statewire 0.23.0 → 0.24.1

package/src/client/session.ts

@@ -2,6 +2,7 @@ import { encodeContext } from "../wire/context";
 import { wrapStorageError } from "./storageError";
 import {
   DEFAULT_PROTOCOL,
+  GAP_FILL_VERSION,
   WIRE_VERSION,
   protocolOffers,
   inRange,
@@ -52,13 +53,11 @@ type Invocation = {
   -readonly [K in keyof CommandsInvocation]: CommandsInvocation[K];
 };
 
-type Hold = StatewireClient.OutboxCommand["hold"];
-
 type Pending = {
   readonly id: string;
   /** Unset while in the outbox, or while another sharer owns its stamp. */
   seq: number | undefined;
-  readonly command: WireCommand;
+  command: WireCommand;
   readonly inv: Invocation;
   /** Enqueued by another sharer: this client holds no promise for it. */
   readonly adopted: boolean;
@@ -96,6 +95,8 @@ export type StatewireSessionOptions = StatewireProtocol.Options & {
   context?: Readonly<Record<string, Statewire.Context>>;
   sessionStore?: StatewireClient.SessionStorage | undefined;
   onSessionLost?: StatewireClient.OnSessionLost | undefined;
+  onDeprecatedPath?: StatewireClient.OnDeprecatedPath | undefined;
+  onSettled?: StatewireClient.OnSettled | undefined;
   onFlush?: StatewireClient.OnFlush | undefined;
   canOvertake?:
     | Readonly<Record<string, StatewireClient.CanOvertake>>
@@ -107,18 +108,35 @@ type Shared = {
   txq: Promise<void>;
   syncQueued: boolean;
   parked: { protocol: string; verdict: StatewireClient.SessionVerdict }[];
+  /** Own commands settled since the last backlog sync: verdicts parked for them are moot. */
+  settled: Set<string>;
+  /** Settled updates waiting for the next backlog sync. */
+  notices: Notice[];
+  /** A locked transaction is running its mutation. */
+  inTx: boolean;
   unsubscribe: (() => void) | null;
   /** Owners whose departure this sharer awaits. */
   watched: Set<string>;
   abort: AbortController | null;
 };
 
+type Patch = {
+  held?: boolean;
+  localMeta?: { value: unknown };
+  params?: readonly unknown[];
+};
+
 type Flushing = {
   ids: ReadonlySet<string>;
-  held: Map<string, NonNullable<Hold>>;
+  patches: Map<string, Patch>;
   removed: Set<string>;
 };
 
+type Waiter = {
+  resolve: (payload: unknown) => void;
+  reject: (error: unknown) => void;
+};
+
 type Session = {
   options: StatewireSessionOptions;
   configuredContext: StatewireSessionOptions["context"];
@@ -147,8 +165,16 @@ type Session = {
   resumeAt: number;
   idle: boolean;
   onSessionLost: StatewireClient.OnSessionLost | undefined;
+  onDeprecatedPath: StatewireClient.OnDeprecatedPath | undefined;
+  onSettled: StatewireClient.OnSettled | undefined;
   onFlush: StatewireClient.OnFlush | undefined;
   onDone: (() => void) | undefined;
+  /** `outbox.release` promises by entry id. */
+  releases: Map<string, Waiter[]>;
+  delivering: boolean;
+  /** Notices whose handler threw on this mount. */
+  skipped: Set<string>;
+  views: WeakMap<object, StatewireClient.OutboxEntry>;
   /** Outbox and stamped ids stored before this client mounted. */
   mountIds: Set<string>;
   flushing: Flushing | null;
@@ -157,9 +183,11 @@ type Session = {
   lanesOnAttach: boolean;
   attachEntries: ReadonlySet<Pending>;
   frameFailures: number;
+  /** A later hello decides stamps this one could not: another live sharer's stamp sat below them. */
+  recheck: ReturnType<typeof setTimeout> | undefined;
+  /** Hellos in a row that left stamps waiting at the same watermarks: the recheck backs off. */
+  rechecks: { watermarks: string; count: number };
   pending: Pending[];
-  failedList: readonly StatewireClient.FailedCommand[];
-  failedParts: readonly (readonly StatewireClient.FailedCommand[])[];
   canonical: unknown;
   documentListeners: Set<() => void>;
   documents: StatewireDocuments.State;
@@ -225,11 +253,12 @@ type RemovalMark = NonNullable<StatewireClient.SessionLane["removed"]>[number];
 const marks = (
   s: Session,
   lane: StatewireClient.SessionLane,
-  removed: readonly StatewireClient.OutboxCommand[],
+  removed: readonly { id: string; by?: string | undefined }[],
+  failure?: StatewireClient.SendFailure,
 ): { removed?: readonly RemovalMark[] } => {
   const added = removed
     .filter((c) => c.by !== undefined && c.by !== s.store.owner?.id)
-    .map((c) => ({ id: c.id, by: c.by! }));
+    .map((c) => ({ id: c.id, by: c.by!, ...(failure && { failure }) }));
   const next = [...(lane.removed ?? []), ...added];
   return next.length > 0 ? { removed: next } : {};
 };
@@ -244,15 +273,12 @@ const withOutbox = (
 
 const outboxOf = (lane: StatewireClient.SessionLane) => lane.outbox ?? [];
 
-const sameHold = (a: Hold, b: Hold) =>
-  a === b || JSON.stringify(a) === JSON.stringify(b);
-
 const changed = (s: Session, p: Pending) => s.lifecycle?.onChange?.(p.inv);
 
 const stamp = (s: Session, p: Pending, seq: number) => {
   p.seq = seq;
   p.inv.seq = seq;
-  delete p.inv.hold;
+  delete p.inv.held;
   p.away = false;
   p.attempted = false;
   p.posted = false;
@@ -268,13 +294,41 @@ const unstamp = (s: Session, p: Pending) => {
   changed(s, p);
 };
 
-const setHold = (s: Session, p: Pending, hold: Hold) => {
-  if (sameHold(p.inv.hold, hold)) return;
-  if (hold === undefined) delete p.inv.hold;
-  else p.inv.hold = hold;
-  changed(s, p);
+// The pending invocation follows its stored entry: hold, local meta, params.
+const follow = (
+  s: Session,
+  p: Pending,
+  stored: StatewireClient.OutboxCommand,
+) => {
+  let dirty = false;
+  if ((p.inv.held === true) !== (stored.held === true)) {
+    if (stored.held) p.inv.held = true;
+    else delete p.inv.held;
+    dirty = true;
+  }
+  if (p.inv.localMeta !== stored.localMeta) {
+    if (stored.localMeta === undefined) delete p.inv.localMeta;
+    else p.inv.localMeta = stored.localMeta;
+    dirty = true;
+  }
+  if (p.command.params !== stored.params) {
+    p.command = {
+      ...p.command,
+      params: stored.params,
+      ...(stored.meta === undefined ? {} : { meta: stored.meta }),
+    };
+    if (stored.meta === undefined) delete p.command.meta;
+    p.inv.params = paramsOf(stored);
+    dirty = true;
+  }
+  if (dirty) changed(s, p);
 };
 
+const paramsOf = (stored: { params: unknown[]; meta?: unknown }) =>
+  stored.meta === undefined
+    ? stored.params
+    : (reviveValue(structuredClone(stored.params), stored.meta) as unknown[]);
+
 const dropPending = (s: Session, p: Pending) => {
   s.pending = s.pending.filter((q) => q !== p);
   s.lifecycle?.onCovered?.(p.inv);
@@ -319,11 +373,13 @@ const setRecord = (s: Session, record: StatewireClient.SessionRecord) => {
     try {
       s.store.save(record);
     } catch (cause) {
+      if (isQuota(cause)) throw cause;
       storageFailed(s, cause);
       throw s.storageError;
     }
   }
   s.record = record;
+  s.notify();
 };
 
 const toOutbox = (p: Pending): StatewireClient.OutboxCommand => {
@@ -333,7 +389,8 @@ const toOutbox = (p: Pending): StatewireClient.OutboxCommand => {
     ...command,
     ts: p.inv.ts,
     ...(p.by !== undefined && { by: p.by }),
-    ...(p.inv.hold !== undefined && { hold: p.inv.hold }),
+    ...(p.inv.held && { held: true as const }),
+    ...(p.inv.localMeta !== undefined && { localMeta: p.inv.localMeta }),
   };
 };
 
@@ -346,6 +403,7 @@ const toStored = (s: Session, p: Stamped): StatewireClient.SessionCommand => {
     ...(p.by !== undefined && { by: p.by }),
     ...command,
     ts: p.inv.ts,
+    ...(p.inv.localMeta !== undefined && { localMeta: p.inv.localMeta }),
   };
 };
 
