foldkit-remote 0.12.0 → 0.14.0

package/dist/{src-9NIJGDTJ.mjs → src-CcPPtNuH.mjs}

@@ -1,12 +1,13 @@
-import { Context, Deferred, Duration, Effect, Layer, Option, Request, RequestResolver, Result, Schema, SchemaAST, SchemaGetter, Stream } from "effect";
+import { Context, Data, Deferred, Duration, Effect, Layer, Match, Option, Predicate, Record, Request, RequestResolver, Result, Schema, SchemaAST, SchemaGetter, Stream } from "effect";
+import { KeyValueStore } from "effect/persistence";
 import * as Domain from "foldkit-entity";
-import { Entity, Expr, Query, SchemaShape, SelectionTypeId, evaluate } from "foldkit-entity";
+import { Entity, Expr, Query, QueryEvaluateError, ReadFilter, SchemaShape, SelectionTypeId, Write, compareRows, dependenciesOf, evaluate } from "foldkit-entity";
 import { mapMessage } from "foldkit/command";
 import { defineMessageUnion } from "foldkit/message";
 import * as Subscription from "foldkit/subscription";
 import { Metadata } from "foldkit-surface";
 import { Rpc, RpcGroup } from "effect/rpc";
-import { KeyValueStore } from "effect/persistence";
+import { defineTaggedUnion } from "foldkit/schema";
 //#region src/requirement.ts
 /**
 * What a Remote Projection needs from the server: entity slices and query
@@ -485,18 +486,89 @@ const reconcileMutation = (store, state, requestId, answer) => {
 		}
 	};
 };
+const conflict = Schema.TaggedStruct("Conflict", {});
+const anyField = Schema.TaggedStruct("Field", {
+	key: Schema.String,
+	reason: Schema.Unknown
+});
+/** Refusals a form or an editor knows how to show. */
+const Refusal = {
+	/** One input key was refused, for `reason`, which a form shows beside that key. */
+	field: (key, reason) => Schema.TaggedStruct("Field", {
+		key: Schema.Literal(key),
+		reason
+	}),
+	/** The row moved on since the client read it; the author decides what wins. */
+	conflict,
+	/** Whether a refusal, of whatever mutation, is a `Refusal.field`. */
+	isField: Schema.is(anyField),
+	/** Whether a refusal, of whatever mutation, is `Refusal.conflict`. */
+	isConflict: Schema.is(conflict)
+};
 /** The codec itself, or a `Schema.Struct` over the fields. */
 const schemaOf = (shape) => Schema.isSchema(shape) ? shape : Schema.Struct(shape);
-const Mutation = { 
 /**
-* Declares a mutation. `Input` and `Output` are codecs, or the fields of the
-* `Schema.Struct` they would be (`{ id: ProjectId, name: Schema.String }`).
+* A bound write as the store patches it: its fields as they are, and each
+* relation it points as the ref key the store holds (`'User:u1'`), or null.
+*/
+const patchOfWrite = (bound) => ({
+	entity: bound.entity,
+	id: bound.id,
+	values: {
+		...bound.values,
+		...Record.map(bound.links, (link) => Option.match(link, {
+			onNone: () => null,
+			onSome: (ref) => entityKey(ref.entity, ref.id)
+		}))
+	}
+});
+/**
+* What a declared write shows before the server answers: an update's or an
+* insert's row as a patch (an update's only for the keys named, when some
+* are). A delete shows nothing, since no operation removes a row from every
+* list it is in; its answer does.
 */
-make: (name, config) => ({
-	name,
-	Input: schemaOf(config.Input),
-	Output: schemaOf(config.Output)
-}) };
+const optimisticOfWrite = (write, input, keys) => Match.value(write).pipe(Match.tagsExhaustive({
+	Update: () => [patchOfWrite(Write.bind(write, input, keys))],
+	Insert: () => {
+		const patch = patchOfWrite(Write.bind(write, input));
+		return [{
+			...patch,
+			values: {
+				id: patch.id,
+				...patch.values
+			}
+		}];
+	},
+	Delete: () => []
+}));
+const Mutation = {
+	/**
+	* Declares a mutation. `Input` and `Output` are codecs, or the fields of the
+	* `Schema.Struct` they would be (`{ id: ProjectId, name: Schema.String }`).
+	* `Refusal`, when given, is what the server may refuse with: a codec, usually
+	* a union of `Refusal.field(...)` and `Refusal.conflict`.
+	*/
+	/**
+	* A mutation that is a declared `Write` (`update`, `insert` or `delete`): its
+	* input is the write's, and it answers nothing but the row it changed, as a
+	* patch, or its deletion. It may be refused as a conflict, for a write that
+	* `expect`s a revision the row has moved past.
+	*/
+	write: (name, write) => ({
+		name,
+		Input: write.input.schema,
+		Output: Schema.Struct({}),
+		Refusal: Refusal.conflict,
+		write
+	}),
+	make: (name, config) => ({
+		name,
+		Input: schemaOf(config.Input),
+		Output: schemaOf(config.Output),
+		Refusal: config.Refusal ?? Schema.Never
+	})
+};
 //#endregion
 //#region src/query.ts
 /**
@@ -654,7 +726,20 @@ const Query$1 = {
 */
 const REMOTE_PROTOCOL_VERSION = 4;
 var RemoteReadError = class extends Schema.TaggedError()("RemoteReadError", { message: Schema.String }) {};
-var RemoteMutationError = class extends Schema.TaggedError()("RemoteMutationError", { message: Schema.String }) {};
+var RemoteMutationError = class extends Schema.TaggedError()("RemoteMutationError", {
+	message: Schema.String,
+	/** The mutation's own `Refusal`, encoded, when the server refused it as one. */
+	refusal: Schema.optional(Schema.Unknown)
+}) {};
+/**
+* The server refused who is asking: they may not do this, and asking again
+* as the same principal is refused again. `reason` is the application's own
+* words for the person who asked; without it the refusal says nothing of why.
+*/
+var RemoteForbidden = class extends Schema.TaggedError()("Forbidden", {
+	message: Schema.String,
+	reason: Schema.optional(Schema.String)
+}) {};
 var RemoteLiveError = class extends Schema.TaggedError()("RemoteLiveError", { message: Schema.String }) {};
 /** The peer speaks another protocol version; nothing was read. */
 var RemoteProtocolError = class extends Schema.TaggedError()("RemoteProtocolError", {
@@ -731,7 +816,9 @@ const MutationRequest = Schema.Struct({
 	/** Stable across transport retries so a mutation is not applied twice. */
 	requestId: Schema.String,
 	mutation: Schema.String,
-	input: Schema.Unknown
+	input: Schema.Unknown,
+	/** For a mutation that is a `Write`: the input keys to write, when not all of them. */
+	keys: Schema.optional(Schema.Array(Schema.String))
 });
 const LiveEdge = Schema.Struct({
 	entity: Schema.String,
@@ -812,7 +899,7 @@ const Read = Rpc.make("FoldkitRemoteRead", {
 const Mutate = Rpc.make("FoldkitRemoteMutate", {
 	payload: MutationRequest,
 	success: MutationResult,
-	error: RemoteMutationError
+	error: Schema.Union([RemoteMutationError, RemoteForbidden])
 });
 const Live = Rpc.make("FoldkitRemoteLive", {
 	payload: LiveRequirement,
@@ -1074,7 +1161,9 @@ const liveEventOf = (change) => {
 };
 const remoteError = (error) => ({
 	_tag: error._tag,
-	message: error.message
+	message: error.message,
+	...error.refusal === void 0 ? {} : { refusal: error.refusal },
+	...error.reason === void 0 ? {} : { reason: error.reason }
 });
 const coalescedLayer = (layer, options = {}) => Layer.effect(RemoteClient, Effect.gen(function* () {
 	const client = yield* RemoteClient;
@@ -1090,7 +1179,7 @@ const coalescedLayer = (layer, options = {}) => Layer.effect(RemoteClient, Effec
 * `Remote.mutate` as a standalone effect, so `Remote.mutateInto` can reuse it
 * without the object literal referencing itself.
 */
-const mutateRemote = Effect.fn("Remote.mutate")(function* (mutation, input, requestId) {
+const mutateRemote = Effect.fn("Remote.mutate")(function* (mutation, input, requestId, keys) {
 	yield* Effect.annotateCurrentSpan({
 		mutation: mutation.name,
 		requestId
@@ -1100,7 +1189,8 @@ const mutateRemote = Effect.fn("Remote.mutate")(function* (mutation, input, requ
 	const result = yield* client.mutate({
 		requestId,
 		mutation: mutation.name,
-		input: encoded
+		input: encoded,
+		...keys === void 0 ? {} : { keys }
 	});
 	return {
 		output: yield* Schema.decodeUnknownEffect(mutation.Output)(result.output).pipe(Effect.catchTag("SchemaError", (error) => Effect.fail(new RemoteMutationError({ message: error.message })))),
@@ -1546,6 +1636,116 @@ const Entity$1 = {
 	})
 };
 //#endregion
+//#region src/placement.ts
+/**
+* Where one row falls in a loaded list, by the list's own declared order:
+* the decidable half of placing a row instead of fetching the list again.
+*
+* A list is segments of edges between boundaries, and only a `Terminal`
+* boundary says nothing lies beyond it. So a row is placed between two loaded
+* edges, or before a segment's first edge when that segment starts the list,
+* or at its end when it ends it; a row that sorts past a `Cursor` or into a
+* gap belongs to rows the client has not read, and is `Outside`. Anything the
+* client cannot judge exactly (a body it cannot place, a field a row lacks,
+* keys it cannot compare) is `Unknown`, with why, never a guess.
+*
+* Pure: it reads the store and the list it is given.
+*/
+const RowPlace = Data.taggedEnum();
+/**
+* The values a row holds of the fields an order reads, or none when it lacks
+* one. An `id` no Selection stored is its key's, when the id is stored as
+* text as a key holds it, so the id tie-break every order ends on does not
+* make such a row unplaceable; a number id is never compared as text.
+*/
+const keysOf = (store, key, id, idIsText, terms) => {
+	const values = Object.create(null);
+	for (const term of terms) {
+		if (term.expr._tag !== "Field") return Option.none();
+		const field = term.expr.key;
+		const stored = readField(store, key, field);
+		const value = field === "id" && Option.isNone(stored) && idIsText ? id : stored;
+		if (Option.isNone(value)) return Option.none();
+		values[field] = value.value;
+	}
+	return Option.some(values);
+};
+/**
+* Where the row stored under `key` falls in `connection`, by `body`'s order
+* for `input` (encoded, as a connection's identity carries it). The row's own
+* edge, if the list holds it, is left out: placing a row that moved asks
+* where it goes now.
