@yuneta/gobj-ui 7.25.7 → 7.25.9

package/src/c_yui_schema_editor.js

@@ -135,6 +135,7 @@ import {
     col_enum,
     is_empty_value,
     fkey_ref,
+    parse_fkey_ref,
     next_order,
     moved_orders,
 } from "./schema_model.js";
@@ -202,10 +203,13 @@ SDATA_END()
 let PRIVATE_DATA = {
     /*  What the store answered, and what it means  */
     records:        null,   /*  {treedbs, topics, cols} as they arrived  */
+    records_before: null,   /*  the records of the model shown, while a load replaces them  */
     model:          null,   /*  build_schema_model() of the above  */
+    model_gen:      0,      /*  which LOAD the model is: a dialog is stamped with it  */
     pending:        0,      /*  `nodes` requests still in flight  */
     load_error:     "",
     load_round:     0,      /*  which load an answer belongs to: echoed as `round`  */
+    load_keeps_written: false,  /*  the load in flight is not the host's: `written` survives it  */
 
     /*  Where the operator is. The url carries it; these mirror it.  */
     treedb_id:      "",
@@ -223,6 +227,7 @@ let PRIVATE_DATA = {
     /*  Children and overlays  */
     diagram_gobj:   null,
     dialog:         null,
+    dialog_gen:     0,      /*  the model_gen the open dialog was built on  */
 
     /*  A write, or a plan of them, in flight  */
     save_queue:     null,
@@ -443,6 +448,36 @@ function refuse_if_readonly(gobj, event)
     return true;
 }
 
+/***************************************************************
+ *  A decision taken on a model a load has since REPLACED: the Save
+ *  of a form, a confirmation, an import. Each carries the
+ *  `model_gen` it was built on (a number, not the model: a kw is
+ *  dumped by the machine trace).
+ *
+ *  Refused, and said. A column form sends every field it shows, so
+ *  its Save after a reload wrote the OLD record over the newer one
+ *  (fourth independent review, probe A3); a form whose column the
+ *  reload removed answered "names no column" for ever. end_load()
+ *  closes such a dialog when the load lands; this is the same rule
+ *  for whatever arrives anyway -- a stale screen, a confirmation
+ *  that was up, a keyboard.
+ *
+ *  A kw with no stamp is not a dialog's and is not asked.
+ ***************************************************************/
+function built_on_a_replaced_model(gobj, event, kw)
+{
+    let priv = gobj.priv;
+
+    if(!kw || kw.model_gen === undefined || kw.model_gen === priv.model_gen) {
+        return false;
+    }
+    log_warning(`${gobj_short_name(gobj)}: ${event} refused, it was decided on ` +
+        `the schemas a reload replaced`);
+    yui_shell_show_error(yui_shell_of(gobj),
+        "the schemas were read again: open the dialog again", {t: t});
+    return true;
+}
+
 
 
 
@@ -458,8 +493,31 @@ function refuse_if_readonly(gobj, event)
  *  schema set of the yuno is here: everything below — the
  *  drawing, the validation, the export — is computed from these
  *  and asks the backend nothing more.
+ *
+ *  THE LOADING SCREEN IS DRAWN, not assumed. ST_LOADING declares
+ *  none of the actions of a screen, so the screen it replaces goes
+ *  and the toolbar stops answering: left up, a click on a card, on
+ *  Back or on the drawing answered "Event NOT DEFINED in state
+ *  ST_LOADING" and was lost (third independent review). A dialog
+ *  left open is answered in ST_LOADING instead (ac_wait_for_the_load),
+ *  and a load that LANDS closes it (end_load()): it was built on the
+ *  model the load replaced, and its Save sends every field it shows.
+ *  An import plan is forgotten here for the same reason: it is a list
+ *  of writes computed against the model going away.
+ *
+ *  `keep_written`: a load the host did not ask for -- the reconnect,
+ *  a write that turned out done -- keeps what this session wrote.
+ *  Only the host's EV_REFRESH (a Save sends it) forgets it.
+ *
+ *  A load that cannot leave WHOLE did not happen (out of session it
+ *  is not even asked): the records the model was built on are put
+ *  back (emptied, the next write patched them into a model with no
+ *  treedb), the round is spent so a request that did leave is
+ *  stale, and the session back asks again. A load that left and
+ *  FAILED keeps them the same way (`records_before`,
+ *  ac_mt_command_answer()).
  ***************************************************************/
-function request_model(gobj)
+function request_model(gobj, keep_written)
 {
     let priv = gobj.priv;
     let remote = gobj_read_pointer_attr(gobj, "gobj_remote_yuno");
@@ -468,27 +526,45 @@ function request_model(gobj)
         return -1;      /*  not mounted on a transport yet: mt_start retries via EV_TRANSPORT_STATE  */
     }
 