@@ -383,7 +441,11 @@ const MAX_PARKED_VERDICTS = 64;
 // Storage holds what a reload must resend: a command leaves at its dur, at a
 // server verdict, or at a record reset — never at a local channel death.
 const syncBacklogInner = (s: Session) => {
+  if (s.shared && s.shared.notices.length > 0)
+    noticeInner(s, s.shared.notices.splice(0));
   const parked = s.shared ? s.shared.parked.splice(0) : [];
+  const settled = s.shared ? new Set(s.shared.settled) : new Set<string>();
+  if (s.shared) s.shared.settled.clear();
   let lanes = s.record.lanes;
   for (const protocol of durableLanes(s)) {
     const lane = laneOf(s.record, protocol);
@@ -391,18 +453,23 @@ const syncBacklogInner = (s: Session) => {
     // stamp; the enqueuer finds the verdict by that id.
     const parkedHere = parked
       .filter((v) => v.protocol === protocol)
-      .map(({ verdict }) => {
+      .flatMap(({ verdict }) => {
         const id =
           verdict.id ?? lane.commands.find((c) => c.seq === verdict.seq)?.id;
-        return id === undefined ? verdict : { ...verdict, id };
+        // No stamp left to map it: its owner already settled the command.
+        if (id === undefined || settled.has(id)) return [];
+        return [{ ...verdict, id }];
       });
     const parkedSeqs = new Set(parkedHere.map((v) => v.seq));
     const commands = mergeBacklog(s, protocol).filter(
       (c) => !parkedSeqs.has(c.seq),
     );
+    const kept = (lane.verdicts ?? []).filter(
+      (v) => v.id === undefined || !settled.has(v.id),
+    );
     const verdicts =
-      parkedHere.length > 0
-        ? [...(lane.verdicts ?? []), ...parkedHere].slice(-MAX_PARKED_VERDICTS)
+      parkedHere.length > 0 || kept.length !== (lane.verdicts ?? []).length
+        ? [...kept, ...parkedHere].slice(-MAX_PARKED_VERDICTS)
         : lane.verdicts;
     const unchanged =
       verdicts === lane.verdicts &&
@@ -443,8 +510,14 @@ const transact = (s: Session, fn: () => void): Promise<void> => {
   const shared = s.shared;
   const run = shared.txq.then(() =>
     s.store.lock!(async () => {
-      refresh(s);
-      fn();
+      const stored = await readStored(s);
+      shared.inTx = true;
+      try {
+        refresh(s, stored);
+        fn();
+      } finally {
+        shared.inTx = false;
+      }
       watchOwners(s);
       s.notify();
       const persistence = s.store.flush?.();
@@ -462,16 +535,19 @@ const transact = (s: Session, fn: () => void): Promise<void> => {
   return result;
 };
 
+const readStored = async (s: Session) =>
+  s.store.read ? await s.store.read() : s.store.load();
+
 // Under the lock: the stored record is the truth about which sharer stamped
 // what; this client's entries follow it by id.
-const refresh = (s: Session) => {
-  const stored = s.store.load();
+const refresh = (s: Session, stored: StatewireClient.SessionRecord | null) => {
   if (stored !== null && stored.clientId !== s.record.clientId) {
     adoptReset(s, stored);
     return;
   }
-  if (stored !== null) s.record = boundRecord(stored);
+  if (stored !== null) s.record = boundInbox(s.store, stored);
   reconcileLocal(s);
+  followReleases(s);
 };
 
 const reconcileLocal = (s: Session) => {
@@ -490,7 +566,7 @@ const reconcileLocal = (s: Session) => {
         }
         unstamp(s, p);
       }
-      setHold(s, p, queued.hold);
+      follow(s, p, queued);
     } else if (stamped && stamped.owner !== me) {
       if (p.adopted) dropPending(s, p);
       else if (!p.away) {
@@ -499,14 +575,24 @@ const reconcileLocal = (s: Session) => {
       }
     } else if (stamped) {
       if (p.seq !== stamped.seq) stamp(s, p, stamped.seq);
-    } else if (isOutboxed(p)) {
-      if (!lane.removed?.some((m) => m.id === p.id)) {
+    } else if (!p.adopted && (isOutboxed(p) || p.away)) {
+      const mark = lane.removed?.find((m) => m.id === p.id);
+      if (mark === undefined) {
         p.away = true;
         continue;
       }
-      settleRemoved(s, p);
+      s.lifecycle?.onCovered?.(p.inv);
+      settleEntry(
+        s,
+        p,
+        {
+          ok: false,
+          failure: mark.failure ?? { fate: "aborted", cause: "removed" },
+        },
+        mark.failure ? "noticed" : "memory",
+      );
       const { removed: _removed, ...rest } = lane;
-      const left = lane.removed.filter((m) => m.id !== p.id);
+      const left = lane.removed!.filter((m) => m.id !== p.id);
       setRecord(
         s,
         withLane(s.record, protocol, {
@@ -518,6 +604,73 @@ const reconcileLocal = (s: Session) => {
   }
 };
 
+const locate = (
+  s: Session,
+  id: string,
+):
+  | { protocol: string; stored: StatewireClient.OutboxCommand }
+  | { protocol: string; stored?: undefined }
+  | undefined => {
+  for (const [protocol, lane] of Object.entries(s.record.lanes)) {
+    const stored = outboxOf(lane).find((c) => c.id === id);
+    if (stored) return { protocol, stored };
+    if (lane.commands.some((c) => c.id === id)) return { protocol };
+  }
+  const p = s.pending.find((q) => q.id === id);
+  if (p === undefined) return undefined;
+  return isOutboxed(p) && isEphemeral(s, p.command.protocol)
+    ? { protocol: p.command.protocol, stored: toOutbox(p) }
+    : { protocol: p.command.protocol };
+};
+
+const settleReleases = (
+  s: Session,
+  id: string,
+  outcome:
+    | { ok: true; payload: unknown }
+    | { ok: false; failure: StatewireClient.SendFailure },
+) => {
+  const waiters = s.releases.get(id);
+  if (waiters === undefined) return;
+  s.releases.delete(id);
+  for (const waiter of waiters) {
+    if (outcome.ok) waiter.resolve(outcome.payload);
+    else waiter.reject(new StatewireSendError(outcome.failure));
+  }
+};
+
+// A release whose command another sharer settled: the record shows only that
+// it left, failed (a notice) or was taken unsent (a mark).
+const followReleases = (s: Session) => {
+  for (const id of [...s.releases.keys()]) {
+    if (locate(s, id) !== undefined) continue;
+    const lanes = Object.values(s.record.lanes);
+    const notice = lanes
+      .flatMap((lane) => lane.inbox ?? [])
+      .find((n) => n.id === id);
+    const mark = lanes
+      .flatMap((lane) => lane.removed ?? [])
+      .find((m) => m.id === id);
+    const failure = notice?.failure ?? mark?.failure;
+    settleReleases(
+      s,
+      id,
+      failure
+        ? { ok: false, failure }
+        : {
+            ok: true,
+            payload:
+              notice?.result === undefined
+                ? undefined
+                : paramsOf({
+                    params: notice.result.value,
+                    meta: notice.result.meta,
+                  })[0],
+          },
+    );
+  }
+};
+
 // A sharer that stamped commands and left: once its owner lock frees,
 // another sharer takes its stamps over and reattaches, so the hello's
 // watermark settles them.
@@ -659,113 +812,159 @@ const cover = (s: Session, entry: Pending) => {
   s.lifecycle?.onCovered?.(entry.inv);
 };
 
-export const failedCommands = (
-  s: Session,
-): readonly StatewireClient.FailedCommand[] => {
-  const parts = Object.values(s.record.lanes).flatMap((lane) =>
-    lane.failed === undefined ? [] : [lane.failed],
-  );
-  const same =
-    parts.length === s.failedParts.length &&
-    parts.every((part, i) => part === s.failedParts[i]);
-  if (!same) {
-    s.failedParts = parts;
-    s.failedList = parts.flat();
-  }
-  return s.failedList;
-};
+export const MAX_INBOX = 256;
 
-export const MAX_FAILED_RETAINED = 256;
+type Outcome =
+  | { ok: true; payload: unknown }
+  | { ok: false; failure: StatewireClient.SendFailure };
 
-const boundFailed = (failed: readonly StatewireClient.FailedCommand[]) =>
-  failed.length > MAX_FAILED_RETAINED
-    ? [...failed].sort((a, b) => a.ts - b.ts).slice(-MAX_FAILED_RETAINED)
-    : failed;
+const updateOf = (
+  protocol: string,
+  stored: StatewireClient.StoredSettled,
+): Statewire.CommandUpdate => ({
+  protocol,
+  id: stored.id,
+  method: stored.method,
+  params: paramsOf(stored) as never[],
+  ...(stored.seq !== undefined && { seq: stored.seq }),
+  status: "settled",
+  ...(stored.result !== undefined && {
+    result: paramsOf({
+      params: stored.result.value,
+      meta: stored.result.meta,
+    })[0],
+  }),
+  ...(stored.failure !== undefined && { failure: stored.failure }),
+  ...(stored.localMeta !== undefined && { localMeta: stored.localMeta }),
+});
 