+*/
+const placeIn = (store, connection, body, input, key) => {
+	const placement = Query.placement(body, input);
+	if (placement._tag === "NotPlaceable") return RowPlace.Unknown({ reason: placement.reason });
+	const terms = Query.orderFor(body, input);
+	const prefix = `${body.entity.name}:`;
+	const id = key.startsWith(prefix) ? Option.some(key.slice(prefix.length)) : Option.none();
+	const idField = body.entity.fields.id;
+	const idIsText = idField !== void 0 && SchemaAST.isString(Schema.toEncoded(idField.schema).ast);
+	const row = keysOf(store, key, id, idIsText, terms);
+	if (Option.isNone(row)) return RowPlace.Unknown({ reason: `${key} lacks a field the order reads` });
+	/** Negative when the row sorts before the edge; none when the edge cannot be compared. */
+	const against = (edge) => Option.flatMap(keysOf(store, entityKey(edge.ref.entity, edge.ref.id), Option.some(edge.ref.id), idIsText, terms), (values) => {
+		try {
+			return Option.some(compareRows(terms, row.value, values, body.entity.name));
+		} catch {
+			return Option.none();
+		}
+	});
+	const boundary = RowPlace.Unknown({ reason: `${key} was where its page met rows not loaded` });
+	const { segments } = connection;
+	for (let index = 0; index < segments.length; index++) {
+		const segment = segments[index];
+		const held = segment.edges.findIndex((edge) => edge.key === key);
+		const edges = segment.edges.filter((edge) => edge.key !== key);
+		for (let position = 0; position < edges.length; position++) {
+			const edge = edges[position];
+			const sign = against(edge);
+			if (Option.isNone(sign)) return RowPlace.Unknown({ reason: `${edge.key} lacks a field the order reads` });
+			if (sign.value < 0) {
+				const before = RowPlace.Before({
+					segment: index,
+					edge: edge.key
+				});
+				if (position > 0) return before;
+				return Match.value(segment.start).pipe(Match.tag("Terminal", () => before), Match.orElse(() => held === 0 ? boundary : RowPlace.Outside()));
+			}
+		}
+		if (Match.value(segment.end).pipe(Match.tag("Terminal", () => true), Match.orElse(() => false))) return RowPlace.End({ segment: index });
+		if (held >= 0 && held === segment.edges.length - 1) return boundary;
+	}
+	return RowPlace.Outside();
+};
+/** The connection without the edge of `key`, or the connection itself when it holds none. */
+const withoutEdge = (connection, key) => connection.segments.some((segment) => segment.edges.some((edge) => edge.key === key)) ? {
+	...connection,
+	segments: connection.segments.map((segment) => ({
+		...segment,
+		edges: segment.edges.filter((edge) => edge.key !== key)
+	}))
+} : connection;
+/** The connection with `edge` where `place` says: before an edge, or at a segment's end. */
+const withEdge = (connection, added, place) => ({
+	...connection,
+	segments: connection.segments.map((segment, index) => {
+		if (index !== place.segment) return segment;
+		const at = Match.value(place).pipe(Match.tagsExhaustive({
+			Before: ({ edge }) => segment.edges.findIndex((held) => held.key === edge),
+			End: () => segment.edges.length
+		}));
+		return {
+			...segment,
+			edges: [
+				...segment.edges.slice(0, at),
+				added,
+				...segment.edges.slice(at)
+			]
+		};
+	})
+});
+//#endregion
 //#region src/matching.ts
 /**
 * Running a query body against the rows the client already holds.
@@ -1652,12 +1852,132 @@ const belongsEncoded = (store, descriptor, encoded, key) => {
 	if (entry.tombstone) return "no";
 	const body = descriptor.body;
 	if (body !== void 0 && decidableOn(body).some((field) => entry.stale.has(field))) return "unknown";
-	const judged = matchingEncoded(store, descriptor, encoded, { among: [key] });
+	let judged;
+	try {
+		judged = matchingEncoded(store, descriptor, encoded, { among: [key] });
+	} catch (error) {
+		if (error instanceof QueryEvaluateError) return "unknown";
+		throw error;
+	}
 	if (judged.matched.includes(key)) return "yes";
 	if (judged.skipped.includes(key)) return "unknown";
 	return "no";
 };
 //#endregion
+//#region src/impact.ts
+/**
+* What a write did to the lists the client holds: given one change and one
+* loaded connection, whether the connection is still right as it stands.
+*
+* Pure, and asked once per connection a write could touch. The answer is never
+* a guess: a connection kept must be provably unchanged in which rows it holds
+* and in what order, a connection placed is the client's exact deduction of
+* what the server now lists, and everything else is invalidated, with the
+* reason, for the read entry to fetch again.
+*
+* Membership is judged by the query's body, as a live insert is
+* (`belongsEncoded`), and position by its declared order (`placeIn`), when
+* the order is placeable. A body that names no order leaves it to the server,
+* by fields the client cannot see, so any change to a row it holds
+* invalidates it.
+*/
+/**
+* One row a write changed: the fields it wrote, and whether the client held
+* no values of the row before (`created`), or its deletion.
+*/
+const EntityChange = defineTaggedUnion({
+	Changed: {
+		entity: Schema.String,
+		id: Schema.String,
+		fields: Schema.Array(Schema.String),
+		created: Schema.Boolean
+	},
+	Deleted: {
+		entity: Schema.String,
+		id: Schema.String
+	}
+});
+/**
+* What a mutation's answer changed, against `before`, the store as the server
+* last said it: each patch's fields whose value is new, and each deletion. An
+* answer returns more than it changed (a whole row, say), and counting an
+* unchanged ordering field would refetch every list on every save.
+*/
+const changesOf = (answer, before) => [...answer.entities.flatMap((patch) => {
+	const held = before[entityKey(patch.entity, patch.id)]?.values;
+	const fields = Object.keys(patch.values).filter((field) => held === void 0 || !Object.hasOwn(held, field) || !sameData(held[field], patch.values[field]));
+	return fields.length === 0 ? [] : [EntityChange.Changed({
+		entity: patch.entity,
+		id: patch.id,
+		fields,
+		created: held === void 0
+	})];
+}), ...(answer.deleted ?? []).map((gone) => EntityChange.Deleted({
+	entity: gone.entity,
+	id: gone.id
+}))];
+const Impact = Data.taggedEnum();
+const kept = Impact.Kept();
+/** Whether two versions of a list hold the same rows in the same order, segment by segment. */
+const sameOrder = (left, right) => left.segments.length === right.segments.length && left.segments.every((segment, index) => {
+	const other = right.segments[index].edges;
+	return segment.edges.length === other.length && segment.edges.every((edge, position) => edge.key === other[position].key);
+});
+/**
+* What `change` does to `connection`, judged against `store`, the store after
+* the write.
+*/
+const impactOn = (connection, store, change) => {
+	const { descriptor } = connection;
+	const body = descriptor.body;
+	if ((body?.entity.name ?? descriptor.Result.entity) !== change.entity) return kept;
+	return EntityChange.match(change, {
+		Deleted: () => kept,
+		Changed: ({ fields, created }) => {
+			if (body === void 0) return Impact.Invalidated({ reason: `query "${descriptor.name}" declares no body, so what it reads is unknown` });
+			const key = entityKey(change.entity, change.id);
+			const held = connection.holds.has(key);
+			const ruled = fields.find((field) => connection.filtered.includes(field));
+			if (!held && ruled !== void 0) return Impact.Invalidated({ reason: `${key} changed "${ruled}", which the server's read rule for ${change.entity} filters on` });
+			const roles = Query.dependencies(body);
+			const touches = (keys) => keys.some((field) => fields.includes(field.key));
+			let order;
+			try {
+				order = Query.orderFor(body, connection.encoded);
+			} catch {
+				return Impact.Invalidated({ reason: `"${descriptor.name}" was read in an order its body does not offer` });
+			}
+			if (held && body.orderBy.length === 0) return Impact.Invalidated({ reason: `${key} changed, and "${descriptor.name}" is ordered by the server, by fields its body does not name` });
+			const pages = connection.connection;
+			const reorders = touches(dependenciesOf(...order).fields);
+			const refilters = touches(roles.predicate);
+			const unloaded = hasPrevious(pages) || hasNext(pages) || isGapped(pages);
+			if (!(held && reorders) && !refilters && !(!held && (created || reorders && unloaded))) return kept;
+			const belongs = held && !refilters ? "yes" : belongsEncoded(store, descriptor, connection.encoded, key);
+			if (belongs === "unknown") return Impact.Invalidated({ reason: `${key} changed a field "${descriptor.name}" filters on, and the client cannot judge it` });
+			if (!held && belongs === "no") return kept;
+			if (held && belongs === "yes" && !reorders) return kept;
+			const inPages = pages.segments.some((segment) => segment.edges.some((edge) => edge.key === key));
+			if (held && !inPages) return Impact.Invalidated({ reason: `${key} is shown in "${descriptor.name}" by an overlay, which a placement does not move` });
+			if (belongs === "no") return Impact.Placed({ connection: withoutEdge(pages, key) });
+			/** The row where `place` says; the list as it was when that is where it already stood. */
+			const placedAt = (place) => {
+				const next = withEdge(withoutEdge(pages, key), edge({
+					entity: change.entity,
+					id: change.id
+				}), place);
+				return sameOrder(pages, next) ? kept : Impact.Placed({ connection: next });
+			};
+			return RowPlace.$match(placeIn(store, pages, body, connection.encoded, key), {
+				Before: placedAt,
+				End: placedAt,
+				Outside: () => held ? Impact.Placed({ connection: withoutEdge(pages, key) }) : kept,
+				Unknown: ({ reason }) => Impact.Invalidated({ reason: `${key} ${held ? "moved in" : "joined"} "${descriptor.name}", and cannot be placed: ${reason}` })
+			});
+		}
+	});
+};
+//#endregion
 //#region src/inspect.ts
 const inspectEntry = (key, entry) => ({
 	key,
@@ -1674,6 +1994,7 @@ const inspectRemote = (model) => ({
 	connections: Object.keys(model.connections),
 	live: Object.keys(model.live),
 	gaps: [...model.gaps],
+	placementMismatches: model.placementMismatches,
 	loading: [...model.loading],
 	failures: model.failures,
 	mutations: {
@@ -2369,7 +2690,9 @@ const fresh = { _tag: "Fresh" };
 const refreshing = { _tag: "Refreshing" };
 const remoteErrorSchema = Schema.Struct({
 	_tag: Schema.String,
-	message: Schema.String
+	message: Schema.String,
+	refusal: Schema.optional(Schema.Unknown),
+	reason: Schema.optional(Schema.String)
 });
 /** A `RemoteData` schema, so a projection that reads remote state is typed. */
 const remoteDataSchemas = /* @__PURE__ */ new WeakMap();
@@ -2403,6 +2726,18 @@ const RemoteData = {
 	* be embedded in a hand-written Model schema, not only through `Remote.select`.
