slopkit 0.2.0 → 0.4.0-rc.0

package/dist/sync.d.ts

@@ -27,6 +27,8 @@
  * - **A command id is never reused.** Each page load is a new client with its own numbers; commands loaded from an
  *   earlier page keep theirs.
  * - **Nothing is sent before it is kept.** An intent the device can't keep fails at once, visibly, and is never sent.
+ *   A push is journalled before it goes: its commands are kept as `sending` (one write per push), so a page that dies
+ *   mid-push leaves them uncertain on disk, and none goes unless that write lands.
  * - **Every command reaches an outcome, and is settled only once the replica holds its effects** (a receipt names the
  *   revision that made it visible; on a partial copy, only a pull reply that carried the receipt, with the rows it
  *   names, settles it); until then a pull is owed, and names the commands it waits on, any page's.
@@ -34,6 +36,16 @@
  *   to load or keep is said (the page goes on from the server meanwhile), and its late answer still counts: a slow
  *   write is not a failed one.
  * - **An intent belongs to the dataset it was made against**: the server refuses it against a replacement.
+ * - **A refusal proves only that attempt didn't act.** Only the kit's own error body is final; anything else may have
+ *   acted and leaves the command unknown, kept so. A command an attempt of which may have acted never becomes a final
+ *   failure: a refusal naming it parks it (never sent again, still named in pulls, done when a receipt comes). A schema
+ *   refusal naming one command of a push is that command's alone; the rest return to what they were and go again.
+ * - **A push fits the server's bounds**: at most `pushMax` commands and `pushBytes` bytes, oldest first, stopping at
+ *   the first command that doesn't fit. One too large even alone is answered at the tap and never kept; one already
+ *   kept is refused (or parked) and passed over, so it never strands the rest.
+ * - **The outbox is bounded across tabs.** The store admits a new command inside its own write transaction, from its
+ *   own count; one it has no room for is answered and never retained. Kept commands always update and are never
+ *   dropped for room.
  */
 import type { Failure } from "./contract.ts";
 import type { Schema } from "./schema.ts";
@@ -138,9 +150,16 @@ export type CommandState<O> = {
     kind: "queued";
 } | {
     kind: "sending";
-} | {
+}
+/**
+ * An attempt's outcome was lost: it may have acted. `parked`: the server refused it by name since, which proves only
+ * that attempt didn't act, so it is never sent again and waits on a pull to bring the receipt an earlier one left; it
+ * needs the person's attention meanwhile.
+ */
+ | {
     kind: "unknown";
     failure: string;
+    parked?: true;
 } | {
     kind: "done";
     outcome: O;
@@ -176,6 +195,22 @@ export type Connection = {
     kind: "incompatible";
     failure: string;
 };
+/**
+ * The outbox's room, as a closed subject for the app's state table: full when it holds `max` commands. `waiting`
+ * (unsent or unknown) needs a connection; `finished` (done, kept until dismissed) needs the person to dismiss them.
+ */
+export type OutboxState = {
+    kind: "ok";
+} | {
+    kind: "full";
+    waiting: number;
+    finished: number;
+    max: number;
+};
+/** The store's answer to a new command it had no room for: its own counts, across every tab. */
+export type OutboxFull = Extract<OutboxState, {
+    kind: "full";
+}>;
 /** This device's copy: fine, failing (writes are retried), or forgotten under this page by another tab. */
 export type Storage = {
     kind: "ok";
@@ -241,9 +276,21 @@ export type Model<T, S, C, O> = {
         kind: "pushing";
         client: string;
         ids: readonly number[];
+        /** Each command's state before this attempt, by position in `ids`: what a refusal restores. */
+        was: readonly CommandState<O>[];
         failures: number;
     };
     commands: readonly Pending<C, O>[];
+    /**
+     * The most commands the outbox admits, and the store's counts when it last refused one for room (it is shared with
+     * other tabs, whose commands this page doesn't hold); cleared once one is admitted or this page drops some.