-const boundRecord = (record: StatewireClient.SessionRecord) => {
+// The inbox keeps the newest notices; the rest are reported as evicted.
+const boundInbox = (
+  store: StatewireClient.SessionStorage,
+  record: StatewireClient.SessionRecord,
+): StatewireClient.SessionRecord => {
   let lanes = record.lanes;
+  const dropped: Statewire.CommandUpdate[] = [];
   for (const [protocol, lane] of Object.entries(lanes)) {
-    if (lane.failed !== undefined && lane.failed.length > MAX_FAILED_RETAINED)
-      lanes = {
-        ...lanes,
-        [protocol]: { ...lane, failed: boundFailed(lane.failed) },
-      };
+    const inbox = lane.inbox;
+    if (inbox === undefined || inbox.length <= MAX_INBOX) continue;
+    const sorted = [...inbox].sort((x, y) => x.ts - y.ts);
+    const cut = sorted.length - MAX_INBOX;
+    dropped.push(...sorted.slice(0, cut).map((n) => updateOf(protocol, n)));
+    lanes = { ...lanes, [protocol]: { ...lane, inbox: sorted.slice(cut) } };
   }
+  if (dropped.length > 0) store.onEvict?.({ reason: "inbox", dropped });
   return lanes === record.lanes ? record : { ...record, lanes };
 };
 
-const retainFailedInner = (
-  s: Session,
-  entry: Stamped,
-  failure: StatewireClient.SendFailure,
-) => {
-  const lane = laneOf(s.record, entry.command.protocol);
-  setRecord(
-    s,
-    withLane(s.record, entry.command.protocol, {
-      ...lane,
-      failed: boundFailed([
-        ...(lane.failed ?? []),
-        {
-          protocol: entry.command.protocol,
-          ...(entry.command.produced !== undefined && {
-            produced: entry.command.produced,
-          }),
-          command: entry.command.method,
-          params: entry.command.params,
-          ...(entry.command.meta !== undefined && { meta: entry.command.meta }),
-          failure,
-          ts: entry.inv.ts,
-          seq: entry.seq,
-        },
-      ]),
+const toNotice = (
+  stored: Omit<StatewireClient.SessionCommand, "seq"> & { seq?: number },
+  outcome: Outcome,
+): StatewireClient.StoredSettled => {
+  const result = outcome.ok
+    ? encodeParams(outcome.payload === undefined ? [] : [outcome.payload])
+    : undefined;
+  return {
+    id: stored.id,
+    method: stored.method,
+    params: stored.params,
+    ...(stored.meta !== undefined && { meta: stored.meta }),
+    ts: stored.ts,
+    ...(stored.seq !== undefined && { seq: stored.seq }),
+    ...(stored.localMeta !== undefined && { localMeta: stored.localMeta }),
+    ...(result !== undefined && {
+      result: {
+        value: result.params,
+        ...(result.meta !== undefined && { meta: result.meta }),
+      },
     }),
-  );
-  s.notify();
+    ...(!outcome.ok && { failure: outcome.failure }),
+  };
 };
 
-const retainFailed = (
-  s: Session,
-  entry: Stamped,
-  failure: StatewireClient.SendFailure,
-) => {
-  if (!s.shared) {
-    retainFailedInner(s, entry, failure);
+const lostNotice = (
+  stored: Omit<StatewireClient.SessionCommand, "seq"> & { seq?: number },
+) => toNotice(stored, { ok: false, failure: LOST });
+
+const LOST = { fate: "lost", cause: "session-lost" } as const;
+
+const withNotices = (
+  lane: StatewireClient.SessionLane,
+  notices: readonly StatewireClient.StoredSettled[],
+): StatewireClient.SessionLane => {
+  const known = new Set((lane.inbox ?? []).map((n) => n.id));
+  const added = notices.filter((n) => !known.has(n.id));
+  return added.length === 0
+    ? lane
+    : { ...lane, inbox: [...(lane.inbox ?? []), ...added] };
+};
+
+// The settled update lands in the same write that drops the stamp: a reload
+// either resends the command or delivers the update.
+type Notice = { entry: Stamped; outcome: Outcome };
+
+const noticeInner = (s: Session, notices: readonly Notice[]) => {
+  let record = s.record;
+  for (const { entry, outcome } of notices) {
+    const protocol = entry.command.protocol;
+    const lane = laneOf(record, protocol);
+    record = withLane(record, protocol, {
+      ...withNotices(lane, [toNotice(toStored(s, entry), outcome)]),
+      commands: lane.commands.filter((c) => c.id !== entry.id),
+    });
+  }
+  setRecord(s, boundInbox(s.store, record));
+  deliver(s);
+};
+
+// Shared storage: the update rides the next backlog sync's locked write.
+const notice = (s: Session, entry: Stamped, outcome: Outcome) => {
+  if (!s.shared || s.shared.inTx) {
+    noticeInner(s, [{ entry, outcome }]);
     return;
   }
-  transactBackground(s, () => retainFailedInner(s, entry, failure));
+  s.shared.notices.push({ entry, outcome });
+  syncBacklog(s);
 };
 
+/**
+ * "notice": a stamped durable command persists its settled update; "noticed":
+ * the caller already did; "memory": the update is best-effort only.
+ */
+type SettleMode = "notice" | "noticed" | "memory";
+
 const settleEntry = (
   s: Session,
   entry: Pending,
-  outcome:
-    | { ok: true; payload: unknown }
-    | { ok: false; failure: StatewireClient.SendFailure },
+  outcome: Outcome,
+  mode: SettleMode = "notice",
 ) => {
   s.pending = s.pending.filter((p) => p !== entry);
+  if (s.shared && !entry.adopted) s.shared.settled.add(entry.id);
+  settleReleases(s, entry.id, outcome);
+  // The record keeps every unsettled command for the next attach; only a
+  // command it no longer owns becomes a durable settled update.
+  const durable =
+    mode === "noticed" ||
+    (mode === "notice" &&
+      (outcome.ok || outcome.failure.cause !== "unmount") &&
+      isStamped(entry) &&
+      !isEphemeral(s, entry.command.protocol));
+  if (durable && mode === "notice") notice(s, entry as Stamped, outcome);
   if (outcome.ok) {
     entry.resolve(outcome.payload);
-    s.lifecycle?.onSettle(entry.inv, {
-      type: "accepted",
-      payload: outcome.payload,
-    });
+    s.lifecycle?.onSettle(
+      entry.inv,
+      { type: "accepted", payload: outcome.payload },
+      durable,
+    );
   } else {
-    // The record keeps every unsettled command for the next attach; only
-    // invocations it no longer owns become failed history.
-    const rides = outcome.failure.cause === "unmount";
-    if (
-      !rides &&
-      isStamped(entry) &&
-      !entry.adopted &&
-      !isEphemeral(s, entry.command.protocol)
-    )
-      retainFailed(s, entry, outcome.failure);
     entry.reject(new StatewireSendError(outcome.failure));
-    s.lifecycle?.onSettle(entry.inv, {
-      type: "rejected",
-      error: new StatewireSendError(outcome.failure),
-    });
+    s.lifecycle?.onSettle(
+      entry.inv,
+      { type: "rejected", error: new StatewireSendError(outcome.failure) },
+      durable,
+    );
   }
 };
 
@@ -817,14 +1016,10 @@ const settleRemoved = (s: Session, entry: Pending) => {
 const requeue = (s: Session, survivors: Pending[]) => {
   for (const old of survivors) {
     s.lifecycle?.onCovered?.(old.inv);
-    enqueueInner(
-      s,
-      old.command,
-      old.inv.params,
-      old.resolve,
-      old.reject,
-      old.inv.hold,
-    );
+    enqueueInner(s, old.command, old.inv.params, old.resolve, old.reject, {
+      ...(old.inv.held && { hold: true }),
+      ...(old.inv.localMeta !== undefined && { localMeta: old.inv.localMeta }),
+    });
   }
 };
 
