@panphora/clayjs 1.16.0 → 1.18.0

package/src/page/ybind/moves.js

@@ -4,6 +4,7 @@ import { state as pmState } from "../../vendor/prosemirror.vendor.js";
 import { walk } from "./walk.js";
 import { docOf } from "./doc.js";
 import { createProjectionMap } from "./projection-map.js";
+import { beforeFence } from "./writer.js";
 import { unitIds } from "./origins.js";
 import { attrKey, copyActiveKey, parseGoneIntents, physicalKeyOf, recoveredRoot, removeKey, restoreKey } from "./recovery.js";
 
@@ -113,12 +114,12 @@ const liveRemovals = (pd, current, selected) => {
   return out;
 };
 
-export function moveBlocks({ pd, view, um, origins, render }, args = {}) {
+export function moveBlocks({ pd, view, um, origins, render, walked = null }, args = {}) {
   const ids = Array.isArray(args?.ids) ? [...new Set(args.ids)] : [];
   const afterId = args?.afterId === undefined ? null : args.afterId;
   const hasParent = args?.parent !== undefined;
 
-  const current = walk(pd, origins);
+  const current = walked ?? walk(pd, origins);
   // An opaque block is an operation this runtime must refuse before writing: it
   // has no turn-into, it cannot be carried, and its record is never rewritten.
   const protectedIds = new Set(current.visible.filter((seg) => seg.opaque).map((seg) => seg.id));
@@ -264,7 +265,7 @@ export function moveBlocks({ pd, view, um, origins, render }, args = {}) {
       let text = null, textAttrs = null;
       const flush = () => {
         if (text === null) return;
-        pd.flow.insert(cursor, text, textAttrs ?? undefined);
+        beforeFence(pd, cursor, after.fences, () => pd.flow.insert(cursor, text, textAttrs ?? undefined));
         cursor += text.length;
         text = null;
       };
@@ -275,7 +276,7 @@ export function moveBlocks({ pd, view, um, origins, render }, args = {}) {
           text += unit.ch;
         } else {
           flush();
-          pd.flow.insertEmbed(cursor, unit.embed, unit.attrs);
+          beforeFence(pd, cursor, after.fences, () => pd.flow.insertEmbed(cursor, unit.embed, unit.attrs));
           cursor += 1;
         }
       }

package/src/page/ybind/origins.js

@@ -34,6 +34,15 @@ const boundaryRecord = (value) => {
 
 const sameBoundary = (a, b) => a.blockId === b.blockId && a.kind === b.kind && a.recoveryOf === b.recoveryOf;
 
+// The keys walkFlow reads boundary and alias positions from: any key that parses to
+// ["boundary" | "alias", client, clock], whatever its value.
+const markerKey = (key) => {
+  let parts;
+  try { parts = JSON.parse(key); } catch { return null; }
+  if (!Array.isArray(parts) || parts.length !== 3 || (parts[0] !== "boundary" && parts[0] !== "alias")) return null;
+  return isClock(parts[1]) && isClock(parts[2]) ? parts : null;
+};
+
 const recordKey = (key) => {
   if (typeof key !== "string" || key.charCodeAt(0) !== 91) return null;
   let parts;
@@ -46,6 +55,7 @@ const recordKey = (key) => {
 export function createOriginIndex(origins) {
   const spans = new Map();
   const aliases = new Map();
+  const aliasClocks = new Map();
   const boundaries = new Map();
 
