filegrc 0.13.0 → 0.13.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "filegrc",
-  "version": "0.13.0",
+  "version": "0.13.1",
   "description": "Zero-dependency Git-native GRC engine",
   "license": "MIT",
   "repository": {

package/src/files.js

@@ -965,14 +965,22 @@ async function updateContentUnlocked(input, dataRelativePath, source, options) {
   const path = resolveDataPath(loaded.root, dataRelativePath);
   const previous = await readFile(path, "utf8");
   assertRevision(previous, options.expectedRevision, "The Markdown file");
-  const before = await validateWorkspace(loaded);
+  const deferValidation = workspaceValidationDeferred();
+  const before = deferValidation ? null : await validateWorkspace(loaded);
   const nextSource = source.endsWith("\n") ? source : `${source}\n`;
   await writeTextAtomic(path, nextSource);
   try {
-    const result = await validateWorkspace(loaded.root);
-    const introduced = newErrors(result, before);
-    if (introduced.length) throw new Error(formatWriteFailure(introduced, dataRelativePath));
-    return { path, dataRelativePath };
+    if (!deferValidation) {
+      const result = await validateWorkspace(loaded.root);
+      const introduced = newErrors(result, before);
+      if (introduced.length) throw new Error(formatWriteFailure(introduced, dataRelativePath));
+    }
+    return {
+      path,
+      dataRelativePath,
+      source: nextSource,
+      revision: contentRevision(nextSource)
+    };
   } catch (error) {
     await writeTextAtomic(path, previous);
     throw error;

package/src/git.js

@@ -1,7 +1,7 @@
 import { execFileSync, spawn } from "node:child_process";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
-import { closeSync, constants, existsSync, fstatSync, fsyncSync, lstatSync, openSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { closeSync, constants, existsSync, fstatSync, fsyncSync, lstatSync, openSync, readFileSync, readSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { rm } from "node:fs/promises";
 import { devNull } from "node:os";
 import { relative, resolve, sep } from "node:path";
@@ -23,6 +23,7 @@ const backgroundSynchronizations = new Map();
 const browserRemotePrefetches = new Map();
 const browserRemotePrefetchPromises = new Map();
 const repositorySnapshotPromises = new Map();
+const repositoryObjectFormats = new Map();
 const gitCommandCaches = new AsyncLocalStorage();
 const gitCommandDeadlines = new AsyncLocalStorage();
 const gitCommandCacheBytes = new WeakMap();
@@ -30,6 +31,7 @@ let gitCommandInterceptor = null;
 let gitSubprocessObserver = null;
 let historicalBatchInterceptor = null;
 let historicalRevisionReadObserver = null;
+let workspaceBlobObjectIdOverride = null;
 const BROWSER_REMOTE_PREFETCH_MAX_AGE_MS = 30_000;
 const GIT_DEFAULT_TIMEOUT_MS = 10_000;
 const GIT_REMOTE_TIMEOUT_MS = 30_000;
@@ -680,15 +682,50 @@ export function getFileObjectIdAtRevision(input, revision, relativePath) {
 export function getWorkingFileObjectId(input, relativePath) {
   if (!isSafeDataGitPath(relativePath)) return null;
   const root = resolveWorkspaceRoot(input);
+  let descriptor;
   try {
-    const objectId = git(root, ["hash-object", "--no-filters", "--", relativePath]);
-    return /^[a-f0-9]{40}(?:[a-f0-9]{24})?$/i.test(objectId) ? objectId : null;
+    const objectFormat = repositoryObjectFormat(root);
+    if (!objectFormat) return null;
+    descriptor = openSync(resolve(root, relativePath), constants.O_RDONLY | (constants.O_NOFOLLOW || 0));
+    const before = fstatSync(descriptor);
+    if (!before.isFile()) return null;
+    const hash = createHash(objectFormat).update(`blob ${before.size}\0`);
+    const buffer = Buffer.allocUnsafe(64 * 1024);
+    let position = 0;
+    while (position < before.size) {
+      const count = readSync(descriptor, buffer, 0, Math.min(buffer.length, before.size - position), position);
+      if (!count) return null;
+      hash.update(buffer.subarray(0, count));
+      position += count;
+    }
+    const after = fstatSync(descriptor);
+    if (
+      after.size !== before.size
+      || after.dev !== before.dev
+      || after.ino !== before.ino
+      || after.mtimeMs !== before.mtimeMs
+      || after.ctimeMs !== before.ctimeMs
+    ) return null;
+    return hash.digest("hex");
   } catch (error) {
     rethrowGitDeadline(error);
     return null;
+  } finally {
+    if (descriptor !== undefined) closeSync(descriptor);
   }
 }
 
+function repositoryObjectFormat(root) {
+  if (repositoryObjectFormats.has(root)) return repositoryObjectFormats.get(root);
+  if (!tryGit(root, ["rev-parse", "--git-dir"])) return null;
+  const objectFormat = tryGit(root, ["config", "--get", "extensions.objectFormat"]) || "sha1";
+  if (!["sha1", "sha256"].includes(objectFormat)) {
+    throw new Error(`FileGRC does not support the repository object format "${objectFormat}".`);
+  }
+  repositoryObjectFormats.set(root, objectFormat);
+  return objectFormat;
+}
+
 export function getWorkspaceHistories(input, relativePaths, limitPerFile = 12, options = {}) {
   const root = resolveWorkspaceRoot(input);
   const wanted = new Set(relativePaths);
@@ -1415,8 +1452,8 @@ async function runTrunkMutationUnlocked(root, config, options, task) {
     })));
     subject = generatedCommitMessage(typeof options?.message === "function" ? options.message(result) : options?.message);
     assertNoIgnoredAuthoritativeFiles(root);
-    const beforeValidation = workspaceByteManifest(root);
-    const validation = await validateWorkspace(root);
+    const beforeValidation = measureTimingSync("workspace-manifest", () => workspaceByteManifest(root));
+    const validation = await withGitCommandCache(new Map(), () => validateWorkspace(root));
     if (!validation.ok) {
       throw new Error(`The workspace has ${validation.counts.errors} validation ${validation.counts.errors === 1 ? "error" : "errors"}.`);
     }
@@ -1426,9 +1463,9 @@ async function runTrunkMutationUnlocked(root, config, options, task) {
           validation,
           fingerprint: (await measureTiming("fingerprint", () => fingerprintWorkspace(validation.loaded))).fingerprint
     };
-    validatedManifest = workspaceByteManifest(root);
+    validatedManifest = measureTimingSync("workspace-manifest", () => workspaceByteManifest(root));
     assertWorkspaceManifestEqual(beforeValidation, validatedManifest);
-    await assertNoOutsideWorktreeChangesAsync(root);
+    await measureTiming("outside-worktree-check", () => assertNoOutsideWorktreeChangesAsync(root));
   } catch (error) {
     throw new Error(`${error.message} FileGRC preserved every current file instead of guessing which edits it owns. Review the Git diff; later browser mutations are blocked until the worktree is reconciled.`);
   }
@@ -1454,13 +1491,13 @@ async function runTrunkMutationUnlocked(root, config, options, task) {
   }
   assertValidGitIdentity(root);
   assertNoWorkspaceContentFilters(root);
-  await assertNoOutsideWorktreeChangesAsync(root);
+  await measureTiming("outside-worktree-check", () => assertNoOutsideWorktreeChangesAsync(root));
   let commit;
   let indexReconciled;
   try {
     const expectedRef = `refs/heads/${config.authoritativeBranch}`;
     assertExpectedCheckout(root, expectedRef, synchronized.currentCommit);
-    validatedManifest = writeWorkspaceManifestObjects(root, validatedManifest);
+    validatedManifest = measureTimingSync("workspace-manifest-objects", () => writeWorkspaceManifestObjects(root, validatedManifest));
     ({ commit, indexReconciled } = await measureTiming("commit", () => commitValidatedIndexAsync(root, subject, validatedManifest, {
       expectedParent: synchronized.currentCommit,
       expectedRef
@@ -2261,6 +2298,8 @@ function assertNoIgnoredAuthoritativeFiles(root) {
 