+     */
+    outbox: {
+        max: number;
+        full: OutboxFull | null;
+    };
+    /** Where the next pull's list of waiting commands starts, when more wait than one pull names. */
+    asking: number;
     /** Commands (`client:id`) whose receipt came in a pull reply this copy applied, so with the rows it names. */
     carried: ReadonlySet<string>;
     /** Commands an earlier page kept that this version can't read: left on disk, and said. */
@@ -270,6 +317,8 @@ export type Msg<T, P, S, C, O> = {
     replica: Replica<T, S>;
     commands: Pending<C, O>[];
     unreadable: number;
+    /** The copy owes a real reset before it is trusted (lifted from an earlier release's row shapes). */
+    restart?: "paged";
     now: number;
 } | {
     type: "loadFailed";
@@ -299,6 +348,15 @@ export type Msg<T, P, S, C, O> = {
     failure: Failure;
     now: number;
 }
+/** A push's in-flight mark couldn't be kept, so it was never sent. */
+ | {
+    type: "unsent";
+    client: string;
+    ids: number[];
+    reason: string;
+    replaced: boolean;
+    now: number;
+}
 /**
  * The disk holds the replica at `revision` (perhaps newer than asked, from another tab); `whole: false` when it took
  * the patch as a delta under its own, other history.
@@ -326,6 +384,13 @@ export type Msg<T, P, S, C, O> = {
     reason: string;
     now: number;
 }
+/** The outbox had no room for a new command: it was not kept. */
+ | ({
+    type: "full";
+    client: string;
+    id: number;
+    now: number;
+} & Omit<OutboxFull, "kind">)
 /** Finished commands left the outbox (`failure` if not: they fade again on the next load). */
  | {
     type: "dropped";
@@ -407,9 +472,12 @@ export type Effect<T, S, C, O> = {
     }[];
 } | ({
     kind: "commit";
-} & Commit<T, S>) | {
+} & Commit<T, S>)
+/** Keep a command: a new one only while the outbox holds fewer than `max` (decided by the store). */
+ | {
     kind: "keep";
     pending: Pending<C, O>;
+    max: number;
 } | {
     kind: "drop";
     keys: {
@@ -450,6 +518,13 @@ export type Spec<T, P, S, C, O> = {
     resolved?: (pending: Pending<C, O>, model: Model<T, S, C, O>) => boolean;
     /** The most commands one push carries: the push endpoint's own bound. Default `PUSH_MAX`. */
     pushMax?: number;
+    /**
+     * The most UTF-8 bytes of one push request, encoded whole: the push endpoint's body limit (`serveWeb.bodyLimit`)
+     * must be at least this. Default `PUSH_BYTES`.
+     */
+    pushBytes?: number;
+    /** The most commands the device's outbox admits, shared by every tab. Default `OUTBOX_MAX`. */
+    outboxMax?: number;
 };
 /** The socket must be heard this often (the server pokes every 20 s); quieter, the page polls. */
 export declare const SOCKET_DEADLINE_MS = 45000;
@@ -459,8 +534,17 @@ export declare const POLL_MS = 4000;
 export declare const STORAGE_DEADLINE_MS = 3000;
 /** Commands per push unless the spec says otherwise; the rest wait for the next push. */
 export declare const PUSH_MAX = 50;
+/** UTF-8 bytes of one push request unless the spec says otherwise (48 KiB). */
+export declare const PUSH_BYTES = 49152;
+/** Commands the outbox admits unless the spec says otherwise; updates to kept ones always are. */
+export declare const OUTBOX_MAX = 500;
 /** Settled commands stay drawn this long. */
 export declare const DONE_KEEP_MS = 60000;
+/**
+ * Where the outbox stands: full once it holds `max` commands, by this page's count or, failing that, by the store's
+ * last refusal (other tabs' commands count too). Unreadable kept commands take room as well.
+ */
+export declare function deriveOutboxState<T, S, C, O>(model: Model<T, S, C, O>): OutboxState;
 /** Whether the server can be asked now. */
 export declare function reachable(connection: Connection): boolean;
 /**

package/dist/sync.js

@@ -144,8 +144,42 @@ const BACKOFF_MAX_MS = 30_000;
 export const STORAGE_DEADLINE_MS = 3000;
 /** Commands per push unless the spec says otherwise; the rest wait for the next push. */
 export const PUSH_MAX = 50;
+/** UTF-8 bytes of one push request unless the spec says otherwise (48 KiB). */
+export const PUSH_BYTES = 49_152;
+/** Commands the outbox admits unless the spec says otherwise; updates to kept ones always are. */
+export const OUTBOX_MAX = 500;
 /** Settled commands stay drawn this long. */
 export const DONE_KEEP_MS = 60_000;
+/** A string's length in UTF-8 bytes, as it goes on the wire. */
+function utf8(text) {
+    let bytes = 0;
+    // By code point: a surrogate pair is one character of four bytes, a lone surrogate encodes as three.
