@yuneta/gobj-ui 7.25.8 → 7.25.10

package/src/c_yui_schema_editor.js

@@ -26,9 +26,10 @@
  *      the owner's design of M36 (2026-09-21 review) every write here
  *      raised both versions, so an edit half made was already the
  *      schema of the next start. The topic list marks what this session
- *      wrote and has not saved (the host's EV_REFRESH after a save is
- *      what forgets it) and what the host says is not saved (EV_DRAFTS,
- *      replaced whole each time it is sent).
+ *      wrote and has not saved (EV_REFRESH forgets it: the view's own
+ *      Refresh button sends it, and a host may after a save -- the
+ *      agent console's does not) and what the host says is not saved
+ *      (EV_DRAFTS, replaced whole each time it is sent).
  *
  *      WHAT ELSE IS HERE, and why each is here and not somewhere else:
  *
@@ -124,6 +125,7 @@ import {yui_tint} from "./bulma_tint.js";
 import {host_draft_ids} from "./host_drafts.js";
 
 import "./c_yui_schema_editor.css";
+import "./yui_toolbar.css";     /*  `selected_state`, the export's chosen view  */
 
 import {
     build_schema_model,
@@ -135,6 +137,7 @@ import {
     col_enum,
     is_empty_value,
     fkey_ref,
+    parse_fkey_ref,
     next_order,
     moved_orders,
 } from "./schema_model.js";
@@ -202,7 +205,9 @@ SDATA_END()
 let PRIVATE_DATA = {
     /*  What the store answered, and what it means  */
     records:        null,   /*  {treedbs, topics, cols} as they arrived  */
+    records_before: null,   /*  the records of the model shown, while a load replaces them  */
     model:          null,   /*  build_schema_model() of the above  */
+    model_gen:      0,      /*  which LOAD the model is: a dialog is stamped with it  */
     pending:        0,      /*  `nodes` requests still in flight  */
     load_error:     "",
     load_round:     0,      /*  which load an answer belongs to: echoed as `round`  */
@@ -224,6 +229,7 @@ let PRIVATE_DATA = {
     /*  Children and overlays  */
     diagram_gobj:   null,
     dialog:         null,
+    dialog_gen:     0,      /*  the model_gen the open dialog was built on  */
 
     /*  A write, or a plan of them, in flight  */
     save_queue:     null,
@@ -444,6 +450,90 @@ function refuse_if_readonly(gobj, event)
     return true;
 }
 
+/***************************************************************
+ *  A decision taken on a model a load has since REPLACED: the Save
+ *  of a form, a confirmation, an import. Each carries the
+ *  `model_gen` it was built on (a number, not the model: a kw is
+ *  dumped by the machine trace).
+ *
+ *  Refused, and said. A column form sends every field it shows, so
+ *  its Save after a reload wrote the OLD record over the newer one
+ *  (fourth independent review, probe A3); a form whose column the
+ *  reload removed answered "names no column" for ever. end_load()
+ *  closes such a dialog when the load lands; this is the same rule
+ *  for whatever arrives anyway -- a stale screen, a confirmation
+ *  that was up, a keyboard.
+ *
+ *  A kw with no stamp is not a dialog's and is not asked.
+ ***************************************************************/
+function built_on_a_replaced_model(gobj, event, kw)
+{
+    let priv = gobj.priv;
+
+    if(!kw || kw.model_gen === undefined || kw.model_gen === priv.model_gen) {
+        return false;
+    }
+    log_warning(`${gobj_short_name(gobj)}: ${event} refused, it was decided on ` +
+        `the schemas a reload replaced`);
+    yui_shell_show_error(yui_shell_of(gobj),
+        "the schemas were read again: open the dialog again", {t: t});
+    return true;
+}
+
+/***************************************************************
+ *  The reload a load refused IN session left owed (a routing
+ *  adapter's deadline on a slow `nodes`, ac_mt_command_answer()):
+ *  the model shown is kept, and it may be older than the store.
+ *  The session is up, so no reconnect will ask for it again -- it
+ *  was owed for as long as the session lasted, and a form opened
+ *  on that model wrote every field of it over the newer record
+ *  (fifth independent review; A3 of the fourth, by another path).
+ *
+ *  So the operator's NEXT action asks it. An edit -- a form, a
+ *  write, a confirmation, what reads the model whole (check,
+ *  export) -- is refused and said: it would be computed on what
+ *  the store may no longer hold, and the load that lands closes a
+ *  dialog built on the old model anyway (end_load()). A move is
+ *  not refused (reload_after_move()): it goes, and reads there.
+ *
+ *  Not on a timer, and not at once: a load refused on a deadline
+ *  asked again at once is refused the same way, and one asked on a
+ *  clock is polling. Out of session nothing is asked; the reconnect
+ *  does it (ac_transport_state()). The reload keeps this session's
+ *  draft chips: the host did not ask for it.
+ ***************************************************************/
+function owes_reload(gobj)
+{
+    let state = gobj_current_state(gobj);
+
+    return gobj.priv.reload_on_open && transport_in_session(gobj) &&
+        state !== "ST_LOADING" && state !== "ST_SAVING";
+}
+
+function reload_first(gobj, event)
+{
+    if(!owes_reload(gobj)) {
+        return false;
+    }
+    gobj.priv.reload_on_open = false;
+    log_warning(`${gobj_short_name(gobj)}: ${event} refused, the schemas shown ` +
+        `may be out of date: they are read again first`);
+    yui_shell_show_error(yui_shell_of(gobj),
+        "the schemas shown may be out of date: they are read again, try again when they are in",
+        {t: t});
+    request_model(gobj, true);
+    return true;
+}
+
+function reload_after_move(gobj)
+{
+    if(!owes_reload(gobj)) {
+        return 0;
+    }
+    gobj.priv.reload_on_open = false;
+    return request_model(gobj, true);
+}
+
 