 function workspaceByteManifest(root) {
   assertNoHiddenIndexEntries(root);
+  const objectFormat = repositoryObjectFormat(root);
+  if (!objectFormat) throw new Error("FileGRC could not determine the Git repository object format.");
   const paths = [...new Set(nulFields(gitRaw(root, [
     "ls-files", "-z", "--cached", "--others", "--exclude-standard", "--", "."
   ])))].sort();
@@ -2298,9 +2337,36 @@ function workspaceByteManifest(root) {
       ) {
         throw new Error(`FileGRC will not commit workspace entry "${path}" because it changed while its bytes were being inspected.`);
       }
-      const bytes = readFileSync(descriptor);
-      const objectId = hashWorkspaceBytes(root, bytes);
-      return [path, { objectId, mode: opened.mode & 0o111 ? "100755" : "100644", bytes }];
+      const objectHash = createHash(objectFormat).update(`blob ${opened.size}\0`);
+      const byteHash = createHash("sha256");
+      const buffer = Buffer.allocUnsafe(64 * 1024);
+      let position = 0;
+      while (position < opened.size) {
+        const count = readSync(descriptor, buffer, 0, Math.min(buffer.length, opened.size - position), position);
+        if (!count) throw new Error(`FileGRC could not read complete workspace entry "${path}".`);
+        const chunk = buffer.subarray(0, count);
+        objectHash.update(chunk);
+        byteHash.update(chunk);
+        position += count;
+      }
+      const after = fstatSync(descriptor);
+      if (
+        after.size !== opened.size
+        || after.dev !== opened.dev
+        || after.ino !== opened.ino
+        || after.mtimeMs !== opened.mtimeMs
+        || after.ctimeMs !== opened.ctimeMs
+      ) {
+        throw new Error(`FileGRC will not commit workspace entry "${path}" because it changed while its bytes were being inspected.`);
+      }
+      const calculatedObjectId = objectHash.digest("hex");
+      const objectId = workspaceBlobObjectIdOverride?.(null, objectFormat, path) ?? calculatedObjectId;
+      return [path, {
+        objectId,
+        byteDigest: byteHash.digest("hex"),
+        size: opened.size,
+        mode: opened.mode & 0o111 ? "100755" : "100644"
+      }];
     } finally {
       closeSync(descriptor);
     }
@@ -2316,24 +2382,42 @@ function assertNoHiddenIndexEntries(root) {
   }
 }
 
-function hashWorkspaceBytes(root, bytes, write = false) {
-  return observedExecFileSync("git", ["hash-object", ...(write ? ["-w"] : []), "--stdin"], {
+function writeWorkspaceManifestObjects(root, manifest) {
+  const valuesByObjectId = new Map();
+  for (const value of manifest.values()) {
+    if (!value.objectId) continue;
+    const prior = valuesByObjectId.get(value.objectId);
+    if (prior && (prior.size !== value.size || prior.byteDigest !== value.byteDigest)) {
+      throw new Error(`Git object ${value.objectId} identifies different validated workspace bytes.`);
+    }
+    valuesByObjectId.set(value.objectId, value);
+  }
+  if (!valuesByObjectId.size) return manifest;
+  const entries = [...manifest].filter(([, value]) => value.objectId);
+  const topLevel = git(root, ["rev-parse", "--show-toplevel"]);
+  const workspacePrefix = relative(topLevel, root).split(sep).join("/");
+  if (workspacePrefix === ".." || workspacePrefix.startsWith("../")) {
+    throw new Error("The FileGRC workspace is outside its Git repository.");
+  }
+  const written = observedExecFileSync("git", ["hash-object", "-w", "--stdin-paths"], {
     cwd: root,
-    input: bytes,
+    input: `${entries.map(([path]) => workspacePrefix ? `${workspacePrefix}/${path}` : path).join("\n")}\n`,
     encoding: "utf8",
     stdio: ["pipe", "pipe", "ignore"],
     timeout: 30_000,
     maxBuffer: 20_000_000,
     env: gitEnvironment()
-  }).trim();
-}
-
-function writeWorkspaceManifestObjects(root, manifest) {
-  return new Map([...manifest].map(([path, value]) => (
-    value.objectId
-      ? [path, { ...value, objectId: hashWorkspaceBytes(root, value.bytes, true) }]
-      : [path, value]
-  )));
+  }).trim().split("\n");
+  if (written.length !== entries.length) {
+    throw new Error("Git returned an unexpected number of workspace objects.");
+  }
+  for (let index = 0; index < entries.length; index += 1) {
+    if (written[index] !== entries[index][1].objectId) {
+      throw new Error(`Git wrote an unexpected object while preparing validated workspace bytes for commit.`);
+    }
+  }
+  assertWorkspaceManifestEqual(manifest, workspaceByteManifest(root));
+  return manifest;
 }
 
 function assertWorkspaceManifestEqual(expected, current) {
@@ -2346,7 +2430,11 @@ function workspaceManifestsEqual(expected, current) {
   return expected.size === current.size
     && [...expected].every(([path, value]) => {
       const other = current.get(path);
-      return other && value.objectId === other.objectId && value.mode === other.mode;
+      return other
+        && value.objectId === other.objectId
+        && value.mode === other.mode
+        && value.size === other.size
+        && value.byteDigest === other.byteDigest;
     });
 }
 
@@ -2621,6 +2709,15 @@ export function setHistoricalRevisionReadObserverForTests(observer) {
   return () => { historicalRevisionReadObserver = previous; };
 }
 
+export function setWorkspaceBlobObjectIdOverrideForTests(override) {
+  if (override !== null && typeof override !== "function") {
+    throw new TypeError("The workspace blob object ID override must be a function or null.");
+  }
+  const previous = workspaceBlobObjectIdOverride;
+  workspaceBlobObjectIdOverride = override;
+  return () => { workspaceBlobObjectIdOverride = previous; };
+}
+
 export function runGitCommand(cwd, args, options = {}) {
   if (gitCommandInterceptor) {
     return Promise.resolve().then(() => gitCommandInterceptor({