+    forget_import_plan(gobj);
+
+    let previous = priv.records;
+    priv.records_before = previous;
     priv.records = {treedbs: [], topics: [], cols: []};
     priv.load_error = "";
     priv.pending = 0;
     priv.load_round++;
+    priv.load_keeps_written = !!keep_written;
     gobj_change_state(gobj, "ST_LOADING");
-    show_notice(gobj, "loading the schemas");
-
-    for(let topic_name of [T_TREEDBS, T_TOPICS, T_COLS]) {
-        if(remote_command(gobj, "nodes", {
-            topic_name: topic_name,
-            options:    {list_dict: true}
-        }, {round: priv.load_round}) === 0) {
-            priv.pending++;
+    set_busy(gobj, false);
+    render(gobj);
+
+    /*  Out of session nothing is asked: each request would come back
+     *  refused and logged as an ERROR, for a drop that is not one.  */
+    let left = 0;
+    if(transport_in_session(gobj)) {
+        for(let topic_name of [T_TREEDBS, T_TOPICS, T_COLS]) {
+            if(remote_command(gobj, "nodes", {
+                topic_name: topic_name,
+                options:    {list_dict: true}
+            }, {round: priv.load_round}) === 0) {
+                left++;
+            }
         }
     }
-    if(priv.pending === 0) {
+    if(left < 3) {
+        priv.records = previous;
+        priv.records_before = null;
+        priv.load_round++;
+        priv.reload_on_open = true;
         priv.load_error = t("cannot reach the treedb");
-        gobj_change_state(gobj, "ST_IDLE");
-        show_notice(gobj, "cannot reach the treedb");
+        if(priv.model) {
+            yui_shell_show_error(yui_shell_of(gobj), "cannot reach the treedb", {t: t});
+        }
+        end_load(gobj);
         return -1;
     }
+    priv.pending = left;
     return 0;
 }
 
@@ -571,17 +647,23 @@ function build_model(gobj)
  *  From here on, "did this session change it?" has an answer.
  *
  *  Called ONLY when records arrive from the store: that is what a
- *  measurement of "changed since" can be measured against. Both
- *  halves reset together -- a baseline without its `written` is
- *  the same false positive from the other side, since every
- *  version equals a baseline just taken.
+ *  measurement of "changed since" can be measured against.
+ *
+ *  `written` is forgotten only by a load the HOST asked for (its
+ *  EV_REFRESH, which a Save sends). Since M36 a write moves no
+ *  version, so `written` is the draft chip of what this session
+ *  wrote and no longer half of a version measurement: a reload of
+ *  the reconnect, or of a write that turned out done, forgot the
+ *  chips of writes the host had not been told about.
  ***************************************************************/
 function start_measuring(gobj)
 {
     let priv = gobj.priv;
 
     priv.baseline = {};
-    priv.written = {};
+    if(!priv.load_keeps_written) {
+        priv.written = {};
+    }
     priv.host_ids = {};
 
     if(!priv.model) {
@@ -605,9 +687,10 @@ function start_measuring(gobj)
  *  until the host saves it (C_TREEDB's save-schema, which raises the
  *  versions of what changed). Two sources say a topic is one, and
  *  they are kept APART because they are forgotten differently:
- *    - `written`: what THIS session wrote since the model was loaded
- *      (a reload, the host's EV_REFRESH, forgets it -- the store says
- *      what is left);
+ *    - `written`: what THIS session wrote. Only a load the HOST asked
+ *      for forgets it (its EV_REFRESH, which a Save sends); the
+ *      reconnect's reload, the one owed after a write and a late
+ *      write's keep it (start_measuring(), request_model());
  *    - `host_ids`: what the host said last (EV_DRAFTS), replaced WHOLE
  *      by the next EV_DRAFTS. Folded into `written`, a topic the host
  *      named once stayed a draft after the Save that published it.
@@ -805,12 +888,27 @@ function render_toolbar(gobj)
     let state = gobj_current_state(gobj);
     let readonly = is_readonly(gobj);
     let has_model = !!priv.model;
+    /*  The position can outlive its screen (a load that failed keeps the
+     *  url's; ST_EMPTY has a treedb in the url and none in the model),
+     *  and a button there sends what only a treedb screen declares.  */
+    let on_a_treedb = state !== "ST_IDLE" && state !== "ST_EMPTY";
+    /*  ...and the screen can outlive the treedb or the topic it is ON: a
+     *  reload that no longer has them keeps the position (it says so,
+     *  and Back is the way out). Asked of the MODEL, not of the state:
+     *  gated on the state, Diagram, Check, Export, Import and New topic
+     *  stayed up there and each logged "with no treedb open" (fourth
+     *  independent review, probe D2).  */
+    let treedb_here = on_a_treedb && !!current_treedb(gobj);
+    let topic_here = treedb_here && !!current_topic(gobj);
+    /*  Nothing is legal while the model is in the air: every action is
+     *  computed against it.  */
+    let in_flight = state === "ST_SAVING" || state === "ST_LOADING";
 
