@perspective-dev/viewer 5.5.0 → 5.6.0

package/src/rust/session.rs

@@ -13,11 +13,13 @@
 pub(crate) mod column_defaults_update;
 pub(crate) mod drag_drop_update;
 mod metadata;
+mod op_queue;
+mod panel_state;
 mod props;
 pub(crate) mod replace_expression_update;
 mod view_subscription;
 
-use std::cell::{Cell, Ref, RefCell};
+use std::cell::{Cell, RefCell};
 use std::collections::{HashMap, HashSet};
 use std::future::Future;
 use std::ops::Deref;
@@ -25,7 +27,9 @@ use std::rc::Rc;
 
 use perspective_client::config::*;
 use perspective_client::proto::ViewDimensionsResp;
-use perspective_client::{Client, ClientError, ReconnectCallback, View};
+use perspective_client::{
+    Client, ClientError, DescribeError, Description, ExprValidationResult, ReconnectCallback, View,
+};
 use perspective_js::apierror;
 use perspective_js::utils::*;
 use wasm_bindgen::prelude::*;
@@ -34,9 +38,13 @@ use yew::prelude::*;
 
 use self::metadata::*;
 pub use self::metadata::{MetadataRef, SessionMetadata, SessionMetadataRc};
+use self::op_queue::OpQueue;
+pub use self::op_queue::{EditDelta, OpCtx, OpKind, StepFuture, Ticket};
+use self::panel_state::effective;
+pub use self::panel_state::{Binding, OverlayClause, PanelState};
 pub use self::props::{SessionProps, TableLoadState};
-pub use self::view_subscription::ViewStats;
 use self::view_subscription::*;
+pub use self::view_subscription::{ViewStats, ViewSubscription};
 use crate::config::PluginStaticConfig;
 use crate::utils::*;
 
@@ -71,12 +79,8 @@ pub struct SessionHandle {
     pub view_config_changed: PubSub<()>,
     pub title_changed: PubSub<Option<String>>,
 
-    /// Count of in-flight CONFIG-DRIVEN pipeline runs.
-    in_flight_config_runs: Cell<u32>,
-
-    /// Fires with the ABSOLUTE [`Self::in_flight_config_runs`] count after
-    /// every change.
-    pub run_state_changed: PubSub<u32>,
+    /// Account of in-flight CONFIG-DRIVEN pipeline runs.
+    pub config_runs: InFlight,
 
     /// Fires when the user clicks the status indicator while in
     /// [`StatusIconState::Normal`].
@@ -100,31 +104,21 @@ pub struct SessionHandle {
     /// copying the config.
     pub last_dispatched_config: RefCell<Option<std::rc::Rc<crate::config::ViewerConfig>>>,
 
-    /// Monotone load counter, bumped once per `load()` call
-    /// ([`Session::begin_pending_load`]). Identifies the LATEST load so a
-    /// stale async classification — React binds `load` to a prop and fires it
-    /// repeatedly, unawaited and out of order — no-ops instead of clobbering a
-    /// newer load ([`Session::is_current_load`]).
-    load_generation: Cell<u32>,
-
-    /// Open between a `load()` call and its payload's classification as
-    /// `Table`/`Client` ([`PendingLoad`]).
-    pending_load: RefCell<Option<PendingLoad>>,
+    /// Every writer of this panel's committed state, run one at a time in
+    /// submit order (see [`op_queue`]).
+    queue: Rc<OpQueue>,
 
     /// Coalesces `view_config_changed`: multiple synchronous commits in one
     /// task emit ONE event on the next microtask — the cadence the deleted
     /// `is_clean` flag provided by accident, now deliberate.
     config_event_scheduled: Cell<bool>,
 
-    /// Count of in-flight `perspective-config-update` dispatch tasks for this
-    /// panel (see [`Session::track_dispatch`]). `flush()` joins these via
+    /// Account of in-flight `perspective-config-update` dispatch tasks for
+    /// this panel (see [`Session::track_dispatch`]). `flush()` joins these via
     /// [`Session::settle_dispatches`], so the "config-update fires before
     /// `flush()` resolves" contract holds by construction instead of by
     /// microtask luck.
-    pending_dispatches: Cell<u32>,
-
-    /// Fires when [`SessionHandle::pending_dispatches`] returns to zero.
-    dispatches_settled: PubSub<()>,
+    dispatches: InFlight,
 
     /// Fires when [`SessionHandle::column_stats`] is updated (insert or
     /// clear). Subscribers re-render and re-query the schema with the
@@ -200,24 +194,144 @@ pub(crate) async fn probe_table(
 /// Mutable state for `Session`.
 #[derive(Default)]
 pub struct SessionData {
-    client: Option<perspective_client::Client>,
-    table: Option<perspective_client::Table>,
-    pending_table: Option<String>,
-    metadata: SessionMetadata,
-    config: ViewConfig,
-    global_filter: Vec<Filter>,
+    /// This panel's committed state: ONE immutable value, replaced whole by
+    /// [`SessionData::swap`].
+    state: Lifecycle,
+
+    /// What [`Session::metadata`] answers while nothing is bound, and what
+    /// [`Session::metadata_mut`] scribbles on (every write is a no-op then).
+    unbound_metadata: Rc<SessionMetadata>,
     view_sub: Option<ViewSubscription>,
     stats: Option<ViewStats>,
-    is_loading: bool,
     is_paused: bool,
+}
+
+/// A panel's state and whether it can still be written.
+enum Lifecycle {
+    Live(Rc<PanelState>),
+
+    /// Terminal: the owning panel was ejected ([`Session::dispose`]).
+    Disposed {
+        last: Rc<PanelState>,
+        disposal: Disposal,
+    },
+}
+
+impl Default for Lifecycle {
+    fn default() -> Self {
+        Self::Live(Rc::default())
+    }
+}
 
-    /// Memo for [`Session::validate_snapshot`]: the expression set validated
-    /// by the last successful server round trip; an equal snapshot skips the
-    /// round trip. Written only under the draw lock; cleared on table
-    /// (re)bind and expression reset.
-    last_validated_expressions: Option<Expressions>,
-    error: Option<TableErrorState>,
-    title: Option<String>,
+impl Deref for Lifecycle {
+    type Target = Rc<PanelState>;
+
+    fn deref(&self) -> &Self::Target {
+        match self {
+            Lifecycle::Live(state) | Lifecycle::Disposed { last: state, .. } => state,
+        }
+    }
+}
+
+impl Lifecycle {
+    fn live_mut(&mut self) -> Option<&mut Rc<PanelState>> {
+        match self {
+            Lifecycle::Live(state) => Some(state),
+            Lifecycle::Disposed { .. } => None,
+        }
+    }
+
+    fn disposal(&self) -> Option<Disposal> {
+        match self {
+            Lifecycle::Live(_) => None,
+            Lifecycle::Disposed { disposal, .. } => Some(*disposal),
+        }
+    }
+}
+
+/// An OWNED read guard over the committed [`ViewConfig`]: a snapshot that
+/// borrows nothing.
+pub struct ViewConfigRef(Rc<ViewConfig>);
+
+impl Deref for ViewConfigRef {
+    type Target = ViewConfig;
+
+    fn deref(&self) -> &Self::Target {
+        &self.0
+    }
+}
+
+impl SessionData {
+    fn error(&self) -> Option<&TableErrorState> {
+        self.state.lost()
+    }
+
+    fn clear_errors(&mut self) {
+        if self.state.lost().is_some() {
+            self.swap(self.state.recovered());
+        }
+    }
+
+    fn swap(&mut self, next: PanelState) {
+        if let Some(state) = self.state.live_mut() {
+            *state = Rc::new(next);
+        }
+    }
+
+    fn table(&self) -> Option<&perspective_client::Table> {
+        self.state.bound().map(|bound| &bound.table)
+    }
+
+    fn pending_table(&self) -> Option<&str> {
+        self.state.awaiting()
+    }
+
+    fn metadata(&self) -> &Rc<SessionMetadata> {
+        match self.state.bound() {
+            Some(bound) => &bound.metadata,
+            None => &self.unbound_metadata,
+        }
+    }
+
+    /// Copy-on-write: a snapshot held elsewhere never observes the mutation.
+    fn metadata_mut(&mut self) -> &mut SessionMetadata {
+        let Some(state) = self.state.live_mut() else {
+            return Rc::make_mut(&mut self.unbound_metadata);
+        };
+
+        let binding = match &mut Rc::make_mut(state).binding {
+            Binding::Lost { prior, .. } => Rc::make_mut(prior),
+            binding => binding,
+        };
+
+        match binding {
+            Binding::Bound(bound) => Rc::make_mut(&mut Rc::make_mut(bound).metadata),
+            _ => Rc::make_mut(&mut self.unbound_metadata),
+        }
+    }
+
+    fn config(&self) -> &ViewConfig {
+        self.state.config()
+    }
+
+    fn set_config(&mut self, config: ViewConfig) {
+        self.swap(self.state.with_config(Rc::new(config)));
+    }
+
+    /// Memo for [`Session::validate_snapshot`]: the [`Description`] the server
+    /// gave for the last validated effective config; an equal snapshot skips
+    /// the round trip.
+    fn description(&self) -> Option<&(Rc<ViewConfig>, Rc<Description>)> {
+        self.state.bound()?.description.as_ref()
+    }
+
+    fn set_description(&mut self, description: Option<(Rc<ViewConfig>, Rc<Description>)>) {
+        self.swap(self.state.with_description(description));
+    }
+
+    fn unbind(&mut self) {
+        self.swap(self.state.unbound());
+    }
 }
 