package/src/server.js

@@ -37,6 +37,7 @@ import {
   withGitCommandDeadline
 } from "./git.js";
 import { normalizeResourceMutation, serializeWorkspaceMutation } from "./mutation.js";
+import { renderMarkdown } from "./markdown.js";
 import {
   approveReportingRouteSet,
   assessReportingRouteSets,
@@ -64,7 +65,7 @@ import { activatePolicies } from "./policy-activation.js";
 import { resolveProgram } from "./program.js";
 import { applyReconciliation, dismissReconciliation, planReconciliation } from "./reconciliation.js";
 import { resourceReviewRevisions } from "./retention.js";
-import { createAppBootstrap, createAppState, createAppStateSection, createResourceDetail } from "./state.js";
+import { createAppBootstrap, createAppState, createAppStateSection, createResourceDetail, createResourceHistory } from "./state.js";
 import { setupWorkspace } from "./setup.js";
 import { collectTimings, measureTiming, timingEnabled } from "./timing.js";
 import { fingerprintWorkspace } from "./validate.js";
@@ -86,6 +87,10 @@ const STATE_SECTION_GIT_DEADLINE_MS = 10_000;
 export function createFilegrcServer(input = process.cwd(), options = {}) {
   const stateSessions = new Map();
   const fileDigestCache = new Map();
+  let bootstrapSnapshotPromise = null;
+  let stateInvalidationGeneration = 0;
+  let activeStateMutations = 0;
+  let stateMutationWaiters = [];
   return createHttpServer(async (request, response) => {
     const requestStarted = performance.now();
     if (timingEnabled()) {
@@ -107,7 +112,22 @@ export function createFilegrcServer(input = process.cwd(), options = {}) {
       const requestOptions = {
         ...options,
         programId: url.searchParams.get("programId") || undefined,
-        invalidateStateSessions: () => invalidateStateSessions(stateSessions)
+        fastResponse: prefersFastMutation(request),
+        beginStateMutation: () => {
+          stateInvalidationGeneration += 1;
+          activeStateMutations += 1;
+          invalidateStateSessions(stateSessions);
+        },
+        endStateMutation: () => {
+          stateInvalidationGeneration += 1;
+          activeStateMutations -= 1;
+          invalidateStateSessions(stateSessions);
+          if (activeStateMutations === 0) {
+            const waiters = stateMutationWaiters;
+            stateMutationWaiters = [];
+            for (const resolve of waiters) resolve();
+          }
+        }
       };
       if (["POST", "PUT", "DELETE"].includes(request.method) && !sameOrigin(request)) {
         return json(response, 403, { error: "Cross-origin writes are not allowed." });
@@ -133,45 +153,51 @@ export function createFilegrcServer(input = process.cwd(), options = {}) {
           return json(response, 403, { error: "Cross-origin state requests are not allowed." });
         }
         const deadlineAt = performance.now() + STATE_SECTION_GIT_DEADLINE_MS;
-        const [snapshot, repositorySignature] = await withGitCommandDeadline(deadlineAt, () => (
-          serializeWorkspaceMutation(input, (root) => Promise.all([
-            fingerprintWorkspace(root, {
+        for (let attempt = 0; attempt < 3; attempt += 1) {
+          if (activeStateMutations > 0) {
+            await awaitWithinDeadline(new Promise((resolve) => stateMutationWaiters.push(resolve)), deadlineAt);
+          }
+          const generation = stateInvalidationGeneration;
+          if (!bootstrapSnapshotPromise) {
+            bootstrapSnapshotPromise = withGitCommandDeadline(deadlineAt, () => stableStateSnapshot(input, {
               fileDigestCache,
               deadlineAt
-            }),
-            getRepositoryStateSignature(root, {
-              timeoutMs: Math.max(1, Math.ceil(deadlineAt - performance.now()))
-            })
-          ]))
-        ));
-        const loaded = snapshot.loaded;
-        const token = randomUUID();
-        const session = {
-          loaded,
-          fingerprint: snapshot.fingerprint,
-          repositorySignature,
-          fileDigestCache,
-          generatedAt: new Date().toISOString(),
-          expiresAt: Date.now() + STATE_SESSION_MAX_AGE_MS,
-          revoked: false,
-          promises: new Map(),
-          verificationPromise: null,
-          gitCommandCache: new Map()
-        };
-        pruneStateSessions(stateSessions);
-        stateSessions.set(token, session);
-        while (stateSessions.size > MAX_STATE_SESSIONS) {
-          const oldestToken = stateSessions.keys().next().value;
-          const oldestSession = stateSessions.get(oldestToken);
-          if (oldestSession) oldestSession.revoked = true;
-          stateSessions.delete(oldestToken);
+            })).finally(() => {
+              bootstrapSnapshotPromise = null;
+            });
+          }
+          const [snapshot, repositorySignature] = await awaitWithinDeadline(bootstrapSnapshotPromise, deadlineAt);
+          const loaded = snapshot.loaded;
+          const token = randomUUID();
+          const session = {
+            loaded,
+            fingerprint: snapshot.fingerprint,
+            repositorySignature,
+            fileDigestCache,
+            generatedAt: new Date().toISOString(),
+            expiresAt: Date.now() + STATE_SESSION_MAX_AGE_MS,
+            revoked: false,
+            promises: new Map(),
+            verificationPromise: null,
+            gitCommandCache: new Map()
+          };
+          const state = await createAppBootstrap(loaded, {
+            generatedAt: session.generatedAt,
+            programId: url.searchParams.get("programId") || undefined
+          });
+          if (activeStateMutations > 0 || generation !== stateInvalidationGeneration) continue;
+          pruneStateSessions(stateSessions);
+          stateSessions.set(token, session);
+          while (stateSessions.size > MAX_STATE_SESSIONS) {
+            const oldestToken = stateSessions.keys().next().value;
+            const oldestSession = stateSessions.get(oldestToken);
+            if (oldestSession) oldestSession.revoked = true;
+            stateSessions.delete(oldestToken);
+          }
+          state.stateToken = token;
+          return json(response, 200, state);
         }
-        const state = await createAppBootstrap(loaded, {
-          generatedAt: session.generatedAt,
-          programId: url.searchParams.get("programId") || undefined
-        });
-        state.stateToken = token;
-        return json(response, 200, state);
+        throw stateSessionExpiredError();
       }
       if (request.method === "GET" && url.pathname.startsWith("/api/state/")) {
         const section = url.pathname.slice("/api/state/".length);
@@ -526,29 +552,35 @@ export function createFilegrcServer(input = process.cwd(), options = {}) {
       if (request.method === "POST" && url.pathname === "/api/policy-activations") {
         const payload = await readJson(request);
         const result = await browserMutation(input, requestOptions, {
-          message: (activation) => `Activate ${activation.policyIds.length} ${activation.policyIds.length === 1 ? "Policy" : "Policies"}`
+          message: (activation) => `Activate ${activation.policyIds.length} ${activation.policyIds.length === 1 ? "Policy" : "Policies"}`,
+          prefetchToken: payload.prefetchToken
         }, () => activatePolicies(input, { ...payload, confirmed: true }));
         return json(response, 200, result);
       }
       if (request.method === "POST" && url.pathname === "/api/document-activations") {
         const payload = await readJson(request);
         const result = await browserMutation(input, requestOptions, {
-          message: (activation) => `Activate ${activation.documentIds.length} governed ${activation.documentIds.length === 1 ? "Document" : "Documents"}`
+          message: (activation) => `Activate ${activation.documentIds.length} governed ${activation.documentIds.length === 1 ? "Document" : "Documents"}`,
+          prefetchToken: payload.prefetchToken
         }, () => activateDocuments(input, { ...payload, confirmed: true }));
         return json(response, 200, result);
       }
       if (request.method === "POST" && url.pathname === "/api/governed-content-activations") {
         const payload = await readJson(request);
         const result = await browserMutation(input, requestOptions, {
-          message: (activation) => `Activate ${activation.resourceIds.length} governed-content ${activation.resourceIds.length === 1 ? "record" : "records"}`
+          message: (activation) => `Activate ${activation.resourceIds.length} governed-content ${activation.resourceIds.length === 1 ? "record" : "records"}`,
+          prefetchToken: payload.prefetchToken
         }, () => activateGovernedContent(input, { ...payload, confirmed: true }));
         return json(response, 200, result);
       }
       if (request.method === "POST" && url.pathname === "/api/resources") {
-        const payload = normalizeResourceMutation(await readJson(request));
+        const requestPayload = await readJson(request);
+        const payload = normalizeResourceMutation(requestPayload);
         const { record } = payload;
         const result = await browserMutation(input, requestOptions, {
-          message: () => `Create ${resourceTypeLabel(record.type)}: ${record.title || record.id}`
+          message: () => `Create ${resourceTypeLabel(record.type)}: ${record.title || record.id}`,
+          fastResponse: prefersFastMutation(request),
+          prefetchToken: requestPayload.prefetchToken
         }, () => createResource(input, record, { content: payload.content }));
         return json(response, 201, result);
       }
@@ -566,19 +598,12 @@ export function createFilegrcServer(input = process.cwd(), options = {}) {
         return json(response, 200, await manualGitResultWithState(input, requestOptions, () => pushWorkspace(input)));
       }
       if (request.method === "POST" && url.pathname === "/api/git/retry-sync") {
-        let result;
-        try {
-          result = await retryBrowserSync(input, {
+        const result = await manualGitResultWithState(input, requestOptions, () => (
+          retryBrowserSync(input, {
             allowNonAuthoritativeWrites: options.allowNonAuthoritativeWrites
-          });
-        } finally {
-          requestOptions.invalidateStateSessions();
-        }
-        const state = await createAppState(input, {
-          allowNonAuthoritativeWrites: options.allowNonAuthoritativeWrites,
-          includeDetails: false
-        });
-        return json(response, 200, { ...result, state });
+          })
+        ));
+        return json(response, 200, result);
       }
       if (request.method === "GET" && url.pathname === "/api/git/sync-status") {
         const git = { ...await getRepositorySnapshot(input) };
@@ -607,11 +632,16 @@ export function createFilegrcServer(input = process.cwd(), options = {}) {
       if (request.method === "PUT" && url.pathname === "/api/content") {
         const payload = await readJson(request);
         const result = await browserMutation(input, requestOptions, {
-          message: () => `Update content: ${payload.path}`
+          message: () => `Update content: ${payload.path}`,
+          fastResponse: prefersFastMutation(request),
+          prefetchToken: payload.prefetchToken
         }, () => updateContent(input, payload.path, payload.source, {
           expectedRevision: requireRevision(payload.revision, `content/${payload.path}`)
         }));
-        return json(response, 200, result);
+        return json(response, 200, {
+          ...result,
+          ...(result.stateRefresh ? { html: renderMarkdown(result.source) } : {})
+        });
       }
       const match = /^\/api\/resource\/([^/]+)\/([^/]+)$/.exec(url.pathname);
       if (match) {
@@ -624,9 +654,17 @@ export function createFilegrcServer(input = process.cwd(), options = {}) {
           const session = token ? stateSessions.get(token) : null;
           if (token && !session) return json(response, 409, { error: "The workspace state expired. Reload it and try again." });
           const includeWorkflow = url.searchParams.get("workflow") === "true";
+          const historyOnly = url.searchParams.get("history") === "only";
+          if (historyOnly) {
+            const history = session
+              ? await loadStateSessionResourceHistory(session, token, type, id, options)
+              : await createResourceHistory(input, type, id);
+            if (!history) return json(response, 404, { error: "Resource not found." });
+            return json(response, 200, history);
+          }
           const entry = session
-            ? await loadStateSessionResource(session, token, type, id, options, requestOptions.programId, includeWorkflow)
-            : await createResourceDetail(input, type, id);
+            ? await loadStateSessionResource(session, token, type, id, options, requestOptions.programId, includeWorkflow, url.searchParams.get("history") !== "false")
+            : await createResourceDetail(input, type, id, { includeHistory: url.searchParams.get("history") !== "false" });
           if (!entry) return json(response, 404, { error: "Resource not found." });
           if (includeWorkflow && !session) {
             const workflow = await assessWorkflow(input, { programId: requestOptions.programId });
@@ -635,10 +673,13 @@ export function createFilegrcServer(input = process.cwd(), options = {}) {
           return json(response, 200, entry);
         }
         if (request.method === "PUT") {
-          const payload = normalizeResourceMutation(await readJson(request), { requireRevision: true });
+          const requestPayload = await readJson(request);
+          const payload = normalizeResourceMutation(requestPayload, { requireRevision: true });
           const { record } = payload;
           const result = await browserMutation(input, requestOptions, {
-            message: () => `Update ${resourceTypeLabel(type)}: ${record.title || id}`
+            message: () => `Update ${resourceTypeLabel(type)}: ${record.title || id}`,
+            fastResponse: prefersFastMutation(request),
+            prefetchToken: requestPayload.prefetchToken
           }, () => updateResource(input, type, id, record, {
             content: payload.content,
             expectedRevision: payload.revision,
@@ -650,7 +691,8 @@ export function createFilegrcServer(input = process.cwd(), options = {}) {
         if (request.method === "DELETE") {
           const revision = requireRevision(url.searchParams.get("revision"), `${type}/${id}`);
           const result = await browserMutation(input, requestOptions, {
-            message: () => `Delete ${resourceTypeLabel(type)}: ${id}`
+            message: () => `Delete ${resourceTypeLabel(type)}: ${id}`,
+            prefetchToken: url.searchParams.get("prefetchToken") || undefined
           }, () => deleteResource(input, type, id, { expectedRevision: revision }));
           return json(response, 200, {
             deleted: true,
@@ -659,7 +701,8 @@ export function createFilegrcServer(input = process.cwd(), options = {}) {
             deletedContent: result.deletedContent,
             synchronization: result.synchronization,
             workflowDelta: result.workflowDelta,
-            state: result.state
+            state: result.state,
+            stateRefresh: result.stateRefresh
           });
         }
       }
@@ -703,6 +746,30 @@ export function createFilegrcServer(input = process.cwd(), options = {}) {
   });
 }
 
