@teepin/sdk 0.3.0 → 0.4.0

package/dist/cjs/direct/uploads.js

@@ -32,6 +32,7 @@ const bytes_js_1 = require("./bytes.js");
 const engine_js_1 = require("./engine.js");
 const common_js_1 = require("./common.js");
 const hpke = __importStar(require("./hpke.js"));
+const packing_js_1 = require("./packing.js");
 const journal_js_1 = require("./journal.js");
 const large_js_1 = require("./large.js");
 const sha256_js_1 = require("./sha256.js");
@@ -170,6 +171,11 @@ class Item {
     wake;
     /** The pack and object id its file row last journaled. */
     journaled = '';
+    /** A run's place for the file (items given back to the planner keep it). */
+    order = 0;
+    /** Rebuilds of the packs it was in, carried when a pack gives it back, so MAX_REBUILDS holds. */
+    rebuilds = 0;
+    reqBytes = 0;
     contentType;
     metadata;
     ifMatch;
@@ -185,6 +191,16 @@ class Item {
         this.metadata = { ...(metadata ?? {}) };
         this.ifMatch = ifMatch || '';
     }
+    /** Its bytes in a pack: its needle and TWS1 bytes. */
+    get stored() {
+        return tws1.NEEDLE_HEADER_SIZE + tws1.storedSize(this.size);
+    }
+    /** The bytes it adds to a reserve body (section 28.17): its JSON object and a separator. */
+    get request() {
+        if (!this.reqBytes)
+            this.reqBytes = new TextEncoder().encode(JSON.stringify(this.reserveJSON())).length + 2;
+        return this.reqBytes;
+    }
     reserveJSON() {
         const o = { key: this.key, size: this.size, sha256: this.sha256 };
         if (this.contentType)
@@ -199,6 +215,11 @@ class Item {
     }
 }
 exports.Item = Item;
+/** A pack's states before its first signature: its bytes can't be on the storage network yet. */
+const UNSIGNED = new Set(['new', 'reserved', 'built', 'conflict', 'bad']);
+const itemStored = (it) => it.stored;
+const itemKey = (it) => it.key;
+const itemRequest = (it) => it.request;
 /** One pack's state, kept in its store (a run's journal, or memory). */
 class Pack {
     bucket;
@@ -222,6 +243,18 @@ class Pack {
     waited = 0;
     throttled = false;
     lastError = '';
+    /** The reason for a pack under the floor (section 28.9), sent with its reserve. */
+    underFloor;
+    /** Its bytes counted against MEMORY_CAP while in flight (putObject's packs). */
+    inflight = 0;
+    /** When its upload ended (in memory only), whether that answer was lost, and the checking waits since (28.18). */
+    sentAt;
+    sentUnknown = false;
+    verifyWaited = 0;
+    /** A run's packs give their files back to its planner instead of renewing under the floor (28.5). */
+    giveback;
+    /** Resumed, unsigned and under the floor (28.22 point 5): its idempotency key is asked first. */
+    dissolve = false;
     constructor(bucket, items, store, id) {
         this.bucket = bucket;
         this.items = items;
@@ -399,11 +432,12 @@ class DirectUploads {
     sizes = {
         ...engine_js_1.PART_RULES,
         packObjectLimit: engine_js_1.PACK_OBJECT_LIMIT,
-        packTarget: engine_js_1.PACK_TARGET_BYTES,
-        packMinTarget: engine_js_1.PACK_MIN_TARGET,
-        packMaxObjects: engine_js_1.PACK_MAX_OBJECTS,
         streamConcurrency: engine_js_1.STREAM_CONCURRENCY,
     };
+    /** The pack sizes and timings (section 28): built in, then the server's from each reservation. Tests set them. */
+    limits = { ...packing_js_1.DEFAULT_LIMITS };
+    /** The timing rule's monotonic clock in milliseconds (tests replace it). */
+    clock = () => performance.now();
     /**
      * The measured upload speed to the storage network: shrinks packs and new uploads' parts on a slow link (section
      * 22.7). Tests set it with speed.set.
@@ -414,6 +448,14 @@ class DirectUploads {
      * slower, twice its time at that speed (section 22.7). Tests shorten it.
      */
     putTimeout = { minMs: 30000, bytesPerSecond: 65536 };
+    /**
+     * A pack call's timeout (29.15): the server's time for `objects` objects, scaled, plus sending `body` (none for a
+     * commit) at the speed measured so far; never under `floorMs`.