     /*----------------------------------------------*
      *  Left: back, then the position as a trail.
      *----------------------------------------------*/
     let $left = [];
-    if(priv.treedb_id) {
+    if(priv.treedb_id && on_a_treedb) {
         $left.push(["button", {class: "SCHEMA_BACK button",
                                type: "button",
                                title: t("back"), "aria-label": t("back"),
@@ -847,7 +945,7 @@ function render_toolbar(gobj)
      *  refused says why when it is pressed.
      *----------------------------------------------*/
     let $right = [];
-    if(priv.treedb_id && has_model) {
+    if(priv.treedb_id && has_model && treedb_here) {
         /*  The compass, like every other door to a SCHEMA: the
          *  `hexagon-nodes` it wore is the graph of the DATA.  */
         $right.push(toolbar_button("SCHEMA_DIAGRAM_BTN", "yi-compass-drafting",
@@ -861,7 +959,7 @@ function render_toolbar(gobj)
                 "import", "EV_IMPORT", false));
         }
     }
-    if(priv.topic_name && !readonly && !priv.diagram) {
+    if(priv.topic_name && !readonly && !priv.diagram && topic_here) {
         /*  Only while there IS somewhere to go back to: a drag is a write,
          *  and this is the way back from one. */
         if(undo_order_writes(gobj, current_topic(gobj)).length > 0) {
@@ -871,7 +969,7 @@ function render_toolbar(gobj)
         $right.push(toolbar_button("SCHEMA_ADD_COL_BTN", "yi-plus",
             "new column", "EV_ADD_COLUMN", false));
     }
-    if(priv.treedb_id && !priv.topic_name && !readonly && !priv.diagram) {
+    if(priv.treedb_id && !priv.topic_name && !readonly && !priv.diagram && treedb_here) {
         $right.push(toolbar_button("SCHEMA_ADD_TOPIC_BTN", "yi-plus",
             "new topic", "EV_ADD_TOPIC", false));
     }
@@ -894,7 +992,7 @@ function render_toolbar(gobj)
      *  destroyed.  */
     for(let $button of $bar.querySelectorAll("button")) {
         $button.__gobj__ = gobj;
-        if(state === "ST_SAVING") {
+        if(in_flight) {
             $button.disabled = true;
         }
     }
@@ -918,19 +1016,25 @@ function render(gobj)
     }
     render_toolbar(gobj);
 
+    /*  A screen with nothing to draw takes the drawing down too: left
+     *  alive, it was only re-shown on the way back -- into a body that
+     *  no longer held it.  */
     if(state === "ST_LOADING") {
         show_notice(gobj, "loading the schemas");
+        destroy_diagram(gobj);
         clear($body);
         return;
     }
     if(state === "ST_IDLE") {
         show_notice(gobj, priv.load_error ? "cannot load the schemas" : "not connected",
             priv.load_error);
+        destroy_diagram(gobj);
         clear($body);
         return;
     }
     if(state === "ST_EMPTY") {
         show_notice(gobj, "this yuno stores no schema");
+        destroy_diagram(gobj);
         clear($body);
         return;
     }
@@ -1471,12 +1575,21 @@ function render_diagram(gobj)
     let $body = $of(gobj, ".SCHEMA_BODY");
     let treedb = current_treedb(gobj);
 
-    if(!$body || !treedb) {
+    if(!$body) {
+        return;
+    }
+    /*  Said on an EMPTY body, as the topics and the columns say it:
+     *  render() clears the body for every screen but this one, and the
+     *  screen before stayed up under the notice, clickable.  */
+    if(!treedb) {
+        destroy_diagram(gobj);
+        clear($body);
         show_notice(gobj, "that treedb is not here any more", priv.treedb_id);
         return;
     }
     if(!gclass_find_by_name("C_YUI_TREEDB_SCHEMA")) {
         log_error(`${gobj_short_name(gobj)}: C_YUI_TREEDB_SCHEMA not registered by the app`);
+        clear($body);
         show_notice(gobj, "the schema drawing is not available");
         return;
     }
@@ -1571,6 +1684,7 @@ function open_dialog(gobj, $content, title, logical, title_prefix)
     let priv = gobj.priv;
 
     close_dialog(gobj);
+    priv.dialog_gen = priv.model_gen;
     priv.dialog = yui_shell_show_modal(yui_shell_of(gobj), $content, {
         dialog:        true,
         title:         title,
@@ -1619,6 +1733,10 @@ function name_control($spec, label)
             $spec[1]["aria-label"] = t(label);
             $spec[1]["data-i18n-aria-label"] = label;
         }
+        if(!$spec[1].title) {
+            $spec[1].title = t(label);
+            $spec[1]["data-i18n-title"] = label;
+        }
         return true;
     }
     for(let child of ($spec[2] || [])) {
@@ -1629,6 +1747,19 @@ function name_control($spec, label)
     return false;
 }
 