+async function stableStateSnapshot(input, options) {
+  for (let attempt = 0; attempt < 3; attempt += 1) {
+    const first = await fingerprintWorkspace(input, {
+      fileDigestCache: options.fileDigestCache,
+      deadlineAt: options.deadlineAt
+    });
+    const firstRepositorySignature = await getRepositoryStateSignature(input, {
+      timeoutMs: Math.max(1, Math.ceil(options.deadlineAt - performance.now()))
+    });
+    const second = await fingerprintWorkspace(input, {
+      fileDigestCache: options.fileDigestCache,
+      deadlineAt: options.deadlineAt
+    });
+    const secondRepositorySignature = await getRepositoryStateSignature(input, {
+      timeoutMs: Math.max(1, Math.ceil(options.deadlineAt - performance.now()))
+    });
+    if (
+      first.fingerprint === second.fingerprint
+      && firstRepositorySignature === secondRepositorySignature
+    ) return [second, secondRepositorySignature];
+  }
+  throw stateSessionExpiredError();
+}
+
 export async function serveWorkspace(input = process.cwd(), options = {}) {
   const host = String(options.host ?? "127.0.0.1").trim();
   const port = Number(options.port ?? 8787);
@@ -761,11 +828,12 @@ function listen(server, port, host) {
 
 function browserMutation(input, requestOptions, mutationOptions, task) {
   const run = () => serializeWorkspaceMutation(input, async (root) => {
-    const fastResponse = mutationOptions.fastResponse === true;
+    const fastResponse = mutationOptions.fastResponse ?? requestOptions.fastResponse;
     const workflowBefore = fastResponse
       ? null
       : await measureTiming("workflow-before", () => assessWorkflow(root, { programId: requestOptions.programId }));
     let result;
+    requestOptions.beginStateMutation?.();
     try {
       result = await measureTiming("mutation", () => runBrowserMutation(root, {
         ...mutationOptions,
@@ -774,7 +842,7 @@ function browserMutation(input, requestOptions, mutationOptions, task) {
         includeValidationProof: !fastResponse
       }, task));
     } finally {
-      requestOptions.invalidateStateSessions?.();
+      requestOptions.endStateMutation?.();
     }
     if (fastResponse) {
       return {
@@ -899,7 +967,7 @@ async function loadStateSessionSection(session, section, serverOptions, programI
   return state;
 }
 