 
 
@@ -465,17 +555,26 @@ function refuse_if_readonly(gobj, event)
  *  and the toolbar stops answering: left up, a click on a card, on
  *  Back or on the drawing answered "Event NOT DEFINED in state
  *  ST_LOADING" and was lost (third independent review). A dialog
- *  left open is answered in ST_LOADING instead (ac_wait_for_the_load).
+ *  left open is answered in ST_LOADING instead (ac_wait_for_the_load),
+ *  and a load that LANDS closes it (end_load()): it was built on the
+ *  model the load replaced, and its Save sends every field it shows.
+ *  An import plan is forgotten here for the same reason: it is a list
+ *  of writes computed against the model going away -- once the load
+ *  has LEFT (one that could not be sent replaces nothing).
  *
- *  `keep_written`: a load the host did not ask for -- the reconnect,
- *  a write that turned out done -- keeps what this session wrote.
- *  Only the host's EV_REFRESH (a Save sends it) forgets it.
+ *  `keep_written`: a load nobody ASKED for -- the reconnect, a write
+ *  that turned out done, the reload a refused load owed -- keeps what
+ *  this session wrote. Only EV_REFRESH forgets it: the view's own
+ *  Refresh button, or a host that sends it (after a Save, say; the
+ *  agent console does not).
  *
  *  A load that cannot leave WHOLE did not happen (out of session it
  *  is not even asked): the records the model was built on are put
  *  back (emptied, the next write patched them into a model with no
  *  treedb), the round is spent so a request that did leave is
- *  stale, and the session back asks again.
+ *  stale, and the session back asks again. A load that left and
+ *  FAILED keeps them the same way (`records_before`,
+ *  ac_mt_command_answer()).
  ***************************************************************/
 function request_model(gobj, keep_written)
 {
@@ -486,7 +585,13 @@ function request_model(gobj, keep_written)
         return -1;      /*  not mounted on a transport yet: mt_start retries via EV_TRANSPORT_STATE  */
     }
 
-    let previous = priv.records;
+    /*  A load asked while one is in flight (the host's EV_REFRESH is
+     *  heard in ST_LOADING) keeps the records the model SHOWN was built
+     *  on: `priv.records` is the half the first load got by then, and
+     *  put back after a failure it was a model with no treedb.  */
+    let previous = (gobj_current_state(gobj) === "ST_LOADING")?
+        priv.records_before : priv.records;
+    priv.records_before = previous;
     priv.records = {treedbs: [], topics: [], cols: []};
     priv.load_error = "";
     priv.pending = 0;
@@ -511,6 +616,7 @@ function request_model(gobj, keep_written)
     }
     if(left < 3) {
         priv.records = previous;
+        priv.records_before = null;
         priv.load_round++;
         priv.reload_on_open = true;
         priv.load_error = t("cannot reach the treedb");
@@ -520,6 +626,9 @@ function request_model(gobj, keep_written)
         end_load(gobj);
         return -1;
     }
+    /*  Only a load that LEFT replaces the model the plan was computed
+     *  on; one that could not be sent keeps it, and the plan with it.  */
+    forget_import_plan(gobj);
     priv.pending = left;
     return 0;
 }
@@ -605,8 +714,8 @@ function build_model(gobj)
  *  Called ONLY when records arrive from the store: that is what a
  *  measurement of "changed since" can be measured against.
  *
- *  `written` is forgotten only by a load the HOST asked for (its
- *  EV_REFRESH, which a Save sends). Since M36 a write moves no
+ *  `written` is forgotten only by an EV_REFRESH (the view's own
+ *  Refresh button, or a host that sends one). Since M36 a write moves no
  *  version, so `written` is the draft chip of what this session
  *  wrote and no longer half of a version measurement: a reload of
  *  the reconnect, or of a write that turned out done, forgot the
@@ -643,9 +752,12 @@ function start_measuring(gobj)
  *  until the host saves it (C_TREEDB's save-schema, which raises the
  *  versions of what changed). Two sources say a topic is one, and
  *  they are kept APART because they are forgotten differently:
- *    - `written`: what THIS session wrote since the model was loaded
- *      (a reload, the host's EV_REFRESH, forgets it -- the store says
- *      what is left);
+ *    - `written`: what THIS session wrote. Only EV_REFRESH forgets
+ *      it -- the view's own Refresh button sends it (in the agent
+ *      console that is the only sender), and a host may after a
+ *      Save; the reconnect's reload, the one owed after a write, a
+ *      refused load's and a late write's keep it (start_measuring(),
+ *      request_model());
  *    - `host_ids`: what the host said last (EV_DRAFTS), replaced WHOLE
  *      by the next EV_DRAFTS. Folded into `written`, a topic the host
  *      named once stayed a draft after the Save that published it.
@@ -847,6 +959,14 @@ function render_toolbar(gobj)
      *  url's; ST_EMPTY has a treedb in the url and none in the model),
      *  and a button there sends what only a treedb screen declares.  */
     let on_a_treedb = state !== "ST_IDLE" && state !== "ST_EMPTY";
+    /*  ...and the screen can outlive the treedb or the topic it is ON: a
+     *  reload that no longer has them keeps the position (it says so,
+     *  and Back is the way out). Asked of the MODEL, not of the state:
+     *  gated on the state, Diagram, Check, Export, Import and New topic
+     *  stayed up there and each logged "with no treedb open" (fourth
+     *  independent review, probe D2).  */
+    let treedb_here = on_a_treedb && !!current_treedb(gobj);
+    let topic_here = treedb_here && !!current_topic(gobj);
     /*  Nothing is legal while the model is in the air: every action is
      *  computed against it.  */
     let in_flight = state === "ST_SAVING" || state === "ST_LOADING";
@@ -892,7 +1012,7 @@ function render_toolbar(gobj)
      *  refused says why when it is pressed.
      *----------------------------------------------*/
     let $right = [];
-    if(priv.treedb_id && has_model && on_a_treedb) {
+    if(priv.treedb_id && has_model && treedb_here) {
         /*  The compass, like every other door to a SCHEMA: the
          *  `hexagon-nodes` it wore is the graph of the DATA.  */
         $right.push(toolbar_button("SCHEMA_DIAGRAM_BTN", "yi-compass-drafting",
@@ -906,7 +1026,7 @@ function render_toolbar(gobj)
                 "import", "EV_IMPORT", false));
         }
     }
-    if(priv.topic_name && !readonly && !priv.diagram && on_a_treedb) {
+    if(priv.topic_name && !readonly && !priv.diagram && topic_here) {
         /*  Only while there IS somewhere to go back to: a drag is a write,
          *  and this is the way back from one. */
         if(undo_order_writes(gobj, current_topic(gobj)).length > 0) {
@@ -916,7 +1036,7 @@ function render_toolbar(gobj)
         $right.push(toolbar_button("SCHEMA_ADD_COL_BTN", "yi-plus",
             "new column", "EV_ADD_COLUMN", false));
     }
-    if(priv.treedb_id && !priv.topic_name && !readonly && !priv.diagram && on_a_treedb) {
+    if(priv.treedb_id && !priv.topic_name && !readonly && !priv.diagram && treedb_here) {
         $right.push(toolbar_button("SCHEMA_ADD_TOPIC_BTN", "yi-plus",
             "new topic", "EV_ADD_TOPIC", false));
     }
@@ -1631,6 +1751,7 @@ function open_dialog(gobj, $content, title, logical, title_prefix)
     let priv = gobj.priv;
 