+     */
+    callTimeoutMs(objects, perObjectMs, floorMs, body) {
+        const n = body === undefined ? 0 : new TextEncoder().encode(JSON.stringify(body)).length;
+        return (0, engine_js_1.scaledTimeoutMs)(objects, perObjectMs, floorMs, (0, engine_js_1.bodyTransferMs)(n, this.speed.bytesPerSecond, this.putTimeout.bytesPerSecond));
+    }
     /** How long a stopping step waits for its tasks, and a cleanup call may take (ms). */
     cleanupMs = exports.CLEANUP_MS;
     digests = exports.webDigests;
@@ -422,8 +464,17 @@ class DirectUploads {
     host;
     /** Where warnings go: a run removed by cleanUploads, a large state directory. */
     warn = (m) => console.warn(m);
+    /** Where a line worth knowing but not a warning goes (a purged pack's commit, 29.15); tests replace it. */
+    info = (m) => console.info(m);
     accountId;
-    queue = [];
+    /** putObject's waiting files, per bucket, with their running totals (section 28.17). */
+    waiting = new Map();
+    /** When the timing rule next needs a decision, if it does. */
+    nextDecision;
+    /** putObject's pack bytes in flight, against MEMORY_CAP. */
+    inflight = 0;
+    /** putObject's packs in flight and when each is expected back (section 28.25). */
+    inFlight = new packing_js_1.InFlight();
     /** Wake-ups of putObject calls waiting for a slot: resolved when one comes free. */
     slotWaiters = [];
     memory = new PackStore();
@@ -501,10 +552,6 @@ class DirectUploads {
     packObjectLimit() {
         return (0, engine_js_1.packObjectLimit)(this.speed.requestBytes(), this.sizes.packObjectLimit, this.sizes.minBytes);
     }
-    /** The next pack's target size, at the speed measured so far. */
-    packTarget() {
-        return (0, engine_js_1.packTarget)(this.speed.requestBytes(), this.sizes.packTarget, this.sizes.packMinTarget);
-    }
     // --- shared plumbing ----------------------------------------------------------
     /** Where runs keep their state, when it's on disk. */
     get runHost() {
@@ -592,7 +639,9 @@ class DirectUploads {
      */
     async drive(p, signal) {
         try {
-            while (p.state !== 'committed' && p.state !== 'failed') {
+            if (p.dissolve)
+                await this.dissolvePack(p, signal);
+            while (p.state !== 'committed' && p.state !== 'failed' && p.state !== 'returned') {
                 signal?.throwIfAborted();
                 switch (p.state) {
                     case 'new':
@@ -645,9 +694,11 @@ class DirectUploads {
     async reserve(p, signal) {
         await p.store.savePack(p); // the idempotency key, before the call
         const body = { idempotency_key: p.idem, objects: p.items.map((it) => it.reserveJSON()) };
+        if (p.underFloor)
+            body.under_floor = p.underFloor;
         let res;
         try {
-            res = (await this.control(`POST`, `${bucketPath(p.bucket)}/packs`, body, p, signal)).data;
+            res = (await this.control(`POST`, `${bucketPath(p.bucket)}/packs`, body, p, signal, this.callTimeoutMs(p.items.length, engine_js_1.RESERVE_MS_PER_OBJECT, this.client.timeout, body))).data;
         }
         catch (err) {
             if (err instanceof errors_js_1.APIError && err.code === 'reservation_abandoned') {
@@ -665,6 +716,9 @@ class DirectUploads {
             throw err;
         }
         await this.checkKey(res.account_key);
+        const limits = (0, packing_js_1.limitsFromJSON)(res.limits);
+        if (limits)
+            this.limits = limits;
         const ids = new Map((res.objects ?? []).map((o) => [str(o.key), str(o.object_id)]));
         for (const it of p.items)
             it.objectId = ids.get(it.key) ?? '';
@@ -680,6 +734,9 @@ class DirectUploads {
             // The reservation names files that changed: the rest go under a new one.
             const gone = new Set(built.changed.map(([it]) => it));
             p.items = p.items.filter((it) => !gone.has(it));
+            // A run's other files go back to its planner, so they never go as a smaller pack (section 28.5).