+/***************************************************************
+ *  The four attributes that NAME a control -- a title and an
+ *  aria-label, each with the key a language change re-translates
+ *  it by. A visible label is not a name (CLAUDE.md).
+ ***************************************************************/
+function name_attrs(key, attrs)
+{
+    return Object.assign({
+        title: t(key), "data-i18n-title": key,
+        "aria-label": t(key), "data-i18n-aria-label": key
+    }, attrs);
+}
+
 function field(logical, name, label, $control, help)
 {
     /*  The label is a SIBLING of the control -- Bulma's `field` shape --
@@ -1782,6 +1913,7 @@ function open_column_form(gobj, topic, col, prefill)
     let hook_col = hook_topic ? hook[hook_topic] : "";
     let treedb = current_treedb(gobj);
     let sibling_topics = treedb ? treedb.topics.map(x => x.name) : [];
+    let model_gen = priv.model_gen;
 
     let $form = createElement2(
         ["div", {class: "SCHEMA_COL_FORM box"}, [
@@ -1823,9 +1955,10 @@ function open_column_form(gobj, topic, col, prefill)
                 text_input("description", record.description, "")),
             ["div", {class: "SCHEMA_COL_FORM_ACTIONS is-flex mt-4",
                      style: "gap:.5rem; justify-content:flex-end;"}, [
-                ["button", {class: "SCHEMA_COL_FORM_CANCEL button", type: "button"},
+                ["button", name_attrs("cancel", {class: "SCHEMA_COL_FORM_CANCEL button", type: "button"}),
                     [["span", {i18n: "cancel"}, t("cancel")]]],
-                ["button", {class: "SCHEMA_COL_FORM_SAVE button is-primary", type: "button"},
+                ["button", name_attrs("save", {class: "SCHEMA_COL_FORM_SAVE button is-primary",
+                                               type: "button"}),
                     [["span", {class: "icon"}, [["i", {class: "yi-floppy-disk"}]]],
                      ["span", {i18n: "save"}, t("save")]]]
             ]]
@@ -1866,10 +1999,11 @@ function open_column_form(gobj, topic, col, prefill)
         let values = read_form($form);
         values.flag = read_flags($form);
         gobj_send_event(gobj, "EV_SAVE_COLUMN", {
-            topic:    topic.name,
-            col:      creating ? "" : col.name,
-            creating: creating,
-            values:   values
+            topic:     topic.name,
+            col:       creating ? "" : col.name,
+            creating:  creating,
+            values:    values,
+            model_gen: model_gen
         }, gobj);
     });
 
@@ -1902,6 +2036,7 @@ function open_topic_form(gobj, treedb, topic)
     let record = (topic && topic.record) || {};
     let creating = !topic;
     let col_names = topic ? topic.cols.map(c => c.name) : [];
+    let model_gen = gobj.priv.model_gen;
 
     let $form = createElement2(
         ["div", {class: "SCHEMA_TOPIC_FORM box"}, [
@@ -1941,10 +2076,10 @@ function open_topic_form(gobj, treedb, topic)
             ]],
             ["div", {class: "SCHEMA_TOPIC_FORM_ACTIONS is-flex mt-4",
                      style: "gap:.5rem; justify-content:flex-end;"}, [
-                ["button", {class: "SCHEMA_TOPIC_FORM_CANCEL button", type: "button"},
+                ["button", name_attrs("cancel", {class: "SCHEMA_TOPIC_FORM_CANCEL button", type: "button"}),
                     [["span", {i18n: "cancel"}, t("cancel")]]],
-                ["button", {class: "SCHEMA_TOPIC_FORM_SAVE button is-primary",
-                            type: "button"},
+                ["button", name_attrs("save", {class: "SCHEMA_TOPIC_FORM_SAVE button is-primary",
+                                               type: "button"}),
                     [["span", {class: "icon"}, [["i", {class: "yi-floppy-disk"}]]],
                      ["span", {i18n: "save"}, t("save")]]]
             ]]
@@ -1958,9 +2093,10 @@ function open_topic_form(gobj, treedb, topic)
     $form.querySelector(".SCHEMA_TOPIC_FORM_SAVE").addEventListener("click", (evt) => {
         evt.stopPropagation();
         gobj_send_event(gobj, "EV_SAVE_TOPIC", {
-            topic:    creating ? "" : topic.name,
-            creating: creating,
-            values:   read_form($form)
+            topic:     creating ? "" : topic.name,
+            creating:  creating,
+            values:    read_form($form),
+            model_gen: model_gen
         }, gobj);
     });
 