-async function loadStateSessionResource(session, token, type, id, serverOptions, programId, includeWorkflow) {
+async function loadStateSessionResource(session, token, type, id, serverOptions, programId, includeWorkflow, includeHistory = true) {
   assertCurrentStateSession(session);
   const detailDeadlineMs = Number.isFinite(serverOptions.resourceDetailDeadlineMs)
     ? Math.max(0, serverOptions.resourceDetailDeadlineMs)
@@ -907,7 +975,8 @@ async function loadStateSessionResource(session, token, type, id, serverOptions,
   const deadlineAt = performance.now() + detailDeadlineMs;
   return withGitCommandDeadline(deadlineAt, async () => {
     const detail = await withGitCommandCache(session.gitCommandCache, () => createResourceDetail(session.loaded, type, id, {
-      historyDeadlineAt: deadlineAt
+      historyDeadlineAt: deadlineAt,
+      includeHistory
     }));
     if (detail && includeWorkflow) {
       const repository = await loadStateSessionSection(
@@ -931,6 +1000,22 @@ async function loadStateSessionResource(session, token, type, id, serverOptions,
   });
 }
 
+async function loadStateSessionResourceHistory(session, token, type, id, serverOptions) {
+  assertCurrentStateSession(session);
+  const detailDeadlineMs = Number.isFinite(serverOptions.resourceDetailDeadlineMs)
+    ? Math.max(0, serverOptions.resourceDetailDeadlineMs)
+    : RESOURCE_DETAIL_GIT_DEADLINE_MS;
+  const deadlineAt = performance.now() + detailDeadlineMs;
+  return withGitCommandDeadline(deadlineAt, async () => {
+    const history = await withGitCommandCache(session.gitCommandCache, () => createResourceHistory(session.loaded, type, id, {
+      historyDeadlineAt: deadlineAt
+    }));
+    await verifyStateSessionSnapshot(session, performance.now(), deadlineAt);
+    assertCurrentStateSession(session);
+    return history ? { ...history, stateToken: token } : null;
+  });
+}
+
 function prefersFastMutation(request) {
   return String(request.headers.prefer || "")
     .split(",")
@@ -948,10 +1033,11 @@ async function requireManualBrowserGit(input, options) {
 
 async function manualGitResultWithState(input, requestOptions, task) {
   let result;
+  requestOptions.beginStateMutation?.();
   try {
     result = await task();
   } finally {
-    requestOptions.invalidateStateSessions?.();
+    requestOptions.endStateMutation?.();
   }
   const state = await createAppState(input, {
     allowNonAuthoritativeWrites: requestOptions.allowNonAuthoritativeWrites,

package/src/state.js

@@ -368,15 +368,39 @@ async function createResourceDetailFromLoaded(loaded, type, id, options) {
   const entry = loaded.entries.find(({ record }) => record.type === type && record.id === id);
   if (!entry) return null;
   const relativePath = `data/${entry.relativePath}`;
-  const histories = getWorkspaceHistories(loaded.root, [relativePath], 12, {
-    deadlineAt: options.historyDeadlineAt
-  });
+  const includeHistory = options.includeHistory !== false;
+  const histories = includeHistory
+    ? getWorkspaceHistories(loaded.root, [relativePath], 12, {
+        deadlineAt: options.historyDeadlineAt
+      })
+    : new Map();
   return createStateEntry(loaded, entry, {
     includeDetails: true,
-    history: histories.get(relativePath) ?? []
+    includeHistory,
+    history: includeHistory ? histories.get(relativePath) ?? [] : undefined
+  });
+}
+
+export async function createResourceHistory(input, type, id, options = {}) {
+  if (input?.entries && input?.root) return createResourceHistoryFromLoaded(input, type, id, options);
+  return serializeWorkspaceMutation(input, async (root) => {
+    const validation = await validateWorkspace(root);
+    return createResourceHistoryFromLoaded(validation.loaded, type, id, options);
   });
 }
 
+function createResourceHistoryFromLoaded(loaded, type, id, options) {
+  const entry = loaded.entries.find(({ record }) => record.type === type && record.id === id);
+  if (!entry) return null;
+  const relativePath = `data/${entry.relativePath}`;
+  return {
+    history: getWorkspaceHistories(loaded.root, [relativePath], 12, {
+      deadlineAt: options.historyDeadlineAt
+    }).get(relativePath) ?? [],
+    historyLoaded: true
+  };
+}
+
 async function createStateEntry(loaded, entry, options) {
   const record = structuredClone(entry.record);
   const content = {};
@@ -401,7 +425,8 @@ async function createStateEntry(loaded, entry, options) {
     relativePath: `data/${entry.relativePath}`,
     revision: contentRevision(entry.source),
     content,
-    history: options.includeDetails ? options.history : undefined,
+    history: options.includeDetails && options.includeHistory !== false ? options.history : undefined,
+    historyLoaded: options.includeDetails ? options.includeHistory !== false : false,
     detailsLoaded: options.includeDetails
   };
 }

package/src/validate.js

@@ -68,6 +68,7 @@ const COMPLETION_DATE_FIELDS = [
 const COMPLETION_TIMESTAMP_FIELDS = [
   "completedAt", "endedAt", "closedAt", "provisionedOn", "deprovisionedOn"
 ];
+const DEFERRED_VALIDATION_CONCURRENCY = 16;
 
 export async function validateWorkspace(input = process.cwd()) {
   const timingStarted = performance.now();
@@ -90,6 +91,8 @@ async function validateWorkspaceUnmeasured(input) {
   ]));
   const asOf = currentCalendarDate(loaded.workspace?.timezone || "UTC");
   const obligationsByControl = new Map();
+  const deferredDiagnosticTasks = [];
+  const serialContentDiagnosticTasks = [];
   const reviewRecords = loaded.resources.filter((record) => (
     record.status === "active" && ["retention-schedule-item", "requirement-mapping"].includes(record.type)
   ));
@@ -163,7 +166,11 @@ async function validateWorkspaceUnmeasured(input) {
     validateClassification(record, loaded, displayPath, diagnostics);
     validateCompletionDates(record, displayPath, diagnostics);
     validateReportingRouteBinding(record, loaded, displayPath, diagnostics);
-    await validateAttestationBinding(record, loaded.model, loaded.root, byId, displayPath, diagnostics);
+    serialContentDiagnosticTasks.push(async () => {
+      const deferredDiagnostics = [];
+      await validateAttestationBinding(record, loaded.model, loaded.root, byId, displayPath, deferredDiagnostics);
+      return deferredDiagnostics;
+    });
 
     const fields = { ...loaded.model.commonFields, ...definition.fields };
     for (const [fieldName, field] of Object.entries(fields)) {
@@ -173,16 +180,19 @@ async function validateWorkspaceUnmeasured(input) {
         const values = Array.isArray(value) ? value : [value];
         for (const item of values) {
           if (typeof item !== "string") continue;
-          try {
-            const path = resolveDataPath(loaded.root, item);
-            if (!(await stat(path)).isFile()) throw new Error("The data path is not a file.");
-          } catch {
-            diagnostics.push(error(
-              "missing-content",
-              displayPath,
-              `${fieldName} points to unavailable data path "${item}".`
-            ));
-          }
+          deferredDiagnosticTasks.push(async () => {
+            try {
+              const path = resolveDataPath(loaded.root, item);
+              if (!(await stat(path)).isFile()) throw new Error("The data path is not a file.");
+              return [];
+            } catch {
+              return [error(
+                "missing-content",
+                displayPath,
+                `${fieldName} points to unavailable data path "${item}".`
+              )];
+            }
+          });
         }
       }
       if (field.relation) {
@@ -209,8 +219,19 @@ async function validateWorkspaceUnmeasured(input) {
     validateCompletedObligationEvent(record, byId, loaded.model, displayPath, diagnostics);
     validateActionObligationRule(record, byId, displayPath, diagnostics);
     validateImplementedControlSchedules(record, obligationsByControl, displayPath, diagnostics);
-    await validateMarkdown(record, definition, loaded.model, loaded.root, displayPath, diagnostics);
-    await validateApprovalBinding(record, loaded.model, loaded.root, displayPath, diagnostics);
+    serialContentDiagnosticTasks.push(async () => {
+      const markdownDiagnostics = [];
+      const approvalDiagnostics = [];
+      await validateMarkdown(record, definition, loaded.model, loaded.root, displayPath, markdownDiagnostics);
+      await validateApprovalBinding(record, loaded.model, loaded.root, displayPath, approvalDiagnostics);
+      return [...markdownDiagnostics, ...approvalDiagnostics];
+    });
+  }
+  for (const deferredDiagnostics of await runDeferredValidationTasks(deferredDiagnosticTasks)) {
+    diagnostics.push(...deferredDiagnostics);
+  }
+  for (const task of serialContentDiagnosticTasks) {
+    diagnostics.push(...await task());
   }
   validateRelationshipConstraints(
     loaded.resources,
@@ -285,6 +306,23 @@ async function validateWorkspaceUnmeasured(input) {
   return result;
 }
 
