@panphora/clayjs 1.17.0 → 1.18.0

package/src/core/save.js

@@ -11,7 +11,7 @@
 
 import throttle from "../lib/throttle.js";
 import Mutation from "../lib/mutation.js";
-import { isDraftMode, isEditMode, isOwner } from "./is-edit-mode.js";
+import { isDraftMode, isEditMode, isOwner, learnedHostWritable } from "./is-edit-mode.js";
 import {
   saveCapturedHtml,
   getPageContents,
@@ -19,10 +19,17 @@ import {
   addDocumentTransform,
   isSaveInProgress,
   saveFateIsUnknown,
-  withKeepalive
+  withKeepalive,
+  setExitSave,
+  reserveSaveLane,
+  releaseSaveLane,
+  keepaliveHeld,
+  knownPageFormatFloor,
+  PAGE_FORMAT_META
 } from "./save-core.js";
 import { captureForComparisonAndDirty, captureForSaveAndComparison, captureForDirtyCheck, captureSaveClone, releaseCaptureArtifact } from "./snapshot.js";
 import { saveLimit, saveLimits, inspectSaveSize } from "./save-size.js";
+import { SLICED_SAVE_MIN_BYTES } from "./save-slices.js";
 import { paintSignature } from "../lib/derived.js";
 import { NO_TRIGGER_AUTOSAVE_SELECTOR } from "../lib/region-policy.js";
 import { seedEtag, learnConditionalSaves, lastSeenEtag, recordEtag } from "./etag.js";
@@ -40,7 +47,7 @@ import { initUserGesture, markExplicitSave, clearExplicitSave } from "../lib/use
 import { bytesUnsaved } from "./unsaved-warning.js";
 import { bootPhase } from "./boot-phase.js";
 import { createAutosaveScheduler } from "../lib/autosave-scheduler.js";
-import { noteRecoveryCapture, noteRecoverySettled } from "./recovery.js";
+import { beginRecoveryCapture, finishRecoveryCapture, noteRecoveryCapture, noteRecoverySettled } from "./recovery.js";
 
 // Keep this library's own root state out of the saved bytes.
 //
@@ -544,7 +551,7 @@ function heldForPreview(callback, resolve) {
   const skipped = skipped_(saveHoldReason());
   callback(skipped);
   resolve(skipped);
-  return true;
+  return skipped;
 }
 
 // ============================================
@@ -632,6 +639,29 @@ function sessionClosed(msg) {
   return skipped_(msg);
 }
 
+// A save this client will not send: the host has already answered that this page may not be
+// written. The shape is any refused save's, carrying the `forbidden` code a host's own 403
+// comes back with and `sent: false` because no request was made, so the chip, the notice and
+// the exit barrier read it exactly as they read that refusal. Sending it would only earn the
+// same answer, later.
+function forbidden_() {
+  return {
+    ok: false,
+    msg: 'You are not allowed to save this document.',
+    msgType: 'forbidden',
+    code: 'forbidden',
+    status: 403,
+    sent: false,
+    etag: null
+  };
+}
+
+// The host has said no, and nothing here overrides that: a page it will not store is not
+// written by an autosave, a Cmd+S, or the exit's own flush.
+function refusesSave() {
+  return learnedHostWritable() === false;
+}
+
 // The exit's own flush is not an ordinary save: it is the barrier writing the bytes the
 // exit is about to account for, so it runs under a permit. Nothing else does — a Cmd+S or
 // a [trigger-save] press while admission is closed stays parked.
@@ -833,6 +863,346 @@ export function setLastSavedContents(val) {
 
 const monotonic = () => (typeof performance !== 'undefined' && performance.now ? performance.now() : Date.now());
 
