@openlfcp/shared-objects 0.2.0-beta.1 → 0.2.0-beta.10

package/dist/admission/canonical.d.ts

@@ -30,6 +30,13 @@ export interface ParsedChange {
     /** Hex other actors, ascending: actor index i is otherActors[i - 1]. */
     readonly otherActors: readonly string[];
     readonly ops: readonly ParsedOp[];
+    /**
+     * §14.1: the extra bytes after the columns (which rule 4 leaves free) begin
+     * with an Automerge author — an unsigned LEB128 1, a length L, then at least
+     * L bytes. automerge 0.12 reads it and asserts the change's sequence number
+     * is 1, so a later change carrying one is refused (finding D5).
+     */
+    readonly beginsWithAuthor: boolean;
 }
 /**
  * §11.3: checks that `bytes` (one change chunk within the §11.1 limits) is

package/dist/admission/canonical.js

@@ -349,6 +349,36 @@ function checkValue(type, bytes) {
     if (type === 6)
         utf8(bytes, "a string value");
 }
+/**
+ * §14.1: whether the extra bytes after a change's columns begin with an
+ * Automerge author (finding D5). Rule 4 leaves these bytes free, but
+ * automerge 0.12 reads an author there — an unsigned LEB128 1, a length L,
+ * then L bytes — and asserts the change's sequence number is 1. The LEB128 is
+ * read as automerge reads it: up to ten bytes, under 2^64, in any encoding
+ * (not the shortest-form `Reader` the rest of the walk uses).
+ */
+function beginsWithAuthor(extra) {
+    let pos = 0;
+    const leb = () => {
+        let value = 0n;
+        let shift = 0n;
+        for (;;) {
+            if (pos >= extra.length)
+                return null;
+            const b = extra[pos++];
+            if (shift === 63n && b !== 0 && b !== 1)
+                return null;
+            value |= BigInt(b & 0x7f) << shift;
+            if ((b & 0x80) === 0)
+                return value;
+            shift += 7n;
+        }
+    };
+    if (leb() !== 1n)
+        return false;
+    const length = leb();
+    return length !== null && BigInt(extra.length - pos) >= length;
+}
 /**
  * §11.3: checks that `bytes` (one change chunk within the §11.1 limits) is
  * the canonical encoding of its change, and returns the change's operations
@@ -403,7 +433,9 @@ export function checkCanonicalChange(bytes) {
     const data = new Map();
     for (const m of metas)
         data.set(m.spec, r.take(m.length));
-    // What follows is the change's extra bytes.
+    // What follows is the change's extra bytes (§11.3 rule 4), free except that
+    // automerge reads an author from their start (§14.1, finding D5).
+    const authored = beginsWithAuthor(bytes.subarray(r.pos));
     const rle = (spec) => {
         const d = data.get(spec);
         return d === undefined ? undefined : column(spec, d);
@@ -615,6 +647,7 @@ export function checkCanonicalChange(bytes) {
         deps: Object.freeze(deps.map(hex)),
         otherActors: Object.freeze(others.map(hex)),
         ops: Object.freeze(ops),
+        beginsWithAuthor: authored,
     });
 }
 //# sourceMappingURL=canonical.js.map

package/dist/admission/framing.d.ts

@@ -12,6 +12,12 @@ export interface CheckedChange {
     readonly deps: readonly string[];
     /** Hex IDs of the other actors the change refers to (§11.1: each must be known to the document). */
     readonly otherActors: readonly string[];
+    /**
+     * §14.1: the change's extra bytes begin with an Automerge author, allowed
+     * only in an actor's first change (finding D5). See
+     * {@link ParsedChange.beginsWithAuthor}.
+     */
+    readonly beginsWithAuthor: boolean;
 }
 /**
  * Checks that `bytes` is exactly one valid Automerge change (§11, §12) and
@@ -23,15 +29,18 @@ export interface CheckedChange {
  */
 export declare function checkChange(bytes: Uint8Array): CheckedChange;
 /**
- * The change hash of bytes checkChange refused, read without decoding
- * them: the SHA-256 of the chunk from its type byte on (the Automerge
- * change hash). A change above a §11.1 limit is named this way, so a
- * receiver can report it without expanding it. Undefined when the bytes
- * are not one change chunk that could be read: no magic bytes, another
- * chunk type, a length that does not cover them exactly, or a header or
- * column cut short.
+ * The change hash of bytes checkChange refused, read without decoding them:
+ * the SHA-256 of the chunk from its type byte on (the Automerge change hash).
+ * §14.1 names a refused change by this hash whenever the bytes are one change
+ * chunk of type 1 whose length field covers them exactly and whose checksum
+ * matches — the inner header is never read, so a change above a §11.1 limit
+ * (named without being expanded) and one whose header holds a length running
+ * past its end (finding C3) are both named. Undefined when the bytes are not
+ * such a chunk: no magic bytes, another chunk type (a compressed chunk
+ * included), a length that does not cover them exactly, or a wrong checksum
+ * (whose name would be its intact copy's, finding C1).
  */
-export declare function refusedChangeHash(bytes: Uint8Array, error: unknown): string | undefined;
+export declare function refusedChangeHash(bytes: Uint8Array): string | undefined;
 /** The change as its canonical bytes give it (§11.3), reusing the walk of checkChange. */
 export declare function parsedOf(change: CheckedChange): ParsedChange;
 /** The decoded change, reusing the decode of checkChange when there was one. */