 #[derive(Clone)]
@@ -255,20 +369,32 @@ impl TableErrorState {
     }
 }
 
+/// How a terminal disposal reports itself to a public run still in flight on
+/// the ejected panel.
+#[derive(Clone, Copy, PartialEq, Eq)]
+pub enum Disposal {
+    /// A separate call destroyed the panel, so a racing public run rejects
+    /// rather than reporting a success it never achieved.
+    Reject,
+
+    /// The ejecting call reports the eviction on its own promise, so a racing
+    /// public run resolves rather than surfacing it twice.
+    Resolve,
+}
+
+impl From<Disposal> for ApiResult<()> {
+    fn from(disposal: Disposal) -> Self {
+        match disposal {
+            Disposal::Reject => Err(ApiError::new("Panel disposed")),
+            Disposal::Resolve => Ok(()),
+        }
+    }
+}
+
 #[derive(Debug, Default)]
 pub enum TableIntermediateState {
     #[default]
     Ejected,
-    Reloaded,
-}
-
-/// The open-load window state (see [`SessionHandle::pending_load`]): the
-/// generation that opened it (for supersession detection) and the raw config
-/// deltas committed while it was open, in commit order, awaiting replay over a
-/// reset base if the payload classifies as a `Table`.
-pub struct PendingLoad {
-    generation: u32,
-    journal: Vec<ViewConfigUpdate>,
 }
 
 /// Options for [`Session::reset`]
@@ -293,19 +419,6 @@ pub struct ResetOptions {
 #[derive(Clone)]
 pub struct Session(Rc<SessionHandle>);
 
-/// RAII spinner accounting for one config-driven pipeline run.
-pub struct ConfigRunToken(Session);
-
-impl Drop for ConfigRunToken {
-    fn drop(&mut self) {
-        let count = self.0.0.in_flight_config_runs.get();
-        debug_assert!(count > 0, "ConfigRunToken underflow");
-        let count = count.saturating_sub(1);
-        self.0.0.in_flight_config_runs.set(count);
-        self.0.run_state_changed.emit(count);
-    }
-}
-
 impl ImplicitClone for Session {}
 
 impl Deref for Session {
@@ -330,21 +443,56 @@ impl Session {
         Self(Rc::default())
     }
 
-    pub(crate) fn metadata(&self) -> MetadataRef<'_> {
-        std::cell::Ref::map(self.borrow(), |x| &x.metadata)
+    pub(crate) fn metadata(&self) -> MetadataRef {
+        MetadataRef(self.borrow().metadata().clone())
     }
 
     pub(crate) fn metadata_mut(&self) -> MetadataMutRef<'_> {
-        std::cell::RefMut::map(self.borrow_mut(), |x| &mut x.metadata)
+        std::cell::RefMut::map(self.borrow_mut(), |x| x.metadata_mut())
     }
 
+    /// The title as the UI and `save()` see it: the committed title, or the
+    /// latest pending rename.
     pub(crate) fn get_title(&self) -> Option<String> {
-        self.borrow().title.clone()
+        let pending = self
+            .0
+            .queue
+            .pending_edits()
+            .into_iter()
+            .filter_map(|delta| match delta {
+                EditDelta::Title(title) => Some(title),
+                _ => None,
+            })
+            .next_back();
+
+        pending.unwrap_or_else(|| self.borrow().state.chrome.title.clone())
     }
 
+    /// Rename this panel — a UI edit, committed by the drain in its turn.
     pub fn set_title(&self, title: Option<String>) {
+        let title = title.filter(|x| !x.is_empty());
+        let session = self.clone();
+        let _ticket = self.submit(
+            OpKind::Edit {
+                delta: EditDelta::Title(title.clone()),
+                swaps_plugin: false,
+            },
+            move |_ctx| {
+                Box::pin(async move {
+                    session.commit_title(title);
+                    Ok(None)
+                })
+            },
+        );
+
+        self.title_changed.emit(self.get_title());
+    }
+
+    /// Write the title NOW.
+    pub(crate) fn commit_title(&self, title: Option<String>) {
         let new_title = title.filter(|x| !x.is_empty());
-        self.borrow_mut().title.clone_from(&new_title);
+        let next = self.borrow().state.with_title(new_title.clone());
+        self.borrow_mut().swap(next);
         self.title_changed.emit(new_title);
     }
 
@@ -354,37 +502,26 @@ impl Session {
     /// `Session`.
     pub fn reset(&self, options: ResetOptions) -> impl Future<Output = ApiResult<()>> + use<> {
         let view = self.0.borrow_mut().view_sub.take();
-        let had_table = self.borrow().table.is_some();
+        let had_table = self.borrow().table().is_some();
         let err = self.get_error();
-        self.borrow_mut().error = None;
+        self.borrow_mut().clear_errors();
         if options.stats {
             self.update_stats(ViewStats::default());
         }
 
         if options.config {
-            self.borrow_mut().config.reset(options.expressions);
+            let mut config = self.borrow().config().clone();
+            config.reset(options.expressions);
+            self.borrow_mut().set_config(config);
         }
 
         if options.expressions {
-            self.borrow_mut().last_validated_expressions = None;
+            self.borrow_mut().set_description(None);
         }
 
         match options.table {
-            Some(TableIntermediateState::Ejected) => {
-                self.borrow_mut().is_loading = false;
-                self.borrow_mut().table = None;
-                self.borrow_mut().pending_table = None;
-                self.borrow_mut().metadata = SessionMetadata::default();
-            },
-            Some(TableIntermediateState::Reloaded) => {
-                self.borrow_mut().is_loading = true;
-                self.borrow_mut().table = None;
-                self.borrow_mut().pending_table = None;
-                self.borrow_mut().metadata = SessionMetadata::default();
-            },
-            _ => {
-                self.borrow_mut().is_loading = false;
-            },
+            Some(TableIntermediateState::Ejected) => self.borrow_mut().unbind(),
+            None => {},
         };
 
         // A config reset that KEEPS its `Table` is itself a commit, and every
@@ -409,56 +546,94 @@ impl Session {
         }
     }
 