+            if (p.giveback && p.items.length)
+                return this.giveBack(p);
             p.state = p.items.length ? 'conflict' : 'failed';
             p.rebuilds--; // not the pack's fault
             await p.store.savePack(p);
@@ -753,7 +810,7 @@ class DirectUploads {
     async sign(p, signal) {
         let signed;
         try {
-            signed = (await this.control(`POST`, `${bucketPath(p.bucket)}/packs/${p.serverId}/sign`, p.signBody, p, signal)).data;
+            signed = (await this.control(`POST`, `${bucketPath(p.bucket)}/packs/${p.serverId}/sign`, p.signBody, p, signal, this.callTimeoutMs(p.items.length, engine_js_1.SIGN_MS_PER_OBJECT, this.client.timeout, p.signBody))).data;
         }
         catch (err) {
             if (err instanceof errors_js_1.APIError && err.code === 'reservation_abandoned') {
@@ -783,6 +840,7 @@ class DirectUploads {
             return;
         }
         p.state = 'uploading';
+        this.inFlight.uploading(p.id, this.clock());
         await p.store.savePack(p);
         let err;
         this.budget.onRequest();
@@ -796,7 +854,14 @@ class DirectUploads {
                 throw e;
             err = e;
         }
-        switch ((0, engine_js_1.storageOutcome)(err)) {
+        const outcome = (0, engine_js_1.storageOutcome)(err);
+        if (outcome === 'sent' || outcome === 'unknown') {
+            p.sentAt = this.clock();
+            p.sentUnknown = outcome === 'unknown';
+            p.verifyWaited = 0;
+            this.inFlight.sent(p.id, p.sentAt);
+        }
+        switch (outcome) {
             case 'sent':
                 p.state = 'sent';
                 break;
@@ -836,7 +901,7 @@ class DirectUploads {
         let status;
         let res;
         try {
-            ({ status, data: res } = await this.control(`POST`, `${bucketPath(p.bucket)}/packs/${p.serverId}/commit`, undefined, p, signal, 70000));
+            ({ status, data: res } = await this.control(`POST`, `${bucketPath(p.bucket)}/packs/${p.serverId}/commit`, undefined, p, signal, this.callTimeoutMs(p.items.length, engine_js_1.COMMIT_MS_PER_OBJECT, engine_js_1.COMMIT_TIMEOUT_MS)));
         }
         catch (err) {
             if (!(err instanceof errors_js_1.APIError))
@@ -855,13 +920,34 @@ class DirectUploads {
             return;
         }
         if (status === 202) {
-            p.verifies++;
-            if (unknown || p.verifies > engine_js_1.COMMIT_VERIFY_TRIES) {
+            // Not there yet (section 28.18): asked again after 250 ms, 500 ms, 1 s and 2 s, then every 2 s; the same bytes are
+            // sent again only 30 s after an upload that answered success, or 5 s after one whose answer was lost (or a pack
+            // resumed mid-upload). The time since is the larger of the clock's and the waits'. The waits count against
+            // uploadWait, but a pack always gets its first full cycle: a pack the network never shows ends after one sending
+            // again, kept for resumeUploads.
+            const now = this.clock();
+            if (p.sentAt === undefined) {
+                p.sentAt = now;
+                p.sentUnknown = unknown;
+                p.verifyWaited = 0;
+            }
+            const limit = p.sentUnknown ? engine_js_1.RESEND_AFTER_LOST_MS : engine_js_1.RESEND_AFTER_SENT_MS;
+            const since = Math.max(now - p.sentAt, p.verifyWaited);
+            if (since >= limit) {
                 p.state = 'signed'; // not there: send the same bytes again
                 p.verifies = 0;
+                p.sentAt = undefined;
             }
             else {
-                await this.client.sleep(1000, signal);
+                const delay = Math.min((0, engine_js_1.verifyDelayMs)(p.verifies), limit - since); // the last look comes as the bytes may go again
+                p.verifies++;
+                const bound = Math.max(this.client.uploadWait, limit);
+                if (p.waited + delay > bound) {
+                    throw new errors_js_1.StorageUnavailableError(`storage didn't show the pack within ${Math.round(bound / 1000)} s of waiting`);
+                }
+                p.waited += delay;
+                p.verifyWaited += delay;
+                await this.client.sleep(delay, signal);
             }
             await p.store.savePack(p);
             return;
@@ -871,11 +957,19 @@ class DirectUploads {
         await p.store.dropBytes(p);
         await p.store.savePack(p);
     }
-    /** A new reservation and fresh keys for the pack's items (section 17.3). */
+    /**
+     * A new reservation and fresh keys for the pack's items (section 17.3). A run's pack under the floor gives its files
+     * back to the planner instead (section 28.5); the old reservation is released (section 28.23).
