@unson/brainbase-mcp 0.22.3 → 0.22.5

package/dist/foundation-graph-http.d.ts

@@ -1,4 +1,5 @@
 import { type FoundationHttpCsrfVerifier, type FoundationHttpRouter } from './foundation-http.js';
+import type { ObjectiveDefinition } from './ontology-foundation.js';
 /**
  * Readiness probe for the Graph history contract used by the public adapter.
  *
@@ -31,8 +32,20 @@ export interface FoundationGraphHttpOptions {
     readonly withAccessContext: <T>(identity: FoundationGraphTrustedIdentity, callback: (client: FoundationGraphQueryClient) => Promise<T>) => Promise<T>;
     /** Host-owned CSRF verification port for mutation requests. */
     readonly csrf?: FoundationHttpCsrfVerifier;
+    /** Canonical host writer, using this request's authenticated transaction.
+     * Must enforce current ACL, tenant/project access and expectedRevision CAS;
+     * null means create-only. Never connect a low-level or maintenance writer.
+     */
+    readonly writeObjectiveDraft?: (input: FoundationGraphObjectiveWriteInput) => Promise<void>;
     readonly bodyLimitBytes?: number;
 }
+export interface FoundationGraphObjectiveWriteInput {
+    readonly definition: ObjectiveDefinition;
+    readonly expectedRevision: string | null;
+    readonly projectCode: string;
+    readonly identity: FoundationGraphTrustedIdentity;
+    readonly client: FoundationGraphQueryClient;
+}
 /**
  * Create the reusable Graph-backed public Foundation handler.
  *

