Commit 4292e4deb721a9526b18e9d9385d225c033b245c | snowbound

crates/notebook/Cargo.toml+1

...	@@ -21,6 +21,7 @@ tokio = { version = "1", features = ["rt-multi-thread", "time"], optional = true	...	@@ -21,6 +21,7 @@ tokio = { version = "1", features = ["rt-multi-thread", "time"], optional = true
21	zeroize = { version = "1.9.0", optional = true }	21	zeroize = { version = "1.9.0", optional = true }
22		22
23	[dev-dependencies]	23	[dev-dependencies]
		24	libc = "0.2"
24	serde_json = "1"	25	serde_json = "1"
25	tempfile = "3"	26	tempfile = "3"
26		27

crates/notebook/README.md+91-194

...	@@ -2,184 +2,97 @@	...	@@ -2,184 +2,97 @@
2		2
3	The application-facing crate: notebook discovery, a durable local replica with	3	The application-facing crate: notebook discovery, a durable local replica with
4	reconnect reconciliation, external-asset caching, recovery export and optional	4	reconnect reconciliation, external-asset caching, recovery export and optional
5	embedded SMB access. The replica stores the last observed remote image of one section,	5	embedded SMB access. A replica keeps one section's queue in a local SQLite database:
6	the working image as its difference from that, and the editor's intents in a	6	the image the queued edits apply to (the base, in 16 KiB chunks), the edits as
7	local SQLite database; a save writes the revision it appended, not the section. `sync_once` provides a	7	`onestore::op` ops in publication batches, and picture and attachment bytes once
8	reconciliation step and `start_sync` owns automatic polling and reconnects. Local	8	each by hash. Local success does not acknowledge publication to a shared notebook.
9	success does not acknowledge publication to a shared notebook.	9
10		10	```text
11	## Saving pages	11	editor ── Edit ──► section thread ─ Section::apply, INSERT edit ─┐
12		12	(the parsed section: base + sealed + open) │ one fsync per burst
13	The editor works on `onestore::page::Page` values and saves whole pages. `save`	13	sync thread: remote.stamp() == base ? publish(sealed batch) ──────┤ base chunks += transaction
14	diffs the supplied model against the page stored in the supplied local snapshot,	14	otherwise read once, replay the queue on it ─────────┘ conflict, or base := remote
15	writes the difference into the working image and queues one	15	```
16	`Operation::Page(PageIntent { before, after, author })`; `before` is the page the	16
17	edit started from and is the precondition reconciliation checks. Text, styles,	17	## Edits
18	paragraph formatting, hyperlinks (external and internal), bullets, numbering, note tags, table rows, columns, cell shading, nested tables, pictures (insertion in paragraphs or on the page, position, size, description), attachments, ink strokes, equations, paragraph structure,	18
19	outline layout, insertions and deletions are all differences between `before` and	19	`Replica::apply(author, edit)` applies an `onestore::op::Edit` to the section the
20	`after`; the library never sees editor operations.	20	queue leaves and returns its id once written; a refused edit returns `Rejected`
		21	and changes nothing. `page(space)` and `pages()` read what the queue leaves, for
		22	opening and reloading. Edits collect in an open batch until the sync thread seals
		23	it, so edits arriving while a publication is in flight publish together.
21		24
22	```no_run	25	```no_run
23	use onestore::{ExGuid, page::Page};	26	use onestore::{ExGuid, op::{Edit, Op, PageOp}};
24	use notebook::Replica;	27	use notebook::Replica;
25	# fn example(path: &std::path::Path, source: &[u8], space: ExGuid, edited: &Page)	28	# fn example(path: &std::path::Path, source: &[u8], space: ExGuid, text: ExGuid)
26	# -> Result<(), Box<dyn std::error::Error>> {	29	# -> Result<(), Box<dyn std::error::Error>> {
27	// `space` identifies the page; `edited` is the editor's current model of it.
28	let cache = Replica::create(path, source)?;	30	let cache = Replica::create(path, source)?;
29	let snapshot = cache.snapshot()?;	31	let typed = PageOp::Text { text, range: 0..0, with: "Hello ".into() };
30	let local_id = cache.save(&snapshot, space, edited, "Author")?;	32	let id = cache.apply("Author", Edit { at: 133_000_000_000_000_000, ops: vec![Op::Page { space, op: typed }] })?;
31	drop(cache);	33	drop(cache);
32		34
33	let reopened = Replica::open(path)?;	35	let reopened = Replica::open(path)?;
34	let pending = reopened.pending()?;	36	assert_eq!(reopened.pending()?.last().map(\|edit\| edit.id), Some(id));
35	assert_eq!(pending.last().map(\|edit\| edit.id), local_id);
36	# Ok(())	37	# Ok(())
37	# }	38	# }
38	```	39	```
39		40
40	Saves coalesce the way OneNote's own autosave does: while the newest queued intent	41	Share one `Replica` between threads. Keep the cache on a local filesystem: the
41	for the same page has not been attempted, a later save replaces its `after` model	42	connection holds exclusive ownership between transactions, and a second open fails
42	under the same ID. Once an intent has been attempted or holds a conflict it is	43	busy. No network wait occurs in a local edit. After a database error the section
43	never rewritten, nor is the intent a synchronization step has selected for	44	thread rereads the queue.
44	publication; the next save then queues a new intent. A save whose model equals
45	the stored page returns `None`. `PageIntent::text_change` describes an intent that
46	changes exactly one paragraph's text as the text object, its previous text, the
47	replaced UTF-16 range and the replacement.
48
49	Share one `Replica` between application threads. Each save compares its supplied
50	snapshot under the cache transaction; stale snapshots return `Io(ResourceBusy)`.
51	The intent and its resulting image commit together. Keep the cache on a local
52	filesystem: the connection holds exclusive ownership between transactions, and a
53	second open fails busy. No network wait occurs in a local save. After a database
54	error, reopen and inspect the durable state before retrying.
55		45
56	## Sessions	46	## Sessions
57		47
58	`session::Notebook::open(root, cache_dir)` discovers a notebook directory and	48	`session::Notebook::open(root, cache_dir)` discovers a notebook directory and
59	`session::Section::open(file, cache_dir, notify)` opens one section file through	49	`session::Section::open(file, cache_dir, notify)` opens one section file through
60	a replica stored under the cache directory, named by the section's document	50	a replica named by the section's document identity, so the same file reopens the
61	identity so the same file reopens the same queue after a relaunch. A section	51	same queue after a relaunch. A section is `Send + Sync`: `apply(author, edit)`
62	publishes in the background to the file itself under OneNote-compatible	52	returns at once and reports a refusal as `Event::Rejected`; `events()` drains
63	exclusion. `pages()` lists page spaces and titles from the local image,	53	remote changes (`Changed(spaces)`), publication outcomes, unreachable files and
64	`page(space)` returns the model to edit (its `identity` and the section's	54	failures; `notify` runs on a background thread whenever an event waits.
65	`identity()` feed `onestore::page::link::internal_link`), and `save(space, before, after,	55	`conflict()`, `remote_page(space)` and `resolve(id, Resolution)` present and end a
66	author)` queues the edited model: `Save::Queued(id)` is durable locally,	56	conflict; `release(id, archive, Resolution)` ends an uncertain attempt.
67	`Save::Unchanged` means the model equals the stored page, and `Save::Stale`	57	`import_page` creates a page holding a copy of another; `delete_pages` removes pages.
68	means the stored page no longer matches `before` because the section changed	58
69	underneath the editor, so the page must be reloaded before saving again.	59	Until the application emits ops, `save`, `queue_save`, `saved`, `saving`,
70	`queue_save(space, before, after, author)` does the same on the section's save	60	`conflicts`, `queue`, `review` and `Event::Refreshed` keep the whole-page API: a
71	thread and returns at once, so an editor's frame never waits on the write;	61	save lowers the page it is given against the stored page (`onestore::op::lower_page`)
72	`saved()` drains the outcomes. A queued save whose `before` is the previous	62	and applies the ops.
73	one's `after` continues it, needing no reload in between, and a run of such	63
74	saves waiting together is written once.	64	`Section::resume(file, replica, notify)` starts from an owned `Replica` without
75	`events()` drains what the synchronization thread reported since the last	65	consulting the remote file; with the `smb` feature, `Section::resume_smb(path,
76	poll: refreshes, attempt outcomes and unreachable files; `notify` runs	66	replica, limit, connect, notify)` binds a share-relative path, `connect` running on
77	whenever an event or save outcome is available so the application can wake its	67	the worker again after transport failure.
78	event loop. `close()` finishes queued saves and stops publication.
79
80	`Event::Unreachable` retains an `io::Error`: callers can distinguish permission
81	denial, missing targets, timeouts, and connection failures through `kind()` without
82	parsing display text. Document/cache failures are reported as `Event::Failed` and
83	stop the worker. Durable publication outcomes remain available through `status`.
84
85	`Section::resume(file, replica, notify)` starts a session from an owned
86	`Replica::open(cache_file)` without consulting the remote file. The caller retains
87	the cache location and publication path for offline relaunch. Local pages and
88	saves remain available while the target is absent; synchronization verifies the
89	document identity before adopting or publishing remote content. A different
90	document stops the worker and retains the pending local edits. `Section::open`
91	remains the online convenience constructor that discovers the identity from the
92	file and creates or reopens its cache.
93
94	With the `smb` feature, `Section::resume_smb(path, replica, limit, connect,
95	notify)` binds the same session operations to a share-relative path. `connect`
96	returns a new SMB client on the synchronization worker and is called again after
97	transport failure. The caller supplies credentials there, outside the replica
98	schema; construction and local saving do not wait for a network connection.
99
100	## Pages of a section
101
102	`create_page` accepts the core `PageCreation` intent and queues its page space
103	and section entry as one publication. Subsequent saves of the new page use the
104	intent's stable identities immediately after local acknowledgement. Independent
105	page additions rebase against the current section order; duplicate titles remain
106	distinct. An unavailable or no-longer-leading insertion anchor produces
107	`StructureChanged`. `rebase_page_creation_conflict(id, local, remote, before)`
108	reviews a replacement anchor against both cache images while retaining the new
109	page and dependent object identities. Existing page identities require
110	reconciliation; a matching page alone does not establish a receipt.
111
112	`pages(snapshot, edits)` queues a slice of core `PageEdit` intents as one atomic
113	publication. `PagePosition::Keep` preserves remote movement during indentation-only
114	edits. Every requested level remains explicit: a competing remote level produces
115	`StructureChanged` unless it already matches the requested level. Moves compare
116	the selected page's position relative to surviving observed pages; an unchanged
117	or already-satisfied position can proceed, and new remote pages remain present.
118	Indistinguishable competing moves retain a conflict and the complete local image.
119	`rebase_pages_conflict(id, local, remote, edits)` reviews the batch against both
120	cache images. Use `PageEdit::reposition(position, level)` on the retained intents
121	to revise anchors or indentation; replacing page or allocated series identities
122	is rejected. Dependent edits remain queued. Attempt evidence includes every
123	changed space plus the receipt space when that space is unchanged. An existing
124	section revision alone cannot confirm a page edit. The
125	[offline page corpus](../../corpus/page-lifecycle/offline-edits/README.md)
126	contains native comparisons, reproduction commands and stateful sanitizer seeds.
127
128	`delete_pages(snapshot, pages)` queues the permanent removal of page spaces;
129	a page already absent remotely produces `TargetUnavailable`.
130		68
131	## Reconciliation	69	## Reconciliation
132		70
133	`sync_once(&mut remote)` processes the oldest pending intent through a `Remote`	71	`sync_once(&mut remote)` returns what one step did as `Synced { edit, changed }`:
134	implementation, returning its ID and `EditStatus`. When the remote page still	72	the state the step's batch reached, named by its newest edit, and the pages a remote
135	equals `before`, the intent publishes as prepared. When the remote page changed,	73	change replaced. While the remote's stamp (header and length) equals the base's, the
136	a three-way merge keeps everything the remote changed and re-applies the local	74	oldest sealed batch publishes as its `Transaction`, and the base's chunks take its
137	changes wherever the two sides touched different objects, fields or text ranges:	75	writes; nothing is read. When the stamp moved, the remote image is read once and the
138	a local text edit merges with a remote edit elsewhere in the same paragraph, an	76	queue replays on it (`merge.rs`): an op whose objects the remote left alone applies
139	outline move merges with a remote text change, a new paragraph survives a remote	77	as it is; a text op shifts past the remote's changes to the same text when its
140	deletion elsewhere. Any overlap retains `Conflict(ContentChanged)` together with	78	range stays clear of them; a move, deletion or property the remote already made is
141	the complete local image and the last observed remote image returned by	79	done; a page the remote already holds as the local edits leave it drops their ops.
142	`remote_snapshot`; a page removed remotely retains `TargetUnavailable`, and a	80	Anything else is a `Conflict` on the batch: the queue stays on its base and the
143	page the writer can no longer express retains `UnsupportedEdit`.	81	remote image is kept for review. `resolve(id, Mine)` rewrites the remote page to the
144		82	local one (`lower_page`, once), `Theirs` drops the local ops on that page; either
145	Publication attempts are recorded before network I/O. A retained attempt	83	applies from the conflicted batch on.
146	requires its recorded revision to remain present in the remote, or the remote	84
147	page to equal the intent's `after` model exactly, followed by comparison,	85	Publication attempts are recorded before network I/O. An attempt confirms only
148	flushing and refreshed header version metadata before acknowledgement. Otherwise	86	when the remote holds its revisions, or every page it changed as it changed them,
149	the attempt remains `AwaitingConfirmation`; an uncertain publication is never	87	followed by `Remote::confirm`; otherwise it stays `AwaitingConfirmation` and is never
150	replayed. A durable `Published` receipt survives reopening. Transport errors	88	replayed. `release(id, archive, Resolution)` exports the queue first, then
151	return `Error::Remote` or `Error::RemoteIo`; inspect `status(id)` after the error	89	publishes the batch again (`Mine`) or abandons every unpublished edit (`Theirs`).
152	to distinguish a retained attempt from a pending edit or receipt. The error return	90	A durable `Published` receipt survives reopening.
153	does not roll back a locally acknowledged intent.	91
154		92	A schema-14 cache is converted when opened: it is exported to
155	The current operation processes one queue head; while edits remain, `snapshot`	93	`<cache>.v14-recovery`, each queued page is lowered against the page the conversion
156	preserves the complete local working image. An empty queue can refresh from the	94	has so far, and every converted page must equal the page in the old working image,
157	remote image. Synchronization holds a separate owner lock, so local saves can	95	or the conversion rolls back and the open fails naming the archive.
158	continue during network waits; competing synchronization calls return `WouldBlock`.
159
160	`review_page(id, local, remote, after)` resolves the oldest page conflict with a
161	model the user reviewed against the current remote page: the intent's `before`
162	becomes that remote page and its `after` the reviewed model, under the same ID,
163	in one local transaction. The supplied images must still match `snapshot()` and
164	`remote_snapshot()`. Review performs no network I/O, clears the conflict to
165	`Pending` and wakes the worker; publication still reads the latest remote image,
166	so another overlapping remote edit can produce a new conflict. Pending intents
167	and uncertain attempts cannot be reviewed.
168
169	An attempt that stays `AwaitingConfirmation` is released by review, never by
170	replay: `release_attempt(id, local, remote, archive, after)` on the replica
171	(`release` on a session) exports the branch to a new archive, then retires
172	the oldest edit's attempt. `Some(page)` continues from a page reviewed
173	against the current remote image as a fresh intent under the same id,
174	keeping later edits; `None` abandons the local branch, whose ids report
175	`EditStatus::Archived { archive }` from then on, and the working image
176	returns to the remote image. Neither writes a receipt: the uncertain
177	publication may or may not have landed, and the archive is the record of
178	what was attempted.
179
180	Opening recognizes the application identity and the current schema version only;
181	caches and archives written by other versions are refused unchanged. Until the
182	application is usable end to end there are no migrations.
183		96
184	With the optional `smb` feature, `SmbRemote::new(client, path, limit)` binds an	97	With the optional `smb` feature, `SmbRemote::new(client, path, limit)` binds an
185	`notebook::smb::Client` to one share-relative file and snapshot limit. Remote identity uses the logical root	98	`notebook::smb::Client` to one share-relative file and snapshot limit. Remote identity uses the logical root
...	@@ -188,18 +101,15 @@ object space, which survives the tested native compaction that replaces the file	...	@@ -188,18 +101,15 @@ object space, which survives the tested native compaction that replaces the file
188	An `Arc<Replica>` can own one background worker. Supply a connection factory, poll	101	An `Arc<Replica>` can own one background worker. Supply a connection factory, poll
189	interval and observer; successful publications drain immediately, durable local	102	interval and observer; successful publications drain immediately, durable local
190	edits wake the worker, and `wake()` requests an immediate reachability retry.	103	edits wake the worker, and `wake()` requests an immediate reachability retry.
191	While nothing is queued, a remote whose `Remote::stamp` (its header and length, read	104	While nothing is queued, or the queue waits on a remote that has not changed since,
192	without coordination) equals the last observed image's is not read again; publishing	105	a remote whose `Remote::stamp` holds is not read again.
193	against an unchanged stamp needs no read either.
194	Transport failures discard the old connection and retry through the factory;	106	Transport failures discard the old connection and retry through the factory;
195	Read contention and `NotCommitted` operations with `WouldBlock` or `ResourceBusy`	107	Read contention and `NotCommitted` operations with `WouldBlock` or `ResourceBusy`
196	reuse the connection. Contended `NotCommitted` operations use randomized backoff,	108	reuse the connection. Contended `NotCommitted` operations use randomized backoff,
197	capped at one second, to separate competing retry cycles. Cancellation interrupts this delay; local wake notifications	109	capped at one second, to separate competing retry cycles. Cancellation interrupts this delay; local wake notifications
198	remain coalesced until its end.	110	remain coalesced until its end.
199	`RemoteIo` distinguishes connection/read failures from	111	`RemoteIo` distinguishes connection/read failures from
200	local `Io` errors. Cache/document errors stop the worker. Observers receive every	112	local `Io` errors. Cache/document errors stop the worker.
201	attempt's result on the worker thread, including unchanged conflict/uncertain
202	statuses; durable edit state remains available through `status`.
203		113
204	```no_run	114	```no_run
205	# #[cfg(feature = "smb")]	115	# #[cfg(feature = "smb")]
...	@@ -229,35 +139,25 @@ worker.stop()?;	...	@@ -229,35 +139,25 @@ worker.stop()?;
229	```	139	```
230		140
231	`stop()` cancels future steps and joins the worker, returning a fatal cache error	141	`stop()` cancels future steps and joins the worker, returning a fatal cache error
232	or worker panic. Dropping it requests cancellation without waiting. An in-flight	142	or worker panic. Dropping it requests cancellation without waiting. Remote
233	step completes before releasing ownership; a replacement worker cannot start	143	operations and callbacks must have bounded execution times if shutdown latency
234	while the old one still owns the replica. Remote operations and callbacks must	144	matters. Credentials belong to the factory, not the cache database.
235	have bounded execution times if shutdown latency matters. A dropped worker can	145
236	briefly retain the cache; use `stop()` before requiring an immediate reopen.	146	Creation refuses existing paths. Opening validates database integrity and replays
237	Cancellation and application restart retain pending edits and publication attempts.	147	the queue on its base. SQLite runs in WAL mode under exclusive locking with FULL
238	Credentials belong to the factory, not the cache database.	148	synchronization and fullfsync, each queried back: every commit is durable, and the only
239		149	file beside the cache is `<cache>-wal`, which holds committed pages until a checkpoint
240	Creation refuses existing paths. Opening recognizes the application identity and	150	and must travel with the cache when it is copied. Recovery archives are single files.
241	schema version, validates database integrity and both notebook images, and rejects	151	The cache contains notebook content.
242	unsupported journal modes without converting them. Failed initialization preserves
243	the file for inspection. SQLite uses DELETE journaling, EXTRA synchronization and
244	fullfsync; each required setting is queried back.
245
246	The cache and its pending intents contain notebook content. The core `onestore`
247	crate stays independent of SQLite and network runtimes. Device and simulator
248	examples compile and link for iOS; recorded process-interruption tests do not
249	establish physical power-loss durability. Evidence is tracked in [Milestone 9](../../evidence/MILESTONE9.md).
250		152
251	The SMB-enabled `smb_offline_client` example is an owned-lab workload for	153	The SMB-enabled `smb_offline_client` example is an owned-lab workload for
252	`tools/native_collaboration.py --offline --embedded-smb`. It separates local	154	`tools/native_collaboration.py --offline --embedded-smb`; its append-specific
253	acknowledgements, remote publication attempts, persisted receipts and cache reopen	155	conflict policy lives in the client.
254	checks. Its append-specific conflict review policy lives in the test client;
255	the library continues to preserve conflicts requiring an explicit decision.
256		156
257	## Recovery archives	157	## Recovery archives
258		158
259	`export_recovery(new_path)` captures both complete notebook images, the intent	159	`export_recovery(new_path)` captures the base and remote images, the edit queue,
260	queue, uncertain attempts, conflicts, receipts, downloaded media and the edit-ID sequence in one	160	uncertain attempts, conflicts, receipts, downloaded media and the edit-ID sequence in one
261	SQLite snapshot. It refuses existing destinations and leaves the live queue	161	SQLite snapshot. It refuses existing destinations and leaves the live queue
262	unchanged. Export to a local directory from a background thread: copying holds	162	unchanged. Export to a local directory from a background thread: copying holds
263	the cache mutex while capturing the database. Failure after the final rename can	163	the cache mutex while capturing the database. Failure after the final rename can
...	@@ -448,9 +348,6 @@ physical power-loss durability.	...	@@ -448,9 +348,6 @@ physical power-loss durability.
448	## Queue measurement	348	## Queue measurement
449		349
450	`cargo run -p notebook --release --example queue_scale -- NEW_DIRECTORY 1000`	350	`cargo run -p notebook --release --example queue_scale -- NEW_DIRECTORY 1000`
451	measures alternating-page saves that retain separate queue IDs, cache reopen,	351	measures alternating-page edits, cache reopen, recovery export and one local-file
452	recovery export and local-file publication. JSON lines record each acknowledgement	352	publication of the queue. `keystroke_probe PARAGRAPHS KEYSTROKES` types into a large
453	and publication latency plus image/cache sizes. The workload verifies every ID	353	page and reports the bytes the cache and the section file write per keystroke.
454	and both final page titles, then independently reopens the recovery archive.
455	Use an external resource monitor for peak memory; these local-file timings do not
456	measure SMB or phone performance.

crates/notebook/examples/cache_probe.rs+75-108

 @@ -1,8 +1,9 @@
-use notebook::{Operation, Replica};
+use notebook::Replica;
+use onestore::op::{Op, PageOp};
 use onestore::{
     ExGuid, RevisionIndex, Store,
     document::{Document, Kind},
-    page::{Page, PageObject, Paragraph, text::Edit},
+    page::{PageObject, Paragraph},
 };
 use std::{
     io::{self, BufRead, Write},
 @@ -86,34 +87,25 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
         let mut ids = Vec::new();
         let mut font_size = None;
         for pending in cache.pending()? {
-            let Operation::Page(intent) = &pending.operation else {
+            let [Op::Page { op, .. }] = &pending.edit.ops[..] else {
-                panic!("Unexpected operation for this fixture")
+                panic!("Unexpected edit for this fixture")
             };
-            let operation = match operation_kind.as_str() {
+            let operation = match (operation_kind.as_str(), op) {
-                "text" => {
+                ("text", PageOp::Text { text, range, with }) => {
-                    let (object, before, range, replacement) =
+                    assert_eq!(*text, target);
-                        intent.text_change().expect("one replaced paragraph");
+                    assert_eq!(*range, 0..u32::try_from(expected.encode_utf16().count())?);
-                    assert_eq!(object, target);
+                    let operation: u64 = with.split_once(':').unwrap().0.parse()?;
-                    assert_eq!(before, expected);
-                    assert_eq!(range, 0..u32::try_from(expected.encode_utf16().count())?);
-                    let operation: u64 = replacement.split_once(':').unwrap().0.parse()?;
                     expected = payload(operation, size);
-                    assert_eq!(replacement, expected);
+                    assert_eq!(*with, expected);
                     operation
                 }
-                "insert" => {
+                (
-                    let added: Vec<_> = intent
+                    "insert",
-                        .after
+                    PageOp::Add {
-                        .objects
+                        object: PageObject::Outline(outline),
-                        .iter()
+                        ..
-                        .filter(|object| {
+                    },
-                            !intent.before.objects.iter().any(|o| o.id() == object.id())
+                ) => {
-                        })
-                        .collect();
-                    // A save that replaced a pending one carries its outlines too.
-                    let Some(PageObject::Outline(outline)) = added.last() else {
-                        panic!("Expected an added outline")
-                    };
                     let text = outline.paragraphs[0].text().unwrap().text.text();
                     let operation: u64 = text.split_once(':').unwrap().0.parse()?;
                     assert_eq!(text, payload(operation, size));
 @@ -124,33 +116,16 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
                     assert!(revision.nodes.contains_key(&outline.id));
                     operation
                 }
-                "format" => {
+                ("format", PageOp::Format { text, set, .. }) => {
-                    let paragraph = intent
+                    assert_eq!(*text, target);
-                        .after
+                    let [onestore::TextAttribute::FontSize(value)] = set[..] else {
-                        .objects
+                        panic!("Expected a font size")
-                        .iter()
+                    };
-                        .find_map(|object| match object {
-                            PageObject::Outline(outline) => outline
-                                .paragraphs
-                                .iter()
-                                .find(|p| p.text().is_some_and(|t| t.id == target)),
-                            _ => None,
-                        })
-                        .expect("formatted paragraph");
-                    let text = paragraph.text().unwrap();
-                    assert_eq!(text.text.text(), expected);
-                    let value = text.text.spans()[0].format.font_size.expect("font size");
-                    assert!(
-                        text.text
-                            .spans()
-                            .iter()
-                            .all(|s| s.format.font_size == Some(value))
-                    );
                     assert!((7.0..=130.0).contains(&value) && value.fract() == 0.0);
                     font_size = Some(value);
                     value as u64 - 6
                 }
-                _ => unreachable!(),
+                other => panic!("Unexpected op {other:?}"),
             };
             assert!(operations.last().is_none_or(|last| *last < operation));
             assert!(ids.last().is_none_or(|last| *last < pending.id));
 @@ -167,10 +142,7 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
             );
         }
         if operations.is_empty() {
-            assert!(
+            assert!(snapshot == base, "An empty local queue changed its image");
-                snapshot == base,
-                "An empty local queue changed its working image"
-            );
         }
         if let Some(output) = args.get(3) {
             std::fs::write(output, &snapshot)?;
 @@ -197,51 +169,43 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
     let replacement = payload(operation, size);
     println!("editing {operation}");
     io::stdout().flush()?;
-    let (space, page) = {
+    let end = u32::try_from(text.encode_utf16().count())?;
-        let store = Store::parse(&source)?;
+    let op = match operation_kind.as_str() {
-        let index = RevisionIndex::parse(&store)?;
+        "text" => PageOp::Text {
-        let document = Document::parse(&index)?;
+            text: oid,
-        let mut page = Page::from_space(&document, sid)?;
+            range: 0..end,
-        fn target_paragraph(page: &mut Page, oid: ExGuid) -> &mut onestore::page::PageParagraph {
+            with: replacement.clone(),
-            page.objects
+        },
-                .iter_mut()
+        "insert" => {
+            let page = cache.page(sid)?;
+            let template = page
+                .objects
+                .iter()
                 .find_map(|object| match object {
                     PageObject::Outline(outline) => outline
                         .paragraphs
-                        .iter_mut()
+                        .iter()
                         .find(|p| p.text().is_some_and(|t| t.id == oid)),
                     _ => None,
                 })
                 .expect("target paragraph")
-        }
+                .clone();
-        let end = u32::try_from(text.encode_utf16().count())?;
+            let mut fresh = template.clone();
-        match operation_kind.as_str() {
+            fresh.id = onestore::page::text::new_id()?;
-            "text" => {
+            fresh.parent = None;
-                let target = target_paragraph(&mut page, oid).text_mut().unwrap();
+            fresh.level = 1;
-                let format = target.text.format_at(0)?.clone();
+            fresh.lists.clear();
-                target.text.apply(Edit {
+            fresh.tags.clear();
-                    range: 0..end,
+            fresh.style = None;
-                    replacement: Paragraph::new(replacement.clone(), format),
+            let format = template.text().unwrap().text.format_at(0)?.clone();
-                })?;
+            fresh.content = onestore::page::ParagraphContent::Text(onestore::page::TextObject {
-            }
+                id: onestore::page::text::new_id()?,
-            "insert" => {
+                date_field: None,
-                let template = target_paragraph(&mut page, oid).clone();
+                text: Paragraph::new(replacement.clone(), format),
-                let mut fresh = template.clone();
+                tags: Vec::new(),
-                fresh.id = onestore::page::text::new_id()?;
+            });
-                fresh.parent = None;
+            PageOp::Add {
-                fresh.level = 1;
+                object: PageObject::Outline(onestore::page::Outline {
-                fresh.lists.clear();
-                fresh.tags.clear();
-                fresh.style = None;
-                let format = template.text().unwrap().text.format_at(0)?.clone();
-                fresh.content =
-                    onestore::page::ParagraphContent::Text(onestore::page::TextObject {
-                        id: onestore::page::text::new_id()?,
-                        date_field: None,
-                        text: Paragraph::new(replacement.clone(), format),
-                        tags: Vec::new(),
-                    });
-                let outline = onestore::page::Outline {
                     id: onestore::page::text::new_id()?,
                     title: false,
                     min_width: None,
 @@ -253,29 +217,32 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
                     indents: Vec::new(),
                     paragraphs: vec![fresh],
                     unsupported: Vec::new(),
-                };
+                }),
-                let at = page
+                before: page
                     .objects
                     .iter()
-                    .position(|o| matches!(o, PageObject::Title(_)))
+                    .find(|o| matches!(o, PageObject::Title(_)))
-                    .unwrap_or(page.objects.len());
+                    .map(PageObject::id),
-                page.objects.insert(at, PageObject::Outline(outline));
             }
-            "format" => {
+        }
-                assert!((1..=124).contains(&operation));
+        "format" => {
-                let target = target_paragraph(&mut page, oid).text_mut().unwrap();
+            assert!((1..=124).contains(&operation));
-                let mut format = target.text.format_at(0)?.clone();
+            PageOp::Format {
-                format.font_size = Some(6.0 + operation as f32);
+                text: oid,
-                target.text.apply(Edit {
+                range: 0..end,
-                    range: 0..end,
+                set: vec![onestore::TextAttribute::FontSize(6.0 + operation as f32)],
-                    replacement: Paragraph::new(text.clone(), format),
+                clear: Vec::new(),
-                })?;
             }
-            _ => unreachable!(),
         }
-        (sid, page)
+        _ => unreachable!(),
     };
-    let id = cache.save(&source, space, &page, "Fixture")?.unwrap();
+    let id = cache.apply(
+        "Fixture",
+        onestore::op::Edit {
+            at: 133_000_000_000_000_000,
+            ops: vec![Op::Page { space: sid, op }],
+        },
+    )?;
     if acknowledgement == "unack" {
         println!("durable {operation} {id}");
     } else {