+// The size at which a document's work hands the page back, shared with the source map's
+// own install and repair. Re-exported so this module keeps answering for the save side.
+export { SLICED_SAVE_MIN_BYTES };
+// The main-thread time one preparation slice may spend before handing the page back.
+const SLICED_SAVE_BUDGET_MS = 4;
+// What a save answers when the page changed underneath its preparation. A skip, because
+// nothing was sent: the bytes are still here, and the next save starts over.
+const SAVE_PREPARE_CANCELLED = 'Save cancelled: the page changed while it prepared';
+
+// The save preparing across tasks right now, for a flush to wait on: it has taken the lane
+// and sent nothing, so its own events have not fired yet.
+let preparing = null;
+// The lazily loaded driver for the steps. Null until something asks, so a page whose
+// documents are small never loads it, and false-keyed off for good if it cannot load.
+let prepDriver = null;
+let prepLoading = null;
+let prepFailed = false;
+
+function loadPreparer() {
+  if (!prepLoading) {
+    prepLoading = import('./save-prepare.js').then(
+      (mod) => { prepDriver = mod; return mod; },
+      (err) => {
+        prepFailed = true;
+        console.info('clayjs: sliced save off (' + (err && err.message ? err.message : err) + '); saves prepare in one task');
+        return null;
+      }
+    );
+  }
+  return prepLoading;
+}
+
+// The size of the bytes the last save wrote. A document that has never saved is judged by
+// the document it was served as, which the browser has already measured.
+function servedSize() {
+  try {
+    return performance.getEntriesByType('navigation')[0]?.decodedBodySize || 0;
+  } catch {
+    return 0;
+  }
+}
+const lastSavedSize = () => (typeof lastSavedBytes === 'string' ? lastSavedBytes.length : servedSize());
+
+// Whether this save prepares across tasks instead of in the caller's.
+//
+// A hidden tab has no typing to protect and timers there are throttled: it keeps the
+// one-task path. A keepalive save belongs to a page that is going away and cannot wait for
+// a task boundary, so the unload flush keeps it too.
+function preparesSliced() {
+  if (prepFailed) return false;
+  if (document.hidden) return false;
+  if (keepaliveHeld()) return false;
+  return lastSavedSize() >= SLICED_SAVE_MIN_BYTES;
+}
+
+// Why a preparing job must not be sent any more, or null when it may go out.
+//
+// Ordinary typing is deliberately NOT one of these: the capture is a checkpoint, and
+// saving it later is the point. Only an invalidation cancels: the session, the mode, the
+// host's permission, a newer write to this document, a morph, or a document format that
+// rose while the job prepared. A rebuilt source map is not one: a render laid out against
+// the old pairing falls back to today's bytes, and a stale artifact is never adopted.
+function prepareInvalidation(ctx, epoch, morph) {
+  if (morph) return 'morph';
+  if (saveGenerationAt !== epoch.generation || !isEditMode) return 'mode';
+  if (!savesAdmitted(ctx.permit)) return 'session';
+  if (refusesSave()) return 'refused';
+  if (baselineRevision !== epoch.baselines) return 'newer save';
+  if (Math.max(knownPageFormatFloor(), ctx.pageFormatFloor) > epoch.floor) return 'floor';
+  return null;
+}
+
+// A merge arrives as a burst of applied frames: a retry waits for a quiet moment, never
+// longer than two seconds, so it captures the page the burst left behind.
+function mergeSettled(quietMs = 150, maxMs = 2000) {
+  return new Promise((resolve) => {
+    const started = monotonic();
+    let timer = null;
+    const done = () => { document.removeEventListener('clay:sync-applied', bump); resolve(); };
+    const bump = () => {
+      clearTimeout(timer);
+      timer = setTimeout(done, Math.max(0, Math.min(quietMs, maxMs - (monotonic() - started))));
+    };
+    document.addEventListener('clay:sync-applied', bump);
+    bump();
+  });
+}
+
+/**
+ * Everything one capture decides, for both save paths.
+ *
+ * The same bytes, the same refusals and the same receipts either way: a capture taken in
+ * one task and a capture prepared across tasks differ only in when their verification
+ * ran, never in what is asked of the result. `noteRecovery` is how the async path records
+ * coverage from its pinned candidates; `release` gives back whatever the capture holds
+ * when nothing is sent.
+ */
+async function settleCaptured({
+  explicit,
+  forced = false,
+  forSave,
+  forComparison,
+  forDirty,
+  captureId,
+  gateToken,
+  costMs,
+  pageFormatFloor = 0,
+  quietConflict = false,
+  laneHeld = false,
+  lane = null,
+  capture,
+  noteRecovery,
+  release,
+  callback,
+}) {
+  noteRecovery();
+
+  if (explicit && !forced) {
+    // An explicit save asks the DIRTY question: write anything the person would
+    // otherwise lose, including an edit inside a batching region that was never
+    // going to autosave itself.
+    unsavedChanges = (forDirty !== lastSavedDirty);
+    logSaveCheck('savePage dirty check', !unsavedChanges);
+
+    // Skip if content hasn't changed. Clearing the explicit intent here is the
+    // whole point of scoping it: pressing Save on a clean page sends nothing, and
+    // leaving "a human asked for this" armed would hand it to the next