 	*/
 	schema: (value) => remoteDataSchema(value),
+	/**
+	* Whether the read has an answer: `Ready`, `Refreshing`, `Failed` or
+	* `NotFound`. `Initial` and `Loading` are still waiting for one.
+	*/
+	answered: (data) => RemoteData.match(data, {
+		Initial: () => false,
+		Loading: () => false,
+		Ready: () => true,
+		Refreshing: () => true,
+		Failed: () => true,
+		NotFound: () => true
+	}),
 	/** Exhaustive: omitting a state is a compile error. */
 	match: (data, cases) => {
 		switch (data._tag) {
@@ -2524,9 +2859,13 @@ const initialRemoteModel = {
 	live: {},
 	mutations: emptyMutationState,
 	gaps: /* @__PURE__ */ new Set(),
+	streams: {},
 	loading: /* @__PURE__ */ new Set(),
 	refresh: emptyRefresh,
-	failures: noFailures
+	failures: noFailures,
+	restoredFrom: Option.none(),
+	placed: {},
+	placementMismatches: []
 };
 /** The entity store and the mutation ledger are runtime values, not wire shapes. */
 const runtimeSchema = Schema.Unknown;
@@ -2538,12 +2877,16 @@ const remoteModelSchema = () => Schema.Struct({
 	live: Schema.Record(Schema.String, runtimeSchema),
 	mutations: runtimeSchema,
 	gaps: runtimeSchema,
+	streams: Schema.Record(Schema.String, runtimeSchema),
 	loading: runtimeSchema,
 	refresh: runtimeSchema,
 	failures: Schema.Struct({
 		connections: Schema.Record(Schema.String, remoteErrorSchema),
 		fields: Schema.Record(Schema.String, remoteErrorSchema)
-	})
+	}),
+	restoredFrom: runtimeSchema,
+	placed: runtimeSchema,
+	placementMismatches: runtimeSchema
 });
 const retentionRootsSchema = Schema.Struct({
 	requirements: Schema.Array(ReadRequest),
@@ -2576,6 +2919,7 @@ const remoteMessageCases = {
 	RetentionChanged: { roots: retentionRootsSchema },
 	Hydrated: {
 		connections: Schema.optional(Schema.Unknown),
+		from: Schema.optional(Schema.String),
 		entities: runtimeSchema,
 		merge: Schema.Union([Schema.Literal("replace"), Schema.Literal("preserve-existing")])
 	},
@@ -2639,7 +2983,10 @@ const remoteMessageSchema = Schema.Union(Object.entries(remoteMessageCases).map(
 	...fields
 })));
 /** An overlay's layer, named apart from every request's: a request id is the application's to choose too. */
-const overlayLayer = (id) => `overlay:${id}`;
+const OVERLAY = "overlay:";
+const overlayLayer = (id) => `${OVERLAY}${id}`;
+/** The ids `OverlayShown` shows now, each once, in the order they are drawn. */
+const overlaysOf = (model) => [...new Set([...model.optimistic.layers, ...model.optimistic.overlays].flatMap(({ id }) => id.startsWith(OVERLAY) ? [id.slice(8)] : []))];
 /** The key a grown window is kept under: its connection and the window first asked for. */
 const windowGrowthKey = (identity, window) => `${identity}\u0000${window}`;
 /**
@@ -2760,6 +3107,22 @@ const withRefreshRequested = (refresh, requests, connections = []) => {
 	};
 };
 /**
+* Marks connections as needing to be asked again, and restarts a read of them
+* already in flight: a page requested before what invalidated it could land
+* after it, saying what is no longer true. `Remote.refresh` marks the same way.
+*/
+const invalidateConnections = (model, connections) => {
+	if (connections.length === 0) return model;
+	const marked = connections.reduce((current, connection) => updateRemote(current, {
+		_tag: "ConnectionInvalidated",
+		connection
+	}), model);
+	return {
+		...marked,
+		refresh: withRefreshRequested(marked.refresh, [], connections)
+	};
+};
+/**
 * Records that a read of `requests` began under `generation`. A read that
 * carries no generation began under none, and leaves the marks as they are.
 */
@@ -2810,9 +3173,49 @@ const withLiveState = (live, stream, state) => live[stream] === state ? live : {
 	...live,
 	[stream]: state
 };
-const markGap = (model, stream) => model.gaps.has(stream) ? model : {
-	...model,
-	gaps: /* @__PURE__ */ new Set([...model.gaps, stream])
+const noHealth = {
+	restarts: 0,
+	failures: 0,
+	error: Option.none()
+};
+/**
+* A stream broke: it is marked a gap and its restart count moves, which
+* restarts its live entry. A stream already broken and not yet restarted
+* changes nothing, so the events a dying stream still delivers restart it once.
+*/
+const broke = (model, stream, error) => {
+	if (model.gaps.has(stream)) return model;
+	const health = model.streams[stream] ?? noHealth;
+	return {
+		...model,
+		gaps: /* @__PURE__ */ new Set([...model.gaps, stream]),
+		streams: {
+			...model.streams,
+			[stream]: {
+				restarts: health.restarts + 1,
+				failures: health.failures + 1,
+				error
+			}
+		}
+	};
+};
+/**
+* An event applied on a stream that resubscribed: it works, so its next break
+* backs off from the start. A broken stream's last events prove nothing.
+*/
+const healthy = (model, stream) => {
+	const health = model.streams[stream];
+	return health === void 0 || health.failures === 0 || model.gaps.has(stream) ? model : {
+		...model,
+		streams: {
+			...model.streams,
+			[stream]: {
+				...health,
+				failures: 0,
+				error: Option.none()
+			}
+		}
+	};
 };
 const clearGap = (model, stream) => model.gaps.has(stream) ? {
 	...model,
@@ -2820,8 +3223,8 @@ const clearGap = (model, stream) => model.gaps.has(stream) ? {
 } : model;
 /**
 * The pure reducer all four producers share. A live event that arrives ahead of
-* its cursor is a gap: it is not applied, and the stream is recorded so the host
-* can resubscribe rather than silently miss facts. When every field a Message
+* its cursor is a gap: it is not applied, and the stream is recorded so its
+* live entry restarts it rather than silently missing facts. When every field a Message
 * touches keeps its identity, `model` itself is returned, so the application's
 * root keeps its identity and Foldkit does not render. The common no-ops do (a
 * duplicate live event, a repeated `ReadStarted`); a repeated failure, or a
@@ -2837,6 +3240,32 @@ const sameFields = (model, next) => {
 	const keys = Object.keys(next);
 	return keys.length === Object.keys(model).length && keys.every((key) => Object.is(model[key], next[key]));
 };
+/**
+* A placement compared with the server's first page of the list it placed
+* in, under `verifyPlacement`: the keys as far as both reach must agree, and
+* no row placing took out may be one the page still lists. The record goes
+* once compared; a disagreement is kept.
+*/
+const checkedPlacement = (model, connection, page, refreshes) => {
+	const placed = model.placed[connection];
+	if (placed === void 0 || !refreshes || page.start._tag !== "Terminal") return {
+		placed: model.placed,
+		placementMismatches: model.placementMismatches
+	};
+	const { [connection]: _, ...rest } = model.placed;
+	const reach = Math.min(placed.order.length, page.edges.length);
+	const served = page.edges.slice(0, reach).map((edge) => edge.key);
+	const asPlaced = placed.order.slice(0, reach);
+	const listed = new Set(page.edges.map((edge) => edge.key));
+	return {
+		placed: rest,
+		placementMismatches: served.every((key, index) => key === asPlaced[index]) && !placed.dropped.some((key) => listed.has(key)) ? model.placementMismatches : [...model.placementMismatches, {
+			connection,
+			placed: asPlaced,
+			served
+		}]
+	};
+};
 const reduceRemote = (model, message) => {
 	switch (message._tag) {
 		case "ReadReceived": return {
@@ -2846,7 +3275,7 @@ const reduceRemote = (model, message) => {
 			failures: withoutFieldFailures(model.failures, [...fieldMarks(message.requests), ...patchedMarks(message.result.entities)])
 		};
 		case "ReadFailed":
-			if (message.stream !== void 0) return markGap(model, message.stream);
+			if (message.stream !== void 0) return broke(model, message.stream, Option.some(message.error));
 			return {
 				...model,
 				entities: setStale(model.entities, marksOf(message.requests), false),
@@ -2886,7 +3315,8 @@ const reduceRemote = (model, message) => {
 				} : {
 					...Object.fromEntries(restored),
 					...model.connections
-				}
+				},
+				restoredFrom: message.from === void 0 ? model.restoredFrom : Option.some(message.from)
 			};
 		}
 		case "RefreshStarted": {
@@ -2956,29 +3386,28 @@ const reduceRemote = (model, message) => {
 			if (message.event._tag === "EntityPatched" || message.event._tag === "EntityDeleted") {
 				const event = message.event;
 				const applied = applyEntityEvent(state, model.entities, event, message.now);
-				if (applied.outcome === "gap") return markGap(model, message.stream);
+				if (applied.outcome === "gap") return broke(model, message.stream, Option.none());
 				const settled = applied.outcome !== "applied" ? [] : event._tag === "EntityPatched" ? [...patchedMarks([{
 					...event.ref,
 					values: event.values
 				}])] : entityFailureMarks(model.failures, entityKey(event.ref.entity, event.ref.id));
-				return clearGap({
+				const next = {
 					...model,
 					entities: applied.store,
 					live: withLiveState(model.live, message.stream, applied.state),
 					failures: withoutFieldFailures(model.failures, settled)
-				}, message.stream);
+				};
+				return applied.outcome === "applied" ? healthy(next, message.stream) : next;
 			}
 			const applied = applyConnectionEvent(state, model.optimistic, message.event, message.policy);
-			if (applied.outcome === "gap") return markGap(model, message.stream);
-			const next = clearGap({
+			if (applied.outcome === "gap") return broke(model, message.stream, Option.none());
+			const written = {
 				...model,
 				optimistic: applied.optimistic,