crates/notebook/examples/keystroke_probe.rs created+260

...	@@ -0,0 +1,260 @@
1	//! `keystroke_probe PARAGRAPHS KEYSTROKES`: types into the middle paragraph of a page
2	//! of PARAGRAPHS paragraphs and reports, per keystroke, the time, the bytes the cache
3	//! writes to disk and the bytes the section file sees: queued alone, then each one
4	//! published at once, then idle polls. The section file stays in memory so the
5	//! process's disk writes (macOS `proc_pid_rusage`) are the cache's.
6
7	use notebook::{Remote, Replica};
8	use onestore::{
9	CommitError, CommitIo, ExGuid, Stamp, Transaction,
10	document::{Format, Layout},
11	op::{Edit, Op, PageOp, SectionOp},
12	page::{
13	Outline, Page, PageObject, PageParagraph, Paragraph, ParagraphContent, TextObject,
14	text::new_id,
15	},
16	};
17	use std::{
18	io,
19	time::{Duration, Instant},
20	};
21
22	fn disk_written() -> u64 {
23	// SAFETY: proc_pid_rusage fills the zeroed structure for this process.
24	unsafe {
25	let mut info: libc::rusage_info_v2 = std::mem::zeroed();
26	libc::proc_pid_rusage(
27	libc::getpid(),
28	libc::RUSAGE_INFO_V2,
29	&mut info as mut _ as mut _,
30	);
31	info.ri_diskio_byteswritten
32	}
33	}
34
35	/// The section file in memory, counting what synchronization reads and writes, so the
36	/// process's disk writes are the cache's alone.
37	struct Memory {
38	bytes: Vec<u8>,
39	read: u64,
40	written: u64,
41	}
42
43	impl CommitIo for Memory {
44	fn read_at(&mut self, offset: u64, output: &mut [u8]) -> io::Result<usize> {
45	let offset = offset as usize;
46	let size = output.len().min(self.bytes.len().saturating_sub(offset));
47	output[..size].copy_from_slice(&self.bytes[offset..offset + size]);
48	self.read += size as u64;
49	Ok(size)
50	}
51	fn write_at(&mut self, offset: u64, bytes: &[u8]) -> io::Result<usize> {
52	let offset = offset as usize;
53	self.bytes
54	.resize(self.bytes.len().max(offset + bytes.len()), 0);
55	self.bytes[offset..offset + bytes.len()].copy_from_slice(bytes);
56	self.written += bytes.len() as u64;
57	Ok(bytes.len())
58	}
59	fn flush(&mut self) -> io::Result<()> {
60	Ok(())
61	}
62	}
63
64	impl Remote for Memory {
65	fn read(&mut self) -> io::Result<Vec<u8>> {
66	self.read += self.bytes.len() as u64;
67	Ok(self.bytes.clone())
68	}
69	fn stamp(&mut self) -> io::Result<Option<Stamp>> {
70	self.read += 1024;
71	Ok(Stamp::of(&self.bytes).ok())
72	}
73	fn publish(&mut self, transaction: &Transaction) -> Result<(), CommitError> {
74	transaction.commit(self)
75	}
76	fn confirm(&mut self, snapshot: &[u8]) -> Result<(), CommitError> {
77	onestore::confirm_snapshot(self, snapshot)
78	}
79	}
80
81	fn paragraph(i: usize) -> PageParagraph {
82	let words = [
83	"quick", "brown", "fox", "jumps", "over", "the", "lazy", "dog",
84	];
85	let text: Vec<&str> = (0..1 + i % 17).map(\|j\| words[(i * 7 + j) % 8]).collect();
86	PageParagraph {
87	id: new_id().unwrap(),
88	parent: None,
89	level: 1,
90	style: None,
91	format: Format::default(),
92	content: ParagraphContent::Text(TextObject {
93	id: new_id().unwrap(),
94	date_field: None,
95	text: Paragraph::new(text.join(" "), Format::default()),
96	tags: Vec::new(),
97	}),
98	lists: Vec::new(),
99	tags: Vec::new(),
100	media: Default::default(),
101	collapsed: false,
102	}
103	}
104
105	fn percentiles(label: &str, mut times: Vec<Duration>, bytes: &[u64]) {
106	times.sort();
107	let at = \|q: f64\| times[((times.len() - 1) as f64 * q) as usize];
108	let mean = bytes.iter().sum::<u64>() as f64 / bytes.len() as f64;
109	let mut sorted = bytes.to_vec();
110	sorted.sort();
111	println!(
112	"{label}: time p50 {:.2?} p90 {:.2?} max {:.2?}; bytes mean {:.0} p50 {} max {}",
113	at(0.5),
114	at(0.9),
115	at(1.0),
116	mean,
117	sorted[sorted.len() / 2],
118	sorted[sorted.len() - 1]
119	);
120	}
121
122	fn main() -> Result<(), Box<dyn std::error::Error>> {
123	let mut args = std::env::args().skip(1);
124	let count: usize = args.next().ok_or("PARAGRAPHS")?.parse()?;
125	let keystrokes: usize = args.next().map_or(Ok(200), \|n\| n.parse())?;
126	let directory = tempfile::tempdir()?;
127	// The probe page, stored in the section file before the cache opens.
128	let source = {
129	let arena = onestore::Arena::default();
130	let mut section =
131	onestore::Section::open(&arena, onestore::create_section("probe.one", "", "Probe")?)?;
132	let creation = onestore::PageCreation::new(None, Some("Probe"), "Probe")?;
133	let page = Page {
134	title: "Probe".into(),
135	identity: None,
136	created: None,
137	margin_origin: [0.0; 2],
138	objects: vec![PageObject::Outline(Outline {
139	id: new_id()?,
140	title: false,
141	min_width: None,
142	layout: Layout {
143	x: Some(36.0),
144	y: Some(86.4),
145	..Layout::default()
146	},
147	indents: Vec::new(),
148	paragraphs: (0..count).map(paragraph).collect(),
149	unsupported: Vec::new(),
150	})],
151	definitions: Default::default(),
152	};
153	section.apply(
154	"Probe",
155	&Edit {
156	at: 133_000_000_000_000_000,
157	ops: vec![Op::Section(SectionOp::Import { creation, page })],
158	},
159	)?;
160	section.seal()?;
161	section.image()
162	};
163	println!("section {} bytes, {count} paragraphs", source.len());
164	let cache = Replica::create(directory.path().join("cache.sqlite"), &source)?;
165	let (space, _, _) = cache
166	.pages()?
167	.into_iter()
168	.find(\|(_, title, _)\| title == "Probe")
169	.ok_or("the probe page")?;
170	let target: ExGuid = cache
171	.page(space)?
172	.objects
173	.iter()
174	.find_map(\|object\| match object {
175	PageObject::Outline(outline) if outline.paragraphs.len() == count => {
176	outline.paragraphs[count / 2].text().map(\|text\| text.id)
177	}
178	_ => None,
179	})
180	.ok_or("the probe paragraph")?;
181	let mut remote = Memory {
182	bytes: source.clone(),
183	read: 0,
184	written: 0,
185	};
186	let mut at = 0_u32;
187	let mut keystroke = \|cache: &Replica\| -> Result<(), notebook::Error> {
188	cache.apply(
189	"Probe",
190	Edit {
191	at: 133_000_000_000_000_000,
192	ops: vec![Op::Page {
193	space,
194	op: PageOp::Text {
195	text: target,
196	range: at..at,
197	with: "x".into(),
198	},
199	}],
200	},
201	)?;
202	at += 1;
203	Ok(())
204	};
205
206	let (mut times, mut bytes) = (Vec::new(), Vec::new());
207	for _ in 0..keystrokes {
208	let (disk, start) = (disk_written(), Instant::now());
209	keystroke(&cache)?;
210	times.push(start.elapsed());
211	bytes.push(disk_written() - disk);
212	}
213	percentiles("queued keystroke (apply + SQLite commit)", times, &bytes);
214
215	let (disk, read, written, start) =
216	(disk_written(), remote.read, remote.written, Instant::now());
217	cache.sync_once(&mut remote)?;
218	println!(
219	"publish the {keystrokes} queued keystrokes as one batch: {:.2?}; cache {} B, file writes {} B, file reads {} B",
220	start.elapsed(),
221	disk_written() - disk,
222	remote.written - written,
223	remote.read - read
224	);
225
226	let (mut times, mut cache_bytes, mut file_bytes, mut reads) =
227	(Vec::new(), Vec::new(), Vec::new(), Vec::new());
228	for _ in 0..keystrokes {
229	let (disk, read, written, start) =
230	(disk_written(), remote.read, remote.written, Instant::now());
231	keystroke(&cache)?;
232	cache.sync_once(&mut remote)?;
233	times.push(start.elapsed());
234	file_bytes.push(remote.written - written);
235	cache_bytes.push(disk_written() - disk);
236	reads.push(remote.read - read);
237	}
238	percentiles(
239	"keystroke published at once: cache",
240	times.clone(),
241	&cache_bytes,
242	);
243	percentiles(
244	"keystroke published at once: file writes",
245	times.clone(),
246	&file_bytes,
247	);
248	percentiles("keystroke published at once: file reads", times, &reads);
249
250	let (disk, read) = (disk_written(), remote.read);
251	for _ in 0..100 {
252	assert!(cache.sync_once(&mut remote)?.edit.is_none());
253	}
254	println!(
255	"100 idle polls: cache {} B, file reads {} B",
256	disk_written() - disk,
257	remote.read - read
258	);
259	Ok(())
260	}

crates/notebook/examples/migrate_probe.rs created+118

...	@@ -0,0 +1,118 @@
1	//! migrate_probe CACHE...: converts copies of schema-14 caches, reports what they hold
2	//! and, where nothing blocks the queue, publishes it to an in-memory copy of the remote.
3	use notebook::{Remote, Replica};
4	use onestore::{CommitError, CommitIo, Stamp, Transaction};
5	use std::io;
6
7	struct Memory(Vec<u8>);
8
9	impl CommitIo for Memory {
10	fn read_at(&mut self, offset: u64, output: &mut [u8]) -> io::Result<usize> {
11	let offset = offset as usize;
12	let size = output.len().min(self.0.len().saturating_sub(offset));
13	output[..size].copy_from_slice(&self.0[offset..offset + size]);
14	Ok(size)
15	}
16	fn write_at(&mut self, offset: u64, bytes: &[u8]) -> io::Result<usize> {
17	let offset = offset as usize;
18	self.0.resize(self.0.len().max(offset + bytes.len()), 0);
19	self.0[offset..offset + bytes.len()].copy_from_slice(bytes);
20	Ok(bytes.len())
21	}
22	fn flush(&mut self) -> io::Result<()> {
23	Ok(())
24	}
25	}
26
27	impl Remote for Memory {
28	fn read(&mut self) -> io::Result<Vec<u8>> {
29	Ok(self.0.clone())
30	}
31	fn stamp(&mut self) -> io::Result<Option<Stamp>> {
32	Ok(Stamp::of(&self.0).ok())
33	}
34	fn publish(&mut self, transaction: &Transaction) -> Result<(), CommitError> {
35	transaction.commit(self)
36	}
37	fn confirm(&mut self, snapshot: &[u8]) -> Result<(), CommitError> {
38	onestore::confirm_snapshot(self, snapshot)
39	}
40	}
41
42	fn pages(replica: &Replica) -> Result<Vec<onestore::page::Page>, notebook::Error> {
43	replica
44	.pages()?
45	.into_iter()
46	.map(\|(space, ..)\| replica.page(space))
47	.collect()
48	}
49
50	fn main() -> Result<(), Box<dyn std::error::Error>> {
51	for path in std::env::args().skip(1) {
52	let copy = std::env::temp_dir().join(format!(
53	"migrate-probe-{}-{}",
54	std::process::id(),
55	std::path::Path::new(&path)
56	.file_name()
57	.unwrap()
58	.to_string_lossy()
59	));
60	std::fs::copy(&path, &copy)?;
61	// A cache open or crashed in WAL mode keeps committed pages in its `-wal` file.
62	let wal = format!("{path}-wal");
63	if std::path::Path::new(&wal).exists() {
64	let mut target = copy.as_os_str().to_owned();
65	target.push("-wal");
66	std::fs::copy(&wal, target)?;
67	}
68	let started = std::time::Instant::now();
69	match Replica::open(&copy) {
70	Ok(replica) => {
71	let elapsed = started.elapsed();
72	let pending = replica.pending()?;
73	let summary = replica.recovery_summary()?;
74	println!(
75	"{path}: converted in {:.1} ms; {} edits; {:?}; conflict {:?}",
76	elapsed.as_secs_f64() * 1e3,
77	pending.len(),
78	summary,
79	replica.conflict()?
80	);
81	for edit in &pending {
82	println!(
83	" {} {:?} {} ops",
84	edit.id,
85	replica.status(edit.id)?,
86	edit.edit.ops.len()
87	);
88	}
89	for (space, title, level) in replica.pages()? {
90	println!(" page {space} {level} {title:?}");
91	}
92	let blocked = replica.conflict()?.is_some()
93	\|\| replica.recovery_summary()?.uncertain_edits > 0;
94	if !pending.is_empty() && !blocked {
95	let local = pages(&replica)?;
96	let mut remote = Memory(replica.remote_snapshot()?);
97	let synced = replica.sync_once(&mut remote)?;
98	let published = {
99	let arena = onestore::Arena::default();
100	let mut section = onestore::Section::open(&arena, remote.0.clone())?;
101	section
102	.pages()?
103	.into_iter()
104	.map(\|(space, ..)\| section.page(space))
105	.collect::<Result<Vec<_>, _>>()?
106	};
107	println!(
108	" published {:?}; remote pages equal the converted pages: {}",
109	synced.edit.map(\|(id, _)\| id),
110	published == local
111	);
112	}
113	}
114	Err(error) => println!("{path}: {error}"),
115	}
116	}
117	Ok(())
118	}

crates/notebook/examples/queue_scale.rs+25-18

 @@ -47,13 +47,9 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
     let start = Instant::now();
     for n in 0..count {
         let edit_start = Instant::now();
-        let source = cache.snapshot()?;
-        let store = Store::parse(&source)?;
-        let index = RevisionIndex::parse(&store)?;
-        let document = Document::parse(&index)?;
         let slot = n % 2;
         let space = pages[slot].0;
-        let mut page = Page::from_space(&document, space)?;
+        let mut page = cache.page(space)?;
         let text = page
             .objects
             .iter_mut()
 @@ -76,13 +72,24 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
             range: 0..end,
             replacement: Paragraph::new(expected[slot].clone(), format),
         })?;
-        let id = cache.save(&source, space, &page, "Fixture")?.unwrap();
+        let before = cache.page(space)?;
+        let ops = onestore::op::lower_page(&before, &page)?;
+        let id = cache.apply(
+            "Fixture",
+            onestore::op::Edit {
+                at: 133_000_000_000_000_000,
+                ops: ops
+                    .into_iter()
+                    .map(|op| onestore::op::Op::Page { space, op })
+                    .collect(),
+            },
+        )?;
         assert!(ids.last().is_none_or(|previous| *previous < id));
         ids.push(id);
         println!(
             "{}",
             serde_json::json!({"phase":"ack","n":n,"id":id,
-            "ms":edit_start.elapsed().as_secs_f64()*1000.0,"working_bytes":source.len()})
+            "ms":edit_start.elapsed().as_secs_f64()*1000.0})
         );
     }
     println!(
 @@ -114,16 +121,16 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
         serde_json::json!({"phase":"export","seconds":start.elapsed().as_secs_f64()})
     );
     let start = Instant::now();
-    for (n, id) in ids.iter().enumerate() {
+    // The queue publishes as one batch.
-        let step = Instant::now();
+    let step = Instant::now();
-        assert!(
+    assert!(matches!(
-            matches!(cache.sync_once(&mut remote)?, Some((actual, EditStatus::Published { .. })) if actual == *id)
+        cache.sync_once(&mut remote)?.edit,
-        );
+        Some((actual, EditStatus::Published { .. })) if Some(&actual) == ids.last()
-        println!(
+    ));
-            "{}",
+    println!(
-            serde_json::json!({"phase":"publish","n":n,"id":id,"ms":step.elapsed().as_secs_f64()*1000.0})
+        "{}",
-        );
+        serde_json::json!({"phase":"publish","count":ids.len(),"ms":step.elapsed().as_secs_f64()*1000.0})
-    }
+    );
     assert!(cache.pending()?.is_empty());
     let published = cache.snapshot()?;
     assert_eq!(onestore::read_file(&remote.0)?, published);
 @@ -145,7 +152,7 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
             .collect::<Vec<_>>(),
         ids
     );
-    assert_eq!(archive.snapshot()?, source);
+    verify(&archive.snapshot()?, &pages, &expected)?;
     println!(
         "{}",
         serde_json::json!({"phase":"complete","count":count,

crates/notebook/examples/recovery_probe.rs+15-33

 @@ -98,12 +98,10 @@ fn report(cache: &Replica, root: &Path) -> Result<(), Box<dyn std::error::Error>
         "{}",
         json!({"event":"state", "status":status, "revision":revision,
         "local_text":local.text, "remote_text":remote.text, "remote_revision":remote.revision.to_string(),
-        "pending":cache.pending()?.iter().map(|pending|match &pending.operation {
+        "pending":cache.pending()?.iter().map(|pending| match &pending.edit.ops[..] {
-            notebook::Operation::Page(intent) => match intent.text_change() {
+            [onestore::op::Op::Page { op: onestore::op::PageOp::Text { range, with, .. }, .. }] =>
-                Some((_, before, range, replacement)) => json!({"id":pending.id,"before":before,"replacement":replacement,"range":[range.start,range.end]}),
+                json!({"id":pending.id,"replacement":with,"range":[range.start,range.end]}),
-                None => json!({"id":pending.id,"operation":"page"}),
+            _ => json!({"id":pending.id,"edit":pending.edit}),
-            },
-            operation => json!({"id":pending.id,"operation":operation}),
         }).collect::<Vec<_>>() })
     );
     Ok(())
 @@ -128,34 +126,18 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
         drop(remote);
         let cache = Replica::create(root.join("cache.sqlite"), &source)?;
         let at = u32::try_from(target.text.encode_utf16().count())?;
-        let mut page = {
+        let edit = onestore::op::Edit {
-            let store = onestore::Store::parse(&source)?;
+            at: 133_000_000_000_000_000,
-            let index = onestore::RevisionIndex::parse(&store)?;
+            ops: vec![onestore::op::Op::Page {
-            let document = onestore::document::Document::parse(&index)?;
+                space: target.space,
-            onestore::page::Page::from_space(&document, target.space)?
+                op: onestore::op::PageOp::Text {
+                    text: target.object,
+                    range: at..at,
+                    with: " [offline-recovery]".into(),
+                },
+            }],
         };
-        let paragraph = page
+        assert_eq!(cache.apply("Fixture", edit)?, 1);
-            .objects
-            .iter_mut()
-            .find_map(|object| match object {
-                onestore::page::PageObject::Outline(outline) => outline
-                    .paragraphs
-                    .iter_mut()
-                    .find(|p| p.text().is_some_and(|t| t.id == target.object)),
-                _ => None,
-            })
-            .ok_or("Target paragraph is not on its page")?
-            .text_mut()
-            .unwrap();
-        let format = paragraph.text.format_at(at)?.clone();
-        paragraph.text.apply(onestore::page::text::Edit {
-            range: at..at,
-            replacement: onestore::page::Paragraph::new(" [offline-recovery]".into(), format),
-        })?;
-        assert_eq!(
-            cache.save(&source, target.space, &page, "Fixture")?,
-            Some(1)
-        );
         phase("local-after");
         report(&cache, root)?;
     } else if args.len() == 2 && ["inspect", "sync"].contains(&mode.as_str()) {

crates/notebook/examples/session_client.rs+13-4

 @@ -159,9 +159,9 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
         for event in section.events() {
             match event {
                 Event::Attempt {
-                    id,
+                    status: EditStatus::Published { .. },
-                    status: EditStatus::Published { revision },
+                    ..
-                } => receipts.push((id, revision)),
+                } => {}
                 Event::Attempt { id, status } => {
                     println!(
                         "{}",
 @@ -175,7 +175,16 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
                     );
                 }
                 Event::Failed(error) => return Err(error.into()),
-                Event::Refreshed => {}
+                Event::Rejected { error, .. } => return Err(error.into()),
+                Event::Refreshed | Event::Changed(_) => {}
+            }
+        }
+        // A batch reports its newest edit; each edit's receipt is its own.
+        for (id, ..) in &queued {
+            if !receipts.iter().any(|(n, _)| n == id)
+                && let Some(EditStatus::Published { revision }) = section.status(*id)?
+            {
+                receipts.push((*id, revision));
             }
         }
     }

crates/notebook/examples/smb_offline_client.rs+52-195

...	@@ -3,9 +3,7 @@ mod concurrent;	...	@@ -3,9 +3,7 @@ mod concurrent;
3		3
4	use notebook::smb::{Client, Credentials};	4	use notebook::smb::{Client, Credentials};
5	use notebook::{EditStatus, Error, Remote, Replica, SmbRemote};	5	use notebook::{EditStatus, Error, Remote, Replica, SmbRemote};
6	use onestore::{	6	use onestore::{CommitError, CommitState, ExGuid, RevisionIndex, Store, Transaction};
7	CommitError, CommitState, ExGuid, RevisionIndex, Store, Transaction, page::Paragraph,
8	};
9	use serde_json::json;	7	use serde_json::json;
10	use std::{	8	use std::{
11	env,	9	env,
...	@@ -252,91 +250,19 @@ impl<R: Remote> Remote for Traced<R> {	...	@@ -252,91 +250,19 @@ impl<R: Remote> Remote for Traced<R> {
252	}	250	}
253	}	251	}
254		252
255	fn tokens(text: &str) -> Option<Vec<&str>> {	253	/// The edit appending `token` at `at` of a text.
256	let mut remaining = text.strip_prefix("Concurrent edits:")?;	254	fn append(space: ExGuid, text: ExGuid, at: u32, token: &str) -> onestore::op::Edit {
257	let mut tokens = Vec::new();	255	onestore::op::Edit {
258	while !remaining.is_empty() {	256	at: u64::try_from(now()).unwrap_or_default() * 10 + 116_444_736_000_000_000,
259	let body = remaining.strip_prefix(" [w")?;	257	ops: vec![onestore::op::Op::Page {
260	let (token, tail) = body.split_once(']')?;	258	space,
261	let (actor, operation) = token.split_once(':')?;	259	op: onestore::op::PageOp::Text {
262	if actor.is_empty()	260	text,
263	\|\| operation.is_empty()	261	range: at..at,
264	\|\| !actor	262	with: token.to_owned(),
265	.bytes()	263	},
266	.chain(operation.bytes())	264	}],
267	.all(\|b\| b.is_ascii_digit())
268	\|\| tokens.contains(&token)
269	{
270	return None;
271	}
272	tokens.push(token);
273	remaining = tail;
274	}
275	Some(tokens)
276	}
277
278	// This owned workload explicitly resolves append conflicts after all retained tokens.
279	fn page_with(
280	bytes: &[u8],
281	space: ExGuid,
282	text: ExGuid,
283	) -> Result<onestore::page::Page, Box<dyn std::error::Error>> {
284	let store = Store::parse(bytes)?;
285	let index = RevisionIndex::parse(&store)?;
286	let document = onestore::document::Document::parse(&index)?;
287	let page = onestore::page::Page::from_space(&document, space)?;
288	if paragraph_mut(&mut page.clone(), text).is_none() {
289	return Err("The target text is not on its page".into());
290	}
291	Ok(page)
292	}
293
294	fn paragraph_mut(
295	page: &mut onestore::page::Page,
296	text: ExGuid,
297	) -> Option<&mut onestore::page::TextObject> {
298	for object in &mut page.objects {
299	let outlines: Vec<&mut onestore::page::Outline> = match object {
300	onestore::page::PageObject::Outline(outline) => vec![outline],
301	onestore::page::PageObject::Title(title) => title.outlines.iter_mut().collect(),
302	_ => Vec::new(),
303	};
304	for outline in outlines {
305	if let Some(paragraph) = outline
306	.paragraphs
307	.iter_mut()
308	.find(\|p\| p.text().is_some_and(\|t\| t.id == text))
309	{
310	return paragraph.text_mut();
311	}
312	}
313	}
314	None
315	}
316
317	fn append_to(page: &mut onestore::page::Page, text: ExGuid, at: u32, token: &str) {
318	let target = paragraph_mut(page, text).expect("target text is on its page");
319	let format = target.text.format_at(at).unwrap().clone();
320	target
321	.text
322	.apply(onestore::page::text::Edit {
323	range: at..at,
324	replacement: Paragraph::new(token.into(), format),
325	})
326	.unwrap();
327	}
328
329	fn append_position(before: &str, current: &str, token: &str) -> Option<u32> {
330	let original = tokens(before)?;
331	let present = tokens(current)?;
332	let mut retained = present.iter();
333	for token in original {
334	retained.find(\|&&candidate\| candidate == token)?;
335	}	265	}
336	if current.contains(token) {
337	return None;
338	}
339	u32::try_from(current.encode_utf16().count()).ok()
340	}	266	}
341		267
342	fn main() -> Result<(), Box<dyn std::error::Error>> {	268	fn main() -> Result<(), Box<dyn std::error::Error>> {
...	@@ -459,10 +385,11 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {	...	@@ -459,10 +385,11 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
459	let at = u32::try_from(target.text.encode_utf16().count())?;	385	let at = u32::try_from(target.text.encode_utf16().count())?;
460	let token = format!(" [{}:{}]", args[2], generated);	386	let token = format!(" [{}:{}]", args[2], generated);
461	let started = now();	387	let started = now();
462	let mut page = page_with(&source, target.space, target.object)?;	388	match cache.apply(
463	append_to(&mut page, target.object, at, &token);	389	"Offline document writer",
464	match cache.save(&source, target.space, &page, "Offline document writer") {	390	append(target.space, target.object, at, &token),
465	Ok(Some(id)) => {	391	) {
		392	Ok(id) => {
466	println!(	393	println!(
467	"{}",	394	"{}",
468	json!({"event":"local_commit", "id":id, "operation":generated, "space":target.space.to_string(), "object":target.object.to_string(), "before":target.text, "token":token, "started_us":started, "finished_us":now()})	395	json!({"event":"local_commit", "id":id, "operation":generated, "space":target.space.to_string(), "object":target.object.to_string(), "before":target.text, "token":token, "started_us":started, "finished_us":now()})
...	@@ -470,43 +397,44 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {	...	@@ -470,43 +397,44 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
470	ids.push(id);	397	ids.push(id);
471	generated += 1;	398	generated += 1;
472	}	399	}
473	Err(Error::Io(error)) if error.kind() == io::ErrorKind::ResourceBusy => {}
474	other => return Err(format!("Unexpected local result: {other:?}").into()),	400	other => return Err(format!("Unexpected local result: {other:?}").into()),
475	}	401	}
476	}	402	}
477	if let Some(intent) = pending.first()	403	if let Some(conflict) = cache.conflict()? {
478	&& matches!(cache.status(intent.id)?, Some(EditStatus::Conflict(_)))	404	// Concurrent appends meet at the end of the text: take the remote text and
479	{	405	// append the queued tokens it lacks after it again.
480	let local = cache.snapshot()?;	406	let remote = view(&cache.remote_snapshot()?)?;
481	let remote = cache.remote_snapshot()?;	407	let tokens: Vec<String> = cache
482	let current = view(&remote)?;	408	.pending()?
483	let notebook::Operation::Page(edit) = &intent.operation else {	409	.iter()
484	return Err(format!(	410	.flat_map(\|queued\| queued.edit.ops.iter())
485	"Intent {} requires review: {:?}",	411	.filter_map(\|op\| match op {
486	intent.id,	412	onestore::op::Op::Page {
487	cache.status(intent.id)?	413	op: onestore::op::PageOp::Text { with, .. },
488	)	414	..
489	.into());	415	} => Some(with.clone()),
490	};	416	_ => None,
491	let (object, before, _, token) = edit	417	})
492	.text_change()	418	.filter(\|token\| !remote.text.contains(token.as_str()))
493	.ok_or("A review expects one appended token")?;	419	.collect();
494	let at = append_position(&before, &current.text, &token)	420	match cache.resolve(conflict.id, notebook::Resolution::Theirs) {
495	.ok_or("Append model disagrees with retained history")?;	421	Ok(()) => {
496	let mut reviewed = page_with(&remote, intent.space, object)?;	422	let mut at = u32::try_from(remote.text.encode_utf16().count())?;
497	append_to(&mut reviewed, object, at, &token);	423	for token in &tokens {
498	match cache.review_page(intent.id, &local, &remote, &reviewed) {	424	cache.apply(
499	Ok(()) => println!(	425	"Offline document writer",
500	"{}",	426	append(remote.space, remote.object, at, token),
501	json!({"event":"reviewed_append", "id":intent.id, "before":before, "remote":current.text, "token":token, "at_us":now()})	427	)?;
502	),	428	at += u32::try_from(token.encode_utf16().count())?;
		429	}
		430	println!(
		431	"{}",
		432	json!({"event":"reviewed_append", "id":conflict.id, "remote":remote.text, "tokens":tokens, "at_us":now()})
		433	);
		434	}
503	Err(Error::Io(error))	435	Err(Error::Io(error))
504	if [	436	if [io::ErrorKind::WouldBlock, io::ErrorKind::InvalidInput]
505	io::ErrorKind::ResourceBusy,	437	.contains(&error.kind()) => {}
506	io::ErrorKind::WouldBlock,
507	io::ErrorKind::InvalidInput,
508	]
509	.contains(&error.kind()) => {}
510	Err(error) => return Err(error.into()),	438	Err(error) => return Err(error.into()),
511	}	439	}
512	}	440	}
...	@@ -546,74 +474,3 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {	...	@@ -546,74 +474,3 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
546	);	474	);
547	Ok(())	475	Ok(())
548	}	476	}
549
550	#[test]
551	fn append_review_requires_a_unique_ordered_history_and_an_absent_new_token() {
552	assert_eq!(
553	append_position(
554	"Concurrent edits: [w0:0]",
555	"Concurrent edits: [w1:0] [w0:0]",
556	" [w0:1]"
557	),
558	Some(31)
559	);
560	for current in [
561	"Concurrent edits:",
562	"Concurrent edits: [w0:0] [w0:0]",
563	"Concurrent edits: [w0:1] [w0:0]",
564	"Concurrent edits: changed [w0:0]",
565	] {
566	assert_eq!(
567	append_position("Concurrent edits: [w0:0]", current, " [w0:1]"),
568	None
569	);
570	}
571	assert_eq!(
572	append_position(
573	"Concurrent edits: [w0:0] [w1:0]",
574	"Concurrent edits: [w1:0] [w0:0]",
575	" [w0:1]"
576	),
577	None
578	);
579	}
580
581	#[cfg(test)]
582	mod tests {
583	use super::*;
584
585	#[test]
586	fn publication_differences_retain_removed_text_and_graph_identities() {
587	let before = DocumentView {
588	texts: serde_json::from_value(json!({"left":{"text":"ab"}, "right":{"text":"cd"}, "untouched":{"text":"ef"}})).unwrap(),
589	graph: serde_json::from_value(json!({"outline":{"children":["a","b"]}, "a":{"content":["left"]}, "b":{"content":["right"]}})).unwrap(),
590	};
591	let after = DocumentView {
592	texts: serde_json::from_value(
593	json!({"left":{"text":"abcd"}, "untouched":{"text":"ef"}}),
594	)
595	.unwrap(),
596	graph: serde_json::from_value(
597	json!({"outline":{"children":["a"]}, "a":{"content":["left"]}}),
598	)
599	.unwrap(),
600	};
601	let changes = after.changes(&before);
602	assert_eq!(
603	changes.texts,
604	serde_json::from_value::<serde_json::Map<_, _>>(
605	json!({"left":{"text":"abcd"}, "right":null})
606	)
607	.unwrap()
608	);
609	assert_eq!(
610	changes.graph,
611	serde_json::from_value::<serde_json::Map<_, _>>(
612	json!({"outline":{"children":["a"]}, "b":null})
613	)
614	.unwrap()
615	);
616	assert_eq!(before.changes(&after).texts["right"], before.texts["right"]);
617	assert_eq!(before.changes(&before), DocumentView::default());
618	}
619	}