@@ -842,22 +1037,14 @@ const rebaseRecord = (s: Session, adopt: () => void) => {
   for (const p of s.pending) if (p.adopted) s.lifecycle?.onCovered?.(p.inv);
   s.pending = [];
   s.durableSeq = {};
-  // Failed entries are user-owned history: they ride through every record replacement.
+  // Failure notices ride through every record replacement.
   const previous = s.record.lanes;
   adopt();
   let lanes = s.record.lanes;
   for (const [protocol, lane] of Object.entries(previous)) {
-    const failed = lane.failed;
-    if (failed === undefined || laneOf(s.record, protocol).failed === failed)
-      continue;
-    const current = laneOf(s.record, protocol);
-    lanes = {
-      ...lanes,
-      [protocol]: {
-        ...current,
-        failed: boundFailed([...(current.failed ?? []), ...failed]),
-      },
-    };
+    const current = laneOf({ ...s.record, lanes }, protocol);
+    if (!lane.inbox?.length || current.inbox === lane.inbox) continue;
+    lanes = { ...lanes, [protocol]: withNotices(current, lane.inbox) };
   }
   if (lanes !== s.record.lanes) setRecord(s, { ...s.record, lanes });
   requeue(s, survivors);
@@ -873,7 +1060,7 @@ const resetRecord = (s: Session, clientId: string) =>
 // attempted history and our survivors re-stamp on the stored clocks.
 const adoptReset = (s: Session, stored: StatewireClient.SessionRecord) => {
   rebaseRecord(s, () => {
-    s.record = boundRecord(stored);
+    s.record = boundInbox(s.store, stored);
   });
   // The host attributes frames by lease, and the lease is bound to the id
   // this attach was opened with.
@@ -1090,21 +1277,11 @@ const publishIngested = (s: Session) => {
 // watermark+1 proves the record that admitted the missing prefix is gone —
 // its history settles lost and the lane clock restarts at the watermark.
 const sessionLostInner = (s: Session, protocol: string, seqWm: number) => {
+  const lane = laneOf(s.record, protocol);
+  const failure = { fate: "lost", cause: "session-lost" } as const;
   const held = laneEntries(s, protocol);
-  settleLost(s, held);
   s.durableSeq[protocol] = seqWm;
-  const { failed, outbox, removed } = laneOf(s.record, protocol);
-  setRecord(
-    s,
-    withLane(s.record, protocol, {
-      nextSeq: seqWm + 1,
-      commands: [],
-      ...(outbox !== undefined && { outbox }),
-      ...(removed !== undefined && { removed }),
-      ...(failed !== undefined && { failed }),
-    }),
-  );
-  if (
+  const requeue =
     held.length > 0 &&
     s.onSessionLost?.(
       held.map((p) => ({
@@ -1115,30 +1292,85 @@ const sessionLostInner = (s: Session, protocol: string, seqWm: number) => {
         seq: p.seq,
         ...(p.inv.clientId !== undefined && { clientId: p.inv.clientId }),
       })),
-    ) === "requeue"
-  ) {
-    for (const old of held) {
+    ) === "requeue";
+  if (requeue) {
+    if (s.onDeprecatedPath)
+      s.onDeprecatedPath({ kind: "session-lost-requeue", count: held.length });
+    else
+      console.warn(
+        `statewire: onSessionLost "requeue" re-enqueued ${held.length} commands; it is deprecated and will be removed`,
+      );
+    for (const p of held) {
+      s.lifecycle?.onCovered?.(p.inv);
+      settleEntry(s, p, { ok: false, failure }, "memory");
+    }
+    setRecord(
+      s,
+      withLane(s.record, protocol, {
+        ...lane,
+        nextSeq: seqWm + 1,
+        commands: [],
+      }),
+    );
+    for (const old of held)
       enqueueInner(
         s,
         old.command,
         old.inv.params,
         () => {},
         () => {},
+        {
+          ...(old.inv.localMeta !== undefined && {
+            localMeta: old.inv.localMeta,
+          }),
+        },
       );
+  } else {
+    // Default: the whole queue goes, each command a failure notice.
+    const stamps = mergeBacklog(s, protocol);
+    const queued = outboxOf(lane);
+    const { outbox: _outbox, ...rest } = lane;
+    setRecord(
+      s,
+      withLane(s.record, protocol, {
+        ...withNotices(rest, [
+          ...stamps.map((c) => lostNotice(c)),
+          ...queued.map((c) => lostNotice(c)),
+        ]),
+        nextSeq: seqWm + 1,
+        commands: [],
+        ...marks(
+          s,
+          lane,
+          [
+            ...stamps.map((c) => ({ id: c.id, by: c.by ?? c.owner })),
+            ...queued,
+          ],
+          failure,
+        ),
+      }),
+    );
+    for (const p of s.pending.filter((q) => q.command.protocol === protocol)) {
+      s.lifecycle?.onCovered?.(p.inv);
+      settleEntry(s, p, { ok: false, failure }, "noticed");
     }
+    deliver(s);
   }
   publish(s);
   wake(s);
 };
 
-// Every stamp above the watermark, whichever sharer made it, returns to the
-// front of the outbox. A stamp past watermark+1, or one this client saw
-// admitted, proves the server record that admitted it is gone.
+// Every stamp above the watermark returns to the front of the outbox. A stamp
+// past watermark+1, or one this client saw admitted, proves the server record
+// that admitted it is gone. Another live sharer's stamp may still be on its
+// way on that sharer's attach: it and every stamp after it wait for a later
+// hello; the stamps before it never arrived and resend under their seqs.
 const demote = (
   s: Session,
   protocol: string,
   watermark: number,
   demoted: Set<string>,
+  waiting: Set<Pending>,
 ) => {
   const lane = laneOf(s.record, protocol);
   const local = laneEntries(s, protocol).filter((p) => p.seq > watermark);
@@ -1156,6 +1388,17 @@ const demote = (
     sessionLostInner(s, protocol, watermark);
     return;
   }
+  const me = s.store.owner?.id;
+  const foreign = moved.find(
+    (c) =>
+      c.owner !== undefined &&
+      c.owner !== me &&
+      !local.some((p) => p.id === c.id),
+  );
+  if (foreign !== undefined) {
+    for (const p of local) if (p.seq > foreign.seq) waiting.add(p);
+    return;
+  }
   setRecord(
     s,
     withLane(s.record, protocol, {
@@ -1175,6 +1418,24 @@ const demote = (
   sortPending(s);
 };
 
+const recheckLater = (s: Session, watermarks: string) => {
+  if (s.rechecks.watermarks !== watermarks)
+    s.rechecks = { watermarks, count: 0 };
+  s.rechecks.count += 1;
+  if (s.recheck !== undefined) return;
+  s.recheck = setTimeout(
+    () => {
+      s.recheck = undefined;
+      if (s.running && s.attach === "attached")
+        s.transport?.connection.reconnect();
+    },
+    backoff(s.rechecks.count + 1),
+  );
+};
+
+const gapFill = (s: Session) =>
+  s.selection !== undefined && s.selection.version >= GAP_FILL_VERSION;
+
 const selectionOf = (
   syn: StatewireSyn,
 ): StatewireProtocol.Selection | undefined => {
@@ -1222,6 +1483,7 @@ const handleHello = (
     // verdicts (the server never re-runs them); seqs above it never arrived
     // and go back to the outbox for fresh ones.
     const demoted = new Set<string>();
+    const waiting = new Set<Pending>();
     for (const lane of lanes) {
       if (lane.record === "ephemeral") {
         s.ephemeralSeqs[lane.name] = Math.max(
@@ -1232,17 +1494,24 @@ const handleHello = (
         );
         continue;
       }
-      demote(s, lane.name, lane.seq ?? 0, demoted);
+      demote(s, lane.name, lane.seq ?? 0, demoted, waiting);
       s.durableSeq[lane.name] = lane.seq ?? 0;
     }
     for (const entry of s.pending) {
       entry.posted =
         attached.has(entry) ||
+        waiting.has(entry) ||
         (isStamped(entry) &&
           entry.seq <= durableSeqOf(s, entry.command.protocol) &&
           !isEphemeral(s, entry.command.protocol));
       entry.stale = false;
     }
+    if (waiting.size > 0)
+      recheckLater(
+        s,
+        JSON.stringify(lanes.map((lane) => [lane.name, lane.seq])),
+      );
+    else s.rechecks = { watermarks: "", count: 0 };
     syncBacklogInner(s);
     s.sessionKnown = true;
     flushInner(s, demoted);
@@ -1251,11 +1520,13 @@ const handleHello = (
     reconcile();
     publishIngested(s);
     void pump(s);
+    deliver(s);
     return;
   }
   transactBackground(s, reconcile, () => {
     publishIngested(s);
     void pump(s);
+    deliver(s);
   });
 };
 