+    // background write and hide exactly the clobber the guard watches for.
+    if (!unsavedChanges) {
+      clearExplicitSave();
+      gateClearIfUnchanged(gateToken);
+      release();
+      const skipped = skipped_('No changes to save');
+      settleRecoveryCapture(captureId, skipped);
+      if (typeof callback === 'function') callback(skipped);
+      return { result: skipped, dispatched: false };
+    }
+  } else if (!explicit) {
+    // For autosave: while the page is still settling, content must differ from
+    // BOTH the load-time baseline and the last save, so module setup churn cannot
+    // trigger a save. Once settled, the baseline veto is disarmed and only the
+    // last save matters — otherwise undoing back to the page's original state
+    // can never be persisted, because it matches the baseline forever.
+    const differsFromBaseline = !baselineActive || forComparison !== baselineContents;
+    const differsFromLastSave = forComparison !== lastSavedContents;
+
+    logSaveCheck('throttled vs baseline', !differsFromBaseline);
+    logSaveCheck('throttled vs lastSave', !differsFromLastSave);
+
+    if (!(differsFromBaseline && differsFromLastSave)) {
+      // This capture's comparison leaves out batching (no-trigger-autosave)
+      // regions, which the gate counts, so on a page that has one the dirty
+      // domain must match too before the gate is cleared.
+      let clear = false;
+      try {
+        clear = !differsFromLastSave && (!document.querySelector(NO_TRIGGER_AUTOSAVE_SELECTOR)
+          || (pageMaybeDirty() && forDirty === lastSavedDirty));
+      } catch (err) {
+        console.error('savePageThrottled: dirty domain check failed', err);
+      }
+      if (clear) gateClearIfUnchanged(gateToken);
+      autosaveScheduler.noteCost(costMs);
+      release();
+      const skipped = skipped_('No changes to save');
+      settleRecoveryCapture(captureId, skipped);
+      if (typeof callback === 'function') callback(skipped);
+      return { result: skipped, dispatched: false };
+    }
+
+    unsavedChanges = true;
+
+    // A save that is not this lane's own (a raw saveHtml) may still be on the
+    // wire. The capture has already been taken, so answer like the explicit lane
+    // and keep these newer bytes queued behind it. A prepared save holds the lane
+    // itself, so it can never be looking at somebody else's request here.
+    if (!laneHeld && isSaveInProgress()) {
+      pendingSave = true;
+      release();
+      const skipped = skipped_('Save already in progress');
+      settleRecoveryCapture(captureId, skipped);
+      if (typeof callback === 'function') callback(skipped);
+      return { result: skipped, dispatched: false };
+    }
+  }
+
+  // Start debounced 'saving' state (only shows if save takes >500ms)
+  setSavingState();
+
+  // Use the captured save path with our pre-captured content (avoids double capture)
+  const comparison = { forComparison, forDirty };
+  inFlightComparisons.add(comparison);
+  ownSaveOnWire = true;
+  return new Promise((resolve) => {
+    saveCapturedHtml(forSave, captureId, (result) => {
+      ownSaveOnWire = false;
+      inFlightComparisons.delete(comparison);
+      const completedAt = monotonic();
+      applySaveResult(result, comparison.forComparison, comparison.forDirty, forced ? 'updated after force save' : 'updated after save', gateToken, forSave, captureId, quietConflict);
+      if (!explicit) autosaveScheduler.noteCost(costMs + (monotonic() - completedAt));
+      if (typeof callback === 'function') callback(result);
+      resolve({ result, dispatched: true });
+      // The save that queued behind this one goes out from here, in this request's own
+      // task, which is where it has always gone out: a flush's own call then finds the
+      // lane busy and waits that request out, which is what its 'clean' answer describes.
+      // A prepared save holds the lane itself, so its caller does the draining instead.
+      if (!laneHeld) drainPendingSave();
+    }, { capture, pageFormatFloor, lane });
+  });
+}
+
+/**
+ * Prepare one capture across tasks and send it, or answer like a skip.
+ *
+ * The lane was reserved before this function's first await, so nothing else can start a
+ * save on the page this capture read. Every outcome gives it back: a send hands it to
+ * `runSave`, which settles it with the bookkeeping, and a cancellation gives it back here.
+ */
+async function runSlicedSave(ctx, lane) {
+  // A morph replaces the page under a job that is only half verified. What it applied may
+  // be a disk frame or a peer's edit, so these bytes describe a page that is gone.
+  const applied = { over: false };
+  const onApplied = () => { applied.over = true; };
+  document.addEventListener('clay:sync-applied', onApplied);
+  try {
+    for (let round = 0; round < 2; round++) {
+      const gateToken = gateCaptureToken();
+      const epoch = {
+        generation: saveGenerationAt,
+        baselines: baselineRevision,
+        floor: Math.max(knownPageFormatFloor(), ctx.pageFormatFloor),
+      };
+      const job = prepDriver.beginSaveCapture({
+        requestRefresh: true,
+        forRequest: true,