+     */
     async renew(p) {
         p.rebuilds++;
         if (p.rebuilds > engine_js_1.MAX_REBUILDS)
             throw new Stop(new errors_js_1.TeepinError(`the pack was rebuilt ${engine_js_1.MAX_REBUILDS} times: ${p.lastError || p.state}`));
+        const stored = p.items.reduce((n, it) => n + it.stored, 0);
+        if (p.giveback && stored < this.limits.floor)
+            return this.giveBack(p);
+        if (p.serverId)
+            await this.releaseReservation(p);
         p.lastError = p.state;
         await p.store.dropBytes(p);
         p.idem = (0, common_js_1.uuid7)();
@@ -889,9 +983,82 @@ class DirectUploads {
         p.state = 'new';
         await p.store.savePack(p);
     }
+    /**
+     * A resumed pack that was never signed and is under the floor: reserve is asked with its own idempotency key (and its
+     * files as journaled), so a pack an earlier run already committed answers pack_committed and is committed for its
+     * stored result. Any other answer releases what it reserved, and its files go back to the planner (28.22, point 5).
+     */
+    async dissolvePack(p, signal) {
+        p.dissolve = false;
+        p.underFloor = 'leftover'; // not part of the idempotency digest
+        try {
+            await this.reserve(p, signal);
+        }
+        catch (err) {
+            if (signal?.aborted || !(err instanceof errors_js_1.APIError))
+                throw err;
+            // e.g. pack_too_small from a server in enforce: nothing was committed under this key
+        }
+        if (p.state === 'committing')
+            return;
+        await this.giveBack(p);
+    }
+    /** Hands a run's pack's remaining files back to its planner (section 28.5); the pack ends as returned. */
+    async giveBack(p) {
+        if (p.serverId)
+            await this.releaseReservation(p);
+        await p.store.dropBytes(p);
+        p.state = 'returned';
+        await p.store.savePack(p);
+        const items = p.items.filter((it) => !it.result && it.error === undefined);
+        for (const it of items) {
+            it.objectId = '';
+            it.rebuilds = Math.max(it.rebuilds, p.rebuilds);
+        }
+        p.giveback(items);
+    }
+    /** Frees a given-up reservation at once (section 28.23), best effort: without the route it expires as before. */
+    async releaseReservation(p) {
+        try {
+            const { response } = await this.client.send({ method: 'POST', path: `${bucketPath(p.bucket)}/packs/${p.serverId}/release`, mode: 'safe' });
+            await response.arrayBuffer().catch(() => undefined);
+        }
+        catch {
+            // a deployment without the route, or any failure: the reservation expires on its own
+        }
+    }
     async deliver(p, res) {
         const when = new Date(str(res.committed_at) || NaN);
         const backend = str(res.backend);
+        if (res.purged === true) {
+            // Committed, then every object in it deleted and the pack's row purged (TEEPIN-STORAGE-DESIGN.md 29.15): the answer
+            // has no per-object results, but each file was saved. Never uploaded again.
+            this.info(`teepin: pack ${p.serverId} was committed at ${str(res.committed_at)}; its objects have since been deleted`);
+            const saved = p.items
+                .filter((it) => !it.result && it.error === undefined)
+                .map((it) => [
+                it,
+                {
+                    id: it.objectId,
+                    key: it.key,
+                    size: it.size,
+                    contentType: it.contentType || undefined,
+                    metadata: it.metadata,
+                    checksumSha256: it.sha256,
+                    etag: it.sha256,
+                    partCount: 0,
+                    status: 'deleted',
+                    backend: '',
+                    createdAt: when,
+                    updatedAt: when,
+                    uploadedAt: when,
+                },
+                undefined,
+                true,
+            ]);
+            await this.done(p.store, saved);
+            return;
+        }
         const objects = res.objects ?? [];
         const byId = new Map(objects.map((o) => [str(o.object_id), o]));
         const byKey = new Map(objects.map((o) => [str(o.key), o]));
@@ -941,17 +1108,26 @@ class DirectUploads {
         const sha = await this.digests.sha256(data);
         const it = new Item(key, data.length, sha, async () => data, opts.contentType, opts.metadata, Boolean(opts.ifNoneMatch), normalizeIfMatch(opts.ifMatch));
         it.done = new common_js_1.Deferred();
-        this.queue.push([bucket, it]);
-        this.limit.setPriority(true);
+        let arrivals = this.waiting.get(bucket);
+        if (!arrivals) {
+            arrivals = new packing_js_1.Arrivals();
+            this.waiting.set(bucket, arrivals);
+        }
+        arrivals.add(it, it.key, it.stored, it.request, this.clock());
         const wait = this.client.uploadWait;
-        const deadline = Date.now() + wait;
+        // The observe time (28.25) is the timing rule's own wait, not one for a slot: it never counts against uploadWait (a
+        // lone save with uploadWait 0 still goes).