@@ -1458,22 +1729,23 @@ const pump = async (s: Session) => {
       if (!s.hydrated) await s.ready;
       const transport = s.transport;
       const flushable = flushCandidates(s).length > 0;
-      const queued = s.pending.some(
-        (p) => isOutboxed(p) && p.inv.hold === undefined,
-      );
+      const queued =
+        s.pending.some((p) => isOutboxed(p) && !p.inv.held) ||
+        queuedInRecord(s);
       if (
         buildLanes(s) === null &&
         !flushable &&
         (!queued || s.attach === "attached")
       )
         return;
-      if (transport?.parked && s.pending.length === 0) return;
+      const waiting = s.pending.length > 0 || queued;
+      if (transport?.parked && !waiting) return;
       if (s.attach !== "attached" || !transport) {
-        if (s.pending.length === 0) return;
+        if (!waiting) return;
         if (
           (transport?.connection.status === "standby" &&
             transport.connection.reason === "idle") ||
-          (transport?.parked && s.pending.length > 0)
+          transport?.parked
         ) {
           transport.connection.reconnect();
         }
@@ -1510,8 +1782,8 @@ const pump = async (s: Session) => {
           return transport.send(built.frame);
         };
         result = await (s.shared && !s.deactivated && lanes.entries.length > 0
-          ? s.store.lock!(() => {
-              refresh(s);
+          ? s.store.lock!(async () => {
+              refresh(s, await readStored(s));
               lanes = buildLanes(s);
               if (!lanes || epoch !== s.attachEpoch) return null;
               return send(lanes);
@@ -1519,6 +1791,18 @@ const pump = async (s: Session) => {
           : send(lanes));
       } catch {
         if (!s.running || isFinished(s)) return;
+        // The frame may have arrived. Under the gap-fill wire its seqs never
+        // go out again: the next hello answers what arrived and frees the rest.
+        if (lanes !== null && lanes.entries.length > 0 && gapFill(s)) {
+          if (epoch !== s.attachEpoch) continue;
+          for (const entry of lanes.entries)
+            if (s.pending.includes(entry)) entry.posted = true;
+          s.frameFailures += 1;
+          await sleepUntilWake(s, backoff(s.frameFailures));
+          if (s.running && epoch === s.attachEpoch && s.attach === "attached")
+            transport.connection.reconnect();
+          continue;
+        }
         if (lanes?.frame.ctx?.length) {
           s.lanesOnAttach = true;
           transport.connection.reconnect();
@@ -1596,6 +1880,7 @@ const start = (s: Session) => {
         () => {
           wake(s);
           void pump(s);
+          deliver(s);
         },
       );
     });
@@ -1608,7 +1893,10 @@ const start = (s: Session) => {
         adoptOwner(s, undefined);
         consumeVerdicts(s);
       },
-      () => void pump(s),
+      () => {
+        void pump(s);
+        deliver(s);
+      },
     );
     return;
   }
@@ -1619,10 +1907,13 @@ const start = (s: Session) => {
   adoptOwner(s, undefined);
   s.running = true;
   void pump(s);
+  deliver(s);
 };
 
 const stop = (s: Session) => {
   s.running = false;
+  clearTimeout(s.recheck);
+  s.recheck = undefined;
   if (s.shared) {
     s.shared.unsubscribe?.();
     s.shared.unsubscribe = null;
@@ -1640,13 +1931,23 @@ const setTransport = (s: Session, transport: RemoteLink) => {
   wake(s);
 };
 
+type EnqueueOptions = {
+  hold?: boolean;
+  localMeta?: unknown;
+};
+
+const QUOTA: StatewireClient.SendFailure = { fate: "aborted", cause: "quota" };
+
+const isQuota = (error: unknown) =>
+  error instanceof Error && error.name === "StatewireQuotaError";
+
 const enqueueInner = (
   s: Session,
   command: WireCommand,
   params: readonly unknown[],
   resolve: (payload: unknown) => void,
   reject: (error: unknown) => void,
-  hold?: Hold,
+  options: EnqueueOptions = {},
 ) => {
   const protocol = command.protocol;
   const id = newClientId();
@@ -1661,7 +1962,8 @@ const enqueueInner = (
       ts: Date.now(),
       id,
       clientId: s.record.clientId,
-      ...(hold !== undefined && { hold }),
+      ...(options.hold && { held: true as const }),
+      ...(options.localMeta !== undefined && { localMeta: options.localMeta }),
     },
     adopted: false,
     by: s.store.owner?.id,
@@ -1673,19 +1975,25 @@ const enqueueInner = (
     resolve,
     reject,
   };
-  s.pending.push(entry);
   if (!isEphemeral(s, protocol)) {
     const lane = laneOf(s.record, protocol);
-    setRecord(
-      s,
-      withLane(
-        s.record,
-        protocol,
-        withOutbox(lane, [...outboxOf(lane), toOutbox(entry)]),
-      ),
-    );
+    try {
+      setRecord(
+        s,
+        withLane(
+          s.record,
+          protocol,
+          withOutbox(lane, [...outboxOf(lane), toOutbox(entry)]),
+        ),
+      );
+    } catch (error) {
+      if (!isQuota(error)) throw error;
+      reject(new StatewireSendError(QUOTA));
+      return;
+    }
+    s.pending.push(entry);
     reorder(s, protocol);
-  }
+  } else s.pending.push(entry);
   s.lifecycle?.onStart(entry.inv);
   s.notify();
 };
@@ -1698,33 +2006,26 @@ type Candidate = {
   stored: StatewireClient.OutboxCommand;
 };
 
-const views = new WeakMap<
-  StatewireClient.OutboxCommand,
-  StatewireClient.OutboxEntry
->();
-
 const viewOf = (
+  s: Session,
   protocol: string,
-  stored: StatewireClient.OutboxCommand,
+  stored: StatewireClient.OutboxCommand | StatewireClient.SessionCommand,
+  state?: "sending",
 ): StatewireClient.OutboxEntry => {
-  const cached = views.get(stored);
+  const cached = s.views.get(stored);
   if (cached?.protocol === protocol) return cached;
   const view: StatewireClient.OutboxEntry = {
     id: stored.id,
     protocol,
-    command: {
-      method: stored.method,
-      params:
-        stored.meta === undefined
-          ? stored.params
-          : (reviveValue(
-              structuredClone(stored.params),
-              stored.meta,
-            ) as unknown[]),
-    },
-    held: stored.hold === undefined ? null : { meta: stored.hold.meta },
+    command: { method: stored.method, params: paramsOf(stored) },
+    ts: stored.ts,
+    state:
+      state ??
+      ((stored as StatewireClient.OutboxCommand).held ? "held" : "queued"),
+    localMeta: stored.localMeta,
+    durable: s.store.durable !== false && !isEphemeral(s, protocol),
   };
-  views.set(stored, view);
+  s.views.set(stored, view);
   return view;
 };
 
@@ -1751,7 +2052,7 @@ const bubble = (
   const order: { stored: StatewireClient.OutboxCommand; blocked: boolean }[] =
     [];
   for (const stored of queue) {
-    if (stored.hold !== undefined) {
+    if (stored.held) {
       order.push({ stored, blocked: true });
       continue;
     }
@@ -1760,7 +2061,10 @@ const bubble = (
       at > 0 &&
       order[at - 1]!.blocked &&
       may !== undefined &&
-      may(viewOf(protocol, stored), viewOf(protocol, order[at - 1]!.stored))
+      may(
+        viewOf(s, protocol, stored),
+        viewOf(s, protocol, order[at - 1]!.stored),
+      )
     )
       at--;
     order.splice(at, 0, { stored, blocked: at > 0 && order[at - 1]!.blocked });
@@ -1796,6 +2100,16 @@ const flushCandidates = (s: Session): Candidate[] =>
     return order.slice(0, free).map((stored) => ({ protocol, stored }));
   });
 
+// An entry the record holds that a flush would stamp once attached, whether
+// or not this page made the send: inserted, or kept from an earlier mount or
+// another sharer. It dials a parked or idle transport as a send does.
+const queuedInRecord = (s: Session) =>
+  Object.keys(s.record.lanes).some(
+    (protocol) =>
+      (s.selection ? negotiated(s, protocol) : offered(s, protocol)) &&
+      bubble(s, protocol, laneQueue(s, protocol)).free > 0,
+  );
+
 const reasonOf = (
   s: Session,
   stored: StatewireClient.OutboxCommand,
@@ -1811,6 +2125,34 @@ const reasonOf = (
 
 const NO_IDS: ReadonlySet<string> = new Set();
 