+    for (const char of text) {
+        const code = char.codePointAt(0) ?? 0;
+        bytes += code < 0x80 ? 1 : code < 0x8_00 ? 2 : code < 0x1_00_00 ? 3 : 4;
+    }
+    return bytes;
+}
+/** A push's bytes as `call` encodes it: this envelope, each command's bytes, and a comma between commands. */
+const envelope = (client, dataset, since) => utf8(JSON.stringify({ client, dataset, since, commands: [] }));
+const bytesOf = (pending) => utf8(JSON.stringify({ id: pending.id, command: pending.command }));
+/**
+ * Where the outbox stands: full once it holds `max` commands, by this page's count or, failing that, by the store's
+ * last refusal (other tabs' commands count too). Unreadable kept commands take room as well.
+ */
+export function deriveOutboxState(model) {
+    const finished = model.commands.filter((each) => each.state.kind === "done").length;
+    const waiting = model.commands.length - finished + model.unreadable;
+    if (waiting + finished >= model.outbox.max) {
+        return { kind: "full", waiting, finished, max: model.outbox.max };
+    }
+    return model.outbox.full ?? { kind: "ok" };
+}
+/** The command a push's schema path names (`request.commands[2].command.value` names 2), if it names one. */
+function commandAt(path) {
+    const found = /^request\.commands\[(\d+)\](?:$|[.[])/.exec(path ?? "");
+    return found?.[1] === undefined ? undefined : Number(found[1]);
+}
 /** Whether the server can be asked now. */
 export function reachable(connection) {
     return connection.kind === "live" || connection.kind === "stale";
@@ -249,7 +283,8 @@ function failedConnection(connection, failure) {
         case "signed-out": {
             return { kind: "signed-out" };
         }
-        case "invalid": {
+        case "invalid":
+        case "unreadable": {
             return { kind: "incompatible", failure: failure.message };
         }
         case "forbidden":
@@ -266,8 +301,16 @@ function failedConnection(connection, failure) {
 }
 export function createSync(spec) {
     const pushMax = spec.pushMax ?? PUSH_MAX;
-    if (!Number.isSafeInteger(pushMax) || pushMax < 1) {
-        throw new Error(`sync: pushMax must be a positive integer, got ${pushMax}`);
+    const pushBytes = spec.pushBytes ?? PUSH_BYTES;
+    const outboxMax = spec.outboxMax ?? OUTBOX_MAX;
+    for (const [name, value] of [
+        ["pushMax", pushMax],
+        ["pushBytes", pushBytes],
+        ["outboxMax", outboxMax],
+    ]) {
+        if (!Number.isSafeInteger(value) || value < 1) {
+            throw new Error(`sync: ${name} must be a positive integer, got ${value}`);
+        }
     }
     const emptyReplica = () => ({
         dataset: null,
@@ -300,6 +343,8 @@ export function createSync(spec) {
             pull: { kind: "idle", nextAt: now, failures: 0 },
             push: { kind: "idle", nextAt: now, failures: 0 },
             commands: [],
+            outbox: { max: outboxMax, full: null },
+            asking: 0,
             carried: new Set(),
             unreadable: 0,
             visible: true,
@@ -359,6 +404,39 @@ export function createSync(spec) {
         };
     }
     const ready = (model) => model.boot.kind === "ready";
+    const keep = (pending) => ({ kind: "keep", pending, max: outboxMax });
+    /** Waiting to be sent: queued, or unknown and not parked (asked again under its key). */
+    const sendable = (each) => each.state.kind === "queued" || (each.state.kind === "unknown" && each.state.parked !== true);
+    const tooLarge = (bytes) => `this is too large to send: ${bytes} bytes, where a push holds at most ${pushBytes}`;
+    /** A command that failed on the page: done with that outcome, never sent, and its kept intent dropped. */
+    function fail(pending, message, now) {
+        return {
+            ...pending,
+            at: now,
+            state: { kind: "done", outcome: spec.refused(pending.command, message), revision: 0 },
+        };
+    }
+    /**
+     * A command the server refused by name, or one too large to send: final if no attempt of it may have acted; else
+     * parked, since a refusal proves only that attempt didn't act. Kept either way, and passed over by every push.