     close_dialog(gobj);
+    priv.dialog_gen = priv.model_gen;
     priv.dialog = yui_shell_show_modal(yui_shell_of(gobj), $content, {
         dialog:        true,
         title:         title,
@@ -1679,6 +1800,10 @@ function name_control($spec, label)
             $spec[1]["aria-label"] = t(label);
             $spec[1]["data-i18n-aria-label"] = label;
         }
+        if(!$spec[1].title) {
+            $spec[1].title = t(label);
+            $spec[1]["data-i18n-title"] = label;
+        }
         return true;
     }
     for(let child of ($spec[2] || [])) {
@@ -1689,6 +1814,19 @@ function name_control($spec, label)
     return false;
 }
 
+/***************************************************************
+ *  The four attributes that NAME a control -- a title and an
+ *  aria-label, each with the key a language change re-translates
+ *  it by. A visible label is not a name (CLAUDE.md).
+ ***************************************************************/
+function name_attrs(key, attrs)
+{
+    return Object.assign({
+        title: t(key), "data-i18n-title": key,
+        "aria-label": t(key), "data-i18n-aria-label": key
+    }, attrs);
+}
+
 function field(logical, name, label, $control, help)
 {
     /*  The label is a SIBLING of the control -- Bulma's `field` shape --
@@ -1842,6 +1980,7 @@ function open_column_form(gobj, topic, col, prefill)
     let hook_col = hook_topic ? hook[hook_topic] : "";
     let treedb = current_treedb(gobj);
     let sibling_topics = treedb ? treedb.topics.map(x => x.name) : [];
+    let model_gen = priv.model_gen;
 
     let $form = createElement2(
         ["div", {class: "SCHEMA_COL_FORM box"}, [
@@ -1883,9 +2022,10 @@ function open_column_form(gobj, topic, col, prefill)
                 text_input("description", record.description, "")),
             ["div", {class: "SCHEMA_COL_FORM_ACTIONS is-flex mt-4",
                      style: "gap:.5rem; justify-content:flex-end;"}, [
-                ["button", {class: "SCHEMA_COL_FORM_CANCEL button", type: "button"},
+                ["button", name_attrs("cancel", {class: "SCHEMA_COL_FORM_CANCEL button", type: "button"}),
                     [["span", {i18n: "cancel"}, t("cancel")]]],
-                ["button", {class: "SCHEMA_COL_FORM_SAVE button is-primary", type: "button"},
+                ["button", name_attrs("save", {class: "SCHEMA_COL_FORM_SAVE button is-primary",
+                                               type: "button"}),
                     [["span", {class: "icon"}, [["i", {class: "yi-floppy-disk"}]]],
                      ["span", {i18n: "save"}, t("save")]]]
             ]]
@@ -1926,10 +2066,11 @@ function open_column_form(gobj, topic, col, prefill)
         let values = read_form($form);
         values.flag = read_flags($form);
         gobj_send_event(gobj, "EV_SAVE_COLUMN", {
-            topic:    topic.name,
-            col:      creating ? "" : col.name,
-            creating: creating,
-            values:   values
+            topic:     topic.name,
+            col:       creating ? "" : col.name,
+            creating:  creating,
+            values:    values,
+            model_gen: model_gen
         }, gobj);
     });
 