crates/notebook/src/assets.rs+28-37

 @@ -1,5 +1,9 @@
 use super::*;
 use onestore::FileDataReference;
+use onestore::{
+    RevisionIndex, Store,
+    document::{Document, Kind},
+};
 use rusqlite::OptionalExtension;
 use sha2::{Digest, Sha256};
 @@ -7,12 +11,7 @@ impl Replica {
     /// Reads a previously downloaded external payload without network access.
     /// Absence is distinct from an empty payload; every returned buffer passes its stored checksum.
     pub fn cached_asset(&self, filename: &str, limit: usize) -> Result<Option<Vec<u8>>> {
-        let key = key(filename)?;
+        cached(&*self.lock()?, &key(filename)?, limit)
-        let connection = self
-            .connection
-            .lock()
-            .map_err(|_| io::Error::other("Cache owner panicked"))?;
-        cached(&connection, &key, limit)
     }
     /// Fetches a declared external payload and durably retains it without changing the edit queue.
 @@ -26,32 +25,23 @@ impl Replica {
         limit: usize,
     ) -> Result<Vec<u8>> {
         let key = key(filename)?;
-        {
+        if !self.references(&key)? {
-            let connection = self
+            return Err(io::Error::new(
-                .connection
+                io::ErrorKind::InvalidInput,
-                .lock()
+                "The retained document images do not reference this external payload",
-                .map_err(|_| io::Error::other("Cache owner panicked"))?;
+            )
-            if !referenced(&connection, &key)? {
+            .into());
-                return Err(io::Error::new(
-                    io::ErrorKind::InvalidInput,
-                    "The retained document images do not reference this external payload",
-                )
-                .into());
-            }
         }
         let bytes = crate::discover::read_external_asset(source, section, filename, limit)?;
-        let mut connection = self
+        if !self.references(&key)? {
-            .connection
-            .lock()
-            .map_err(|_| io::Error::other("Cache owner panicked"))?;
-        let transaction = connection.transaction_with_behavior(TransactionBehavior::Immediate)?;
-        if !referenced(&transaction, &key)? {
             return Err(io::Error::new(
                 io::ErrorKind::ResourceBusy,
                 "The external payload reference changed during download",
             )
             .into());
         }
+        let mut connection = self.lock()?;
+        let transaction = connection.transaction_with_behavior(TransactionBehavior::Immediate)?;
         let previous = match cached(&transaction, &key, bytes.len()) {
             Err(Error::Io(error)) if error.kind() == io::ErrorKind::FileTooLarge => {
                 return Err(Error::AssetChanged);
 @@ -78,21 +68,22 @@ pub(crate) fn key(filename: &str) -> Result<String> {
     Ok(filename.to_ascii_lowercase())
 }
-fn referenced(connection: &Connection, key: &str) -> Result<bool> {
+impl Replica {
-    // One image at a time: the working image usually answers.
+    /// Whether the local pages or the remote image declare the external payload `key`.
-    for read in [crate::images::working, crate::images::base] {
+    fn references(&self, key: &str) -> Result<bool> {
-        let image = read(connection)?;
+        for image in [self.snapshot()?, self.remote_snapshot()?] {
-        let store = Store::parse(&image)?;
+            let store = Store::parse(&image)?;
-        let index = RevisionIndex::parse(&store)?;
+            let index = RevisionIndex::parse(&store)?;
-        let document = Document::parse(&index)?;
+            let document = Document::parse(&index)?;
-        if document.spaces.values().flat_map(|space| space.revisions.values())
+            if document.spaces.values().flat_map(|space| space.revisions.values())
-            .flat_map(|revision| revision.nodes.values()).any(|node| {
+                .flat_map(|revision| revision.nodes.values()).any(|node| {
-                matches!(&node.kind, Kind::File { reference: FileDataReference::External(name), .. } if name.eq_ignore_ascii_case(key))
+                    matches!(&node.kind, Kind::File { reference: FileDataReference::External(name), .. } if name.eq_ignore_ascii_case(key))
-            }) {
+                }) {
-            return Ok(true);
+                return Ok(true);
+            }
         }
+        Ok(false)
     }
-    Ok(false)
 }
 pub(crate) fn cached(connection: &Connection, key: &str, limit: usize) -> Result<Option<Vec<u8>>> {

crates/notebook/src/base.rs created+231

...	@@ -0,0 +1,231 @@
1	//! Section images kept as 16 KiB chunk rows, so a publication rewrites the chunks its
2	//! transaction touches instead of the image: `base`, the image the queued edits apply to,
3	//! and `remote`, the last observed remote image while it is not the base.
4
5	use crate::Result;
6	use onestore::{Stamp, Transaction};
7	use rusqlite::{Connection, OptionalExtension, params};
8	use std::io;
9
10	const CHUNK: usize = 16 * 1024;
11
12	#[derive(Clone, Copy)]
13	pub(crate) enum Image {
14	Base,
15	Remote,
16	}
17
18	impl Image {
19	fn table(self) -> &'static str {
20	match self {
21	Self::Base => "base",
22	Self::Remote => "remote",
23	}
24	}
25	}
26
27	fn damaged() -> crate::Error {
28	io::Error::new(io::ErrorKind::InvalidData, "Damaged cached image").into()
29	}
30
31	/// The whole image, or `None` when none is stored.
32	pub(crate) fn read(connection: &Connection, image: Image) -> Result<Option<Vec<u8>>> {
33	let mut query = connection.prepare_cached(&format!(
34	"SELECT chunk, bytes FROM {} ORDER BY chunk",
35	image.table()
36	))?;
37	let mut rows = query.query([])?;
38	let mut bytes = Vec::new();
39	let mut count = 0;
40	while let Some(row) = rows.next()? {
41	let chunk: i64 = row.get(0)?;
42	let part = row.get_ref(1)?.as_blob().map_err(\|_\| damaged())?;
43	if chunk != count \|\| bytes.len() % CHUNK != 0 \|\| part.is_empty() \|\| part.len() > CHUNK {
44	return Err(damaged());
45	}
46	bytes.extend_from_slice(part);
47	count += 1;
48	}
49	Ok((count > 0).then_some(bytes))
50	}
51
52	/// The stored image's header and length, reading its first and last chunks.
53	pub(crate) fn stamp(connection: &Connection, image: Image) -> Result<Option<Stamp>> {
54	let table = image.table();
55	let Some((header, last)): Option<(Vec<u8>, i64)> = connection
56	.query_row(
57	&format!("SELECT substr(bytes, 1, 1024), (SELECT max(chunk) FROM {table}) FROM {table} WHERE chunk=0"),
58	[],
59	\|row\| Ok((row.get(0)?, row.get(1)?)),
60	)
61	.optional()?
62	else {
63	return Ok(None);
64	};
65	let tail: i64 = connection.query_row(
66	&format!("SELECT length(bytes) FROM {table} WHERE chunk=?1"),
67	[last],
68	\|row\| row.get(0),
69	)?;
70	Ok(Some(Stamp {
71	header: header.try_into().map_err(\|_\| damaged())?,
72	length: u64::try_from(last).map_err(\|_\| damaged())? * CHUNK as u64
73	+ u64::try_from(tail).map_err(\|_\| damaged())?,
74	}))
75	}
76
77	/// Stores `bytes` as the image, rewriting only the chunks that differ.
78	pub(crate) fn write(connection: &Connection, image: Image, bytes: &[u8]) -> Result<()> {
79	let table = image.table();
80	let count = bytes.len().div_ceil(CHUNK);
81	connection.execute(
82	&format!("DELETE FROM {table} WHERE chunk>=?1"),
83	[count as i64],
84	)?;
85	let mut stored =
86	connection.prepare_cached(&format!("SELECT bytes FROM {table} WHERE chunk=?1"))?;
87	let mut replace = connection.prepare_cached(&format!(
88	"INSERT INTO {table}(chunk, bytes) VALUES (?1, ?2) ON CONFLICT(chunk) DO UPDATE SET bytes=excluded.bytes"
89	))?;
90	for (index, part) in bytes.chunks(CHUNK).enumerate() {
91	let current: Option<Vec<u8>> = stored
92	.query_row([index as i64], \|row\| row.get(0))
93	.optional()?;
94	if current.as_deref() != Some(part) {
95	replace.execute(params![index as i64, part])?;
96	}
97	}
98	Ok(())
99	}
100
101	pub(crate) fn clear(connection: &Connection, image: Image) -> Result<()> {
102	connection.execute(&format!("DELETE FROM {}", image.table()), [])?;
103	Ok(())
104	}
105
106	/// Commits `transaction` to the base image the way it commits to the file, rewriting only
107	/// the chunks it writes.
108	pub(crate) fn publish(connection: &Connection, transaction: &Transaction) -> Result<()> {
109	if stamp(connection, Image::Base)?.as_ref() != Some(transaction.base()) {
110	return Err(io::Error::new(
111	io::ErrorKind::InvalidData,
112	"The published transaction is not on the cached base image",
113	)
114	.into());
115	}
116	let mut stored = connection.prepare_cached("SELECT bytes FROM base WHERE chunk=?1")?;
117	let mut replace = connection.prepare_cached(
118	"INSERT INTO base(chunk, bytes) VALUES (?1, ?2) ON CONFLICT(chunk) DO UPDATE SET bytes=excluded.bytes",
119	)?;
120	let mut chunks: std::collections::BTreeMap<usize, Vec<u8>> = Default::default();
121	for (offset, bytes) in transaction.writes() {
122	let mut offset = usize::try_from(offset).map_err(\|_\| damaged())?;
123	let mut bytes = bytes;
124	while !bytes.is_empty() {
125	let index = offset / CHUNK;
126	let chunk = match chunks.entry(index) {
127	std::collections::btree_map::Entry::Occupied(entry) => entry.into_mut(),
128	std::collections::btree_map::Entry::Vacant(entry) => entry.insert(
129	stored
130	.query_row([index as i64], \|row\| row.get(0))
131	.optional()?
132	.unwrap_or_default(),
133	),
134	};
135	let at = offset % CHUNK;
136	let take = bytes.len().min(CHUNK - at);
137	if chunk.len() < at {
138	return Err(damaged());
139	}
140	if chunk.len() < at + take {
141	chunk.resize(at + take, 0);
142	}
143	chunk[at..at + take].copy_from_slice(&bytes[..take]);
144	offset += take;
145	bytes = &bytes[take..];
146	}
147	}
148	for (index, bytes) in chunks {
149	replace.execute(params![index as i64, bytes])?;
150	}
151	Ok(())
152	}
153
154	#[cfg(test)]
155	mod tests {
156	use super::*;
157
158	fn connection() -> Connection {
159	let connection = Connection::open_in_memory().unwrap();
160	connection.execute_batch(crate::schema::QUEUE).unwrap();
161	connection
162	}
163
164	/// Types `text` at the start of the page's first body paragraph.
165	pub(crate) fn typed(section: &mut onestore::Section<'_>, space: onestore::ExGuid, text: &str) {
166	use onestore::op::{Edit, Op, PageOp};
167	let page = section.page(space).unwrap();
168	let target = page
169	.objects
170	.iter()
171	.find_map(\|object\| match object {
172	onestore::page::PageObject::Outline(outline) => outline
173	.paragraphs
174	.iter()
175	.find_map(\|p\| p.text().map(\|t\| t.id)),
176	_ => None,
177	})
178	.unwrap();
179	section
180	.apply(
181	"Author",
182	&Edit {
183	at: 133_000_000_000_000_000,
184	ops: vec![Op::Page {
185	space,
186	op: PageOp::Text {
187	text: target,
188	range: 0..0,
189	with: text.into(),
190	},
191	}],
192	},
193	)
194	.unwrap();
195	}
196
197	#[test]
198	fn a_published_transaction_rewrites_only_its_chunks_and_matches_the_file() {
199	let source =
200	include_bytes!("../../../corpus/outline-edit/before/notebook/synthetic.one").to_vec();
201	assert!(source.len() > 4 * CHUNK);
202	let arena = onestore::Arena::default();
203	let mut section = onestore::Section::open(&arena, source.clone()).unwrap();
204	let space = section.pages().unwrap()[0].0;
205	let connection = connection();
206	write(&connection, Image::Base, &source).unwrap();
207	assert_eq!(read(&connection, Image::Base).unwrap().unwrap(), source);
208	assert_eq!(
209	stamp(&connection, Image::Base).unwrap().unwrap(),
210	Stamp::of(&source).unwrap()
211	);
212	let mut image = source.clone();
213	for round in 0..3 {
214	typed(&mut section, space, &format!("{round}"));
215	let transaction = section.seal().unwrap().unwrap();
216	publish(&connection, &transaction).unwrap();
217	transaction.apply(&mut image).unwrap();
218	assert_eq!(read(&connection, Image::Base).unwrap().unwrap(), image);
219	assert_eq!(
220	stamp(&connection, Image::Base).unwrap().unwrap(),
221	Stamp::of(&image).unwrap()
222	);
223	assert!(publish(&connection, &transaction).is_err());
224	}
225	let shorter = &image[..CHUNK + 5];
226	write(&connection, Image::Base, shorter).unwrap();
227	assert_eq!(read(&connection, Image::Base).unwrap().unwrap(), shorter);
228	clear(&connection, Image::Remote).unwrap();
229	assert!(read(&connection, Image::Remote).unwrap().is_none());
230	}
231	}

crates/notebook/src/images.rs deleted-198

...	@@ -1,198 +0,0 @@
1	//! The cache's two section images. `base` is stored whole; `working` is stored as the byte
2	//! ranges where it differs from `base`, so saving an edit writes the revision it appended
3	//! instead of the section.
4
5	use crate::Result;
6	use onestore::Stamp;
7	use rusqlite::{Connection, params};
8	use std::io;
9
10	const BLOCK: usize = 4096;
11
12	/// `image` as its length and the `(offset, bytes)` runs of blocks that differ from `base`;
13	/// empty when the images are equal.
14	fn difference(base: &[u8], image: &[u8]) -> Vec<u8> {
15	if base == image {
16	return Vec::new();
17	}
18	let mut patch = (image.len() as u64).to_le_bytes().to_vec();
19	let mut run: Option<usize> = None;
20	let close = \|patch: &mut Vec<u8>, start: usize, end: usize\| {
21	patch.extend_from_slice(&(start as u64).to_le_bytes());
22	patch.extend_from_slice(&((end - start) as u64).to_le_bytes());
23	patch.extend_from_slice(&image[start..end]);
24	};
25	for start in (0..image.len()).step_by(BLOCK) {
26	let end = (start + BLOCK).min(image.len());
27	if base.get(start..end) == Some(&image[start..end]) {
28	if let Some(from) = run.take() {
29	close(&mut patch, from, start);
30	}
31	} else {
32	run.get_or_insert(start);
33	}
34	}
35	if let Some(from) = run {
36	close(&mut patch, from, image.len());
37	}
38	patch
39	}
40
41	fn restore(mut base: Vec<u8>, patch: &[u8]) -> Result<Vec<u8>> {
42	let damaged = \|\| io::Error::new(io::ErrorKind::InvalidData, "Damaged working image");
43	let Some((length, mut runs)) = patch.split_first_chunk::<8>() else {
44	return if patch.is_empty() {
45	Ok(base)
46	} else {
47	Err(damaged().into())
48	};
49	};
50	// Every block past the base is a run, so a whole patch bounds the image.
51	let length = usize::try_from(u64::from_le_bytes(*length))
52	.ok()
53	.filter(\|length\| *length <= base.len() + patch.len())
54	.ok_or_else(damaged)?;
55	base.resize(length, 0);
56	while let Some((header, rest)) = runs.split_first_chunk::<16>() {
57	let offset = usize::try_from(u64::from_le_bytes(header[..8].try_into().unwrap()))
58	.map_err(\|_\| damaged())?;
59	let size = usize::try_from(u64::from_le_bytes(header[8..].try_into().unwrap()))
60	.map_err(\|_\| damaged())?;
61	let (bytes, rest) = rest.split_at_checked(size).ok_or_else(damaged)?;
62	base.get_mut(offset..)
63	.and_then(\|target\| target.get_mut(..size))
64	.ok_or_else(damaged)?
65	.copy_from_slice(bytes);
66	runs = rest;
67	}
68	if runs.is_empty() {
69	Ok(base)
70	} else {
71	Err(damaged().into())
72	}
73	}
74
75	pub(crate) fn base(connection: &Connection) -> Result<Vec<u8>> {
76	Ok(connection.query_row("SELECT base FROM replica WHERE id=1", [], \|row\| row.get(0))?)
77	}
78
79	/// `(base, working)`.
80	pub(crate) fn both(connection: &Connection) -> Result<(Vec<u8>, Vec<u8>)> {
81	let (base, patch): (Vec<u8>, Vec<u8>) =
82	connection.query_row("SELECT base, working FROM replica WHERE id=1", [], \|row\| {
83	Ok((row.get(0)?, row.get(1)?))
84	})?;
85	let working = restore(base.clone(), &patch)?;
86	Ok((base, working))
87	}
88
89	/// The working image's length, without restoring it.
90	pub(crate) fn working_length(connection: &Connection) -> Result<u64> {
91	Ok(connection.query_row(
92	"SELECT length(base), substr(working, 1, 8) FROM replica WHERE id=1",
93	[],
94	\|row\| {
95	// SQLite's substr of an empty blob is NULL.
96	let header: Option<Vec<u8>> = row.get(1)?;
97	Ok(match header.as_deref().and_then(<[u8]>::first_chunk::<8>) {
98	Some(length) => u64::from_le_bytes(*length),
99	None => row.get::<_, i64>(0)? as u64,
100	})
101	},
102	)?)
103	}
104
105	/// Whether no edit is queued and the working image is the base image, without reading
106	/// either image.
107	pub(crate) fn settled(connection: &Connection) -> Result<bool> {
108	Ok(connection.query_row(
109	"SELECT length(working) = 0 AND NOT EXISTS (SELECT 1 FROM edits) FROM replica WHERE id=1",
110	[],
111	\|row\| row.get(0),
112	)?)
113	}
114
115	/// The base image's stamp, without reading the image.
116	pub(crate) fn stamp(connection: &Connection) -> Result<Stamp> {
117	let (header, length): (Vec<u8>, i64) = connection.query_row(
118	"SELECT substr(base, 1, 1024), length(base) FROM replica WHERE id=1",
119	[],
120	\|row\| Ok((row.get(0)?, row.get(1)?)),
121	)?;
122	Ok(Stamp {
123	header: header
124	.try_into()
125	.map_err(\|_\| io::Error::new(io::ErrorKind::InvalidData, "Damaged base image"))?,
126	length: u64::try_from(length).map_err(io::Error::other)?,
127	})
128	}
129
130	pub(crate) fn working(connection: &Connection) -> Result<Vec<u8>> {
131	let (base, patch): (Vec<u8>, Vec<u8>) =
132	connection.query_row("SELECT base, working FROM replica WHERE id=1", [], \|row\| {
133	Ok((row.get(0)?, row.get(1)?))
134	})?;
135	restore(base, &patch)
136	}
137
138	/// Replaces the working image; `base` is the stored base image.
139	pub(crate) fn set_working(connection: &Connection, base: &[u8], working: &[u8]) -> Result<()> {
140	connection.execute(
141	"UPDATE replica SET working=?1 WHERE id=1",
142	[difference(base, working)],
143	)?;
144	Ok(())
145	}
146
147	/// Replaces the base image, keeping `working` as the working image. An unchanged base
148	/// leaves its stored bytes alone.
149	pub(crate) fn set_base(
150	connection: &Connection,
151	old: &[u8],
152	base: &[u8],
153	working: &[u8],
154	) -> Result<()> {
155	if old == base {
156	return set_working(connection, base, working);
157	}
158	connection.execute(
159	"UPDATE replica SET base=?1, working=?2 WHERE id=1",
160	params![base, difference(base, working)],
161	)?;
162	Ok(())
163	}
164
165	#[cfg(test)]
166	mod tests {
167	use super::*;
168
169	#[test]
170	fn a_working_image_survives_as_its_difference_from_any_base() {
171	let base: Vec<u8> = (0..3 * BLOCK + 17).map(\|i\| i as u8).collect();
172	let mut edited = base.clone();
173	edited[5] ^= 1;
174	edited[2 * BLOCK + 1] ^= 1;
175	edited.extend_from_slice(b"appended revision");
176	for image in [
177	base.clone(),
178	edited.clone(),
179	base[..BLOCK + 3].to_vec(),
180	Vec::new(),
181	vec![7; 5 * BLOCK],
182	] {
183	let patch = difference(&base, &image);
184	assert_eq!(restore(base.clone(), &patch).unwrap(), image);
185	}
186	assert!(difference(&base, &base).is_empty());
187	assert!(difference(&base, &edited).len() < 3 * BLOCK);
188	let mut huge = difference(&base, &edited);
189	huge[..8].copy_from_slice(&u64::MAX.to_le_bytes());
190	assert!(restore(base.clone(), &huge).is_err());
191	let patch = difference(&base, &edited);
192	for cut in 1..patch.len() {
193	if let Ok(image) = restore(base.clone(), &patch[..cut]) {
194	assert_ne!(image, edited);
195	}
196	}
197	}
198	}