-    /// Open a pending-load window (see [`SessionHandle::pending_load`]) at the
-    /// `load()` call site. Bumps the load generation and returns it — the
-    /// caller carries it into the async classification to detect supersession
-    /// by a later `load()`. Sets `is_loading` so a FRESH panel shows the
-    /// spinner while a slow payload resolves (a RELOAD keeps its bound table,
-    /// hence [`TableLoadState::Loaded`], throughout — no spinner flicker).
-    pub fn begin_pending_load(&self) -> u32 {
-        let generation = self.0.load_generation.get() + 1;
-        self.0.load_generation.set(generation);
-        *self.0.pending_load.borrow_mut() = Some(PendingLoad {
-            generation,
-            journal: Vec::new(),
+    /// Submit a writer of this panel's state.
+    pub fn submit(&self, kind: OpKind, step: impl FnOnce(OpCtx) -> StepFuture + 'static) -> Ticket {
+        if let Some(disposal) = self.disposal() {
+            return Ticket::settled(disposal.into());
+        }
+
+        let is_edit = matches!(kind, OpKind::Edit {
+            delta: EditDelta::View(_),
+            ..
         });
-        self.borrow_mut().is_loading = true;
-        generation
+
+        let guard = self.begin_config_run();
+        let (ticket, start) = self.0.queue.push(kind, guard, step);
+        if is_edit {
+            self.notify_view_config_changed();
+        }
+
+        if start {
+            let queue = self.0.queue.clone();
+            let session = self.clone();
+            ApiFuture::spawn_named("op-queue-drain", async move {
+                queue
+                    .drain(move |_exit| session.notify_view_config_changed())
+                    .await;
+
+                Ok(())
+            });
+        }
+
+        ticket
     }
 
-    /// Whether a `load()` payload is still awaiting classification. A `true`
-    /// value makes every config-driven bind DEFER
-    /// ([`crate::tasks::bind_snapshot`]) — the incoming config must never draw
-    /// against the outgoing table.
+    /// Resolves once every op submitted to this panel has settled — its write
+    /// made (or rejected) AND its render landed.
+    pub async fn settle_ops(&self) {
+        self.0.queue.idle().await
+    }
+
+    /// Whether a `load()` is queued or running.
     pub fn has_pending_load(&self) -> bool {
-        self.0.pending_load.borrow().is_some()
-    }
-
-    /// Close the pending-load window for `generation`, returning its journal
-    /// (the raw deltas committed while it was open, in order) for replay.
-    /// Returns `None` when a later `load()` already superseded this one (or it
-    /// was already closed), which the caller treats as "abandon this
-    /// classification, hold the frame". Clears `is_loading` — the
-    /// classification that follows sets the real table state.
-    pub fn take_pending_load(&self, generation: u32) -> Option<Vec<ViewConfigUpdate>> {
-        let mut slot = self.0.pending_load.borrow_mut();
-        if slot.as_ref().map(|p| p.generation) != Some(generation) {
-            return None;
+        self.0.queue.has_load()
+    }
+
+    /// The ONE `Live → Disposed` transition (this session's panel was ejected):
+    /// the state is frozen as its last value, everything queued settles per
+    /// `disposal`, and every later `submit` settles at once.
+    pub(crate) fn dispose(&self, disposal: Disposal) {
+        {
+            let mut data = self.borrow_mut();
+            if let Lifecycle::Live(last) = &data.state {
+                data.state = Lifecycle::Disposed {
+                    last: last.clone(),
+                    disposal,
+                };
+            }
         }
 
-        let journal = slot.take().map(|p| p.journal);
-        drop(slot);
-        self.borrow_mut().is_loading = false;
-        journal
+        self.0.queue.reject_all(disposal.into());
+    }
+
+    /// Take the bound `View` out WITHOUT deleting it, so it can feed a derived
+    /// `Table`, leaving the next bind nothing to dispose of.
+    pub fn take_view_sub(&self) -> Option<ViewSubscription> {
+        self.borrow_mut().view_sub.take()
+    }
+
+    /// Put a subscription taken by [`Self::take_view_sub`] back, for a
+    /// derivation which could not complete.
+    pub fn put_view_sub(&self, sub: ViewSubscription) {
+        self.borrow_mut().view_sub = Some(sub);
+    }
+
+    pub(crate) fn is_disposed(&self) -> bool {
+        self.disposal().is_some()
+    }
+
+    /// This session's disposal, if its panel was ejected.
+    pub(crate) fn disposal(&self) -> Option<Disposal> {
+        self.borrow().state.disposal()
     }
 
     pub(crate) fn has_table(&self) -> Option<TableLoadState> {
         let data = self.borrow();
-        if data.table.is_some() {
+        if data.table().is_some() {
             Some(TableLoadState::Loaded)
-        } else if data.is_loading {
+        } else if self.0.queue.has_load() {
             Some(TableLoadState::Loading)
-        } else if data.pending_table.is_some() {
+        } else if data.pending_table().is_some() {
             Some(TableLoadState::Pending)
         } else {
             None
@@ -466,13 +641,15 @@ impl Session {
     }
 
     pub fn get_table(&self) -> Option<perspective_client::Table> {
-        self.borrow().table.clone()
+        self.borrow().table().cloned()
     }
 
+    /// Look this panel's tables up on `client` — unbinding it from a table of
+    /// any other client's.
     pub fn set_client(&self, client: Client) -> bool {
-        if Some(&client) != self.borrow().client.as_ref() {
-            self.borrow_mut().client = Some(client);
-            self.borrow_mut().table = None;
+        if Some(&client) != self.get_client().as_ref() {
+            let next = self.borrow().state.unbound_on(Some(client));
+            self.borrow_mut().swap(next);
             true
         } else {
             false
@@ -480,13 +657,13 @@ impl Session {
     }
 
     pub fn get_client(&self) -> Option<Client> {
-        self.borrow().client.clone()
+        self.borrow().state.client()
     }
 
     /// The configured table name awaiting a host, if any (see
     /// [`SessionData::pending_table`]).
     pub fn pending_table(&self) -> Option<String> {
-        self.borrow().pending_table.clone()
+        self.borrow().pending_table().map(str::to_owned)
     }
 
     /// Suspend a BOUND table to PENDING: delete the `View`, drop the `Table`
@@ -496,60 +673,35 @@ impl Session {
     /// as it was when the name is hosted again. `None` when no table is
     /// bound.
     pub fn suspend_table(&self) -> Option<impl Future<Output = ApiResult<()>> + use<>> {
-        let name = self.borrow().table.as_ref()?.get_name().to_owned();
+        let name = self.borrow().table()?.get_name().to_owned();
+        let client = self.get_client()?;
         let fut = self.reset(ResetOptions {
             table: Some(TableIntermediateState::Ejected),
             stats: true,
             ..ResetOptions::default()
         });
 
-        self.borrow_mut().pending_table = Some(name);
+        let next = self.borrow().state.awaiting_table(client, name);
+        self.borrow_mut().swap(next);
         Some(fut)
     }
 
-    /// Reset this `Session`'s state with a new `Table`.  Implicitly clears the
-    /// `ViewSubscription`, which will need to be re-initialized later via
-    /// `create_view()`.
-    ///
-    /// # Arguments
-    ///
-    /// - `table_name` The name of the `Table` to load.
-    ///
-    /// # Returns
-    ///
-    /// `table_name` is unique per `Client`, so if this value has not changed,
-    /// `Session::set_table` does nothing and returns `Ok(false)`.
-    ///
-    /// A name no loaded client hosts pends ([`MissingTable::Pend`]) and
-    /// returns `Ok(false)` until the table lifecycle re-runs the bind.
-    pub async fn set_table(&self, table_name: String) -> ApiResult<bool> {
-        if Some(table_name.as_str()) == self.0.borrow().table.as_ref().map(|x| x.get_name()) {
-            self.0.borrow_mut().pending_table = None;
-            return Ok(false);
-        }
-
-        let client = self.0.borrow().client.clone().into_apierror()?;
-        match probe_table(&client, &table_name, MissingTable::Pend).await? {
-            Some(table) => match self.bind_table(table).await {
-                Ok(()) => Ok(true),
-                Err(err) => self.set_error(false, err).await.map(|_| false),
-            },
-            None => {
-                self.pend_table(table_name).await?;
-                Ok(false)
-            },
-        }
-    }
-
-    /// Bind an opened `Table`, replacing any previous binding and announcing
-    /// `table_loaded`.
-    pub(crate) async fn bind_table(&self, table: perspective_client::Table) -> ApiResult<()> {
-        let metadata = SessionMetadata::from_table(&table).await?;
-        let client = table.get_client();
+    /// Record a connection error on `client` as this panel's lost binding — for
+    /// as long as `client` is the one the panel is bound through.
+    async fn watch_client(&self, client: &Client) -> ApiResult<()> {
         let on_error = self.on_table_errored.borrow().clone();
         let session = self.clone();
+        let watched = client.clone();
         let poll_loop = LocalPollLoop::new(move |(message, reconnect): (ApiError, _)| {
-            session.borrow_mut().error = Some(TableErrorState(message, reconnect));
+            if session.get_client().as_ref() != Some(&watched) {
+                return Ok(JsValue::UNDEFINED);
+            }
+
+            let next = session
+                .borrow()
+                .state
+                .with_lost(TableErrorState(message, reconnect));
+            session.borrow_mut().swap(next);
             if let Some(cb) = &on_error {
                 cb.emit(());
             }
@@ -570,29 +722,9 @@ impl Session {
             }))
             .await?;
 