@@ -2113,14 +2249,15 @@ function copy_text(gobj, $text)
  ***************************************************************/
 function open_import(gobj, treedb)
 {
+    let model_gen = gobj.priv.model_gen;
     let $content = createElement2(
         ["div", {class: "SCHEMA_IMPORT box"}, [
             ["p", {class: "SCHEMA_IMPORT_HELP help mb-2",
                    i18n: "paste a schema as json: the plan is shown before anything is written"},
                 t("paste a schema as json: the plan is shown before anything is written")],
-            ["textarea", {class: "SCHEMA_IMPORT_TEXT textarea is-small is-family-monospace",
+            ["textarea", name_attrs("schema", {class: "SCHEMA_IMPORT_TEXT textarea is-small is-family-monospace",
                           rows: "12", spellcheck: "false",
-                          placeholder: '{"id": "...", "schema_version": "1", "topics": []}'}, ""],
+                          placeholder: '{"id": "...", "schema_version": "1", "topics": []}'}), ""],
             ["label", {class: "SCHEMA_IMPORT_PRUNE checkbox mt-2"}, [
                 ["input", {type: "checkbox", class: "SCHEMA_IMPORT_PRUNE_BOX", checked: "checked"}],
                 ["span", {class: "ml-1", i18n: "delete what the pasted schema does not declare"},
@@ -2129,13 +2266,13 @@ function open_import(gobj, treedb)
             ["div", {class: "SCHEMA_IMPORT_PLAN mt-3"}, []],
             ["div", {class: "SCHEMA_IMPORT_ACTIONS is-flex mt-3",
                      style: "gap:.5rem; justify-content:flex-end;"}, [
-                ["button", {class: "SCHEMA_IMPORT_CANCEL button", type: "button"},
+                ["button", name_attrs("cancel", {class: "SCHEMA_IMPORT_CANCEL button", type: "button"}),
                     [["span", {i18n: "cancel"}, t("cancel")]]],
-                ["button", {class: "SCHEMA_IMPORT_PREVIEW button", type: "button"},
+                ["button", name_attrs("preview", {class: "SCHEMA_IMPORT_PREVIEW button", type: "button"}),
                     [["span", {class: "icon"}, [["i", {class: "yi-eye"}]]],
                      ["span", {i18n: "preview"}, t("preview")]]],
-                ["button", {class: "SCHEMA_IMPORT_RUN button is-warning",
-                            type: "button", disabled: "disabled"},
+                ["button", name_attrs("import", {class: "SCHEMA_IMPORT_RUN button is-warning",
+                                                 type: "button", disabled: "disabled"}),
                     [["span", {class: "icon"}, [["i", {class: "yi-upload"}]]],
                      ["span", {i18n: "import"}, t("import")]]]
             ]]
@@ -2154,13 +2291,14 @@ function open_import(gobj, treedb)
     $content.querySelector(".SCHEMA_IMPORT_PREVIEW").addEventListener("click", (evt) => {
         evt.stopPropagation();
         gobj_send_event(gobj, "EV_PREVIEW_IMPORT", {
-            text:  $text.value,
-            prune: $prune.checked
+            text:      $text.value,
+            prune:     $prune.checked,
+            model_gen: model_gen
         }, gobj);
     });
     $run.addEventListener("click", (evt) => {
         evt.stopPropagation();
-        gobj_send_event(gobj, "EV_APPLY_IMPORT", {}, gobj);
+        gobj_send_event(gobj, "EV_APPLY_IMPORT", {model_gen: model_gen}, gobj);
     });
 
     gobj.priv.import_pane = $plan_pane;
@@ -2168,6 +2306,23 @@ function open_import(gobj, treedb)
     open_dialog(gobj, $content, "import", "SCHEMA_IMPORT_DIALOG", treedb.id);
 }
 
+/***************************************************************
+ *  The plan is a list of writes computed against the model shown:
+ *  a load replaces the model, so the plan goes with it and the
+ *  dialog, if it stays up (a load that failed keeps the model),
+ *  asks for a Preview again.
+ ***************************************************************/
+function forget_import_plan(gobj)
+{
+    let priv = gobj.priv;
+
+    priv.import_plan = null;
+    clear(priv.import_pane);
+    if(priv.import_run) {
+        priv.import_run.disabled = true;
+    }
+}
+
 /***************************************************************
  *  The plan, drawn where the paste is: one line per write, the
  *  deletions apart and counted, because they are what the
@@ -2244,7 +2399,7 @@ function open_orphans(gobj)
             ["td", {class: "SCHEMA_ORPHAN_ID"}, [["code", {}, `${entry.id}`]]],
             ["td", {class: "SCHEMA_ORPHAN_ACTIONS has-text-right"},
                 readonly ? [] : [row_icon(gobj, "SCHEMA_ORPHAN_DELETE", "yi-trash", "delete",
-                    "EV_DELETE_ORPHAN", {kind: kind, id: entry.id})]]
+                    "EV_DELETE_ORPHAN", {kind: kind, id: entry.id, model_gen: priv.model_gen})]]
         ]];
     };
 
@@ -2459,6 +2614,11 @@ function transport_dropped(gobj)
         priv.load_round++;
         priv.pending = 0;
         priv.load_error = "";
+        if(priv.records_before) {
+            /*  The records of the model kept, not the half the load got.  */
+            priv.records = priv.records_before;
+            priv.records_before = null;
+        }
         return end_load(gobj);
     }
     return 0;
@@ -2470,6 +2630,12 @@ function transport_dropped(gobj)
  *  in flight (ac_show() kept it), or the one it had. Without a
  *  model there is no screen to go to: the position is kept for the
  *  next load, and the editor says why it is empty.
+ *
+ *  A dialog built on the model this load REPLACED is closed, and the
+ *  operator told to open it again: it shows the old record, and its
+ *  Save would write every field of it over the newer one. A load
+ *  that failed or never left replaced nothing (`model_gen` did not
+ *  move), and the dialog stays with what was typed.
  ***************************************************************/
 function end_load(gobj)
 {
@@ -2477,6 +2643,13 @@ function end_load(gobj)
     let seg = priv.pending_seg;
 