package/dist/foundation-graph-http.js

@@ -3,6 +3,8 @@ import { checkObjectiveReadiness } from './company-os-objectives.js';
 import { createFoundationPublicProvider, createFoundationPublicRoute } from './foundation-public-provider.js';
 import { createGraphFoundationReaders } from './graph-foundation-reader.js';
 import { FoundationStoreError } from './foundation-store.js';
+import { digestFoundationDefinition, nextFoundationRevision } from './foundation-catalog.js';
+import { validateFoundationGraphWrite } from './foundation-graph-write.js';
 /**
  * Readiness probe for the Graph history contract used by the public adapter.
  *
@@ -24,6 +26,54 @@ export const FOUNDATION_GRAPH_READY_SQL = `SELECT
 export const FOUNDATION_GRAPH_CONTRACT_VERSION = 'foundation-graph-http.v1';
 export const FOUNDATION_OVERVIEW_CONTRACT_VERSION = 'foundation-overview.v1';
 const FOUNDATION_CATALOG_PATH = '/api/foundation/catalog';
+class FoundationGraphResponseError extends Error {
+    response;
+    constructor(response) {
+        super('Foundation mutation was rejected');
+        this.response = response;
+    }
+}
+/** Domain proposals can never supply the host's authority or provenance. */
+function graphObjectiveBuilder(projectCode) {
+    return ({ operation, body, context, current, expectedRevision }) => {
+        if (body.adoptionState !== undefined && body.adoptionState !== 'draft') {
+            throw new FoundationStoreError('invalid_input', 'Objective writes accept draft definitions only');
+        }
+        const domain = {};
+        for (const key of ['meaning', 'desiredState', 'beneficiaryIds', 'criteria', 'evaluationPeriod', 'accountableId', 'epistemicState']) {
+            if (body[key] !== undefined)
+                domain[key] = body[key];
+        }
+        const blank = (value) => value === undefined || value === null || (typeof value === 'string' && !value.trim());
+        if (isRecord(domain.evaluationPeriod)
+            && blank(domain.evaluationPeriod.from) && blank(domain.evaluationPeriod.until))
+            delete domain.evaluationPeriod;
+        if (blank(domain.accountableId))
+            delete domain.accountableId;
+        if (operation === 'update') {
+            if (!current)
+                throw new FoundationStoreError('not_found', 'The current Objective is required');
+            if (current.revision !== expectedRevision) {
+                throw new FoundationStoreError('revision_conflict', 'Objective changed; reload before saving', { currentRevision: current.revision });
+            }
+            return {
+                ...domain, id: current.id, type: 'objective', revision: nextFoundationRevision(current.revision),
+                adoptionState: 'draft', acl: current.acl, scope: current.scope, storage: current.storage,
+                provenance: current.provenance, authorizedUses: current.authorizedUses
+            };
+        }
+        const id = typeof body.id === 'string' ? body.id.trim() : '';
+        if (!id)
+            throw new FoundationStoreError('invalid_input', 'id is required');
+        return {
+            ...domain, id, type: 'objective', revision: '1', adoptionState: 'draft',
+            acl: { ownerId: context.principal, visibility: 'private', readerIds: [], writerIds: [] },
+            scope: { subjectIds: [projectCode], validFrom: new Date().toISOString() },
+            storage: 'candidate', authorizedUses: ['draft'],
+            provenance: [{ sourceId: 'foundation-objective-editor', sourceKind: 'candidate', evidenceIds: [] }]
+        };
+    };
+}
 const DEFAULT_BODY_LIMIT_BYTES = 65_536;
 const DIRECT_FOUNDATION_REFERENCE_KINDS = new Set(['objective', 'variable', 'model', 'constraint', 'philosophy']);
 const SNAPSHOT_REFERENCE_KINDS = new Set([
@@ -298,19 +348,47 @@ export function createFoundationGraphHttpHandler(options) {
                     const provider = createFoundationPublicProvider(readers);
                     const route = createFoundationPublicRoute(provider);
                     const catalogRoute = createFoundationCatalogRoute(readers, scopeId, context);
+                    const writeObjective = async (definition, expectedRevision) => {
+                        if (!options.writeObjectiveDraft) {
+                            throw new FoundationStoreError('unsupported_graph', 'Objective writes are not configured');
+                        }
+                        const current = expectedRevision === null ? undefined
+                            : await readers.store.readLatest('objective', definition.id, context);
+                        if (expectedRevision !== null && !current)
+                            throw new FoundationStoreError('not_found', 'Objective was not found');
+                        if (current && current.definition.revision !== expectedRevision) {
+                            throw new FoundationStoreError('revision_conflict', 'Objective changed; reload before saving', { currentRevision: current.definition.revision });
+                        }
+                        const checked = validateFoundationGraphWrite({
+                            context: { principal: identity.principal, projectCode: scopeId },
+                            row: { id: definition.id, type: 'objective', projectCode: scopeId, revision: definition.revision, payload: { foundation: definition } },
+                            expectedNextRevision: expectedRevision === null ? '1' : nextFoundationRevision(expectedRevision),
+                            ...(current ? { currentDefinition: current.definition } : {})
+                        });
+                        if (!checked.valid || !checked.normalized) {
+                            const denied = checked.issues.some((issue) => ['WRITER_NOT_AUTHORIZED', 'OWNER_MISMATCH', 'ACL_CHANGE_FORBIDDEN', 'SCOPE_VIOLATION'].includes(issue.code));
+                            throw new FoundationStoreError(denied ? 'authorization_denied' : 'invalid_input', 'Objective draft validation failed');
+                        }
+                        const candidate = checked.normalized.definition;
+                        await options.writeObjectiveDraft({ definition: candidate, expectedRevision, projectCode: scopeId, identity, client });
+                        const saved = await readers.store.read({ id: candidate.id, type: 'objective', revision: candidate.revision }, context);
+                        const digest = digestFoundationDefinition(candidate);
+                        if (!saved || saved.digest !== digest) {
+                            throw new FoundationStoreError('readback_mismatch', 'The saved Objective revision could not be verified');
+                        }
+                        return { id: candidate.id, type: 'objective', revision: candidate.revision, digest };
+                    };
                     const objectiveRoute = createObjectiveFoundationRoute({
+                        ...(options.writeObjectiveDraft ? { buildDefinition: graphObjectiveBuilder(scopeId) } : {}),
+                        bodyLimitBytes,
                         objectives: {
-                            async createObjective() {
-                                throw new FoundationStoreError('unsupported_graph', 'Objective writes are not configured for the Graph read adapter');
-                            },
+                            createObjective: (definition) => writeObjective(definition, null),
                             async readObjective(id, objectiveContext, revision) {
                                 return revision === undefined
                                     ? readers.store.readLatest('objective', id, objectiveContext)
                                     : readers.store.read({ id, type: 'objective', revision }, objectiveContext);
                             },
-                            async updateObjective() {
-                                throw new FoundationStoreError('unsupported_graph', 'Objective writes are not configured for the Graph read adapter');
-                            },
+                            updateObjective: (_id, expectedRevision, definition) => writeObjective(definition, expectedRevision),
                             async checkObjectiveReadiness(id, objectiveContext, revision) {
                                 return checkObjectiveReadiness(readers.store, id, objectiveContext, revision);
                             },
@@ -323,13 +401,21 @@ export function createFoundationGraphHttpHandler(options) {
                         routes: [catalogRoute, route, objectiveRoute],
                         bodyLimitBytes
                     });
-                    return handler.handle(request);
+                    const result = await handler.handle(request);
+                    // The common HTTP router renders domain errors. Re-throw the response
+                    // until the host transaction rolls back, including failed readback.
+                    if (!['GET', 'HEAD'].includes(request.method.toUpperCase()) && result.status >= 400) {
+                        throw new FoundationGraphResponseError(result);
+                    }
+                    return result;
                 });
                 return response instanceof Response
                     ? response
                     : jsonResponse(503, { error: { code: 'foundation_provider_unavailable' } });
             }
-            catch {
+            catch (error) {
+                if (error instanceof FoundationGraphResponseError)
+                    return error.response;
                 return jsonResponse(503, { error: { code: 'foundation_provider_unavailable' } });
             }
         }

package/dist/foundation-http.d.ts

@@ -77,6 +77,15 @@ export interface ObjectiveFoundationHttpRouteOptions {
     replaceObjectiveConstraintRefs?: (reference: FoundationRef, refs: readonly FoundationRevision[], context: FoundationStoreContext) => MaybePromise<unknown>;
     bodyLimitBytes?: number;
 }
+/** Typed, explicitly sanitized error for trusted host adapters. */
+export declare class FoundationHttpError extends Error {
+    readonly status: number;
+    readonly code: string;
+    readonly currentRevision?: string;
+    constructor(status: number, code: string, message: string, options?: {
+        currentRevision?: string;
+    });
+}
 /**
  * Compose OSS Company OS routes under one local server boundary.  The
  * resolver is called only for a matching route and the resulting trusted

package/dist/foundation-http.js

@@ -65,7 +65,8 @@ const AUTHORITY_FIELDS = new Set([
     'permission',
     'permissions',
 ]);
-class FoundationHttpError extends Error {
+/** Typed, explicitly sanitized error for trusted host adapters. */
+export class FoundationHttpError extends Error {
     status;
     code;
     currentRevision;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unson/brainbase-mcp",
-  "version": "0.22.3",
+  "version": "0.22.5",
   "description": "Local-first Brainbase judgment OS that lets supported AI agents reuse a user's approved goals, priorities, decisions, and judgment criteria.",
   "type": "module",
   "license": "MIT",
@@ -386,7 +386,7 @@
     "build:world": "node scripts/build-world-vendor.mjs"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.30.0",
+    "@modelcontextprotocol/sdk": "^1.31.0",
     "graphology": "0.26.0",
     "sigma": "3.0.3",
     "zod": "^3.25.56"
@@ -407,5 +407,5 @@
   "engines": {
     "node": ">=20"
   },
-  "gitHead": "8e7c9b80910f862f297788c35096461e3359d465"
+  "gitHead": "c361ea6dc167dd1ffe372a6f0d6c1f445d0d5ebf"
 }