+     */
+    function refuse(pending, doubt, message, now, effects) {
+        if (doubt) {
+            const parked = {
+                ...pending,
+                state: { kind: "unknown", failure: message, parked: true },
+            };
+            effects.push(keep(parked), {
+                kind: "telemetry",
+                name: "command.parked",
+                attributes: { reason: message },
+            });
+            return parked;
+        }
+        const done = fail(pending, message, now);
+        effects.push(keep(done), { kind: "answered", pending: done });
+        return done;
+    }
     /** Start what is due: the obligations are read off the model after every message, never remembered. */
     function schedule(model, effects) {
         let next = model;
@@ -379,14 +457,16 @@ export function createSync(spec) {
             const since = next.restart === null ? next.replica.revision : 0;
             if ((owed && (failures === 0 || due)) || (polling && due)) {
                 const current = next;
-                // Commands waiting on an outcome or on their effects, oldest first, at most a push's worth: their receipts
-                // come back with the rows they name; the rest in the next pull.
-                const commands = current.commands
+                // Commands waiting on an outcome or on their effects, at most a push's worth: their receipts come back with
+                // the rows they name. When more wait, each pull names the next ones round, so every one is asked about in
+                // turn (a parked command has no other way to settle).
+                const waiting = current.commands
                     .filter((each) => each.state.kind === "sending" ||
                     each.state.kind === "unknown" ||
                     (each.state.kind === "done" && !settled(current, each)))
-                    .slice(0, pushMax)
                     .map((each) => ({ client: each.client, id: each.id }));
+                const turn = waiting.length > pushMax ? current.asking % waiting.length : 0;
+                const commands = [...waiting.slice(turn), ...waiting.slice(0, turn)].slice(0, pushMax);
                 out.push({
                     kind: "pull",
                     client: next.client,
@@ -398,6 +478,7 @@ export function createSync(spec) {
                 });
                 next = {
                     ...next,
+                    asking: waiting.length > pushMax ? turn + pushMax : 0,
                     pull: { kind: "pulling", since, failures },
                     verify: verifying && next.verify.kind === "pending"
                         ? { kind: "requested", tries: next.verify.tries }
@@ -406,37 +487,64 @@ export function createSync(spec) {
             }
         }
         if (next.push.kind === "idle" && now >= next.push.nextAt && reachable(next.connection)) {
-            const first = next.commands.find((each) => each.state.kind === "queued" || each.state.kind === "unknown");
+            const tapped = (each) => each.since ?? next.replica.revision;
+            let first = next.commands.find(sendable);
+            // A kept command too large to send even alone (an older release kept it, or the bound was lowered) is refused,
+            // or parked if an attempt may have acted, and passed over: it never strands the commands behind it.
+            while (first !== undefined) {
+                const alone = envelope(first.client, first.dataset, tapped(first)) + bytesOf(first);
+                if (alone <= pushBytes) {
+                    break;
+                }
+                const large = first;
+                const told = [];
+                const withdrawn = refuse(large, large.state.kind === "unknown", tooLarge(alone), now, told);
+                out.push(...told);
+                next = {
+                    ...next,
+                    commands: next.commands.map((each) => (each === large ? withdrawn : each)),
+                };
+                first = next.commands.find(sendable);
+            }
             if (first !== undefined) {
                 // One push per client, dataset and tapped-against revision: the server judges each by what it was made on.
-                // At most `pushMax`, oldest first; the rest go in the next push.
-                const tapped = (each) => each.since ?? next.replica.revision;
-                const ids = new Set(next.commands
-                    .filter((each) => each.client === first.client &&
-                    each.dataset === first.dataset &&
-                    tapped(each) === tapped(first) &&
-                    (each.state.kind === "queued" || each.state.kind === "unknown"))
-                    .slice(0, pushMax)
-                    .map((each) => each.id));
-                const mine = (each) => each.client === first.client && ids.has(each.id);
+                // Oldest first, at most `pushMax` commands and `pushBytes` bytes: it stops at the first command that doesn't
+                // fit, never skipping ahead to a smaller one, and the rest go in the next push.