+        const deadline = Date.now() + wait + this.limits.observeMs;
         const leave = () => {
-            const queued = this.queue.some(([, i]) => i === it);
-            if (queued) {
-                this.queue = this.queue.filter(([, i]) => i !== it);
-                this.limit.setPriority(this.queue.length > 0);
-            }
-            return queued;
+            const a = this.waiting.get(bucket);
+            if (!a || it.picked)
+                return false;
+            a.remove([it]);
+            if (!a.size)
+                this.waiting.delete(bucket);
+            if (!this.waiting.size)
+                this.limit.setPriority(false); // no save is left to hold a run up
+            return true;
         };
         try {
             while (!it.picked) {
@@ -967,8 +1143,11 @@ class DirectUploads {
                     break;
                 let timer;
                 try {
-                    // A timer past 2^31 - 1 ms fires at once in Node and browsers, so a very long uploadWait waits in slices.
-                    const slice = Math.min(left, MAX_TIMER_MS);
+                    // A timer past 2^31 - 1 ms fires at once in Node and browsers, so a very long uploadWait waits in slices; the
+                    // timing rule's next decision comes sooner.
+                    let slice = Math.min(left, MAX_TIMER_MS);
+                    if (this.nextDecision !== undefined)
+                        slice = Math.min(slice, Math.max(1, this.nextDecision - this.clock()));
                     await (0, common_js_1.abortable)(Promise.race([woken.promise, new Promise((r) => (timer = setTimeout(r, slice)))]), signal);
                 }
                 finally {
@@ -989,21 +1168,67 @@ class DirectUploads {
             throw new errors_js_1.TeepinError(`${key}: no result`);
         return it.result;
     }
-    /** Forms a pack from what's waiting whenever a send slot is free. Replaced in tests. */
+    /**
+     * Sends the packs section 28's timing rule allows, oldest bucket first, each when a slot is free and the memory cap
+     * allows, and notes when the rule next needs a decision. While a pack would go but has no slot, a run's next pack
+     * waits for it (priority); a pack that is only gathering holds no run up. Replaced in tests.
+     */
     dispatch() {
-        while (this.queue.length && this.limit.tryAcquire()) {
-            const bucket = this.queue[0][0];
-            const waiting = this.queue.filter(([b]) => b === bucket).map(([, it]) => it);
-            const [batch] = (0, engine_js_1.nextPack)(waiting, (i) => i.size, (i) => i.key, this.packTarget(), this.sizes.packMaxObjects);
-            const chosen = new Set(batch);
-            this.queue = this.queue.filter(([, it]) => !chosen.has(it));
-            this.limit.setPriority(this.queue.length > 0);
-            for (const it of batch) {
+        for (;;) {
+            const chosen = this.choose();
+            if (!chosen)
+                return;
+            const [bucket, plan, reason] = chosen;
+            for (const it of plan.pack) {
                 it.picked = true;
-                it.wake?.resolve(); // its caller may be waiting for a slot: it has one now
+                it.wake?.resolve(); // its caller may be waiting: its file has a pack now
             }
-            void this.runShared(new Pack(bucket, batch, this.memory));
-        }
+            const p = new Pack(bucket, plan.pack, this.memory);
+            p.underFloor = reason;
+            p.inflight = plan.stored;
+            this.inFlight.add(p.id, bucket, plan.stored);
+            void this.runShared(p);
+        }
+    }
+    /** The next pack to send and its reason (a slot taken for it), or undefined; sets the next decision and priority. */
+    choose() {
+        const now = this.clock();
+        const speed = this.speed.bytesPerSecond;
+        const requestBytes = this.speed.requestBytes();
+        const [limits, slow] = (0, packing_js_1.atSpeed)(this.limits, requestBytes);
+        const [choices, next] = (0, packing_js_1.schedule)(this.waiting, now, limits, (a, tailCap) => (0, packing_js_1.planPack)(a.items(), itemStored, itemKey, itemRequest, limits, tailCap !== undefined, tailCap), (bucket, by) => this.inFlight.coming(bucket, by, now, speed, limits.observeMs, (t) => this.waiting.get(bucket)?.arrivedSince(t) ?? 0), this.limit.runsWaiting(), slow ? 0 : (0, packing_js_1.absorbCap)(this.limits, requestBytes));