+        pageFormatMarker: epoch.floor ? { name: PAGE_FORMAT_META, content: String(epoch.floor) } : null,
+      });
+      // The copies this capture could cover are the ones held right now: reading them
+      // after the preparation would both miss A's coverage and claim a newer copy's.
+      beginRecoveryCapture(job.captureId);
+      let why = null;
+      const signal = {
+        get aborted() {
+          const reason = prepareInvalidation(ctx, epoch, applied.over);
+          if (reason) why = reason;
+          return !!reason;
+        },
+      };
+      let prepared;
+      try {
+        prepared = await prepDriver.runPreparedSteps(job.steps(), { budgetMs: SLICED_SAVE_BUDGET_MS, signal });
+      } catch (err) {
+        console.error(`${ctx.explicit ? 'savePage' : 'savePageThrottled'}: preparing the save failed`, err);
+        job.drop();
+        const result = { msg: err && err.message ? err.message : 'Save failed', msgType: 'error', code: err?.code ?? null, etag: null };
+        setSaveState('error', result.msg, '', { sent: false, code: result.code });
+        settleRecoveryCapture(job.captureId, result);
+        if (typeof ctx.callback === 'function') ctx.callback(result);
+        return { result, dispatched: false };
+      }
+
+      const late = prepared.aborted ? why : prepareInvalidation(ctx, epoch, applied.over);
+      if (!late) {
+        const captured = prepared.result;
+        return await settleCaptured({
+          explicit: ctx.explicit,
+          forced: ctx.forced,
+          forSave: captured.forSave,
+          forComparison: captured.forComparison,
+          forDirty: captured.forDirty,
+          captureId: captured.captureId,
+          gateToken,
+          costMs: prepared.activeMs,
+          pageFormatFloor: ctx.pageFormatFloor,
+          quietConflict: ctx.quietConflict,
+          laneHeld: true,
+          lane,
+          capture: captured,
+          noteRecovery: () => finishRecoveryCapture(captured.captureId, captured.forSave),
+          release: () => job.drop(),
+          callback: ctx.callback,
+        });
+      }
+
+      // Nothing is sent from a capture that cannot be trusted: the clones and the
+      // candidate go, and the waiters hear the skip contract's answer.
+      job.drop();
+      const skipped = skipped_(SAVE_PREPARE_CANCELLED);
+      // A session's closed admission cancelled this preparation: the page is between
+      // modes, and the attempt is remembered so `resume` replays it.
+      if (late === 'session') parkedAutosave = true;
+      settleRecoveryCapture(job.captureId, skipped);
+      // The document format rose under a job already prepared: its marker and its
+      // verification both predate the floor, so the capture is taken again at the new one.
+      if (late === 'floor' && round === 0) continue;
+      // The person asked for this save: a merge that landed under it does not get to
+      // swallow it. Once the merge settles the page is captured again, once.
+      if (late === 'morph' && ctx.explicit && round === 0) {
+        await mergeSettled();
+        applied.over = false;
+        // The retry captures again rather than asking the dirty gate: an editor's content
+        // lives where the gate does not look, and the capture itself skips a clean page.
+        continue;
+      }
+      if (typeof ctx.callback === 'function') ctx.callback(skipped);
+      return { result: skipped, dispatched: false };
+    }
+    const skipped = skipped_(SAVE_PREPARE_CANCELLED);
+    if (typeof ctx.callback === 'function') ctx.callback(skipped);
+    return { result: skipped, dispatched: false };
+  } finally {
+    document.removeEventListener('clay:sync-applied', onApplied);
+    releaseSaveLane(lane);
+  }
+}
+
+/**
+ * Start a prepared save, or answer false so the caller takes the one-task path.
+ *
+ * The lane is reserved and the capture is begun in THIS task, before anything awaits.
+ */
+function startSlicedSave(ctx) {
+  const lane = reserveSaveLane();
+  if (!lane) return false;
+  const task = runSlicedSave(ctx, lane).catch((err) => {
+    console.error('save: preparing the save failed', err);
+    const result = { msg: err && err.message ? err.message : 'Save failed', msgType: 'error', code: err?.code ?? null, etag: null };
+    setSaveState('error', result.msg, '', { sent: false, code: result.code });
+    if (typeof ctx.callback === 'function') ctx.callback(result);
+    return { result, dispatched: false };
+  });
+  preparing = task;
+  task.then((outcome) => {
+    if (preparing === task) preparing = null;
+    ctx.resolve(outcome.result);
+    ctx.settleSoonQueued(outcome.result);
+    if (outcome.dispatched || pendingSave || pendingAutosave || soonQueuedWaiters.length) drainPendingSave();
+  });
+  return true;
+}
+
 /**
  * One save attempt, explicit or automatic.
  *
@@ -862,19 +1232,38 @@ function attemptSaveNow({ kind, permit = null }, callback = () => {}) {
     if (!isEditMode && !window.clay?.testMode) {
       if (explicit) clearExplicitSave();
       const skipped = skipped_('Not in edit mode');
+      // The page left edit mode, so no later save is coming to take these callers.
+      takeSoonQueued().forEach((done) => done(skipped));
       callback(skipped);
       return resolve(skipped);
     }
 