   const lower = (list, clock) => {
@@ -53,13 +63,56 @@ export function createOriginIndex(origins) {
     while (lo < hi) { const mid = (lo + hi) >> 1; if (list[mid].clock < clock) lo = mid + 1; else hi = mid; }
     return lo;
   };
+  const lowerClock = (list, clock) => {
+    let lo = 0, hi = list.length;
+    while (lo < hi) { const mid = (lo + hi) >> 1; if (list[mid] < clock) lo = mid + 1; else hi = mid; }
+    return lo;
+  };
+  const markAlias = (client, clock, present) => {
+    const list = aliasClocks.get(client) ?? [];
+    const at = lowerClock(list, clock);
+    const there = list[at] === clock;
+    if (present && !there) list.splice(at, 0, clock);
+    else if (!present && there) list.splice(at, 1);
+    if (list.length) aliasClocks.set(client, list);
+    else aliasClocks.delete(client);
+  };
+  // Boundary and alias keys in the map's key order (Yjs keeps a key where it was first
+  // written), and each client's clocks that have one, sorted, for walkFlow.
+  const markerRecords = [];
+  const markerEntries = new Map();
+  const markerCounts = new Map();
+  const markerClocks = new Map();
+  const trackMarker = (key, live) => {
+    let entry = markerEntries.get(key);
+    if (entry === undefined) {
+      const parts = markerKey(key);
+      entry = parts ? { kind: parts[0], client: parts[1], clock: parts[2], live: false } : null;
+      markerEntries.set(key, entry);
+      if (entry) markerRecords.push(entry);
+    }
+    if (!entry || entry.live === live) return;
+    entry.live = live;
+    const counts = markerCounts.get(entry.client) ?? markerCounts.set(entry.client, new Map()).get(entry.client);
+    const list = markerClocks.get(entry.client) ?? markerClocks.set(entry.client, []).get(entry.client);
+    const n = (counts.get(entry.clock) ?? 0) + (live ? 1 : -1);
+    if (n) counts.set(entry.clock, n);
+    else counts.delete(entry.clock);
+    const at = lowerClock(list, entry.clock);
+    if (live && n === 1) list.splice(at, 0, entry.clock);
+    else if (!live && n === 0) list.splice(at, 1);
+    if (!list.length) { markerClocks.delete(entry.client); markerCounts.delete(entry.client); }
+  };
   const apply = (key, value) => {
+    trackMarker(key, value !== undefined);
     const parts = recordKey(key);
     if (!parts) return;
     const [kind, client, clock] = parts;
     if (kind === "alias") {
-      if (value && isClock(value.sourceClient) && isClock(value.sourceClock)) aliases.set(idKey(client, clock), { client: value.sourceClient, clock: value.sourceClock });
+      const valid = Boolean(value && isClock(value.sourceClient) && isClock(value.sourceClock));
+      if (valid) aliases.set(idKey(client, clock), { client: value.sourceClient, clock: value.sourceClock });
       else aliases.delete(idKey(client, clock));
+      markAlias(client, clock, valid);
       return;
     }
     if (kind === "boundary") {
@@ -77,12 +130,17 @@ export function createOriginIndex(origins) {
     if (list.length) spans.set(client, list);
     else spans.delete(client);
   };
-  for (const [key, value] of origins) apply(key, value);
+  for (const key of origins._map.keys()) apply(key, origins.get(key));
   const observer = (event) => { for (const key of event.keysChanged) apply(key, origins.get(key)); };
   origins.observe(observer);
 
+  const hasAlias = (client, clock) => {
+    const list = aliasClocks.get(client);
+    return list !== undefined && list[lowerClock(list, clock)] === clock;
+  };
+
   const resolve = (id) => {
-    const alias = aliases.get(idKey(id.client, id.clock));
+    const alias = hasAlias(id.client, id.clock) ? aliases.get(idKey(id.client, id.clock)) : undefined;
     if (alias) return { client: alias.client, clock: alias.clock };
     const list = spans.get(id.client);
     if (!list) return { client: id.client, clock: id.clock };
@@ -95,8 +153,45 @@ export function createOriginIndex(origins) {
     return { client: record.sourceClient, clock: record.sourceClock + offset };
   };
 