crates/notebook/src/lib.rs+221-415

...	@@ -6,32 +6,33 @@ pub mod discover;	...	@@ -6,32 +6,33 @@ pub mod discover;
6	pub mod smb;	6	pub mod smb;
7		7
8	use onestore::{	8	use onestore::{
9	ExGuid, PageCreation, PreparedEdit, RevisionIndex, Store,	9	ExGuid,
10	document::{Document, Kind},	10	op::{Edit, OpError},
11	page::Page,	11	page::Page,
12	};	12	};
13	use rusqlite::{Connection, OpenFlags, OptionalExtension, TransactionBehavior, params};	13	use rusqlite::{Connection, OpenFlags, TransactionBehavior, params};
14	use std::{	14	use std::{
15	fs::OpenOptions,	15	fs::OpenOptions,
16	io,	16	io,
17	path::Path,	17	path::Path,
18	sync::{Mutex, atomic::AtomicI64},	18	sync::{Arc, Mutex, MutexGuard, mpsc},
		19	thread::JoinHandle,
19	time::Duration,	20	time::Duration,
20	};	21	};
21		22
22	mod assets;	23	mod assets;
23	mod images;	24	mod base;
24	mod merge;	25	mod merge;
25	mod pages;	26	mod migrate;
26	mod rebase;	27	mod queue;
27	mod recovery;	28	mod recovery;
28	mod schema;	29	mod schema;
29	pub mod session;	30	pub mod session;
30	pub use pages::PageEdits;
31	pub use recovery::{Recovery, RecoverySummary};	31	pub use recovery::{Recovery, RecoverySummary};
32	mod sync;	32	mod sync;
33	pub use sync::{ConflictKind, EditStatus, Remote};	33	pub use sync::{ConflictKind, EditStatus, Remote, Synced};
34	mod worker;	34	mod worker;
		35	mod working;
35	#[cfg(feature = "smb")]	36	#[cfg(feature = "smb")]
36	pub use smb::SmbRemote;	37	pub use smb::SmbRemote;
37	pub use worker::SyncWorker;	38	pub use worker::SyncWorker;
...	@@ -50,6 +51,9 @@ pub enum Error {	...	@@ -50,6 +51,9 @@ pub enum Error {
50	RemoteIo(io::Error),	51	RemoteIo(io::Error),
51	#[error(transparent)]	52	#[error(transparent)]
52	Discovery(#[from] discover::Error),	53	Discovery(#[from] discover::Error),
		54	/// The section refused an edit; the pages it names are as they were.
		55	#[error(transparent)]
		56	Rejected(#[from] OpError),
53	#[error("External payload identity now refers to different bytes")]	57	#[error("External payload identity now refers to different bytes")]
54	AssetChanged,	58	AssetChanged,
55	#[cfg(feature = "protected")]	59	#[cfg(feature = "protected")]
...	@@ -60,114 +64,49 @@ pub enum Error {	...	@@ -60,114 +64,49 @@ pub enum Error {
60	type Result<T> = std::result::Result<T, Error>;	64	type Result<T> = std::result::Result<T, Error>;
61		65
62	const APPLICATION_ID: u32 = 0x4f4e454f;	66	const APPLICATION_ID: u32 = 0x4f4e454f;
63	const SCHEMA_VERSION: u32 = 14;
64
65	/// An edited page model together with the stored model it was edited from.
66	/// `before` is the precondition reconciliation checks against the remote page.
67	#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
68	#[serde(deny_unknown_fields)]
69	pub struct PageIntent {
70	pub before: Page,
71	pub after: Page,
72	pub author: String,
73	}
74
75	impl PageIntent {
76	/// Describes the intent as one paragraph's text replacement, when that is all it changes:
77	/// the text object, its text before, the replaced UTF-16 range and the replacement.
78	pub fn text_change(&self) -> Option<(ExGuid, String, std::ops::Range<u32>, String)> {
79	fn texts(page: &Page) -> Vec<(ExGuid, &onestore::page::Paragraph)> {
80	let mut out = Vec::new();
81	for object in &page.objects {
82	let outlines: Vec<&onestore::page::Outline> = match object {
83	onestore::page::PageObject::Outline(outline) => vec![outline],
84	onestore::page::PageObject::Title(title) => title.outlines.iter().collect(),
85	_ => Vec::new(),
86	};
87	for outline in outlines {
88	for paragraph in &outline.paragraphs {
89	if let Some(text) = paragraph.text() {
90	out.push((text.id, &text.text));
91	}
92	}
93	}
94	}
95	out
96	}
97	let (before, after) = (texts(&self.before), texts(&self.after));
98	if before.len() != after.len() {
99	return None;
100	}
101	let mut changed = None;
102	for ((id, x), (other, y)) in before.iter().zip(&after) {
103	if id != other {
104	return None;
105	}
106	if x.text() != y.text() {
107	if changed.is_some() {
108	return None;
109	}
110	changed = Some((id, x, *y));
111	}
112	}
113	let (id, x, y) = changed?;
114	let (b, o) = (x.text(), y.text());
115	let prefix = b
116	.char_indices()
117	.zip(o.chars())
118	.take_while(\|((_, c), d)\| c == d)
119	.map(\|((i, c), _)\| i + c.len_utf8())
120	.last()
121	.unwrap_or(0);
122	let suffix = b[prefix..]
123	.chars()
124	.rev()
125	.zip(o[prefix..].chars().rev())
126	.take_while(\|(c, d)\| c == d)
127	.map(\|(c, _)\| c.len_utf8())
128	.sum::<usize>();
129	let start = x.utf16_offset(prefix).ok()?;
130	let end = x.utf16_offset(b.len() - suffix).ok()?;
131	Some((
132	id,
133	b.to_owned(),
134	start..end,
135	o[prefix..o.len() - suffix].to_owned(),
136	))
137	}
138	}
139
140	#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
141	#[serde(deny_unknown_fields)]
142	pub enum Operation {
143	/// An edited page model; body content is edited only through this intent.
144	Page(PageIntent),
145	CreatePage(PageCreation),
146	Pages(PageEdits),
147	/// Permanent removal of explicitly selected page spaces from the section.
148	DeletePages(Vec<ExGuid>),
149	}
150		67
151	/// A locally acknowledged intent; its ID remains stable across cache reopen.	68	/// A locally durable edit; its ID remains stable across cache reopen.
152	#[derive(Debug, Clone, PartialEq)]	69	#[derive(Debug, Clone, PartialEq)]
153	pub struct PendingEdit {	70	pub struct PendingEdit {
		71	pub id: u64,
		72	pub author: String,
		73	pub edit: Edit,
		74	}
		75
		76	/// Unpublished work the remote section no longer accepts: the batch holding edit `id`
		77	/// changed page `space` where the remote changed it too.
		78	#[derive(Debug, Clone, PartialEq, Eq)]
		79	pub struct Conflict {
154	pub id: u64,	80	pub id: u64,
155	pub space: ExGuid,	81	pub space: ExGuid,
156	pub operation: Operation,	82	pub kind: ConflictKind,
		83	}
		84
		85	/// How a conflict or an uncertain attempt ends. `Mine` keeps the local pages: a conflicted
		86	/// page is rewritten from the remote page to the local one; a released attempt publishes
		87	/// again. `Theirs` drops the local edits to the conflicted page, or the whole unpublished
		88	/// branch of a released attempt.
		89	#[derive(Debug, Clone, Copy, PartialEq, Eq)]
		90	pub enum Resolution {
		91	Mine,
		92	Theirs,
157	}	93	}
158		94
159	/// Owns one local cache. Share this handle between threads; a second open fails busy.	95	/// Owns one local cache. Share this handle between threads; a second open fails busy.
160	/// SQLite's exclusive connection retains ownership between local transactions.	96	/// Edits apply on the cache's section thread, which keeps the section parsed; SQLite's
		97	/// exclusive connection retains ownership between local transactions.
161	pub struct Replica {	98	pub struct Replica {
162	connection: Mutex<Connection>,	99	connection: Arc<Mutex<Connection>>,
		100	working: Option<mpsc::Sender<working::Request>>,
		101	thread: Option<JoinHandle<()>>,
163	synchronization: Mutex<()>,	102	synchronization: Mutex<()>,
164	/// The intent a synchronization step selected for publication, or zero.	103	worker: Arc<Mutex<std::sync::Weak<worker::Signal>>>,
165	in_flight: AtomicI64,	104	/// The section's root object space, which names the document.
166	worker: Mutex<std::sync::Weak<worker::Signal>>,	105	root: ExGuid,
167	}	106	}
168		107
169	impl Replica {	108	impl Replica {
170	/// Seeds a new cache from a validated notebook image, refusing any existing path.	109	/// Seeds a new cache from a validated section image, refusing any existing path.
171	/// An initialization error preserves the created file for inspection.	110	/// An initialization error preserves the created file for inspection.
172	pub fn create(path: impl AsRef<Path>, source: &[u8]) -> Result<Self> {	111	pub fn create(path: impl AsRef<Path>, source: &[u8]) -> Result<Self> {
173	validate(source)?;	112	validate(source)?;
...	@@ -179,364 +118,224 @@ impl Replica {	...	@@ -179,364 +118,224 @@ impl Replica {
179	options.mode(0o600);	118	options.mode(0o600);
180	}	119	}
181	drop(options.open(path.as_ref())?);	120	drop(options.open(path.as_ref())?);
182	Self::connect(path.as_ref(), Some(source))	121	let mut connection = cache_connection(path.as_ref())?;
		122	write_ahead(&connection)?;
		123	let transaction = connection.transaction_with_behavior(TransactionBehavior::Exclusive)?;
		124	let tables: i64 =
		125	transaction.query_row("SELECT count(*) FROM sqlite_schema", [], \|row\| row.get(0))?;
		126	let application: u32 =
		127	transaction.pragma_query_value(None, "application_id", \|row\| row.get(0))?;
		128	if application != 0 \|\| tables != 0 {
		129	return Err(io::Error::new(
		130	io::ErrorKind::AlreadyExists,
		131	"Cache initialization found an existing database",
		132	)
		133	.into());
		134	}
		135	transaction.pragma_update(None, "application_id", APPLICATION_ID)?;
		136	transaction.pragma_update(None, "user_version", schema::VERSION)?;
		137	schema::create(&transaction)?;
		138	base::write(&transaction, base::Image::Base, source)?;
		139	transaction.commit()?;
		140	Self::start(connection)
183	}	141	}
184		142
185	/// Reopens an existing cache and its durable pending edits without network access.	143	/// Reopens an existing cache and its durable pending edits without network access.
186	/// Unrecognized databases and unsupported journal modes are rejected without conversion.	144	/// A schema-14 cache is converted once, after exporting it to `<path>.v14-recovery`;
		145	/// a conversion that cannot reproduce every queued page leaves it untouched.
		146	/// Unrecognized databases and unsupported journal modes are rejected.
187	pub fn open(path: impl AsRef<Path>) -> Result<Self> {	147	pub fn open(path: impl AsRef<Path>) -> Result<Self> {
188	Self::connect(path.as_ref(), None)	148	let path = path.as_ref();
189	}
190
191	fn connect(path: &Path, source: Option<&[u8]>) -> Result<Self> {
192	let mut connection = cache_connection(path)?;	149	let mut connection = cache_connection(path)?;
193	let transaction = connection.transaction_with_behavior(TransactionBehavior::Exclusive)?;
194	let application: u32 =	150	let application: u32 =
195	transaction.pragma_query_value(None, "application_id", \|row\| row.get(0))?;	151	connection.pragma_query_value(None, "application_id", \|row\| row.get(0))?;
196	let version: u32 =	152	if application != APPLICATION_ID {
197	transaction.pragma_query_value(None, "user_version", \|row\| row.get(0))?;	153	return Err(io::Error::new(io::ErrorKind::InvalidData, "Not a notebook cache").into());
198	if let Some(source) = source {	154	}
199	let tables: i64 =	155	let integrity: String = connection.query_row("PRAGMA quick_check", [], \|row\| row.get(0))?;
200	transaction	156	if integrity != "ok" {
201	.query_row("SELECT count(*) FROM sqlite_schema", [], \|row\| row.get(0))?;	157	return Err(
202	if application != 0 \|\| version != 0 \|\| tables != 0 {	158	io::Error::new(io::ErrorKind::InvalidData, "Cache integrity check failed").into(),
203	return Err(io::Error::new(	159	);
204	io::ErrorKind::AlreadyExists,	160	}
205	"Cache initialization found an existing database",	161	let version: u32 = connection.pragma_query_value(None, "user_version", \|row\| row.get(0))?;
206	)	162	// A schema-14 cache converts in its rollback journal, so a failed conversion leaves
207	.into());	163	// the file as it was.
208	}	164	match version {
209	transaction.pragma_update(None, "application_id", APPLICATION_ID)?;	165	migrate::VERSION => migrate::migrate(&mut connection, path)?,
210	transaction.pragma_update(None, "user_version", SCHEMA_VERSION)?;	166	schema::VERSION => {}
211	transaction.execute_batch(	167	_ => {
212	"
213	CREATE TABLE replica (
214	id INTEGER PRIMARY KEY CHECK(id=1),
215	base BLOB NOT NULL,
216	working BLOB NOT NULL
217	) STRICT;
218	",
219	)?;
220	schema::create(&transaction)?;
221	transaction.execute("INSERT INTO replica VALUES (1, ?1, x'')", [source])?;
222	} else {
223	if application != APPLICATION_ID {
224	return Err(
225	io::Error::new(io::ErrorKind::InvalidData, "Not a notebook cache").into(),
226	);
227	}
228	if version != SCHEMA_VERSION {
229	// Older caches are refused rather than migrated until the application is
230	// usable end to end; the queue must be drained by the build that wrote it.
231	return Err(io::Error::new(	168	return Err(io::Error::new(
232	io::ErrorKind::InvalidData,	169	io::ErrorKind::InvalidData,
233	format!("Cache schema version {version} is not the supported version {SCHEMA_VERSION}"),	170	format!(
		171	"Cache schema version {version} is not the supported version {}",
		172	schema::VERSION
		173	),
234	)	174	)
235	.into());	175	.into());
236	}	176	}
237	validate_images(&transaction)?;
238	pending(&transaction)?;
239	}	177	}
240	transaction.commit()?;	178	write_ahead(&connection)?;
		179	Self::start(connection)
		180	}
		181
		182	fn start(connection: Connection) -> Result<Self> {
		183	let connection = Arc::new(Mutex::new(connection));
		184	let worker = Arc::new(Mutex::new(std::sync::Weak::new()));
		185	let (sender, thread, root) = working::spawn(Arc::clone(&connection), Arc::clone(&worker))?;
241	Ok(Self {	186	Ok(Self {
242	connection: Mutex::new(connection),	187	connection,
		188	working: Some(sender),
		189	thread: Some(thread),
243	synchronization: Mutex::new(()),	190	synchronization: Mutex::new(()),
244	in_flight: AtomicI64::new(0),	191	worker,
245	worker: Mutex::new(std::sync::Weak::new()),	192	root,
246	})	193	})
247	}	194	}
248		195
249	/// Returns the latest complete locally committed image, including pending edits.	196	fn lock(&self) -> Result<MutexGuard<'_, Connection>> {
250	pub fn snapshot(&self) -> Result<Vec<u8>> {	197	lock(&self.connection)
251	let connection = self
252	.connection
253	.lock()
254	.map_err(\|_\| io::Error::other("Cache owner panicked"))?;
255	images::working(&connection)
256	}	198	}
257		199
258	/// The page in `space` as the working image stores it.	200	/// Hands `request` to the section thread.
259	pub fn page(&self, space: ExGuid) -> Result<Page> {	201	fn send(&self, request: working::Request) -> Result<()> {
260	let snapshot = self.snapshot()?;	202	self.working
261	let store = Store::parse(&snapshot)?;	203	.as_ref()
262	let index = RevisionIndex::parse(&store)?;	204	.and_then(\|working\| working.send(request).ok())
263	Ok(Page::from_space(&Document::parse(&index)?, space)?)	205	.ok_or_else(\|\| io::Error::other("The section thread stopped").into())
264	}	206	}
265		207
266	/// Whether no edit is queued and the remote still has the last observed image's stamp,	208	/// Asks the section thread and waits for its answer.
267	/// reading neither image; the cache is not locked during remote I/O.	209	fn ask<T: Send + 'static>(
268	pub(crate) fn settled(&self, remote: &mut impl Remote) -> Result<bool> {	210	&self,
269	let lock = \|\| {	211	request: impl FnOnce(working::Reply<T>) -> working::Request,
270	self.connection	212	) -> Result<T> {
271	.lock()	213	let (sender, receiver) = mpsc::sync_channel(1);
272	.map_err(\|_\| io::Error::other("Cache owner panicked"))	214	self.send(request(Box::new(move \|result\| {
273	};	215	let _ = sender.send(result);
274	if !images::settled(&*lock()?)? {	216	})))?;
275	return Ok(false);	217	receiver
276	}	218	.recv()
277	let Some(stamp) = remote.stamp().map_err(Error::RemoteIo)? else {	219	.map_err(\|_\| io::Error::other("The section thread stopped"))?
278	return Ok(false);
279	};
280	Ok(images::stamp(&*lock()?)? == stamp)
281	}
282
283	pub fn pending(&self) -> Result<Vec<PendingEdit>> {
284	let connection = self
285	.connection
286	.lock()
287	.map_err(\|_\| io::Error::other("Cache owner panicked"))?;
288	pending(&connection)
289	}	220	}
290		221
291	/// Identities and page spaces of the pending edits, oldest first, without reading their	222	/// Applies an edit and queues it durably for publication, returning its id once
292	/// operations.	223	/// written. A refused edit returns `Rejected` and leaves every page as it was.
293	pub(crate) fn queued(&self) -> Result<Vec<(u64, ExGuid)>> {	224	pub fn apply(&self, author: &str, edit: Edit) -> Result<u64> {
294	let connection = self	225	self.ask(\|reply\| working::Request::Apply {
295	.connection	226	author: author.to_owned(),
296	.lock()	227	edit,
297	.map_err(\|_\| io::Error::other("Cache owner panicked"))?;	228	reply,
298	let mut query = connection.prepare("SELECT id, space FROM edits ORDER BY id")?;	229	})
299	let mut rows = query.query([])?;
300	let mut edits = Vec::new();
301	while let Some(row) = rows.next()? {
302	edits.push((
303	u64::try_from(row.get::<_, i64>(0)?).map_err(io::Error::other)?,
304	row.get::<_, String>(1)?.parse()?,
305	));
306	}
307	Ok(edits)
308	}	230	}
309		231
310	/// Durably queues an edited page model using the supplied local snapshot.	232	/// `apply` without waiting: `reply` runs on the section thread once the edit is
311	/// While the newest pending edit is an unattempted save of the same page, a new save	233	/// durable or refused.
312	/// replaces its result instead of queueing another publication, as OneNote does	234	pub(crate) fn submit(
313	/// within its own save interval. An unchanged model returns `None`.
314	pub fn save(
315	&self,	235	&self,
316	source: &[u8],
317	space: ExGuid,
318	after: &Page,
319	author: &str,	236	author: &str,
320	) -> Result<Option<u64>> {	237	edit: Edit,
321	Ok(self.save_image(source, space, after, author)?.0)	238	reply: working::Reply<u64>,
		239	) -> Result<()> {
		240	self.send(working::Request::Apply {
		241	author: author.to_owned(),
		242	edit,
		243	reply,
		244	})
322	}	245	}
323		246
324	/// `save`, with the working image it leaves.	247	/// The page in `space` as the queued edits leave it; O(page), for opening and reloading.
325	pub(crate) fn save_image(	248	pub fn page(&self, space: ExGuid) -> Result<Page> {
326	&self,	249	self.ask(\|reply\| working::Request::Page { space, reply })
327	source: &[u8],
328	space: ExGuid,
329	after: &Page,
330	author: &str,
331	) -> Result<(Option<u64>, Vec<u8>)> {
332	let prepared = PreparedEdit::page(source, space, after, author)?;
333	if prepared.as_bytes() == source {
334	return Ok((None, source.to_vec()));
335	}
336	let before = page_of(source, space)?.ok_or_else(\|\| {
337	io::Error::new(
338	io::ErrorKind::InvalidData,
339	"The saved page is not in the local image",
340	)
341	})?;
342	{
343	let mut connection = self
344	.connection
345	.lock()
346	.map_err(\|_\| io::Error::other("Cache owner panicked"))?;
347	let transaction =
348	connection.transaction_with_behavior(TransactionBehavior::Immediate)?;
349	let (base, current) = images::both(&transaction)?;
350	if current != source {
351	return Err(io::Error::new(
352	io::ErrorKind::ResourceBusy,
353	"The local snapshot changed before this edit",
354	)
355	.into());
356	}
357	let newest: Option<(i64, String, String)> = transaction
358	.query_row(
359	"SELECT id, space, operation FROM edits WHERE id=(SELECT max(id) FROM edits)",
360	[],
361	\|row\| Ok((row.get(0)?, row.get(1)?, row.get(2)?)),
362	)
363	.optional()?;
364	// The intent a step is publishing has no attempt row yet; rewriting it would lose
365	// this save under the published bytes.
366	if let Some((id, sid, operation)) = newest
367	&& id != self.in_flight.load(std::sync::atomic::Ordering::Acquire)
368	&& sid == space.to_string()
369	&& let Ok(Operation::Page(mut head)) = serde_json::from_str::<Operation>(&operation)
370	{
371	let attempted: bool = transaction.query_row(
372	"SELECT EXISTS(SELECT 1 FROM attempt WHERE edit_id=?1) OR EXISTS(SELECT 1 FROM conflicts WHERE edit_id=?1)",
373	[id],
374	\|row\| row.get(0),
375	)?;
376	if !attempted {
377	head.after = after.clone();
378	transaction.execute(
379	"UPDATE edits SET operation=?1 WHERE id=?2",
380	params![
381	serde_json::to_string(&Operation::Page(head))
382	.map_err(io::Error::other)?,
383	id
384	],
385	)?;
386	images::set_working(&transaction, &base, prepared.as_bytes())?;
387	transaction.commit()?;
388	drop(connection);
389	self.wake_sync();
390	let id = u64::try_from(id).map_err(io::Error::other)?;
391	return Ok((Some(id), prepared.as_bytes().to_vec()));
392	}
393	}
394	}
395	let id = self.record(
396	source,
397	space,
398	Operation::Page(PageIntent {
399	before,
400	after: after.clone(),
401	author: author.to_owned(),
402	}),
403	&prepared,
404	)?;
405	Ok((id, prepared.as_bytes().to_vec()))
406	}	250	}
407		251
408	/// Queues a new page and its section entry with stable identities for dependent edits.	252	/// Page spaces, titles and outline levels (1 at the top) in section order.
409	pub fn create_page(&self, source: &[u8], page: &PageCreation) -> Result<Option<u64>> {	253	pub fn pages(&self) -> Result<Vec<(ExGuid, String, u32)>> {
410	let edit = PreparedEdit::create_page(source, page)?;	254	self.ask(\|reply\| working::Request::Pages { reply })
411	self.record(
412	source,
413	page.space(),
414	Operation::CreatePage(page.clone()),
415	&edit,
416	)
417	}	255	}
418		256
419	/// Queues the permanent removal of explicitly selected pages; the batch is republished	257	/// The section image the queued edits leave, the unsealed ones sealed as one more
420	/// only while every selected page still exists remotely.	258	/// revision whose identities differ per call: O(section), for tests and diagnostics.
421	pub fn delete_pages(&self, source: &[u8], pages: &[ExGuid]) -> Result<Option<u64>> {	259	pub fn snapshot(&self) -> Result<Vec<u8>> {
422	let edit = PreparedEdit::delete_pages_permanently(source, pages)?;	260	self.ask(\|reply\| working::Request::Image { reply })
423	let space = validate(source)?;
424	self.record(source, space, Operation::DeletePages(pages.to_vec()), &edit)
425	}	261	}
426		262
427	fn record(	263	/// The section file's identity, which internal links name as `section-id`.
428	&self,	264	pub fn identity(&self) -> Result<[u8; 16]> {
429	source: &[u8],	265	let stamp = base::stamp(&*self.lock()?, base::Image::Base)?
430	space: ExGuid,	266	.ok_or_else(\|\| io::Error::new(io::ErrorKind::InvalidData, "Damaged cached image"))?;
431	operation: Operation,	267	Ok(onestore::Header::parse(&stamp.header)?.file_id)
432	edit: &PreparedEdit<'_>,	268	}
433	) -> Result<Option<u64>> {	269
434	let mut connection = self	270	/// Queued edits, oldest first.
435	.connection	271	pub fn pending(&self) -> Result<Vec<PendingEdit>> {
436	.lock()	272	pending(&*self.lock()?)
437	.map_err(\|_\| io::Error::other("Cache owner panicked"))?;
438	let transaction = connection.transaction_with_behavior(TransactionBehavior::Immediate)?;
439	let (base, current) = images::both(&transaction)?;
440	if current != source {
441	return Err(io::Error::new(
442	io::ErrorKind::ResourceBusy,
443	"The local snapshot changed before this edit",
444	)
445	.into());
446	}
447	if edit.as_bytes() == source {
448	return Ok(None);
449	}
450	transaction.execute(
451	"INSERT INTO edits(space, operation) VALUES (?1, ?2)",
452	params![
453	space.to_string(),
454	serde_json::to_string(&operation).map_err(io::Error::other)?
455	],
456	)?;
457	let id = u64::try_from(transaction.last_insert_rowid()).map_err(io::Error::other)?;
458	images::set_working(&transaction, &base, edit.as_bytes())?;
459	transaction.commit()?;
460	drop(connection);
461	self.wake_sync();
462	Ok(Some(id))
463	}	273	}
464		274
465	fn wake_sync(&self) {	275	fn wake_sync(&self) {
466	if let Ok(worker) = self.worker.lock()	276	wake(&self.worker);
467	&& let Some(worker) = worker.upgrade()	277	}
468	{	278	}
469	worker.wake();	279
		280	impl Drop for Replica {
		281	fn drop(&mut self) {
		282	drop(self.working.take());
		283	if let Some(thread) = self.thread.take() {
		284	let _ = thread.join();
470	}	285	}
471	}	286	}
472	}	287	}
473		288
474	fn page_of(source: &[u8], space: ExGuid) -> Result<Option<Page>> {	289	fn lock(connection: &Mutex<Connection>) -> Result<MutexGuard<'_, Connection>> {
475	let store = Store::parse(source)?;	290	connection
476	let index = RevisionIndex::parse(&store)?;	291	.lock()
477	let document = Document::parse(&index)?;	292	.map_err(\|_\| io::Error::other("Cache owner panicked").into())
478	Ok(Page::from_space(&document, space).ok())
479	}	293	}
480		294
481	fn validate(source: &[u8]) -> Result<ExGuid> {	295	fn wake(worker: &Mutex<std::sync::Weak<worker::Signal>>) {
482	let store = Store::parse(source)?;	296	if let Ok(worker) = worker.lock()
483	if !store.checksum_mismatches.is_empty() {	297	&& let Some(worker) = worker.upgrade()
484	return Err(io::Error::new(	298	{
485	io::ErrorKind::InvalidData,	299	worker.wake();
486	"Notebook transaction checksum damage",
487	)
488	.into());
489	}	300	}
490	let index = RevisionIndex::parse(&store)?;	301	}
491	index.validate_current()?;	302
492	Document::parse(&index)?;	303	/// Fully validates a section image, returning its root object space.
493	Ok(index.root)	304	fn validate(source: &[u8]) -> Result<ExGuid> {
		305	let arena = onestore::Arena::default();
		306	Ok(onestore::Section::open(&arena, source.to_vec())?.root())
494	}	307	}
495		308
496	fn pending(connection: &Connection) -> Result<Vec<PendingEdit>> {	309	fn pending(connection: &Connection) -> Result<Vec<PendingEdit>> {
497	let mut query = connection.prepare("SELECT id, space, operation FROM edits ORDER BY id")?;	310	queue::load(connection, None)
498	let mut rows = query.query([])?;
499	let mut edits = Vec::new();
500	while let Some(row) = rows.next()? {
501	edits.push(pending_edit(row)?);
502	}
503	Ok(edits)
504	}	311	}
505		312
506	fn pending_edit(row: &rusqlite::Row<'_>) -> Result<PendingEdit> {	313	fn unsigned(value: i64) -> Result<u64> {
507	let edit = PendingEdit {	314	Ok(u64::try_from(value).map_err(\|_\| io::Error::from(io::ErrorKind::InvalidData))?)
508	id: u64::try_from(row.get::<_, i64>(0)?).map_err(io::Error::other)?,	315	}
509	space: row.get::<_, String>(1)?.parse()?,	316
510	operation: serde_json::from_str(&row.get::<_, String>(2)?)	317	fn signed(value: u64) -> Result<i64> {
511	.map_err(\|error\| io::Error::new(io::ErrorKind::InvalidData, error))?,	318	Ok(i64::try_from(value).map_err(\|_\| io::Error::from(io::ErrorKind::InvalidInput))?)
512	};
513	if matches!(&edit.operation, Operation::CreatePage(page) if page.space() != edit.space) {
514	return Err(io::Error::new(
515	io::ErrorKind::InvalidData,
516	"Cached page identity differs from its creation intent",
517	)
518	.into());
519	}
520	Ok(edit)
521	}	319	}
522		320
		321	/// Opens a cache without writing to it: exclusive locking, a full sync of every commit
		322	/// (`F_FULLFSYNC` on macOS, the WAL's syncs included) and foreign keys, each queried back.
523	fn cache_connection(path: &Path) -> Result<Connection> {	323	fn cache_connection(path: &Path) -> Result<Connection> {
524	let connection = Connection::open_with_flags(path, OpenFlags::SQLITE_OPEN_READ_WRITE)?;	324	let connection = Connection::open_with_flags(path, OpenFlags::SQLITE_OPEN_READ_WRITE)?;
525	connection.busy_timeout(Duration::ZERO)?;	325	connection.busy_timeout(Duration::ZERO)?;
526	connection.execute_batch(	326	connection.execute_batch(
527	"PRAGMA locking_mode=EXCLUSIVE; PRAGMA synchronous=EXTRA; PRAGMA fullfsync=ON; PRAGMA foreign_keys=ON;",	327	"PRAGMA locking_mode=EXCLUSIVE; PRAGMA synchronous=FULL; PRAGMA fullfsync=ON; PRAGMA foreign_keys=ON;",
528	)?;	328	)?;
529	for (name, expected) in [("locking_mode", "exclusive"), ("journal_mode", "delete")] {	329	let locking: String = connection.pragma_query_value(None, "locking_mode", \|row\| row.get(0))?;
530	let actual: String = connection.pragma_query_value(None, name, \|row\| row.get(0))?;	330	let journal: String = connection.pragma_query_value(None, "journal_mode", \|row\| row.get(0))?;
531	if actual != expected {	331	if locking != "exclusive" \|\| !["wal", "delete"].contains(&journal.as_str()) {
532	return Err(io::Error::new(	332	return Err(io::Error::new(
533	io::ErrorKind::InvalidData,	333	io::ErrorKind::InvalidData,
534	"Unsupported cache locking or journal mode",	334	"Unsupported cache locking or journal mode",
535	)	335	)
536	.into());	336	.into());
537	}
538	}	337	}
539	for (name, expected) in [("synchronous", 3), ("fullfsync", 1), ("foreign_keys", 1)] {	338	for (name, expected) in [("synchronous", 2), ("fullfsync", 1), ("foreign_keys", 1)] {
540	let actual: i64 = connection.pragma_query_value(None, name, \|row\| row.get(0))?;	339	let actual: i64 = connection.pragma_query_value(None, name, \|row\| row.get(0))?;
541	if actual != expected {	340	if actual != expected {
542	return Err(io::Error::new(	341	return Err(io::Error::new(
...	@@ -549,20 +348,27 @@ fn cache_connection(path: &Path) -> Result<Connection> {	...	@@ -549,20 +348,27 @@ fn cache_connection(path: &Path) -> Result<Connection> {
549	Ok(connection)	348	Ok(connection)
550	}	349	}
551		350
552	fn validate_images(connection: &Connection) -> Result<()> {	351	/// Switches a cache to write-ahead logging: a commit appends its pages to `<cache>-wal`
553	let integrity: String = connection.query_row("PRAGMA quick_check", [], \|row\| row.get(0))?;	352	/// instead of copying the originals to a rollback journal. Under exclusive locking the WAL
554	if integrity != "ok" {	353	/// index lives in memory, so the WAL is the only file beside the cache; it is checkpointed
555	return Err(	354	/// and removed on close, and replayed on the next open after a crash.
556	io::Error::new(io::ErrorKind::InvalidData, "Cache integrity check failed").into(),	355	fn write_ahead(connection: &Connection) -> Result<()> {
557	);	356	let mode: String =
558	}	357	connection.pragma_update_and_check(None, "journal_mode", "WAL", \|row\| row.get(0))?;
559	let (base, working) = images::both(connection)?;	358	if mode != "wal" {
560	if validate(&base)? != validate(&working)? {
561	return Err(io::Error::new(	359	return Err(io::Error::new(
562	io::ErrorKind::InvalidData,	360	io::ErrorKind::Unsupported,
563	"Cache images belong to different documents",	361	"The cache cannot use write-ahead logging",
564	)	362	)
565	.into());	363	.into());
566	}	364	}
567	Ok(())	365	Ok(())
568	}	366	}
		367
		368	/// FILETIME now, as an edit's `at`.
		369	pub(crate) fn now() -> u64 {
		370	let unix = std::time::SystemTime::now()
		371	.duration_since(std::time::UNIX_EPOCH)
		372	.unwrap_or_default();
		373	(unix.as_secs() + 11_644_473_600) * 10_000_000 + u64::from(unix.subsec_nanos() / 100)
		374	}