     // A session has admission closed: the page is between modes, and neither lane writes
-    // until it decides. An automatic attempt is remembered so `resume` replays it.
+    // until it decides. The attempt is remembered so `resume` replays it, explicit or not.
     if (!savesAdmitted(permit)) {
-      if (!explicit) parkedAutosave = true;
+      parkedAutosave = true;
       const skipped = sessionClosed('Save session is quiesced');
+      // The soon() callers waiting on this save hear its refusal: a queued waiter that is
+      // never answered is a promise the page cannot settle, and the refusal is the answer
+      // to the save it was moved to.
+      if (explicit) takeSoonQueued().forEach((done) => done(skipped));
       callback(skipped);
       return resolve(skipped);
     }
 
+    // The host has told this tab this page is no longer writable. Nothing sends a request
+    // the client already knows will be refused: the text stays here, and the answer is the
+    // one a host's 403 gets, so the indicator says so and the exit refuses like a failed
+    // save. The flush inside the exit barrier passes through here too.
+    if (refusesSave()) {
+      if (explicit) clearExplicitSave();
+      const refused = forbidden_();
+      setSaveState('error', refused.msg, '', { code: refused.code, status: refused.status, sent: false });
+      takeSoonQueued().forEach((done) => done(refused));
+      callback(refused);
+      return resolve(refused);
+    }
+
     // A save is already on the wire. Remember that a newer state is waiting rather
     // than dropping it: the in-flight request carries the older bytes, and if no
     // further mutation happens to retrigger autosave, the newer ones would never
@@ -882,7 +1271,13 @@ function attemptSaveNow({ kind, permit = null }, callback = () => {}) {
     // Not cleared here: pendingSave means this request is deferred, not
     // abandoned, and drainPendingSave is what eventually sends it.
     if (explicit) {
-      if (heldForPreview(callback, resolve)) return;
+      const held = heldForPreview(callback, resolve);
+      if (held) {
+        // A hold's replay is an autosave, which takes nobody's queued waiters, and a hold
+        // released without a replay drops the missed save: the hold is their answer.
+        takeSoonQueued().forEach((done) => done(held));
+        return;
+      }
       if (isSaveInProgress()) {
         pendingSave = true;
         const skipped = skipped_('Save already in progress');
@@ -902,6 +1297,15 @@ function attemptSaveNow({ kind, permit = null }, callback = () => {}) {
         callback(skipped);
         return resolve(skipped);
       }
+      // A save preparing across tasks holds the lane and has sent nothing yet. This
+      // records intent and nothing more: capturing the page again for it would be the
+      // second full snapshot this split exists to prevent.
+      if (preparing) {
+        pendingAutosave = true;
+        const skipped = skipped_('Save already in progress');
+        callback(skipped);
+        return resolve(skipped);
+      }
       // The dirty gate counts every change no save has accounted for, and it is
       // the cheap half of the old dirtyMatchesLastSave check. When it says clean
       // there is nothing to compare, so answer like the old comparison did and
@@ -919,6 +1323,11 @@ function attemptSaveNow({ kind, permit = null }, callback = () => {}) {
     const prepare = window.clay?.source?.ensureForSave?.();
     if (prepare) return prepare.then(() => resolve(attemptSaveNow({ kind, permit }, callback)));
 