+  const resolveRange = (client, clock, length) => {
+    const out = [];
+    const push = (sourceClient, sourceClock, size) => {
+      const last = out[out.length - 1];
+      if (last && last.client === sourceClient && last.clock + last.length === sourceClock) last.length += size;
+      else out.push({ client: sourceClient, clock: sourceClock, length: size });
+    };
+    const list = spans.get(client) ?? [];
+    const marks = aliasClocks.get(client) ?? [];
+    const end = clock + length;
+    let s = lower(list, clock + 1) - 1, a = lowerClock(marks, clock), at = clock;
+    while (at < end) {
+      if (a < marks.length && marks[a] === at) {
+        const target = aliases.get(idKey(client, at));
+        push(target.client, target.clock, 1);
+        at += 1;
+        a += 1;
+      } else {
+        let stop = end;
+        if (a < marks.length && marks[a] < stop) stop = marks[a];
+        if (s + 1 < list.length && list[s + 1].clock < stop) stop = list[s + 1].clock;
+        const span = s >= 0 ? list[s] : null;
+        if (span && at < span.clock + span.length) {
+          stop = Math.min(stop, span.clock + span.length);
+          push(span.sourceClient, span.sourceClock + at - span.clock, stop - at);
+        } else push(client, at, stop - at);
+        at = stop;
+      }
+      while (s + 1 < list.length && list[s + 1].clock <= at) s += 1;
+    }
+    return out;
+  };
+
   const boundaryOf = (id) => {
     if (!id || !isClock(id.client) || !isClock(id.clock)) return null;
+    if (!hasAlias(id.client, id.clock)) {
+      const record = boundaries.get(idKey(id.client, id.clock));
+      return record ? { ...record } : null;
+    }
     let key = idKey(id.client, id.clock);
     const seen = new Set();
     while (!seen.has(key)) {
@@ -164,8 +259,15 @@ export function createOriginIndex(origins) {
     if (!previous || !sameBoundary(previous, record)) throw conflicting(key);
   };
 
+  // null while a transaction that wrote origin records has not settled: the observer has
+  // not seen those keys yet, and walkFlow then reads the map's keys itself.
+  const markers = () => {
+    for (const t of origins.doc?._transactionCleanups ?? []) if (t.changed.has(origins)) return null;
+    return { records: markerRecords, clocks: markerClocks };
+  };
+
   return {
-    origins, resolve, recordSpans, recordAlias, recordBoundary, boundaryOf,
+    origins, resolve, resolveRange, recordSpans, recordAlias, recordBoundary, boundaryOf, markers,
     get size() { return origins.size; },
     dispose() { origins.unobserve(observer); },
   };

package/src/page/ybind/parts.js

@@ -1,5 +1,12 @@
 export const PART_KEY = /^(.+)\.(\d+)\.(\d+)$/;
-export const BASE64 = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}(?:==)?|[A-Za-z0-9+/]{3}=?)?$/;
+// A regexp group per quad keeps backtrack state per quad and overflows on a page of a few MB.
+const NOT_BASE64 = /[^A-Za-z0-9+/]/;
+export function isBase64(text) {
+  const pad = text.endsWith("==") ? 2 : text.endsWith("=") ? 1 : 0;
+  const body = text.length - pad;
+  if (NOT_BASE64.test(pad ? text.slice(0, body) : text)) return false;
+  return pad ? body % 4 + pad === 4 : body % 4 !== 1;
+}
 const PART_CHARS = /^[A-Za-z0-9+/=\t\n\f\r ]*$/;
 
 export function entriesOf(y) {

package/src/page/ybind/provider.js

@@ -2,8 +2,9 @@ import * as Y from "../../vendor/yjs.vendor.js";
 import { toBase64, fromBase64 } from "../../vendor/yjs.vendor.js";
 import { NET } from "./layout.js";
 import { ORIGINS_ORIGIN } from "./origins.js";
-import { PART_KEY, BASE64, entriesOf, captureYValue } from "./parts.js";
+import { PART_KEY, isBase64, entriesOf, captureYValue } from "./parts.js";
 import { containsUpdate } from "./recovery-proof.js";
+import { rangesOf, unite, within, docRanges } from "./containment.js";
 
 export { entriesOf } from "./parts.js";
 