+const patched = (
+  stored: StatewireClient.OutboxCommand,
+  patch: Patch,
+): StatewireClient.OutboxCommand => {
+  const {
+    held: _held,
+    released: _released,
+    localMeta: _meta,
+    ...rest
+  } = stored;
+  const held = patch.held ?? stored.held === true;
+  const localMeta =
+    patch.localMeta === undefined ? stored.localMeta : patch.localMeta.value;
+  let next: StatewireClient.OutboxCommand = {
+    ...rest,
+    ...(held && { held: true as const }),
+    ...(!held &&
+      (stored.held || stored.released) && { released: true as const }),
+    ...(localMeta !== undefined && { localMeta }),
+  };
+  if (patch.params !== undefined) {
+    const { params, meta } = encodeParams(patch.params);
+    const { meta: _old, ...plain } = next;
+    next = { ...plain, params, ...(meta !== undefined && { meta }) };
+  }
+  return next;
+};
+
 // Seqs are allocated here, under the lock, against the attach's watermark:
 // each outbox entry is stamped by exactly one sharer, in the bubbled order.
 const flushInner = (s: Session, demoted: ReadonlySet<string> = NO_IDS) => {
@@ -1826,12 +2168,12 @@ const flushInner = (s: Session, demoted: ReadonlySet<string> = NO_IDS) => {
     const reason = reasonOf(s, stored, demoted);
     groups.set(reason, [
       ...(groups.get(reason) ?? []),
-      viewOf(protocol, stored),
+      viewOf(s, protocol, stored),
     ]);
   }
   const flushing: Flushing = {
     ids: new Set(candidates.map((c) => c.stored.id)),
-    held: new Map(),
+    patches: new Map(),
     removed: new Set(),
   };
   s.flushing = flushing;
@@ -1859,14 +2201,14 @@ const flushInner = (s: Session, demoted: ReadonlySet<string> = NO_IDS) => {
         if (own) settleRemoved(s, own);
         continue;
       }
-      const hold = flushing.held.get(stored.id);
-      if (hold === undefined) {
+      const patch = flushing.patches.get(stored.id);
+      if (patch === undefined) {
         queue.push(stored);
         continue;
       }
-      const { released: _released, ...rest } = stored;
-      queue.push({ ...rest, hold });
-      if (own) setHold(s, own, hold);
+      const next = patched(stored, patch);
+      queue.push(next);
+      if (own) follow(s, own, next);
     }
     const { order, free } = bubble(s, protocol, queue);
     let nextSeq = lane.nextSeq;
@@ -1885,7 +2227,7 @@ const flushInner = (s: Session, demoted: ReadonlySet<string> = NO_IDS) => {
       }
       const seq = Math.max(nextSeq, durableSeqOf(s, protocol) + 1);
       nextSeq = seq + 1;
-      const { hold: _hold, released: _released, ...command } = stored;
+      const { held: _held, released: _released, ...command } = stored;
       const stamped: StatewireClient.SessionCommand = {
         ...command,
         seq,
@@ -1932,12 +2274,14 @@ export const outboxEntries = (
   s: Session,
 ): readonly StatewireClient.OutboxEntry[] => {
   const local = s.pending.filter(
-    (p) => isOutboxed(p) && isEphemeral(s, p.command.protocol),
+    (p) => isEphemeral(s, p.command.protocol) && !p.away,
   );
   const parts: unknown[] = [
-    ...Object.values(s.record.lanes).map((lane) => lane.outbox),
-    ...local.map((p) => p.inv.hold),
-    ...local,
+    ...Object.values(s.record.lanes).flatMap((lane) => [
+      lane.commands,
+      lane.outbox,
+    ]),
+    ...local.flatMap((p) => [p, p.seq, p.inv.held, p.inv.localMeta]),
   ];
   const same =
     parts.length === s.outboxParts.length &&
@@ -1945,130 +2289,342 @@ export const outboxEntries = (
   if (!same) {
     s.outboxParts = parts;
     s.outboxList = [
-      ...Object.entries(s.record.lanes).flatMap(([protocol, lane]) =>
-        outboxOf(lane).map((c) => viewOf(protocol, c)),
-      ),
-      ...local.map((p) => viewOf(p.command.protocol, toOutbox(p))),
+      ...Object.entries(s.record.lanes).flatMap(([protocol, lane]) => [
+        ...[...lane.commands]
+          .sort((a, b) => a.seq - b.seq)
+          .map((c) => viewOf(s, protocol, c, "sending")),
+        ...outboxOf(lane).map((c) => viewOf(s, protocol, c)),
+      ]),
+      ...[...local]
+        .sort((a, b) => (a.seq ?? Infinity) - (b.seq ?? Infinity))
+        .map((p) =>
+          isStamped(p)
+            ? viewOf(s, p.command.protocol, toStored(s, p), "sending")
+            : viewOf(s, p.command.protocol, toOutbox(p)),
+        ),
     ];
   }
   return s.outboxList;
 };
 
 type OutboxOp =
-  | { type: "hold"; hold: NonNullable<Hold> }
-  | { type: "release" }
+  | { type: "patch"; patch: (entry: StatewireClient.OutboxEntry) => Patch }
   | { type: "remove" };
 
-type OutboxStatus = "held" | "released" | "removed" | "stamped";
+const entryOf = (s: Session, id: string) => {
+  const at = locate(s, id);
+  if (at === undefined) throw new Error(`outbox: no entry ${id}`);
+  if (at.stored === undefined) throw new Error(`outbox: ${id} is in flight`);
+  return { protocol: at.protocol, stored: at.stored };
+};
 
-const applyOutboxOp = (
-  s: Session,
-  protocol: string,
-  id: string,
-  op: OutboxOp,
-): OutboxStatus => {
-  const done: OutboxStatus =
-    op.type === "hold"
-      ? "held"
-      : op.type === "release"
-        ? "released"
-        : "removed";
+const applyOutboxOp = (s: Session, id: string, op: OutboxOp) => {
+  const at = locate(s, id);
+  if (at?.stored === undefined) return;
+  const { protocol, stored } = at;
   const own = s.pending.find((p) => p.id === id && isOutboxed(p));
-  const lane = laneOf(s.record, protocol);
-  const stored = outboxOf(lane).find((c) => c.id === id);
-  if (!stored) {
-    if (op.type === "remove" && lane.removed?.some((m) => m.id === id))
-      return "removed";
-    if (!own || !isEphemeral(s, protocol)) return "stamped";
-  } else if (op.type === "remove") {
-    setRecord(
-      s,
-      withLane(s.record, protocol, {
-        ...withOutbox(
-          lane,
-          outboxOf(lane).filter((c) => c.id !== id),
-        ),
-        ...marks(s, lane, [stored]),
-      }),
-    );
+  if (op.type === "remove") {
+    if (!isEphemeral(s, protocol)) {
+      const lane = laneOf(s.record, protocol);
+      setRecord(
+        s,
+        withLane(s.record, protocol, {
+          ...withOutbox(
+            lane,
+            outboxOf(lane).filter((c) => c.id !== id),
+          ),
+          ...marks(s, lane, [stored]),
+        }),
+      );
+    }
+    if (own) settleRemoved(s, own);
   } else {
-    const { hold: _hold, released: _released, ...queued } = stored;
-    const next: StatewireClient.OutboxCommand =
-      op.type === "hold"
-        ? { ...queued, hold: op.hold }
-        : stored.hold === undefined && !stored.released
-          ? queued
-          : { ...queued, released: true };
-    setRecord(
-      s,
-      withLane(
-        s.record,
-        protocol,
-        withOutbox(
-          lane,
-          outboxOf(lane).map((c) => (c.id === id ? next : c)),
+    const next = patched(stored, op.patch(viewOf(s, protocol, stored)));
+    if (!isEphemeral(s, protocol)) {
+      const lane = laneOf(s.record, protocol);
+      setRecord(
+        s,
+        withLane(
+          s.record,
+          protocol,
+          withOutbox(
+            lane,
+            outboxOf(lane).map((c) => (c.id === id ? next : c)),
+          ),
         ),
-      ),
-    );
-  }
-  if (own) {
-    if (op.type === "remove") settleRemoved(s, own);
-    else setHold(s, own, op.type === "hold" ? op.hold : undefined);
+      );
+    }
+    if (own) follow(s, own, next);
   }
   reorder(s, protocol);
   s.notify();
-  return done;
 };
 