-        let sub = self.borrow_mut().view_sub.take();
-        self.borrow_mut().metadata = metadata;
-        self.borrow_mut().table = Some(table);
-        self.borrow_mut().pending_table = None;
-        self.borrow_mut().is_loading = false;
-        self.borrow_mut().last_validated_expressions = None;
-        sub.delete().await?;
-        self.table_loaded.emit(());
         Ok(())
     }
 
-    /// Record `name` as pending, dropping any bound `Table` so nothing binds
-    /// against the outgoing table while the name waits for a host.
-    pub(crate) async fn pend_table(&self, name: String) -> ApiResult<()> {
-        let sub = self.borrow_mut().view_sub.take();
-        self.borrow_mut().table = None;
-        self.borrow_mut().metadata = SessionMetadata::default();
-        self.borrow_mut().pending_table = Some(name);
-        self.borrow_mut().is_loading = false;
-        self.borrow_mut().last_validated_expressions = None;
-        sub.delete().await
-    }
-
     pub async fn set_error(&self, reset_table: bool, err: ApiError) -> ApiResult<()> {
         let session = self.clone();
         let poll_loop = LocalPollLoop::new(move |()| {
@@ -604,7 +736,7 @@ impl Session {
             Ok(JsValue::UNDEFINED)
         });
 
-        self.borrow_mut().error = Some(TableErrorState(
+        let error = TableErrorState(
             err.clone(),
             Some(ReconnectCallback::new(move || {
                 clone!(poll_loop);
@@ -613,7 +745,10 @@ impl Session {
                     Ok(())
                 })
             })),
-        ));
+        );
+
+        let next = self.borrow().state.with_lost(error);
+        self.borrow_mut().swap(next);
 
         if let Some(cb) = self.on_table_errored.borrow().as_ref() {
             cb.emit(());
@@ -621,7 +756,7 @@ impl Session {
 
         let sub = self.borrow_mut().view_sub.take();
         if reset_table {
-            self.borrow_mut().table = None;
+            self.borrow_mut().unbind();
         }
 
         sub.delete().await?;
@@ -651,24 +786,38 @@ impl Session {
     }
 
     pub fn js_get_table(&self) -> Option<JsValue> {
-        Some(perspective_js::Table::from(self.borrow().table.clone()?).into())
+        Some(perspective_js::Table::from(self.borrow().table().cloned()?).into())
     }
 
+    /// Whether the binding is lost.
     pub(crate) fn is_errored(&self) -> bool {
-        self.borrow().error.is_some()
+        self.borrow().error().is_some()
     }
 
     pub(crate) fn get_error(&self) -> Option<ApiError> {
-        self.borrow().error.as_ref().map(|x| x.0.clone())
+        self.borrow().error().map(|x| x.0.clone())
     }
 
+    /// Recover from an error state (the overlay's button) — a writer, so an op
+    /// on the queue like any other.
     pub async fn reconnect(&self) -> ApiResult<()> {
-        let err = self.borrow().error.clone();
+        let session = self.clone();
+        self.submit(OpKind::Restore { update: None }, move |_ctx| {
+            Box::pin(async move {
+                session.reconnect_step().await?;
+                Ok(None)
+            })
+        })
+        .settle()
+        .await
+    }
+
+    async fn reconnect_step(&self) -> ApiResult<()> {
+        let err = self.borrow().error().cloned();
         if let Some(TableErrorState(_, Some(reconnect))) = err {
             reconnect().await?;
-            self.borrow_mut().is_loading = false;
-            self.borrow_mut().error = None;
-            self.borrow_mut().last_validated_expressions = None;
+            self.borrow_mut().clear_errors();
+            self.borrow_mut().set_description(None);
             self.borrow_mut().view_sub = None;
             self.table_loaded.emit(());
         }
@@ -704,36 +853,93 @@ impl Session {
             .is_some_and(|s| s.num_table_cells.is_some())
     }
 
-    pub fn get_view_config(&'_ self) -> Ref<'_, ViewConfig> {
-        Ref::map(self.borrow(), |x| &x.config)
+    /// The view config as the UI and `save()` see it: the committed config with
+    /// every pending UI edit applied, in submit order.
+    pub fn get_view_config(&self) -> ViewConfigRef {
+        ViewConfigRef(self.projected())
     }
 
-    /// The effective [`ViewConfig`] the `View` is built from: the stored config
-    /// with the transient element-level [`SessionData::global_filter`] clauses
-    /// appended. Used at view-creation only; the stored `config` (hence
-    /// `savePanel`/the settings UI) is unaffected.
-    fn effective_view_config(&self) -> ViewConfig {
-        let data = self.borrow();
-        if data.global_filter.is_empty() {
-            return data.config.clone();
+    /// The COMMITTED view config — what a running op must read, since the edits
+    /// still queued behind it have not happened yet.
+    pub fn committed_view_config(&self) -> ViewConfigRef {
+        ViewConfigRef(self.borrow().state.config().clone())
+    }
+
+    fn projected(&self) -> Rc<ViewConfig> {
+        let committed = self.borrow().state.config().clone();
+        let edits = self
+            .0
+            .queue
+            .pending_edits()
+            .into_iter()
+            .filter_map(|delta| match delta {
+                EditDelta::View(delta) => Some(*delta),
+                _ => None,
+            })
+            .collect::<Vec<_>>();
+
+        if edits.is_empty() {
+            return committed;
         }
 
-        let mut config = data.config.clone();
-        config.filter.extend(data.global_filter.iter().cloned());
-        config
+        let mut config = (*committed).clone();
+        for delta in edits {
+            let mut candidate = config.clone();
+            if candidate.apply_update(delta) && self.validate_names(&candidate).is_ok() {
+                self.normalize_view_config(&mut candidate);
+                config = candidate;
+            }
+        }
+
+        Rc::new(config)
     }
 
-    /// Replace the transient element-level global filters and re-render the
-    /// view (no-op if unchanged). These are applied on top of the panel's
-    /// own config at view-creation but never persisted into it.
-    pub fn set_global_filter(&self, filter: Vec<Filter>) -> bool {
-        if self.borrow().global_filter != filter {
-            self.borrow_mut().global_filter = filter;
-            self.notify_view_config_changed();
-            true
-        } else {
-            false
+    /// Whether `delta` is an edit the UI may submit: SYNCHRONOUS validation
+    /// against the projection, so an invalid edit is refused at the control
+    /// that made it.
+    pub fn check_edit(&self, delta: &ViewConfigUpdate) -> ApiResult<()> {
+        if let Some(x) = self.borrow().state.lost() {
+            return Err(ApiError::new(x.0.clone()));
+        }
+
+        let mut candidate = (*self.projected()).clone();
+        if candidate.apply_update(delta.clone()) {
+            self.validate_names(&candidate)?;
         }
+
+        Ok(())
+    }
+
+    /// The effective [`ViewConfig`] the `View` is built from — the one the
+    /// committed description describes.
+    fn effective_view_config(&self) -> Rc<ViewConfig> {
+        let data = self.borrow();
+        if let Some((effective, _)) = data.description() {
+            return effective.clone();
+        }
+
+        let metadata = data.metadata().clone();
+        let (config, _) = effective(data.config(), &data.state.overlay, &|name| {
+            metadata.get_column_table_type(name)
+        });
+
+        Rc::new(config)
+    }
+
+    /// The overlay clauses this panel's table cannot honor, by index — a column
+    /// it lacks, or has with another type.
+    pub fn skipped_overlay(&self) -> Vec<usize> {
+        let data = self.borrow();
+        let metadata = data.metadata().clone();
+        effective(data.config(), &data.state.overlay, &|name| {
+            metadata.get_column_table_type(name)
+        })
+        .1
+    }
+
+    /// The element's global filter as last broadcast to this panel.
+    pub(crate) fn committed_overlay(&self) -> Rc<Vec<OverlayClause>> {
+        self.borrow().state.overlay.clone()
     }
 