@@ -1962,6 +2103,7 @@ function open_topic_form(gobj, treedb, topic)
     let record = (topic && topic.record) || {};
     let creating = !topic;
     let col_names = topic ? topic.cols.map(c => c.name) : [];
+    let model_gen = gobj.priv.model_gen;
 
     let $form = createElement2(
         ["div", {class: "SCHEMA_TOPIC_FORM box"}, [
@@ -2001,10 +2143,10 @@ function open_topic_form(gobj, treedb, topic)
             ]],
             ["div", {class: "SCHEMA_TOPIC_FORM_ACTIONS is-flex mt-4",
                      style: "gap:.5rem; justify-content:flex-end;"}, [
-                ["button", {class: "SCHEMA_TOPIC_FORM_CANCEL button", type: "button"},
+                ["button", name_attrs("cancel", {class: "SCHEMA_TOPIC_FORM_CANCEL button", type: "button"}),
                     [["span", {i18n: "cancel"}, t("cancel")]]],
-                ["button", {class: "SCHEMA_TOPIC_FORM_SAVE button is-primary",
-                            type: "button"},
+                ["button", name_attrs("save", {class: "SCHEMA_TOPIC_FORM_SAVE button is-primary",
+                                               type: "button"}),
                     [["span", {class: "icon"}, [["i", {class: "yi-floppy-disk"}]]],
                      ["span", {i18n: "save"}, t("save")]]]
             ]]
@@ -2018,9 +2160,10 @@ function open_topic_form(gobj, treedb, topic)
     $form.querySelector(".SCHEMA_TOPIC_FORM_SAVE").addEventListener("click", (evt) => {
         evt.stopPropagation();
         gobj_send_event(gobj, "EV_SAVE_TOPIC", {
-            topic:    creating ? "" : topic.name,
-            creating: creating,
-            values:   read_form($form)
+            topic:     creating ? "" : topic.name,
+            creating:  creating,
+            values:    read_form($form),
+            model_gen: model_gen
         }, gobj);
     });
 
@@ -2092,13 +2235,21 @@ function open_export(gobj, treedb)
 
     let $content = createElement2(
         ["div", {class: "SCHEMA_EXPORT box"}, [
-            ["div", {class: "SCHEMA_EXPORT_TABS tabs is-toggle mb-2"}, [
-                ["ul", {}, [
-                    ["li", {class: "SCHEMA_EXPORT_TAB is-active", "data-pane": "c"},
-                        [["a", {}, [["span", {}, "C"]]]]],
-                    ["li", {class: "SCHEMA_EXPORT_TAB", "data-pane": "json"},
-                        [["a", {}, [["span", {}, "JSON"]]]]]
-                ]]
+            /*  Two BUTTONS, not Bulma tabs: a tab's <a> with no href is
+             *  reached by no keyboard and named by nothing but its "C".
+             *  The one shown is the selected segment (`selected_state`,
+             *  yui_toolbar.css) and says so with aria-pressed.  */
+            ["div", {class: "SCHEMA_EXPORT_TABS buttons has-addons mb-2"}, [
+                ["button", {class: "SCHEMA_EXPORT_TAB button selected_state", type: "button",
+                            "data-pane": "c", "aria-pressed": "true",
+                            title: t("schema as c source"), "data-i18n-title": "schema as c source",
+                            "aria-label": t("schema as c source"), "data-i18n-aria-label": "schema as c source"},
+                    [["span", {}, "C"]]],
+                ["button", {class: "SCHEMA_EXPORT_TAB button", type: "button",
+                            "data-pane": "json", "aria-pressed": "false",
+                            title: t("schema as json"), "data-i18n-title": "schema as json",
+                            "aria-label": t("schema as json"), "data-i18n-aria-label": "schema as json"},
+                    [["span", {}, "JSON"]]]
             ]],
             ["p", {class: "SCHEMA_EXPORT_HELP help mb-2",
                    i18n: "an edit made here works and lives in no source: this is what to paste back"},
@@ -2129,7 +2280,8 @@ function open_export(gobj, treedb)
         $tab.addEventListener("click", (evt) => {
             evt.stopPropagation();
             for(let $other of $content.querySelectorAll(".SCHEMA_EXPORT_TAB")) {
-                $other.classList.toggle("is-active", $other === $tab);
+                $other.classList.toggle("selected_state", $other === $tab);
+                $other.setAttribute("aria-pressed", ($other === $tab)? "true": "false");
             }
             $text.value = ($tab.dataset.pane === "c") ? c_text : json_text;
         });
@@ -2173,14 +2325,15 @@ function copy_text(gobj, $text)
  ***************************************************************/
 function open_import(gobj, treedb)
 {
+    let model_gen = gobj.priv.model_gen;
     let $content = createElement2(
         ["div", {class: "SCHEMA_IMPORT box"}, [
             ["p", {class: "SCHEMA_IMPORT_HELP help mb-2",
                    i18n: "paste a schema as json: the plan is shown before anything is written"},
                 t("paste a schema as json: the plan is shown before anything is written")],
-            ["textarea", {class: "SCHEMA_IMPORT_TEXT textarea is-small is-family-monospace",
+            ["textarea", name_attrs("schema", {class: "SCHEMA_IMPORT_TEXT textarea is-small is-family-monospace",
                           rows: "12", spellcheck: "false",
-                          placeholder: '{"id": "...", "schema_version": "1", "topics": []}'}, ""],
+                          placeholder: '{"id": "...", "schema_version": "1", "topics": []}'}), ""],
             ["label", {class: "SCHEMA_IMPORT_PRUNE checkbox mt-2"}, [
                 ["input", {type: "checkbox", class: "SCHEMA_IMPORT_PRUNE_BOX", checked: "checked"}],
                 ["span", {class: "ml-1", i18n: "delete what the pasted schema does not declare"},
@@ -2189,13 +2342,13 @@ function open_import(gobj, treedb)
             ["div", {class: "SCHEMA_IMPORT_PLAN mt-3"}, []],
             ["div", {class: "SCHEMA_IMPORT_ACTIONS is-flex mt-3",
                      style: "gap:.5rem; justify-content:flex-end;"}, [
-                ["button", {class: "SCHEMA_IMPORT_CANCEL button", type: "button"},
+                ["button", name_attrs("cancel", {class: "SCHEMA_IMPORT_CANCEL button", type: "button"}),
                     [["span", {i18n: "cancel"}, t("cancel")]]],
-                ["button", {class: "SCHEMA_IMPORT_PREVIEW button", type: "button"},
+                ["button", name_attrs("preview", {class: "SCHEMA_IMPORT_PREVIEW button", type: "button"}),
                     [["span", {class: "icon"}, [["i", {class: "yi-eye"}]]],
                      ["span", {i18n: "preview"}, t("preview")]]],
-                ["button", {class: "SCHEMA_IMPORT_RUN button is-warning",
-                            type: "button", disabled: "disabled"},
+                ["button", name_attrs("import", {class: "SCHEMA_IMPORT_RUN button is-warning",
+                                                 type: "button", disabled: "disabled"}),
                     [["span", {class: "icon"}, [["i", {class: "yi-upload"}]]],
                      ["span", {i18n: "import"}, t("import")]]]
             ]]
@@ -2214,13 +2367,14 @@ function open_import(gobj, treedb)
     $content.querySelector(".SCHEMA_IMPORT_PREVIEW").addEventListener("click", (evt) => {
         evt.stopPropagation();
         gobj_send_event(gobj, "EV_PREVIEW_IMPORT", {
-            text:  $text.value,
-            prune: $prune.checked
+            text:      $text.value,
+            prune:     $prune.checked,
+            model_gen: model_gen
         }, gobj);
     });
     $run.addEventListener("click", (evt) => {
         evt.stopPropagation();
-        gobj_send_event(gobj, "EV_APPLY_IMPORT", {}, gobj);
+        gobj_send_event(gobj, "EV_APPLY_IMPORT", {model_gen: model_gen}, gobj);
     });
 