crates/notebook/src/merge.rs+1102-476

...	@@ -1,554 +1,1180 @@	...	@@ -1,554 +1,1180 @@
1	//! Three-way merge of page models: the remote page keeps everything it changed, and the	1	//! Rebasing queued edits onto a changed remote section. Each op replays on the remote
2	//! local changes (`base` → `ours`) are re-applied wherever the two sides touched	2	//! section when the objects it reads are as the base image had them; text ops on a text
3	//! different objects, fields or text ranges. Any overlap is a conflict for review.	3	//! the remote also changed shift past the remote's changes when they stay clear of them;
		4	//! a move, deletion or outline setting the remote already made is dropped as done.
		5	//! Anything else is a conflict: the queue stays on its base until it is resolved.
		6	//! Objects the queue itself created are not in the base, so nothing remote can have
		7	//! changed them.
4		8
		9	use crate::{ConflictKind, PendingEdit, Result};
5	use onestore::{	10	use onestore::{
6	ExGuid,	11	ExGuid, OutlineEdit, PageCreation, PageEdit, PagePosition, Section,
7	page::{Outline, Page, PageObject, PageParagraph, ParagraphContent, text::Edit},	12	document::{Format, Layout, Tag},
		13	op::{Edit, Op, OpError, PageOp, SectionOp, TableEdit},
		14	page::{
		15	Attachment, Image, Ink, MediaIndex, Outline, Page, PageObject, PageParagraph, Paragraph,
		16	ParagraphContent, TableColumn, TextObject, Unsupported,
		17	},
		18	};
		19	use std::{
		20	collections::{BTreeMap, BTreeSet},
		21	ops::Range,
8	};	22	};
9	use std::collections::{BTreeMap, BTreeSet};
10		23
11	pub(crate) fn merge(base: &Page, ours: &Page, theirs: &Page) -> Option<Page> {	24	/// A conflict being resolved: from edit `first` on, ops on `space` are dropped. Keeping
12	if ours == base {	25	/// mine replaces the first of them by the ops rewriting the remote page to `target` (or
13	return Some(theirs.clone());	26	/// putting `target` back as a page where the remote removed it), or, for the section's
14	}	27	/// page list, keeps what of each section op still applies.
15	if theirs == base \|\| ours == theirs {	28	pub(crate) struct Resolving<'p> {
16	return Some(ours.clone());	29	pub first: u64,
17	}	30	pub space: ExGuid,
18	if ours.created != base.created \|\| ours.margin_origin != base.margin_origin {	31	pub mine: bool,
19	return None;	32	pub target: Option<&'p Page>,
20	}	33	}
21	fn by_id(page: &Page) -> BTreeMap<ExGuid, &PageObject> {	34
22	page.objects	35	pub(crate) enum Outcome {
23	.iter()	36	/// Every edit applied; these edits' ops changed. An edit whose ops were all dropped
24	.map(\|object\| (object.id(), object))	37	/// stays, empty, to be published and acknowledged with its batch.
25	.collect()	38	Applied(Vec<(u64, Edit)>),
26	}	39	Conflict {
27	let (b, o, t) = (by_id(base), by_id(ours), by_id(theirs));	40	id: u64,
28	let mut result: Vec<PageObject> = Vec::new();	41	space: ExGuid,
29	for object in &theirs.objects {	42	kind: ConflictKind,
30	let id = object.id();	43	},
31	match (b.get(&id), o.get(&id)) {	44	}
32	(Some(before), Some(after)) => match (before, after, object) {	45
33	(PageObject::Outline(x), PageObject::Outline(y), PageObject::Outline(z)) => {	46	/// Replays `edits` on `new`, the remote section; `old` is the base they were made on.
34	result.push(PageObject::Outline(merge_outline(x, y, z)?));	47	pub(crate) fn rebase(
		48	old: &mut Section<'_>,
		49	new: &mut Section<'_>,
		50	edits: &[PendingEdit],
		51	converged: &BTreeSet<ExGuid>,
		52	resolving: Option<Resolving<'_>>,
		53	) -> Result<Outcome> {
		54	let root = new.root();
		55	let before: BTreeMap<ExGuid, ExGuid> = old.revisions().collect();
		56	let after: BTreeMap<ExGuid, ExGuid> = new.revisions().collect();
		57	let orders = (order(old)?, order(new)?);
		58	let mut state = Replay {
		59	before,
		60	after,
		61	orders,
		62	created: BTreeSet::new(),
		63	diffs: BTreeMap::new(),
		64	};
		65	let mut rewritten = Vec::new();
		66	let mut resolved = false;
		67	for queued in edits {
		68	let branch = resolving
		69	.as_ref()
		70	.filter(\|resolving\| queued.id >= resolving.first);
		71	let mut ops = Vec::new();
		72	let mut changed = false;
		73	for op in &queued.edit.ops {
		74	let conflict = \|kind, space\| Outcome::Conflict {
		75	id: queued.id,
		76	space,
		77	kind,
		78	};
		79	if let Some(resolving) = branch {
		80	let dropped = match op {
		81	Op::Page { space, .. } => *space == resolving.space,
		82	Op::Section(_) => resolving.space == root,
		83	};
		84	if dropped {
		85	changed = true;
		86	let rewrite = match op {
		87	Op::Page { space, .. } if !resolved && resolving.mine => {
		88	resolving.target.map(\|target\| (*space, target))
		89	}
		90	_ => None,
		91	};
		92	resolved \|= matches!(op, Op::Page { .. });
		93	if let Some((space, target)) = rewrite {
		94	if !state.listed(space) {
		95	// Kept while the remote removed it: the page comes back.
		96	match state.restore(
		97	new,
		98	space,
		99	target,
		100	&queued.author,
		101	queued.edit.at,
		102	)? {
		103	Ok(restored) => ops.extend(restored),
		104	Err(kind) => return Ok(conflict(kind, space)),
		105	}
		106	continue;
		107	}
		108	let current = new.page(space)?;
		109	for op in onestore::op::lower_page(&current, target)
		110	.map_err(\|error\| OpError::Unsupported(error.message))?
		111	{
		112	let op = Op::Page { space, op };
		113	if let Some(kind) =
		114	state.apply(new, &queued.author, queued.edit.at, &op)?
		115	{
		116	return Ok(conflict(kind, space));
		117	}
		118	ops.push(op);
		119	}
		120	}
		121	if let (Op::Section(op), true) = (op, resolving.mine) {
		122	// Keeping mine for the section list: the first form that applies.
		123	for op in state.salvage(new, op) {
		124	let op = Op::Section(op);
		125	if state
		126	.apply(new, &queued.author, queued.edit.at, &op)?
		127	.is_none()
		128	{
		129	ops.push(op);
		130	break;
		131	}
		132	}
		133	}
		134	continue;
35	}	135	}
36	_ => result.push(pick(before, after, &object)?.clone()),	136	}
37	},	137	let space = match op {
38	(Some(before), None) => {	138	Op::Page { space, .. } => *space,
39	// Removed locally; keep only if the remote left it untouched.	139	Op::Section(_) => root,
40	if object != *before {	140	};
41	return None;	141	if matches!(op, Op::Page { .. }) && converged.contains(&space) {
		142	changed = true;
		143	continue;
		144	}
		145	let mapped = match state.check(old, new, op)? {
		146	Ok(Some(mapped)) => mapped,
		147	Ok(None) => {
		148	changed = true;
		149	continue;
42	}	150	}
		151	Err(kind) => return Ok(conflict(kind, space)),
		152	};
		153	changed \|= mapped != *op;
		154	if let Some(kind) = state.apply(new, &queued.author, queued.edit.at, &mapped)? {
		155	return Ok(conflict(kind, space));
43	}	156	}
44	(None, _) => result.push(object.clone()),	157	ops.push(mapped);
		158	}
		159	if changed {
		160	rewritten.push((
		161	queued.id,
		162	Edit {
		163	at: queued.edit.at,
		164	ops,
		165	},
		166	));
45	}	167	}
46	}	168	}
47	for (index, object) in ours.objects.iter().enumerate() {	169	Ok(Outcome::Applied(rewritten))
48	let id = object.id();	170	}
49	if b.contains_key(&id) {	171
50	if !t.contains_key(&id) {	172	fn order(section: &mut Section<'_>) -> Result<Order> {
51	// Removed remotely; a local edit to it cannot be placed.	173	Ok(section
52	if b[&id] != object {	174	.pages()?
53	return None;	175	.into_iter()
		176	.map(\|(space, _, level)\| (space, level))
		177	.collect())
		178	}
		179
		180	/// Page spaces in section order with their levels.
		181	type Order = Vec<(ExGuid, u32)>;
		182
		183	struct Replay {
		184	/// Active revisions of the base and the remote.
		185	before: BTreeMap<ExGuid, ExGuid>,
		186	after: BTreeMap<ExGuid, ExGuid>,
		187	/// Page order of the base and the remote.
		188	orders: (Order, Order),
		189	/// Page spaces the replayed edits created.
		190	created: BTreeSet<ExGuid>,
		191	/// Per page the remote changed, what it changed; `None` when it left the page alone.
		192	diffs: BTreeMap<ExGuid, Option<Diff>>,
		193	}
		194
		195	impl Replay {
		196	/// Applies one op to the remote section; `Some` names why it did not apply.
		197	fn apply(
		198	&mut self,
		199	new: &mut Section<'_>,
		200	author: &str,
		201	at: u64,
		202	op: &Op,
		203	) -> Result<Option<ConflictKind>> {
		204	match new.apply(
		205	author,
		206	&Edit {
		207	at,
		208	ops: vec![op.clone()],
		209	},
		210	) {
		211	Ok(()) => {
		212	if let Op::Section(
		213	SectionOp::Create(creation) \| SectionOp::Import { creation, .. },
		214	) = op
		215	{
		216	self.created.insert(creation.space());
54	}	217	}
		218	Ok(None)
55	}	219	}
56	continue;	220	Err(OpError::Failed(error)) => Err(error.into()),
		221	Err(error) => Ok(Some(match op {
		222	// A page list the remote reordered refuses the op, however it says so.
		223	Op::Section(_) => ConflictKind::StructureChanged,
		224	Op::Page { .. } if matches!(error, OpError::Unsupported(_)) => {
		225	ConflictKind::UnsupportedEdit
		226	}
		227	Op::Page { space, .. } if !self.listed(*space) => ConflictKind::TargetUnavailable,
		228	Op::Page { .. } => ConflictKind::ContentChanged,
		229	})),
57	}	230	}
58	if t.contains_key(&id) {	231	}
59	return None;	232
		233	/// The op as it replays on the remote section, or why it cannot.
		234	fn check(
		235	&mut self,
		236	old: &mut Section<'_>,
		237	new: &mut Section<'_>,
		238	op: &Op,
		239	) -> Result<std::result::Result<Option<Op>, ConflictKind>> {
		240	match op {
		241	Op::Page { space, op } => {
		242	if !self.listed(*space) {
		243	return Ok(Err(ConflictKind::TargetUnavailable));
		244	}
		245	let diff = match self.diffs.get_mut(space) {
		246	Some(diff) => diff,
		247	None => {
		248	let diff = match (self.before.get(space), self.after.get(space)) {
		249	(Some(before), Some(after)) if before != after => Some(Diff {
		250	old: Index::of(&old.page(*space)?),
		251	new: Index::of(&new.page(*space)?),
		252	regions: BTreeMap::new(),
		253	}),
		254	_ => None,
		255	};
		256	self.diffs.entry(*space).or_insert(diff)
		257	}
		258	};
		259	Ok(match diff {
		260	None => Ok(Some(Op::Page {
		261	space: *space,
		262	op: op.clone(),
		263	})),
		264	Some(diff) => diff
		265	.check(op)
		266	.map(\|op\| op.map(\|op\| Op::Page { space: *space, op })),
		267	})
		268	}
		269	Op::Section(section) => Ok(self.section(section).map(\|()\| Some(op.clone()))),
60	}	270	}
61	let PageObject::Outline(_) = object else {
62	return None;
63	};
64	let predecessor = ours.objects[..index]
65	.iter()
66	.rev()
67	.map(PageObject::id)
68	.find(\|other\| result.iter().any(\|r\| r.id() == *other));
69	let at = match predecessor {
70	Some(other) => result.iter().position(\|r\| r.id() == other).unwrap() + 1,
71	None => 0,
72	};
73	let at = at.min(
74	result
75	.iter()
76	.position(\|r\| matches!(r, PageObject::Title(_)))
77	.unwrap_or(result.len()),
78	);
79	result.insert(at, object.clone());
80	}	271	}
81	let order = \|objects: &[PageObject], keep: &dyn Fn(ExGuid) -> bool\| -> Vec<ExGuid> {	272
82	objects	273	/// Whether the remote section lists the page, or the replayed edits created it; a page
		274	/// removed from the list keeps its stored revisions.
		275	fn listed(&self, space: ExGuid) -> bool {
		276	self.created.contains(&space) \|\| self.orders.1.iter().any(\|(page, _)\| *page == space)
		277	}
		278
		279	/// Puts `page`, which the remote removed, back into the section and returns the ops
		280	/// that did: a copy under fresh identities at its level, before the first page after it
		281	/// that the remote still has and that can take a page before it, or last.
		282	fn restore(
		283	&mut self,
		284	new: &mut Section<'_>,
		285	space: ExGuid,
		286	page: &Page,
		287	author: &str,
		288	at: u64,
		289	) -> Result<std::result::Result<Vec<Op>, ConflictKind>> {
		290	let old = self.orders.0.clone();
		291	let position = old.iter().position(\|(listed, _)\| *listed == space);
		292	let anchors = position
		293	.map_or(&[][..], \|position\| &old[position + 1..])
83	.iter()	294	.iter()
84	.filter(\|object\| matches!(object, PageObject::Outline(_)) && keep(object.id()))	295	.map(\|(next, _)\| Some(*next))
85	.map(PageObject::id)	296	.filter(\|next\| next.is_some_and(\|next\| self.listed(next)))
86	.collect()	297	.chain([None])
87	};	298	.collect::<Vec<_>>();
88	let common = \|id: ExGuid\| b.contains_key(&id) && o.contains_key(&id) && t.contains_key(&id);	299	let copy = page.copy()?;
89	let (base_order, our_order, their_order) = (	300	let mut refusal = ConflictKind::StructureChanged;
90	order(&base.objects, &common),	301	for before in anchors {
91	order(&ours.objects, &common),	302	let creation = PageCreation::new(before, Some(&page.title), author)?;
92	order(&theirs.objects, &common),	303	let import = Op::Section(SectionOp::Import {
93	);	304	creation: creation.clone(),
94	if our_order != base_order {	305	page: copy.clone(),
95	if their_order != base_order && their_order != our_order {	306	});
96	return None;	307	match self.apply(new, author, at, &import)? {
		308	Some(kind) => refusal = kind,
		309	None => {
		310	let mut ops = vec![import];
		311	if let Some(level) = position.map(\|at\| old[at].1).filter(\|level\| *level > 1) {
		312	let indent = Op::Section(SectionOp::Pages(vec![PageEdit::set_level(
		313	creation.space(),
		314	level,
		315	)?]));
		316	if let Some(kind) = self.apply(new, author, at, &indent)? {
		317	return Ok(Err(kind));
		318	}
		319	ops.push(indent);
		320	}
		321	return Ok(Ok(ops));
		322	}
		323	}
97	}	324	}
98	result = reorder(result, &our_order);	325	Ok(Err(refusal))
99	}	326	}
100	// Definitions we added or changed travel with our paragraphs; theirs win elsewhere.	327
101	let mut definitions = theirs.definitions.clone();	328	fn section(&self, op: &SectionOp) -> std::result::Result<(), ConflictKind> {
102	for (id, definition) in &ours.definitions {	329	let (old, new) = &self.orders;
103	match (base.definitions.get(id), theirs.definitions.get(id)) {	330	let find =
104	(Some(before), Some(after)) if before != definition => {	331	\|list: &[(ExGuid, u32)], space: ExGuid\| list.iter().position(\|(s, _)\| *s == space);
105	if after != before && after != definition {	332	match op {
106	return None;	333	SectionOp::Create(_) \| SectionOp::Import { .. } => Ok(()),
		334	SectionOp::Delete(pages) => {
		335	for page in pages {
		336	if find(new, *page).is_none() && !self.created.contains(page) {
		337	return Err(ConflictKind::TargetUnavailable);
		338	}
		339	if self.before.get(page) != self.after.get(page) {
		340	return Err(ConflictKind::ContentChanged);
		341	}
107	}	342	}
108	definitions.insert(*id, definition.clone());	343	Ok(())
109	}	344	}
110	(None, None) => {	345	SectionOp::Pages(edits) => {
111	definitions.insert(*id, definition.clone());	346	// Where the batch puts each page, from the base order.
		347	let mut wanted: Vec<ExGuid> = old.iter().map(\|(space, _)\| *space).collect();
		348	for edit in edits {
		349	if let PagePosition::Before(before) = edit.position()
		350	&& let Some(at) = wanted.iter().position(\|space\| *space == edit.space())
		351	{
		352	let space = wanted.remove(at);
		353	let at = before
		354	.and_then(\|before\| wanted.iter().position(\|space\| *space == before))
		355	.unwrap_or(wanted.len());
		356	wanted.insert(at, space);
		357	}
		358	}
		359	let wanted: Vec<(ExGuid, u32)> =
		360	wanted.into_iter().map(\|space\| (space, 0)).collect();
		361	for edit in edits {
		362	let space = edit.space();
		363	let Some(at) = find(old, space) else {
		364	continue;
		365	};
		366	let Some(now) = find(new, space) else {
		367	return Err(ConflictKind::TargetUnavailable);
		368	};
		369	if old[at].1 != new[now].1 && new[now].1 != edit.level() {
		370	return Err(ConflictKind::StructureChanged);
		371	}
		372	if edit.position() != PagePosition::Keep {
		373	// Each page the remote also has must keep its side of the moved page,
		374	// or already be on the side the batch wants.
		375	let side = \|list: &[(ExGuid, u32)], peer: ExGuid\| {
		376	Some(find(list, peer)? < find(list, space)?)
		377	};
		378	let conflicting = old.iter().any(\|(peer, _)\| {
		379	*peer != space
		380	&& find(new, *peer).is_some()
		381	&& side(new, peer) != side(old, peer)
		382	&& side(new, peer) != side(&wanted, peer)
		383	});
		384	if conflicting {
		385	return Err(ConflictKind::StructureChanged);
		386	}
		387	}
		388	}
		389	Ok(())
		390	}
		391	}
		392	}
		393
		394	/// Forms of a section op to try on the remote section list, in order: as it is, a
		395	/// creation appended instead, moves and removals of the pages still there.
		396	fn salvage(&self, new: &mut Section<'_>, op: &SectionOp) -> Vec<SectionOp> {
		397	let pages: BTreeSet<ExGuid> = new
		398	.pages()
		399	.map(\|pages\| pages.into_iter().map(\|(space, ..)\| space).collect())
		400	.unwrap_or_default();
		401	let present = \|space: &ExGuid\| pages.contains(space) \|\| self.created.contains(space);
		402	match op {
		403	SectionOp::Create(creation) => std::iter::once(creation.clone())
		404	.chain(creation.reposition(None).ok())
		405	.map(SectionOp::Create)
		406	.collect(),
		407	SectionOp::Import { .. } => vec![op.clone()],
		408	SectionOp::Pages(edits) => {
		409	let edits: Vec<PageEdit> = edits
		410	.iter()
		411	.filter(\|edit\| present(&edit.space()))
		412	.cloned()
		413	.collect();
		414	if edits.is_empty() {
		415	Vec::new()
		416	} else {
		417	vec![SectionOp::Pages(edits)]
		418	}
		419	}
		420	SectionOp::Delete(deleted) => {
		421	let deleted: Vec<ExGuid> = deleted
		422	.iter()
		423	.filter(\|space\| present(space))
		424	.copied()
		425	.collect();
		426	if deleted.is_empty() {
		427	Vec::new()
		428	} else {
		429	vec![SectionOp::Delete(deleted)]
		430	}
112	}	431	}
113	(None, Some(after)) if after != definition => return None,
114	_ => {}
115	}	432	}
116	}	433	}
117	Some(Page {
118	title: theirs.title.clone(),
119	identity: theirs.identity,
120	created: theirs.created,
121	margin_origin: theirs.margin_origin,
122	objects: result,
123	definitions,
124	})
125	}	434	}
126		435
127	/// Places the objects named in `order` into the slots those objects occupy in `objects`,	436	/// One page as the base stored it and as the remote does, with the remote's text changes
128	/// leaving every other object where it is.	437	/// in the coordinates of the replayed edits.
129	fn reorder(objects: Vec<PageObject>, order: &[ExGuid]) -> Vec<PageObject> {	438	struct Diff {
130	let mut slots: Vec<Option<PageObject>> = objects.into_iter().map(Some).collect();	439	old: Index,
131	let positions: Vec<usize> = slots	440	new: Index,
132	.iter()	441	regions: BTreeMap<ExGuid, Changes>,
133	.enumerate()
134	.filter(\|(_, slot)\| {
135	slot.as_ref()
136	.is_some_and(\|object\| order.contains(&object.id()))
137	})
138	.map(\|(i, _)\| i)
139	.collect();
140	let mut taken: BTreeMap<ExGuid, PageObject> = positions
141	.iter()
142	.map(\|&i\| {
143	let object = slots[i].take().unwrap();
144	(object.id(), object)
145	})
146	.collect();
147	for (slot, id) in positions.into_iter().zip(order) {
148	slots[slot] = taken.remove(id);
149	}
150	slots.into_iter().flatten().collect()
151	}	442	}
152		443
153	fn pick<T: PartialEq + Clone>(base: &T, ours: &T, theirs: &T) -> Option<T> {	444	impl Diff {
154	if ours == base {	445	fn ours(&self, id: ExGuid) -> bool {
155	Some(theirs.clone())	446	!self.old.nodes.contains_key(&id)
156	} else if theirs == base \|\| theirs == ours {
157	Some(ours.clone())
158	} else {
159	None
160	}	447	}
161	}
162		448
163	fn merge_outline(base: &Outline, ours: &Outline, theirs: &Outline) -> Option<Outline> {	449	/// Whether the remote left the object's own data as the base had it.
164	let title = pick(&base.title, &ours.title, &theirs.title)?;	450	fn kept(&self, id: ExGuid) -> bool {
165	let min_width = pick(&base.min_width, &ours.min_width, &theirs.min_width)?;	451	self.ours(id)
166	let indents = pick(&base.indents, &ours.indents, &theirs.indents)?;	452	\|\| matches!((self.old.nodes.get(&id), self.new.nodes.get(&id)), (Some(a), Some(b)) if a.own == b.own)
167	let unsupported = pick(&base.unsupported, &ours.unsupported, &theirs.unsupported)?;	453	}
168	let mut layout = theirs.layout.clone();
169	let (x, y) = pick(
170	&(base.layout.x, base.layout.y),
171	&(ours.layout.x, ours.layout.y),
172	&(theirs.layout.x, theirs.layout.y),
173	)?;
174	// A user-set width clears the wrap reservation, so the three travel together.
175	let width = \|layout: &onestore::document::Layout\| {
176	(
177	layout.max_width,
178	layout.width_set_by_user,
179	layout.reserved_width,
180	)
181	};
182	let (max_width, user_set, reserved) = pick(
183	&width(&base.layout),
184	&width(&ours.layout),
185	&width(&theirs.layout),
186	)?;
187	layout.x = x;
188	layout.y = y;
189	layout.max_width = max_width;
190	layout.width_set_by_user = user_set;
191	layout.reserved_width = reserved;
192	Some(Outline {
193	id: theirs.id,
194	title,
195	min_width,
196	layout,
197	indents,
198	paragraphs: merge_paragraphs(&base.paragraphs, &ours.paragraphs, &theirs.paragraphs)?,
199	unsupported,
200	})
201	}
202		454
203	type Children = BTreeMap<Option<ExGuid>, Vec<ExGuid>>;	455	/// Whether the remote left the object and everything under it as the base had it.
		456	fn untouched(&self, id: ExGuid) -> bool {
		457	if self.ours(id) {
		458	return true;
		459	}
		460	let (Some(a), Some(b)) = (self.old.nodes.get(&id), self.new.nodes.get(&id)) else {
		461	return false;
		462	};
		463	a.own == b.own
		464	&& a.parent == b.parent
		465	&& a.children == b.children
		466	&& a.below().all(\|child\| self.untouched(child))
		467	}
204		468
205	fn children(list: &[PageParagraph]) -> Children {	469	/// Whether the remote kept the object under the same parent, in the same order among
206	let mut children: Children = BTreeMap::new();	470	/// the siblings both sides have.
207	for paragraph in list {	471	fn placed(&self, id: ExGuid) -> bool {
208	children	472	if self.ours(id) {
209	.entry(paragraph.parent)	473	return true;
210	.or_default()	474	}
211	.push(paragraph.id);	475	let (Some(a), Some(b)) = (self.old.nodes.get(&id), self.new.nodes.get(&id)) else {
		476	return false;
		477	};
		478	if a.parent != b.parent {
		479	return false;
		480	}
		481	let siblings = \|index: &Index\| index.children(a.parent).to_vec();
		482	let (old, new) = (siblings(&self.old), siblings(&self.new));
		483	let at = \|list: &[ExGuid], id: ExGuid\| list.iter().position(\|x\| *x == id);
		484	let (Some(i), Some(j)) = (at(&old, id), at(&new, id)) else {
		485	return false;
		486	};
		487	old.iter()
		488	.enumerate()
		489	.all(\|(k, peer)\| peer == id \|\| at(&new, peer).is_none_or(\|l\| (k < i) == (l < j)))
212	}	490	}
213	children
214	}
215		491
216	fn merge_paragraphs(	492	/// Where the remote changed a text's characters and formats; its tags and date field
217	base: &[PageParagraph],	493	/// are not positions an op names.
218	ours: &[PageParagraph],	494	fn region(&mut self, text: ExGuid) -> std::result::Result<Option<&mut Changes>, ConflictKind> {
219	theirs: &[PageParagraph],	495	if !self.regions.contains_key(&text) {
220	) -> Option<Vec<PageParagraph>> {	496	if self.ours(text) {
221	fn index(list: &[PageParagraph]) -> BTreeMap<ExGuid, &PageParagraph> {	497	return Ok(None);
222	list.iter().map(\|p\| (p.id, p)).collect()	498	}
223	}	499	let (Some(Own::Text(a)), Some(Own::Text(b))) = (
224	let (b, o, t) = (index(base), index(ours), index(theirs));	500	self.old.nodes.get(&text).map(\|node\| &node.own),
225	let mut merged: BTreeMap<ExGuid, PageParagraph> = BTreeMap::new();	501	self.new.nodes.get(&text).map(\|node\| &node.own),
226	let mut removed = BTreeSet::new();	502	) else {
227	for id in b.keys().chain(o.keys()).chain(t.keys()) {	503	return Err(ConflictKind::ContentChanged);
228	if merged.contains_key(id) \|\| removed.contains(id) {	504	};
229	continue;	505	if a.text == b.text {
		506	return Ok(None);
		507	}
		508	let region = Changes::between(&a.text, &b.text);
		509	self.regions.insert(text, region);
230	}	510	}
231	let paragraph = match (b.get(id), o.get(id), t.get(id)) {	511	Ok(self.regions.get_mut(&text))
232	(Some(x), Some(y), Some(z)) => merge_paragraph(x, y, z)?,	512	}
233	(Some(x), None, Some(z)) => {	513
234	if z != x {	514	/// The op as it replays on the remote page; `None` when the remote already made it.
235	return None;	515	fn check(&mut self, op: &PageOp) -> std::result::Result<Option<PageOp>, ConflictKind> {
		516	use ConflictKind::ContentChanged as Changed;
		517	let require = \|ok: bool\| if ok { Ok(()) } else { Err(Changed) };
		518	let mut op = op.clone();
		519	match &mut op {
		520	PageOp::Text { text, range, with } => {
		521	if let Some(region) = self.region(*text)? {
		522	let mapped = region.map(range).ok_or(Changed)?;
		523	region.replaced(range, with.encode_utf16().count() as u32);
		524	*range = mapped;
236	}	525	}
237	removed.insert(*id);
238	continue;
239	}	526	}
240	(Some(x), Some(y), None) => {	527	PageOp::Format { text, range, .. } => {
241	if y != x {	528	if let Some(region) = self.region(*text)? {
242	return None;	529	*range = region.map(range).ok_or(Changed)?;
243	}	530	}
244	removed.insert(*id);
245	continue;
246	}	531	}
247	(Some(_), None, None) => {	532	PageOp::Link { text, .. } \| PageOp::Equation { text, .. } => {
248	removed.insert(*id);	533	require(self.region(*text)?.is_none())?;
249	continue;
250	}	534	}
251	(None, Some(_), Some(_)) => return None,	535	PageOp::Split {
252	(None, Some(y), None) => (*y).clone(),	536	text, at, right, ..
253	(None, None, Some(z)) => (*z).clone(),	537	} => {
254	(None, None, None) => unreachable!(),	538	// The new paragraph copies the holder's placement and formats; lists and tags
255	};	539	// stay with the holder unless the split names copies of them.
256	merged.insert(*id, paragraph);	540	let holder = self.holder(*text);
257	}	541	require(holder.is_none_or(\|holder\| self.splits_alike(holder)))?;
258	// Child order per container: the remote order with our repositioned paragraphs re-placed.	542	if let Some(region) = self.region(*text)? {
259	let (bc, oc, tc) = (children(base), children(ours), children(theirs));	543	// The cut moves with the character after it: text the remote typed at
260	// A paragraph we added after one they gave new children would sit after or among those	544	// the cut stays left of it.
261	// children; Enter splitting a paragraph carries its children below, so neither is assumed.	545	let cut = region.map(&(at..at + 1)).ok_or(Changed)?;
262	for pair in oc.values().flat_map(\|list\| list.windows(2)) {	546	let right_changes = region.split(*at);
263	if b.contains_key(&pair[0])	547	if !right_changes.0.is_empty() {
264	&& !b.contains_key(&pair[1])	548	self.regions.insert(*right, right_changes);
265	&& tc	549	}
266	.get(&Some(pair[0]))	550	*at = cut.start;
267	.is_some_and(\|children\| children.iter().any(\|id\| !b.contains_key(id)))	551	}
268	{	552	}
269	return None;	553	PageOp::Join { left, right } => {
		554	require(self.untouched(*right))?;
		555	require(
		556	self.holder_text(*right)
		557	.is_none_or(\|text\| !self.regions.contains_key(&text)),
		558	)?;
		559	if let Some(text) = self.holder_text(*left) {
		560	self.region(text)?;
		561	}
		562	}
		563	PageOp::Insert { .. } \| PageOp::Add { .. } => {}
		564	PageOp::Move {
		565	object,
		566	parent,
		567	before,
		568	} => require(self.placed(object) \|\| self.placed_at(object, parent, before))?,
		569	PageOp::Delete { object } => {
		570	if !self.ours(*object) && !self.new.nodes.contains_key(object) {
		571	return Ok(None);
		572	}
		573	require(self.untouched(*object))?
		574	}