     /// Snapshot of the [`ViewConfig`] the currently-bound `View` was
@@ -742,9 +948,8 @@ impl Session {
     ///
     /// Prefer this over [`Self::get_view_config`] when you need a
     /// value consistent with what the active plugin is rendering.
-    /// `get_view_config` returns the live config, which is mutated
-    /// synchronously by [`Self::commit_view_config`] ahead of the next
-    /// queued run and so may temporarily disagree with the bound `View`.
+    /// `get_view_config` returns the PROJECTED config — committed state plus
+    /// pending edits — which runs ahead of the bound `View`.
     pub fn get_rendered_view_config(&self) -> Option<Rc<ViewConfig>> {
         self.borrow().view_sub.as_ref().map(|s| s.get_view_config())
     }
@@ -755,7 +960,7 @@ impl Session {
         config_static: &PluginStaticConfig,
     ) {
         use self::column_defaults_update::*;
-        let config = self.get_view_config();
+        let config = self.committed_view_config();
         config_update.set_update_column_defaults(
             &self.metadata(),
             &config,
@@ -777,72 +982,18 @@ impl Session {
         use self::column_defaults_update::*;
         config_update.set_update_rollup_defaults(
             &self.metadata(),
-            &self.get_view_config(),
+            &self.committed_view_config(),
             config_static,
         )
     }
 
-    /// Apply a `ViewConfigUpdate` to the live config — the ONLY view-config
-    /// mutator (invariant I1: synchronous and total; no `await` separates any
-    /// read of the config from this write, so a lost update is
-    /// unrepresentable).
-    ///
-    /// Validation is SYNCHRONOUS and happens before anything is applied: an
-    /// update naming an unknown column is rejected with `Err` and the config
-    /// is untouched (I4 — invalid state is never entered, so no rollback
-    /// path exists). Server-side expression compilation is deliberately NOT
-    /// checked here; it is a property of a pipeline run
-    /// ([`Self::validate_snapshot`]) and fails that run, never the commit.
-    pub fn commit_view_config(&self, config_update: ViewConfigUpdate) -> ApiResult<()> {
-        if let Some(x) = self.borrow().error.as_ref() {
-            tracing::warn!("Errored state");
-
-            // Load bearing return
-            return Err(ApiError::new(x.0.clone()));
-        }
-
-        // A `load()` is classifying its payload (see
-        // [`SessionHandle::pending_load`]): record the RAW delta so a `Table`
-        // classification can replay it over the reset base, validated against
-        // the INCOMING table's schema. The live apply below is a best-effort
-        // preview (kept for `save()` coherence, I1) that SKIPS name validation
-        // — the delta may legitimately name the incoming table's columns,
-        // absent from the outgoing one — mirroring the "no table bound yet"
-        // leniency already in `validate_names`. Authoritative validation is
-        // deferred to the replay.
-        let pending = self.has_pending_load();
-        let mut candidate = self.borrow().config.clone();
-        let journal_entry = pending.then(|| config_update.clone());
-        if !candidate.apply_update(config_update) {
-            return Ok(());
-        }
-
-        if let Some(entry) = journal_entry
-            && let Some(p) = self.0.pending_load.borrow_mut().as_mut()
-        {
-            p.journal.push(entry);
-        }
-
-        if !pending {
-            self.validate_names(&candidate)?;
-        }
-
-        self.normalize_view_config(&mut candidate);
-        self.borrow_mut().config = candidate;
-        self.notify_view_config_changed();
-        Ok(())
-    }
-
-    /// Table-bind commit: normalize the (possibly empty) config against the
-    /// newly-bound table's metadata — the default-view materialization that
-    /// previously happened inside the async validate write-back. SYNC;
-    /// called immediately after `set_table().await` inside the binding run,
-    /// so it is ordered like any other commit.
-    pub fn commit_table_defaults(&self) {
-        let mut candidate = self.borrow().config.clone();
+    /// Re-normalize the config against the bound table's metadata — the
+    /// default-view materialization after a config reset that keeps its table.
+    fn commit_table_defaults(&self) {
+        let mut candidate = self.borrow().config().clone();
         self.normalize_view_config(&mut candidate);
-        if candidate != self.borrow().config {
-            self.borrow_mut().config = candidate;
+        if candidate != *self.borrow().config() {
+            self.borrow_mut().set_config(candidate);
             self.notify_view_config_changed();
         }
     }
@@ -854,7 +1005,13 @@ impl Session {
     /// when no table is bound yet: the config rides along until `load()`
     /// binds one, and the engine surfaces any residual error on that run.
     fn validate_names(&self, config: &ViewConfig) -> ApiResult<()> {
-        let table_columns = self.all_columns();
+        Self::validate_names_with(&self.metadata(), config)
+    }
+
+    /// [`Self::validate_names`] against an explicit table's metadata — the
+    /// INCOMING table's, for a restore that binds one.
+    fn validate_names_with(metadata: &SessionMetadata, config: &ViewConfig) -> ApiResult<()> {
+        let table_columns = Self::columns_of(metadata);
         if table_columns.is_empty() {
             return Ok(());
         }
@@ -897,7 +1054,11 @@ impl Session {
     /// write-back): fill empty `columns` from the table, prune `aggregates`
     /// to referenced columns.
     fn normalize_view_config(&self, config: &mut ViewConfig) {
-        let table_columns = self.all_columns();
+        Self::normalize_with(&self.metadata(), config)
+    }
+
+    fn normalize_with(metadata: &SessionMetadata, config: &mut ViewConfig) {
+        let table_columns = Self::columns_of(metadata);
         if table_columns.is_empty() {
             return;
         }
@@ -927,19 +1088,10 @@ impl Session {
     /// [`Self::settle_dispatches`]. Used by the `perspective-config-update`
     /// dispatcher, whose landing `flush()` must be able to await.
     pub fn track_dispatch(&self, fut: impl std::future::Future<Output = ApiResult<()>> + 'static) {
-        self.0
-            .pending_dispatches
-            .set(self.0.pending_dispatches.get() + 1);
-        let session = self.clone();
+        let guard = self.0.dispatches.guard();
         ApiFuture::spawn_named("config-update-dispatch", async move {
-            let result = fut.await;
-            let remaining = session.0.pending_dispatches.get() - 1;
-            session.0.pending_dispatches.set(remaining);
-            if remaining == 0 {
-                session.0.dispatches_settled.emit(());
-            }
-
-            if let Err(e) = result {
+            let _guard = guard;
+            if let Err(e) = fut.await {
                 tracing::error!("[config-update dispatch] {}", e);
             }
 
@@ -950,10 +1102,7 @@ impl Session {
     /// Resolve once every in-flight tracked dispatch for this panel has
     /// landed. Immediate when none are pending.
     pub async fn settle_dispatches(&self) -> ApiResult<()> {
-        while self.0.pending_dispatches.get() > 0 {
-            self.0.dispatches_settled.read_next().await?;
-        }
-
+        self.0.dispatches.settle().await;
         Ok(())
     }
 