package/ui/graph-projects-view.js

@@ -298,6 +298,9 @@ export function createGraphProjectsView({
   let contextRequest = 0;
   let detailRequest = 0;
   let hostListRequest = 0;
+  // An explicitly selected project may be read in parallel with the host
+  // list, but the list remains authoritative for whether its detail is shown.
+  let initialSelectionGate = null;
   let viewDestroyed = false;
 
   const correction = createGraphCorrection({
@@ -415,7 +418,7 @@ export function createGraphProjectsView({
   }
 
   /** Reads supplementary sections independently of the Graph project detail. */
-  async function loadProjectContextFor(id, { keep = false } = {}) {
+  async function loadProjectContextFor(id, { keep = false, deferUntilHostList = null } = {}) {
     if (viewDestroyed) return state.context;
     if (typeof loadProjectContext !== 'function') {
       if (state.context?.projectId !== id) state.context = null;
@@ -425,9 +428,16 @@ export function createGraphProjectsView({
     const request = ++contextRequest;
     state.context = normalizeProjectContext(id, { state: 'loading' });
     controller.render();
-    const applyContext = (snapshot) => {
+    const applyContext = (snapshot, { flushDeferred = false } = {}) => {
       const normalized = normalizeProjectContext(id, snapshot);
       if (viewDestroyed || request !== contextRequest || state.selectedId !== id) return false;
+      if (deferUntilHostList && !deferUntilHostList.confirmed && !flushDeferred) {
+        if (!deferUntilHostList.cancelled && initialSelectionGate === deferUntilHostList) {
+          deferUntilHostList.pendingContext = normalized;
+          deferUntilHostList.flushContext = () => applyContext(normalized, { flushDeferred: true });
+        }
+        return false;
+      }
       state.context = normalized;
       // Context progress must not rebuild the workspace: rebuilding destroys
       // Sigma's viewport and resets the user's active tab/selection. Detail
@@ -796,6 +806,37 @@ export function createGraphProjectsView({
     return children;
   }
 