 				live: withLiveState(model.live, message.stream, applied.state)
-			}, message.stream);
-			return applied.invalidated === void 0 ? next : updateRemote(next, {
-				_tag: "ConnectionInvalidated",
-				connection: applied.invalidated
-			});
+			};
+			const next = applied.outcome === "applied" ? healthy(written, message.stream) : written;
+			return applied.invalidated === void 0 ? next : invalidateConnections(next, [applied.invalidated]);
 		}
 		case "GapCleared": return clearGap(model, message.stream);
 		case "ConnectionMerged": {
@@ -2999,6 +3428,7 @@ const reduceRemote = (model, message) => {
 			const failures = withoutFieldFailures(withoutConnectionFailure(model.failures, message.connection), [...fieldMarks(requests), ...patchedMarks(payload)]);
 			return {
 				...model,
+				...checkedPlacement(model, message.connection, message.page, message.refreshes === true),
 				entities,
 				connections: {
 					...model.connections,
@@ -3529,29 +3959,46 @@ const RemoteJsonRequest = Schema.Struct({
 	payload: Schema.Unknown
 });
 /** An answer: the call's result, or why there is none. */
-const RemoteJsonAnswer = Schema.Union([Schema.Struct({ result: Schema.Unknown }), Schema.Struct({ error: Schema.String })]);
+const RemoteJsonAnswer = Schema.Union([Schema.Struct({ result: Schema.Unknown }), Schema.Struct({
+	error: Schema.String,
+	refusal: Schema.optional(Schema.Unknown),
+	/** Who is asking was refused, with the application's reason when it gave one. */
+	forbidden: Schema.optional(Schema.Struct({ reason: Schema.optional(Schema.String) }))
+})]);
 const decodeAnswer = Schema.decodeUnknownEffect(RemoteJsonAnswer);
 const call = (send, operation, payload, fail) => Effect.tryPromise({
 	try: () => send(JSON.stringify({
 		operation,
 		payload
 	})),
-	catch: (error) => fail(error instanceof Error ? error.message : String(error))
-}).pipe(Effect.flatMap((answer) => decodeAnswer(answer).pipe(Effect.mapError(() => fail("The server answered with something that is not an answer")))), Effect.flatMap((answer) => "error" in answer ? Effect.fail(fail(answer.error)) : Effect.succeed(answer.result)));
+	catch: (error) => fail({ error: error instanceof Error ? error.message : String(error) })
+}).pipe(Effect.flatMap((answer) => decodeAnswer(answer).pipe(Effect.mapError(() => fail({ error: "The server answered with something that is not an answer" })))), Effect.flatMap((answer) => "error" in answer ? Effect.fail(fail(answer)) : Effect.succeed(answer.result)));
 /** Remote's client over `send`, for `Remote.clientLayer`. */
 const json = (send) => ({
-	FoldkitRemoteRead: (payload) => call(send, "read", payload, (message) => new RemoteReadError({ message })),
-	FoldkitRemoteQuery: (payload) => call(send, "query", payload, (message) => new RemoteQueryError({ message })),
-	FoldkitRemoteMutate: (payload) => call(send, "mutate", payload, (message) => new RemoteMutationError({ message })),
+	FoldkitRemoteRead: (payload) => call(send, "read", payload, ({ error }) => new RemoteReadError({ message: error })),
+	FoldkitRemoteQuery: (payload) => call(send, "query", payload, ({ error }) => new RemoteQueryError({ message: error })),
+	FoldkitRemoteMutate: (payload) => call(send, "mutate", payload, ({ error, refusal, forbidden }) => forbidden === void 0 ? new RemoteMutationError({
+		message: error,
+		refusal
+	}) : new RemoteForbidden({
+		message: error,
+		...forbidden.reason === void 0 ? {} : { reason: forbidden.reason }
+	})),
 	FoldkitRemoteLive: () => Stream.empty
 });
+/** A body that did not parse, told apart from every value one can parse to, `null` included. */
+const notJson = Symbol("not JSON");
 /**
 * Remote's client over HTTP: each call a `POST` of the request to `url`, the
-* answer its JSON body whatever its status. `headers` is read per request, so
-* a token that changes reaches the next call.
+* answer its JSON body whatever its status. A 403 is answered as forbidden
+* unless its body says so itself, as the server's own does: one from
+* middleware in front of Remote (a refused session) may say only `{ error }`.
+* `headers` is read per request, so a token that changes reaches the next
+* call. `fetch` defaults to the global one; pass it to route calls through
+* another implementation in tests.
 */
 const http = (url, options = {}) => json(async (request) => {
-	const response = await fetch(url, {
+	const response = await (options.fetch ?? fetch)(url, {
 		method: "POST",
 		headers: {
 			"content-type": "application/json",
@@ -3559,9 +4006,120 @@ const http = (url, options = {}) => json(async (request) => {
 		},
 		body: request
 	});
-	return response.json().catch(() => {
-		throw new Error(`${response.status} ${response.statusText}`);
+	const status = `${response.status} ${response.statusText}`;
+	const body = await response.json().catch(() => notJson);
+	const saysForbidden = typeof body === "object" && body !== null && Object.hasOwn(body, "forbidden");
+	if (response.status === 403 && !saysForbidden) return {
+		error: status,
+		forbidden: {}
+	};
+	if (body === notJson) throw new Error(status);
+	return body;
+});
+//#endregion
+//#region src/sse.ts
+/**
+* Remote live over fetch with SSE framing: the other end of
+* `foldkit-remote-server/fetch`'s live open. One `POST` carries the live
+* requirement; the answer is a `text/event-stream` of `LiveChange` frames,
+* one `data:` frame per change, closing when the server has nothing more or
+* failing on a terminal `event: error` frame. Abandoning the stream aborts
+* the request, which interrupts the subscription server-side.
+*
+* `httpWithLive` is this live stream beside `http`'s reads, queries, and
+* mutations, for `Remote.clientLayer`.
+*/
+const decodeChange = Schema.decodeUnknownSync(LiveChange);
+const parseFrame = (text) => {
+	let event = "message";
+	const data = [];
+	for (const line of text.split(/\r\n|\n/)) {
+		if (line.startsWith(":") || line === "") continue;
+		const colon = line.indexOf(":");
+		if (colon < 0) continue;
+		const field = line.slice(0, colon);
+		const value = line.slice(colon + 1).startsWith(" ") ? line.slice(colon + 2) : line.slice(colon + 1);
+		if (field === "event") event = value;
+		else if (field === "data") data.push(value);
+	}
+	return {
+		event,
+		data
+	};
+};
+/** The frames of a body, split liberally: a blank line ends a frame. */
+async function* frames(body) {
+	const reader = body.getReader();
+	const decoder = new TextDecoder();
+	let buffer = "";
+	try {
+		for (;;) {
+			const next = await reader.read();
+			if (next.done) break;
+			buffer += decoder.decode(next.value, { stream: true });
+			for (;;) {
+				const found = /(?:\r\n|\n){2}/.exec(buffer);
+				if (found === null) break;
+				yield parseFrame(buffer.slice(0, found.index));
+				buffer = buffer.slice(found.index + found[0].length);
+			}
+		}
+		buffer += decoder.decode();
+		if (buffer.trim() !== "") yield parseFrame(buffer);
+	} finally {
+		await reader.cancel().catch(() => {});
+		reader.releaseLock();
+	}
+}
+/** The wire changes of a live body: data frames decoded, error frames failed. */
+async function* changes(body) {
+	for await (const frame of frames(body)) {
+		if (frame.data.length === 0) continue;
+		const text = frame.data.join("\n");
+		if (frame.event === "error") {
+			const message = JSON.parse(text).message;
+			throw new RemoteLiveError({ message: typeof message === "string" ? message : text });
+		}
+		yield decodeChange(JSON.parse(text));
+	}
+}
+const liveError = (error) => error instanceof RemoteLiveError ? error : new RemoteLiveError({ message: error instanceof Error ? error.message : String(error) });
+/** Remote's live stream over fetch: `serveFetch`'s live open as a `Stream`. */
+const liveFetch = (url, options = {}) => (payload) => Stream.unwrap(Effect.gen(function* () {
+	const via = options.fetch ?? fetch;
+	const controller = yield* Effect.acquireRelease(Effect.sync(() => new AbortController()), (open) => Effect.sync(() => open.abort()));
+	const response = yield* Effect.tryPromise({
+		try: () => via(url, {
+			method: "POST",
+			headers: {
+				"content-type": "application/json",
+				...options.headers?.()
+			},
+			body: JSON.stringify({
+				operation: "live",
+				payload
+			}),
+			signal: controller.signal
+		}),
+		catch: liveError
 	});
+	if (!response.ok) {
+		const answered = yield* Effect.tryPromise({
+			try: () => response.json().catch(() => null),
+			catch: liveError
+		});
+		return yield* new RemoteLiveError({ message: Predicate.isObject(answered) && "error" in answered ? String(answered.error) : `HTTP ${response.status} ${response.statusText}` });
+	}
+	if (response.body === null) return yield* new RemoteLiveError({ message: "The server answered live with no body" });
+	return Stream.fromAsyncIterable(changes(response.body), liveError);
+}));
+/**
+* Remote's client over HTTP with live: reads, queries, and mutations as
+* `http` sends them, live as `liveFetch` streams it, for `clientLayer`.
+*/
+const httpWithLive = (url, options = {}) => ({
+	...http(url, options),
+	FoldkitRemoteLive: liveFetch(url, options)
 });
 //#endregion
 //#region src/index.ts
@@ -3600,6 +4158,30 @@ const readContract = (source, shape, window) => {
 		}
 	};
 };
+/**
+* A read contract whose connection, when a client can place rows in it, also
+* reads every field its body filters and orders by: a changed row is then
+* compared with neighbours that hold those fields. What the view reads, and so
+* decodes, stays its Selection.