@@ -973,26 +1122,10 @@ impl Session {
     }
 
     /// Begin spinner accounting for ONE config-driven pipeline run: call
-    /// immediately after the run's commit, and move the returned token INTO
-    /// the run future. `Drop` settles it on every exit — completion, error,
-    /// cancellation, and runs that never reach `bind_view` (the
-    /// deferred-draw restore) — so, unlike edge-counting PubSub pairs, the
-    /// count cannot strand by construction.
-    /// [`SessionHandle::run_state_changed`] broadcasts the ABSOLUTE count
-    /// on both edges.
-    pub fn begin_config_run(&self) -> ConfigRunToken {
-        let count = self.0.in_flight_config_runs.get() + 1;
-        self.0.in_flight_config_runs.set(count);
-        self.run_state_changed.emit(count);
-        ConfigRunToken(self.clone())
-    }
-
-    /// The number of config-driven pipeline runs currently in flight (see
-    /// [`Self::begin_config_run`]). Read directly when (re)targeting a
-    /// panel — level-triggered consumers initialize from this and then
-    /// track [`SessionHandle::run_state_changed`].
-    pub fn in_flight_config_runs(&self) -> u32 {
-        self.0.in_flight_config_runs.get()
+    /// immediately after the run's commit, and move the returned guard INTO
+    /// the run future.
+    pub fn begin_config_run(&self) -> InFlightGuard {
+        self.0.config_runs.guard()
     }
 
     /// Read the cached `ColumnStats` for a column. Returns `None` if no
@@ -1031,53 +1164,336 @@ impl Session {
     /// that preceded run *N*'s completion (invariant I3).
     pub fn snapshot(&self, _guard: &RenderGuard) -> ConfigSnapshot {
         ConfigSnapshot {
-            config: Rc::new(self.borrow().config.clone()),
-            effective: Rc::new(self.effective_view_config()),
+            config: self.borrow().state.config().clone(),
+            effective: self.effective_view_config(),
         }
     }
 
-    /// Validate a snapshot's expressions against the server (the only
-    /// inherently-async validation), updating the metadata expression
-    /// schema. Reads nothing from — and writes nothing to — the live
-    /// config; a failure fails this RUN, never the committed config (I4).
-    ///
-    /// Memoized: when the snapshot's expressions equal the last successfully
-    /// validated set, the round trip is skipped entirely — safe because the
-    /// memo key is an immutable snapshot field and the recorded set is
-    /// written only under the draw lock.
+    /// Validate a snapshot against the server with `Table::describe`, failing
+    /// this run and never the committed config.
     pub async fn validate_snapshot(
         &self,
         _guard: &RenderGuard,
         snap: ConfigSnapshot,
     ) -> ApiResult<ValidatedSnapshot> {
-        let memo_hit =
-            self.borrow().last_validated_expressions.as_ref() == Some(&snap.effective.expressions);
-        if !memo_hit {
-            let supports_expressions = self
-                .metadata()
-                .get_features()
-                .map(|x| x.expressions)
-                .unwrap_or_default();
-
-            if supports_expressions {
-                let table = self
-                    .borrow()
-                    .table
-                    .as_ref()
-                    .ok_or_else(|| apierror!(NoTableError))?
-                    .clone();
-
-                let valid_recs = table
-                    .validate_expressions(snap.effective.expressions.clone())
-                    .await?;
+        let (description, fresh) = self.describe_effective(&snap.effective).await?;
+        if fresh {
+            tracing::warn!("Rendering a commit that was not described");
+            Self::record_description(&mut self.metadata_mut(), &snap.effective, &description)?;
+            self.borrow_mut()
+                .set_description(Some((snap.effective.clone(), description.clone())));
+        }
+
+        Ok(ValidatedSnapshot { snap })
+    }
+
+    /// The server's [`Description`] of `effective`, and whether it took a round
+    /// trip (`false` when the memo already held it).
+    async fn describe_effective(
+        &self,
+        effective: &Rc<ViewConfig>,
+    ) -> ApiResult<(Rc<Description>, bool)> {
+        let memo = self
+            .borrow()
+            .description()
+            .cloned()
+            .filter(|(key, _)| **key == **effective)
+            .map(|(_, description)| description);
+
+        if let Some(description) = memo {
+            return Ok((description, false));
+        }
+
+        let table = self
+            .borrow()
+            .table()
+            .cloned()
+            .ok_or_else(|| apierror!(NoTableError))?;
+
+        Self::describe_with(&table, &self.metadata(), effective)
+            .await
+            .map(|description| (description, true))
+    }
+
+    /// `table`'s [`Description`] of `effective`, with validation failures as
+    /// the errors a `restore()` rejects with.
+    async fn describe_with(
+        table: &perspective_client::Table,
+        metadata: &SessionMetadata,
+        effective: &Rc<ViewConfig>,
+    ) -> ApiResult<Rc<Description>> {
+        let engine_config = Self::with_default_aggregates_of(metadata, effective);
+        match table.describe(engine_config.into()).await? {
+            Ok(description) => Ok(Rc::new(description)),
+            Err(DescribeError::Expressions {
+                expression_schema,
+                errors,
+            }) => Err(apierror!(InvalidViewerConfigExpressionsError(Rc::new(
+                ExprValidationResult {
+                    expression_schema,
+                    errors,
+                    expression_alias: effective.expressions.0.clone(),
+                }
+            )))),
+            Err(DescribeError::Config(msg)) => Err(ApiError::new(msg)),
+        }
+    }
+
+    /// The PREPARE half of a transactional restore's view of the panel: the
+    /// binding `plan` resolved, and the config it leaves — the committed one (a
+    /// default one, for a plan that resets) with `update` applied —
+    /// name-checked, normalized and DESCRIBED by the table it will be bound to.
+    pub(crate) async fn prepare_view(
+        &self,
+        plan: BindPlan,
+        mut update: ViewConfigUpdate,
+        defaults: ViewDefaults<'_>,
+        overlay: Option<Rc<Vec<OverlayClause>>>,
+    ) -> ApiResult<PreparedView> {
+        if self.is_disposed() {
+            return Err(ApiError::new("Panel disposed"));
+        }
+
+        if matches!(plan, BindPlan::Keep)
+            && let Some(error) = self.borrow().state.lost()
+        {
+            return Err(error.0.clone());
+        }
+
+        let committed = self.borrow().state.config().clone();
+        let base = match &plan {
+            BindPlan::Bind { reset: true, .. } | BindPlan::Pend { reset: true, .. } => {
+                Rc::new(ViewConfig::default())
+            },
+            _ => committed.clone(),
+        };
+
+        let (binding, checked) = match plan {
+            BindPlan::Keep => {
+                let bound = self.borrow().state.bound().cloned();
+                (
+                    PreparedBinding::Keep,
+                    bound.map(|bound| (bound.table.clone(), bound.metadata.clone())),
+                )
+            },
+            BindPlan::Bind { table, client, .. } => {
+                let metadata = Rc::new(SessionMetadata::from_table(&table).await?);
+                let binding = PreparedBinding::Bind {
+                    client: client.clone(),
+                    table: table.clone(),
+                    metadata: metadata.clone(),
+                };
+
+                (binding, Some((*table, metadata)))
+            },
+            BindPlan::Pend { client, name, .. } => (PreparedBinding::Pend { client, name }, None),
+        };
+
+        {
+            use self::column_defaults_update::*;
+            let metadata = match &checked {
+                Some((_, metadata)) => metadata.clone(),
+                None => self.borrow().metadata().clone(),
+            };
+
+            match defaults {
+                ViewDefaults::Swap(plugin) => {
+                    update.set_update_column_defaults(&metadata, &base, &base.columns, plugin)
+                },
+                ViewDefaults::Rollup(plugin) => {
+                    update.set_update_rollup_defaults(&metadata, &base, plugin)
+                },
+                ViewDefaults::AsGiven => {},
+            }
+        }
+
+        let mut candidate = (*base).clone();
+        candidate.apply_update(update);
+        if let Some((_, metadata)) = &checked {
+            Self::validate_names_with(metadata, &candidate)?;
+            Self::normalize_with(metadata, &mut candidate);
+        }
+
+        let config = if candidate == *committed {
+            committed.clone()
+        } else {
+            Rc::new(candidate)
+        };
+
+        let changed = !Rc::ptr_eq(&config, &committed);
+        let clauses = overlay
+            .clone()
+            .unwrap_or_else(|| self.borrow().state.overlay.clone());
+
+        let (effective, description) = match &checked {
+            None => (config.clone(), None),
+            Some((table, metadata)) => {
+                let on_expression = clauses
+                    .iter()
+                    .any(|x| config.expressions.0.contains_key(x.filter.column()));
+
+                let bare = if on_expression {
+                    Some(Self::describe_with(table, metadata, &config).await?)
+                } else {
+                    None
+                };
+
+                let (effective, _) = effective(&config, &clauses, &|name| {
+                    metadata.get_table_schema_type(name).or_else(|| {
+                        bare.as_ref()
+                            .and_then(|x| x.expression_schema.get(name).copied())
+                    })
+                });
+
+                let effective = if effective == *config {
+                    config.clone()
+                } else {
+                    Rc::new(effective)
+                };
+
+                let description = match (&binding, bare) {
+                    (_, Some(bare)) if Rc::ptr_eq(&effective, &config) => bare,
+                    (PreparedBinding::Keep, _) => self.describe_effective(&effective).await?.0,
+                    _ => Self::describe_with(table, metadata, &effective).await?,
+                };
+
+                (effective, Some(description))
+            },
+        };
+
+        Ok(PreparedView {
+            binding,
+            overlay,
+            config,
+            effective,
+            description,
+            changed,
+            announce: true,
+        })
+    }
+
+    /// The COMMIT half of [`Self::prepare_view`], as one swap of this session's
+    /// state.
+    pub(crate) fn commit_view(
+        &self,
+        view: PreparedView,
+        title: Option<Option<String>>,
+    ) -> BindingEffects {
+        let state = self.borrow().state.clone();
+        let title_before = state.chrome.title.clone();
+        let had_table = state.bound().is_some();
+        let (rebound, watch) = match view.binding {
+            PreparedBinding::Keep => (None, None),
+            PreparedBinding::Bind {
+                client,
+                table,
+                metadata,
+            } => (
+                Some(state.bound_to(*table, (*metadata).clone())),
+                Some(client),
+            ),
+            PreparedBinding::Pend { client, name } => {
+                (Some(state.awaiting_table(client, name)), None)
+            },
+        };
+
+        let rebinds = rebound.is_some();
+        let mut next = rebound.unwrap_or_else(|| (*state).clone());
+        next = next.with_config(view.config.clone());
+        if let Some(overlay) = view.overlay {
+            next = next.with_overlay(overlay);
+        }
 