@@ -11,6 +12,10 @@ export const enc = (u) => toBase64(u);
 export const dec = (s) => fromBase64(s);
 
 export const PART = 12 * 1024;
+
+// The origin a replayed journal is applied through. It is offered to the room like any
+// other local work and is never journaled again: a recovery is not this tab's typing.
+export const RECOVERY_ORIGIN = "page-recovery";
 const baseOf = (k) => PART_KEY.exec(k)?.[1] ?? k;
 
 export function yValueOf(ydoc) {
@@ -59,7 +64,7 @@ export function docFromValue(value, { strict = false } = {}) {
   try {
     for (const [key, value] of entries) {
       const text = strict ? value.replace(/[\t\n\f\r ]/g, "") : value;
-      if (strict && !BASE64.test(text)) throw new YDecodeError("invalid-update", `Invalid base64 in Yjs update: ${key}`);
+      if (strict && !isBase64(text)) throw new YDecodeError("invalid-update", `Invalid base64 in Yjs update: ${key}`);
       Y.applyUpdateV2(d, dec(text), NET);
     }
     if (strict && (d.store.pendingStructs || d.store.pendingDs)) {
@@ -80,7 +85,7 @@ const utf8Bytes = (text) => (encoder ? encoder.encode(text).length : text.length
 const sameDeletes = (a, b) => Y.equalDeleteSets(Y.createDeleteSetFromStructStore(a.store), Y.createDeleteSetFromStructStore(b.store));
 const svEqual = (a, b) => { if (a.size !== b.size) return false; for (const [c, n] of a) if (b.get(c) !== n) return false; return true; };
 
-export function createYProvider({ store, ydoc, compact: limits = {}, setTimer = setTimeout, clearTimer = clearTimeout, onStopped = () => {}, stats = { applied: 0, offered: 0, compactions: 0 } }) {
+export function createYProvider({ store, ydoc, compact: limits = {}, setTimer = setTimeout, clearTimer = clearTimeout, onStopped = () => {}, stats = { applied: 0, offered: 0, compactions: 0 }, journal = null, onLocalUpdate = () => {} }) {
   const initial = entriesOf(store.value.y);
   const known = new Set();
   // Set when this tab's page can no longer reach the room: "lineage" when the room holds
@@ -95,8 +100,14 @@ export function createYProvider({ store, ydoc, compact: limits = {}, setTimer =
   let canCompact = !initial.some(([k]) => k[0] === "m");
   let counter = 0;
   const me = ydoc.clientID.toString(36);
-  const nextKey = (p) => `${p}${me}-${(counter++).toString(36)}`;
+  const inst = Math.floor(Math.random() * 36 ** 6).toString(36);
+  let mode = store.room?.compaction?.v === 1 ? "host" : "legacy";
+  const nextKey = (p) => (mode === "host" ? `${p}${me}-${inst}-${(counter++).toString(36)}` : `${p}${me}-${(counter++).toString(36)}`);
   let timer = null;
+  let outbox = [];
+  // A refusal took back writes of this tab's that later updates build on: until a reconcile
+  // puts them back, nothing newer goes out.
+  let refusedGap = false;
   const generation = store.value.g;
   // Keys this tab wrote itself: the updates and offers the room has not confirmed yet.
   const own = new Set();
@@ -113,12 +124,50 @@ export function createYProvider({ store, ydoc, compact: limits = {}, setTimer =
     const parts = partsOf(key, enc(bytes));
     store.handle.update((data) => { for (const [k, v] of parts) data.y[k] = v; });
   };
+  const putWhole = (key, bytes) => {
+    known.add(key);
+    own.add(key);
+    const text = enc(bytes);
+    store.handle.update((data) => { data.y[key] = text; });
+  };
+  const isOwnYOp = (op) => {
+    const path = op.path;
+    if (!Array.isArray(path) || path.length !== 2 || path[0] !== "y") return true;
+    return own.has(path[1]);
+  };
+  const mineInFlight = () => store.pending.some((op) => isOwnYOp(op));
+  // Host mode orders this tab's writes only while the store is in the room: at save
+  // speed nothing confirms a write until the save lands, so updates go out at once.
+  const hosted = () => mode === "host" && store.handle.status?.mode !== "file";
+  const flushOutbox = () => {
+    if (!outbox.length) return;
+    const update = outbox.length === 1 ? outbox[0] : Y.mergeUpdatesV2(outbox);
+    outbox = [];
+    putWhole(nextKey("u"), update);
+  };
+  const offer = () => {
+    if (!hosted() || stopped || mineInFlight()) return;
+    if (refusedGap) {
+      refusedGap = false;
+      if (reconcile()) return;
+    }
+    if (!outbox.length) return;
+    const update = outbox.length === 1 ? outbox[0] : Y.mergeUpdatesV2(outbox);
+    outbox = [];
+    putWhole(nextKey("u"), update);
+  };
 