+  function cancelInitialSelectionGate(gate, { reset = true } = {}) {
+    if (!gate || gate.cancelled || gate.confirmed) return;
+    gate.cancelled = true;
+    gate.pendingContext = null;
+    gate.pendingDetail = null;
+    gate.flushContext = null;
+    gate.flushDetail = null;
+    if (initialSelectionGate === gate) initialSelectionGate = null;
+    // A caller may have selected another project while this gate was pending.
+    // Do not invalidate that newer project's reads in that case.
+    if (!reset || state.selectedId !== gate.id) return;
+    detailRequest += 1;
+    contextRequest += 1;
+    if (state.detail?.id === gate.id && state.detail.state === 'loading') state.detail = null;
+    if (state.context?.projectId === gate.id && state.context.state === 'loading') state.context = null;
+  }
+
+  function confirmInitialSelectionGate(gate) {
+    if (!gate || gate.cancelled) return;
+    gate.confirmed = true;
+    if (initialSelectionGate === gate) initialSelectionGate = null;
+    // Responses which finished before the list are safe to expose now.  A
+    // response still in flight will apply through its normal completion path.
+    gate.flushDetail?.();
+    gate.flushContext?.();
+    gate.pendingDetail = null;
+    gate.pendingContext = null;
+    gate.flushDetail = null;
+    gate.flushContext = null;
+  }
+
   /** Reads the host's project list (see `load`). */
   async function loadHostList({ keep = false } = {}) {
     const request = ++hostListRequest;
@@ -804,14 +845,45 @@ export function createGraphProjectsView({
       state.list = { state: 'loading' };
       controller.render();
     }
+    let selectionGate = null;
+    let selectionDetailReading = null;
+    const selectedBeforeList = state.selectedId;
+    if (selectedBeforeList) {
+      if (initialSelectionGate?.id === selectedBeforeList && !initialSelectionGate.cancelled && !initialSelectionGate.confirmed) {
+        selectionGate = initialSelectionGate;
+        selectionDetailReading = selectionGate.detailReading;
+      } else if (state.detail === null) {
+        selectionGate = {
+          id: selectedBeforeList,
+          confirmed: false,
+          cancelled: false,
+          pendingContext: null,
+          pendingDetail: null,
+          flushContext: null,
+          flushDetail: null,
+          detailReading: null,
+        };
+        initialSelectionGate = selectionGate;
+        selectionDetailReading = controller.loadDetail(selectedBeforeList, {
+          keep,
+          deferUntilHostList: selectionGate,
+        });
+        selectionGate.detailReading = selectionDetailReading;
+      }
+    }
     const result = await client.read('/projects');
     if (viewDestroyed || request !== hostListRequest) return state.list;
     state.list = normalizeProjectList(result);
     if (state.list.state !== 'ok') {
+      cancelInitialSelectionGate(selectionGate);
       controller.render();
       return state.list;
     }
     const { projects } = state.list.payload;
+    if (selectionGate && (selectionGate.cancelled || state.selectedId !== selectionGate.id)) {
+      cancelInitialSelectionGate(selectionGate, { reset: false });
+      selectionGate = null;
+    }
     if (!state.selectedId) {
       if (correction.form) correction.close();
       state.panelAt = null;
@@ -832,6 +904,7 @@ export function createGraphProjectsView({
       // never be replaced with the first row when the refreshed list no
       // longer contains it.  Keeping the id makes the missing target visible
       // and lets the host decide whether its identity or access changed.
+      cancelInitialSelectionGate(selectionGate);
       if (correction.form) correction.close();
       detailRequest += 1;
       state.panelAt = null;
@@ -842,6 +915,11 @@ export function createGraphProjectsView({
       };
       state.context = null;
       contextRequest += 1;
+    } else if (selectionGate && selectionGate.id === state.selectedId) {
+      confirmInitialSelectionGate(selectionGate);
+      if (selectionDetailReading) await selectionDetailReading;
+      if (viewDestroyed || request !== hostListRequest) return state.list;
+      return state.list;
     } else if (state.detail?.id !== state.selectedId || state.detail?.state === 'not_found') {
       // The project the host asked for is listed; read it for the rail.
       if (viewDestroyed || request !== hostListRequest) return state.list;
@@ -876,6 +954,7 @@ export function createGraphProjectsView({
       hostListRequest += 1;
       detailRequest += 1;
       contextRequest += 1;
+      initialSelectionGate = null;
       knowledgeWorkspace?.destroy();
       knowledgeWorkspace = null;
       correction.close();
@@ -925,7 +1004,7 @@ export function createGraphProjectsView({
       return state.own.detail;
     },
     /** `keep` shows the current detail until the new one has been read. */
-    async loadDetail(id, { keep = false } = {}) {
+    async loadDetail(id, { keep = false, deferUntilHostList = null } = {}) {
       if (viewDestroyed) return state.detail;
       const request = ++detailRequest;
       const previous = state.detail;
@@ -933,13 +1012,26 @@ export function createGraphProjectsView({
         state.detail = { id, state: 'loading' };
         controller.render();
       }
-      const contextReading = loadProjectContextFor(id, { keep });
+      const contextReading = loadProjectContextFor(id, { keep, deferUntilHostList });
       const result = await client.read(`/projects/${encodeURIComponent(id)}`);
       if (viewDestroyed || request !== detailRequest || state.selectedId !== id) return state.detail;
-      state.detail = result.state === 'error' && result.status === 404
+      const detail = result.state === 'error' && result.status === 404
         ? { id, state: 'not_found', reason: 'このプロジェクトは見つかりません。一覧を読み直してください。' }
         : { id, ...normalizeProjectDetail(result) };
-      controller.render();
+      const applyDetail = () => {
+        if (viewDestroyed || request !== detailRequest || state.selectedId !== id) return false;
+        state.detail = detail;
+        controller.render();
+        return true;
+      };
+      if (deferUntilHostList && !deferUntilHostList.confirmed) {
+        if (!deferUntilHostList.cancelled && initialSelectionGate === deferUntilHostList) {
+          deferUntilHostList.pendingDetail = detail;
+          deferUntilHostList.flushDetail = applyDetail;
+        }
+        return state.detail;
+      }
+      applyDetail();
       // The context is intentionally independent.  Its completion may trigger
       // one more render, but never changes the Graph detail result.
       void contextReading;
@@ -947,6 +1039,10 @@ export function createGraphProjectsView({
     },
     /** Selects a row: the rail shows that project, and an open correction is closed. */
     async selectProject(id) {
+      // A host selection supersedes a prefetched initial detail.  Cancel the
+      // gate before changing the id so A -> B -> A cannot make a later list
+      // response wait for the first A read.
+      cancelInitialSelectionGate(initialSelectionGate, { reset: false });
       if (correction.form) correction.close();
       state.panelAt = null;
       state.selectedId = id;

package/ui/objective-editor.js

@@ -220,6 +220,17 @@ function canonicalDateTimeValue(value) {
   return Number.isNaN(date.getTime()) ? input : date.toISOString();
 }
 
+// Empty date inputs are an unspecified draft period. A partial or invalid
+// period must still reach canonical validation instead of being discarded.
+function definitionForSave(definition) {
+  const draft = JSON.parse(JSON.stringify(definition));
+  const period = objectValue(draft.evaluationPeriod);
+  const blankDate = (value) => value === null || value === undefined || (typeof value === 'string' && !value.trim());
+  if (period && Object.keys(period).every((key) => ['from', 'until'].includes(key))
+    && blankDate(period.from) && blankDate(period.until)) delete draft.evaluationPeriod;
+  return draft;
+}
+
 function normalizeReadiness(value) {
   const object = objectValue(value);
   if (!object || typeof object.ready !== 'boolean') return { state: 'unknown', ready: null, issues: null };
@@ -698,7 +709,7 @@ function renderCriteria(root, draft, callbacks) {
   return fieldset;
 }
 
-function collectDefinition(form, baseDraft) {
+function collectDefinition(form, baseDraft, { keepEmptyCriteria = false } = {}) {
   const draft = JSON.parse(JSON.stringify(baseDraft ?? {}));
   const value = (name) => findField(form, name)?.value ?? '';
   draft.id = optionalText(value('id')).trim();
@@ -719,7 +730,7 @@ function collectDefinition(form, baseDraft) {
     const variableRevision = value(`criteria.${index}.variable_revision`).trim();
     const operator = value(`criteria.${index}.operator`) || 'equals';
     const target = parseTarget(value(`criteria.${index}.target`));
-    if (!variableIdInput.value.trim() && !variableRevision) continue;
+    if (!keepEmptyCriteria && !variableIdInput.value.trim() && !variableRevision) continue;
     const criterion = {
       variableRef: { id: variableIdInput.value.trim(), type: 'variable', revision: variableRevision },
       operator,
@@ -727,7 +738,7 @@ function collectDefinition(form, baseDraft) {
     if (target !== undefined) criterion.target = target;
     draft.criteria.push(criterion);
   }
-  return draft;
+  return definitionForSave(draft);
 }
 