package/dist/admission/framing.js

@@ -3,7 +3,7 @@ import { LfcpError, toHex } from "@openlfcp/core";
 import { sha256 } from "@openlfcp/crypto";
 import { ProfileInvalidError } from "../profile-invalid.js";
 import { checkCanonicalChange } from "./canonical.js";
-import { checkChangeExpansion, MalformedChunkError } from "./limits.js";
+import { checkChangeExpansion } from "./limits.js";
 /**
  * Automerge byte checks of the SHARED-OBJECTS-PROFILE-01 payloads (LFCP-031):
  * a Data Unit plaintext carries exactly one Automerge change (§11, §12), a
@@ -63,23 +63,25 @@ export function checkChange(bytes) {
         seq: decoded.seq,
         deps: Object.freeze([...decoded.deps]),
         otherActors: expansion.otherActors,
+        beginsWithAuthor: parsed.beginsWithAuthor,
     });
     DECODED.set(checked, decoded);
     PARSED.set(checked, parsed);
     return checked;
 }
 /**
- * The change hash of bytes checkChange refused, read without decoding
- * them: the SHA-256 of the chunk from its type byte on (the Automerge
- * change hash). A change above a §11.1 limit is named this way, so a
- * receiver can report it without expanding it. Undefined when the bytes
- * are not one change chunk that could be read: no magic bytes, another
- * chunk type, a length that does not cover them exactly, or a header or
- * column cut short.
+ * The change hash of bytes checkChange refused, read without decoding them:
+ * the SHA-256 of the chunk from its type byte on (the Automerge change hash).
+ * §14.1 names a refused change by this hash whenever the bytes are one change
+ * chunk of type 1 whose length field covers them exactly and whose checksum
+ * matches — the inner header is never read, so a change above a §11.1 limit
+ * (named without being expanded) and one whose header holds a length running
+ * past its end (finding C3) are both named. Undefined when the bytes are not
+ * such a chunk: no magic bytes, another chunk type (a compressed chunk
+ * included), a length that does not cover them exactly, or a wrong checksum
+ * (whose name would be its intact copy's, finding C1).
  */
-export function refusedChangeHash(bytes, error) {
-    if (error instanceof MalformedChunkError)
-        return undefined;
+export function refusedChangeHash(bytes) {
     if (bytes.length < HEADER || MAGIC.some((b, i) => bytes[i] !== b))
         return undefined;
     if (bytes[8] !== CHUNK_CHANGE)
@@ -99,7 +101,16 @@ export function refusedChangeHash(bytes, error) {
     }
     if (pos + length !== bytes.length)
         return undefined;
-    return toHex(sha256(bytes.subarray(8)));
+    // §14.1 (baseline.7, finding C1): name the bytes only when their checksum
+    // matches. The name is the SHA-256 of the chunk from its type byte on, and
+    // the checksum (bytes 4 to 8) is the first four bytes of that same hash; a
+    // chunk with a wrong checksum would be named by its intact copy's hash, so
+    // it is left unnamed and the intact copy is checked as any change is.
+    const hash = sha256(bytes.subarray(8));
+    for (let i = 0; i < 4; i++)
+        if (bytes[4 + i] !== hash[i])
+            return undefined;
+    return toHex(hash);
 }
 /** The operations checkChange read from the bytes (§11.3), for the references of §11.4. */
 const PARSED = new WeakMap();

package/dist/admission/sequence.js

@@ -69,6 +69,14 @@ export function admitBatch(changes, doc, accept = () => undefined) {
             });
             continue;
         }
+        else if (c.beginsWithAuthor && c.seq !== 1) {
+            refused.push({
+                change: c,
+                error: new ProfileInvalidError("INVALID_AUTOMERGE_BYTES", `the change's extra bytes begin with an author but its sequence number is ${c.seq}, not 1 (§14.1)`),
+                held: false,
+            });
+            continue;
+        }
         else {
             const references = referenceRefusal(c, doc);
             if (references !== null) {
@@ -124,6 +132,12 @@ export function admitChange(change, doc) {
             kind: "invalid",
             error: new ProfileInvalidError("INVALID_AUTOMERGE_BYTES", `actor ${change.actor} sequence ${change.seq} skips sequence ${latest + 1} (§14.1)`),
         };
+    // §14.1: an author belongs only in an actor's first change (finding D5).
+    if (change.beginsWithAuthor && change.seq !== 1)
+        return {
+            kind: "invalid",
+            error: new ProfileInvalidError("INVALID_AUTOMERGE_BYTES", `the change's extra bytes begin with an author but its sequence number is ${change.seq}, not 1 (§14.1)`),
+        };
     // §11.4: checked only; the caller adds the change once the engine applied it.
     const references = referenceRefusal(change, doc);
     if (references !== null)

package/dist/concurrent.d.ts

@@ -0,0 +1,15 @@
+import * as A from "@automerge/automerge";
+type AMap = Record<string, unknown>;
+/**
+ * The distinct concurrent values of `map[key]` in `doc` (SOP §45,
+ * mvp-0.2-baseline.12): none when absent, one when it is not conflicted or
+ * when every concurrent value is equal. Two values are equal when they have
+ * the same Automerge scalar type and the same value (strings code point by
+ * code point); an object (a map, a list or Text) equals no other value. In
+ * Automerge's order of the concurrent values, the first of each equal group.
+ */
+export declare function distinctValues(doc: A.Doc<unknown>, map: AMap | undefined, key: string): unknown[];
+/** Whether `map[key]` has two or more distinct concurrent values (a conflict, SOP §45). */
+export declare function isConflicted(doc: A.Doc<unknown>, map: AMap, key: string): boolean;
+export {};
+//# sourceMappingURL=concurrent.d.ts.map