+        this.nextDecision = next;
+        let blocked = false;
+        for (const c of choices) {
+            const p = c.plan;
+            if (this.inflight > 0 && this.inflight + p.stored > packing_js_1.MEMORY_CAP) {
+                blocked = true;
+                continue;
+            }
+            if (!this.limit.tryAcquire()) {
+                blocked = true;
+                continue;
+            }
+            const a = this.waiting.get(c.bucket);
+            a.remove(p.pack);
+            if (!a.size)
+                this.waiting.delete(c.bucket);
+            this.inflight += p.stored;
+            this.limit.setPriority(blocked);
+            return [c.bucket, p, this.reasonFor(p, c.decision.reason, slow)];
+        }
+        this.limit.setPriority(blocked);
+        return undefined;
+    }
+    /** A pack's reason for being under the floor (section 28.9), or undefined at or over it. */
+    reasonFor(p, reason, slow) {
+        if (p.stored >= this.limits.floor)
+            return undefined;
+        if (slow)
+            return 'slow_link';
+        if (p.state === 'request_limited')
+            return 'request_limit';
+        return reason ?? 'leftover';
     }
     async runShared(p) {
         let outcome = 'failed';
@@ -1017,8 +1242,13 @@ class DirectUploads {
                     it.error = err; // every caller gets its answer
         }
         finally {
+            // Out of the packs in flight, into its grace time (28.25), before its slot is released. Its callers were woken as
+            // each item was delivered: one that saved again meanwhile counted twice until here, which can only hold a pack, and
+            // the release below has it decided again.
+            this.inFlight.remove(p.id, this.clock(), p.state === 'committed');
             for (const it of p.items)
                 it.done?.resolve();
+            this.inflight -= p.inflight;
             this.release(outcome);
         }
     }
@@ -1239,6 +1469,7 @@ class DirectUploads {
     }
     async sendRun(state, onProgress, partSize, signal) {
         const { bucket, store, place, items } = state;
+        items.forEach((it, i) => (it.order = i));
         const lim = this.packObjectLimit();
         // A file whose upload in parts a crash left open goes on in parts, whatever the speed now (section 22.7).
         const inParts = new Set(store.journal
@@ -1247,7 +1478,7 @@ class DirectUploads {
             .map((r) => str(r.file_id)));
         const large = items.filter((it) => it.size > lim || (it.size > 0 && it.fileId !== undefined && inParts.has(it.fileId)));
         const chosen = new Set(large);
-        const small = items.filter((it) => it.size > 0 && !chosen.has(it));
+        let small = items.filter((it) => it.size > 0 && !chosen.has(it));
         // The small files are packed as slots come free, each pack at the speed measured by then (section 22.7).
         const packs = [...state.packs];
         let total = 0;
@@ -1299,32 +1530,56 @@ class DirectUploads {
                     await this.abandon(store, place); // the last task of an interrupted run releases it
             }
         };
-        const tasks = [];
+        // Files a pack gives back (a changed file's pack, a renewal under the floor) are planned again with the rest, their
+        // place in the run kept (section 28.5).
+        let back = [];
+        let tasks = [];
         try {
             const start = (p) => {
+                p.giveback = (returned) => back.push(...returned);
                 closer.started();
                 tasks.push(go(p).catch(failed));
             };
-            for (const p of [...packs]) {
-                await this.limit.acquire(ctl.signal);
-                if (failure) {
-                    this.release('failed');
-                    throw failure.err;
+            // A first round dissolves the resumed packs under the floor (section 28.22, point 5), so their files are planned
+            // with the queued ones; the other resumed packs and the queued files wait for it.