 function renderObjectiveForm(root, state, callbacks) {
@@ -742,7 +753,9 @@ function renderObjectiveForm(root, state, callbacks) {
     makeElement('div', { className: 'objective-editor-panel-heading', text: title }),
     makeElement('p', { className: 'objective-editor-muted', text: '保存すると新しい版になり、保存した版を読み戻して表示します。' }),
   );
-  if (state.save.state !== 'idle' && state.save.state !== 'saving') section.append(statusNotice(state.save, { onRetry: callbacks.onRetrySave }));
+  if (state.save.state !== 'idle' && state.save.state !== 'saving') section.append(statusNotice(state.save, {
+    onRetry: ['conflict', 'saved_unverified'].includes(state.save.state) ? null : callbacks.onRetrySave,
+  }));
   section.append(buildObjectiveForm(state, callbacks));
   return section;
 }
@@ -776,18 +789,36 @@ function buildObjectiveForm(state, callbacks, { workspace = false } = {}) {
     { value: 'retired', label: '終了' },
   ] }).label);
   form.append(governance);
-  form.append(renderCriteria(form, draft, callbacks));
+  const captureDraft = () => callbacks.onDraftChange?.(collectDefinition(form, draft, { keepEmptyCriteria: true }));
+  form.append(renderCriteria(form, draft, {
+    ...callbacks,
+    onAddCriterion: () => { captureDraft(); callbacks.onAddCriterion?.(); },
+    onRemoveCriterion: (index) => { captureDraft(); callbacks.onRemoveCriterion?.(index); },
+  }));
   form.append(renderReadiness(form, state.readiness));
   form.append(renderConstraintRefs(form, state, callbacks));
   const actions = makeElement('div', { className: 'objective-editor-actions' });
   actions.append(makeElement('span', { className: 'objective-editor-muted', text: callbacks.canEdit ? '保存後に同じID・新版を再取得して確認します。' : '読み取り専用です。書込み権限はホストから提供してください。' }));
-  const saving = state.save.state === 'saving';
-  if (callbacks.canEdit) actions.append(makeElement('button', { className: workspace ? 'bb-ws-button is-primary' : 'objective-editor-button-primary', text: saving ? '保存中…' : '保存', attrs: { type: 'submit' }, disabled: saving }));
-  if (workspace) actions.append(makeButton('キャンセル', callbacks.onCancelEdit, 'bb-ws-button'));
-  else actions.append(makeButton('一覧へ戻る', callbacks.onBack, 'objective-editor-button-secondary'));
+  const saving = callbacks.saving || state.save.state === 'saving';
+  const unverified = state.save.state === 'saved_unverified';
+  if (saving) actions.append(makeElement('span', { className: 'objective-editor-muted', text: '保存中の処理は、画面を閉じても続きます。' }));
+  if (unverified) actions.append(makeElement('span', { className: 'objective-editor-muted', text: '一覧を再読込し、保存した目的を選び直して確かめてください。' }));
+  if (callbacks.canEdit) actions.append(makeElement('button', { className: workspace ? 'bb-ws-button is-primary' : 'objective-editor-button-primary', text: saving ? '保存中…' : '保存', attrs: { type: 'submit' }, disabled: saving || unverified }));
+  const dismiss = workspace
+    ? makeButton('キャンセル', callbacks.onCancelEdit, 'bb-ws-button')
+    : makeButton('一覧へ戻る', callbacks.onBack, 'objective-editor-button-secondary');
+  actions.append(dismiss);
   form.append(actions);
+  if (saving) {
+    for (const control of findAll(form, (node) => ['INPUT', 'SELECT', 'TEXTAREA', 'BUTTON'].includes(node.tagName))) {
+      if (control !== dismiss) control.disabled = true;
+    }
+  }
+  form.addEventListener('input', captureDraft);
+  form.addEventListener('change', captureDraft);
   form.addEventListener('submit', (event) => {
     event.preventDefault();
+    if (saving || unverified) return;
     callbacks.onSubmit?.(collectDefinition(form, draft));
   });
   return form;
@@ -1107,7 +1138,7 @@ function renderObjectiveFormRail(doc, state, callbacks) {
     // A conflict keeps the input; saving again with the same revision would fail again, so no retry there.
     parts.push(workspaceStatusNotice(doc, state.save, {
       label: '保存',
-      onRetry: state.save.state === 'conflict' ? null : callbacks.onRetrySave,
+      onRetry: ['conflict', 'saved_unverified'].includes(state.save.state) ? null : callbacks.onRetrySave,
       retryLabel: 'もう一度保存',
     }));
   }
@@ -1219,20 +1250,35 @@ export function createObjectiveEditorController(options = {}) {
   };
   // The objective shown before 新しい目的, to return to when the owner cancels.
   let beforeCreate = null;
+  // Requests may finish after Cancel or a newer selection. Only the current
+  // screen may consume their results; the save lock survives those changes.
+  let selectionVersion = 0;
+  let editorVersion = 0;
+  let listRequest = 0;
+  let readinessRequest = 0;
+  let constraintRequest = 0;
+  let renderVersion = 0;
+  let activeSave = null;
 