+async function runDeferredValidationTasks(tasks) {
+  const results = new Array(tasks.length);
+  let nextIndex = 0;
+  const workers = Array.from(
+    { length: Math.min(DEFERRED_VALIDATION_CONCURRENCY, tasks.length) },
+    async () => {
+      while (nextIndex < tasks.length) {
+        const index = nextIndex;
+        nextIndex += 1;
+        results[index] = await tasks[index]();
+      }
+    }
+  );
+  await Promise.all(workers);
+  return results;
+}
+
 function validateDocumentWorkflowScopes(resources, model, byId, pathById, diagnostics) {
   const managementFields = [
     "engagementTermsDocumentId",

package/src/web.js

@@ -94,6 +94,7 @@ let repositorySyncPollTimer = null;
 let repositorySyncPollInFlight = false;
 let mutationStateRefreshInFlight = false;
 let mutationStateRefreshTimer = null;
+let mutationStateRefreshRequested = false;
 let programSelectionGeneration = 0;
 let expiredStateRefresh = null;
 
@@ -132,7 +133,8 @@ function render() {
   if (nextNavigation) nextNavigation.scrollTop = navigationScrollTop;
   const main = root.querySelector("main");
   const waitingFor = blockingStateSections(route).filter((section) => state.sections?.[section] !== "complete");
-  if (waitingFor.length) renderStateLoading(main, route, waitingFor);
+  if (state.refreshingAfterMutation) renderStateLoading(main, route, []);
+  else if (waitingFor.length) renderStateLoading(main, route, waitingFor);
   else if (route.name === "home") renderHome(main);
   else if (route.name === "stage") renderStageOverview(main, route.stageId, route.params);
   else if (route.name === "obligations") renderObligations(main, route.params);
@@ -660,6 +662,7 @@ function openDocumentActivationDialog(auditId = null) {
     '<label><span>Effective date</span><input name="effectiveOn" type="date" min="' + esc(today) + '" value="' + esc(today) + '" required></label>' +
     '<div class="dialog-error" role="alert"></div><div class="dialog-actions"><span class="save-status" role="status" aria-live="polite"></span><button type="button" class="button" data-event="cancel">Cancel</button><button type="submit" class="button primary">Activate selected content</button></div></form>';
   document.body.append(dialog);
+  const repositoryPrefetch = prefetchRepositoryForReview(dialog.querySelector(".save-status"));
   const close = () => dialog.close();
   dialog.querySelector(".icon-button").addEventListener("click", close);
   dialog.querySelector('[data-event="cancel"]').addEventListener("click", close);
@@ -674,6 +677,8 @@ function openDocumentActivationDialog(auditId = null) {
     }
     setMutationBusy(dialog, true, "Activating…", "Activate selected content");
     try {
+      const prefetch = await repositoryPrefetch;
+      if (prefetch?.error) throw prefetch.error;
       const response = await localFetch(auditId ? "/api/document-activations" : "/api/governed-content-activations", {
         method: "POST",
         headers: { "content-type": "application/json" },
@@ -683,6 +688,7 @@ function openDocumentActivationDialog(auditId = null) {
           activatedByIds: [event.currentTarget.elements.activatedById.value],
           activatedOn: event.currentTarget.elements.activatedOn.value,
           effectiveOn: event.currentTarget.elements.effectiveOn.value,
+          prefetchToken: prefetch?.token,
           expectedRevisions: Object.fromEntries(resourceIds.map((resourceId) => [resourceId, entryById.get(resourceId).revision]))
         })
       });
@@ -759,6 +765,7 @@ function openPolicyActivationDialog() {
     '<label><span>Effective date</span><input name="effectiveOn" type="date" min="' + esc(today) + '" value="' + esc(today) + '" required></label>' +
     '<div class="dialog-error" role="alert"></div><div class="dialog-actions"><span class="save-status" role="status" aria-live="polite"></span><button type="button" class="button" data-event="cancel">Cancel</button><button id="activate-policy" type="submit" class="button primary">Activate selected Policies</button></div></form>';
   document.body.append(dialog);
+  const repositoryPrefetch = prefetchRepositoryForReview(dialog.querySelector(".save-status"));
   const close = () => dialog.close();
   dialog.querySelector(".icon-button").addEventListener("click", close);
   dialog.querySelector('[data-event="cancel"]').addEventListener("click", close);
@@ -773,12 +780,15 @@ function openPolicyActivationDialog() {
     }
     setMutationBusy(dialog, true, "Activating…", "Activate selected Policies");
     try {
+      const prefetch = await repositoryPrefetch;
+      if (prefetch?.error) throw prefetch.error;
       const response = await localFetch("/api/policy-activations", {
         method: "POST",
         headers: { "content-type": "application/json" },
         body: JSON.stringify({
           policyIds,
           effectiveOn: event.currentTarget.elements.effectiveOn.value,
+          prefetchToken: prefetch?.token,
           expectedRevisions: Object.fromEntries(policyIds.map((policyId) => [policyId, entryById.get(policyId).revision]))
         })
       });
@@ -2686,10 +2696,11 @@ function renderDetail(main, type, id, params = new URLSearchParams()) {
   const definition = state.model.resources[type];
   if (!entry || !definition) return renderNotFound(main);
   if (entry.detailsLoaded === false) {
-    main.innerHTML = '<div class="page"><div class="detail-head"><div><div class="breadcrumbs header-breadcrumbs"><a href="#/resources/' + encodeURIComponent(type) + '">' + esc(titleCase(definition.pluralTitle)) + '</a><span>/</span><span>' + esc(entry.record.title) + '</span></div><h2>' + esc(titleCase(entry.record.title)) + '</h2></div></div><section class="panel detail-loading" role="status">Loading record content and file history…</section></div>';
+    main.innerHTML = '<div class="page"><div class="detail-head"><div><div class="breadcrumbs header-breadcrumbs"><a href="#/resources/' + encodeURIComponent(type) + '">' + esc(titleCase(definition.pluralTitle)) + '</a><span>/</span><span>' + esc(entry.record.title) + '</span></div><h2>' + esc(titleCase(entry.record.title)) + '</h2></div></div><section class="panel detail-loading" role="status">Loading record…</section></div>';
     loadResourceDetail(type, id);
     return;
   }
+  if (entry.historyLoaded === false) loadResourceHistory(type, id);
   const fields = { ...state.model.commonFields, ...definition.fields };
   const recordContent = recordContentDefinition(type);
   const narrative = recordNarrative(entry.record, fields);
@@ -2756,13 +2767,16 @@ function renderDetail(main, type, id, params = new URLSearchParams()) {
   const historyPanel = entry.history?.length
     ? '<section class="panel detail-history-panel"><div class="panel-head"><h3>File History</h3></div><div class="history">' + entry.history.map((commit) => '<div><code>' + esc(commit.shortCommit) + '</code><span><strong>' + esc(commit.subject) + '</strong><small>' + esc(commit.author) + ' · ' + esc(formatLocalDateTime(commit.timestamp)) + '</small></span></div>').join("") + '</div></section>'
     : "";
+  const participationPanel = entry.historyLoaded === false
+    ? '<section class="panel detail-support-panel" role="status"><div class="panel-head"><h3>Participation</h3></div><p class="muted">Loading participation and file history…</p></section>'
+    : personParticipation(entry);
   const supportPanels = renderDetailSupport({
     hasRecordBody,
     workflowPanel: workflowGuidance({ type, id, title: "Next steps" }),
     reviewPanel: resourceReviewCriteria(type),
     metadataPanel: '<section class="panel detail-support-panel detail-metadata-panel"><div class="panel-head"><h3>Record details</h3></div><dl class="metadata">' + sourceMetadata + visible.map(([name, value]) => '<div><dt>' + esc(fields[name]?.label || humanize(name)) + '</dt><dd>' + formatValue(name === "status" ? displayStatus(entry.record) : value, name, type) + '</dd></div>').join("") + '</dl></section>',
     attachmentPanel,
-    participationPanel: personParticipation(entry),
+    participationPanel,
     connectionsPanel: resourceConnections(entry),
     historyPanel
   });
@@ -2879,6 +2893,7 @@ function renderDetail(main, type, id, params = new URLSearchParams()) {
   main.querySelector("#add-record-content")?.addEventListener("click", () => openEditor(type, entry, { addRecordContent: true }));
   main.querySelectorAll("[data-edit-content]").forEach((button) => button.addEventListener("click", () => openContentEditor(entry, button.dataset.editContent)));
   main.querySelector("#delete-resource")?.addEventListener("click", async () => {
+    const repositoryPrefetch = prefetchRepositoryForReview();
     if (!await confirmAction({
       kicker: "Delete record",
       title: entry.record.title,
@@ -2887,7 +2902,9 @@ function renderDetail(main, type, id, params = new URLSearchParams()) {
       danger: true
     })) return;
     try {
-      const response = await localFetch("/api/resource/" + encodeURIComponent(type) + "/" + encodeURIComponent(id) + "?revision=" + encodeURIComponent(entry.revision), { method: "DELETE" });
+      const prefetch = await repositoryPrefetch;
+      if (prefetch?.error) throw prefetch.error;
+      const response = await localFetch("/api/resource/" + encodeURIComponent(type) + "/" + encodeURIComponent(id) + "?revision=" + encodeURIComponent(entry.revision) + (prefetch?.token ? "&prefetchToken=" + encodeURIComponent(prefetch.token) : ""), { method: "DELETE" });
       if (!response.ok) return showError(await responseMessage(response));
       applyMutationState(await response.json());
       location.hash = "#/resources/" + encodeURIComponent(type);
@@ -2937,7 +2954,7 @@ async function loadResourceDetail(type, id) {
       let token = state.stateToken;
       let detail = null;
       for (let attempt = 0; attempt < 3; attempt += 1) {
-        const tokenQuery = token ? "?token=" + encodeURIComponent(token) : "";
+        const tokenQuery = token ? "?token=" + encodeURIComponent(token) + "&history=false" : "?history=false";
         const response = await localFetch("/api/resource/" + encodeURIComponent(type) + "/" + encodeURIComponent(id) + tokenQuery);
         if (response.status === 409 && token) {
           await refreshExpiredAppState(token);
@@ -2975,6 +2992,44 @@ async function loadResourceDetail(type, id) {
   return request;
 }
 