     priv.pending_seg = null;
+    if(priv.dialog && priv.dialog_gen !== priv.model_gen) {
+        log_warning(`${gobj_short_name(gobj)}: a dialog was open on the schemas ` +
+            `the load replaced: closed`);
+        close_dialog(gobj);
+        yui_shell_show_error(yui_shell_of(gobj),
+            "the schemas were read again: open the dialog again", {t: t});
+    }
     if(priv.model) {
         if(seg !== null) {
             return apply_seg(gobj, seg);
@@ -2501,29 +2674,15 @@ function end_writes(gobj, error)
 {
     let priv = gobj.priv;
 
+    let seg = priv.pending_seg;
+
     priv.save_queue = [];
+    priv.pending_seg = null;
     gobj_change_state(gobj, priv.save_return || "ST_TREEDBS");
     priv.save_return = "";
     show_notice(gobj, "");
     set_busy(gobj, false);
 
-    /*  A position that arrived while the write was in flight: applied
-     *  now, so a Back pressed mid-save is not simply lost.  */
-    if(priv.pending_seg !== null) {
-        let seg = priv.pending_seg;
-        priv.pending_seg = null;
-        if(!error) {
-            apply_seg(gobj, seg);
-            if(priv.save_wrote) {
-                gobj_publish_event(gobj, "EV_RECORD_WRITTEN", {
-                    treedb_name: gobj_read_str_attr(gobj, "treedb_name")
-                });
-            }
-            priv.save_wrote = false;
-            return reload_if_owed(gobj);
-        }
-    }
-
     if(error) {
         yui_shell_show_error(yui_shell_of(gobj), error, {t: t});
     }
@@ -2533,8 +2692,18 @@ function end_writes(gobj, error)
         });
     }
     priv.save_wrote = false;
-    render(gobj);
-    publish_check(gobj);
+
+    /*  A position that arrived while the write was in flight: applied
+     *  now, so a Back pressed mid-save is not simply lost -- with an
+     *  error too. The host's url already says it, and a load cut by a
+     *  drop applies it (end_load()): the write kept the old screen, and
+     *  the url and the view disagreed.  */
+    if(seg !== null) {
+        apply_seg(gobj, seg);
+    } else {
+        render(gobj);
+        publish_check(gobj);
+    }
     reload_if_owed(gobj);
     return error ? -1 : 0;
 }
@@ -2556,7 +2725,7 @@ function reload_if_owed(gobj)
         priv.reload_on_open = true;
         return 0;
     }
-    return request_model(gobj);
+    return request_model(gobj, true);
 }
 
 /***************************************************************
@@ -2660,6 +2829,9 @@ function go(gobj, treedb_id, topic_name, diagram, mirror)
 {
     let priv = gobj.priv;
 