     gobj.priv.import_pane = $plan_pane;
@@ -2228,6 +2382,23 @@ function open_import(gobj, treedb)
     open_dialog(gobj, $content, "import", "SCHEMA_IMPORT_DIALOG", treedb.id);
 }
 
+/***************************************************************
+ *  The plan is a list of writes computed against the model shown:
+ *  a load replaces the model, so the plan goes with it and the
+ *  dialog, if it stays up (a load that failed keeps the model),
+ *  asks for a Preview again.
+ ***************************************************************/
+function forget_import_plan(gobj)
+{
+    let priv = gobj.priv;
+
+    priv.import_plan = null;
+    clear(priv.import_pane);
+    if(priv.import_run) {
+        priv.import_run.disabled = true;
+    }
+}
+
 /***************************************************************
  *  The plan, drawn where the paste is: one line per write, the
  *  deletions apart and counted, because they are what the
@@ -2304,7 +2475,7 @@ function open_orphans(gobj)
             ["td", {class: "SCHEMA_ORPHAN_ID"}, [["code", {}, `${entry.id}`]]],
             ["td", {class: "SCHEMA_ORPHAN_ACTIONS has-text-right"},
                 readonly ? [] : [row_icon(gobj, "SCHEMA_ORPHAN_DELETE", "yi-trash", "delete",
-                    "EV_DELETE_ORPHAN", {kind: kind, id: entry.id})]]
+                    "EV_DELETE_ORPHAN", {kind: kind, id: entry.id, model_gen: priv.model_gen})]]
         ]];
     };
 
@@ -2519,6 +2690,11 @@ function transport_dropped(gobj)
         priv.load_round++;
         priv.pending = 0;
         priv.load_error = "";
+        if(priv.records_before) {
+            /*  The records of the model kept, not the half the load got.  */
+            priv.records = priv.records_before;
+            priv.records_before = null;
+        }
         return end_load(gobj);
     }
     return 0;
@@ -2530,6 +2706,12 @@ function transport_dropped(gobj)
  *  in flight (ac_show() kept it), or the one it had. Without a
  *  model there is no screen to go to: the position is kept for the
  *  next load, and the editor says why it is empty.
+ *
+ *  A dialog built on the model this load REPLACED is closed, and the
+ *  operator told to open it again: it shows the old record, and its
+ *  Save would write every field of it over the newer one. A load
+ *  that failed or never left replaced nothing (`model_gen` did not
+ *  move), and the dialog stays with what was typed.
  ***************************************************************/
 function end_load(gobj)
 {
@@ -2537,6 +2719,13 @@ function end_load(gobj)
     let seg = priv.pending_seg;
 