+    if (preparesSliced() && !prepDriver) {
+      loadPreparer().then(() => resolve(attemptSaveNow({ kind, permit }, callback)));
+      return;
+    }
+
     // From here this call answers: it either writes, or reports why it did not,
     // and the soon() callers waiting on the save queued behind the one that was
     // on the wire when they asked get that answer.
@@ -932,6 +1341,21 @@ function attemptSaveNow({ kind, permit = null }, callback = () => {}) {
       setOfflineStateQuiet();
     }
 
+    // A document this big prepares its save across tasks, so typing is never blocked for
+    // the whole verification. The claim and the capture are both taken in this task.
+    if (preparesSliced()) {
+      if (startSlicedSave({
+        explicit,
+        forced: false,
+        permit,
+        pageFormatFloor: 0,
+        quietConflict: false,
+        settleSoonQueued,
+        callback,
+        resolve,
+      })) return;
+    }
+
     // Single capture: clone once, get all three versions
     // forSave strips non-persisted regions ([no-save]/[save-remove])
     // forComparison additionally strips every autosave-off region
@@ -961,99 +1385,22 @@ function attemptSaveNow({ kind, permit = null }, callback = () => {}) {
 
     // The recovery hook sees the accepted capture's exact bytes, before anything is
     // sent, so a copy can be proved to be in them rather than merely to be nearby.
-    noteRecoveryCapture({ captureId, html: forSave });
-
-    if (explicit) {
-      // An explicit save asks the DIRTY question: write anything the person would
-      // otherwise lose, including an edit inside a batching region that was never
-      // going to autosave itself.
-      unsavedChanges = (forDirty !== lastSavedDirty);
-      logSaveCheck('savePage dirty check', !unsavedChanges);
-
-      // Skip if content hasn't changed. Clearing the explicit intent here is the
-      // whole point of scoping it: pressing Save on a clean page sends nothing, and
-      // leaving "a human asked for this" armed would hand it to the next
-      // background write and hide exactly the clobber the guard watches for.
-      if (!unsavedChanges) {
-        clearExplicitSave();
-        gateClearIfUnchanged(gateToken);
-        releaseCaptureArtifact(capture);
-        const skipped = skipped_('No changes to save');
-        settleRecoveryCapture(captureId, skipped);
-        callback(skipped);
-        resolve(skipped);
-        settleSoonQueued(skipped);
-        return;
-      }
-    } else {
-      // For autosave: while the page is still settling, content must differ from
-      // BOTH the load-time baseline and the last save, so module setup churn cannot
-      // trigger a save. Once settled, the baseline veto is disarmed and only the
-      // last save matters — otherwise undoing back to the page's original state
-      // can never be persisted, because it matches the baseline forever.
-      const differsFromBaseline = !baselineActive || forComparison !== baselineContents;
-      const differsFromLastSave = forComparison !== lastSavedContents;
-
-      logSaveCheck('throttled vs baseline', !differsFromBaseline);
-      logSaveCheck('throttled vs lastSave', !differsFromLastSave);
-
-      if (!(differsFromBaseline && differsFromLastSave)) {
-        // This capture's comparison leaves out batching (no-trigger-autosave)
-        // regions, which the gate counts, so on a page that has one the dirty
-        // domain must match too before the gate is cleared.
-        let clear = false;
-        try {
-          clear = !differsFromLastSave && (!document.querySelector(NO_TRIGGER_AUTOSAVE_SELECTOR)
-            || (pageMaybeDirty() && forDirty === lastSavedDirty));
-        } catch (err) {
-          console.error('savePageThrottled: dirty domain check failed', err);
-        }
-        if (clear) gateClearIfUnchanged(gateToken);
-        autosaveScheduler.noteCost(preparedMs);
-        releaseCaptureArtifact(capture);
-        const skipped = skipped_('No changes to save');
-        settleRecoveryCapture(captureId, skipped);
-        callback(skipped);
-        resolve(skipped);
-        return;
-      }
-
-      unsavedChanges = true;
-
-      // A save that is not this lane's own (a raw saveHtml) may still be on the
-      // wire. The capture has already been taken, so answer like the explicit lane
-      // and keep these newer bytes queued behind it.
-      if (isSaveInProgress()) {
-        pendingSave = true;
-        releaseCaptureArtifact(capture);
-        const skipped = skipped_('Save already in progress');
-        settleRecoveryCapture(captureId, skipped);
-        callback(skipped);
-        resolve(skipped);
-        return;
-      }
-    }
-
-    // Start debounced 'saving' state (only shows if save takes >500ms)
-    setSavingState();
-
-    // Use the captured save path with our pre-captured content (avoids double capture)
-    const comparison = { forComparison, forDirty };
-    inFlightComparisons.add(comparison);
-    ownSaveOnWire = true;
-    saveCapturedHtml(forSave, captureId, (result) => {
-      ownSaveOnWire = false;
-      inFlightComparisons.delete(comparison);
-      const completedAt = monotonic();
-      applySaveResult(result, comparison.forComparison, comparison.forDirty, 'updated after save', gateToken, forSave, captureId);
-      if (!explicit) autosaveScheduler.noteCost(preparedMs + (monotonic() - completedAt));
-      if (typeof callback === 'function') {
-        callback(result);
-      }
-      resolve(result);
-      settleSoonQueued(result);
-      drainPendingSave();
-    }, { capture });
+    settleCaptured({
+      explicit,
+      forSave,
+      forComparison,
+      forDirty,
+      captureId,
+      gateToken,
+      costMs: preparedMs,
+      capture,
+      noteRecovery: () => noteRecoveryCapture({ captureId, html: forSave }),
+      release: () => releaseCaptureArtifact(capture),
+      callback,
+    }).then((outcome) => {
+      resolve(outcome.result);
+      settleSoonQueued(outcome.result);
+    });
   });
 }
 