package/dist/concurrent.js

@@ -0,0 +1,55 @@
+import * as A from "@automerge/automerge";
+/** Automerge object types: an object value equals no other value (SOP §45). */
+const OBJECTS = new Set(["map", "list", "text", "table"]);
+/** A scalar's identity for equality: its Automerge type and its value. */
+function scalarKey(type, value) {
+    if (value instanceof Uint8Array)
+        return `${type}:${Array.from(value, (b) => b.toString(16).padStart(2, "0")).join("")}`;
+    if (value instanceof Date)
+        return `${type}:${value.getTime()}`;
+    if (typeof value === "bigint")
+        return `${type}:${value}`;
+    return `${type}:${JSON.stringify(value)}`;
+}
+/**
+ * The distinct concurrent values of `map[key]` in `doc` (SOP §45,
+ * mvp-0.2-baseline.12): none when absent, one when it is not conflicted or
+ * when every concurrent value is equal. Two values are equal when they have
+ * the same Automerge scalar type and the same value (strings code point by
+ * code point); an object (a map, a list or Text) equals no other value. In
+ * Automerge's order of the concurrent values, the first of each equal group.
+ */
+export function distinctValues(doc, map, key) {
+    if (map === undefined || !(key in map))
+        return [];
+    const conflicts = A.getConflicts(map, key);
+    if (conflicts === undefined)
+        return [map[key]];
+    const obj = A.getObjectId(map);
+    const all = obj === null ? [] : A.getBackend(doc).getAll(obj, key, A.getHeads(doc));
+    const typeOf = new Map();
+    for (const e of all) {
+        const type = e[0];
+        if (OBJECTS.has(type))
+            typeOf.set(e[1], { type, value: undefined });
+        else
+            typeOf.set(e[2], { type, value: e[1] });
+    }
+    const seen = new Set();
+    const out = [];
+    for (const [opId, value] of Object.entries(conflicts)) {
+        const t = typeOf.get(opId);
+        const k = t === undefined || OBJECTS.has(t.type) ? `object:${opId}` : scalarKey(t.type, t.value);
+        if (seen.has(k))
+            continue;
+        seen.add(k);
+        out.push(value);
+    }
+    return out;
+}
+/** Whether `map[key]` has two or more distinct concurrent values (a conflict, SOP §45). */
+export function isConflicted(doc, map, key) {
+    return (A.getConflicts(map, key) !== undefined &&
+        distinctValues(doc, map, key).length > 1);
+}
+//# sourceMappingURL=concurrent.js.map

package/dist/replica.js

@@ -4,6 +4,7 @@ import { checkChange, checkSaveHeader, parsedOf, unframeChange, unframeSnapshot,
 import { checkSnapshotExpansion, MAX_DOCUMENT_DEPTH, SNAPSHOT_LIMITS_FLOOR, } from "./admission/limits.js";
 import { referenceHistoryOf } from "./admission/references.js";
 import { admitBatch, admitChange } from "./admission/sequence.js";
+import { distinctValues, isConflicted } from "./concurrent.js";
 /** The decoded actions that create an object (§11.2). */
 const MAKE_ACTIONS = new Set(["makeMap", "makeList", "makeText", "makeTable"]);
 import { ProfileInvalidError } from "./profile-invalid.js";
@@ -153,17 +154,13 @@ function canonical(value) {
             .map((k) => [k, canonical(value[k])]));
     return value;
 }
-/** Every concurrent value of `map[key]`: none if absent, one if not conflicted. */
-function valuesOf(map, key) {
-    if (!(key in map))
-        return [];
-    const conflicts = A.getConflicts(map, key);
-    return conflicts === undefined ? [map[key]] : Object.values(conflicts);
-}
-/** Top-level fields of `object` with more than one concurrent value. */
-function conflictedFields(object) {
+/**
+ * Top-level fields of `object` in conflict: two or more distinct concurrent
+ * values (§45; concurrent equal values agree).
+ */
+function conflictedFields(doc, object) {
     return Object.keys(object)
-        .filter((f) => A.getConflicts(object, f) !== undefined)
+        .filter((f) => isConflicted(doc, object, f))
         .sort();
 }
 const problem = (diagnostic, pointer, message) => Object.freeze({ code: "PROFILE_INVALID", diagnostic, pointer, message });
@@ -236,7 +233,7 @@ export function taskView(doc, objects, id) {
     const problems = storedObjectProblems(doc, object, id);
     const parsed = parseTask(plain(object), id);
     const field = (f) => {
-        const values = valuesOf(object, f).map(plain).sort(byJson);
+        const values = distinctValues(doc, object, f).map(plain).sort(byJson);
         return Object.freeze({
             value: f in object ? plain(object[f]) : undefined,
             values: Object.freeze(values),
@@ -525,7 +522,7 @@ export class SharedObjectsReplica {
             this.#noteSeq(meta.actor, meta.seq);
         for (const [id, object] of Object.entries(this.#objects() ?? {}))
             if (isMap(object))
-                this.#conflicted.set(id, conflictedFields(object));
+                this.#conflicted.set(id, conflictedFields(doc, object));
     }
     /**
      * §11.2: the depths of the objects `change` creates (object ID → depth),
@@ -749,9 +746,9 @@ export class SharedObjectsReplica {
         for (const [id, object] of Object.entries(objects)) {
             if (!isMap(object))
                 continue;
-            for (const field of conflictedFields(object)) {
+            for (const field of conflictedFields(this.#doc, object)) {
                 out[id] ??= {};
-                out[id][field] = valuesOf(object, field)
+                out[id][field] = distinctValues(this.#doc, object, field)
                     .map(plain)
                     .sort(byJson);
             }
@@ -1008,7 +1005,7 @@ export class SharedObjectsReplica {
             if (set.size === 0)
                 for (const f of Object.keys(now))
                     set.add(f);
-            const nowConflicts = conflictedFields(now);
+            const nowConflicts = conflictedFields(this.#doc, now);
             const wasConflicts = this.#conflicted.get(id) ?? [];
             this.#conflicted.set(id, nowConflicts);
             out.push(Object.freeze({

package/dist/sections/replica.d.ts

@@ -361,12 +361,6 @@ export declare class SectionReplica {
      * never merged; the changes that depend on it wait.
      */
     receiveChanges(items: readonly (Uint8Array | SectionUnit)[]): SectionReceiveResult;
-    /**
-     * Everything an editor projects, in one synchronous read of one revision:
-     * the title (and its concurrent values), each node, the visible order,
-     * and the problems to show. `revision` is the modelRevision of a commit
-     * receipt and the `base` of text.edit.
-     */
     snapshot(): SectionSnapshot;
     /**
      * The Task of a task node (§4.2: stored under `/objects/<id>`, the node's