   for (const [k] of initial) known.add(k);
 
+  // Ahead of the stop guards, and of the room's own delivery: work this tab can no longer
+  // offer, and work a refused offer took back, is still work a crash must not lose.
   const onUpdate = (u, origin) => {
+    if (origin !== NET && origin !== ORIGINS_ORIGIN) onLocalUpdate(u);
+    if (origin !== NET && origin !== ORIGINS_ORIGIN && origin !== RECOVERY_ORIGIN) journal?.local(u);
     if (stopped || origin === NET || origin === ORIGINS_ORIGIN) return;
-    put(nextKey("u"), u);
+    if (hosted()) { outbox.push(u); offer(); }
+    else if (mode === "host") { outbox.push(u); flushOutbox(); }
+    else put(nextKey("u"), u);
   };
   ydoc.on("updateV2", onUpdate);
 
@@ -127,7 +176,11 @@ export function createYProvider({ store, ydoc, compact: limits = {}, setTimer =
     canCompact = true;
     known.add(k);
     stats.applied++;
-    Y.applyUpdateV2(ydoc, dec(v), NET);
+    const update = dec(v);
+    Y.applyUpdateV2(ydoc, update, NET);
+    // A received update can be the prerequisite of a later local insert, so the journal
+    // keeps it beside the work it owns, and never counts it as this tab's own.
+    journal?.dependency(update);
   };
 
   let wantReconcile = false;
@@ -140,15 +193,24 @@ export function createYProvider({ store, ydoc, compact: limits = {}, setTimer =
       timer = null;
       const full = wantReconcile;
       if (full) reconcile();
-      maybeCompact();
+      if (mode === "legacy") maybeCompact();
     }, 0);
   };
 
-  const settle = () => { reconcile(); maybeCompact(); };
+  const settle = () => { reconcile(); if (mode === "legacy") maybeCompact(); };
+
+  // The room's entries already hold every item and deletion of this tab's document, read
+  // from each entry's cached ranges: nothing to offer, and no copy of the room is built.
+  const roomHolds = (y) => {
+    const mine = docRanges(ydoc);
+    return mine.complete && within(unite(entriesOf(y ?? {}).map(([k, v]) => rangesFor(k, v))), mine);
+  };
 