     priv.pending_seg = null;
+    if(priv.dialog && priv.dialog_gen !== priv.model_gen) {
+        log_warning(`${gobj_short_name(gobj)}: a dialog was open on the schemas ` +
+            `the load replaced: closed`);
+        close_dialog(gobj);
+        yui_shell_show_error(yui_shell_of(gobj),
+            "the schemas were read again: open the dialog again", {t: t});
+    }
     if(priv.model) {
         if(seg !== null) {
             return apply_seg(gobj, seg);
@@ -2885,6 +3074,25 @@ function ac_mt_command_answer(gobj, event, kw, src)
             return 0;
         }
         if(priv.load_error) {
+            /*  Refused IN session (a deadline of a routing adapter on a
+             *  slow `nodes`): the model shown is what the store held a
+             *  moment ago, and blanking it took the screen and every open
+             *  form with it -- a form's Save then answered "Event NOT
+             *  DEFINED in state ST_IDLE" (fourth independent review). It
+             *  stays, as it does when the load cannot leave, and the
+             *  reload is owed: the operator's next action asks it
+             *  (reload_first(), fifth independent review).  */
+            if(priv.model) {
+                log_warning(`${gobj_short_name(gobj)}: the schemas could not be read ` +
+                    `again (${priv.load_error}): the previous ones stay`);
+                priv.records = priv.records_before;
+                priv.records_before = null;
+                priv.reload_on_open = true;
+                yui_shell_show_error(yui_shell_of(gobj),
+                    "cannot read the schemas again: the ones shown may be out of date, your next change reads them first",
+                    {t: t});
+                return end_load(gobj);
+            }
             priv.model = null;
             return end_load(gobj);
         }
@@ -2893,6 +3101,8 @@ function ac_mt_command_answer(gobj, event, kw, src)
          *  (NOT in build_model(): that also runs on the patch after every
          *  write, which is exactly when the undo has to survive.)  */
         priv.order_undo = {};
+        priv.records_before = null;
+        priv.model_gen++;
         build_model(gobj);
         /*  Same reason as order_undo above: this is the LOAD, and the
          *  baseline is what a later "the version did not move" is measured
@@ -2931,12 +3141,26 @@ function ac_mt_command_answer(gobj, event, kw, src)
                 patch_record(gobj, topic_name, record);
             } else {
                 /*  The treedb wrote it and did not describe it back: ask
-                 *  again rather than draw a model that has drifted.  */
-                log_warning(`${gobj_short_name(gobj)}: '${command}' answered no record`);
+                 *  again rather than draw a model that has drifted. What
+                 *  was queued after it is not sent -- it was computed on
+                 *  the model that drifted -- and that is SAID: dropped in
+                 *  silence, a drag of five columns stopped at the first.
+                 *  The reload is also the one a late write may have owed
+                 *  (reload_after_write): left set, the next write loaded
+                 *  the whole model once more (fourth independent review).  */
+                let not_sent = priv.save_queue.length - 1;
+                log_warning(`${gobj_short_name(gobj)}: '${command}' answered no record` +
+                    (not_sent > 0 ? `: ${not_sent} write(s) after it were not sent` : ""));
+                if(not_sent > 0) {
+                    yui_shell_show_error(yui_shell_of(gobj),
+                        "the treedb did not describe a write back: the writes after it were not sent",
+                        {t: t});
+                }
                 if(topic_name === T_TOPICS || topic_name === T_COLS) {
                     let write = priv.save_queue[0];
                     mark_written(gobj, topic_name, write ? write.record : null);
                 }
+                priv.reload_after_write = false;
                 priv.save_queue = [];
                 priv.save_return = "";
                 priv.save_wrote = false;
@@ -3010,8 +3234,14 @@ function late_write_done(gobj, command, topic_name, data)
 /***************************************************************
  *  The topic a record written belongs to, read off the RECORD and
  *  not off the screen: a write answered late may be about a topic
- *  the operator has left. A column names its topic in its fkey
- *  (`topics^<topic id>^cols`); a topic is its own id.
+ *  the operator has left. A column names its topic in its fkey; a
+ *  topic is its own id.
+ *
+ *  The fkey is read with parse_fkey_ref(), because the store answers
+ *  in list_dict -- `[{topic_name, id, hook_name}]` -- and not in the
+ *  `topics^<topic id>^cols` strings this view writes. Split as a
+ *  string, every production answer marked nothing (fourth independent
+ *  review, probe C).
  ***************************************************************/
 function mark_written_record(gobj, topic_name, record)
 {
@@ -3027,13 +3257,8 @@ function mark_written_record(gobj, topic_name, record)
     if(topic_name !== T_COLS) {
         return;
     }
-    let refs = Array.isArray(record.topics) ? record.topics
-        : (typeof record.topics === "string" ? [record.topics] : []);
-    for(let ref of refs) {
-        let parts = String(ref).split("^");
-        if(parts.length >= 2 && parts[1]) {
-            priv.written[parts[1]] = true;
-        }
+    for(let ref of parse_fkey_ref(record.topics)) {
+        priv.written[ref.id] = true;
     }
 }
 
@@ -3142,16 +3367,43 @@ function ac_refresh(gobj, event, kw, src)
  *  operator can still reach, and what it asks is computed against
  *  a model the answers in the air are about to replace.
  *
- *  Refused, and SAID -- and the dialog stays open with what was
- *  typed, so the same Save works once the load is in. Undeclared,
- *  it answered "Event NOT DEFINED in state ST_LOADING" and the
- *  edit was gone with no word (third independent review).
+ *  Refused, and SAID. Undeclared, it answered "Event NOT DEFINED
+ *  in state ST_LOADING" and the edit was gone with no word (third
+ *  independent review).
+ *
+ *  And NOT "try again": the same Save, once the load was in, sent
+ *  the form built on the old model -- every field of the old record
+ *  over the newer one (fourth independent review). The load that
+ *  lands closes such a dialog (end_load()); one that fails leaves it
+ *  up, on the model it was built on.
  ***************************************************************/
 function ac_wait_for_the_load(gobj, event, kw, src)
 {
     log_warning(`${gobj_short_name(gobj)}: ${event} refused, the schemas are loading`);
     yui_shell_show_error(yui_shell_of(gobj),
-        "the schemas are loading: try again when they are in", {t: t});
+        "the schemas are loading: wait for them", {t: t});
+    return -1;
+}
+
+/***************************************************************
+ *  A confirmation answered where no treedb is open: ST_EMPTY (a
+ *  reload landed on zero treedbs while it was up) or ST_IDLE (no
+ *  model). A confirmation is a shell modal, not this view's dialog,
+ *  so the load that lands does not close it, and its Yes arrives
+ *  anyway. Undeclared, it answered "Event NOT DEFINED" (fifth
+ *  independent review).
+ *
+ *  Refused with the stamp's own words: whatever it was decided on
+ *  is not on screen any more.
+ ***************************************************************/
+function ac_confirmed_on_nothing(gobj, event, kw, src)
+{
+    if(built_on_a_replaced_model(gobj, event, kw)) {
+        return -1;
+    }
+    log_warning(`${gobj_short_name(gobj)}: ${event} refused, no treedb is open`);
+    yui_shell_show_error(yui_shell_of(gobj),
+        "the schemas were read again: open the dialog again", {t: t});
     return -1;
 }
 