-const outboxOp = (
-  s: Session,
-  entry: StatewireClient.OutboxEntry,
-  op: OutboxOp,
-): Promise<OutboxStatus> => {
+const toPatch = (patch: StatewireClient.OutboxPatch): Patch => {
+  if (typeof patch !== "object" || patch === null)
+    throw new Error("outbox: update must return a patch object");
+  if (patch.held !== undefined && typeof patch.held !== "boolean")
+    throw new Error("outbox: held must be a boolean");
+  if (
+    patch.command !== undefined &&
+    (Object.keys(patch.command).some((k) => k !== "params") ||
+      !Array.isArray(patch.command.params))
+  )
+    throw new Error("outbox: a patch may only replace command.params");
+  return {
+    ...(patch.held !== undefined && { held: patch.held }),
+    ...("localMeta" in patch && { localMeta: { value: patch.localMeta } }),
+    ...(patch.command !== undefined && { params: patch.command.params }),
+  };
+};
+
+const outboxOp = (s: Session, id: string, op: OutboxOp): Promise<void> => {
+  entryOf(s, id);
   const flushing = s.flushing;
-  if (flushing?.ids.has(entry.id)) {
-    if (op.type === "remove") flushing.removed.add(entry.id);
-    else if (op.type === "hold") flushing.held.set(entry.id, op.hold);
-    else flushing.held.delete(entry.id);
-    return Promise.resolve(
-      op.type === "hold"
-        ? "held"
-        : op.type === "release"
-          ? "released"
-          : "removed",
-    );
+  if (flushing?.ids.has(id)) {
+    if (op.type === "remove") flushing.removed.add(id);
+    else {
+      const at = entryOf(s, id);
+      const patch = op.patch(viewOf(s, at.protocol, at.stored));
+      flushing.patches.set(id, { ...flushing.patches.get(id), ...patch });
+    }
+    return Promise.resolve();
   }
-  let status: OutboxStatus = "stamped";
+  const done = () => {
+    wake(s);
+    void pump(s);
+  };
+  if (!s.shared) {
+    applyOutboxOp(s, id, op);
+    done();
+    return Promise.resolve();
+  }
+  return transact(s, () => applyOutboxOp(s, id, op)).then(done);
+};
+
+const background = (promise: Promise<void>) => {
+  promise.catch(() => {});
+};
+
+export const holdOutbox = (s: Session, id: string) =>
+  background(outboxOp(s, id, { type: "patch", patch: () => ({ held: true }) }));
+
+export const releaseOutbox = (s: Session, id: string): Promise<unknown> => {
+  entryOf(s, id);
+  const result = new Promise<unknown>((resolve, reject) => {
+    const waiters = s.releases.get(id) ?? [];
+    waiters.push({ resolve, reject });
+    s.releases.set(id, waiters);
+  });
+  result.catch(() => {});
+  outboxOp(s, id, { type: "patch", patch: () => ({ held: false }) }).catch(
+    (error: unknown) => settleWaiters(s, id, error),
+  );
+  return result;
+};
+
+const settleWaiters = (s: Session, id: string, error: unknown) => {
+  const waiters = s.releases.get(id) ?? [];
+  s.releases.delete(id);
+  for (const waiter of waiters) waiter.reject(error);
+};
+
+export const removeOutbox = (s: Session, id: string) =>
+  background(outboxOp(s, id, { type: "remove" }));
+
+export const updateOutbox = (
+  s: Session,
+  id: string,
+  fn: (entry: StatewireClient.OutboxEntry) => StatewireClient.OutboxPatch,
+) =>
+  background(
+    outboxOp(s, id, { type: "patch", patch: (entry) => toPatch(fn(entry)) }),
+  );
+
+const producedOf = (
+  s: Session,
+): NonNullable<StatewireClient.SessionCommand["produced"]> => ({
+  wire: s.options.wireVersion ?? { version: WIRE_VERSION },
+  protocols:
+    protocolOffers(s.options) === "*" && s.selection
+      ? s.selection.protocols
+      : protocolOffers(s.options),
+});
+
+const placed = (
+  queue: readonly StatewireClient.OutboxCommand[],
+  entry: StatewireClient.OutboxCommand,
+  { after, before }: { after?: string; before?: string },
+) => {
+  const anchor = after ?? before;
+  if (anchor === undefined) return [...queue, entry];
+  const index = queue.findIndex((c) => c.id === anchor);
+  if (index === -1) return [...queue, entry];
+  const at = after !== undefined ? index + 1 : index;
+  return [...queue.slice(0, at), entry, ...queue.slice(at)];
+};
+
+export const insertOutbox = (
+  s: Session,
+  entry: StatewireClient.OutboxInsert,
+): string => {
+  if (!s.hydrated) throw new Error("outbox: storage is not hydrated yet");
+  if (s.storageError !== undefined) throw s.storageError;
+  if (entry.after !== undefined && entry.before !== undefined)
+    throw new Error("outbox: after and before are exclusive");
+  for (const anchor of [entry.after, entry.before])
+    if (anchor !== undefined) entryOf(s, anchor);
+  const { protocol } = entry;
+  if (!(s.selection ? negotiated(s, protocol) : offered(s, protocol)))
+    throw new Error(`statewire: protocol "${protocol}" is not negotiated`);
+  const { params, meta } = encodeParams(entry.command.params);
+  const id = entry.from === undefined ? newClientId() : `${entry.from}~`;
+  const stored: StatewireClient.OutboxCommand = {
+    id,
+    produced: producedOf(s),
+    method: entry.command.method,
+    params,
+    ...(meta !== undefined && { meta }),
+    ts: Date.now(),
+    ...(entry.held && { held: true as const }),
+    ...(entry.localMeta !== undefined && { localMeta: entry.localMeta }),
+    ...(s.store.owner !== undefined && { by: s.store.owner.id }),
+  };
   const run = () => {
-    status = applyOutboxOp(s, entry.protocol, entry.id, op);
+    if (isEphemeral(s, protocol)) {
+      enqueueInner(
+        s,
+        {
+          protocol,
+          produced: stored.produced!,
+          method: stored.method,
+          params,
+          ...(meta !== undefined && { meta }),
+        },
+        entry.command.params,
+        () => {},
+        () => {},
+        {
+          ...(entry.held && { hold: true }),
+          ...(entry.localMeta !== undefined && { localMeta: entry.localMeta }),
+        },
+      );
+      return;
+    }
+    let base = s.record;
+    if (entry.from !== undefined) {
+      // Re-inserting a settled update consumes it in the same write: a
+      // redelivery finds it gone.
+      const source = Object.entries(base.lanes).find(([, l]) =>
+        l.inbox?.some((n) => n.id === entry.from),
+      );
+      if (source === undefined || locate(s, id) !== undefined) return;
+      base = withLane(base, source[0], withoutNotice(source[1], entry.from));
+    }
+    const lane = laneOf(base, protocol);
+    try {
+      setRecord(
+        s,
+        withLane(
+          base,
+          protocol,
+          withOutbox(lane, placed(outboxOf(lane), stored, entry)),
+        ),
+      );
+    } catch (error) {
+      if (!isQuota(error)) throw error;
+      // The update stays unacked for the next mount.
+      if (entry.from !== undefined) s.skipped.add(entry.from);
+      settleReleases(s, id, { ok: false, failure: QUOTA });
+      return;
+    }
+    s.mountIds.delete(id);
+    reorder(s, protocol);
+    s.notify();
   };
   const done = () => {
     wake(s);
     void pump(s);
-    return status;
   };
   if (!s.shared) {
     run();
-    return Promise.resolve(done());
+    done();
+  } else background(transact(s, run).then(done));
+  return id;
+};
+
+// One sharer at a time runs the handler; the update leaves the record only
+// once it resolved, so a crash mid-handler redelivers it.
+const nextNotice = (s: Session) => {
+  for (const [protocol, lane] of Object.entries(s.record.lanes)) {
+    const found = (lane.inbox ?? []).find((n) => !s.skipped.has(n.id));
+    if (found) return { protocol, found };
   }
-  return transact(s, run).then(done);
+  return undefined;
 };
 
-export const holdOutbox = (
-  s: Session,
-  entry: StatewireClient.OutboxEntry,
-  meta?: unknown,
-) =>
-  outboxOp(s, entry, {
-    type: "hold",
-    hold: meta === undefined ? {} : { meta },
-  }) as Promise<"held" | "stamped">;
+const withoutNotice = (
+  lane: StatewireClient.SessionLane,
+  id: string,
+): StatewireClient.SessionLane => {
+  const inbox = (lane.inbox ?? []).filter((n) => n.id !== id);
+  const { inbox: _inbox, ...rest } = lane;
+  return inbox.length > 0 ? { ...rest, inbox } : rest;
+};
 
-export const releaseOutbox = (s: Session, entry: StatewireClient.OutboxEntry) =>
-  outboxOp(s, entry, { type: "release" }) as Promise<"released" | "stamped">;
+const ack = (s: Session, protocol: string, id: string) => {
+  const lane = laneOf(s.record, protocol);
+  if (s.skipped.has(id) || !lane.inbox?.some((n) => n.id === id)) return;
+  setRecord(s, withLane(s.record, protocol, withoutNotice(lane, id)));
+};
 