package/dist/sections/replica.js

@@ -4,6 +4,7 @@ import { checkChange, checkSaveHeader, parsedOf, refusedChangeHash, } from "../a
 import { checkChangeExpansion, checkSnapshotExpansion, SNAPSHOT_LIMITS_FLOOR, } from "../admission/limits.js";
 import { referenceHistoryOf } from "../admission/references.js";
 import { admitBatch } from "../admission/sequence.js";
+import { distinctValues } from "../concurrent.js";
 import { ProfileInvalidError } from "../profile-invalid.js";
 import { isWasmTrap, prepareTaskIntent, taskView, } from "../replica.js";
 import { frameProfilePayload, isUtcTimestamp, principalRef } from "../values.js";
@@ -99,6 +100,8 @@ const S = (s) => new A.ImmutableString(s);
 const str = (v) => A.isImmutableString(v) ? v.toString() : typeof v === "string" ? v : undefined;
 const isListStyle = (s) => typeof s === "string" && LIST_STYLES.includes(s);
 const revisionOf = (doc) => [...A.getHeads(doc)].sort().join(",");
+/** `changes` without those of `batch` (by hash), in their order. */
+const withoutBatch = (changes, batch) => changes.filter((c) => !batch.has(A.decodeChange(c).hash));
 /** Rebuilds a section document from the changes it held before an aborted apply. */
 function restoreSection(changes, actor, revision) {
     let restored;
@@ -138,12 +141,9 @@ function applyIsolating(doc, changes) {
     }
     return { doc: work, applied, poisoned };
 }
-/** Every concurrent value of `map[key]`. */
-function values(map, key) {
-    if (!(key in map))
-        return [];
-    const c = A.getConflicts(map, key);
-    return c === undefined ? [map[key]] : Object.values(c);
+/** The distinct concurrent values of `map[key]` in `doc` (SOP §45: equal values agree). */
+function values(doc, map, key) {
+    return distinctValues(doc, map, key);
 }
 /** PROFILE_INVALID for a Snapshot, with the diagnostic of what refused it. */
 function snapshotRefused(diagnostic, message) {
@@ -292,7 +292,7 @@ export class SectionReplica {
             }
             catch (e) {
                 // Never decoded: a change refused by the checks is named from its bytes only.
-                refused.push(refusal(index, refusedChangeHash(unit.bytes, e), e, false));
+                refused.push(refusal(index, refusedChangeHash(unit.bytes), e, false));
                 return;
             }
             if (unit.signer !== undefined &&
@@ -393,15 +393,36 @@ export class SectionReplica {
      * and the problems to show. `revision` is the modelRevision of a commit
      * receipt and the `base` of text.edit.
      */
+    /**
+     * The tree and snapshot derived from the document at one revision (its
+     * heads): both are frozen and depend on the document alone, so a read at
+     * the same revision returns them again. Any change to the document
+     * changes its heads, so every path that changes it (commit, apply,
+     * revert, receive, a rebuild) gives a new revision and a new derivation
+     * (soak #11: the status was derived again on every refresh).
+     */
+    #derived;
+    #derivedNow() {
+        const revision = revisionOf(this.#doc);
+        if (this.#derived?.revision !== revision)
+            this.#derived = { revision, tree: deriveTree(this.#doc) };
+        return this.#derived;
+    }
     snapshot() {
-        const tree = deriveTree(this.#doc);
+        const derived = this.#derivedNow();
+        if (derived.snapshot !== undefined)
+            return derived.snapshot;
+        derived.snapshot = this.#snapshotOf(derived.tree);
+        return derived.snapshot;
+    }
+    #snapshotOf(tree) {
         const root = this.#doc;
         const section = (root.section ?? {});
         const nodes = (root.nodes ?? {});
         const objects = (root.objects ?? {});
         const placements = (root.placements ?? {});
         const hidden = new Set(tree.hidden);
-        const titles = values(section, "title").map(str);
+        const titles = values(this.#doc, section, "title").map(str);
         const out = {};
         for (const id of Object.keys(nodes).sort()) {
             if (tree.collisions.includes(id))
@@ -456,7 +477,7 @@ export class SectionReplica {
     }
     /** §7, §9, §14.3: the effective tree, hidden nodes and structural facts. */
     tree() {
-        return deriveTree(this.#doc);
+        return this.#derivedNow().tree;
     }
     /** The document heads, sorted, as one string. */
     revision() {
@@ -519,6 +540,9 @@ export class SectionReplica {
         if (A.getActorId(this.#doc) !== this.#actor)
             throw new Error("the document actor is not the §2 actor");
         const affected = new Set();
+        // The validation's own document, freed on every exit (#7: an Automerge
+        // document left to the garbage collector holds its whole history in
+        // wasm memory until the collector happens to run).
         let scratch = A.clone(this.#doc);
         // The validation of the document before the batch: nodes the batch
         // creates are valid by construction, so it is computed again only when
@@ -533,106 +557,159 @@ export class SectionReplica {
         const chunks = [[]];
         const used = { text: 0, nodes: 0 };
         let i = -1;
-        for (const step of steps) {
-            if (step.intent !== "text.continue")
-                i = Math.min(i + 1, intents.length - 1);
-            const cost = { text: 0, nodes: 0 };
-            const write = this.#prepare(scratch, state, step, i, affected, cost);
-            if (cost.text > AUTHORING_BUDGET.textOperations || cost.nodes > AUTHORING_BUDGET.createdNodes)
-                throw new SectionIntentError("OVER_BUDGET", `one intent is over the §16.2 budgets (${cost.text} Text operations, ${cost.nodes} nodes)`, i);
-            const current = chunks[chunks.length - 1];
-            if (current.length > 0 &&
-                (used.text + cost.text > AUTHORING_BUDGET.textOperations ||
-                    used.nodes + cost.nodes > AUTHORING_BUDGET.createdNodes)) {
-                chunks.push([write]);
-                used.text = cost.text;
-                used.nodes = cost.nodes;
-            }
-            else {
-                current.push(write);
-                used.text += cost.text;
-                used.nodes += cost.nodes;
+        try {
+            for (const step of steps) {
+                if (step.intent !== "text.continue")
+                    i = Math.min(i + 1, intents.length - 1);
+                const cost = { text: 0, nodes: 0 };
+                const write = this.#prepare(scratch, state, step, i, affected, cost);
+                if (cost.text > AUTHORING_BUDGET.textOperations ||
+                    cost.nodes > AUTHORING_BUDGET.createdNodes)
+                    throw new SectionIntentError("OVER_BUDGET", `one intent is over the §16.2 budgets (${cost.text} Text operations, ${cost.nodes} nodes)`, i);