   function reconcile() {
     if (stopped) return false;
+    if (hosted() && mineInFlight()) return false;
     const y = store.value.y;
+    if (roomHolds(y)) { wantReconcile = false; reconcilePending = false; return false; }
     const scratch = new Y.Doc();
     for (const [, v] of entriesOf(y)) Y.applyUpdateV2(scratch, dec(v), NET);
     const sv = Y.encodeStateVector(scratch);
@@ -158,7 +220,8 @@ export function createYProvider({ store, ydoc, compact: limits = {}, setTimer =
     const diff = Y.encodeStateAsUpdateV2(ydoc, sv);
     scratch.destroy();
     stats.offered++;
-    put(nextKey("r"), diff);
+    if (mode === "host") { outbox = []; putWhole(nextKey("r"), diff); }
+    else put(nextKey("r"), diff);
     wantReconcile = false;
     reconcilePending = false;
     return true;
@@ -171,24 +234,38 @@ export function createYProvider({ store, ydoc, compact: limits = {}, setTimer =
   let quietUntil = 0;
   const COVER_MAX = 256;
   const coverCache = new Map();
+  const META_MAX = 256;
+  const metas = new Map();
   const drop = (keys) => store.handle.update((data) => { for (const k of keys) delete data.y[k]; });
   const keysOf = (auth, bases) => Object.keys(auth).filter((k) => bases.has(baseOf(k)));
   // A key is retired only while what this tab shows under it is still what the proof was
   // made over: a late write under the same key keeps its own entry.
   const retire = (auth, keys) => { const visible = store.value.y ?? {}; drop(keys.filter((k) => k in visible && visible[k] === auth[k])); };
 
-  // `known` and the coverage memo keep live references only: the authoritative entries,
-  // this tab's own unconfirmed writes and the fold in progress. Pruned after a rebase, a
-  // fold and a refusal. A key that is forgotten can be decoded again; Yjs is idempotent.
+  // The items and deletions one entry holds, read once per value.
+  const rangesFor = (key, value) => {
+    const meta = metas.get(key);
+    if (meta && meta.value === value) return meta.ranges;
+    if (metas.size >= META_MAX) metas.delete(metas.keys().next().value);
+    const ranges = rangesOf(dec(value));
+    metas.set(key, { value, ranges });
+    return ranges;
+  };
+
+  // `known` and the entry memo keep live references only: the authoritative entries, by
+  // their whole keys, this tab's own unconfirmed writes and the fold in progress. Pruned
+  // after a rebase, a fold and a refusal. A key that is forgotten can be decoded again;
+  // Yjs is idempotent.
   function prune() {
     const auth = store.authoritative.y ?? {};
     const visible = store.value.y ?? {};
     for (const k of own) if (!(k in visible)) own.delete(k);
-    const held = fold ? [...fold.parts.map(([k]) => k), ...fold.inputs.keys()] : [];
-    const retained = new Set([...Object.keys(auth), ...own, ...held]);
-    for (const key of known) if (!retained.has(key)) known.delete(key);
     const values = new Map(entriesOf(auth));
+    const held = fold ? [fold.key, ...fold.parts.map(([k]) => k), ...fold.inputs.keys()] : [];
+    const retained = new Set([...Object.keys(auth), ...values.keys(), ...own, ...held]);
+    for (const key of known) if (!retained.has(key)) known.delete(key);
     for (const [key, proof] of coverCache) if (!retained.has(key) || values.get(key) !== proof.value) coverCache.delete(key);
+    for (const [key, meta] of metas) if (!retained.has(key) || (values.has(key) && values.get(key) !== meta.value)) metas.delete(key);
   }
 
   // Whether a fold's merged bytes already carry this input: merging it in again changes
@@ -229,7 +306,15 @@ export function createYProvider({ store, ydoc, compact: limits = {}, setTimer =
       prune();
       return true;
     }
-    if (store.pending.length || !stillHeld(auth, active) || !coversInputs(active)) return false;
+    if (store.pending.length) return false;
+    if (!stillHeld(auth, active) || !coversInputs(active)) {
+      // A fold that can never speak for its inputs is re-planned, never held.
+      fold = null;
+      if (arrived.length) retire(auth, arrived.map(([k]) => k));
+      quietUntil = entriesOf(auth).length + compact.keys;
+      prune();
+      return true;
+    }
     fold = null;
     retire(auth, keysOf(auth, active.inputs));
     prune();
@@ -295,7 +380,7 @@ export function createYProvider({ store, ydoc, compact: limits = {}, setTimer =
   // with this tab's document is a page rebuilt from another article while the tab was away.
   const clientsOf = (y) => {
     const clients = new Set();
-    for (const [, v] of entriesOf(y ?? {})) for (const c of Y.decodeStateVector(Y.encodeStateVectorFromUpdateV2(dec(v))).keys()) clients.add(c);
+    for (const [k, v] of entriesOf(y ?? {})) for (const [c, spans] of rangesFor(k, v).items) if (spans[0][0] === 0) clients.add(c);
     return clients;
   };
   // A page whose article has no blocks seeds with no client at all; it still shares its
@@ -310,6 +395,18 @@ export function createYProvider({ store, ydoc, compact: limits = {}, setTimer =
 