+            const dissolving = packs.filter((p) => p.dissolve);
+            for (const group of [dissolving, packs.filter((p) => !p.dissolve)]) {
+                for (const p of group) {
+                    await this.limit.acquire(ctl.signal);
+                    if (failure) {
+                        this.release('failed');
+                        throw failure.err;
+                    }
+                    start(p);
                 }
-                start(p);
-            }
-            for (let rest = small; rest.length;) {
-                await this.limit.acquire(ctl.signal);
-                if (failure) {
-                    this.release('failed');
-                    throw failure.err;
+                if (group === dissolving && dissolving.length) {
+                    await (0, common_js_1.abortable)(Promise.all(tasks), ctl.signal);
+                    if (failure)
+                        throw failure.err;
+                    tasks = [];
+                    small = [...back, ...small].sort((a, b) => a.order - b.order);
+                    back = [];
                 }
-                let chunk;
-                [chunk, rest] = (0, engine_js_1.nextPack)(rest, (i) => i.size, (i) => i.key, this.packTarget(), this.sizes.packMaxObjects);
-                const p = new Pack(bucket, chunk, store);
-                packs.push(p);
-                start(p);
             }
+            // A pack for each slot that comes free, planned at the speed measured by then, the run's tail joining its last pack.
+            const planSmall = async (files) => {
+                for (let rest = files; rest.length;) {
+                    await this.limit.acquire(ctl.signal);
+                    if (failure) {
+                        this.release('failed');
+                        throw failure.err;
+                    }
+                    const [limits, slow] = (0, packing_js_1.atSpeed)(this.limits, this.speed.requestBytes());
+                    const plan = (0, packing_js_1.planPack)(rest, itemStored, itemKey, itemRequest, limits, true);
+                    rest = plan.rest;
+                    const p = new Pack(bucket, plan.pack, store);
+                    p.underFloor = this.reasonFor(plan, 'leftover', slow);
+                    p.rebuilds = Math.max(0, ...plan.pack.map((it) => it.rebuilds));
+                    packs.push(p);
+                    start(p);
+                }
+            };
+            await planSmall(small);
             for (const it of large) {
                 if (stop.length) {
                     await this.done(store, [[it, undefined, stop[0], false]]);
@@ -1350,10 +1605,19 @@ class DirectUploads {
                         throw err;
                 }
             }
-            // A task that fails stops the run at once (its controller aborts), as joining it first would.
-            await (0, common_js_1.abortable)(Promise.all(tasks), ctl.signal);
-            if (failure)
-                throw failure.err;
+            // A task that fails stops the run at once (its controller aborts), as joining it first would. What packs gave back
+            // is planned again with its place in the run kept, until none gives any back.
+            for (;;) {
+                await (0, common_js_1.abortable)(Promise.all(tasks), ctl.signal);
+                if (failure)
+                    throw failure.err;
+                const again = back.sort((a, b) => a.order - b.order);
+                back = [];
+                if (!again.length)
+                    break;
+                tasks = [];
+                await planSmall(again);
+            }
         }
         catch (err) {
             // Interrupted, or failed: every pack still under way is stopped and waited for (up to the cap); then the run's
@@ -1538,7 +1802,7 @@ class DirectUploads {
         const packs = [];
         for (const r of j.rows('packs')) {
             const pid = str(r._id);
-            if (r.state === 'committed' || r.state === 'failed')
+            if (r.state === 'committed' || r.state === 'failed' || r.state === 'returned')
                 continue;
             const its = byPack.get(pid);
             byPack.delete(pid);
@@ -1557,10 +1821,18 @@ class DirectUploads {
             p.attempts = int(r.attempts);
             if (p.state === 'uploading')
                 p.state = 'unknown'; // the PUT may have landed: commit first
+            // Not yet signed and under the floor (section 28.22, point 5): its files are planned again, once its idempotency
+            // key has shown it wasn't committed (dissolvePack).
+            p.dissolve = UNSIGNED.has(p.state) && its.reduce((n, it) => n + it.stored, 0) < this.limits.floor;
             packs.push(p);
         }
         for (const its of byPack.values())
             queued.push(...its); // packed into a pack that's gone: queue them again
+        // Dissolving gains nothing when there is nothing to merge with: a lone small pack would be planned again as the same
+        // leftover, and carrying on under its own idempotency key keeps a restored older journal from sending files twice.
+        if (packs.filter((p) => p.dissolve).length + (queued.length ? 1 : 0) < 2)
+            for (const p of packs)
+                p.dissolve = false;
         await this.sweepOrphans(place, j, packs);
         return { state: { bucket, store, place, items: queued, packs, results }, changed };
     }