+                const lead = first;
+                const batch = [];
+                let bytes = envelope(lead.client, lead.dataset, tapped(lead));
+                for (const each of next.commands) {
+                    if (each.client !== lead.client ||
+                        each.dataset !== lead.dataset ||
+                        tapped(each) !== tapped(lead) ||
+                        !sendable(each)) {
+                        continue;
+                    }
+                    const size = bytesOf(each) + (batch.length > 0 ? 1 : 0);
+                    if (batch.length >= pushMax || bytes + size > pushBytes) {
+                        break;
+                    }
+                    bytes += size;
+                    batch.push(each);
+                }
+                const sent = new Set(batch);
                 out.push({
                     kind: "push",
-                    client: first.client,
-                    dataset: first.dataset,
-                    since: tapped(first),
-                    commands: next.commands
-                        .filter(mine)
-                        .map((each) => ({ id: each.id, command: each.command })),
+                    client: lead.client,
+                    dataset: lead.dataset,
+                    since: tapped(lead),
+                    commands: batch.map((each) => ({ id: each.id, command: each.command })),
                 });
                 next = {
                     ...next,
                     push: {
                         kind: "pushing",
-                        client: first.client,
-                        ids: [...ids],
+                        client: lead.client,
+                        ids: batch.map((each) => each.id),
+                        was: batch.map((each) => each.state),
                         failures: next.push.failures,
                     },
-                    commands: next.commands.map((each) => mine(each) ? { ...each, state: { kind: "sending" } } : each),
+                    commands: next.commands.map((each) => sent.has(each) ? { ...each, state: { kind: "sending" } } : each),
                 };
             }
         }
@@ -480,19 +588,16 @@ export function createSync(spec) {
                 at: model.now,
                 state: { kind: "done", outcome: receipt.outcome, revision: receipt.revision },
             };
-            effects.push({ kind: "keep", pending: done }, { kind: "answered", pending: done }, { kind: "telemetry", name: "command.done", attributes: { ms: model.now - each.at } });
+            effects.push(keep(done), { kind: "answered", pending: done }, { kind: "telemetry", name: "command.done", attributes: { ms: model.now - each.at } });
             return done;
         });
         const target = Math.max(model.target, ...receipts.map((each) => each.revision));
         return [{ ...model, commands, target }, effects];
     }
-    /** A command that failed on the page: done with that outcome, never sent, and its kept intent dropped. */
-    function fail(pending, message, now) {
-        return {
-            ...pending,
-            at: now,
-            state: { kind: "done", outcome: spec.refused(pending.command, message), revision: 0 },
-        };
+    /** Each command's state before the push in flight for `client`; unknown when this page can't tell. */
+    function prior(model, client) {
+        const pushing = model.push.kind === "pushing" && model.push.client === client ? model.push : null;
+        return (each) => pushing?.was[pushing.ids.indexOf(each.id)] ?? { kind: "unknown", failure: "sent before" };
     }
     function reduce(model, msg) {
         const now = msg.now;
@@ -530,6 +635,7 @@ export function createSync(spec) {
                         replica: msg.replica,
                         saved: { ...at.saved, dataset: msg.replica.dataset, revision: msg.replica.revision },
                         target: Math.max(at.target, msg.replica.revision),
+                        restart: msg.restart ?? at.restart,
                         commands: [...resumed, ...at.commands],
                         unreadable: msg.unreadable,
                     },
@@ -646,18 +752,19 @@ export function createSync(spec) {
                     const done = fail(each, each.state.kind === "unknown"
                         ? "the server's data was replaced; whether this ran before is unknown"
                         : "the server's data was replaced since this was tapped, so it wasn't sent", now);
-                    more.push({ kind: "keep", pending: done }, { kind: "answered", pending: done });
+                    more.push(keep(done), { kind: "answered", pending: done });
                     return done;
                 });
                 return [{ ...answered, commands: replaced }, [...effects, ...more]];
             }
             case "pullFailed": {
                 const failures = (at.pull.kind === "pulling" ? at.pull.failures : 0) + 1;
+                const wait = Math.max(backoff(failures), msg.failure.retryAfterMs ?? 0);
                 return [
                     {
                         ...at,
                         connection: failedConnection(at.connection, msg.failure),
-                        pull: { kind: "idle", nextAt: now + backoff(failures), failures },
+                        pull: { kind: "idle", nextAt: now + wait, failures },
                         verify: at.verify.kind === "requested"
                             ? { kind: "pending", tries: at.verify.tries }
                             : at.verify,
@@ -668,7 +775,8 @@ export function createSync(spec) {
             case "pushed": {
                 const ids = new Set(msg.ids);
                 const [answered, effects] = answer(at, msg.client, msg.receipts, ids);
-                // A command the reply has no receipt for is still acting elsewhere: asked again.