   const off = store.onRebase((ev) => {
     if (stopped) return;
+    if (ev.room) {
+      const was = mode;
+      mode = ev.room.compaction?.v === 1 ? "host" : "legacy";
+      // A room that stopped compacting confirms nothing in host order: what host mode
+      // was holding back goes out as ordinary updates.
+      if (was === "host" && mode === "legacy" && outbox.length) setTimer(() => {
+        if (stopped || mode !== "legacy" || !outbox.length) return;
+        const update = outbox.length === 1 ? outbox[0] : Y.mergeUpdatesV2(outbox);
+        outbox = [];
+        put(nextKey("u"), update);
+      }, 0);
+    }
     const ops = ev.source === "remote" && ev.frame ? ev.frame.ops : null;
     const plain = ops && ops.every((op) => op.path[0] === "y" && op.path.length === 2 && !PART_KEY.test(op.path[1]));
     if (!plain && ev.cause !== "refused" && !sharesLineage(ev.next.y)) {
@@ -323,6 +420,7 @@ export function createYProvider({ store, ydoc, compact: limits = {}, setTimer =
     }
     prune();
     schedule(ev.source !== "remote" || !ops, ev.source !== "remote");
+    offer();
   });
 
   // A page update the room refused as too large is never offered again: the difference would
@@ -331,6 +429,12 @@ export function createYProvider({ store, ydoc, compact: limits = {}, setTimer =
   // hold whole, and the room's page stays one a checkpoint can render.
   const offDelivery = store.onDelivery((event) => {
     if (event.phase !== "refused") return;
+    if (mode === "host") {
+      if (event.code === "page-full" || event.code === "compaction-failed") { stop(event.code); return; }
+      refusedGap = true;
+      schedule(true, false);
+      return;
+    }
     if (event.code !== "too-large" || stopped) { prune(); return; }
     stop("too-large");
     const auth = store.authoritative.y ?? {};
@@ -341,7 +445,10 @@ export function createYProvider({ store, ydoc, compact: limits = {}, setTimer =
     prune();
   });
 
+  const offConfirm = store.onConfirm(() => { offer(); });
+
   return { known, stats, settle, reconcile, get reconcilePending() { return reconcilePending; }, get stopped() { return stopped; },
+    get pending() { return outbox.length > 0; },
     // Test-only snapshot of the counters and cache sizes; no mutable set leaves the provider.
-    _diagnostics: () => ({ known: known.size, cover: coverCache.size, fold: fold ? fold.parts.length : 0, generation }), compact: maybeCompact, dispose() { off(); offDelivery(); ydoc.off("updateV2", onUpdate); if (timer) clearTimer(timer); } };
+    _diagnostics: () => ({ known: known.size, cover: coverCache.size, fold: fold ? fold.parts.length : 0, generation }), compact: maybeCompact, dispose() { off(); offDelivery(); offConfirm(); ydoc.off("updateV2", onUpdate); if (timer) clearTimer(timer); } };
 }