		575	PageOp::Level { paragraph, .. } => require(
		576	self.ours(*paragraph) \|\| {
		577	let level = \|index: &Index\| {
		578	index.nodes.get(paragraph).map(\|node\| {
		579	(
		580	node.parent,
		581	match &node.own {
		582	Own::Paragraph { level, .. } => *level,
		583	_ => 0,
		584	},
		585	)
		586	})
		587	};
		588	level(&self.old).is_some() && level(&self.old) == level(&self.new)
		589	},
		590	)?,
		591	PageOp::Outline { object, edit } => {
		592	if self.ours(*object) {
		593	return Ok(Some(op));
		594	}
		595	let edit: &OutlineEdit = edit;
		596	// What the edit sets, as each side has it.
		597	let part = \|index: &Index\| {
		598	index.nodes.get(object).map(\|node\| match (&node.own, edit) {
		599	(Own::Outline { layout, .. }, OutlineEdit::Position { .. }) => {
		600	(layout.x, layout.y, None, None)
		601	}
		602	(Own::Outline { layout, .. }, OutlineEdit::Width { .. }) => (
		603	layout.max_width,
		604	layout.reserved_width,
		605	layout.width_set_by_user,
		606	None,
		607	),
		608	(Own::Paragraph { collapsed, .. }, OutlineEdit::Collapsed(_)) => {
		609	(None, None, None, Some(*collapsed))
		610	}
		611	_ => (None, None, None, None),
		612	})
		613	};
		614	let (before, after) = (part(&self.old), part(&self.new));
		615	if before.is_some() && before != after {
		616	// The remote set the same value: the edit is done.
		617	let near = \|a: Option<f32>, b: f32\| a.is_some_and(\|a\| (a - b).abs() < 1e-3);
		618	let done = match (after, edit) {
		619	(Some((x, y, ..)), OutlineEdit::Position { x: px, y: py }) => {
		620	near(x, px) && near(y, py)
		621	}
		622	(
		623	Some((width, reserved, set, _)),
		624	OutlineEdit::Width { points, user_set },
		625	) => near(width, points) && reserved.is_none() && set == Some(user_set),
		626	(Some((.., collapsed)), OutlineEdit::Collapsed(value)) => {
		627	collapsed == Some(*value)
		628	}
		629	_ => false,
		630	};
		631	return if done { Ok(None) } else { Err(Changed) };
		632	}
		633	require(before.is_some())?
		634	}
		635	PageOp::Paragraph { paragraph, .. }
		636	\| PageOp::Style { paragraph, .. }
		637	\| PageOp::List { paragraph, .. } => {
		638	require(self.kept(paragraph) && self.new_has(paragraph))?
		639	}
		640	PageOp::Tags { target, .. } => require(self.same_tags(*target))?,
		641	PageOp::Picture {
		642	picture: object, ..
		643	}
		644	\| PageOp::Attachment {
		645	attachment: object, ..
		646	}
		647	\| PageOp::Strokes { ink: object, .. } => {
		648	require(self.kept(object) && self.new_has(object))?
		649	}
		650	PageOp::Table { table, edit } => match edit {
		651	TableEdit::Cell { cell, .. } => require(self.kept(cell) && self.new_has(cell))?,
		652	TableEdit::DeleteRow(row) => require(self.kept(table) && self.untouched(row))?,
		653	TableEdit::DeleteColumn(_) => require(self.untouched(*table))?,
		654	TableEdit::Rows { .. }
		655	\| TableEdit::Column { .. }
		656	\| TableEdit::Columns(_)
		657	\| TableEdit::Borders(_) => require(self.kept(table) && self.new_has(table))?,
		658	},
270	}	659	}
		660	Ok(Some(op))
271	}	661	}
272	let mut order: BTreeMap<Option<ExGuid>, Vec<ExGuid>> = BTreeMap::new();	662
273	let containers: BTreeSet<Option<ExGuid>> = bc	663	/// Whether the remote put the object where a move places it: under `parent` (the page
274	.keys()	664	/// when `None`), before `before` or last.
275	.chain(oc.keys())	665	fn placed_at(&self, id: ExGuid, parent: Option<ExGuid>, before: Option<ExGuid>) -> bool {
276	.chain(tc.keys())	666	let Some(node) = self.new.nodes.get(&id) else {
277	.copied()	667	return false;
278	.collect();
279	for container in containers {
280	let live = \|ids: Option<&Vec<ExGuid>>\| -> Vec<ExGuid> {
281	ids.map(\|ids\| {
282	ids.iter()
283	.copied()
284	.filter(\|id\| merged.contains_key(id))
285	.collect()
286	})
287	.unwrap_or_default()
288	};	668	};
289	let (our_list, their_list) = (live(oc.get(&container)), live(tc.get(&container)));	669	let container = parent.unwrap_or(PAGE);
290	let of_base = \|ids: Option<&Vec<ExGuid>>\| -> Vec<ExGuid> {	670	let siblings = self.new.children(container);
291	ids.map(\|ids\| {	671	node.parent == container
292	ids.iter()	672	&& siblings
293	.copied()	673	.iter()
294	.filter(\|id\| b.contains_key(id))	674	.position(\|sibling\| *sibling == id)
295	.collect()	675	.is_some_and(\|at\| siblings.get(at + 1).copied() == before)
		676	}
		677
		678	/// Whether the remote kept a paragraph's, text's or table's tags.
		679	fn same_tags(&self, id: ExGuid) -> bool {
		680	if self.ours(id) {
		681	return true;
		682	}
		683	let tags = \|index: &Index\| {
		684	index.nodes.get(&id).map(\|node\| match &node.own {
		685	Own::Paragraph { tags, .. } \| Own::Table { tags, .. } => Some(tags.clone()),
		686	Own::Text(text) => Some(text.tags.clone()),
		687	_ => None,
296	})	688	})
297	.unwrap_or_default()
298	};	689	};
299	let (base_ids, our_ids, their_ids) = (	690	let before = tags(&self.old);
300	of_base(bc.get(&container)),	691	before.is_some() && before == tags(&self.new)
301	of_base(oc.get(&container)),	692	}
302	of_base(tc.get(&container)),	693
303	);	694	fn new_has(&self, id: ExGuid) -> bool {
304	let ours_moved = if our_ids == base_ids \|\| our_ids == their_ids {	695	self.ours(id) \|\| self.new.nodes.contains_key(&id)
305	BTreeSet::new()	696	}
306	} else {	697
307	moved(&base_ids, &our_ids)	698	/// The paragraph holding a text, as the base stored it.
		699	fn holder(&self, text: ExGuid) -> Option<ExGuid> {
		700	self.old.nodes.get(&text).map(\|node\| node.parent)
		701	}
		702
		703	fn holder_text(&self, paragraph: ExGuid) -> Option<ExGuid> {
		704	match self.old.nodes.get(&paragraph).map(\|node\| &node.own) {
		705	Some(Own::Paragraph { content, .. }) => Some(*content),
		706	_ => None,
		707	}
		708	}
		709
		710	/// Whether a split of the paragraph makes the same new paragraph on both sides: its
		711	/// container, style, format and children are as the base had them.
		712	fn splits_alike(&self, id: ExGuid) -> bool {
		713	if self.ours(id) {
		714	return true;
		715	}
		716	let shape = \|index: &Index\| {
		717	index.nodes.get(&id).map(\|node\| match &node.own {
		718	Own::Paragraph { style, format, .. } => {
		719	Some((node.parent, *style, format.clone(), node.children.clone()))
		720	}
		721	_ => None,
		722	})
308	};	723	};
309	// A paragraph we repositioned that the remote also moved, reparented or removed	724	let before = shape(&self.old);
310	// has two destinations; neither side's placement can be assumed.	725	before.is_some() && before == shape(&self.new)
311	let mut theirs_touched = moved(&base_ids, &their_ids);	726	}
312	theirs_touched.extend(base_ids.iter().filter(\|id\| !their_ids.contains(id)));	727	}
313	if ours_moved.iter().any(\|id\| theirs_touched.contains(id)) {	728
314	return None;	729	/// Where the remote replaced parts of a text, in order: each `start..end` of the text as
		730	/// the replayed edits see it holds what the remote replaced by `end - start + delta` UTF-16
		731	/// units. Outside them both texts hold the same characters in the same formats.
		732	#[derive(Debug, Clone, Default, PartialEq)]
		733	struct Changes(Vec<Region>);
		734
		735	#[derive(Debug, Clone, Copy, PartialEq)]
		736	struct Region {
		737	start: u32,
		738	end: u32,
		739	delta: i64,
		740	}
		741
		742	/// The characters of a text with their formats and UTF-16 widths.
		743	fn units(paragraph: &Paragraph) -> Vec<(char, Format)> {
		744	let mut out = Vec::new();
		745	let mut spans = paragraph.spans().iter();
		746	let mut span = spans.next();
		747	for (byte, character) in paragraph.text().char_indices() {
		748	while span.is_some_and(\|span\| span.end <= byte) {
		749	span = spans.next();
315	}	750	}
316	let mut list: Vec<ExGuid> = their_list.clone();	751	out.push((
317	list.retain(\|id\| merged[id].parent == container);	752	character,
318	// Paragraphs we repositioned, added or brought here follow their predecessor in our list.	753	span.map(\|span\| span.format.clone()).unwrap_or_default(),
319	for (at, id) in our_list.iter().enumerate() {	754	));
320	if merged[id].parent != container \|\| (list.contains(id) && !ours_moved.contains(id)) {	755	}
321	continue;	756	out
		757	}
		758
		759	/// Beyond this many cells of the alignment table the changed middle counts as one change.
		760	const CELLS: usize = 4_000_000;
		761
		762	impl Changes {
		763	/// The runs where `new` differs from `old` in characters or formats, from a longest
		764	/// common subsequence of the two: where several align equally, one is chosen, which
		765	/// places an op among repeated characters one way of the equally valid ones.
		766	fn between(old: &Paragraph, new: &Paragraph) -> Self {
		767	let (a, b) = (units(old), units(new));
		768	let prefix = a.iter().zip(&b).take_while(\|(x, y)\| x == y).count();
		769	let suffix = a[prefix..]
		770	.iter()
		771	.rev()
		772	.zip(b[prefix..].iter().rev())
		773	.take_while(\|(x, y)\| x == y)
		774	.count();
		775	let (x, y) = (&a[prefix..a.len() - suffix], &b[prefix..b.len() - suffix]);
		776	// Matched pairs of the middles, in order.
		777	let mut matched = Vec::new();
		778	if x.len().saturating_mul(y.len()) <= CELLS {
		779	let width = y.len() + 1;
		780	let mut table = vec![0_u32; (x.len() + 1) * width];
		781	for i in (0..x.len()).rev() {
		782	for j in (0..y.len()).rev() {
		783	table[i * width + j] = if x[i] == y[j] {
		784	table[(i + 1) * width + j + 1] + 1
		785	} else {
		786	table[(i + 1) * width + j].max(table[i * width + j + 1])
		787	};
		788	}
322	}	789	}
323	list.retain(\|other\| other != id);	790	let (mut i, mut j) = (0, 0);
324	let predecessor = our_list[..at]	791	while i < x.len() && j < y.len() {
		792	if x[i] == y[j] {
		793	matched.push((i, j));
		794	i += 1;
		795	j += 1;
		796	} else if table[(i + 1) * width + j] >= table[i * width + j + 1] {
		797	i += 1;
		798	} else {
		799	j += 1;
		800	}
		801	}
		802	}
		803	matched.push((x.len(), y.len()));
		804	let width = \|units: &[(char, Format)]\| -> u32 {
		805	units
325	.iter()	806	.iter()
326	.rev()	807	.map(\|(character, _)\| character.len_utf16() as u32)
327	.find(\|other\| list.contains(other));	808	.sum()
328	let position = predecessor.map_or(0, \|p\| list.iter().position(\|x\| x == p).unwrap() + 1);	809	};
329	list.insert(position, *id);	810	let mut regions = Vec::new();
		811	let (mut at, mut i, mut j) = (width(&a[..prefix]), 0, 0);
		812	for (k, l) in matched {
		813	if (k, l) != (i, j) {
		814	let (removed, inserted) = (width(&x[i..k]), width(&y[j..l]));
		815	regions.push(Region {
		816	start: at,
		817	end: at + removed,
		818	delta: i64::from(inserted) - i64::from(removed),
		819	});
		820	at += removed;
		821	}
		822	if k < x.len() {
		823	at += width(&x[k..k + 1]);
		824	}
		825	(i, j) = (k + 1, l + 1);
330	}	826	}
331	order.insert(container, list);	827	Self(regions)
332	}	828	}
333	let mut out = Vec::new();	829
334	let mut pending: Vec<ExGuid> = order.get(&None).cloned().unwrap_or_default();	830	/// The range on the remote text, when it lies clear of every change: a range may end
335	pending.reverse();	831	/// where a change starts or start where one ends, an insertion point may not.
336	while let Some(id) = pending.pop() {	832	fn map(&self, range: &Range<u32>) -> Option<Range<u32>> {
337	let paragraph = merged.remove(&id)?;	833	let empty = range.start == range.end;
338	out.push(paragraph);	834	let mut shift = 0;
339	if let Some(children) = order.get(&Some(id)) {	835	for region in &self.0 {
340	pending.extend(children.iter().rev().copied());	836	if range.end < region.start \|\| (!empty && range.end == region.start) {
		837	break;
		838	}
		839	if range.start > region.end \|\| (!empty && range.start == region.end) {
		840	shift += region.delta;
		841	} else {
		842	return None;
		843	}
		844	}
		845	let shifted = \|at: u32\| u32::try_from(i64::from(at) + shift).ok();
		846	Some(shifted(range.start)?..shifted(range.end)?)
		847	}
		848
		849	/// Follows a replacement of `range`, clear of every change, by `length` units.
		850	fn replaced(&mut self, range: &Range<u32>, length: u32) {
		851	let moved = i64::from(length) - i64::from(range.end - range.start);
		852	for region in &mut self.0 {
		853	if region.start >= range.end {
		854	region.start = (i64::from(region.start) + moved) as u32;
		855	region.end = (i64::from(region.end) + moved) as u32;
		856	}
341	}	857	}
342	}	858	}
343	if !merged.is_empty() {	859
344	return None;	860	/// Cuts the text at `at`, clear of every change, keeping the changes left of it (text
		861	/// typed at the cut included) and returning those right of it, measured from the cut.
		862	fn split(&mut self, at: u32) -> Self {
		863	let right = self
		864	.0
		865	.iter()
		866	.filter(\|region\| region.end > at)
		867	.map(\|region\| Region {
		868	start: region.start - at,
		869	end: region.end - at,
		870	delta: region.delta,
		871	})
		872	.collect();
		873	self.0.retain(\|region\| region.end <= at);
		874	Self(right)
345	}	875	}
346	Some(out)
347	}	876	}
348		877
349	/// The members of `list` outside a longest common subsequence with `base`: the paragraphs	878	/// What an object holds apart from the objects under it.
350	/// a reorder of the shared members had to move.	879	#[derive(Debug, Clone, PartialEq)]
351	fn moved(base: &[ExGuid], list: &[ExGuid]) -> BTreeSet<ExGuid> {	880	enum Own {
352	let a: Vec<ExGuid> = base	881	Outline {
353	.iter()	882	title: bool,
354	.copied()	883	min_width: Option<f32>,
355	.filter(\|id\| list.contains(id))	884	layout: Layout,
356	.collect();	885	indents: Vec<f32>,
357	let b: Vec<ExGuid> = list	886	unsupported: Vec<Unsupported>,
358	.iter()	887	},
359	.copied()	888	Title {
360	.filter(\|id\| base.contains(id))	889	date: Option<ExGuid>,
361	.collect();	890	layout: Layout,
362	let mut table = vec![vec![0usize; b.len() + 1]; a.len() + 1];	891	},
363	for i in (0..a.len()).rev() {	892	Paragraph {
364	for j in (0..b.len()).rev() {	893	level: u32,
365	table[i][j] = if a[i] == b[j] {	894	style: Option<ExGuid>,
366	table[i + 1][j + 1] + 1	895	format: Format,
367	} else {	896	lists: Vec<ExGuid>,
368	table[i + 1][j].max(table[i][j + 1])	897	tags: Vec<Tag>,
369	};	898	media: MediaIndex,
		899	collapsed: bool,
		900	content: ExGuid,
		901	},
		902	Text(TextObject),
		903	Table {
		904	columns: Vec<TableColumn>,
		905	borders: Option<bool>,
		906	layout: Layout,
		907	tags: Vec<Tag>,
		908	},
		909	Row,
		910	Cell {
		911	layout: Layout,
		912	indents: Vec<f32>,
		913	shading: Option<u32>,
		914	unsupported: Vec<Unsupported>,
		915	},
		916	Image(Image),
		917	Attachment(Attachment),
		918	Ink(Ink),
		919	Unsupported(Unsupported),
		920	}
		921
		922	#[derive(Debug)]
		923	struct Node {
		924	own: Own,
		925	/// The containing object; the page is the default identity.
		926	parent: ExGuid,
		927	children: Vec<ExGuid>,
		928	}
		929
		930	impl Node {
		931	/// Everything directly under the object, a paragraph's content included.
		932	fn below(&self) -> impl Iterator<Item = ExGuid> + '_ {
		933	let content = match &self.own {
		934	Own::Paragraph { content, .. } => Some(*content),
		935	_ => None,
		936	};
		937	content.into_iter().chain(self.children.iter().copied())
		938	}
		939	}
		940
		941	#[derive(Default)]
		942	struct Index {
		943	nodes: BTreeMap<ExGuid, Node>,
		944	page: Vec<ExGuid>,
		945	}
		946
		947	const PAGE: ExGuid = ExGuid {
		948	guid: [0; 16],
		949	n: 0,
		950	};
		951
		952	impl Index {
		953	fn of(page: &Page) -> Self {
		954	let mut index = Self::default();
		955	for object in &page.objects {
		956	index.page.push(object.id());
		957	match object {
		958	PageObject::Outline(outline) => index.outline(outline, PAGE),
		959	PageObject::Title(title) => {
		960	index.add(
		961	title.id,
		962	PAGE,
		963	Own::Title {
		964	date: title.date,
		965	layout: title.layout.clone(),
		966	},
		967	title.outlines.iter().map(\|outline\| outline.id).collect(),
		968	);
		969	for outline in &title.outlines {
		970	index.outline(outline, title.id);
		971	}
		972	}
		973	PageObject::Image(image) => {
		974	index.add(image.id, PAGE, Own::Image(image.clone()), Vec::new())
		975	}
		976	PageObject::Ink(ink) => index.add(ink.id, PAGE, Own::Ink(ink.clone()), Vec::new()),
		977	PageObject::Unsupported(object) => index.add(
		978	object.id,
		979	PAGE,
		980	Own::Unsupported(object.clone()),
		981	Vec::new(),
		982	),
		983	}
370	}	984	}
		985	index
371	}	986	}
372	let mut kept = BTreeSet::new();	987
373	let (mut i, mut j) = (0, 0);	988	fn children(&self, id: ExGuid) -> &[ExGuid] {
374	while i < a.len() && j < b.len() {	989	if id == PAGE {
375	if a[i] == b[j] {	990	&self.page
376	kept.insert(a[i]);
377	i += 1;
378	j += 1;
379	} else if table[i + 1][j] >= table[i][j + 1] {
380	i += 1;
381	} else {	991	} else {
382	j += 1;	992	self.nodes.get(&id).map_or(&[], \|node\| &node.children)
383	}	993	}
384	}	994	}
385	b.into_iter().filter(\|id\| !kept.contains(id)).collect()
386	}
387		995
388	fn merge_paragraph(	996	fn add(&mut self, id: ExGuid, parent: ExGuid, own: Own, children: Vec<ExGuid>) {
389	base: &PageParagraph,	997	self.nodes.insert(
390	ours: &PageParagraph,	998	id,
391	theirs: &PageParagraph,	999	Node {
392	) -> Option<PageParagraph> {	1000	own,
393	let lists = pick(&base.lists, &ours.lists, &theirs.lists)?;	1001	parent,
394	let tags = pick(&base.tags, &ours.tags, &theirs.tags)?;	1002	children,
395	let style = pick(&base.style, &ours.style, &theirs.style)?;	1003	},
396	let format = pick(&base.format, &ours.format, &theirs.format)?;	1004	);
397	let (parent, level) = pick(	1005	}
398	&(base.parent, base.level),
399	&(ours.parent, ours.level),
400	&(theirs.parent, theirs.level),
401	)?;
402	let collapsed = pick(&base.collapsed, &ours.collapsed, &theirs.collapsed)?;
403	let content = match pick(&base.content, &ours.content, &theirs.content) {
404	Some(picked) => picked,
405	None => match (&base.content, &ours.content, &theirs.content) {
406	(ParagraphContent::Text(x), ParagraphContent::Text(y), ParagraphContent::Text(z))
407	if x.id == y.id && x.id == z.id =>
408	{
409	let mut text = z.clone();
410	text.date_field = pick(&x.date_field, &y.date_field, &z.date_field)?;
411	text.tags = pick(&x.tags, &y.tags, &z.tags)?;
412	text.text = merge_text(&x.text, &y.text, &z.text)?;
413	ParagraphContent::Text(text)
414	}
415	_ => return None,
416	},
417	};
418	Some(PageParagraph {
419	id: theirs.id,
420	parent,
421	level,
422	style,
423	format,
424	content,
425	lists,
426	tags,
427	media: pick(&base.media, &ours.media, &theirs.media)?,
428	collapsed,
429	})
430	}
431		1006
432	/// Re-applies our replacement inside the remote text when its range maps unambiguously.	1007	fn outline(&mut self, outline: &Outline, parent: ExGuid) {
433	fn merge_text(	1008	let children = self.paragraphs(&outline.paragraphs, outline.id);
434	base: &onestore::page::Paragraph,	1009	self.add(
435	ours: &onestore::page::Paragraph,	1010	outline.id,
436	theirs: &onestore::page::Paragraph,	1011	parent,
437	) -> Option<onestore::page::Paragraph> {	1012	Own::Outline {
438	if let Some(picked) = pick(base, ours, theirs) {	1013	title: outline.title,
439	return Some(picked);	1014	min_width: outline.min_width,
440	}	1015	layout: outline.layout.clone(),
441	if base.text() == ours.text() {	1016	indents: outline.indents.clone(),
442	// A local formatting-only change cannot be attributed to a range of the remote text.	1017	unsupported: outline.unsupported.clone(),
443	return None;	1018	},
444	}	1019	children,
445	let (b, o) = (base.text(), ours.text());	1020	);
446	let prefix = b	1021	}
447	.char_indices()	1022
448	.zip(o.chars())	1023	/// Indexes a flat paragraph list; returns the container's direct children.
449	.take_while(\|((_, x), y)\| x == y)	1024	fn paragraphs(&mut self, list: &[PageParagraph], container: ExGuid) -> Vec<ExGuid> {
450	.map(\|((i, x), _)\| i + x.len_utf8())	1025	let mut children: BTreeMap<ExGuid, Vec<ExGuid>> = BTreeMap::new();
451	.last()	1026	for paragraph in list {
452	.unwrap_or(0);	1027	children
453	let suffix = b[prefix..]	1028	.entry(paragraph.parent.unwrap_or(container))
454	.chars()	1029	.or_default()
455	.rev()	1030	.push(paragraph.id);
456	.zip(o[prefix..].chars().rev())	1031	}
457	.take_while(\|(x, y)\| x == y)	1032	for paragraph in list {
458	.map(\|(x, _)\| x.len_utf8())	1033	let content = match &paragraph.content {
459	.sum::<usize>();	1034	ParagraphContent::Text(text) => {
460	let start = base.utf16_offset(prefix).ok()?;	1035	self.add(text.id, paragraph.id, Own::Text(text.clone()), Vec::new());
461	let end = base.utf16_offset(b.len() - suffix).ok()?;	1036	text.id
462	let inserted = ours.utf16_offset(o.len() - suffix).ok()?;	1037	}
463	let replacement = ours.slice(start..inserted).ok()?;	1038	ParagraphContent::Table(table) => {
464	let our_end = ours.utf16_offset(o.len()).ok()?;	1039	let rows = table.rows.iter().map(\|row\| row.id).collect();
465	let base_end = base.utf16_offset(b.len()).ok()?;	1040	for row in &table.rows {
466	if (start > 0 && ours.slice(0..start).ok()? != base.slice(0..start).ok()?)	1041	let cells = row.cells.iter().map(\|cell\| cell.id).collect();
467	\|\| (end < base_end	1042	for cell in &row.cells {
468	&& ours.slice(inserted..our_end).ok()? != base.slice(end..base_end).ok()?)	1043	let children = self.paragraphs(&cell.paragraphs, cell.id);
469	{	1044	self.add(
470	// Formatting changed outside the replaced range; the remote text would hide it.	1045	cell.id,
471	return None;	1046	row.id,
472	}	1047	Own::Cell {
473	let mapped = crate::rebase::rebase(b, theirs.text(), start..end)?;	1048	layout: cell.layout.clone(),
474	// Text they reformatted is not ours to replace, nor to move as a split would.	1049	indents: cell.indents.clone(),
475	if start < end && theirs.slice(mapped.clone()).ok()? != base.slice(start..end).ok()? {	1050	shading: cell.shading,
476	return None;	1051	unsupported: cell.unsupported.clone(),
477	}	1052	},
478	let mut merged = theirs.clone();	1053	children,
479	merged	1054	);
480	.apply(Edit {	1055	}
481	range: mapped,	1056	self.add(row.id, table.id, Own::Row, cells);
482	replacement,	1057	}
483	})	1058	self.add(
484	.ok()?;	1059	table.id,
485	Some(merged)	1060	paragraph.id,
		1061	Own::Table {
		1062	columns: table.columns.clone(),
		1063	borders: table.borders,
		1064	layout: table.layout.clone(),
		1065	tags: table.tags.clone(),
		1066	},
		1067	rows,
		1068	);
		1069	table.id
		1070	}
		1071	ParagraphContent::Image(image) => {
		1072	self.add(
		1073	image.id,
		1074	paragraph.id,
		1075	Own::Image(image.clone()),
		1076	Vec::new(),
		1077	);
		1078	image.id
		1079	}
		1080	ParagraphContent::Attachment(attachment) => {
		1081	self.add(
		1082	attachment.id,
		1083	paragraph.id,
		1084	Own::Attachment(attachment.clone()),
		1085	Vec::new(),
		1086	);
		1087	attachment.id
		1088	}
		1089	ParagraphContent::Ink(ink) => {
		1090	self.add(ink.id, paragraph.id, Own::Ink(ink.clone()), Vec::new());
		1091	ink.id
		1092	}
		1093	ParagraphContent::Unsupported(object) => {
		1094	self.add(
		1095	object.id,
		1096	paragraph.id,
		1097	Own::Unsupported(object.clone()),
		1098	Vec::new(),
		1099	);
		1100	object.id
		1101	}
		1102	};
		1103	self.add(
		1104	paragraph.id,
		1105	paragraph.parent.unwrap_or(container),
		1106	Own::Paragraph {
		1107	level: paragraph.level,
		1108	style: paragraph.style,
		1109	format: paragraph.format.clone(),
		1110	lists: paragraph.lists.clone(),
		1111	tags: paragraph.tags.clone(),
		1112	media: paragraph.media.clone(),
		1113	collapsed: paragraph.collapsed,
		1114	content,
		1115	},
		1116	children.remove(&paragraph.id).unwrap_or_default(),
		1117	);
		1118	}
		1119	children.remove(&container).unwrap_or_default()
		1120	}
486	}	1121	}
487		1122
488	#[cfg(test)]	1123	#[cfg(test)]
489	mod tests {	1124	mod tests {
490	use super::*;	1125	use super::*;
491	use onestore::page::Paragraph;
492		1126
493	fn text(s: &str) -> Paragraph {	1127	fn text(s: &str) -> Paragraph {
494	Paragraph::new(s.into(), Default::default())	1128	Paragraph::new(s.into(), Format::default())
495	}	1129	}
496		1130
497	#[test]	1131	#[test]
498	fn same_paragraph_edits_merge_when_their_ranges_do_not_overlap() {	1132	fn ranges_clear_of_the_remote_changes_shift_past_them() {
499	let base = text("one two three");	1133	let region = \|start, end, delta\| Region { start, end, delta };
500	let ours = text("one two three four");	1134	let changes = Changes::between(&text("one two three"), &text("one 2 three"));
501	assert_eq!(	1135	assert_eq!(changes.0, [region(4, 7, -2)]);
502	merge_text(&base, &ours, &text("zero one two three"))	1136	assert_eq!(changes.map(&(0..3)), Some(0..3));
503	.unwrap()	1137	assert_eq!(changes.map(&(0..4)), Some(0..4));
504	.text(),	1138	assert_eq!(changes.map(&(8..13)), Some(6..11));
505	"zero one two three four"	1139	assert_eq!(changes.map(&(7..8)), Some(5..6));
506	);	1140	assert_eq!(changes.map(&(13..13)), Some(11..11));
507	assert_eq!(	1141	assert_eq!(changes.map(&(4..4)), None);
508	merge_text(&base, &ours, &text("one 2 three"))	1142	assert_eq!(changes.map(&(7..7)), None);
509	.unwrap()	1143	assert_eq!(changes.map(&(3..5)), None);
510	.text(),	1144	let mut moved = changes.clone();
511	"one 2 three four"	1145	moved.replaced(&(0..0), 5);
512	);	1146	assert_eq!(moved.0, [region(9, 12, -2)]);
513	assert_eq!(	1147	let both = Changes::between(&text("ab🦀cd"), &text("Xab🦀cYd"));
514	merge_text(&base, &text("one two THREE"), &text("one two 3")),	1148	assert_eq!(both.0, [region(0, 0, 1), region(5, 5, 1)]);
515	None	1149	assert_eq!(both.map(&(2..4)), Some(3..5));
516	);	1150	assert_eq!(both.map(&(1..1)), Some(2..2));
517	assert_eq!(	1151	assert_eq!(both.map(&(0..0)), None);
518	merge_text(&base, &text("one two three"), &text("x"))	1152	assert_eq!(both.map(&(3..6)), None);
519	.unwrap()	1153	let bold = Format {
520	.text(),
521	"x"
522	);
523	assert_eq!(
524	merge_text(&base, &text("y"), &text("one two three"))
525	.unwrap()
526	.text(),
527	"y"
528	);
529	let bold = onestore::document::Format {
530	bold: Some(true),	1154	bold: Some(true),
531	..Default::default()	1155	..Default::default()
532	};	1156	};
533	let remote = Paragraph::new("one two three".into(), bold);	1157	let formatted = Changes::between(
534	let merged = merge_text(&base, &text("one two three four"), &remote).unwrap();	1158	&text("abc"),
535	assert_eq!(merged.text(), "one two three four");	1159	&Paragraph::from_runs([
536	assert_eq!(merged.format_at(0).unwrap(), remote.format_at(0).unwrap());	1160	("a".to_owned(), Format::default()),
537	assert_eq!(	1161	("b".to_owned(), bold),
538	merge_text(&base, &remote, &text("one two three four")),	1162	("c".to_owned(), Format::default()),
539	None	1163	]),
540	);
541	assert_eq!(
542	merge_text(&base, &text("one two"), &text("X one two three"))
543	.unwrap()
544	.text(),
545	"X one two"
546	);	1164	);
		1165	assert_eq!(formatted.0, [region(1, 2, 0)]);
		1166	let emoji = Changes::between(&text("🦀a"), &text("🦀ab"));
		1167	assert_eq!(emoji.0, [region(3, 3, 1)]);
		1168	let mut cut = Changes::between(&text("abcdef"), &text("aXbcdeYf"));
		1169	assert_eq!(cut.map(&(3..4)), Some(4..5));
		1170	let right = cut.split(3);
547	assert_eq!(	1171	assert_eq!(
548	merge_text(&base, &text("two three"), &text("one two three!"))	1172	(cut.0, right.0),
549	.unwrap()	1173	(vec![region(1, 1, 1)], vec![region(2, 2, 1)])
550	.text(),
551	"two three!"
552	);	1174	);
		1175	let mut typed = Changes::between(&text("ab🦀cd"), &text("abX🦀cd"));
		1176	assert_eq!(typed.map(&(2..3)), Some(3..4));
		1177	assert!(typed.split(2).0.is_empty());
		1178	assert_eq!(typed.0, [region(2, 2, 1)]);
553	}	1179	}
554	}	1180	}