+                // A command the reply has no receipt for is still acting elsewhere: asked again. The disk holds its in-flight
+                // mark, so a reload knows it too.
                 const commands = answered.commands.map((each) => each.client === msg.client && ids.has(each.id) && each.state.kind === "sending"
                     ? { ...each, state: { kind: "unknown", failure: "the server is still on it" } }
                     : each);
@@ -684,34 +792,98 @@ export function createSync(spec) {
                 ];
             }
             case "pushFailed": {
-                // Refused before anything acted: final. Anything else may have acted (an unreadable reply included), so it is
-                // unknown and asked again under the same key, which answers with the first outcome.
-                const final = msg.failure.kind === "forbidden" || msg.failure.kind === "conflict";
+                const failure = msg.failure;
                 const ids = new Set(msg.ids);
+                const before = prior(at, msg.client);
                 const effects = [];
+                // The server's own refusal of a request it never ran (its schema is checked before the handler, and a handler
+                // never refuses after anything acted): this attempt didn't act, though an earlier one may have.
+                const refused = failure.refused === true &&
+                    (failure.kind === "invalid" ||
+                        failure.kind === "forbidden" ||
+                        failure.kind === "conflict");
+                // A schema refusal naming one of this push's commands is that command's alone.
+                const index = refused && failure.kind === "invalid" ? commandAt(failure.path) : undefined;
+                const named = index === undefined ? undefined : msg.ids[index];
                 const commands = at.commands.map((each) => {
-                    if (each.client !== msg.client || !ids.has(each.id) || each.state.kind === "done") {
+                    if (each.client !== msg.client || !ids.has(each.id) || each.state.kind !== "sending") {
                         return each;
                     }
-                    if (!final) {
-                        return { ...each, state: { kind: "unknown", failure: msg.failure.message } };
+                    const was = before(each);
+                    // An attempt whose outcome was lost may have acted: no later refusal makes it final.
+                    const doubt = was.kind === "unknown";
+                    if (named !== undefined) {
+                        return each.id === named
+                            ? refuse(each, doubt, failure.message, now, effects)
+                            : { ...each, state: was };
                     }
-                    const done = fail(each, msg.failure.message, now);
-                    effects.push({ kind: "keep", pending: done }, { kind: "answered", pending: done });
-                    return done;
+                    // A kit forbidden or conflict: nothing in this attempt acted. Final only for a command no attempt of which
+                    // may have acted.
+                    if (refused && failure.kind !== "invalid") {
+                        return doubt
+                            ? { ...each, state: was }
+                            : refuse(each, false, failure.message, now, effects);
+                    }
+                    // An envelope refusal (a page and server of different releases): nothing acted, and the page stops. The disk
+                    // holds the in-flight mark: a command never uncertain is kept as it was again.
+                    if (refused) {
+                        const restored = { ...each, state: was };
+                        if (!doubt) {
+                            effects.push(keep(restored));
+                        }
+                        return restored;
+                    }
+                    // Anything else may have acted (a lost reply, an unreadable one, a proxy's answer): asked again, same key.
+                    // The disk holds its in-flight mark.
+                    return { ...each, state: { kind: "unknown", failure: failure.message } };
                 });
-                const failures = (at.push.kind === "pushing" ? at.push.failures : 0) + 1;
+                const telemetry = {
+                    kind: "telemetry",
+                    name: "push.failed",
+                    attributes: {
+                        kind: failure.kind,
+                        refused: failure.refused === true,
+                        path: failure.path ?? null,
+                    },
+                };
+                const pushing = at.push.kind === "pushing" ? at.push.failures : 0;
+                // One command refused by name: the rest go again at once, without it.