   function render() {
     if (!root) return null;
+    const currentRender = ++renderVersion;
+    const currentEditor = editorVersion;
     const callbacks = {
       canEdit,
+      saving: activeSave !== null,
       constraintsEditable,
       storyLinks,
       onView: (view) => { state.view = view; render(); },
       onReload: loadObjectives,
       onCreate: beginCreate,
       onSelect: selectObjective,
-      onBack: () => { state.view = 'list'; render(); },
-      onSubmit: saveObjective,
-      onRetrySave: () => state.editor.mode === 'create' ? saveObjective(state.editor.draft) : saveObjective(state.editor.draft),
+      onBack: () => { cancelEdit(); state.view = 'list'; render(); },
+      onSubmit: (definition) => currentEditor === editorVersion && currentRender === renderVersion ? saveObjective(definition) : null,
+      onDraftChange: (definition) => {
+        if (currentEditor === editorVersion && currentRender === renderVersion && !activeSave) state.editor.draft = definition;
+      },
+      onRetrySave: () => saveObjective(state.editor.draft),
       onAddCriterion: () => { state.editor.draft.criteria = [...(state.editor.draft.criteria ?? []), { variableRef: { id: '', type: 'variable', revision: '' }, operator: 'equals' }]; render(); },
       onRemoveCriterion: (index) => { state.editor.draft.criteria = (state.editor.draft.criteria ?? []).filter((_, itemIndex) => itemIndex !== index); render(); },
       onAddConstraintRef: addConstraintRef,
@@ -1243,6 +1289,10 @@ export function createObjectiveEditorController(options = {}) {
       onEdit: beginEdit,
       onCancelEdit: cancelEdit,
     };
+    // Detached forms and buttons must not act on a newer editor session.
+    for (const [name, callback] of Object.entries(callbacks)) {
+      if (typeof callback === 'function') callbacks[name] = (...args) => currentRender === renderVersion ? callback(...args) : undefined;
+    }
     return rail ? renderObjectiveWorkspace(root, rail, state, callbacks, page, options) : renderObjectiveEditor(root, state, callbacks);
   }
 
@@ -1256,6 +1306,8 @@ export function createObjectiveEditorController(options = {}) {
   }
 
   async function loadObjectives() {
+    const request = ++listRequest;
+    const version = editorVersion;
     state.objectives = { state: 'loading', records: null, absence_confirmed: false };
     state.connection = port ? 'ready' : 'api_unavailable';
     render();
@@ -1267,20 +1319,26 @@ export function createObjectiveEditorController(options = {}) {
       return state.objectives;
     }
     try {
-      state.objectives = normalizeObjectiveCollection(await method(context));
+      const payload = await method(context);
+      if (request !== listRequest) return state.objectives;
+      state.objectives = normalizeObjectiveCollection(payload);
       state.connection = state.objectives.state === 'ready' || state.objectives.state === 'empty' ? 'ready' : state.objectives.state;
     } catch (error) {
+      if (request !== listRequest) return state.objectives;
       state.objectives = { state: normalizeObjectiveError(error).state, records: null, absence_confirmed: false, ...normalizeObjectiveError(error) };
       state.connection = state.objectives.state;
     }
     render();
     // As on the organization screens, the workspace opens with the first row selected.
     const first = state.objectives.records?.[0];
-    if (rail && first && !state.selectedId && state.railMode !== 'form') await selectObjective(first);
+    if (rail && first && !state.selectedId && state.railMode !== 'form' && version === editorVersion) await selectObjective(first);
     return state.objectives;
   }
 
   async function loadConstraintRefs(objective) {
+    const version = selectionVersion;
+    const request = ++constraintRequest;
+    const current = () => version === selectionVersion && request === constraintRequest;
     state.constraints = { state: 'loading', refs: null, absence_confirmed: false };
     render();
     if (!objective) {
@@ -1297,13 +1355,15 @@ export function createObjectiveEditorController(options = {}) {
     }
     try {
       const payload = await method({ id: objective.id, type: 'objective', revision: objective.revision }, context);
+      if (!current()) return state.constraints;
       state.constraints = normalizeReferenceCollection(payload, ['refs', 'references', 'constraints', 'records', 'items', 'data']);
-      if (state.constraints.refs) {
+      if (state.constraints.refs && !state.editor.constraintRefsChanged) {
         state.editor.constraintRefs = state.constraints.refs;
         state.editor.originalConstraintRefs = JSON.parse(JSON.stringify(state.constraints.refs));
         state.editor.constraintRefsChanged = false;
       }
     } catch (error) {
+      if (!current()) return state.constraints;
       state.constraints = { state: normalizeObjectiveError(error).state, refs: null, absence_confirmed: false, ...normalizeObjectiveError(error) };
     }
     render();
@@ -1312,6 +1372,10 @@ export function createObjectiveEditorController(options = {}) {
 