crates/notebook/src/migrate.rs created+303

...	@@ -0,0 +1,303 @@
1	//! Converts a schema-14 cache, whose queue holds whole-page edits over a working image,
2	//! to this schema's op queue. The cache is exported first; each queued page is lowered to
3	//! ops against the page the conversion has so far, and every converted page must equal
4	//! the page in the old working image, or nothing changes.
5
6	use crate::{Result, base, queue, schema};
7	use onestore::{
8	Arena, ExGuid, PageCreation, PageEdit, RevisionIndex, Section, Store,
9	document::Document,
10	op::{Edit, Op, SectionOp},
11	page::Page,
12	};
13	use rusqlite::{Connection, OptionalExtension, TransactionBehavior, params};
14	use std::{collections::BTreeMap, io, path::Path};
15
16	pub(crate) const VERSION: u32 = 14;
17
18	/// Schema 14's queued intents, as it serialized them.
19	#[derive(serde::Deserialize)]
20	#[serde(deny_unknown_fields)]
21	enum Operation {
22	Page(PageIntent),
23	CreatePage(PageCreation),
24	Pages(PageEdits),
25	DeletePages(Vec<ExGuid>),
26	}
27
28	#[derive(serde::Deserialize)]
29	#[serde(deny_unknown_fields)]
30	struct PageIntent {
31	#[allow(dead_code)]
32	before: Page,
33	after: Page,
34	author: String,
35	}
36
37	#[derive(serde::Deserialize)]
38	#[serde(deny_unknown_fields)]
39	struct PageEdits {
40	edits: Vec<PageEdit>,
41	#[allow(dead_code)]
42	observed: Vec<(ExGuid, u32)>,
43	}
44
45	fn invalid(message: String) -> crate::Error {
46	io::Error::new(io::ErrorKind::InvalidData, message).into()
47	}
48
49	/// Schema 14 stored the working image as its length and the runs where it differs from
50	/// the base.
51	fn working(mut base: Vec<u8>, patch: &[u8]) -> Result<Vec<u8>> {
52	let damaged = \|\| invalid("Damaged working image".into());
53	let Some((length, mut runs)) = patch.split_first_chunk::<8>() else {
54	return if patch.is_empty() {
55	Ok(base)
56	} else {
57	Err(damaged())
58	};
59	};
60	let length = usize::try_from(u64::from_le_bytes(*length))
61	.ok()
62	.filter(\|length\| *length <= base.len() + patch.len())
63	.ok_or_else(damaged)?;
64	base.resize(length, 0);
65	while let Some((header, rest)) = runs.split_first_chunk::<16>() {
66	let offset = usize::try_from(u64::from_le_bytes(header[..8].try_into().unwrap()))
67	.map_err(\|_\| damaged())?;
68	let size = usize::try_from(u64::from_le_bytes(header[8..].try_into().unwrap()))
69	.map_err(\|_\| damaged())?;
70	let (bytes, rest) = rest.split_at_checked(size).ok_or_else(damaged)?;
71	base.get_mut(offset..)
72	.and_then(\|target\| target.get_mut(..size))
73	.ok_or_else(damaged)?
74	.copy_from_slice(bytes);
75	runs = rest;
76	}
77	if runs.is_empty() {
78	Ok(base)
79	} else {
80	Err(damaged())
81	}
82	}
83
84	struct Converted {
85	id: i64,
86	author: String,
87	edit: Edit,
88	/// Schema 14's publication evidence, when this edit was attempted.
89	attempted: Option<String>,
90	conflict: Option<(i64, ExGuid)>,
91	}
92
93	pub(crate) fn migrate(connection: &mut Connection, path: &Path) -> Result<()> {
94	let mut archive = path.as_os_str().to_owned();
95	archive.push(".v14-recovery");
96	let archive = std::path::PathBuf::from(archive);
97	crate::recovery::export(connection, &archive, true)?;
98	let failed = \|error: crate::Error\| {
99	invalid(format!(
100	"The schema-14 cache could not be converted ({error}); it is unchanged and archived at {}",
101	archive.display()
102	))
103	};
104	let transaction = connection.transaction_with_behavior(TransactionBehavior::Exclusive)?;
105	convert(&transaction).map_err(failed)?;
106	transaction.commit()?;
107	Ok(())
108	}
109
110	fn convert(transaction: &rusqlite::Transaction<'_>) -> Result<()> {
111	let (base, patch): (Vec<u8>, Vec<u8>) =
112	transaction.query_row("SELECT base, working FROM replica WHERE id=1", [], \|row\| {
113	Ok((row.get(0)?, row.get(1)?))
114	})?;
115	let expected = working(base.clone(), &patch)?;
116	let attempt: Option<(i64, String)> = transaction
117	.query_row("SELECT edit_id, revisions FROM attempt", [], \|row\| {
118	Ok((row.get(0)?, row.get(1)?))
119	})
120	.optional()?;
121	let conflicts: BTreeMap<i64, i64> = transaction
122	.prepare("SELECT edit_id, kind FROM conflicts")?
123	.query_map([], \|row\| Ok((row.get(0)?, row.get(1)?)))?
124	.collect::<rusqlite::Result<_>>()?;
125	let queued: Vec<(i64, String, String)> = transaction
126	.prepare("SELECT id, space, operation FROM edits ORDER BY id")?
127	.query_map([], \|row\| Ok((row.get(0)?, row.get(1)?, row.get(2)?)))?
128	.collect::<rusqlite::Result<_>>()?;
129	let sequence: i64 = transaction.query_row(
130	"SELECT max(coalesce((SELECT seq FROM sqlite_sequence WHERE name='edits'), 0),
131	coalesce((SELECT max(edit_id) FROM receipts), 0),
132	coalesce((SELECT max(edit_id) FROM archived), 0))",
133	[],
134	\|row\| row.get(0),
135	)?;
136
137	let arena = Arena::default();
138	let mut section = Section::open(&arena, base.clone())?;
139	let at = crate::now();
140	let mut converted = Vec::new();
141	let mut sealed = None;
142	let mut edited = BTreeMap::new();
143	let (mut created, mut deleted) = (Vec::new(), Vec::new());
144	for (id, space, operation) in queued {
145	let space: ExGuid = space.parse()?;
146	let operation: Operation = serde_json::from_str(&operation)
147	.map_err(\|error\| invalid(format!("Queued edit {id} is unreadable: {error}")))?;
148	let (author, ops) = match operation {
149	Operation::Page(intent) => {
150	let current = section.page(space)?;
151	let ops = onestore::op::lower_page(&current, &intent.after)?;
152	edited.insert(space, id);
153	(
154	intent.author,
155	ops.into_iter().map(\|op\| Op::Page { space, op }).collect(),
156	)
157	}
158	Operation::CreatePage(creation) => {
159	created.push(creation.space());
160	(
161	String::new(),
162	vec![Op::Section(SectionOp::Create(creation))],
163	)
164	}
165	Operation::Pages(batch) => (
166	String::new(),
167	vec![Op::Section(SectionOp::Pages(batch.edits))],
168	),
169	Operation::DeletePages(pages) => {
170	deleted.extend(&pages);
171	(String::new(), vec![Op::Section(SectionOp::Delete(pages))])
172	}
173	};
174	let edit = Edit { at, ops };
175	section.apply(&author, &edit)?;
176	let attempted = attempt
177	.as_ref()
178	.filter(\|(edit, _)\| *edit == id)
179	.map(\|(_, revisions)\| revisions.clone());
180	if attempted.is_some() {
181	if !converted.is_empty() {
182	return Err(invalid(
183	"Only the oldest queued edit can hold an attempt".into(),
184	));
185	}
186	sealed = Some(section.seal()?);
187	}
188	// A conflicting page-list edit is the section's conflict, whichever page it names.
189	let conflicted = match edit.ops.first() {
190	Some(Op::Section(_)) => section.root(),
191	_ => space,
192	};
193	converted.push(Converted {
194	id,
195	author,
196	edit,
197	attempted,
198	conflict: conflicts.get(&id).map(\|kind\| (*kind, conflicted)),
199	});
200	}
201	let listed = \|image: &[u8]\| -> Result<Vec<ExGuid>> {
202	let store = Store::parse(image)?;
203	let index = RevisionIndex::parse(&store)?;
204	Ok(Document::parse(&index)?
205	.pages()?
206	.into_iter()
207	.map(\|(space, _)\| space)
208	.collect())
209	};
210	let based = listed(&base)?;
211	let listing: Vec<ExGuid> = section
212	.pages()?
213	.into_iter()
214	.map(\|(space, ..)\| space)
215	.collect();
216	let cached = listed(&expected)?;
217	// A page the remote added or removed while edits waited is in one list and not the
218	// other; one the queue created or deleted must agree.
219	let agree = cached
220	.iter()
221	.filter(\|space\| !listing.contains(space))
222	.all(\|space\| !based.contains(space) && !created.contains(space))
223	&& listing
224	.iter()
225	.filter(\|space\| !cached.contains(space))
226	.all(\|space\| based.contains(space) && !deleted.contains(space));
227	if !agree {
228	return Err(invalid(
229	"The converted page list differs from the cached one".into(),
230	));
231	}
232	verify(&mut section, &expected, &edited)?;
233
234	transaction.execute_batch(
235	"DROP TABLE replica; DROP TABLE attempt; DROP TABLE conflicts; DROP TABLE edits;",
236	)?;
237	transaction.execute_batch(schema::QUEUE)?;
238	base::write(transaction, base::Image::Base, &base)?;
239	let mut batch = None;
240	for edit in converted {
241	let current = match (batch, &edit.attempted) {
242	(Some(current), None) => current,
243	_ => {
244	transaction.execute("INSERT INTO batches DEFAULT VALUES", [])?;
245	transaction.last_insert_rowid()
246	}
247	};
248	if let Some(evidence) = &edit.attempted {
249	transaction.execute(
250	"UPDATE batches SET sealed=?1, revisions=?2, attempted=1 WHERE id=?3",
251	params![
252	serde_json::to_string(sealed.as_ref().unwrap()).map_err(io::Error::other)?,
253	evidence,
254	current
255	],
256	)?;
257	batch = None;
258	} else {
259	batch = Some(current);
260	}
261	if let Some((kind, space)) = edit.conflict {
262	transaction.execute(
263	"UPDATE batches SET conflict=?1, space=?2 WHERE id=?3",
264	params![kind, space.to_string(), current],
265	)?;
266	}
267	queue::insert(
268	transaction,
269	Some(crate::unsigned(edit.id)?),
270	current,
271	&edit.author,
272	&edit.edit,
273	)?;
274	}
275	transaction.execute("DELETE FROM sqlite_sequence WHERE name='edits'", [])?;
276	transaction.execute(
277	"INSERT INTO sqlite_sequence(name, seq) VALUES ('edits', ?1)",
278	[sequence],
279	)?;
280	transaction.pragma_update(None, "user_version", schema::VERSION)?;
281	Ok(())
282	}
283
284	/// Requires each page a queued page edit changed to read as the old working image has it.
285	fn verify(
286	section: &mut Section<'_>,
287	expected: &[u8],
288	edited: &BTreeMap<ExGuid, i64>,
289	) -> Result<()> {
290	let store = Store::parse(expected)?;
291	let index = RevisionIndex::parse(&store)?;
292	let document = Document::parse(&index)?;
293	for (space, id) in edited {
294	let converted = section.page(*space).ok();
295	let stored = Page::from_space(&document, *space).ok();
296	if converted != stored {
297	return Err(invalid(format!(
298	"Queued edit {id} converts to a page that differs from the cached page"
299	)));
300	}
301	}
302	Ok(())
303	}

crates/notebook/src/pages.rs deleted-168

...	@@ -1,168 +0,0 @@
1	use super::*;
2	use onestore::{PageEdit, PagePosition};
3	use serde::{Deserialize, Serialize};
4	use std::collections::BTreeMap;
5
6	type PageOrder = Vec<(ExGuid, u32)>;
7
8	/// An atomic page batch with its observed order and indentation.
9	#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
10	#[serde(deny_unknown_fields)]
11	pub struct PageEdits {
12	pub edits: Vec<PageEdit>,
13	observed: PageOrder,
14	}
15
16	fn observe(source: &[u8]) -> Result<Option<(ExGuid, PageOrder)>> {
17	let store = Store::parse(source)?;
18	let index = RevisionIndex::parse(&store)?;
19	let document = Document::parse(&index)?;
20	let mut pages = Vec::new();
21	for (sid, _) in document.pages()? {
22	let view = document.active(sid)?;
23	let Some(metadata) = view.roots.get(&2).and_then(\|id\| view.nodes.get(id)) else {
24	return Ok(None);
25	};
26	let Kind::Metadata { level, .. } = metadata.kind else {
27	return Ok(None);
28	};
29	pages.push((sid, level.unwrap_or(1)));
30	}
31	Ok(Some((document.root, pages)))
32	}
33
34	fn positions(pages: &[(ExGuid, u32)]) -> Result<BTreeMap<ExGuid, (usize, u32)>> {
35	let mut positions = BTreeMap::new();
36	for (at, (sid, level)) in pages.iter().enumerate() {
37	if sid.guid == [0; 16]
38	\|\| !(1..=3).contains(level)
39	\|\| positions.insert(sid, (at, level)).is_some()
40	{
41	return Err(io::Error::new(
42	io::ErrorKind::InvalidData,
43	"Page observations need unique identities and valid indentation",
44	)
45	.into());
46	}
47	}
48	Ok(positions)
49	}
50
51	impl Replica {
52	/// Durably queues the complete page batch using the supplied local snapshot.
53	pub fn pages(&self, source: &[u8], edits: &[PageEdit]) -> Result<Option<u64>> {
54	let (space, batch, prepared) = PageEdits::capture(source, edits)?;
55	self.record(source, space, Operation::Pages(batch), &prepared)
56	}
57	}
58
59	impl PageEdits {
60	fn capture<'a>(
61	source: &'a [u8],
62	edits: &[PageEdit],
63	) -> Result<(ExGuid, Self, PreparedEdit<'a>)> {
64	let prepared = PreparedEdit::pages(source, edits)?;
65	let (space, observed) = observe(source)?.ok_or_else(\|\| {
66	io::Error::new(
67	io::ErrorKind::InvalidData,
68	"Prepared page edits have no page metadata",
69	)
70	})?;
71	positions(&observed)?;
72	Ok((
73	space,
74	Self {
75	edits: edits.to_vec(),
76	observed,
77	},
78	prepared,
79	))
80	}
81
82	pub(crate) fn prepare<'a>(
83	&self,
84	source: &'a [u8],
85	space: ExGuid,
86	) -> Result<std::result::Result<PreparedEdit<'a>, ConflictKind>> {
87	let Some((root, current)) = observe(source)? else {
88	return Ok(Err(ConflictKind::TargetUnavailable));
89	};
90	if root != space {
91	return Ok(Err(ConflictKind::TargetUnavailable));
92	}
93	let before = positions(&self.observed)?;
94	let current = positions(&current)?;
95	for edit in &self.edits {
96	let Some((_, original_level)) = before.get(&edit.space()) else {
97	return Ok(Err(ConflictKind::TargetUnavailable));
98	};
99	let Some((_, current_level)) = current.get(&edit.space()) else {
100	return Ok(Err(ConflictKind::TargetUnavailable));
101	};
102	if current_level != original_level && *current_level != edit.level() {
103	return Ok(Err(ConflictKind::StructureChanged));
104	}
105	}
106	let prepared = match PreparedEdit::pages(source, &self.edits) {
107	Ok(prepared) => prepared,
108	Err(_) => return Ok(Err(ConflictKind::StructureChanged)),
109	};
110	let (_, wanted) = observe(prepared.as_bytes())?.ok_or_else(\|\| {
111	io::Error::new(
112	io::ErrorKind::InvalidData,
113	"Prepared page edits lost page metadata",
114	)
115	})?;
116	let wanted = positions(&wanted)?;
117	for edit in &self.edits {
118	if edit.position() == PagePosition::Keep {
119	continue;
120	}
121	let sid = edit.space();
122	let peers = before
123	.keys()
124	.filter(\|id\| **id != sid && current.contains_key(id));
125	let mut unchanged = true;
126	let mut satisfied = true;
127	for id in peers {
128	let observed = current[id].0 < current[&sid].0;
129	unchanged &= observed == (before[id].0 < before[&sid].0);
130	satisfied &= observed == (wanted[id].0 < wanted[&sid].0);
131	}
132	if !unchanged && !satisfied {
133	return Ok(Err(ConflictKind::StructureChanged));
134	}
135	}
136	Ok(Ok(prepared))
137	}
138
139	pub(crate) fn review(&self, source: &[u8], space: ExGuid, edits: &[PageEdit]) -> Result<Self> {
140	let identities_match = edits.len() == self.edits.len()
141	&& edits.iter().all(\|edit\| {
142	self.edits
143	.iter()
144	.find(\|original\| original.space() == edit.space())
145	.is_some_and(\|original\| {
146	original
147	.reposition(edit.position(), edit.level())
148	.is_ok_and(\|revised\| revised == *edit)
149	})
150	});
151	if !identities_match {
152	return Err(io::Error::new(
153	io::ErrorKind::InvalidInput,
154	"Retain the original page and series identities when reviewing a page batch",
155	)
156	.into());
157	}
158	let (root, reviewed, _) = Self::capture(source, edits)?;
159	if root != space {
160	return Err(io::Error::new(
161	io::ErrorKind::InvalidInput,
162	"Review the original section for page edits",
163	)
164	.into());
165	}
166	Ok(reviewed)
167	}
168	}

crates/notebook/src/queue.rs created+324

...	@@ -0,0 +1,324 @@
1	//! Edit rows. An edit is stored as its serialized ops with picture and attachment bytes
2	//! moved to the `payloads` table, named by SHA-256 in the order `slots` visits them.
3
4	use crate::{PendingEdit, Result, signed, unsigned};
5	use onestore::{
6	op::{Edit, Op, PageOp, SectionOp, TableEdit},
7	page::{PageObject, PageParagraph, ParagraphContent, TableCell},
8	};
9	use rusqlite::{Connection, OptionalExtension, params};
10	use sha2::{Digest, Sha256};
11	use std::{io, sync::Arc};
12
13	type Payload = Option<Arc<[u8]>>;
14
15	fn paragraphs(list: &mut [PageParagraph], visit: &mut impl FnMut(&mut Payload)) {
16	for paragraph in list {
17	match &mut paragraph.content {
18	ParagraphContent::Image(image) => visit(&mut image.bytes),
19	ParagraphContent::Attachment(attachment) => {
20	visit(&mut attachment.bytes);
21	visit(&mut attachment.preview);
22	}
23	ParagraphContent::Table(table) => {
24	for row in &mut table.rows {
25	cells(&mut row.cells, visit);
26	}
27	}
28	ParagraphContent::Text(_)
29	\| ParagraphContent::Ink(_)
30	\| ParagraphContent::Unsupported(_) => {}
31	}
32	}
33	}
34
35	fn cells(list: &mut [TableCell], visit: &mut impl FnMut(&mut Payload)) {
36	for cell in list {
37	paragraphs(&mut cell.paragraphs, visit);
38	}
39	}
40
41	fn object(object: &mut PageObject, visit: &mut impl FnMut(&mut Payload)) {
42	match object {
43	PageObject::Outline(outline) => paragraphs(&mut outline.paragraphs, visit),
44	PageObject::Title(title) => {
45	for outline in &mut title.outlines {
46	paragraphs(&mut outline.paragraphs, visit);
47	}
48	}
49	PageObject::Image(image) => visit(&mut image.bytes),
50	PageObject::Ink(_) \| PageObject::Unsupported(_) => {}
51	}
52	}
53
54	/// Visits every payload an edit carries, in a fixed order.
55	fn slots(edit: &mut Edit, mut visit: impl FnMut(&mut Payload)) {
56	for op in &mut edit.ops {
57	match op {
58	Op::Page { op, .. } => match op {
59	PageOp::Insert {
60	paragraphs: list, ..
61	} => paragraphs(list, &mut visit),
62	PageOp::Add { object: added, .. } => object(added, &mut visit),
63	PageOp::Table {
64	edit: TableEdit::Rows { rows, .. },
65	..
66	} => {
67	for row in rows {
68	cells(&mut row.cells, &mut visit);
69	}
70	}
71	PageOp::Table {
72	edit: TableEdit::Column { cells: list, .. },
73	..
74	} => cells(list, &mut visit),
75	_ => {}
76	},
77	Op::Section(SectionOp::Import { page, .. }) => {
78	for added in &mut page.objects {
79	object(added, &mut visit);
80	}
81	}
82	Op::Section(_) => {}
83	}
84	}
85	}
86
87	fn damaged(message: &'static str) -> crate::Error {
88	io::Error::new(io::ErrorKind::InvalidData, message).into()
89	}
90
91	/// Stores `edit` in `batch` under `id`, or the next id, its payloads once each by hash;
92	/// returns the edit's id.
93	pub(crate) fn insert(
94	connection: &Connection,
95	id: Option<u64>,
96	batch: i64,
97	author: &str,
98	edit: &Edit,
99	) -> Result<u64> {
100	let (text, names) = encode(connection, edit)?;
101	connection.execute(
102	"INSERT INTO edits(id, batch, author, edit, payloads) VALUES (?1, ?2, ?3, ?4, ?5)",
103	params![id.map(signed).transpose()?, batch, author, text, names],
104	)?;
105	unsigned(connection.last_insert_rowid())
106	}
107
108	fn hex(digest: &[u8]) -> String {
109	digest.iter().map(\|byte\| format!("{byte:02x}")).collect()
110	}
111
112	/// Replaces a stored edit's ops.
113	pub(crate) fn rewrite(connection: &Connection, id: u64, edit: &Edit) -> Result<()> {
114	let (text, names) = encode(connection, edit)?;
115	connection.execute(
116	"UPDATE edits SET edit=?1, payloads=?2 WHERE id=?3",
117	params![text, names, signed(id)?],
118	)?;
119	Ok(())
120	}
121
122	/// The serialized edit without payload bytes and the payload names, storing the payloads.
123	fn encode(connection: &Connection, edit: &Edit) -> Result<(String, Option<String>)> {
124	let mut edit = edit.clone();
125	let mut names: Vec<Option<String>> = Vec::new();
126	let mut failure = None;
127	slots(&mut edit, \|payload\| {
128	let name = payload.take().map(\|bytes\| {
129	let digest = Sha256::digest(&bytes);
130	if let Err(error) = connection.execute(
131	"INSERT INTO payloads(sha256, bytes) VALUES (?1, ?2) ON CONFLICT DO NOTHING",
132	params![&digest[..], &bytes[..]],
133	) {
134	failure.get_or_insert(error);
135	}
136	hex(&digest)
137	});
138	names.push(name);
139	});
140	if let Some(error) = failure {
141	return Err(error.into());
142	}
143	let names = names
144	.iter()
145	.any(Option::is_some)
146	.then(\|\| serde_json::to_string(&names))
147	.transpose()
148	.map_err(io::Error::other)?;
149	Ok((
150	serde_json::to_string(&edit).map_err(io::Error::other)?,
151	names,
152	))
153	}
154
155	fn decode(connection: &Connection, text: &str, names: Option<String>) -> Result<Edit> {
156	let mut edit: Edit = serde_json::from_str(text)
157	.map_err(\|error\| io::Error::new(io::ErrorKind::InvalidData, error))?;
158	let Some(names) = names else {
159	return Ok(edit);
160	};
161	let names: Vec<Option<String>> = serde_json::from_str(&names)
162	.map_err(\|error\| io::Error::new(io::ErrorKind::InvalidData, error))?;
163	let mut names = names.into_iter();
164	let mut failure: Option<crate::Error> = None;
165	let mut query =
166	connection.prepare_cached("SELECT bytes FROM payloads WHERE sha256=unhex(?1)")?;
167	slots(&mut edit, \|payload\| {
168	let Some(name) = names.next() else {
169	failure.get_or_insert(damaged("A queued edit names fewer payloads than it holds"));
170	return;
171	};
172	let Some(name) = name else {
173	return;
174	};
175	match query
176	.query_row([&name], \|row\| row.get::<_, Vec<u8>>(0))
177	.optional()
178	{
179	Ok(Some(bytes)) if hex(&Sha256::digest(&bytes)) == name => {
180	*payload = Some(Arc::from(bytes));
181	}
182	Ok(_) => {
183	failure.get_or_insert(damaged("A queued payload is missing or damaged"));
184	}
185	Err(error) => {
186	failure.get_or_insert(error.into());
187	}
188	}
189	});
190	if names.next().is_some() {
191	failure.get_or_insert(damaged("A queued edit names more payloads than it holds"));
192	}
193	match failure {
194	Some(error) => Err(error),
195	None => Ok(edit),
196	}
197	}
198
199	/// Queued edits, oldest first; of one batch when `batch` is given.
200	pub(crate) fn load(connection: &Connection, batch: Option<i64>) -> Result<Vec<PendingEdit>> {
201	let mut query = connection.prepare_cached(
202	"SELECT id, author, edit, payloads FROM edits WHERE ?1 IS NULL OR batch=?1 ORDER BY id",
203	)?;
204	let mut rows = query.query([batch])?;
205	let mut edits = Vec::new();
206	while let Some(row) = rows.next()? {
207	edits.push(PendingEdit {
208	id: unsigned(row.get(0)?)?,
209	author: row.get(1)?,
210	edit: decode(connection, &row.get::<_, String>(2)?, row.get(3)?)?,
211	});
212	}
213	Ok(edits)
214	}
215
216	/// Drops payloads no queued edit names.
217	pub(crate) fn collect(connection: &Connection) -> Result<()> {
218	connection.execute(
219	"DELETE FROM payloads WHERE NOT EXISTS (SELECT 1 FROM edits, json_each(edits.payloads) AS name
220	WHERE edits.payloads IS NOT NULL AND name.value=lower(hex(payloads.sha256)))",
221	[],
222	)?;
223	Ok(())
224	}
225
226	/// The object spaces an edit changes; section ops change the root space as well.
227	pub(crate) fn spaces(edit: &Edit, root: onestore::ExGuid) -> Vec<onestore::ExGuid> {
228	let mut spaces = Vec::new();
229	for op in &edit.ops {
230	match op {
231	Op::Page { space, .. } => spaces.push(*space),
232	Op::Section(op) => {
233	spaces.push(root);
234	match op {
235	SectionOp::Create(creation) \| SectionOp::Import { creation, .. } => {
236	spaces.push(creation.space());
237	}
238	SectionOp::Pages(edits) => spaces.extend(edits.iter().map(\|edit\| edit.space())),
239	SectionOp::Delete(pages) => spaces.extend(pages),
240	}
241	}
242	}
243	}
244	spaces.sort();
245	spaces.dedup();
246	spaces
247	}
248
249	#[cfg(test)]
250	mod tests {
251	use super::*;
252	use onestore::{ExGuid, page::Image};
253
254	#[test]
255	fn payloads_are_stored_once_by_hash_and_restored_in_place() {
256	let connection = Connection::open_in_memory().unwrap();
257	connection.execute_batch(crate::schema::QUEUE).unwrap();
258	connection
259	.execute("INSERT INTO batches DEFAULT VALUES", [])
260	.unwrap();
261	let bytes: Arc<[u8]> = Arc::from(vec![7_u8; 100_000]);
262	let image = \|id: u32\| {
263	PageObject::Image(Image {
264	id: ExGuid {
265	guid: [1; 16],
266	n: id,
267	},
268	layout: Default::default(),
269	size: None,
270	bytes: Some(Arc::clone(&bytes)),
271	alt: None,
272	background: false,
273	})
274	};
275	let space = ExGuid {
276	guid: [2; 16],
277	n: 1,
278	};
279	let edit = Edit {
280	at: 1,
281	ops: [image(1), image(2)]
282	.into_iter()
283	.map(\|object\| Op::Page {
284	space,
285	op: PageOp::Add {
286	object,
287	before: None,
288	},
289	})
290	.collect(),
291	};
292	let id = insert(&connection, None, 1, "Author", &edit).unwrap();
293	let stored: String = connection
294	.query_row("SELECT edit FROM edits WHERE id=?1", [id as i64], \|row\| {
295	row.get(0)
296	})
297	.unwrap();
298	assert!(stored.len() < 1000, "{}", stored.len());
299	let payloads: i64 = connection
300	.query_row("SELECT count(*) FROM payloads", [], \|row\| row.get(0))
301	.unwrap();
302	assert_eq!(payloads, 1);
303	let loaded = load(&connection, None).unwrap();
304	assert_eq!(loaded[0].edit, edit);
305	let Op::Page {
306	op:
307	PageOp::Add {
308	object: PageObject::Image(image),
309	..
310	},
311	..
312	} = &loaded[0].edit.ops[1]
313	else {
314	panic!()
315	};
316	assert_eq!(image.bytes.as_deref(), Some(&bytes[..]));
317	connection.execute("DELETE FROM edits", []).unwrap();
318	collect(&connection).unwrap();
319	let payloads: i64 = connection
320	.query_row("SELECT count(*) FROM payloads", [], \|row\| row.get(0))
321	.unwrap();
322	assert_eq!(payloads, 0);
323	}
324	}