+                const current = chunks[chunks.length - 1];
+                if (current.length > 0 &&
+                    (used.text + cost.text > AUTHORING_BUDGET.textOperations ||
+                        used.nodes + cost.nodes > AUTHORING_BUDGET.createdNodes)) {
+                    chunks.push([write]);
+                    used.text = cost.text;
+                    used.nodes = cost.nodes;
+                }
+                else {
+                    current.push(write);
+                    used.text += cost.text;
+                    used.nodes += cost.nodes;
+                }
+                scratch = A.change(scratch, { time: 0 }, write);
+                if (step.intent === "section.create" || step.intent === "section.mark_ready")
+                    state.v = undefined;
+                // Only creations keep every verified ancestor chain as it was.
+                if (!KEEPS_CHAINS.has(step.intent))
+                    state.chainOk.clear();
             }
-            scratch = A.change(scratch, { time: 0 }, write);
-            if (step.intent === "section.create" || step.intent === "section.mark_ready")
-                state.v = undefined;
-            // Only creations keep every verified ancestor chain as it was.
-            if (!KEEPS_CHAINS.has(step.intent))
-                state.chainOk.clear();
+        }
+        finally {
+            A.free(scratch);
         }
         const message = intents.map((x) => x.intent).join(",");
         const before = A.getHeads(this.#doc);
-        // On a clone: A.change outdates the handle it is given, and this
-        // replica keeps its own until apply().
-        let next = A.clone(this.#doc, { actor: this.#actor });
-        const parts = [];
-        const partChanges = [];
-        for (const chunk of chunks) {
-            if (chunk.length === 0)
-                continue;
-            const heads = A.getHeads(next).join();
-            next = A.change(next, { message, time: 0 }, (d) => {
-                for (const w of chunk)
-                    w(d);
-            });
-            if (A.getHeads(next).join() === heads)
-                continue;
-            const bytes = A.getLastLocalChange(next);
-            let checked;
-            try {
-                checkChangeExpansion(bytes);
-                checked = checkChange(bytes);
-            }
-            catch (e) {
-                throw new SectionIntentError("OVER_BUDGET", `a change of the batch is larger than one change may be (SOP §11.1: ${e.message})`);
+        // The batch's changes are made on a fork with this replica's §2 actor;
+        // apply() gives #doc the same changes by applyChanges, so #doc keeps its
+        // one Automerge document. (Adopting the fork as #doc kept, through each
+        // object the new document shared with the old one, one old document
+        // alive per unchanged node: a section's memory grew with the number of
+        // Tasks times its history, #7.) The fork is freed on every exit.
+        let work = A.clone(this.#doc, { actor: this.#actor });
+        let handedOver = false;
+        try {
+            const parts = [];
+            const partChanges = [];
+            for (const chunk of chunks) {
+                if (chunk.length === 0)
+                    continue;
+                const heads = A.getHeads(work).join();
+                work = A.change(work, { message, time: 0 }, (d) => {
+                    for (const w of chunk)
+                        w(d);
+                });
+                if (A.getHeads(work).join() === heads)
+                    continue;
+                const bytes = A.getLastLocalChange(work);
+                let checked;
+                try {
+                    checkChangeExpansion(bytes);
+                    checked = checkChange(bytes);
+                }
+                catch (e) {
+                    throw new SectionIntentError("OVER_BUDGET", `a change of the batch is larger than one change may be (SOP §11.1: ${e.message})`);
+                }
+                partChanges.push(checked);
+                parts.push(Object.freeze({
+                    change: checked.bytes,
+                    plaintext: frameProfilePayload(checked.bytes),
+                    hash: checked.hash,
+                    seq: checked.seq,
+                }));
             }
-            partChanges.push(checked);
-            parts.push(Object.freeze({
-                change: checked.bytes,
-                plaintext: frameProfilePayload(checked.bytes),
-                hash: checked.hash,
-                seq: checked.seq,
-            }));
-        }
-        if (parts.length === 0 || A.getHeads(next).join() === before.join())
-            return null;
-        const last = parts[parts.length - 1];
-        const change = Object.freeze({
-            intents: Object.freeze(intents.map((x) => x.intent)),
-            parts: Object.freeze(parts),
-            ...last,
-            affectedNodeIds: Object.freeze([...affected].sort()),
-            modelRevision: revisionOf(next),
-        });
-        const base = revisionOf(this.#doc);
-        const prior = this.#doc;
-        const priorSeqs = this.#seqs === undefined ? undefined : new Map(this.#seqs);
-        let applied = false;
-        return Object.freeze({
-            change,
-            apply: () => {
-                if (applied)
-                    return;
-                if (revisionOf(this.#doc) !== base)
-                    throw new Error("the replica changed since the batch was staged; stage it again");
-                this.#doc = next;
-                if (this.#seqs !== undefined && last.seq > (this.#seqs.get(this.#actor) ?? 0))
-                    this.#seqs.set(this.#actor, last.seq);
-                for (const c of partChanges)
-                    this.#refs?.add(c.hash, parsedOf(c));
-                applied = true;
-            },
-            revert: () => {
-                if (!applied)
+            if (parts.length === 0 || A.getHeads(work).join() === before.join())
+                return null;
+            const last = parts[parts.length - 1];
+            const change = Object.freeze({
+                intents: Object.freeze(intents.map((x) => x.intent)),
+                parts: Object.freeze(parts),
+                ...last,
+                affectedNodeIds: Object.freeze([...affected].sort()),
+                modelRevision: revisionOf(work),
+            });
+            const base = revisionOf(this.#doc);
+            const batch = new Set(partChanges.map((c) => c.hash));
+            const priorSeqs = this.#seqs === undefined ? undefined : new Map(this.#seqs);
+            const fork = work;
+            let forkFreed = false;
+            const freeFork = () => {
+                if (forkFreed)
                     return;
-                if (this.#doc !== next)