-                self.metadata_mut().update_expressions(&valid_recs)?;
+        if let Some(description) = view.description {
+            if let Some(bound) = next.bound() {
+                let mut metadata = (*bound.metadata).clone();
+                if Self::record_description(&mut metadata, &view.effective, &description).is_ok() {
+                    next = next.with_metadata(Rc::new(metadata));
+                }
             }
 
-            self.borrow_mut().last_validated_expressions = Some(snap.effective.expressions.clone());
+            next = next.with_description(Some((view.effective, description)));
+        }
+
+        let next = match title {
+            Some(title) => next.with_title(title),
+            None => next,
+        };
+
+        let title_after = next.chrome.title.clone();
+        let bound = next.bound().is_some();
+        self.borrow_mut().swap(next);
+        let outgoing = if rebinds {
+            self.borrow_mut().view_sub.take()
+        } else {
+            None
+        };
+
+        if rebinds {
+            self.update_stats(ViewStats::default());
+        }
+
+        if (view.changed && view.announce) || rebinds {
+            self.notify_view_config_changed();
         }
 
-        Ok(ValidatedSnapshot(snap))
+        if title_before != title_after {
+            self.title_changed.emit(title_after);
+        }
+
+        BindingEffects {
+            rebinds,
+            outgoing,
+            unloaded: rebinds && had_table,
+            loaded: rebinds && bound,
+            watch,
+        }
+    }
+
+    /// Everything the metadata derives from a [`Description`] of `effective`:
+    /// the expression types, the types the `View` will have, and the window
+    /// columns.
+    fn record_description(
+        metadata: &mut SessionMetadata,
+        effective: &ViewConfig,
+        description: &Description,
+    ) -> ApiResult<()> {
+        metadata.update_expressions(&ExprValidationResult {
+            expression_schema: description.expression_schema.clone(),
+            errors: HashMap::new(),
+            expression_alias: effective.expressions.0.clone(),
+        })?;
+
+        metadata.update_view_schema(&description.view_schema)?;
+        metadata.update_windows(&effective.windows)?;
+        Ok(())
+    }
+
+    /// Finish a committed rebind: dispose of the outgoing `View`, announce the
+    /// table change, and watch the incoming client for errors.
+    pub(crate) async fn finish_binding(&self, effects: BindingEffects) -> ApiResult<()> {
+        let BindingEffects {
+            outgoing,
+            unloaded,
+            loaded,
+            watch,
+            ..
+        } = effects;
+
+        let deleted = outgoing.delete().await;
+        if unloaded {
+            self.table_unloaded.emit(true);
+        }
+
+        if let Some(client) = watch {
+            self.watch_client(&client).await?;
+        }
+
+        if loaded {
+            self.table_loaded.emit(());
+        }
+
+        deleted
     }
 
     /// Bind the engine `View` for a validated snapshot: SKIP
@@ -1105,7 +1521,9 @@ impl Session {
             }
         }
 
-        let ConfigSnapshot { config, effective } = validated.0;
+        let ValidatedSnapshot {
+            snap: ConfigSnapshot { config, effective },
+        } = validated;
         if self.borrow().is_paused {
             // A paused bind still RECONCILES the committed config (no `View`
             // is constructed — `view_created` stays silent). Without this
@@ -1121,8 +1539,7 @@ impl Session {
             return Ok(unchanged_or_deferred(self));
         }
 
-        let needs_schema = !self.metadata().has_view_schema();
-        if !needs_schema {
+        {
             let bound = self.borrow().view_sub.as_ref().map(|x| x.build_config());
             if let Some(bound) = bound {
                 if *bound == *effective {
@@ -1146,15 +1563,12 @@ impl Session {
 
         let table = self
             .borrow()
-            .table
-            .clone()
+            .table()
+            .cloned()
             .ok_or("`restore()` called before `load()`")?;
 
         let view_config = self.with_default_aggregates(&effective);
         let view = table.view(Some(view_config.into())).await?;
-        let view_schema = view.schema().await?;
-        self.metadata_mut().update_view_schema(&view_schema)?;
-        self.metadata_mut().update_windows(&effective.windows)?;
         let on_stats = Callback::from({
             let this = self.clone();
             move |stats| this.update_stats(stats)
@@ -1185,6 +1599,13 @@ impl Session {
     /// The engine config for a `View` built from `effective`, per-column
     /// default aggregates filled in as a courtesy to the virtual server API.
     fn with_default_aggregates(&self, effective: &ViewConfig) -> ViewConfig {
+        Self::with_default_aggregates_of(&self.metadata(), effective)
+    }
+
+    fn with_default_aggregates_of(
+        metadata: &SessionMetadata,
+        effective: &ViewConfig,
+    ) -> ViewConfig {
         let mut view_config = effective.clone();
         for col in view_config
             .columns
@@ -1193,15 +1614,14 @@ impl Session {
             .chain(view_config.sort.iter().map(|x| &x.0))
         {
             if !view_config.aggregates.contains_key(col.as_str()) {
-                let agg = self
-                    .metadata()
+                let agg = metadata
                     .get_column_aggregates(col.as_str())
                     .and_then(|mut aggs| aggs.next())
                     .into_apierror();
 
                 match agg {
                     Err(_) => {
-                        tracing::warn!("No default aggregate for column '{}' found, skipping", col)
+                        tracing::debug!("No default aggregate for column '{}' found, skipping", col)
                     },
                     Ok(agg) => _ = view_config.aggregates.insert(col.to_string(), agg),
                 };
@@ -1214,43 +1634,29 @@ impl Session {
     /// Build a caller-owned `View` from the effective config outside the
     /// render pipeline, with no subscription and no interaction with pause.
     pub async fn create_detached_view(&self) -> ApiResult<View> {
-        let table = self.borrow().table.clone().ok_or("No `Table` set")?;
+        let table = self.borrow().table().cloned().ok_or("No `Table` set")?;
         let view_config = self.with_default_aggregates(&self.effective_view_config());
         Ok(table.view(Some(view_config.into())).await?)
     }
 