-export const removeOutbox = (s: Session, entry: StatewireClient.OutboxEntry) =>
-  outboxOp(s, entry, { type: "remove" }) as Promise<"removed" | "stamped">;
+const deliver = (s: Session) => {
+  const handler = s.onSettled;
+  // Handlers get ctx.state: delivery waits for the first hello.
+  if (
+    handler === undefined ||
+    s.delivering ||
+    !s.running ||
+    !s.hydrated ||
+    !s.sessionKnown
+  )
+    return;
+  if (nextNotice(s) === undefined) return;
+  s.delivering = true;
+  const run = async () => {
+    for (;;) {
+      if (s.shared) await transact(s, () => {});
+      else await null;
+      const next = nextNotice(s);
+      if (next === undefined || !s.running) return;
+      const { protocol, found } = next;
+      try {
+        await handler(updateOf(protocol, found));
+      } catch (error) {
+        console.error(
+          "statewire: onCommandChange threw on a settled update; it stays for the next mount",
+          error,
+        );
+        s.skipped.add(found.id);
+        continue;
+      }
+      if (s.shared) await transact(s, () => ack(s, protocol, found.id));
+      else ack(s, protocol, found.id);
+      s.notify();
+    }
+  };
+  const locked = s.store.notifyLock ? s.store.notifyLock(run) : run();
+  locked.then(
+    () => {
+      s.delivering = false;
+      deliver(s);
+    },
+    (error: unknown) => {
+      s.delivering = false;
+      console.error("statewire: settled update delivery stopped", error);
+    },
+  );
+};
 
 const enqueue = (
   s: Session,
@@ -2076,10 +2632,10 @@ const enqueue = (
   params: readonly unknown[],
   resolve: (payload: unknown) => void,
   reject: (error: unknown) => void,
-  hold?: Hold,
+  options?: EnqueueOptions,
 ) => {
   if (!s.shared) {
-    enqueueInner(s, command, params, resolve, reject, hold);
+    enqueueInner(s, command, params, resolve, reject, options);
     wake(s);
     void pump(s);
     return;
@@ -2091,7 +2647,7 @@ const enqueue = (
       reject(new StatewireSendError({ fate: "aborted", cause: "stream-gone" }));
       return;
     }
-    enqueueInner(s, command, params, resolve, reject, hold);
+    enqueueInner(s, command, params, resolve, reject, options);
   }).then(() => {
     wake(s);
     void pump(s);
@@ -2115,6 +2671,8 @@ const sendCommand = (
     : offered(s, protocol);
   if (!negotiated)
     throw new Error(`statewire: protocol "${protocol}" is not negotiated`);
+  if (options?.hold !== undefined && typeof options.hold !== "boolean")
+    throw new Error("statewire: invoke hold must be a boolean");
   if (!s.hydrated) {
     const result = s.ready!.then(() =>
       sendCommand(s, method, params, protocol, options),
@@ -2139,13 +2697,7 @@ const sendCommand = (
       s,
       {
         protocol,
-        produced: {
-          wire: s.options.wireVersion ?? { version: WIRE_VERSION },
-          protocols:
-            protocolOffers(s.options) === "*" && s.selection
-              ? s.selection.protocols
-              : protocolOffers(s.options),
-        },
+        produced: producedOf(s),
         method,
         params: encoded,
         ...(meta !== undefined && { meta }),
@@ -2153,120 +2705,18 @@ const sendCommand = (
       params,
       resolve,
       reject,
-      options?.hold,
+      {
+        ...(options?.hold && { hold: true }),
+        ...(options?.localMeta !== undefined && {
+          localMeta: options.localMeta,
+        }),
+      },
     );
   });
   result.catch(() => {});
   return result;
 };
 
-const findFailed = (
-  s: Session,
-  entry: StatewireClient.FailedCommand,
-): StatewireClient.FailedCommand | undefined =>
-  (laneOf(s.record, entry.protocol).failed ?? []).find(
-    (f) =>
-      f.seq === entry.seq && f.ts === entry.ts && f.command === entry.command,
-  );
-
-const unknownFailed = (entry: StatewireClient.FailedCommand) =>
-  new Error(`statewire: unknown failed command "${entry.command}"`);
-
-const takeFailed = (
-  s: Session,
-  entry: StatewireClient.FailedCommand,
-): StatewireClient.FailedCommand => {
-  const lane = laneOf(s.record, entry.protocol);
-  const found = findFailed(s, entry);
-  if (found === undefined) throw unknownFailed(entry);
-  setRecord(
-    s,
-    withLane(s.record, entry.protocol, {
-      ...lane,
-      failed: (lane.failed ?? []).filter((f) => f !== found),
-    }),
-  );
-  s.notify();
-  return found;
-};
-
-export const discardFailed = (
-  s: Session,
-  entry: StatewireClient.FailedCommand,
-): void => {
-  if (!s.shared) {
-    takeFailed(s, entry);
-    return;
-  }
-  if (findFailed(s, entry) === undefined) throw unknownFailed(entry);
-  transactBackground(s, () => {
-    if (findFailed(s, entry) !== undefined) takeFailed(s, entry);
-  });
-};
-
-export const retryFailed = (
-  s: Session,
-  entry: StatewireClient.FailedCommand,
-): Promise<unknown> => {
-  if (!s.running) {
-    return rejectedSend({ fate: "aborted", cause: "unmount" });
-  }
-  if (isFinished(s)) {
-    return rejectedSend({ fate: "aborted", cause: "stream-gone" });
-  }
-  const found = findFailed(s, entry);
-  if (found === undefined) throw unknownFailed(entry);
-  const params =
-    found.meta === undefined
-      ? found.params
-      : (reviveValue(structuredClone(found.params), found.meta) as unknown[]);
-  const result = new Promise<unknown>((resolve, reject) => {
-    const retry = () => {
-      if (!s.running) {
-        reject(new StatewireSendError({ fate: "aborted", cause: "unmount" }));
-        return;
-      }
-      if (isFinished(s)) {
-        reject(
-          new StatewireSendError({ fate: "aborted", cause: "stream-gone" }),
-        );
-        return;
-      }
-      const current = findFailed(s, entry);
-      if (current === undefined) {
-        reject(unknownFailed(entry));
-        return;
-      }
-      takeFailed(s, current);
-      enqueueInner(
-        s,
-        {
-          protocol: current.protocol,
-          ...(current.produced !== undefined && { produced: current.produced }),
-          method: current.command,
-          params: [...current.params],
-          ...(current.meta !== undefined && { meta: current.meta }),
-        },
-        params,
-        resolve,
-        reject,
-      );
-    };
-    if (!s.shared) {
-      retry();
-      wake(s);
-      void pump(s);
-      return;
-    }
-    void transact(s, retry).then(() => {
-      wake(s);
-      void pump(s);
-    }, reject);
-  });
-  result.catch(() => {});
-  return result;
-};
-
 export const documentSource = (s: Session): StatewireDocuments.Source => ({
   get: (protocol, key, prefix = s.options.keyPrefixes?.[protocol]) => {
     const mounted = findDocument(s.documents, protocol, key, prefix);
@@ -2373,7 +2823,7 @@ const loadSessionRecord = (
   const record =
     stored === null
       ? { clientId: newClientId(), lanes: {} }
-      : boundRecord(stored);
+      : boundInbox(store, stored);
   if (record !== stored) store.save(record);
   return record;
 };
@@ -2417,10 +2867,11 @@ export const useStatewireSession = (
   const store = options.sessionStore ?? mounted ?? defaultStore;
   if (
     (store.lock === undefined) !== (store.subscribe === undefined) ||
-    (store.lock === undefined) !== (store.owner === undefined)
+    (store.lock === undefined) !== (store.owner === undefined) ||
+    (store.lock === undefined) !== (store.notifyLock === undefined)
   ) {
     throw new Error(
-      "statewire: session storage must provide lock, subscribe and owner together",
+      "statewire: session storage must provide lock, subscribe, owner and notifyLock together",
     );
   }
   const [s] = useState((): Session => {
@@ -2468,6 +2919,9 @@ export const useStatewireSession = (
               txq: Promise.resolve(),
               syncQueued: false,
               parked: [],
+              settled: new Set(),
+              notices: [],
+              inTx: false,
               unsubscribe: null,
               watched: new Set(),
               abort: null,
@@ -2481,6 +2935,12 @@ export const useStatewireSession = (
       resumeAt: 0,
       idle: false,
       onSessionLost: undefined,
+      onDeprecatedPath: undefined,
+      onSettled: undefined,
+      releases: new Map(),
+      delivering: false,
+      skipped: new Set(),
+      views: new WeakMap(),
       onFlush: undefined,
       onDone: undefined,
       mountIds: storedIds(record),
@@ -2490,9 +2950,9 @@ export const useStatewireSession = (
       lanesOnAttach: false,
       attachEntries: new Set(),
       frameFailures: 0,
+      recheck: undefined,
+      rechecks: { watermarks: "", count: 0 },
       pending: [],
-      failedList: [],
-      failedParts: [],
       canonical: undefined,
       documentListeners: new Set(),
       documents: { mode: null, documents: new Map() },
@@ -2559,6 +3019,8 @@ export const useStatewireSession = (
   s.store = store;
   s.documentStore = documentStore;
   s.onSessionLost = options.onSessionLost;
+  s.onDeprecatedPath = options.onDeprecatedPath;
+  s.onSettled = options.onSettled;
   s.onFlush = options.onFlush;
   s.onDone = options.onDone;
   const keyPrefixes = JSON.stringify(options.keyPrefixes);