-                    throw new Error("the replica changed after the batch was applied; it cannot be reverted");
-                this.#doc = prior;
-                this.#seqs = priorSeqs === undefined ? undefined : new Map(priorSeqs);
-                this.#refs = null;
-                applied = false;
-            },
-        });
+                forkFreed = true;
+                A.free(fork);
+            };
+            let applied = false;
+            handedOver = true;
+            return Object.freeze({
+                change,
+                apply: () => {
+                    if (applied)
+                        return;
+                    if (forkFreed)
+                        throw new Error("the batch could not be applied before; stage it again");
+                    if (revisionOf(this.#doc) !== base)
+                        throw new Error("the replica changed since the batch was staged; stage it again");
+                    try {
+                        try {
+                            this.#doc = A.applyChanges(this.#doc, partChanges.map((c) => c.bytes))[0];
+                            if (revisionOf(this.#doc) !== change.modelRevision)
+                                throw new Error("the batch did not apply as it was staged");
+                        }
+                        catch (e) {
+                            if (isWasmTrap(e))
+                                throw e;
+                            // The document is not trusted after a failed apply: rebuilt from
+                            // the changes the fork held before the batch, never from it.
+                            this.#doc = this.#rebuilt(withoutBatch(A.getAllChanges(fork), batch), base);
+                            throw e;
+                        }
+                    }
+                    finally {
+                        freeFork();
+                    }
+                    if (this.#seqs !== undefined && last.seq > (this.#seqs.get(this.#actor) ?? 0))
+                        this.#seqs.set(this.#actor, last.seq);
+                    for (const c of partChanges)
+                        this.#refs?.add(c.hash, parsedOf(c));
+                    applied = true;
+                },
+                revert: () => {
+                    if (!applied)
+                        return;
+                    if (revisionOf(this.#doc) !== change.modelRevision)
+                        throw new Error("the replica changed after the batch was applied; it cannot be reverted");
+                    // The document as it was before the batch: its changes without the batch's.
+                    this.#doc = this.#rebuilt(withoutBatch(A.getAllChanges(this.#doc), batch), base);
+                    this.#seqs = priorSeqs === undefined ? undefined : new Map(priorSeqs);
+                    this.#refs = null;
+                    applied = false;
+                },
+            });
+        }
+        finally {
+            if (!handedOver)
+                A.free(work);
+        }
+    }
+    /** A document of exactly `changes`, with this replica's §2 actor, at `revision` (checked). */
+    #rebuilt(changes, revision) {
+        const doc = restoreSection(changes, this.#actor, revision);
+        if (A.getActorId(doc) !== this.#actor)
+            throw new Error("the section replica could not be restored: another actor");
+        return doc;
     }
     /**
      * Checks one intent against `doc`, the document with the batch so far,
@@ -844,7 +921,8 @@ export class SectionReplica {
                     refuse("NODE_IN_CONFLICT", `${second} is invalid or collides (§14.2)`, second);
                 const otherKind = str(other.kind);
                 const sameStyle = kind === "paragraph" ||
-                    values(node, "list_style").join() === values(other, "list_style").join();
+                    values(doc, node, "list_style").join() ===
+                        values(doc, other, "list_style").join();
                 if (otherKind !== kind || (kind !== "paragraph" && kind !== "item") || !sameStyle)
                     refuse("INVALID_INTENT", "only two paragraphs, or two items of one list style, join (§10)", id);
                 const kids = (n) => (n.children ?? []).length;
@@ -871,8 +949,8 @@ export class SectionReplica {
             // split: a deletion of the suffix and a new node after this one.
             if (intent.intent.slice(0, intent.intent.indexOf(".")) !== kind)
                 refuse("INVALID_INTENT", `${intent.intent} on a ${kind} node (§10)`, id);
-            if (values(node, "placement").length !== 1 ||
-                new Set(values(node, "lifecycle")).size !== 1)
+            if (values(doc, node, "placement").length !== 1 ||
+                new Set(values(doc, node, "lifecycle")).size !== 1)
                 refuse("NODE_IN_CONFLICT", `${id} has unresolved structure (§10)`, id);
             const cut = rebase(doc, path, intent.base, [{ index: intent.at, deleteCount: 0, insert: "" }], refuse, id)[0];
             const suffix = current.slice(cut.from);
@@ -939,7 +1017,7 @@ export class SectionReplica {
                     n.list_style = S(style);
                 };
             }
-            if (intent.intent === "node.move" && values(node, "placement").length !== 1)
+            if (intent.intent === "node.move" && values(doc, node, "placement").length !== 1)
                 refuse("NODE_IN_CONFLICT", `${id} has concurrent placements: use node.resolve_placement (§7, §8)`, id);
             const placementId = intent.placementId ?? generateObjectId();
             if (!isObjectId(placementId))
@@ -1086,12 +1164,12 @@ chainOk) {
             return { why: "is invalid (§14.2)" };
         const kind = str(node.kind);
         const owner = kind === "task" ? objects[id] : node;
-        const life = values(owner, "lifecycle").map(str);
+        const life = values(doc, owner, "lifecycle").map(str);
         if (life.length !== 1)
             return { why: "has a lifecycle conflict (§9)" };
         if (life[0] !== "active")
             return { why: "is deleted (§9)" };
-        const selected = values(node, "placement").map(str);
+        const selected = values(doc, node, "placement").map(str);
         if (selected.length !== 1)
             return { why: "has a placement conflict (§7)" };
         const placement = placements[selected[0]];
@@ -1131,7 +1209,7 @@ chainOk) {
     const e = eligible(after);
     if ("why" in e || e.parent !== parent)
         refuse("INVALID_PREDECESSOR", `${after} is not a visible child of ${parent} (§6)`, after);
-    const slot = str(values(nodes[after], "placement")[0]);
+    const slot = str(values(doc, nodes[after], "placement")[0]);
     const at = lane.findIndex((x) => str(x) === slot);
     if (at < 0)
         refuse("INVALID_PREDECESSOR", `${after}'s placement is not in the parent's list (§4.3)`, after);