-    /// Record a failed pipeline run: error state plus a reconnect affordance
-    /// that resets the config (the error screen's reset button). Replaces
-    /// the old `validate()` error path — the committed config is NOT rolled
-    /// back (I4: it holds exactly what the caller committed; the failure
-    /// belongs to the run).
-    pub async fn set_run_error(&self, err: ApiError) -> ApiResult<()> {
+    /// Reset the config a failed draw could not render, as one queued op.
+    pub async fn reset_failed_config(&self) -> ApiResult<()> {
         let session = self.clone();
-        let poll_loop = LocalPollLoop::new(move |()| {
-            ApiFuture::spawn(session.reset(ResetOptions {
-                config: true,
-                expressions: true,
-                ..ResetOptions::default()
-            }));
-            Ok(JsValue::UNDEFINED)
-        });
-
-        self.borrow_mut().error = Some(TableErrorState(
-            err.clone(),
-            Some(ReconnectCallback::new(move || {
-                clone!(poll_loop);
-                Box::pin(async move {
-                    poll_loop.poll(()).await;
-                    Ok(())
-                })
-            })),
-        ));
-
-        if let Some(cb) = self.on_table_errored.borrow().as_ref() {
-            cb.emit(());
-        }
+        self.submit(OpKind::Restore { update: None }, move |_ctx| {
+            Box::pin(async move {
+                session
+                    .reset(ResetOptions {
+                        config: true,
+                        expressions: true,
+                        ..ResetOptions::default()
+                    })
+                    .await?;
 
-        Err(err)
+                Ok(None)
+            })
+        })
+        .settle()
+        .await
     }
 
     fn update_stats(&self, stats: ViewStats) {
@@ -1262,8 +1668,8 @@ impl Session {
         self.stats_changed.emit(());
     }
 
-    fn all_columns(&self) -> Vec<String> {
-        self.metadata()
+    fn columns_of(metadata: &SessionMetadata) -> Vec<String> {
+        metadata
             .get_table_columns()
             .into_iter()
             .flatten()
@@ -1276,6 +1682,8 @@ impl Session {
     /// session-related PubSub event fires.
     pub fn to_props(&self) -> SessionProps {
         let column_stats = PtrEqRc::new(self.column_stats.borrow().clone());
+        let projected = self.projected();
+        let title = self.get_title();
         let data = self.borrow();
 
         // Reuse memoized snapshots when the underlying value hasn't
@@ -1285,15 +1693,15 @@ impl Session {
         // these `PtrEqRc`s will spuriously refire.
         let config = {
             let mut cached = self.cached_config.borrow_mut();
-            if !matches!(&*cached, Some(c) if **c == data.config) {
-                *cached = Some(PtrEqRc::new(data.config.clone()));
+            if !matches!(&*cached, Some(c) if **c == *projected) {
+                *cached = Some(PtrEqRc::new((*projected).clone()));
             }
             cached.clone().unwrap()
         };
         let metadata = {
             let mut cached = self.cached_metadata.borrow_mut();
-            if !matches!(&*cached, Some(m) if **m == data.metadata) {
-                *cached = Some(PtrEqRc::new(data.metadata.clone()));
+            if !matches!(&*cached, Some(m) if **m == **data.metadata()) {
+                *cached = Some(PtrEqRc::new((**data.metadata()).clone()));
             }
             cached.clone().unwrap()
         };
@@ -1304,23 +1712,126 @@ impl Session {
                 .stats
                 .as_ref()
                 .is_some_and(|s| s.num_table_cells.is_some()),
-            has_table: if data.table.is_some() {
+            has_table: if data.table().is_some() {
                 Some(TableLoadState::Loaded)
-            } else if data.is_loading {
+            } else if self.0.queue.has_load() {
                 Some(TableLoadState::Loading)
-            } else if data.pending_table.is_some() {
+            } else if data.pending_table().is_some() {
                 Some(TableLoadState::Pending)
             } else {
                 None
             },
-            error: data.error.clone(),
-            title: data.title.clone(),
+            error: data.error().cloned(),
+            title,
             metadata,
             column_stats,
         }
     }
 }
 
+/// A view-config change that has passed every check — names, normalization and
+/// the server's `describe` — and only awaits [`Session::commit_view`].
+pub(crate) struct PreparedView {
+    binding: PreparedBinding,
+
+    /// A new overlay to commit, when the op broadcasts one.
+    overlay: Option<Rc<Vec<OverlayClause>>>,
+    config: Rc<ViewConfig>,
+    effective: Rc<ViewConfig>,
+    description: Option<Rc<Description>>,
+    changed: bool,
+
+    /// `false` for a projected UI edit, whose SUBMIT already announced it.
+    announce: bool,
+}
+
+/// The plugin whose advice fills in what a restore's view config leaves unsaid
+/// — computed against the table and config the restore LANDS on.
+pub(crate) enum ViewDefaults<'a> {
+    /// The restore swaps to this plugin: default its columns and rollup mode.
+    Swap(&'a PluginStaticConfig),
+
+    /// The restore stays on this plugin: re-enforce its rollup mode only.
+    Rollup(&'a PluginStaticConfig),
+
+    /// The update is complete as given (a UI edit, whose control applied the
+    /// plugin's advice when it made it).
+    AsGiven,
+}
+
+/// What a restore does to the panel's table binding — decided by its caller
+/// from the restore's `table` and the panel it lands on, with the incoming
+/// table already probed.
+pub(crate) enum BindPlan {
+    /// The binding stands: bound, awaiting or unbound, as it is.
+    Keep,
+
+    /// Bind `table`.
+    Bind {
+        client: Client,
+        table: Box<perspective_client::Table>,
+        reset: bool,
+    },
+
+    /// Await a host for `name`.
+    Pend {
+        client: Client,
+        name: String,
+        reset: bool,
+    },
+}
+
+enum PreparedBinding {
+    Keep,
+    Bind {
+        client: Client,
+        table: Box<perspective_client::Table>,
+        metadata: Rc<SessionMetadata>,
+    },
+    Pend {
+        client: Client,
+        name: String,
+    },
+}
+
+/// What [`Session::commit_view`] leaves for [`Session::finish_binding`].
+#[must_use]
+pub(crate) struct BindingEffects {
+    rebinds: bool,
+    outgoing: Option<ViewSubscription>,
+    unloaded: bool,
+    loaded: bool,
+    watch: Option<Client>,
+}
+
+impl BindingEffects {
+    /// Whether the commit replaced the panel's table binding.
+    pub fn rebound(&self) -> bool {
+        self.rebinds
+    }
+
+    /// Discard the effects of a commit that kept its binding (there are none).
+    pub fn forget(self) {}
+}
+
+impl PreparedView {
+    /// Mark this as a projected UI edit: the UI has shown it since it was
+    /// submitted, so committing it announces nothing.
+    pub fn projected(mut self) -> Self {
+        self.announce = false;
+        self
+    }
+
+    pub fn config(&self) -> &ViewConfig {
+        &self.config
+    }
+
+    /// The type each column will have in the `View` this config builds.
+    pub fn view_schema(&self) -> Option<&HashMap<String, perspective_client::proto::ColumnType>> {
+        self.description.as_ref().map(|x| &x.view_schema)
+    }
+}
+
 /// One pipeline run's frozen input (invariant I2): the persisted
 /// [`ViewConfig`] and its EFFECTIVE companion (global-filter overlay
 /// appended), captured at the same synchronous instant inside the draw
@@ -1331,10 +1842,11 @@ pub struct ConfigSnapshot {
     pub effective: Rc<ViewConfig>,
 }
 
-/// Type-state token: proof this snapshot's expressions were validated by
-/// [`Session::validate_snapshot`]. [`Session::bind_view`] accepts only this
-/// token, so a `View` can never be built from an unvalidated snapshot.
-pub struct ValidatedSnapshot(ConfigSnapshot);
+/// Type-state token: proof this snapshot was validated by
+/// [`Session::validate_snapshot`], carrying the server's [`Description`] of it.
+pub struct ValidatedSnapshot {
+    snap: ConfigSnapshot,
+}
 
 /// Type-state witness that a `View` is NEW for the plugin about to render
 /// it.