY_DB_NAME, DbCache, DbNamespace, DbTable, DevicePairingError, DeviceRevokedError, DeviceStoreUnavailableError, DoubleRatchet, DoubleRatchetCipher, DoubleRatchetManager, EncryptedSession, EventCore, EventCoreEvents, Field, Field as FieldElement, FileStorage, FunctionsNamespace, HLC, HashKnowledge, HostedAuth, HttpClient, HttpError, IdentityLockedError, IdentityUnavailableError, IndexedDbStore, KEEPER_MEMBER_ID$1 as KEEPER_MEMBER_ID, KeyStore, KeyringClient, KeyringHttpError, KvCache, KvNamespace, LocalEngineHost, LocalStorageSessionStore, Logger, MemorySessionStore, Message, Message as MessageDefault, MessageNamespace, MuhkooAgent, MuhkooDB, MuhkooFunction, MuhkooSpace, NOT_MEMBER_CLOSE_CODE, NOT_MEMBER_RECHECK_MS, NoopStore, OfflineLockedError, OfflineManager, OutboundQueue, P2P_SUBJECT, PAIRING_CODE_ALPHABET, PAIRING_CODE_LENGTH, PBKDF2_DEFAULT_ITERATIONS, PINNED_CIRCUIT_DIGESTS, PREIMAGE_POK_VERIFICATION_KEY, Packet, PasskeyOriginError, PaymentRequiredError, PeerExchange, PeerNetwork, PersonalSpaceClient, Poseidon, PreimagePoK, ROOT_ID, Ready, ReauthRequiredError, ReedSolomonCodec, Repo, Retry, Space as Room, SerializeMessage, SessionState, ShardCache, ShardClient, SharedSpaceClient, SnapshotNamespace, Space, SpaceCache, SpaceKeyring, SpaceNamespace, SpacePacketCipher, SpaceSignaler, SpaceTrustError, StorageNamespace, SyncEngine, VERSION, VFS_ROOT_INFO, VaultProtocolMismatchError, VaultUnavailableError, VcsError, VcsNamespace, VfsConflictError, VfsCorruptRecordError, VfsLimitError, VfsLockedError, VfsNamespace, VfsNotFoundError, WSTransport, WebRtcTransport, WorkerEngineHost, ZERO_HLC, ZkAuth, _accountId, _formatBytes, _messageId, _objectId, _packetId, _socketId, _userId, appLogger$1 as appLogger, assertType, base58Decode, base58Encode, buildCommitment, canonicalUserCode, clearDeviceIdentity, compareHlc, compilePrograms, concatBytes$1 as concatBytes, configureDeviceStore, createPasskeyWithPrf, decodeFromHex, decorators, decryptAesGcm, defaultCircuitUrls, defaultRpId, defaultSessionStore, deleteBeatsWrite, deleteRegister, deriveAesKeyFromPassphrase, deriveBitsHkdf, deriveIdentity, deriveIdentityFromSeed, deriveMasterSeedFromPassword, deserialize, deviceFingerprint, deviceIdentityIsEphemeral, deviceIdentityKey, dirKey, ejectAgentPrompt, ejectAgentTools, emptyMap, emptyRegister, encodeToHex, encryptAesGcm, evaluatePasskeyPrf, exportPublicKeyBase64, exportPublicKeyHex, formatUserCode, fromBase64$2 as fromBase64, fromBase64Url, fromHex, generateAuthProof, generateChecksum, generateDevicePairingKeypair, generateId, generatePkce, getIPAddress, getId, getMuhkooAppDescriptor, getSubtle, hasDeviceIdentity, headKey, historyKey, initBn128Wasm, initRsWasm, initializeCircuits, isNewer, isNumber, isOfflineCapable, isP2pCapable, isProvisional, isSameOriginPath, loadDeviceIdentity, log, manifestToStat, materializeRow, merge3, merge3Text, mergeKey, mergeMap, mergeMessage, mergeRegister, messageKey, objectKey, pack, padHandle, pairingVerificationCode, passkeyPrfCapable, passkeySupported, passkeyUsableFromOrigin, persistDeviceIdentity, poseidonHash, protocol, provisionalHandle, quickVerify, randomBytes, randomState, refKey, refsIndexKey, rpIdUsableForOrigin, sealSeed, sealSeedToDevice, serialize, shardHash, signMessage, stableStringify, toBase64$2 as toBase64, toBase64Url, toField, toHex, tombstoneRow, unpack, unsealSeed, unsealSeedFromDevice, unwrapWithPassphrase, utf8Decode, utf8Encode, verify, verifyChecksum, verifyGroth16, verifyHashKnowledge, verifyPreimagePoK, wrapWithPassphrase, writeBeatsTombstone, writeColumns, writeRegister };
 //# sourceMappingURL=index.js.map