+*/
+const placeableReadContract = (contract, body) => {
+	if (body === void 0) return contract;
+	const { requirement, ref } = contract;
+	const encoded = Schema.encodeSync(ref.Input)(ref.input);
+	if (Query.placement(body, encoded)._tag !== "Placeable") return contract;
+	const missing = Query.dependencies(body).fields.filter((field) => !requirement.select.fields.includes(field.key));
+	if (missing.length === 0) return contract;
+	return {
+		...contract,
+		requirement: {
+			...requirement,
+			select: {
+				...requirement.select,
+				fields: [...requirement.select.fields, ...missing.map((field) => field.key)]
+			}
+		}
+	};
+};
 const metaOf = (remote, asked) => {
 	const visible = visibleStoreOf(remote.entities, remote.optimistic);
 	let updatedAt;
@@ -3781,7 +4363,8 @@ const defineRemote = (config) => {
 		registry: {
 			entities: new Map(entities.map((entity) => [entity.name, entity])),
 			queries: new Map((config.queries ?? []).map((query) => [query.name, query])),
-			mutations: new Map((config.mutations ?? []).map((mutation) => [mutation.name, mutation]))
+			mutations: new Map((config.mutations ?? []).map((mutation) => [mutation.name, mutation])),
+			filtered: new Map(config.entities.flatMap((entity) => Entity.is(entity) ? [[entity.name, ReadFilter.members(entity.metadata)]] : []))
 		}
 	};
 };
@@ -3803,19 +4386,10 @@ const bindRemote = (definition, store) => ({
 const assertRegistered = (bound, kind, registered, name) => {
 	if (!registered.has(name)) throw new Error(`Remote: ${kind} "${name}" is not registered with domain "${bound.contract.name}"`);
 };
-const nothingAsked = {
-	requirements: [],
-	connections: []
-};
 const askedOf = (projection) => ({
 	requirements: requirementsOf(projection),
 	connections: connectionsOf(projection)
 });
-/** What an active Surface asks for: nothing while it is inactive. */
-const askedWhile = (projection) => Option.match(projection, {
-	onNone: () => nothingAsked,
-	onSome: askedOf
-});
 /**
 * Whether `outer` asks for everything `inner` does of one entity: each field,
 * each relation's own slice of its target, and each page window alike.
@@ -4162,58 +4736,121 @@ const observeEntry = (bound, askedOf, toMessage, options) => {
 	};
 };
 const resumeCursor = Schema.Number.pipe(Schema.overrideToEquivalence(() => () => true));
+/** The wait before a stream's restart after `failures` breaks in a row: Sync's transport backoff. */
+const restartDelay = (options, failures) => {
+	const base = Duration.toMillis(Duration.fromInputUnsafe(options.retryBase ?? "50 millis"));
+	const max = Duration.toMillis(Duration.fromInputUnsafe(options.maxRetryDelay ?? "5 seconds"));
+	const backoff = Math.min(max, base * 2 ** Math.min(Math.max(failures, 1) - 1, 30));
+	return Duration.millis(backoff * (.8 + Math.random() * .4));
+};
 /** The live entry: subscribes to `requirementsOf(model)` from the Model's resume cursor. */
 const liveEntry = (bound, requirementsOf, toMessage, options) => ({
 	dependenciesSchema: Schema.Struct({
 		requirements: Schema.Array(ReadRequest),
 		cursor: resumeCursor,
-		floor: Schema.Number
+		floor: Schema.Number,
+		restarts: Schema.Number,
+		failures: resumeCursor
 	}),
 	modelToDependencies: (model) => {
 		const requirements = requirementsOf(model);
 		const stream = liveStreamKey(requirements);
 		const remote = bound.store.get(model);
+		const health = remote.streams[stream];
 		return {
 			requirements,
 			cursor: remote.live[stream]?.cursor ?? 0,
-			floor: remote.refresh.floor
+			floor: remote.refresh.floor,
+			restarts: health?.restarts ?? 0,
+			failures: health?.failures ?? 0
 		};
 	},
-	dependenciesToStream: ({ requirements, cursor }) => requirements.length === 0 ? Stream.empty : Stream.unwrap(Effect.gen(function* () {
-		return (yield* RemoteClient).live({
-			requirements,
-			after: cursor
-		});
-	})).pipe(Stream.map((event) => toMessage({
-		_tag: "LiveReceived",
-		stream: liveStreamKey(requirements),
-		event,
-		now: (options.now ?? wallClock)()
-	})), Stream.catchIf((_error) => true, (error) => Stream.succeed(toMessage({
-		_tag: "ReadFailed",
-		requests: requirements,
-		error: remoteError(error),
-		stream: liveStreamKey(requirements)
-	}))))
+	dependenciesToStream: ({ requirements, cursor, restarts, failures }) => {
+		if (requirements.length === 0) return Stream.empty;
+		const stream = liveStreamKey(requirements);
+		const live = Stream.unwrap(Effect.gen(function* () {
+			return (yield* RemoteClient).live({
+				requirements,
+				after: cursor
+			});
+		})).pipe(Stream.map((event) => toMessage({
+			_tag: "LiveReceived",
+			stream: liveStreamKey(requirements),
+			event,
+			now: (options.now ?? wallClock)()
+		})), Stream.catchIf((_error) => true, (error) => Stream.succeed(toMessage({
+			_tag: "ReadFailed",
+			requests: requirements,
+			error: remoteError(error),
+			stream: liveStreamKey(requirements)
+		}))));
+		if (restarts === 0) return live;
+		return Stream.fromEffect(Effect.sleep(restartDelay(options, failures))).pipe(Stream.drain, Stream.concat(Stream.make(toMessage({
+			_tag: "RefreshStarted",
+			requests: requirements
+		}), toMessage({
+			_tag: "GapCleared",
+			stream
+		}))), Stream.concat(live));
+	}
+});
+/** The projection an active entry has for this Model; none while it is inactive. */
+const projectionOf = (entry, model) => {
+	if ("projectionOf" in entry) return entry.projectionOf(model);
+	if ("projection" in entry) return Option.some(entry.projection());
+	return Option.none();
+};
+/**
+* Every projection an entry resolves to for a Model: the lone one of a
+* `Surface.at`/`Surface.when` value or a bare Surface, or a family's parent
+* first and then each instance. The parent joins so an unloaded parent is
+* fetched before what it reveals; `Data.satisfy` reaches the instances in a
+* later pass. A caller that also passes the parent separately double-covers
+* its requirements, as overlapping Surfaces already do.
+*/
+const resolvedOf = (entry, model) => {
+	const source = entry;
+	if (typeof source.instancesOf === "function") {
+		const instances = source.instancesOf(model);
+		const from = entry.from;
+		if (from === void 0) return instances.map((instance) => ({
+			name: entry.name,
+			projection: instance.projection
+		}));
+		return [...Option.toArray(from.projectionOf(model)).map((projection) => ({
+			name: from.name,
+			projection
+		})), ...instances.map((instance) => ({
+			name: `${entry.name}[${instance.key}]`,
+			projection: instance.projection
+		}))];
+	}
+	return Option.toArray(projectionOf(entry, model)).map((projection) => ({
+		name: entry.name,
+		projection
+	}));
+};
+/** What some projections ask for together: their requirements and connections unioned. */
+const askedUnion = (projections) => ({
+	requirements: projections.flatMap(requirementsOf),
+	connections: projections.flatMap(connectionsOf)
 });
-/** The projection an active Surface has for this Model; none while it is inactive. */
-const projectionOf = (entry, model) => "projectionOf" in entry ? entry.projectionOf(model) : Option.some(entry.projection());
 /**
-* `projectionOf` computed once per Model: the read, live, and retain entries
-* all derive their dependencies from the same projection on the same Model
+* `resolvedOf` computed once per Model: the read, live, and retain entries
+* all derive their dependencies from the same projections on the same Model
 * change, and a Surface's `model` callback (which lifts and builds schemas)
 * need not run three times for it. Models are objects, so the memo is weak.
 */
-const memoizedProjectionOf = (entry) => {
+const memoizedResolved = (entry) => {
 	const cache = /* @__PURE__ */ new WeakMap();
 	return (model) => {
 		const key = model;
-		if (typeof key !== "object" || key === null) return projectionOf(entry, model);
+		if (typeof key !== "object" || key === null) return resolvedOf(entry, model);
 		const known = cache.get(key);
 		if (known !== void 0) return known;
-		const projection = projectionOf(entry, model);
-		cache.set(key, projection);
-		return projection;
+		const resolved = resolvedOf(entry, model);
+		cache.set(key, resolved);
+		return resolved;
 	};
 };
 const Remote = {
@@ -4294,7 +4931,7 @@ const Remote = {
 	* in one step; the result carries the application-facing operations. The
 	* descriptor alone is `Remote.define`, the binding alone `Remote.at`.
 	*/
-	make: (config) => bindDomain(defineRemote(config), config.model),
+	make: (config) => bindDomain(defineRemote(config), config.model, { verifyPlacement: config.verifyPlacement }),
 	/**
 	* Declares a Remote domain without binding it: its entities, queries, and
 	* mutations, plus the submodel. For a domain reused across applications or
@@ -4516,6 +5153,13 @@ const Remote = {
 	* request to `url`. `headers` is read per request (a session token, say).
 	*/
 	http,
+	/**
+	* Remote's client over HTTP with live, for `clientLayer`: reads, queries,
+	* and mutations as `http` sends them, live requirements as one `POST`
+	* answered with a `text/event-stream` of changes.
+	* `foldkit-remote-server/fetch` is the other end.
+	*/
+	httpWithLive,
 	clientLayer: (client, options = {}) => coalescedLayer(Layer.effect(RemoteClient, Effect.gen(function* () {
 		const context = yield* Effect.context();
 		return {
@@ -4571,15 +5215,6 @@ const Remote = {
 	}),
 	/** The `RemoteMessage` that merges a query page into its connection. */
 	queryMessage: (ref, result, select, now) => pageMessage(ref.identity, result, false, ref.window, select, now),
-	/**
-	* The edges a connection shows: its server-known region with pending and
-	* confirmed overlays placed around it, minus removed edges and edges whose
-	* target is a tombstone.
-	*/
-	visibleItems: (model, connection) => {
-		const identity = connectionIdentity(connection);
-		return visibleItems(model.connections[identity] ?? emptyConnection, identity, model.optimistic.overlays, model.entities);
-	},
 	/** A pure, serializable view of the whole cache. */
 	inspect: inspectRemote,
 	/** A pure, serializable view of one entity, or `undefined` if unknown. */
@@ -4631,7 +5266,8 @@ const Remote = {
 	* requirements, emitting a `LiveReceived` per event and a `ReadFailed`
 	* carrying its `stream` when the stream breaks (including
 	* `ResumeUnavailable`). That records a gap on the stream rather than a failed
-	* read, since nothing was being read. The resume cursor is read
+	* read, since nothing was being read, and restarts the entry after a
+	* backoff; the restart refetches what it covers. The resume cursor is read
 	* from `RemoteModel.live`, so the application tracks no cursor of its own.