+async function loadResourceHistory(type, id) {
+  const key = (state.stateToken || "live") + "\0history\0" + type + "\0" + id;
+  if (resourceDetailRequests.has(key)) return resourceDetailRequests.get(key);
+  const request = (async () => {
+    try {
+      const token = state.stateToken;
+      const tokenQuery = (token ? "?token=" + encodeURIComponent(token) + "&" : "?") + "history=only";
+      const response = await localFetch("/api/resource/" + encodeURIComponent(type) + "/" + encodeURIComponent(id) + tokenQuery);
+      if (response.status === 409 && token) {
+        await refreshExpiredAppState(token);
+        const route = parseRoute();
+        if (route.name === "detail" && route.type === type && route.id === id) {
+          render();
+          loadStateForRoute();
+        }
+        return;
+      }
+      if (!response.ok) throw new Error(await responseMessage(response));
+      const history = await response.json();
+      if (token && (history.stateToken !== token || state.stateToken !== token)) return;
+      const entry = state.resources.find(({ record }) => record.type === type && record.id === id);
+      if (!entry) return;
+      entry.history = history.history || [];
+      entry.historyLoaded = true;
+      const route = parseRoute();
+      if (route.name === "detail" && route.type === type && route.id === id) render();
+    } catch {
+      // History and participation are supplemental. The record stays usable.
+    } finally {
+      for (const [requestKey, pending] of resourceDetailRequests) {
+        if (pending === request) resourceDetailRequests.delete(requestKey);
+      }
+    }
+  })();
+  resourceDetailRequests.set(key, request);
+  return request;
+}
+
 function refreshExpiredAppState(expectedToken) {
   if (expiredStateRefresh) {
     if (expiredStateRefresh.token === expectedToken) return expiredStateRefresh.promise;
@@ -4182,6 +4237,14 @@ function openEditor(type, entry = null, options = {}) {
     '<details class="advanced-editor"><summary>Advanced JSON</summary><p>Use this for optional fields, extensions, or bulk edits. Changes here replace the guided fields above.</p><textarea spellcheck="false" aria-label="Advanced resource JSON">' + esc(JSON.stringify(record, null, 2)) + '</textarea></details><div class="dialog-error" role="alert"></div><div class="save-status" role="status" aria-live="polite"></div><div class="dialog-actions"><button type="button" class="button" data-editor-dismiss>Cancel</button><button type="submit" class="button primary" id="save-record">' + esc(options.saveLabel || "Save file") + '</button></div></form>';
   document.body.append(dialog);
   dialog.showModal();
+  const saveStatus = dialog.querySelector(".save-status");
+  const fastResourceSave = !options.occurrenceReconciliation
+    && !options.auditPopulationCorrection
+    && !options.actionCompletion
+    && !options.obligationCompletion;
+  const repositoryPrefetch = fastResourceSave
+    ? prefetchRepositoryForReview(saveStatus)
+    : Promise.resolve(null);
   dialog.addEventListener("close", () => dialog.remove());
   dialog.querySelectorAll("[data-editor-dismiss]").forEach((button) => button.addEventListener("click", () => dialog.close()));
   wireEditorRequirements(dialog, record, fields, oneOfGroups, markdownDefinitions);
@@ -4254,9 +4317,14 @@ function openEditor(type, entry = null, options = {}) {
         [recordContentItem?.path, recordContentItem?.revision]
       ].filter(([path, revision]) => path && revision));
       setMutationBusy(dialog, true, "Saving…", options.saveLabel || "Save file");
+      const prefetch = await repositoryPrefetch;
+      if (prefetch?.error) throw prefetch.error;
       const response = await localFetch(url, {
         method: options.occurrenceReconciliation ? "POST" : entry ? "PUT" : "POST",
-        headers: { "content-type": "application/json" },
+        headers: {
+          "content-type": "application/json",
+          ...(fastResourceSave ? { prefer: "respond-async" } : {})
+        },
         body: JSON.stringify({
           record: updated,
           content,
@@ -4264,7 +4332,8 @@ function openEditor(type, entry = null, options = {}) {
           contentRevisions,
           obligationId: options.obligationCompletion?.obligationId,
           actionItemId: options.actionCompletion?.actionItemId,
-          completedOn: options.actionCompletion?.completedOn
+          completedOn: options.actionCompletion?.completedOn,
+          prefetchToken: prefetch?.token
         })
       });
       if (!response.ok) throw new Error(await responseMessage(response));
@@ -5025,12 +5094,15 @@ function openContentEditor(entry, name) {
   dialog.innerHTML = '<form method="dialog"><div class="dialog-head"><div><p class="kicker">Edit Markdown</p><h2 id="content-editor-title">' + esc(titleCase(entry.record.title)) + '</h2></div><button value="cancel" class="icon-button" aria-label="Close">×</button></div><p><code>' + esc(item.path) + '</code></p><textarea class="markdown-source" spellcheck="true" aria-label="Markdown content">' + esc(item.source) + '</textarea><div class="dialog-error" role="alert"></div><div class="save-status" role="status" aria-live="polite"></div><div class="dialog-actions"><button value="cancel" class="button">Cancel</button><button type="button" class="button primary" id="save-content">Save Markdown</button></div></form>';
   document.body.append(dialog);
   dialog.showModal();
+  const repositoryPrefetch = prefetchRepositoryForReview(dialog.querySelector(".save-status"));
   dialog.addEventListener("close", () => dialog.remove());
   dialog.querySelector("#save-content").addEventListener("click", async () => {
     if (dialog.dataset.mutationBusy === "true") return;
     try {
       setMutationBusy(dialog, true, "Saving…", "Save Markdown");
-      const response = await localFetch("/api/content", { method: "PUT", headers: { "content-type": "application/json" }, body: JSON.stringify({ path: item.path, source: dialog.querySelector(".markdown-source").value, revision: item.revision }) });
+      const prefetch = await repositoryPrefetch;
+      if (prefetch?.error) throw prefetch.error;
+      const response = await localFetch("/api/content", { method: "PUT", headers: { "content-type": "application/json" }, body: JSON.stringify({ path: item.path, source: dialog.querySelector(".markdown-source").value, revision: item.revision, prefetchToken: prefetch?.token }) });
       if (!response.ok) throw new Error(await responseMessage(response));
       applyMutationState(await response.json());
       dialog.close();
@@ -5503,7 +5575,16 @@ function applyMutationState(result) {
     state = normalizeAppState(result.state);
   } else if (result?.stateRefresh) {
     applyFastMutationPatch(result);
+    state.refreshingAfterMutation = true;
+    state.readOnly = true;
+    state.resources = state.resources.map((entry) => ({
+      ...entry,
+      content: {},
+      history: undefined,
+      detailsLoaded: false
+    }));
     scheduleMutationStateRefresh();
+    render();
   } else {
     throw new Error("The save response did not include the current workspace state.");
   }
@@ -5512,6 +5593,19 @@ function applyMutationState(result) {
 