package/dist/sections/tree.js

@@ -1,14 +1,12 @@
 import * as A from "@automerge/automerge";
+import { distinctValues } from "../concurrent.js";
 import { validateSection } from "./schema.js";
 /** The Task scalar fields whose concurrent values tree() reports. */
 const CONFLICT_FIELDS = ["title", "status", "lifecycle", "due", "priority"];
 const str = (v) => A.isImmutableString(v) ? v.toString() : typeof v === "string" ? v : undefined;
-/** Every concurrent value of `map[key]`, as strings. */
-function values(map, key) {
-    if (map === undefined || !(key in map))
-        return [];
-    const c = A.getConflicts(map, key);
-    return (c === undefined ? [map[key]] : Object.values(c)).map(str);
+/** The distinct concurrent values of `map[key]` in `doc`, as strings (SOP §45: equal values agree). */
+function values(doc, map, key) {
+    return distinctValues(doc, map, key).map(str);
 }
 const byId = (a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0;
 /** §7: the effective tree and structural facts of `doc`. Reads only. */
@@ -32,13 +30,13 @@ export function deriveTree(doc, validation = validateSection(doc)) {
         // §7.6: a lifecycle conflict has no winner. It blocks the branch (below)
         // instead of the provisional value hiding it: the node is not deleted,
         // and edits under it are not under a deleted ancestor.
-        const lifecycles = new Set(values(owner(id), "lifecycle"));
+        const lifecycles = new Set(values(doc, owner(id), "lifecycle"));
         if (lifecycles.size === 1 && lifecycles.has("deleted"))
             deleted.add(id);
         if (collided.has(id))
             continue;
         const n = node(id);
-        const selected = values(n, "placement");
+        const selected = values(doc, n, "placement");
         const parentOf = (p) => p === undefined ? undefined : str(placements[p]?.parent_id);
         // The default value selects the parent used for hiding and for the walk below.
         const parent = parentOf(str(n.placement));
@@ -177,21 +175,57 @@ export function deriveTree(doc, validation = validateSection(doc)) {
         collisions: validation.collisions,
         retainedConcurrentEdits: Object.freeze(retained),
         scalarConflicts: Object.freeze(Object.keys(objects).flatMap((id) => CONFLICT_FIELDS.flatMap((field) => {
-            const vs = values(objects[id], field);
+            const vs = values(doc, objects[id], field);
             return vs.length > 1 ? [{ id, field, values: vs.map((v) => v ?? "").sort() }] : [];
         }))),
         candidates,
         validation,
     });
 }
+const summarise = (bytes) => {
+    const c = A.decodeChange(bytes);
+    return {
+        hash: c.hash,
+        deps: c.deps,
+        actor: c.actor,
+        seq: c.seq,
+        ops: c.ops.map((op) => {
+            const o = op;
+            return { obj: o.obj, action: o.action, key: o.key, value: o.value };
+        }),
+    };
+};
 /**
- * §9: the hidden nodes with content changes concurrent with a deletion of
- * the node or of an ancestor, from the change history. A change deletes
- * when the last lifecycle value it writes to an owner (a Task node's Task,
- * another node itself) is "deleted"; content is a node's creation, an
- * operation on its Text, or a Task's title or status. Two changes are
- * concurrent when neither is in the other's dependencies.
+ * The decoded history of the documents read last, by their heads (a few,
+ * least recently used last out). A change is the same wherever it is, so a
+ * later revision of the same document decodes only the changes since a
+ * revision read before, whose heads it has: decoding the whole history on
+ * every new revision was linear in it, per pass (soak #11).
  */
+const histories = new Map();
+const HISTORIES = 16;
+function historyOf(doc) {
+    const key = [...A.getHeads(doc)].sort().join(",");
+    const known = histories.get(key);
+    if (known !== undefined) {
+        histories.delete(key);
+        histories.set(key, known);
+        return known;
+    }
+    let out;
+    for (const [k, list] of [...histories].reverse()) {
+        const heads = k === "" ? [] : k.split(",");
+        if (A.getMissingDeps(doc, heads).length > 0)
+            continue;
+        out = [...list, ...A.getChangesSince(doc, heads).map(summarise)];
+        break;
+    }
+    out ??= A.getAllChanges(doc).map(summarise);
+    histories.set(key, out);
+    while (histories.size > HISTORIES)
+        histories.delete(histories.keys().next().value);
+    return out;
+}
 function retainedEdits(doc, hidden, parentOf, sectionId) {
     const root = doc;
     const nodes = (root.nodes ?? {});
@@ -201,8 +235,13 @@ function retainedEdits(doc, hidden, parentOf, sectionId) {
     const textOf = new Map();
     const ownerOf = new Map();
     const taskOf = new Map();
+    // The object ID of each node's own map, for a move written to its `placement`.
+    const nodeMapOf = new Map();
     for (const id of Object.keys(nodes)) {
         const n = nodes[id];
+        const nodeMap = A.getObjectId(n);
+        if (nodeMap !== null)
+            nodeMapOf.set(nodeMap, id);
         const text = A.getObjectId(n, "text");
         if (text !== null)
             textOf.set(text, id);
@@ -218,11 +257,15 @@ function retainedEdits(doc, hidden, parentOf, sectionId) {
         }
     }
     const deps = new Map();
+    // Each change's actor and sequence number, for its vector clock below.
+    const author = new Map();
     const deletes = [];
+    // Every lifecycle write (any value), to tell whether a deletion is still held.
+    const lifecycleWrites = [];
     const edits = [];
-    for (const bytes of A.getAllChanges(doc)) {
-        const change = A.decodeChange(bytes);
+    for (const change of historyOf(doc)) {
         deps.set(change.hash, change.deps);
+        author.set(change.hash, { actor: change.actor, seq: change.seq });