+    /*  Moving IS the answer to a position that waited: one left behind
+     *  sent a later load back to it.  */
+    priv.pending_seg = null;
     priv.treedb_id = treedb_id || "";
     priv.topic_name = topic_name || "";
     priv.diagram = !!diagram;
@@ -2826,6 +2998,23 @@ function ac_mt_command_answer(gobj, event, kw, src)
             return 0;
         }
         if(priv.load_error) {
+            /*  Refused IN session (a deadline of a routing adapter on a
+             *  slow `nodes`): the model shown is what the store held a
+             *  moment ago, and blanking it took the screen and every open
+             *  form with it -- a form's Save then answered "Event NOT
+             *  DEFINED in state ST_IDLE" (fourth independent review). It
+             *  stays, as it does when the load cannot leave, and the
+             *  reload is owed.  */
+            if(priv.model) {
+                log_warning(`${gobj_short_name(gobj)}: the schemas could not be read ` +
+                    `again (${priv.load_error}): the previous ones stay`);
+                priv.records = priv.records_before;
+                priv.records_before = null;
+                priv.reload_on_open = true;
+                yui_shell_show_error(yui_shell_of(gobj),
+                    "cannot read the schemas again: the previous ones stay", {t: t});
+                return end_load(gobj);
+            }
             priv.model = null;
             return end_load(gobj);
         }
@@ -2834,6 +3023,8 @@ function ac_mt_command_answer(gobj, event, kw, src)
          *  (NOT in build_model(): that also runs on the patch after every
          *  write, which is exactly when the undo has to survive.)  */
         priv.order_undo = {};
+        priv.records_before = null;
+        priv.model_gen++;
         build_model(gobj);
         /*  Same reason as order_undo above: this is the LOAD, and the
          *  baseline is what a later "the version did not move" is measured
@@ -2857,7 +3048,7 @@ function ac_mt_command_answer(gobj, event, kw, src)
                     `for a write that is over (result ${result}): ignored`);
                 return 0;
             }
-            return late_write_done(gobj, command, topic_name);
+            return late_write_done(gobj, command, topic_name, data);
         }
         if(result < 0) {
             return end_writes(gobj, comment || t("the treedb refused the write"));
@@ -2872,10 +3063,33 @@ function ac_mt_command_answer(gobj, event, kw, src)
                 patch_record(gobj, topic_name, record);
             } else {
                 /*  The treedb wrote it and did not describe it back: ask
-                 *  again rather than draw a model that has drifted.  */
-                log_warning(`${gobj_short_name(gobj)}: '${command}' answered no record`);
+                 *  again rather than draw a model that has drifted. What
+                 *  was queued after it is not sent -- it was computed on
+                 *  the model that drifted -- and that is SAID: dropped in
+                 *  silence, a drag of five columns stopped at the first.
+                 *  The reload is also the one a late write may have owed
+                 *  (reload_after_write): left set, the next write loaded
+                 *  the whole model once more (fourth independent review).  */
+                let not_sent = priv.save_queue.length - 1;
+                log_warning(`${gobj_short_name(gobj)}: '${command}' answered no record` +
+                    (not_sent > 0 ? `: ${not_sent} write(s) after it were not sent` : ""));
+                if(not_sent > 0) {
+                    yui_shell_show_error(yui_shell_of(gobj),
+                        "the treedb did not describe a write back: the writes after it were not sent",
+                        {t: t});
+                }
+                if(topic_name === T_TOPICS || topic_name === T_COLS) {
+                    let write = priv.save_queue[0];
+                    mark_written(gobj, topic_name, write ? write.record : null);
+                }
+                priv.reload_after_write = false;
                 priv.save_queue = [];
-                request_model(gobj);
+                priv.save_return = "";
+                priv.save_wrote = false;
+                gobj_publish_event(gobj, "EV_RECORD_WRITTEN", {
+                    treedb_name: gobj_read_str_attr(gobj, "treedb_name")
+                });
+                request_model(gobj, true);
                 return 0;
             }
         }
@@ -2907,14 +3121,24 @@ function ac_mt_command_answer(gobj, event, kw, src)
  *  the view was answered once, as failed -- and echoes the node
  *  event instead, which this view does not hear: there, Refresh is
  *  what reads the store.
+ *
+ *  It is a WRITE like any other for the host (EV_RECORD_WRITTEN):
+ *  the host was told nothing when it was given up, and it owns the
+ *  Save that publishes it. The reload keeps what this session wrote
+ *  (request_model()), and the record it answered marks its topic.
  ***************************************************************/
-function late_write_done(gobj, command, topic_name)
+function late_write_done(gobj, command, topic_name, data)
 {
     let priv = gobj.priv;
     let state = gobj_current_state(gobj);
 
     log_warning(`${gobj_short_name(gobj)}: '${command}' of '${topic_name}' was given up, ` +
         `and it was DONE: the model is read again`);
+    mark_written_record(gobj, topic_name, is_object(data) ? data
+        : (Array.isArray(data) && is_object(data[0]) ? data[0] : null));
+    gobj_publish_event(gobj, "EV_RECORD_WRITTEN", {
+        treedb_name: gobj_read_str_attr(gobj, "treedb_name")
+    });
     if(state === "ST_LOADING") {
         return 0;
     }
@@ -2926,7 +3150,38 @@ function late_write_done(gobj, command, topic_name)
         priv.reload_on_open = true;
         return 0;
     }
-    return request_model(gobj);
+    return request_model(gobj, true);
+}
+
+/***************************************************************
+ *  The topic a record written belongs to, read off the RECORD and
+ *  not off the screen: a write answered late may be about a topic
+ *  the operator has left. A column names its topic in its fkey; a
+ *  topic is its own id.
+ *
+ *  The fkey is read with parse_fkey_ref(), because the store answers
+ *  in list_dict -- `[{topic_name, id, hook_name}]` -- and not in the
+ *  `topics^<topic id>^cols` strings this view writes. Split as a
+ *  string, every production answer marked nothing (fourth independent
+ *  review, probe C).
+ ***************************************************************/
+function mark_written_record(gobj, topic_name, record)
+{
+    let priv = gobj.priv;
+
+    if(!record) {
+        return;
+    }
+    if(topic_name === T_TOPICS && typeof record.id === "string" && record.id) {
+        priv.written[record.id] = true;
+        return;
+    }
+    if(topic_name !== T_COLS) {
+        return;
+    }
+    for(let ref of parse_fkey_ref(record.topics)) {
+        priv.written[ref.id] = true;
+    }
 }
 