 function applyFastMutationPatch(result) {
   state.stateToken = null;
+  if (result.deleted && result.type && result.id) {
+    state.resources = state.resources.filter(({ record }) => record.type !== result.type || record.id !== result.id);
+  }
+  if (result.dataRelativePath && typeof result.source === "string") {
+    for (const entry of state.resources) {
+      for (const item of Object.values(entry.content || {})) {
+        if (item.path !== result.dataRelativePath) continue;
+        item.source = result.source;
+        item.revision = result.revision;
+        if (typeof result.html === "string") item.html = result.html;
+      }
+    }
+  }
   if (result.operation === "collection-review" && result.assessment?.resourceType) {
     state.collectionReviews[result.assessment.resourceType] = result.assessment;
   }
@@ -5524,7 +5618,24 @@ function applyFastMutationPatch(result) {
       state.resources.push({ record, content: {}, history: [], detailsLoaded: false });
     }
   }
-  for (const record of [result.workspace, result.program, result.system, result.renderer, result.commitment].filter(Boolean)) {
+  const immediateRecords = [
+    result.record,
+    result.workspace,
+    result.program,
+    result.system,
+    result.renderer,
+    result.commitment,
+    result.audit,
+    result.event,
+    result.created,
+    result.linked,
+    result.dismissal,
+    result.result?.record,
+    result.result?.created,
+    result.result?.linked,
+    ...(result.actions || [])
+  ].filter((record) => record?.id && record?.type);
+  for (const record of immediateRecords) {
     const entry = state.resources.find(({ record: current }) => current.id === record.id);
     if (entry) entry.record = record;
     else state.resources.push({ record, content: {}, history: [], detailsLoaded: false });
@@ -5544,6 +5655,7 @@ function applyFastMutationPatch(result) {
 }
 
 function scheduleMutationStateRefresh(delay = 0) {
+  mutationStateRefreshRequested = true;
   if (mutationStateRefreshTimer || mutationStateRefreshInFlight) return;
   mutationStateRefreshTimer = setTimeout(refreshMutationState, delay);
 }
@@ -5552,6 +5664,7 @@ async function refreshMutationState() {
   mutationStateRefreshTimer = null;
   if (mutationStateRefreshInFlight) return;
   mutationStateRefreshInFlight = true;
+  mutationStateRefreshRequested = false;
   let retry = false;
   try {
     const programQuery = state.selectedProgramId ? "?programId=" + encodeURIComponent(state.selectedProgramId) : "";
@@ -5567,24 +5680,24 @@ async function refreshMutationState() {
   } finally {
     mutationStateRefreshInFlight = false;
   }
-  if (retry) scheduleMutationStateRefresh(1_000);
+  if (retry || mutationStateRefreshRequested) scheduleMutationStateRefresh(retry ? 1_000 : 0);
 }
 
-function prefetchRepositoryForReview(status) {
+function prefetchRepositoryForReview(status = null) {
   if (state.repository?.mode !== "trunk" || state.repository?.developmentOverride) {
     return Promise.resolve(null);
   }
-  status.textContent = "Checking repository…";
+  if (status) status.textContent = "Checking repository…";
   return fetch("/api/git/prefetch", { method: "POST" })
     .then(async (response) => {
       if (!response.ok) throw new Error(await responseMessage(response));
       const result = await response.json();
-      status.textContent = result.status === "checked" ? "Repository checked" : "Ready to save";
+      if (status) status.textContent = result.status === "checked" ? "Repository checked" : "Ready to save";
       return result;
     })
     .catch((error) => {
-      status.textContent = "Repository check failed";
-      return { error };
+      if (status) status.textContent = "Repository check failed";
+      return null;
     });
 }
 
@@ -5697,15 +5810,25 @@ async function localFetch(url, options) {
   }
   const scopedUrl = requestUrl.pathname + requestUrl.search + requestUrl.hash;
   const method = String(options?.method || "GET").toUpperCase();
+  const mutation = ["POST", "PUT", "DELETE"].includes(method);
+  const requestOptions = mutation
+    ? {
+        ...options,
+        headers: {
+          ...Object.fromEntries(new Headers(options?.headers || {}).entries()),
+          prefer: "respond-async"
+        }
+      }
+    : options;
   const synchronizing = state?.repository?.mode === "trunk"
-    && ["POST", "PUT", "DELETE"].includes(method)
+    && mutation
     && !["/api/evidence-packet", "/api/git/prefetch"].includes(requestUrl.pathname);
   const chip = synchronizing ? document.querySelector(".repo-chip") : null;
   const previousChip = chip?.innerHTML;
   let repositoryRefreshed = false;
   if (chip) chip.innerHTML = '<span class="status-dot neutral"></span>Syncing';
   try {
-    const response = await fetch(scopedUrl, options);
+    const response = await fetch(scopedUrl, requestOptions);
     if (synchronizing && !response.ok) {
       try {
         const stateResponse = await fetch("/api/state?programId=" + encodeURIComponent(state.selectedProgramId || ""));