 	*/
 	live: (bound, surface, params, toMessage = identityMessage, options = {}) => liveEntry(bound, () => requirementsOf(surface.projection(params)), toMessage, options)
@@ -4647,7 +5283,7 @@ const failedReadWords = (error) => {
 	}
 };
 /** The bound domain: the descriptor, the binding, and the operations over them. */
-const bindDomain = (definition, store) => {
+const bindDomain = (definition, store, options = {}) => {
 	const bound = bindRemote(definition, store);
 	const readers = /* @__PURE__ */ new Map();
 	const keptConnections = /* @__PURE__ */ new Set();
@@ -4692,11 +5328,248 @@ const bindDomain = (definition, store) => {
 			policy: livePolicyFor(model, live.event)
 		};
 		const remote = store.get(model);
-		const next = updateRemote(remote, resolved);
+		const reduced = updateRemote(remote, resolved);
+		const answer = message._tag === "MutationSucceeded" ? message : void 0;
+		const next = answer === void 0 ? placedNews(reduced, newsOf(message), remote.entities) : impactOf(reduced, answer, remote.entities);
 		return next === remote ? model : store.set(model, next);
 	};
+	/** The registered query a connection identity names, and its encoded input. */
+	const queryOf = (identity) => {
+		const separator = identity.indexOf("\0");
+		const descriptor = definition.registry.queries.get(identity.slice(0, separator));
+		if (descriptor === void 0) return Option.none();
+		const encoded = JSON.parse(identity.slice(separator + 1));
+		const over = descriptor.body?.entity.name;
+		const filtered = (over === void 0 ? void 0 : definition.registry.filtered.get(over)) ?? [];
+		return Option.some({
+			descriptor,
+			encoded,
+			filtered
+		});
+	};
+	/**
+	* `pages` with each change to a row they hold placed, judged against
+	* `store`: a row that moved goes where the body's order puts it, and one
+	* that stopped matching leaves. A row a change brings in is not added,
+	* since what the list selects of it may not be loaded, and a change the
+	* client cannot place leaves the row where it is.
+	*/
+	const placedHeld = (identity, pages, changes, store) => {
+		const query = queryOf(identity);
+		if (Option.isNone(query)) return pages;
+		const holds = new Set(items(pages).map((edge) => entityKey(edge.ref.entity, edge.ref.id)));
+		let placed = pages;
+		for (const change of changes) {
+			if (!holds.has(entityKey(change.entity, change.id))) continue;
+			placed = Impact.$match(impactOn({
+				...query.value,
+				connection: placed,
+				holds
+			}, store, change), {
+				Kept: () => placed,
+				Placed: ({ connection }) => connection,
+				Invalidated: () => placed
+			});
+		}
+		return placed;
+	};
+	/**
+	* A loaded list with the pending layers placed in its pages, so a row a
+	* pending edit moves, or takes out of the list, shows where its answer
+	* will be placed until the edit settles.
+	*/
+	const pendingPlaced = (remote, identity, pages) => {
+		const { layers } = remote.optimistic;
+		if (layers.length === 0) return pages;
+		return memoRead([
+			pages,
+			layers,
+			remote.entities
+		], `placed:${identity}`, () => placedHeld(identity, pages, changesOf({ entities: layers.flatMap((layer) => layer.patches) }, remote.entities), visibleStoreOf(remote.entities, remote.optimistic)));
+	};
+	/**
+	* The edges a loaded list shows: its pages with pending edits placed, and
+	* each row an insert overlay shows (a pending create, a confirmed or a live
+	* insert) where the body's order puts it, or left out when it sorts past
+	* what is loaded. An overlay says a row is in the list; in a list the
+	* client can place, the order says where. A row it cannot place stays at
+	* the end its overlay names.
+	*/
+	const shownEdges = (remote, identity, connection) => {
+		const pages = pendingPlaced(remote, identity, connection);
+		const shown = remote.optimistic.overlays.some((overlay) => overlay.connection === identity && overlay.position !== "remove") ? insertsPlaced(remote, identity, pages) : {
+			pages,
+			overlays: remote.optimistic.overlays
+		};
+		return visibleItems(shown.pages, identity, shown.overlays, remote.entities);
+	};
+	const insertsPlaced = (remote, identity, pages) => {
+		const { overlays } = remote.optimistic;
+		const store = visibleStoreOf(remote.entities, remote.optimistic);
+		return memoRead([
+			pages,
+			overlays,
+			store
+		], `inserted:${identity}`, () => {
+			const query = queryOf(identity);
+			const body = Option.isSome(query) ? query.value.descriptor.body : void 0;
+			if (Option.isNone(query) || body === void 0) return {
+				pages,
+				overlays
+			};
+			const inserted = /* @__PURE__ */ new Map();
+			for (const overlay of overlays) {
+				if (overlay.connection !== identity || overlay.position === "remove") continue;
+				for (const edge of overlay.edges) inserted.set(edge.key, edge);
+			}
+			const held = new Set(items(pages).map((edge) => edge.key));
+			let placed = pages;
+			const outside = [];
+			for (const edge of inserted.values()) {
+				if (held.has(edge.key)) continue;
+				const key = entityKey(edge.ref.entity, edge.ref.id);
+				RowPlace.$match(placeIn(store, placed, body, query.value.encoded, key), {
+					Before: (place) => void (placed = withEdge(placed, edge, place)),
+					End: (place) => void (placed = withEdge(placed, edge, place)),
+					Outside: () => void outside.push(edge),
+					Unknown: () => void 0
+				});
+			}
+			return {
+				pages: placed,
+				overlays: outside.length === 0 ? overlays : [...overlays, {
+					id: "placed:outside",
+					connection: identity,
+					edges: outside,
+					position: "remove"
+				}]
+			};
+		});
+	};
+	/**
+	* The loaded lists with what the server said of rows they hold placed: a
+	* read or a live patch that changes a held row's ordering or filtered field
+	* moves it, or takes it out, as a mutation's answer does. A list it cannot
+	* place stands as it is, as a read is no write: its own refetch or live
+	* stream says otherwise. Only a value the client held before counts, so a
+	* row's first read judges nothing.
+	*/
+	const placedNews = (remote, news, before) => {
+		if (news.length === 0) return remote;
+		const held = news.map((patch) => {
+			const values = before[entityKey(patch.entity, patch.id)]?.values ?? {};
+			return {
+				...patch,
+				values: Object.fromEntries(Object.entries(patch.values).filter(([field]) => Object.hasOwn(values, field)))
+			};
+		});
+		const changes = changesOf({ entities: held }, before);
+		if (changes.length === 0) return remote;
+		const placed = {};
+		for (const [identity, pages] of Object.entries(remote.connections)) {
+			const after = placedHeld(identity, pages, changes, remote.entities);
+			if (after !== pages) placed[identity] = after;
+		}
+		return withPlacements(remote, placed, []);
+	};
+	/** The rows a read or a live patch says the server holds now. */
+	const newsOf = (message) => {
+		if (message._tag === "ReadReceived") return message.result.entities;
+		if (message._tag !== "LiveReceived") return [];
+		const event = message.event;
+		if (event._tag !== "EntityPatched") return [];
+		return [{
+			entity: event.ref.entity,
+			id: event.ref.id,
+			values: event.values
+		}];
+	};
+	/**
+	* The loaded connections as a write left them: each judged by its body
+	* against the store as the write left it, a change it can place placed in
+	* its pages, and one it cannot invalidated for its read entry to fetch.
+	*/
+	const impactOf = (remote, answer, before) => {
+		const changes = changesOf(answer, before);
+		if (changes.length === 0) return remote;
+		const named = /* @__PURE__ */ new Map();
+		for (const change of answer.connections ?? []) {
+			const keys = named.get(change.connection) ?? /* @__PURE__ */ new Set();
+			keys.add(change.edge.key);
+			named.set(change.connection, keys);
+		}
+		const visible = visibleStoreOf(remote.entities, remote.optimistic);
+		const placed = {};
+		const invalidated = [];
+		for (const identity of Object.keys(remote.connections)) {
+			const answered = named.get(identity);
+			const judged = answered === void 0 ? changes : changes.filter((change) => !answered.has(entityKey(change.entity, change.id)));
+			if (judged.length === 0) continue;
+			const query = queryOf(identity);
+			if (Option.isNone(query)) continue;
+			const original = remote.connections[identity];
+			const holds = new Set(visibleItems(original, identity, remote.optimistic.overlays, remote.entities).map((edge) => entityKey(edge.ref.entity, edge.ref.id)));
+			let pages = original;
+			let invalid = false;
+			for (const change of judged) {
+				const held = {
+					...query.value,
+					connection: pages,
+					holds
+				};
+				const after = Impact.$match(impactOn(held, visible, change), {
+					Kept: () => Option.some(pages),
+					Placed: ({ connection }) => Option.some(connection),
+					Invalidated: () => Option.none()
+				});
+				if (Option.isNone(after)) {
+					invalid = true;
+					break;
+				}
+				pages = after.value;
+			}
+			if (invalid) invalidated.push(identity);
+			else if (pages !== original) placed[identity] = pages;
+		}
+		return withPlacements(remote, placed, invalidated);
+	};
+	/**
+	* The lists placed and invalidated. Under `verifyPlacement`, each placed
+	* list is fetched too, and the order it was placed in kept to compare with
+	* the server's page.