@@ -1080,43 +1427,99 @@ function savePagePermitted(permit, callback = () => {}) {
 /**
  * Force-save the current page (skips dirty check).
  *
+ * `permit` is the exit's own save permit: the one write a closed session still admits.
+ * Internal to the exit flush, which no page can reach.
+ *
  * @param {Function} callback - Optional callback for custom handling
  * @returns {Promise<{msg: string, msgType: string}>}
  */
-export function savePageForce(callback = () => {}, { quietConflict = false, pageFormatFloor = 0 } = {}) {
-  if (capabilityPending) return capabilityKnown.then(() => savePageForce(callback, { quietConflict, pageFormatFloor }));
+export function savePageForce(callback = () => {}, { quietConflict = false, pageFormatFloor = 0, permit = null } = {}) {
+  if (capabilityPending) return capabilityKnown.then(() => savePageForce(callback, { quietConflict, pageFormatFloor, permit }));
   return new Promise((resolve) => {
     if (!isEditMode && !window.clay?.testMode) {
       const skipped = skipped_('Not in edit mode');
+      // A soon() caller queued behind a save that ends here hears this answer: the page left
+      // edit mode, and no later save is coming to take them.
+      takeSoonQueued().forEach((done) => done(skipped));
       callback(skipped);
       return resolve(skipped);
     }
 
     // A forced save is still an ordinary one for admission: only the exit's own flush
-    // carries the permit.
-    if (!savesAdmitted()) {
+    // carries the permit. A revoked permit is refused even where admission has reopened,
+    // so a continuation the exit already gave up on cannot write later input.
+    if (!savesAdmitted(permit) || (permit && !permitHolds(permit))) {
       const skipped = sessionClosed('Save session is quiesced');
+      // A closed session parks its own attempt and sends nothing more without a permit, so
+      // the refusal is the last word these callers get from this page.
+      takeSoonQueued().forEach((done) => done(skipped));
       callback(skipped);
       return resolve(skipped);
     }
 
-    if (heldForPreview(callback, resolve)) return;
+    // A force save is not a way around the host's answer: these bytes are the ones it has
+    // already refused, and a request it will reject is not sent.
+    if (refusesSave()) {
+      const refused = forbidden_();
+      setSaveState('error', refused.msg, '', { code: refused.code, status: refused.status, sent: false });
+      // The host's refusal is the standing answer for this page, so nothing later will take
+      // these callers: they hear it here.
+      takeSoonQueued().forEach((done) => done(refused));
+      callback(refused);
+      return resolve(refused);
+    }
+
+    // A held save's replay is not the waiters' answer: a hold released without a replay
+    // drops the missed save, and these callers would wait for one that never comes.
+    const held = heldForPreview(callback, resolve);
+    if (held) {
+      takeSoonQueued().forEach((done) => done(held));
+      return;
+    }
 
     if (isSaveInProgress()) {
       pendingSave = true;
       const skipped = skipped_('Save already in progress');
+      // The parked attempt behind the request on the wire is not the save these callers
+      // asked for, and its drain can be held for good: the skip is their answer.
+      takeSoonQueued().forEach((done) => done(skipped));
       callback(skipped);
       return resolve(skipped);
     }
 
     const prepare = window.clay?.source?.ensureForSave?.();
-    if (prepare) return prepare.then(() => resolve(savePageForce(callback, { quietConflict, pageFormatFloor })));
+    if (prepare) return prepare.then(() => resolve(savePageForce(callback, { quietConflict, pageFormatFloor, permit })));
 
     const wasOffline = !navigator.onLine;
     if (wasOffline) {
       setOfflineStateQuiet();
     }
 
+    // A forced save prepares like an ordinary one when the document is this big; it only
+    // skips the dirty question, which `forced` says here.
+    if (preparesSliced() && !prepDriver) {
+      loadPreparer().then(() => resolve(savePageForce(callback, { quietConflict, pageFormatFloor, permit })));
+      return;
+    }
+
+    // From here this call answers, and the soon() callers waiting now are waiting on its
+    // capture: one that queues after it stays queued for the save the drain starts.
+    const soonQueued = takeSoonQueued();
+    const settleSoonQueued = (result) => soonQueued.forEach((done) => done(result));
+
+    if (preparesSliced()) {
+      if (startSlicedSave({
+        explicit: true,
+        forced: true,
+        permit,
+        pageFormatFloor,
+        quietConflict,
+        settleSoonQueued,
+        callback,
+        resolve,
+      })) return;
+    }
+
     let capture, forSave, forComparison, forDirty, captureId;
     const gateToken = gateCaptureToken();
     try {
@@ -1129,29 +1532,39 @@ export function savePageForce(callback = () => {}, { quietConflict = false, page
       if (typeof callback === 'function') {
         callback(result);
       }
-      return resolve(result);
+      resolve(result);
+      settleSoonQueued(result);
+      return;
     }
 