@@ -3186,32 +3438,34 @@ function ac_drafts(gobj, event, kw, src)
  ***************************************************************/
 function ac_select_treedb(gobj, event, kw, src)
 {
-    return go(gobj, kw.treedb, "", false, true);
+    go(gobj, kw.treedb, "", false, true);
+    return reload_after_move(gobj);
 }
 
 function ac_select_topic(gobj, event, kw, src)
 {
-    return go(gobj, gobj.priv.treedb_id, kw.topic, false, true);
+    go(gobj, gobj.priv.treedb_id, kw.topic, false, true);
+    return reload_after_move(gobj);
 }
 
 function ac_back(gobj, event, kw, src)
 {
     let priv = gobj.priv;
 
-    if(priv.diagram) {
-        return go(gobj, priv.treedb_id, "", false, true);
-    }
-    if(priv.topic_name) {
-        return go(gobj, priv.treedb_id, "", false, true);
+    if(priv.diagram || priv.topic_name) {
+        go(gobj, priv.treedb_id, "", false, true);
+    } else {
+        go(gobj, "", "", false, true);
     }
-    return go(gobj, "", "", false, true);
+    return reload_after_move(gobj);
 }
 
 function ac_toggle_diagram(gobj, event, kw, src)
 {
     let priv = gobj.priv;
 
-    return go(gobj, priv.treedb_id, priv.topic_name, !priv.diagram, true);
+    go(gobj, priv.treedb_id, priv.topic_name, !priv.diagram, true);
+    return reload_after_move(gobj);
 }
 
 /***************************************************************
@@ -3226,11 +3480,15 @@ function ac_node_click(gobj, event, kw, src)
     if(!topic) {
         return 0;
     }
-    return go(gobj, gobj.priv.treedb_id, topic, false, true);
+    go(gobj, gobj.priv.treedb_id, topic, false, true);
+    return reload_after_move(gobj);
 }
 
 function ac_show_orphans(gobj, event, kw, src)
 {
+    if(reload_first(gobj, event)) {
+        return -1;
+    }
     open_orphans(gobj);
     return 0;
 }
@@ -3245,6 +3503,7 @@ function ac_show_orphans(gobj, event, kw, src)
  ***************************************************************/
 function confirm_then(gobj, message, detail, kw)
 {
+    kw = Object.assign({model_gen: gobj.priv.model_gen}, kw);
     yui_shell_confirm_danger(yui_shell_of(gobj), message, {
         t:      t,
         detail: detail
@@ -3266,6 +3525,9 @@ function ac_add_column(gobj, event, kw, src)
     if(refuse_if_readonly(gobj, event)) {
         return -1;
     }
+    if(reload_first(gobj, event)) {
+        return -1;
+    }
     if(!topic) {
         log_error(`${gobj_short_name(gobj)}: ${event} with no topic open`);
         return -1;
@@ -3283,6 +3545,9 @@ function ac_edit_column(gobj, event, kw, src)
     if(refuse_if_readonly(gobj, event)) {
         return -1;
     }
+    if(reload_first(gobj, event)) {
+        return -1;
+    }
     if(!col) {
         log_error(`${gobj_short_name(gobj)}: ${event} names no column: ${kw.col}`);
         return -1;
@@ -3305,6 +3570,9 @@ function ac_duplicate_column(gobj, event, kw, src)
     if(refuse_if_readonly(gobj, event)) {
         return -1;
     }
+    if(reload_first(gobj, event)) {
+        return -1;
+    }
     if(!col) {
         log_error(`${gobj_short_name(gobj)}: ${event} names no column: ${kw.col}`);
         return -1;
@@ -3330,6 +3598,12 @@ function ac_save_column(gobj, event, kw, src)
     if(refuse_if_readonly(gobj, event)) {
         return -1;
     }
+    if(reload_first(gobj, event)) {
+        return -1;
+    }
+    if(built_on_a_replaced_model(gobj, event, kw)) {
+        return -1;
+    }
     if(!topic || (!kw.creating && !col)) {
         log_error(`${gobj_short_name(gobj)}: ${event} names no column: ${kw.topic}.${kw.col}`);
         return -1;
@@ -3362,6 +3636,9 @@ function ac_delete_column(gobj, event, kw, src)
     if(refuse_if_readonly(gobj, event)) {
         return -1;
     }
+    if(reload_first(gobj, event)) {
+        return -1;
+    }
     if(!col) {
         log_error(`${gobj_short_name(gobj)}: ${event} names no column: ${kw.col}`);
         return -1;
@@ -3384,6 +3661,9 @@ function ac_move_column(gobj, event, kw, src)
     if(refuse_if_readonly(gobj, event)) {
         return -1;
     }
+    if(reload_first(gobj, event)) {
+        return -1;
+    }
     if(!topic) {
         log_error(`${gobj_short_name(gobj)}: ${event} with no topic open`);
         return -1;
@@ -3423,6 +3703,9 @@ function ac_undo_order(gobj, event, kw, src)
     if(refuse_if_readonly(gobj, event)) {
         return -1;
     }
+    if(reload_first(gobj, event)) {
+        return -1;
+    }
     if(!topic) {
         log_error(`${gobj_short_name(gobj)}: ${event} with no topic open`);
         return -1;
@@ -3450,6 +3733,9 @@ function ac_add_topic(gobj, event, kw, src)
     if(refuse_if_readonly(gobj, event)) {
         return -1;
     }
+    if(reload_first(gobj, event)) {
+        return -1;
+    }
     if(!treedb) {
         log_error(`${gobj_short_name(gobj)}: ${event} with no treedb open`);
         return -1;
@@ -3467,6 +3753,9 @@ function ac_edit_topic(gobj, event, kw, src)
     if(refuse_if_readonly(gobj, event)) {
         return -1;
     }
+    if(reload_first(gobj, event)) {
+        return -1;
+    }
     if(!topic) {
         log_error(`${gobj_short_name(gobj)}: ${event} names no topic: ${kw.topic}`);
         return -1;
@@ -3484,6 +3773,12 @@ function ac_save_topic(gobj, event, kw, src)
     if(refuse_if_readonly(gobj, event)) {
         return -1;
     }
+    if(reload_first(gobj, event)) {
+        return -1;
+    }
+    if(built_on_a_replaced_model(gobj, event, kw)) {
+        return -1;
+    }
     if(!treedb || (!kw.creating && !topic)) {
         log_error(`${gobj_short_name(gobj)}: ${event} names no topic: ${kw.topic}`);
         return -1;
@@ -3520,6 +3815,9 @@ function ac_delete_topic(gobj, event, kw, src)
     if(refuse_if_readonly(gobj, event)) {
         return -1;
     }
+    if(reload_first(gobj, event)) {
+        return -1;
+    }
     if(!topic) {
         log_error(`${gobj_short_name(gobj)}: ${event} names no topic: ${kw.topic}`);
         return -1;
@@ -3538,6 +3836,12 @@ function ac_delete_orphan(gobj, event, kw, src)
     if(refuse_if_readonly(gobj, event)) {
         return -1;
     }
+    if(reload_first(gobj, event)) {
+        return -1;
+    }
+    if(built_on_a_replaced_model(gobj, event, kw)) {
+        return -1;
+    }
     if(empty_string(kw.id)) {
         log_error(`${gobj_short_name(gobj)}: ${event} names nothing`);
         return -1;
@@ -3558,6 +3862,10 @@ function ac_validate(gobj, event, kw, src)
     let priv = gobj.priv;
     let treedb = current_treedb(gobj);
 