   async function loadReadiness(objective) {
     if (!objective) return state.readiness;
+    const version = selectionVersion;
+    const request = ++readinessRequest;
+    const current = () => version === selectionVersion && request === readinessRequest
+      && state.selected?.id === objective.id && state.selected?.revision === objective.revision;
     const method = portMethod(port, 'checkObjectiveReadiness');
     if (!method) {
       state.readiness = { state: 'unknown', ready: null, issues: null, message: '判断に使える状態を確かめる経路がありません。' };
@@ -1319,8 +1383,11 @@ export function createObjectiveEditorController(options = {}) {
       return state.readiness;
     }
     try {
-      state.readiness = normalizeReadiness(await method(objective.id, context, objective.revision));
+      const payload = await method(objective.id, context, objective.revision);
+      if (!current()) return state.readiness;
+      state.readiness = normalizeReadiness(payload);
     } catch (error) {
+      if (!current()) return state.readiness;
       state.readiness = { state: normalizeObjectiveError(error).state, ready: null, issues: null, ...normalizeObjectiveError(error) };
     }
     if (state.selected) state.selected.readiness = state.readiness;
@@ -1333,10 +1400,13 @@ export function createObjectiveEditorController(options = {}) {
     const id = reference?.id;
     const revision = reference?.revision;
     if (!id) return null;
+    const version = ++selectionVersion;
+    editorVersion += 1;
+    state.selected = null;
     state.selectedId = id;
+    state.save = { state: 'idle' };
     if (rail) {
       state.railMode = 'detail';
-      state.save = { state: 'idle' };
       beforeCreate = null;
     }
     state.view = 'editor';
@@ -1353,6 +1423,7 @@ export function createObjectiveEditorController(options = {}) {
     }
     try {
       const payload = await method(id, context, revision);
+      if (version !== selectionVersion) return null;
       const objective = normalizeObjectiveRecord(payload);
       if (!objective) {
         state.editor = { ...state.editor, state: 'missing', message: '指定した目的を保存先から確認できません。' };
@@ -1370,6 +1441,7 @@ export function createObjectiveEditorController(options = {}) {
       await Promise.allSettled([loadReadiness(objective), loadConstraintRefs(objective)]);
       return objective;
     } catch (error) {
+      if (version !== selectionVersion) return null;
       const normalized = normalizeObjectiveError(error);
       state.editor = { ...state.editor, state: normalized.state, message: normalized.message, error: normalized.error };
       state.connection = normalized.state;
@@ -1379,6 +1451,10 @@ export function createObjectiveEditorController(options = {}) {
   }
 
   function beginCreate() {
+    // A repeated click on New must not throw away an in-progress draft.
+    if (state.editor.mode === 'create' && state.railMode === 'form') return;
+    selectionVersion += 1;
+    editorVersion += 1;
     if (rail && state.railMode !== 'form') beforeCreate = state.selected;
     state.railMode = 'form';
     state.view = 'editor';
@@ -1399,6 +1475,8 @@ export function createObjectiveEditorController(options = {}) {
   /** Workspace layout: open the edit form for the selected objective in the rail. */
   function beginEdit() {
     if (!state.selected) return;
+    if (state.railMode === 'form' && state.editor.mode === 'edit') return;
+    editorVersion += 1;
     state.editor = {
       ...state.editor,
       state: 'ready', mode: 'edit', draft: editorDraftFromObjective(state.selected), expectedRevision: state.selected.revision,
@@ -1411,12 +1489,14 @@ export function createObjectiveEditorController(options = {}) {
     render();
   }
 
-  /** Workspace layout: leave the form without saving and show the objective again. */
+  /** Discard unsaved input and leave the form; an already sent write cannot be undone. */
   function cancelEdit() {
+    editorVersion += 1;
     const creating = state.editor.mode === 'create';
     state.railMode = 'detail';
     state.save = { state: 'idle' };
     if (creating) {
+      selectionVersion += 1;
       const previous = beforeCreate;
       beforeCreate = null;
       state.editor = { state: 'idle', mode: 'edit', draft: null, expectedRevision: null, constraintRefs: null, originalConstraintRefs: null, constraintRefsChanged: false };
@@ -1438,7 +1518,7 @@ export function createObjectiveEditorController(options = {}) {
   }
 
   function addConstraintRef(reference) {
-    if (!constraintsEditable) return;
+    if (!canEdit || !constraintsEditable || activeSave) return;
     const normalized = normalizeReference(reference, 'constraint');
     if (!normalized || normalized.type !== 'constraint') return;
     const refs = state.editor.constraintRefs ?? [];
@@ -1449,7 +1529,7 @@ export function createObjectiveEditorController(options = {}) {
   }
 
   function removeConstraintRef(reference) {
-    if (!constraintsEditable) return;
+    if (!canEdit || !constraintsEditable || activeSave) return;
     state.editor.constraintRefs = (state.editor.constraintRefs ?? []).filter((item) => !(item.id === reference.id && item.revision === reference.revision));
     state.editor.constraintRefsChanged = true;
     render();
@@ -1457,7 +1537,16 @@ export function createObjectiveEditorController(options = {}) {
 