+                if (named !== undefined) {
+                    return [
+                        { ...at, commands, push: { kind: "idle", nextAt: now, failures: pushing } },
+                        [...effects, telemetry],
+                    ];
+                }
+                const failures = pushing + 1;
                 return [
                     {
                         ...at,
                         commands,
-                        connection: failedConnection(at.connection, msg.failure),
+                        connection: failedConnection(at.connection, failure),
+                        push: {
+                            kind: "idle",
+                            nextAt: now + Math.max(backoff(failures), failure.retryAfterMs ?? 0),
+                            failures,
+                        },
+                    },
+                    [...effects, telemetry],
+                ];
+            }
+            case "unsent": {
+                // Never sent: each command is what it was before, and goes again once the disk keeps its mark.
+                const ids = new Set(msg.ids);
+                const before = prior(at, msg.client);
+                const failures = (at.push.kind === "pushing" ? at.push.failures : 0) + 1;
+                return [
+                    {
+                        ...at,
+                        commands: at.commands.map((each) => each.client === msg.client && ids.has(each.id) && each.state.kind === "sending"
+                            ? { ...each, state: before(each) }
+                            : each),
+                        storage: msg.replaced ? { kind: "replaced" } : { kind: "failed", reason: msg.reason },
                         push: { kind: "idle", nextAt: now + backoff(failures), failures },
                     },
-                    [
-                        ...effects,
-                        { kind: "telemetry", name: "push.failed", attributes: { kind: msg.failure.kind } },
-                    ],
+                    [{ kind: "telemetry", name: "push.unsent", attributes: { reason: msg.reason } }],
                 ];
             }
             case "committed": {
@@ -753,10 +925,50 @@ export function createSync(spec) {
                 ];
             }
             case "kept": {
-                const commands = at.commands.map((each) => each.client === msg.client && each.id === msg.id && each.state.kind === "saving"
-                    ? { ...each, state: { kind: "queued" } }
-                    : each);
-                return [{ ...at, commands, storage: working(at) }, []];
+                let admitted = false;
+                const commands = at.commands.map((each) => {
+                    if (each.client !== msg.client || each.id !== msg.id || each.state.kind !== "saving") {
+                        return each;
+                    }
+                    admitted = true;
+                    return { ...each, state: { kind: "queued" } };
+                });
+                return [
+                    {
+                        ...at,
+                        commands,
+                        storage: working(at),
+                        outbox: admitted ? { ...at.outbox, full: null } : at.outbox,
+                    },
+                    [],
+                ];
+            }
+            case "full": {
+                // Not a storage failure: the store answered, with no room. The tap is answered and not retained.
+                const gone = at.commands.find((each) => each.client === msg.client && each.id === msg.id && each.state.kind === "saving");
+                if (gone === undefined) {
+                    return [{ ...at, storage: working(at) }, []];
+                }
+                const refused = fail(gone, "this device's outbox is full, so it wasn't kept or sent", now);
+                return [
+                    {
+                        ...at,
+                        commands: at.commands.filter((each) => each !== gone),
+                        storage: working(at),
+                        outbox: {
+                            ...at.outbox,
+                            full: { kind: "full", waiting: msg.waiting, finished: msg.finished, max: msg.max },
+                        },
+                    },
+                    [
+                        { kind: "answered", pending: refused },
+                        {
+                            kind: "telemetry",
+                            name: "commands.full",
+                            attributes: { waiting: msg.waiting, finished: msg.finished, max: msg.max },
+                        },
+                    ],
+                ];
             }
             case "keepFailed": {
                 const effects = [
@@ -774,7 +986,7 @@ export function createSync(spec) {
             }
             case "dropped": {
                 if (msg.failure === null) {
-                    return [{ ...at, storage: working(at) }, []];
+                    return [{ ...at, storage: working(at), outbox: { ...at.outbox, full: null } }, []];
                 }
                 return [
                     {
@@ -871,9 +1083,15 @@ export function createSync(spec) {
                 if (joined) {
                     return [at, []];
                 }
+                // A tap no push could carry is answered now, never kept.
+                const alone = envelope(at.client, pending.dataset, at.replica.revision) + bytesOf(pending);
+                if (alone > pushBytes) {
+                    return [numbered, [{ kind: "answered", pending: fail(pending, tooLarge(alone), now) }]];
+                }
+                // Admitted by the store, inside the keep's own transaction: a full outbox answers `full`, and the tap goes.
                 return [
                     { ...numbered, commands: [...at.commands, pending] },
-                    [{ kind: "keep", pending: { ...pending, state: { kind: "queued" } } }],
+                    [keep({ ...pending, state: { kind: "queued" } })],
                 ];
             }
             case "dismiss": {