package/src/page/ybind/recovery-proof.js

@@ -14,8 +14,9 @@
  * state and the receipt arrive in the proof itself.
  */
 
-import { encodeStateAsUpdateV2, mergeUpdatesV2 } from "../../vendor/yjs.vendor.js";
+import { encodeStateAsUpdateV2 } from "../../vendor/yjs.vendor.js";
 import { docFromValue } from "./provider.js";
+import { indexOf, indexContains } from "./containment.js";
 
 export class PageProofError extends Error {
   constructor(code, message) {
@@ -40,17 +41,19 @@ const copyState = (state) => ({ v: state.v, g: state.g, y: { ...(state.y ?? {})
 export const equalBytes = (a, b) => a.length === b.length && a.every((value, index) => value === b[index]);
 
 /**
- * Whether merging `update` into `checkpoint` adds nothing: no insertion, no deletion.
+ * Whether applying `update` on top of `checkpoint` adds nothing: no insertion, no
+ * deletion. Compared by structure (the items and deletions the checkpoint holds), since
+ * merged bytes are not stable across merge orders. An update whose dependencies the
+ * checkpoint lacks is not contained: Yjs would hold it pending rather than refuse it. The
+ * checkpoint is integrated once for as long as its bytes are held, and each update after
+ * it is read, not applied.
  *
  * @param {Uint8Array} checkpoint - canonical or merged Yjs V2 update bytes
  * @param {Uint8Array} update - the bytes to look for
- * @param {Object} [Yjs] - the vendored Yjs module
  * @returns {boolean}
  */
-export function containsUpdate(checkpoint, update, Yjs = null) {
-  const merge = Yjs?.mergeUpdatesV2 ?? mergeUpdatesV2;
-  const canonical = merge([checkpoint]);
-  return equalBytes(canonical, merge([canonical, update]));
+export function containsUpdate(checkpoint, update) {
+  return indexContains(indexOf(checkpoint), update);
 }
 
 export async function digestHex(bytes) {
@@ -58,27 +61,47 @@ export async function digestHex(bytes) {
   return [...new Uint8Array(digest)].map((value) => value.toString(16).padStart(2, "0")).join("");
 }
 
+// The last few states decoded, by their entries: a proof, its validation, the file debt
+// and the journal's rebase all ask for the same state's bytes after one accepted save.
+const CANONICAL_MAX = 4;
+const canonical = [];
+const sameState = (memo, state) => {
+  if (memo.v !== state.v || memo.g !== state.g) return false;
+  const keys = Object.keys(state.y ?? {});
+  if (keys.length !== memo.y.size) return false;
+  for (const key of keys) if (memo.y.get(key) !== state.y[key]) return false;
+  return true;
+};
+
 /**
  * The accepted page state as one canonical update, decoded strictly.
  *
  * Pending structs, missing part and a delete set naming an unknown item all refuse:
- * a checkpoint nobody can decode proves nothing about a journaled record.
+ * a checkpoint nobody can decode proves nothing about a journaled record. The same state
+ * answers with the same bytes, which no caller may change.
  *
  * @param {Object} state - a version 1 page value
  * @returns {Uint8Array}
  */
 export function canonicalPageBytes(state) {
+  const hit = state && typeof state === "object" && state.y && typeof state.y === "object" ? canonical.find((memo) => sameState(memo, state)) : null;
+  if (hit) return hit.bytes;
   let doc;
   try {
     doc = docFromValue(state, { strict: true });
   } catch (error) {
     fail("invalid-state", `The accepted page state does not decode: ${error.message}`);
   }
+  let bytes;
   try {
-    return encodeStateAsUpdateV2(doc);
+    bytes = encodeStateAsUpdateV2(doc);
+    indexOf(bytes, doc);
   } finally {
     doc.destroy();
   }
+  if (canonical.length >= CANONICAL_MAX) canonical.shift();
+  canonical.push({ v: state.v, g: state.g, y: new Map(Object.entries(state.y)), bytes });
+  return bytes;
 }
 
 // The same answer `sameAuthority` gives in recovery/identity.js, written here because the