   async function saveObjective(definition) {
     if (!definition) return null;
+    if (!canEdit) return { state: 'permission_denied', message: 'この画面では目的を保存できません。' };
+    if (activeSave) return { state: 'saving', action: activeSave.mode };
+    // Once a mutation succeeded, repeating it is unsafe until the owner has
+    // reloaded and selected the canonical revision again.
+    if (state.save.state === 'saved_unverified') return state.save;
+    definition = definitionForSave(definition);
     const mode = state.editor.mode;
+    const expectedRevision = state.editor.expectedRevision;
+    const constraintRefsChanged = state.editor.constraintRefsChanged;
+    const constraintRefs = JSON.parse(JSON.stringify(state.editor.constraintRefs ?? []));
     const updateMethod = mode === 'create' ? null : portMethod(port, 'updateObjective');
     const createMethod = mode === 'create' ? portMethod(port, 'createObjective') : null;
     if ((mode === 'create' && !createMethod) || (mode !== 'create' && !updateMethod)) {
@@ -1465,80 +1554,93 @@ export function createObjectiveEditorController(options = {}) {
       render();
       return state.save;
     }
-    if (state.editor.constraintRefsChanged && !portMethod(port, 'replaceObjectiveConstraintRefs')) {
+    if (constraintRefsChanged && !portMethod(port, 'replaceObjectiveConstraintRefs')) {
       state.save = { state: 'api_unavailable', message: '制約の参照を保存する経路が無いため、目的の本文も保存していません。' };
       render();
       return state.save;
     }
+    const version = editorVersion;
+    const current = () => version === editorVersion;
+    const publish = (result) => {
+      if (current()) { state.save = result; render(); }
+      return result;
+    };
+    const saving = { mode };
+    activeSave = saving;
     state.editor.draft = definition;
     state.save = { state: 'saving', action: mode };
     render();
+    let mutation;
+    let mutationCompleted = false;
     try {
-      const mutation = mode === 'create'
+      mutation = mode === 'create'
         ? await createMethod(definition, context)
-        : await updateMethod(definition.id, state.editor.expectedRevision, definition, context);
+        : await updateMethod(definition.id, expectedRevision, definition, context);
+      mutationCompleted = true;
+      if (!current()) return { state: 'saved_unverified', action: mode, mutation };
       const savedRef = extractMutationRef(mutation);
       if (!savedRef || savedRef.id !== definition.id || savedRef.type !== 'objective' || !savedRef.revision) {
-        state.save = { state: 'saved_unverified', message: '保存の応答に、同じ目的の新しい版が含まれていません。', mutation };
-        render();
-        return state.save;
+        return publish({ state: 'saved_unverified', message: '保存の応答に、同じ目的の新しい版が含まれていません。', mutation });
       }
-      const expectedRevision = state.editor.expectedRevision;
       if (mode !== 'create' && (!expectedRevision || savedRef.revision === expectedRevision)) {
-        state.save = {
+        return publish({
           state: 'saved_unverified',
           message: '更新応答にexpectedRevisionとは異なる新版が含まれていません。',
           mutation,
           expectedRevision,
           reference: savedRef,
-        };
-        render();
-        return state.save;
+        });
       }
       const readMethod = portMethod(port, 'readObjective');
       const readback = readMethod ? normalizeObjectiveRecord(await readMethod(savedRef.id, context, savedRef.revision)) : null;
+      if (!current()) return { state: 'saved_unverified', action: mode, mutation, readback };
       const returnedDefinition = readback ? { id: readback.id, type: readback.type, revision: readback.revision, digest: readback.digest } : null;
       const referenceMatches = definitionsEqual(savedRef, returnedDefinition);
       if (!referenceMatches || !readback || (mode !== 'create' && (!expectedRevision || readback.revision === expectedRevision))) {
-        state.save = { state: 'saved_unverified', message: '保存した新しい版を読み戻して確かめられません。', mutation, readback };
-        render();
-        return state.save;
+        return publish({ state: 'saved_unverified', message: '保存した新しい版を読み戻して確かめられません。一覧を再読込して確かめてください。', mutation, readback });
       }
-      if (state.editor.constraintRefsChanged) {
+      if (constraintRefsChanged) {
         const replaceRefs = portMethod(port, 'replaceObjectiveConstraintRefs');
-        await replaceRefs(savedRef, state.editor.constraintRefs ?? [], context);
+        await replaceRefs(savedRef, constraintRefs, context);
+        if (!current()) return { state: 'saved_unverified', action: mode, mutation, readback };
         const readConstraintRefs = portMethod(port, 'listObjectiveConstraintRefs') ?? portMethod(port, 'listConstraintReferences');
         const constraintPayload = readConstraintRefs
           ? await readConstraintRefs(savedRef, context)
           : null;
+        if (!current()) return { state: 'saved_unverified', action: mode, mutation, readback };
         const verifiedRefs = normalizeReferenceCollection(constraintPayload).refs;
-        if (!verifiedRefs || !referencesEqual(verifiedRefs, state.editor.constraintRefs)) {
-          state.save = { state: 'saved_unverified', message: '目的は保存されましたが、制約の参照を読み戻した内容が一致しません。', mutation, readback, constraintRefs: verifiedRefs };
-          render();
-          return state.save;
+        if (!verifiedRefs || !referencesEqual(verifiedRefs, constraintRefs)) {
+          return publish({ state: 'saved_unverified', message: '目的は保存されましたが、制約の参照を読み戻した内容が一致しません。', mutation, readback, constraintRefs: verifiedRefs });
         }
       }
+      // Reads of the previous revision must not replace the saved revision's
+      // readiness or constraints when they finish out of order.
+      selectionVersion += 1;
       state.selected = readback;
       state.selectedId = readback.id;
       state.railMode = 'detail';
       beforeCreate = null;
       state.editor = {
         state: 'ready', mode: 'edit', draft: editorDraftFromObjective(readback), expectedRevision: readback.revision,
-        constraintRefs: state.editor.constraintRefs ?? [], originalConstraintRefs: state.editor.constraintRefs ?? [], constraintRefsChanged: false,
+        constraintRefs, originalConstraintRefs: constraintRefs, constraintRefsChanged: false,
       };
-      state.save = { state: 'verified', action: mode, reference: savedRef, readback };
+      const result = { state: 'verified', action: mode, reference: savedRef, readback };
+      state.save = result;
       state.connection = 'ready';
       // Readiness belongs to a revision; re-read it for the one just saved.
       state.readiness = { state: 'unknown', ready: null, issues: null };
       render();
       await loadReadiness(readback);
-      await loadObjectives();
-      return state.save;
+      if (current()) await loadObjectives();
+      return result;
     } catch (error) {
       const normalized = normalizeObjectiveError(error);
-      state.save = { state: normalized.state, message: normalized.message, currentRevision: normalized.currentRevision, error: normalized.error, draft: definition };
+      return publish(mutationCompleted
+        ? { state: 'saved_unverified', message: '目的は保存されましたが、保存結果を確かめられません。一覧を再読込して確かめてください。', mutation, error: normalized.error, draft: definition }
+        : { state: normalized.state, message: normalized.message, currentRevision: normalized.currentRevision, error: normalized.error, draft: definition });
+    } finally {
+      if (activeSave === saving) activeSave = null;
       render();
-      return state.save;
     }
   }