+	*/
+	const withPlacements = (remote, placed, invalidated) => {
+		const identities = Object.keys(placed);
+		if (identities.length === 0) return invalidateConnections(remote, invalidated);
+		const withPlaced = {
+			...remote,
+			connections: {
+				...remote.connections,
+				...placed
+			}
+		};
+		if (options.verifyPlacement !== true) return invalidateConnections(withPlaced, invalidated);
+		const firstPage = (connection) => (connection?.segments[0]?.edges ?? []).map((edge) => edge.key);
+		const orders = Object.fromEntries(identities.map((identity) => {
+			const order = firstPage(placed[identity]);
+			const kept = new Set(order);
+			return [identity, {
+				order,
+				dropped: firstPage(remote.connections[identity]).filter((key) => !kept.has(key))
+			}];
+		}));
+		return invalidateConnections({
+			...withPlaced,
+			placed: {
+				...remote.placed,
+				...orders
+			}
+		}, [...invalidated, ...identities]);
+	};
 	const assertOwned = (entry) => {
 		if (bound.contract.owner !== void 0 && entry.owner !== bound.contract.owner) throw new Error(`Remote: Surface "${entry.name}" belongs to another application than domain "${bound.contract.name}"`);
+		const from = entry.from;
+		if (from !== void 0 && bound.contract.owner !== void 0 && from.owner !== bound.contract.owner) throw new Error(`Remote: Surface "${from.name}" belongs to another application than domain "${bound.contract.name}"`);
 	};
 	const domain = {
 		...definition,
@@ -4726,16 +5599,16 @@ const bindDomain = (definition, store) => {
 			const entries = {};
 			for (const entry of Object.values(active)) assertOwned(entry);
 			for (const [key, entry] of Object.entries(active)) {
-				const projectionAt = readers.get(entry) ?? memoizedProjectionOf(entry);
-				readers.set(entry, projectionAt);
-				const asked = (model) => askedWhile(projectionAt(model));
+				const resolvedAt = readers.get(entry) ?? memoizedResolved(entry);
+				readers.set(entry, resolvedAt);
+				const asked = (model) => askedUnion(resolvedAt(model).map(({ projection }) => projection));
 				entries[`${key}.read`] = observeEntry(bound, asked, identityMessage, options);
 				entries[`${key}.live`] = liveEntry(bound, (model) => asked(model).requirements.filter((requirement) => requirement.live === true), identityMessage, options);
 			}
 			for (const identity of options.connections ?? []) keptConnections.add(connectionIdentity(identity));
 			entries.retain = {
 				dependenciesSchema: retentionRootsSchema,
-				modelToDependencies: (model) => rootsOf([...readers.values()].flatMap((projectionAt) => Option.toArray(projectionAt(model))), { connections: [...keptConnections] }),
+				modelToDependencies: (model) => rootsOf([...readers.values()].flatMap((resolvedAt) => resolvedAt(model).map(({ projection }) => projection)), { connections: [...keptConnections] }),
 				dependenciesToStream: (current) => Stream.fromEffect(Effect.succeed({
 					_tag: "RetentionChanged",
 					roots: current
@@ -4776,22 +5649,19 @@ const bindDomain = (definition, store) => {
 			const entries = Object.values(active);
 			entries.forEach(assertOwned);
 			const planOptions = RemotePolicy.toPlan(RemotePolicy.cacheFirst, now());
-			const plans = (current, entry) => {
-				const planned = planAsked(store.get(current), askedWhile(projectionOf(entry, current)), planOptions);
+			const plans = (current, projections) => {
+				const planned = planAsked(store.get(current), askedUnion(projections), planOptions);
 				return planned.queries.length > 0 || planned.requirements.length > 0;
 			};
 			let current = model;
 			for (let pass = 0; pass < passes; pass++) {
-				if (!entries.some((entry) => plans(current, entry))) return current;
-				for (const entry of entries) {
-					const projection = projectionOf(entry, current);
-					if (Option.isSome(projection)) current = yield* domain.prefetch(current, projection.value, { now });
-				}
+				if (!entries.some((entry) => plans(current, resolvedOf(entry, current).map(({ projection }) => projection)))) return current;
+				for (const entry of entries) for (const { projection } of resolvedOf(entry, current)) current = yield* domain.prefetch(current, projection, { now });
 			}
-			const reading = entries.filter((entry) => plans(current, entry));
+			const reading = entries.flatMap((entry) => resolvedOf(entry, current).filter(({ projection }) => plans(current, [projection])));
 			if (reading.length === 0) return current;
 			return yield* new RemoteUnsatisfied({
-				surfaces: reading.map((entry) => entry.name),
+				surfaces: reading.map(({ name }) => name),
 				passes
 			});
 		}),
@@ -4803,10 +5673,10 @@ const bindDomain = (definition, store) => {
 			const listed = query.Result.entity;
 			if (listed === void 0) throw new Error(`Remote: query "${query.name}" is not a connection over an entity, so it has no page to select`);
 			if (select.entity !== listed) throw new Error(`Remote: the selection is of "${select.entity}", but query "${query.name}" lists "${listed}"`);
-			const { ref, relation, requirement } = readContract(query.ref(input), select, window);
+			const { ref, relation, requirement } = placeableReadContract(readContract(query.ref(input), select, window), query.body);
 			const relationKey = stableStringify(relation);
 			const sizeOf = (remote) => windowSize(remote, ref);
-			const shown = (remote, connection) => cutToWindow(visibleItems(connection, ref.identity, remote.optimistic.overlays, remote.entities), ref.window, sizeOf(remote));
+			const shown = (remote, connection) => cutToWindow(shownEdges(remote, ref.identity, connection), ref.window, sizeOf(remote));
 			const failedItem = (remote, connection) => {
 				if (Object.keys(remote.failures.fields).length === 0) return void 0;
 				for (const edge of shown(remote, connection).edges) {
@@ -4924,8 +5794,13 @@ const bindDomain = (definition, store) => {
 		},
 		explain: (model, projection, options) => {
 			const { ref } = projection;
-			const reading = Object.values(options?.surfaces ?? {}).filter((active) => {
-				return Option.exists(active.projectionOf(model), (shown) => connectionsOf(shown).some((connection) => connection.identity === ref.identity));
+			const reading = Object.values(options?.surfaces ?? {}).flatMap((source) => {
+				const matched = resolvedOf(source, model).filter(({ projection: shown }) => connectionsOf(shown).some((connection) => connection.identity === ref.identity));
+				if (matched.length === 0) return [];
+				return [{
+					source,
+					names: matched.map(({ name }) => name)
+				}];
 			});
 			const body = definition.registry.queries.get(ref.query)?.body;
 			const [connection] = RemoteConnections.get(projection.metadata);
@@ -4942,20 +5817,21 @@ const bindDomain = (definition, store) => {
 				},
 				state: projection.read(model)._tag,
 				...options?.surfaces === void 0 ? {} : {
-					surfaces: reading.map((active) => active.name),
-					activation: reading.flatMap((active) => active.activation === void 0 ? [] : [{
-						surface: active.name,
-						...active.activation
-					}])
+					surfaces: reading.flatMap((read) => read.names),
+					activation: reading.flatMap((read) => {
+						const activation = "activation" in read.source ? read.source.activation : void 0;
+						return activation === void 0 ? [] : [{
+							surface: read.source.name,
+							...activation
+						}];
+					})
 				}
 			};
 		},
 		why: (model, projection, options) => {
 			const state = projection.read(model);
 			const asked = askedOf(projection);
-			const reading = options?.surfaces === void 0 ? void 0 : Object.values(options.surfaces).filter((active) => {
-				return Option.exists(active.projectionOf(model), (shown) => covers(askedOf(shown), asked));
-			}).map((active) => active.name);
+			const reading = options?.surfaces === void 0 ? void 0 : Object.values(options.surfaces).flatMap((source) => resolvedOf(source, model).filter(({ projection: shown }) => covers(askedOf(shown), asked)).map(({ name }) => name));
 			const withSurfaces = reading === void 0 ? {} : { surfaces: reading };
 			switch (state._tag) {
 				case "Ready": return {
@@ -5009,8 +5885,17 @@ const bindDomain = (definition, store) => {
 			const remote = store.get(model);
 			const connection = remote.connections[over.ref.identity];
 			const visible = visibleStoreOf(remote.entities, remote.optimistic);
-			const among = (connection === void 0 ? [] : visibleItems(connection, over.ref.identity, remote.optimistic.overlays, remote.entities)).map((edge) => entityKey(edge.ref.entity, edge.ref.id));
-			const judged = matching(visible, by, input, { among });
+			const among = (connection === void 0 ? [] : shownEdges(remote, over.ref.identity, connection)).map((edge) => entityKey(edge.ref.entity, edge.ref.id));
+			let judged;
+			try {
+				judged = matching(visible, by, input, { among });
+			} catch (error) {
+				if (error instanceof QueryEvaluateError) return {
+					items: [],
+					complete: false
+				};
+				throw error;
+			}
 			const relation = relationOf(over.selection);
 			const items = [];
 			let assembledAll = true;
@@ -5043,6 +5928,11 @@ const bindDomain = (definition, store) => {
 			_tag: "OverlayLifted",
 			id
 		}),
+		overlays: (model) => overlaysOf(store.get(model)),
+		visibleItems: (remote, connection) => {
+			const identity = connectionIdentity(connection);
+			return shownEdges(remote, identity, remote.connections[identity] ?? emptyConnection);
+		},
 		mutate: (model, mutation, input, options = {}) => {
 			assertRegistered(bound, "Mutation", definition.registry.mutations, mutation.name);
 			const remote = store.get(model);
@@ -5051,7 +5941,7 @@ const bindDomain = (definition, store) => {
 			const optimistic = typeof options.optimistic === "function" ? options.optimistic({
 				requestId,
 				tempId
-			}) : options.optimistic;
+			}) : options.optimistic ?? (mutation.write === void 0 ? void 0 : optimisticOfWrite(mutation.write, input, options.keys));
 			const started = updateRemote(remote, {
 				_tag: "MutationStarted",
 				requestId,
@@ -5064,7 +5954,7 @@ const bindDomain = (definition, store) => {
 				command: {
 					name: `Remote.mutate(${mutation.name})`,
 					args: { requestId },
-					effect: mutateRemote(mutation, input, requestId).pipe(Effect.match({
+					effect: mutateRemote(mutation, input, requestId, options.keys).pipe(Effect.match({
 						onFailure: (error) => ({
 							_tag: "MutationFailed",
 							requestId,
@@ -5083,8 +5973,108 @@ const bindDomain = (definition, store) => {
 			};
 		},
 		mutation: (model, requestId) => mutationStatus(store.get(model).mutations, requestId),