+    if(reload_first(gobj, event)) {
+        return -1;
+    }
+
     if(!treedb) {
         log_error(`${gobj_short_name(gobj)}: ${event} with no treedb open`);
         return -1;
@@ -3577,6 +3885,10 @@ function ac_export(gobj, event, kw, src)
 {
     let treedb = current_treedb(gobj);
 
+    if(reload_first(gobj, event)) {
+        return -1;
+    }
+
     if(!treedb) {
         log_error(`${gobj_short_name(gobj)}: ${event} with no treedb open`);
         return -1;
@@ -3592,6 +3904,9 @@ function ac_import(gobj, event, kw, src)
     if(refuse_if_readonly(gobj, event)) {
         return -1;
     }
+    if(reload_first(gobj, event)) {
+        return -1;
+    }
     if(!treedb) {
         log_error(`${gobj_short_name(gobj)}: ${event} with no treedb open`);
         return -1;
@@ -3610,6 +3925,13 @@ function ac_preview_import(gobj, event, kw, src)
     let treedb = current_treedb(gobj);
     let incoming = null;
 
+    if(reload_first(gobj, event)) {
+        return -1;
+    }
+
+    if(built_on_a_replaced_model(gobj, event, kw)) {
+        return -1;
+    }
     if(!treedb) {
         log_error(`${gobj_short_name(gobj)}: ${event} with no treedb open`);
         return -1;
@@ -3637,6 +3959,12 @@ function ac_apply_import(gobj, event, kw, src)
     if(refuse_if_readonly(gobj, event)) {
         return -1;
     }
+    if(reload_first(gobj, event)) {
+        return -1;
+    }
+    if(built_on_a_replaced_model(gobj, event, kw)) {
+        return -1;
+    }
     if(!plan || plan.writes.length === 0) {
         log_error(`${gobj_short_name(gobj)}: ${event} with no plan to run`);
         return -1;
@@ -3660,8 +3988,12 @@ function run_import(gobj)
     let priv = gobj.priv;
     let plan = priv.import_plan;
 
+    /*  Not an ERROR: a load that left forgets the plan (request_model()),
+     *  and the confirmation of it may still be up. The operator's Yes
+     *  is answered, not lost in the log.  */
     if(!plan) {
-        log_error(`${gobj_short_name(gobj)}: the import plan is gone`);
+        log_warning(`${gobj_short_name(gobj)}: the import plan is gone`);
+        yui_shell_show_error(yui_shell_of(gobj), "the import plan is gone: preview it again", {t: t});
         return -1;
     }
     close_dialog(gobj);
@@ -3687,6 +4019,12 @@ function ac_confirmed(gobj, event, kw, src)
     if(refuse_if_readonly(gobj, event)) {
         return -1;
     }
+    if(reload_first(gobj, event)) {
+        return -1;
+    }
+    if(built_on_a_replaced_model(gobj, event, kw)) {
+        return -1;
+    }
     if(kw.what === "import") {
         return run_import(gobj);
     }
@@ -3782,7 +4120,9 @@ function create_gclass(gclass_name)
      *  a click is worth routing through a machine.
      *---------------------------------------------*/
     const states = [
-        ["ST_IDLE", COMMON.slice()],
+        ["ST_IDLE", COMMON.concat([
+            ["EV_CONFIRMED",        ac_confirmed_on_nothing, null]
+        ])],
 
         ["ST_LOADING", COMMON.concat([
             ["EV_SAVE_COLUMN",      ac_wait_for_the_load,   null],
@@ -3793,7 +4133,9 @@ function create_gclass(gclass_name)
             ["EV_CONFIRMED",        ac_wait_for_the_load,   null]
         ])],
 
-        ["ST_EMPTY", COMMON.slice()],
+        ["ST_EMPTY", COMMON.concat([
+            ["EV_CONFIRMED",        ac_confirmed_on_nothing, null]
+        ])],
 
         ["ST_TREEDBS", COMMON.concat([
             ["EV_SELECT_TREEDB",    ac_select_treedb,       null],