         const lastLifecycle = new Map();
         const touched = new Set();
         for (const op of change.ops) {
@@ -236,19 +279,71 @@ function retainedEdits(doc, hidden, parentOf, sectionId) {
             const task = taskOf.get(op.obj);
             if (task !== undefined && hidden.has(task) && (key === "title" || key === "status"))
                 touched.add(task);
+            // §8, §9: a move writes the node's `placement` register (node.move or
+            // node.resolve_placement). A creation also writes it and is already
+            // counted above; what this adds is a move of an existing node.
+            const moved = nodeMapOf.get(op.obj);
+            if (moved !== undefined && key === "placement" && hidden.has(moved))
+                touched.add(moved);
             const owner = ownerOf.get(op.obj);
             if (owner !== undefined && key === "lifecycle")
                 lastLifecycle.set(owner, value);
         }
-        for (const [owner, value] of lastLifecycle)
+        for (const [owner, value] of lastLifecycle) {
+            lifecycleWrites.push({ hash: change.hash, node: owner });
             if (value === "deleted")
                 deletes.push({ hash: change.hash, node: owner });
+        }
         for (const node of touched)
             edits.push({ hash: change.hash, node });
     }
     if (deletes.length === 0 || edits.length === 0)
         return [];
-    /** Every change `hash` depends on, transitively, memoized. */
+    /**
+     * Each change's vector clock: the highest sequence number of every actor
+     * in its causal history, itself included. When each change of an actor
+     * has that actor's previous change in its history (as Automerge writes
+     * them), `a` is in the history of `b` exactly when b's clock has a's actor
+     * at a's sequence or later: O(history × actors), where a set of ancestors
+     * per change was O(history²) (soak #11: seconds per pass after ~3,000
+     * changes in a section with deleted Tasks). A history where that does not
+     * hold (a change made without its actor's previous one), or one with more
+     * than 32 actors, falls back to the exact sets.
+     */
+    const clocks = new Map();
+    // A clock holds an entry per actor: with many actors (a hostile or unusual
+    // history), the exact sets are cheaper.
+    let regular = new Set([...author.values()].map((x) => x.actor)).size <= 32;
+    for (const start of regular ? deps.keys() : []) {
+        const stack = [start];
+        while (stack.length > 0) {
+            const h = stack[stack.length - 1];
+            if (clocks.has(h)) {
+                stack.pop();
+                continue;
+            }
+            const pending = (deps.get(h) ?? []).filter((d) => deps.has(d) && !clocks.has(d));
+            if (pending.length > 0) {
+                stack.push(...pending);
+                continue;
+            }
+            stack.pop();
+            const clock = new Map();
+            for (const d of deps.get(h) ?? [])
+                for (const [actor, seq] of clocks.get(d) ?? [])
+                    if (seq > (clock.get(actor) ?? 0))
+                        clock.set(actor, seq);
+            const me = author.get(h);
+            if (me !== undefined) {
+                if ((clock.get(me.actor) ?? 0) !== me.seq - 1)
+                    regular = false;
+                if (me.seq > (clock.get(me.actor) ?? 0))
+                    clock.set(me.actor, me.seq);
+            }
+            clocks.set(h, clock);
+        }
+    }
+    /** Every change `hash` depends on, transitively, memoized (the exact fallback). */
     const ancestry = new Map();
     const ancestorsOf = (hash) => {
         const known = ancestry.get(hash);
@@ -268,9 +363,25 @@ function retainedEdits(doc, hidden, parentOf, sectionId) {
         ancestry.set(hash, out);
         return out;
     };
-    const concurrent = (a, b) => a !== b && !ancestorsOf(a).has(b) && !ancestorsOf(b).has(a);
+    /** Whether change `a` is in the causal history of change `b` (a ≠ b). */
+    const before = (a, b) => {
+        if (a === b)
+            return false;
+        if (!regular)
+            return ancestorsOf(b).has(a);
+        const me = author.get(a);
+        return me !== undefined && (clocks.get(b)?.get(me.actor) ?? 0) >= me.seq;
+    };
+    const concurrent = (a, b) => a !== b && !before(a, b) && !before(b, a);
+    // §9 (baseline.9): a deletion counts only while the lifecycle register still
+    // holds it. A later write to the same register — one that has the deletion in
+    // its dependencies — supersedes it, so deleting a node again clears the
+    // attention a concurrent edit raised. Two concurrent deletions supersede
+    // neither, so both still count (SS86); the writes come from each change's
+    // operations, which also keeps a deletion merged after a concurrent one.
+    const heldDeletes = deletes.filter((d) => !lifecycleWrites.some((w) => w.node === d.node && w.hash !== d.hash && before(d.hash, w.hash)));
     const deletesOf = new Map();
-    for (const d of deletes)
+    for (const d of heldDeletes)
         deletesOf.set(d.node, [...(deletesOf.get(d.node) ?? []), d.hash]);
     const attention = new Set();
     for (const edit of edits) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openlfcp/shared-objects",
-  "version": "0.2.0-beta.1",
+  "version": "0.2.0-beta.10",
   "description": "SHARED-OBJECTS-PROFILE-01 (org.openlfcp.shared-objects.v1) implementation.",
   "keywords": [
     "openlfcp",
@@ -53,8 +53,8 @@
   "dependencies": {
     "@automerge/automerge": "3.5.0",
     "fflate": "0.8.3",
-    "@openlfcp/core": "^0.2.0-beta.1",
-    "@openlfcp/crypto": "^0.2.0-beta.1"
+    "@openlfcp/crypto": "^0.2.0-beta.10",
+    "@openlfcp/core": "^0.2.0-beta.10"
   },
   "devDependencies": {
     "fast-check": "4.10.2"