 /***************************************************************
@@ -3004,7 +3259,7 @@ function ac_transport_state(gobj, event, kw, src)
     if((!priv.model || priv.reload_on_open) &&
             state !== "ST_LOADING" && state !== "ST_SAVING") {
         priv.reload_on_open = false;
-        return request_model(gobj);
+        return request_model(gobj, true);
     }
     render_toolbar(gobj);
     return 0;
@@ -3023,7 +3278,33 @@ function ac_language_changed(gobj, event, kw, src)
 
 function ac_refresh(gobj, event, kw, src)
 {
-    return request_model(gobj);
+    return request_model(gobj, false);
+}
+
+/***************************************************************
+ *  What a DIALOG sends while the model is being read again: the
+ *  Save of a form left open when the reload started, a
+ *  confirmation, an import. The loading screen took the rest of
+ *  the view away (request_model()); a dialog is the one thing the
+ *  operator can still reach, and what it asks is computed against
+ *  a model the answers in the air are about to replace.
+ *
+ *  Refused, and SAID. Undeclared, it answered "Event NOT DEFINED
+ *  in state ST_LOADING" and the edit was gone with no word (third
+ *  independent review).
+ *
+ *  And NOT "try again": the same Save, once the load was in, sent
+ *  the form built on the old model -- every field of the old record
+ *  over the newer one (fourth independent review). The load that
+ *  lands closes such a dialog (end_load()); one that fails leaves it
+ *  up, on the model it was built on.
+ ***************************************************************/
+function ac_wait_for_the_load(gobj, event, kw, src)
+{
+    log_warning(`${gobj_short_name(gobj)}: ${event} refused, the schemas are loading`);
+    yui_shell_show_error(yui_shell_of(gobj),
+        "the schemas are loading: wait for them", {t: t});
+    return -1;
 }
 
 /***************************************************************
@@ -3116,6 +3397,7 @@ function ac_show_orphans(gobj, event, kw, src)
  ***************************************************************/
 function confirm_then(gobj, message, detail, kw)
 {
+    kw = Object.assign({model_gen: gobj.priv.model_gen}, kw);
     yui_shell_confirm_danger(yui_shell_of(gobj), message, {
         t:      t,
         detail: detail
@@ -3201,6 +3483,9 @@ function ac_save_column(gobj, event, kw, src)
     if(refuse_if_readonly(gobj, event)) {
         return -1;
     }
+    if(built_on_a_replaced_model(gobj, event, kw)) {
+        return -1;
+    }
     if(!topic || (!kw.creating && !col)) {
         log_error(`${gobj_short_name(gobj)}: ${event} names no column: ${kw.topic}.${kw.col}`);
         return -1;
@@ -3355,6 +3640,9 @@ function ac_save_topic(gobj, event, kw, src)
     if(refuse_if_readonly(gobj, event)) {
         return -1;
     }
+    if(built_on_a_replaced_model(gobj, event, kw)) {
+        return -1;
+    }
     if(!treedb || (!kw.creating && !topic)) {
         log_error(`${gobj_short_name(gobj)}: ${event} names no topic: ${kw.topic}`);
         return -1;
@@ -3409,6 +3697,9 @@ function ac_delete_orphan(gobj, event, kw, src)
     if(refuse_if_readonly(gobj, event)) {
         return -1;
     }
+    if(built_on_a_replaced_model(gobj, event, kw)) {
+        return -1;
+    }
     if(empty_string(kw.id)) {
         log_error(`${gobj_short_name(gobj)}: ${event} names nothing`);
         return -1;
@@ -3481,6 +3772,9 @@ function ac_preview_import(gobj, event, kw, src)
     let treedb = current_treedb(gobj);
     let incoming = null;
 
+    if(built_on_a_replaced_model(gobj, event, kw)) {
+        return -1;
+    }
     if(!treedb) {
         log_error(`${gobj_short_name(gobj)}: ${event} with no treedb open`);
         return -1;
@@ -3508,6 +3802,9 @@ function ac_apply_import(gobj, event, kw, src)
     if(refuse_if_readonly(gobj, event)) {
         return -1;
     }
+    if(built_on_a_replaced_model(gobj, event, kw)) {
+        return -1;
+    }
     if(!plan || plan.writes.length === 0) {
         log_error(`${gobj_short_name(gobj)}: ${event} with no plan to run`);
         return -1;
@@ -3558,6 +3855,9 @@ function ac_confirmed(gobj, event, kw, src)
     if(refuse_if_readonly(gobj, event)) {
         return -1;
     }
+    if(built_on_a_replaced_model(gobj, event, kw)) {
+        return -1;
+    }
     if(kw.what === "import") {
         return run_import(gobj);
     }
@@ -3655,7 +3955,14 @@ function create_gclass(gclass_name)
     const states = [
         ["ST_IDLE", COMMON.slice()],
 
-        ["ST_LOADING", COMMON.slice()],
+        ["ST_LOADING", COMMON.concat([
+            ["EV_SAVE_COLUMN",      ac_wait_for_the_load,   null],
+            ["EV_SAVE_TOPIC",       ac_wait_for_the_load,   null],
+            ["EV_DELETE_ORPHAN",    ac_wait_for_the_load,   null],
+            ["EV_PREVIEW_IMPORT",   ac_wait_for_the_load,   null],
+            ["EV_APPLY_IMPORT",     ac_wait_for_the_load,   null],
+            ["EV_CONFIRMED",        ac_wait_for_the_load,   null]
+        ])],
 
         ["ST_EMPTY", COMMON.slice()],