+		refusal: (model, requestId, mutation) => {
+			const status = mutationStatus(store.get(model).mutations, requestId);
+			if (status._tag !== "Failed") return Option.none();
+			const { refusal } = status.error;
+			return refusal === void 0 ? Option.none() : Schema.decodeUnknownOption(mutation.Refusal)(refusal);
+		},
+		liveStatus: (model, active) => {
+			assertOwned(active);
+			const resolvedAt = readers.get(active) ?? memoizedResolved(active);
+			const requirements = askedUnion(resolvedAt(model).map(({ projection }) => projection)).requirements.filter((requirement) => requirement.live === true);
+			if (requirements.length === 0) return { _tag: "Idle" };
+			const remote = store.get(model);
+			const stream = liveStreamKey(requirements);
+			const health = remote.streams[stream];
+			return health === void 0 || !remote.gaps.has(stream) ? { _tag: "Live" } : {
+				_tag: "Reconnecting",
+				attempt: health.failures,
+				error: health.error
+			};
+		},
 		reduce,
 		inspect: (model) => inspectRemote(store.get(model)),
+		persistence: (options) => {
+			const connections = (options.connections ?? []).map(connectionIdentity);
+			const snapshotOf = options.snapshot ?? ((remote) => RemotePersistence.snapshotOf(remote, { connections }));
+			const debounce = options.debounce ?? "250 millis";
+			let last = {
+				entities: emptyStore,
+				connections: {},
+				scope: "",
+				text: Option.none()
+			};
+			const textOf = (remote, scope) => {
+				if (last.entities !== remote.entities || last.connections !== remote.connections || last.scope !== scope) last = {
+					entities: remote.entities,
+					connections: remote.connections,
+					scope,
+					text: Option.fromUndefinedOr(RemotePersistence.dehydrate(snapshotOf(remote), {
+						scope,
+						maxBytes: options.maxBytes
+					}))
+				};
+				return last.text;
+			};
+			const restore = {
+				dependenciesSchema: Schema.Struct({
+					key: Schema.String,
+					scope: Schema.String
+				}),
+				modelToDependencies: (model) => ({
+					key: options.key(model),
+					scope: options.scope(model)
+				}),
+				dependenciesToStream: ({ key, scope }) => Stream.fromEffect(RemotePersistence.restore({
+					key,
+					scope,
+					maxBytes: options.maxBytes
+				}).pipe(Effect.option)).pipe(Stream.flatMap((read) => Option.match(read, {
+					onNone: () => Stream.empty,
+					onSome: (snapshot) => Stream.make({
+						_tag: "Hydrated",
+						entities: snapshot.entities,
+						connections: snapshot.connections,
+						merge: "preserve-existing",
+						from: key
+					})
+				})))
+			};
+			const save = {
+				dependenciesSchema: Schema.Struct({
+					key: Schema.String,
+					restored: Schema.Boolean,
+					text: Schema.OptionFromNullOr(Schema.String)
+				}),
+				modelToDependencies: (model) => {
+					const remote = store.get(model);
+					const key = options.key(model);
+					const restored = Option.contains(remote.restoredFrom, key);
+					return {
+						key,
+						restored,
+						text: restored ? textOf(remote, options.scope(model)) : Option.none()
+					};
+				},
+				dependenciesToStream: ({ key, restored, text }) => restored ? Stream.fromEffect(Effect.gen(function* () {
+					yield* Effect.sleep(debounce);
+					const kv = yield* KeyValueStore.KeyValueStore;
+					yield* Option.match(text, {
+						onNone: () => kv.remove(key),
+						onSome: (written) => kv.set(key, written)
+					});
+				}).pipe(Effect.ignore)).pipe(Stream.drain) : Stream.empty
+			};
+			return {
+				key: `persistence:${bound.contract.name}`,
+				handles: [],
+				subscriptions: Subscription.make()(() => ({
+					"persistence.restore": restore,
+					"persistence.save": save
+				}))
+			};
+		},
 		wiring: (active, options) => ({
 			key: `remote:${bound.contract.name}`,
 			handles: Object.keys(remoteMessageCases),
@@ -5131,6 +6121,6 @@ const pickWindow = (window) => ({
 	...window.before === void 0 ? {} : { before: window.before }
 });
 //#endregion
-export { settleSuccess as $, RelationRequest as $t, REMOTE_CACHE_VERSION as A, remove as An, coalesceReads as At, emptyLiveState as B, isRefPage as Bn, MutationRequest as Bt, updateRemote as C, hasField as Cn, RemoteClient as Ct, RemoteData as D, markStale as Dn, mutateRemote as Dt, writeRead as E, isTombstone as En, liveEventOf as Et, plan as F, writeEntity as Fn, LiveEdge as Ft, addOverlay as G, targetsOf as Gn, QueryRequest as Gt, liveHasPrevious as H, refsIn as Hn, NormalizedEntity as Ht, windowKey as I, RELATION_ALIAS as In, LiveRequirement as It, emptyOptimistic as J, Requirement as Jn, REMOTE_PROTOCOL_VERSION as Jt, beginOptimistic as K, RemoteConnections as Kn, QueryResult as Kt, applyConnectionEvent as L, RelationAnnotation as Ln, MAX_FIELDS_PER_REQUEST as Lt, gc as M, setUnavailable as Mn, ConnectionChangeSchema as Mt, reachable as N, tombstone as Nn, Live as Nt, remoteDataSchema as O, missingFields as On, remoteError as Ot, deadlineOf as P, writeEntities as Pn, LiveChange as Pt, settleFailure as Q, ReadRequest as Qt, applyEntityEvent as R, RelationEntityAnnotation as Rn, MAX_RELATION_DEPTH as Rt, retentionRootsSchema as S, entry as Sn, unknown as St, withRefreshRequested as T, isFieldUnavailable as Tn, connectionChangeOf as Tt, ConnectionChange as U, relationAlias as Un, PageSize as Ut, liveHasNext as V, refParts as Vn, MutationResult as Vt, addLayer as W, relationShape as Wn, QueryEdge as Wt, removeLayer as X, requirementsOf as Xn, ReadBatch as Xt, pruneOverlays as Y, connectionsOf as Yn, Read as Yt, removeOverlay as Z, ReadBatchResult as Zt, refreshIsInFlight as _, reconcileMutation as _n, isGapped as _t, RemotePolicy as a, RemoteRpc as an, matching as at, remoteMessageSchema as b, emptyStore as bn, segment as bt, forgetRemote as c, WireBoundary as cn, assemble as ct, isLoading as d, stableStringify as dn, unavailableOf as dt, RemoteLiveError as en, visibleItems as et, isLoadingThrough as f, Mutation as fn, cursor as ft, onlyOverlaid as g, mutationStatus as gn, hasPrevious as gt, noFailures as h, failMutation as hn, hasNext as ht, RemoteJsonRequest as i, RemoteReadError as in, belongsEncoded as it, RemotePersistence as j, setStale as jn, requirementKey as jt, remoteErrorSchema as k, readField as kn, coalesceQueries as kt, initialRemoteModel as l, IDENTITY_SEPARATOR as ln, pageSchema as lt, isRemoteMessage as m, emptyMutationState as mn, emptyConnection as mt, RemoteUnsatisfied as n, RemoteProtocolError as nn, inspectEntity as nt, emptyRefresh as o, SettledFields as on, Entity$1 as ot, isQueryLoading as p, beginMutation as pn, edge as pt, connectionIdentity as q, RemoteRequirements as qn, QueryRpc as qt, RemoteJsonAnswer as r, RemoteQueryError as rn, inspectRemote as rt, failureOf as s, WindowSchema as sn, Selection as st, Remote as t, RemoteMutationError as tn, visibleStore as tt, isFieldFailed as u, Query$1 as un, relationOf as ut, refreshedAt as v, schemaOf as vn, items as vt, windowGrowthKey as w, isFieldStale as wn, coalescedLayer as wt, remoteModelSchema as x, entityKey as xn, terminal as xt, remoteMessageCases as y, clearStale as yn, merge as yt, classifyLive as z, aliasedField as zn, Mutate as zt };
+export { pruneOverlays as $, relationAlias as $n, QueryRpc as $t, writeRead as A, emptyStore as An, coalescedLayer as At, windowKey as B, remove as Bn, LiveChange as Bt, remoteMessageCases as C, failMutation as Cn, isGapped as Ct, updateRemote as D, reconcileMutation as Dn, terminal as Dt, retentionRootsSchema as E, patchOfWrite as En, segment as Et, RemotePersistence as F, isFieldUnavailable as Fn, coalesceQueries as Ft, liveHasNext as G, writeEntity as Gn, Mutate as Gt, applyEntityEvent as H, setUnavailable as Hn, LiveRequirement as Ht, gc as I, isTombstone as In, coalesceReads as It, addLayer as J, RelationEntityAnnotation as Jn, NormalizedEntity as Jt, liveHasPrevious as K, RELATION_ALIAS as Kn, MutationRequest as Kt, reachable as L, markStale as Ln, requirementKey as Lt, remoteDataSchema as M, entry as Mn, liveEventOf as Mt, remoteErrorSchema as N, hasField as Nn, mutateRemote as Nt, windowGrowthKey as O, schemaOf as On, unknown as Ot, REMOTE_CACHE_VERSION as P, isFieldStale as Pn, remoteError as Pt, emptyOptimistic as Q, refsIn as Qn, QueryResult as Qt, deadlineOf as R, missingFields as Rn, ConnectionChangeSchema as Rt, refreshedAt as S, emptyMutationState as Sn, hasPrevious as St, remoteModelSchema as T, optimisticOfWrite as Tn, merge as Tt, classifyLive as U, tombstone as Un, MAX_FIELDS_PER_REQUEST as Ut, applyConnectionEvent as V, setStale as Vn, LiveEdge as Vt, emptyLiveState as W, writeEntities as Wn, MAX_RELATION_DEPTH as Wt, beginOptimistic as X, isRefPage as Xn, QueryEdge as Xt, addOverlay as Y, aliasedField as Yn, PageSize as Yt, connectionIdentity as Z, refParts as Zn, QueryRequest as Zt, isRemoteMessage as _, Query$1 as _n, unavailableOf as _t, RemoteJsonAnswer as a, RelationRequest as an, connectionsOf as ar, visibleStore as at, overlaysOf as b, Refusal as bn, emptyConnection as bt, emptyRefresh as c, RemoteMutationError as cn, belongsEncoded as ct, initialRemoteModel as d, RemoteReadError as dn, placeIn as dt, REMOTE_PROTOCOL_VERSION as en, relationShape as er, removeLayer as et, invalidateConnections as f, RemoteRpc as fn, Entity$1 as ft, isQueryLoading as g, IDENTITY_SEPARATOR as gn, relationOf as gt, isLoadingThrough as h, WireBoundary as hn, pageSchema as ht, liveFetch as i, ReadRequest as in, Requirement as ir, visibleItems as it, RemoteData as j, entityKey as jn, connectionChangeOf as jt, withRefreshRequested as k, clearStale as kn, RemoteClient as kt, failureOf as l, RemoteProtocolError as ln, matching as lt, isLoading as m, WindowSchema as mn, assemble as mt, RemoteUnsatisfied as n, ReadBatch as nn, RemoteConnections as nr, settleFailure as nt, RemoteJsonRequest as o, RemoteForbidden as on, requirementsOf as or, inspectEntity as ot, isFieldFailed as p, SettledFields as pn, Selection as pt, ConnectionChange as q, RelationAnnotation as qn, MutationResult as qt, httpWithLive as r, ReadBatchResult as rn, RemoteRequirements as rr, settleSuccess as rt, RemotePolicy as s, RemoteLiveError as sn, inspectRemote as st, Remote as t, Read as tn, targetsOf as tr, removeOverlay as tt, forgetRemote as u, RemoteQueryError as un, RowPlace as ut, noFailures as v, stableStringify as vn, cursor as vt, remoteMessageSchema as w, mutationStatus as wn, items as wt, refreshIsInFlight as x, beginMutation as xn, hasNext as xt, onlyOverlaid as y, Mutation as yn, edge as yt, plan as z, readField as zn, Live as zt };
 
-//# sourceMappingURL=src-9NIJGDTJ.mjs.map
+//# sourceMappingURL=src-CcPPtNuH.mjs.map