-    noteRecoveryCapture({ captureId, html: forSave });
-
-    setSavingState();
-
-    const comparison = { forComparison, forDirty };
-    inFlightComparisons.add(comparison);
-    ownSaveOnWire = true;
-    saveCapturedHtml(forSave, captureId, (result) => {
-      ownSaveOnWire = false;
-      inFlightComparisons.delete(comparison);
-      applySaveResult(result, comparison.forComparison, comparison.forDirty, 'updated after force save', gateToken, forSave, captureId, quietConflict);
-      if (typeof callback === 'function') {
-        callback(result);
-      }
-      resolve(result);
-      drainPendingSave();
-    }, { capture, pageFormatFloor });
+    settleCaptured({
+      explicit: true,
+      forced: true,
+      forSave,
+      forComparison,
+      forDirty,
+      captureId,
+      gateToken,
+      costMs: 0,
+      pageFormatFloor,
+      quietConflict,
+      capture,
+      noteRecovery: () => noteRecoveryCapture({ captureId, html: forSave }),
+      release: () => releaseCaptureArtifact(capture),
+      callback,
+    }).then((outcome) => {
+      resolve(outcome.result);
+      // The waiters asked for a save soon and this one landed: its result is their answer.
+      settleSoonQueued(outcome.result);
+    });
   });
 }
 
+// The exit's own checkpoint, through the slot save-core holds for it: a page exit has
+// to save this tab's own input while admission is closed, and only a save minted here
+// can do it. Set at load, read only by the live plugin's exit flush.
+setExitSave((permit) => savePageForce(() => {}, { permit }));
+
 // Resolve on the next save that settles, or reject once the deadline has passed.
 // Every settled state is one, not just success: a save that failed is an answer about
 // the page's bytes too, and the caller decides what to do with it.
@@ -1211,37 +1624,54 @@ export async function flushSave({ keepalive = false, timeoutMs = 15000, permit =
   // the generation that owns the page now, so a flush during a transition is still a
   // write in this generation and never the next one's.
   const held = permit || openSavePermit();
+  const run = { over: false };
   let timer = null;
   const timeout = new Promise((_, reject) => {
     timer = setTimeout(() => reject(flushError('Save timed out.', 'failed')), Math.max(0, timeoutMs));
   });
   try {
-    return await Promise.race([flushBytes(keepalive, deadline, held), timeout]);
+    return await Promise.race([flushBytes(keepalive, deadline, held, run), timeout]);
   } catch (err) {
     if (err && typeof err.state === 'string') throw err;
     throw flushError(err?.message || 'Save failed', 'failed');
   } finally {
+    run.over = true;
     clearTimeout(timer);
     if (!permit) closeSavePermit(held);
   }
 }
 
-async function flushBytes(keepalive, deadline, permit) {
+async function flushBytes(keepalive, deadline, permit, run = { over: false }) {
   // Load-time module churn is not the person's work: autosave never saves it, and
   // neither does a flush. Wait for the baseline to settle (at most MAX_SETTLE_MS).
   if (!baselineSettled()) await nextEvent('clay:baseline-settled', deadline);
+  if (run.over) return null;
 
   let saved = false;
   let etag = null;
   for (let attempt = 0; attempt < 4; attempt++) {
-    if (isSaveInProgress()) await settled(deadline);
+    // A save still preparing holds the lane and has sent nothing, so it has fired none of
+    // the events below: the flush waits for it rather than reading the page in the middle
+    // of a capture it cannot see.
+    if (preparing) {
+      await preparing;
+      if (run.over) return null;
+    }
+    if (isSaveInProgress()) {
+      await settled(deadline);
+      if (run.over) return null;
+    }
     if (isSaveConflicted()) throw flushError('This document has a conflict to resolve.', 'conflict');
     const token = gateCaptureToken();
     if (!bytesUnsaved()) {
       gateClearIfUnchanged(token);
       if (hasUnsavedState()) throw flushError('This document has unsaved work a save cannot write.', 'blocked');
+      // Nothing was written because there was nothing to write: the bytes on the page are
+      // the ones the last accepted save left, so work a closed session parked is covered.
+      parkedWork = false;
       return { state: saved ? 'saved' : 'clean', etag: etag ?? lastSeenEtag() };
     }
+    if (run.over) return null;
     const result = await withKeepalive(keepalive, () => savePagePermitted(permit));
     // The lane was busy (a drained pending save is on the wire): wait it out next turn.
     if (result.msgType === 'skipped') continue;