crates/notebook/src/rebase.rs deleted-297

...	@@ -1,297 +0,0 @@
1	use std::ops::Range;
2
3	const INFINITY: u32 = 1 << 30;
4	const MAX_CELLS: usize = 4_000_000;
5
6	struct Matrix {
7	band: usize,
8	values: Vec<u32>,
9	}
10
11	impl Matrix {
12	fn get(&self, row: usize, column: usize) -> u32 {
13	let Some(column) = column
14	.checked_add(self.band)
15	.and_then(\|at\| at.checked_sub(row))
16	else {
17	return INFINITY;
18	};
19	let width = self.band * 2 + 1;
20	if column >= width {
21	return INFINITY;
22	}
23	self.values
24	.get(row * width + column)
25	.copied()
26	.unwrap_or(INFINITY)
27	}
28
29	fn build(before: &[char], after: &[char], band: usize) -> Self {
30	let width = band * 2 + 1;
31	let mut matrix = Self {
32	band,
33	values: vec![INFINITY; (before.len() + 1) * width],
34	};
35	for row in 0..=before.len() {
36	for column in row.saturating_sub(band)..=after.len().min(row + band) {
37	let mut cost = if row == 0 && column == 0 { 0 } else { INFINITY };
38	if row > 0 {
39	cost = cost.min(matrix.get(row - 1, column) + 1);
40	}
41	if column > 0 {
42	cost = cost.min(matrix.get(row, column - 1) + 1);
43	}
44	if row > 0 && column > 0 && before[row - 1] == after[column - 1] {
45	cost = cost.min(matrix.get(row - 1, column - 1));
46	}
47	matrix.values[row * width + column + band - row] = cost;
48	}
49	}
50	matrix
51	}
52	}
53
54	/// Requires the same mapping in every minimum insertion/deletion alignment.
55	pub(crate) fn rebase(before: &str, after: &str, range: Range<u32>) -> Option<Range<u32>> {
56	if range.start > range.end {
57	return None;
58	}
59	let mut a: Vec<_> = before.chars().collect();
60	let offsets: Vec<_> = std::iter::once(0)
61	.chain(a.iter().scan(0_u32, \|at, character\| {
62	*at = at.checked_add(character.len_utf16() as u32)?;
63	Some(*at)
64	}))
65	.collect();
66	let local =
67	offsets.binary_search(&range.start).ok()?..offsets.binary_search(&range.end).ok()?;
68	if before == after {
69	return Some(range);
70	}
71	let mut b: Vec<_> = after.chars().collect();
72	let (n, m) = (a.len(), b.len());
73	let mut band = n.abs_diff(m).max(1);
74	let forward = loop {
75	let width = band.checked_mul(2)?.checked_add(1)?;
76	if (n + 1).checked_mul(width)? > MAX_CELLS {
77	return None;
78	}
79	let matrix = Matrix::build(&a, &b, band);
80	if matrix.get(n, m) <= band as u32 {
81	break matrix;
82	}
83	band *= 2;
84	};
85	let distance = forward.get(n, m);
86	a.reverse();
87	b.reverse();
88	let backward = Matrix::build(&a, &b, band);
89	a.reverse();
90	b.reverse();
91	let position = \|index: usize\| {
92	let mut matched = None;
93	for column in index.saturating_sub(band)..=m.min(index + band) {
94	let cost = forward.get(index, column);
95	if cost + 1 + backward.get(n - index - 1, m - column) == distance {
96	return None;
97	}
98	if b.get(column) == Some(&a[index])
99	&& cost + backward.get(n - index - 1, m - column - 1) == distance
100	{
101	if matched.is_some() {
102	return None;
103	}
104	matched = Some(column);
105	}
106	}
107	matched
108	};
109	let mapped = if local.is_empty() {
110	if local.start > 0 {
111	position(local.start - 1)?;
112	}
113	if local.start < n {
114	position(local.start)?;
115	}
116	let mut boundary = None;
117	for column in local.start.saturating_sub(band)..=m.min(local.start + band) {
118	if forward.get(local.start, column) + backward.get(n - local.start, m - column)
119	== distance
120	{
121	if boundary.is_some() {
122	return None;
123	}
124	boundary = Some(column);
125	}
126	}
127	let at = boundary?;
128	at..at
129	} else {
130	let start = position(local.start)?;
131	for index in local.start + 1..local.end {
132	if position(index)? != start + index - local.start {
133	return None;
134	}
135	}
136	start..start + local.len()
137	};
138	let start = b[..mapped.start]
139	.iter()
140	.map(\|character\| character.len_utf16())
141	.sum::<usize>();
142	let end = start
143	+ b[mapped]
144	.iter()
145	.map(\|character\| character.len_utf16())
146	.sum::<usize>();
147	Some(u32::try_from(start).ok()?..u32::try_from(end).ok()?)
148	}
149
150	#[cfg(test)]
151	mod tests {
152	use super::*;
153
154	fn optimal_paths(a: &[char], b: &[char]) -> Vec<Vec<(usize, usize)>> {
155	fn visit(
156	a: &[char],
157	b: &[char],
158	path: &mut Vec<(usize, usize)>,
159	cost: usize,
160	best: &mut usize,
161	found: &mut Vec<Vec<(usize, usize)>>,
162	) {
163	if cost > *best {
164	return;
165	}
166	let (i, j) = *path.last().unwrap();
167	if (i, j) == (a.len(), b.len()) {
168	if cost < *best {
169	found.clear();
170	*best = cost;
171	}
172	found.push(path.clone());
173	return;
174	}
175	for (next_i, next_j, charge) in [(i + 1, j + 1, 0), (i + 1, j, 1), (i, j + 1, 1)] {
176	if next_i > a.len() \|\| next_j > b.len() \|\| (charge == 0 && a[i] != b[j]) {
177	continue;
178	}
179	path.push((next_i, next_j));
180	visit(a, b, path, cost + charge, best, found);
181	path.pop();
182	}
183	}
184	let mut found = Vec::new();
185	let mut best = usize::MAX;
186	visit(a, b, &mut vec![(0, 0)], 0, &mut best, &mut found);
187	found
188	}
189
190	#[test]
191	fn bounded_alignment_agrees_with_exhaustive_paths_for_every_small_unicode_edit() {
192	let mut words = vec![String::new()];
193	for length in 1..=4 {
194	for bits in 0..1 << length {
195	words.push(
196	(0..length)
197	.map(\|bit\| if bits & (1 << bit) == 0 { 'a' } else { '🦀' })
198	.collect(),
199	);
200	}
201	}
202	let mut cases = 0;
203	for before in &words {
204	let a: Vec<_> = before.chars().collect();
205	for after in &words {
206	let b: Vec<_> = after.chars().collect();
207	let paths = optimal_paths(&a, &b);
208	for start in 0..=a.len() {
209	for end in start..=a.len() {
210	let mut expected = None;
211	let mut valid = true;
212	for path in &paths {
213	let mapping: Vec<_> = (0..a.len())
214	.map(\|i\| {
215	path.windows(2).find_map(\|edge\| {
216	(edge[0].0 == i && edge[1] == (i + 1, edge[0].1 + 1))
217	.then_some(edge[0].1)
218	})
219	})
220	.collect();
221	let candidate = if start == end {
222	let vertices: Vec<_> = path
223	.iter()
224	.filter(\|(i, _)\| *i == start)
225	.map(\|(_, j)\| *j)
226	.collect();
227	if (start > 0 && mapping[start - 1].is_none())
228	\|\| (start < a.len() && mapping[start].is_none())
229	\|\| vertices.len() != 1
230	{
231	None
232	} else {
233	Some(vertices[0]..vertices[0])
234	}
235	} else if let Some(first) = mapping[start] {
236	(start..end)
237	.all(\|i\| mapping[i] == Some(first + i - start))
238	.then_some(first..first + end - start)
239	} else {
240	None
241	};
242	let Some(candidate) = candidate else {
243	valid = false;
244	break;
245	};
246	if expected.as_ref().is_some_and(\|old\| *old != candidate) {
247	valid = false;
248	break;
249	}
250	expected = Some(candidate);
251	}
252	let expected = if valid {
253	expected.map(\|range\| {
254	b[..range.start].iter().map(\|c\| c.len_utf16() as u32).sum()
255	..b[..range.end].iter().map(\|c\| c.len_utf16() as u32).sum()
256	})
257	} else {
258	None
259	};
260	let range = a[..start].iter().map(\|c\| c.len_utf16() as u32).sum()
261	..a[..end].iter().map(\|c\| c.len_utf16() as u32).sum();
262	assert_eq!(
263	rebase(before, after, range),
264	expected,
265	"{before:?} -> {after:?}, characters {start}..{end}"
266	);
267	cases += 1;
268	}
269	}
270	}
271	}
272	assert_eq!(cases, 10881);
273	}
274
275	#[test]
276	fn maps_disjoint_unicode_edits_and_rejects_ambiguous_or_overlapping_changes() {
277	assert_eq!(rebase("ab🦀cd", "Xab🦀cYd", 2..4), Some(3..5));
278	assert_eq!(rebase("abc", "XabcY", 1..2), Some(2..3));
279	assert_eq!(rebase("abc", "XabcY", 1..1), Some(2..2));
280	assert_eq!(rebase("abc", "abcX", 3..3), None);
281	assert_eq!(rebase("abc", "ac", 1..2), None);
282	assert_eq!(rebase("abc", "", 1..1), None);
283	assert_eq!(rebase("aaaa", "aaaaa", 1..2), None);
284	assert_eq!(rebase("ab🦀cd", "ab🦀cd", 3..4), None);
285	assert_eq!(rebase("abc", "abc", 4..4), None);
286	}
287
288	#[test]
289	fn long_paragraphs_with_small_remote_changes_use_a_narrow_band() {
290	let text = format!("{}🦀{}", "a".repeat(8192), "b".repeat(8192));
291	assert_eq!(
292	rebase(&text, &format!("X{text}Y"), 8192..8194),
293	Some(8193..8195)
294	);
295	assert_eq!(rebase(&"a".repeat(8192), &"b".repeat(8192), 1..2), None);
296	}
297	}

crates/notebook/src/recovery.rs+90-78

 @@ -11,7 +11,9 @@ pub struct RecoverySummary {
     pub conflicts: u64,
     pub uncertain_edits: u64,
     pub published_receipts: u64,
-    pub working_bytes: u64,
+    /// Bytes of the image the queued edits apply to.
+    pub base_bytes: u64,
+    /// Bytes of the observed remote image, while it is not the base.
     pub remote_bytes: u64,
     pub cached_assets: u64,
     pub cached_asset_bytes: u64,
 @@ -36,33 +38,48 @@ impl Recovery {
                 io::Error::new(io::ErrorKind::InvalidData, "Not a recovery archive").into(),
             );
         }
-        if version != SCHEMA_VERSION {
+        if version != schema::VERSION {
             return Err(io::Error::new(
                 io::ErrorKind::InvalidData,
                 format!(
-                    "Archive schema version {version} is not the supported version {SCHEMA_VERSION}"
+                    "Archive schema version {version} is not the supported version {}",
+                    schema::VERSION
                 ),
             )
             .into());
         }
-        validate_images(&connection)?;
+        let recovery = Self { connection };
-        for edit in pending(&connection)? {
+        recovery.snapshot()?;
-            sync::status(&connection, edit.id)?;
+        for edit in pending(&recovery.connection)? {
+            sync::status(&recovery.connection, edit.id)?;
         }
-        receipts(&connection)?;
+        receipts(&recovery.connection)?;
-        Ok(Self { connection })
+        Ok(recovery)
     }
     pub fn summary(&self) -> Result<RecoverySummary> {
         summary(&self.connection)
     }
+    /// The image the archived queue leaves, as `Replica::snapshot` gives it.
     pub fn snapshot(&self) -> Result<Vec<u8>> {
-        crate::images::working(&self.connection)
+        working::image(&self.connection)
     }
+    fn base(&self) -> Result<Vec<u8>> {
+        Ok(
+            base::read(&self.connection, base::Image::Base)?.ok_or_else(|| {
+                io::Error::new(io::ErrorKind::InvalidData, "The archive has no base image")
+            })?,
+        )
+    }
+    /// The last observed remote image.
     pub fn remote_snapshot(&self) -> Result<Vec<u8>> {
-        crate::images::base(&self.connection)
+        match base::read(&self.connection, base::Image::Remote)? {
+            Some(image) => Ok(image),
+            None => self.base(),
+        }
     }
     pub fn pending(&self) -> Result<Vec<PendingEdit>> {
 @@ -86,83 +103,88 @@ impl Recovery {
 impl Replica {
     /// Summarizes durable state without exposing notebook content.
     pub fn recovery_summary(&self) -> Result<RecoverySummary> {
-        let connection = self
+        summary(&*self.lock()?)
-            .connection
-            .lock()
-            .map_err(|_| io::Error::other("Cache owner panicked"))?;
-        summary(&connection)
     }
     /// Exports a consistent archive to a new local path without changing the live queue.
     /// Archives contain notebook content and cannot be opened as writable replicas.
     /// An error after publication can leave a complete archive at the destination.
     pub fn export_recovery(&self, path: impl AsRef<Path>) -> Result<()> {
-        let path = path.as_ref();
+        export(&*self.lock()?, path.as_ref(), false)
-        if path.file_name().is_none() {
+    }
+}
+/// Copies the cache to `path` as a recovery archive; `replace` overwrites an existing file.
+pub(crate) fn export(source: &Connection, path: &Path, replace: bool) -> Result<()> {
+    if path.file_name().is_none() {
+        return Err(io::Error::new(
+            io::ErrorKind::InvalidInput,
+            "Provide a new recovery archive filename",
+        )
+        .into());
+    }
+    let parent = path
+        .parent()
+        .filter(|parent| !parent.as_os_str().is_empty())
+        .unwrap_or_else(|| Path::new("."));
+    let temporary = tempfile::Builder::new()
+        .prefix(".onestore-recovery-")
+        .tempfile_in(parent)?;
+    let mut destination = cache_connection(temporary.path())?;
+    {
+        let backup = Backup::new(source, &mut destination)?;
+        if backup.step(-1)? != StepResult::Done {
             return Err(io::Error::new(
-                io::ErrorKind::InvalidInput,
+                io::ErrorKind::WouldBlock,
-                "Provide a new recovery archive filename",
+                "Recovery export could not acquire the database snapshot",
             )
             .into());
         }
-        let parent = path
+    }
-            .parent()
+    // One self-contained file: the copied header says WAL, as the cache does.
-            .filter(|parent| !parent.as_os_str().is_empty())
+    destination.pragma_update(None, "journal_mode", "DELETE")?;
-            .unwrap_or_else(|| Path::new("."));
+    destination.pragma_update(None, "application_id", RECOVERY_ID)?;
-        let temporary = tempfile::Builder::new()
+    destination.close().map_err(|(_, error)| error)?;
-            .prefix(".onestore-recovery-")
+    temporary.as_file().sync_all()?;
-            .tempfile_in(parent)?;
+    if replace {
-        let mut destination = cache_connection(temporary.path())?;
+        temporary.persist(path).map_err(|error| error.error)?;
-        {
+    } else {
-            let source = self
-                .connection
-                .lock()
-                .map_err(|_| io::Error::other("Cache owner panicked"))?;
-            let backup = Backup::new(&source, &mut destination)?;
-            if backup.step(-1)? != StepResult::Done {
-                return Err(io::Error::new(
-                    io::ErrorKind::WouldBlock,
-                    "Recovery export could not acquire the database snapshot",
-                )
-                .into());
-            }
-        }
-        destination.pragma_update(None, "application_id", RECOVERY_ID)?;
-        destination.close().map_err(|(_, error)| error)?;
-        temporary.as_file().sync_all()?;
         temporary
             .persist_noclobber(path)
             .map_err(|error| error.error)?;
-        File::open(parent)?.sync_all()?;
-        Ok(())
     }
+    File::open(parent)?.sync_all()?;
+    Ok(())
 }
 fn summary(connection: &Connection) -> Result<RecoverySummary> {
-    let (cached_assets, cached_asset_bytes) = connection.query_row(
+    let (cached_assets, cached_asset_bytes): (i64, i64) = connection.query_row(
         "SELECT count(*),coalesce(sum(length(data)),0) FROM assets",
         [],
-        |row| Ok((unsigned(row, 0)?, unsigned(row, 1)?)),
+        |row| Ok((row.get(0)?, row.get(1)?)),
     )?;
-    let working_bytes = crate::images::working_length(connection)?;
+    let length = |image| -> Result<u64> {
-    Ok(connection.query_row(
+        Ok(base::stamp(connection, image)?.map_or(0, |stamp| stamp.length))
-        "SELECT (SELECT count(*) FROM edits), (SELECT count(*) FROM conflicts),
+    };
-                (SELECT count(*) FROM attempt), (SELECT count(*) FROM receipts),
+    let (queued_edits, conflicts, uncertain_edits, published_receipts): (i64, i64, i64, i64) =
-                length(base) FROM replica WHERE id=1",
+        connection.query_row(
-        [],
+            "SELECT (SELECT count(*) FROM edits),
-        |row| {
+                    (SELECT count(*) FROM edits JOIN batches ON batches.id=edits.batch WHERE conflict IS NOT NULL),
-            Ok(RecoverySummary {
+                    (SELECT count(*) FROM edits JOIN batches ON batches.id=edits.batch WHERE attempted=1),
-                queued_edits: unsigned(row, 0)?,
+                    (SELECT count(*) FROM receipts)",
-                conflicts: unsigned(row, 1)?,
+            [],
-                uncertain_edits: unsigned(row, 2)?,
+            |row| Ok((row.get(0)?, row.get(1)?, row.get(2)?, row.get(3)?)),
-                published_receipts: unsigned(row, 3)?,
+        )?;
-                working_bytes,
+    Ok(RecoverySummary {
-                remote_bytes: unsigned(row, 4)?,
+        queued_edits: unsigned(queued_edits)?,
-                cached_assets,
+        conflicts: unsigned(conflicts)?,
-                cached_asset_bytes,
+        uncertain_edits: unsigned(uncertain_edits)?,
-            })
+        published_receipts: unsigned(published_receipts)?,
-        },
+        base_bytes: length(base::Image::Base)?,
-    )?)
+        remote_bytes: length(base::Image::Remote)?,
+        cached_assets: unsigned(cached_assets)?,
+        cached_asset_bytes: unsigned(cached_asset_bytes)?,
+    })
 }
 fn receipts(connection: &Connection) -> Result<BTreeMap<u64, ExGuid>> {
 @@ -171,17 +193,7 @@ fn receipts(connection: &Connection) -> Result<BTreeMap<u64, ExGuid>> {
     let mut rows = statement.query([])?;
     let mut receipts = BTreeMap::new();
     while let Some(row) = rows.next()? {
-        receipts.insert(unsigned(row, 0)?, row.get::<_, String>(1)?.parse()?);
+        receipts.insert(unsigned(row.get(0)?)?, row.get::<_, String>(1)?.parse()?);
     }
     Ok(receipts)
 }
-fn unsigned(row: &rusqlite::Row<'_>, column: usize) -> rusqlite::Result<u64> {
-    u64::try_from(row.get::<_, i64>(column)?).map_err(|error| {
-        rusqlite::Error::FromSqlConversionFailure(
-            column,
-            rusqlite::types::Type::Integer,
-            Box::new(error),
-        )
-    })
-}

crates/notebook/src/schema.rs+45-31

 @@ -1,39 +1,53 @@
 use super::*;
 use rusqlite::Transaction;
-const CONFLICTS: &str = "CREATE TABLE conflicts (
+pub(crate) const VERSION: u32 = 15;
-    edit_id INTEGER PRIMARY KEY REFERENCES edits(id) ON DELETE CASCADE,
-    kind INTEGER NOT NULL CHECK(kind BETWEEN 0 AND 3)
-) STRICT;";
-const ASSETS: &str = "CREATE TABLE assets (
+/// Tables a schema-14 cache shares with this one.
-    name TEXT PRIMARY KEY NOT NULL,
+pub(crate) const KEPT: &str = "
-    data BLOB NOT NULL,
+    CREATE TABLE receipts (
-    sha256 BLOB NOT NULL CHECK(length(sha256)=32)
+        edit_id INTEGER PRIMARY KEY CHECK(edit_id>0),
-) STRICT;";
+        revision TEXT NOT NULL
+    ) STRICT;
+    CREATE TABLE archived (
+        edit_id INTEGER PRIMARY KEY CHECK(edit_id>0),
+        archive TEXT NOT NULL
+    ) STRICT;
+    CREATE TABLE assets (
+        name TEXT PRIMARY KEY NOT NULL,
+        data BLOB NOT NULL,
+        sha256 BLOB NOT NULL CHECK(length(sha256)=32)
+    ) STRICT;";
+/// The queue: the image its edits apply to, in chunks, and the edits in publication batches.
+pub(crate) const QUEUE: &str = "
+    CREATE TABLE base (chunk INTEGER PRIMARY KEY CHECK(chunk>=0), bytes BLOB NOT NULL) STRICT;
+    CREATE TABLE remote (chunk INTEGER PRIMARY KEY CHECK(chunk>=0), bytes BLOB NOT NULL) STRICT;
+    CREATE TABLE batches (
+        id INTEGER PRIMARY KEY AUTOINCREMENT CHECK(id>0),
+        sealed TEXT,
+        revisions TEXT,
+        attempted INTEGER NOT NULL DEFAULT 0 CHECK(attempted IN (0,1)),
+        conflict INTEGER CHECK(conflict BETWEEN 0 AND 3),
+        space TEXT,
+        CHECK((sealed IS NULL) = (revisions IS NULL)),
+        CHECK(attempted=0 OR sealed IS NOT NULL),
+        CHECK((conflict IS NULL) = (space IS NULL))
+    ) STRICT;
+    CREATE TABLE edits (
+        id INTEGER PRIMARY KEY AUTOINCREMENT CHECK(id>0),
+        batch INTEGER NOT NULL REFERENCES batches(id) ON DELETE CASCADE,
+        author TEXT NOT NULL,
+        edit TEXT NOT NULL,
+        payloads TEXT
+    ) STRICT;
+    CREATE TABLE payloads (
+        sha256 BLOB PRIMARY KEY CHECK(length(sha256)=32),
+        bytes BLOB NOT NULL
+    ) STRICT;";
 pub(crate) fn create(transaction: &Transaction<'_>) -> Result<()> {
-    transaction.execute_batch(
+    transaction.execute_batch(QUEUE)?;
-        "CREATE TABLE edits (
+    transaction.execute_batch(KEPT)?;
-            id INTEGER PRIMARY KEY AUTOINCREMENT CHECK(id>0),
-            space TEXT NOT NULL,
-            operation TEXT NOT NULL
-        ) STRICT;
-        CREATE TABLE attempt (
-            id INTEGER PRIMARY KEY CHECK(id=1),
-            edit_id INTEGER NOT NULL UNIQUE REFERENCES edits(id) ON DELETE CASCADE,
-            revisions TEXT NOT NULL
-        ) STRICT;
-        CREATE TABLE receipts (
-            edit_id INTEGER PRIMARY KEY CHECK(edit_id>0),
-            revision TEXT NOT NULL
-        ) STRICT;
-        CREATE TABLE archived (
-            edit_id INTEGER PRIMARY KEY CHECK(edit_id>0),
-            archive TEXT NOT NULL
-        ) STRICT;",
-    )?;
-    transaction.execute_batch(CONFLICTS)?;
-    transaction.execute_batch(ASSETS)?;
     Ok(())
 }

crates/notebook/src/session.rs+246-299

...	@@ -1,15 +1,18 @@	...	@@ -1,15 +1,18 @@
1	//! The application's view of a notebook: sections opened through a local replica that	1	//! The application's view of a notebook: sections opened through a local replica that
2	//! publishes page saves to the section file in the background.	2	//! publishes their edits to the section file in the background.
3		3
4	use crate::{	4	use crate::{
5	ConflictKind, EditStatus, Error, PendingEdit, Remote, Replica, Result, SyncWorker, discover,	5	Conflict, ConflictKind, EditStatus, Error, PendingEdit, Remote, Replica, Resolution, Result,
		6	SyncWorker, discover,
6	};	7	};
7	use onestore::{	8	use onestore::{
8	CommitError, ExGuid, PageCreation, PreparedEdit, RevisionIndex, Stamp, Store, Transaction,	9	CommitError, ExGuid, PageCreation, PreparedEdit, RevisionIndex, Stamp, Store, Transaction,
9	document::Document, page::Page,	10	document::Document,
		11	op::{Edit, Op, SectionOp},
		12	page::Page,
10	};	13	};
11	use std::{	14	use std::{
12	collections::{BTreeMap, VecDeque},	15	collections::BTreeMap,
13	io,	16	io,
14	io::Write,	17	io::Write,
15	path::{Path, PathBuf},	18	path::{Path, PathBuf},
...	@@ -18,7 +21,6 @@ use std::{	...	@@ -18,7 +21,6 @@ use std::{
18	atomic::{AtomicUsize, Ordering},	21	atomic::{AtomicUsize, Ordering},
19	mpsc::{self, Receiver, Sender},	22	mpsc::{self, Receiver, Sender},
20	},	23	},
21	thread::{self, JoinHandle},
22	time::Duration,	24	time::Duration,
23	};	25	};
24		26
...	@@ -723,10 +725,15 @@ fn catalog_path(folder: &str, name: &str) -> String {	...	@@ -723,10 +725,15 @@ fn catalog_path(folder: &str, name: &str) -> String {
723	}	725	}
724	}	726	}
725		727
726	/// What happened on the synchronization thread since the last poll.	728	/// What happened to the section since the last poll.
727	#[derive(Debug)]	729	#[derive(Debug)]
728	pub enum Event {	730	pub enum Event {
729	/// The working image was refreshed from the section file with no local edit pending.	731	/// A remote change reached these pages; reload them where they are open.
		732	Changed(Vec<ExGuid>),
		733	/// The section refused an edit `apply` handed it; the pages it names are as they were
		734	/// before it, so an editor showing them should reload them.
		735	Rejected { spaces: Vec<ExGuid>, error: String },
		736	/// Old session API, until the application reloads on `Changed`: pages changed remotely.
730	Refreshed,	737	Refreshed,
731	/// A publication attempt finished with this durable state.	738	/// A publication attempt finished with this durable state.
732	Attempt { id: u64, status: EditStatus },	739	Attempt { id: u64, status: EditStatus },
...	@@ -736,7 +743,7 @@ pub enum Event {	...	@@ -736,7 +743,7 @@ pub enum Event {
736	Failed(String),	743	Failed(String),
737	}	744	}
738		745
739	/// The outcome of saving an edited page.	746	/// The outcome of saving an edited page (old session API).
740	#[derive(Debug, PartialEq, Eq)]	747	#[derive(Debug, PartialEq, Eq)]
741	pub enum Save {	748	pub enum Save {
742	/// The model equals the stored page.	749	/// The model equals the stored page.
...	@@ -755,31 +762,27 @@ pub struct QueuedEdit {	...	@@ -755,31 +762,27 @@ pub struct QueuedEdit {
755	pub status: EditStatus,	762	pub status: EditStatus,
756	}	763	}
757		764
758	/// A section file with its replica, background saves and background publication.	765	type Notify = Arc<dyn Fn() + Send + Sync>;
		766
		767	/// A section file with its replica and background publication. `Send + Sync`: edits
		768	/// arrive from any thread without waiting, and `notify` wakes the host when events wait.
759	pub struct Section {	769	pub struct Section {
760	file: PathBuf,	770	file: PathBuf,
761	replica: Arc<Replica>,	771	replica: Arc<Replica>,
762	worker: Option<SyncWorker>,	772	worker: Option<SyncWorker>,
763	events: Receiver<Event>,	773	events: Mutex<Receiver<Event>>,
764	saves: Option<Sender<PageSave>>,	774	sender: Sender<Event>,
765	saved: Receiver<(ExGuid, std::result::Result<Save, String>)>,	775	notify: Notify,
		776	saved: Mutex<Receiver<(ExGuid, std::result::Result<Save, String>)>>,
		777	saves: Sender<(ExGuid, std::result::Result<Save, String>)>,
766	/// Saves queued and not yet reported.	778	/// Saves queued and not yet reported.
767	unsaved: Arc<AtomicUsize>,	779	unsaved: Arc<AtomicUsize>,
768	saver: Option<JoinHandle<()>>,
769	}
770
771	/// An edited page `Section::queue_save` hands to the save thread.
772	struct PageSave {
773	space: ExGuid,
774	before: Page,
775	after: Page,
776	author: String,
777	}	780	}
778		781
779	impl Section {	782	impl Section {
780	/// Opens the section file through a replica in `cache`, creating the replica from the	783	/// Opens the section file through a replica in `cache`, creating the replica from the
781	/// file on first use. `notify` runs on the synchronization thread whenever an event is	784	/// file on first use and converting an older one. `notify` runs on a background thread
782	/// available.	785	/// whenever an event is available.
783	pub fn open(	786	pub fn open(
784	file: impl AsRef<Path>,	787	file: impl AsRef<Path>,
785	cache: impl AsRef<Path>,	788	cache: impl AsRef<Path>,
...	@@ -847,58 +850,58 @@ impl Section {	...	@@ -847,58 +850,58 @@ impl Section {
847	) -> Result<Self> {	850	) -> Result<Self> {
848	let replica = Arc::new(replica);	851	let replica = Arc::new(replica);
849	let (sender, events) = mpsc::channel();	852	let (sender, events) = mpsc::channel();
850	let (saved_sender, saved) = mpsc::channel();	853	let (saves, saved) = mpsc::channel();
851	let notify = Arc::new(Mutex::new(notify));	854	let notify = Mutex::new(notify);
852	let signal = move \|\| {	855	let notify: Notify = Arc::new(move \|\| {
853	if let Ok(notify) = notify.lock() {	856	if let Ok(notify) = notify.lock() {
854	notify();	857	notify();
855	}	858	}
856	};	859	});
857	let (saves, requests) = mpsc::channel();	860	let worker = {
858	let unsaved = Arc::new(AtomicUsize::new(0));	861	let (sender, notify) = (sender.clone(), Arc::clone(&notify));
859	let saver = {	862	replica.start_sync(Duration::from_secs(2), connect, move \|result\| {
860	let (replica, signal) = (Arc::clone(&replica), signal.clone());	863	let mut events = Vec::new();
861	let unsaved = Arc::clone(&unsaved);	864	match result {
862	thread::Builder::new()	865	Ok(synced) => {
863	.name("onestore-save".into())	866	if !synced.changed.is_empty() {
864	.spawn(move \|\| {	867	events.push(Event::Changed(synced.changed.clone()));
865	save_pages(&replica, &requests, \|outcome, count\| {	868	events.push(Event::Refreshed);
866	unsaved.fetch_sub(count, Ordering::Release);
867	if saved_sender.send(outcome).is_ok() {
868	signal();
869	}	869	}
870	});	870	if let Some((id, status)) = &synced.edit {
871	})?	871	events.push(Event::Attempt {
872	};	872	id: *id,
873	let worker = replica.start_sync(Duration::from_secs(2), connect, move \|result\| {	873	status: status.clone(),
874	let event = match result {	874	});
875	Ok(None) => Event::Refreshed,	875	}
876	Ok(Some((id, status))) => Event::Attempt {	876	}
877	id: *id,	877	Err(Error::RemoteIo(error)) => {
878	status: status.clone(),	878	events.push(Event::Unreachable(match error.raw_os_error() {
879	},	879	Some(code) => io::Error::from_raw_os_error(code),
880	Err(Error::RemoteIo(error)) => Event::Unreachable(match error.raw_os_error() {	880	None => io::Error::new(error.kind(), error.to_string()),
881	Some(code) => io::Error::from_raw_os_error(code),	881	}))
882	None => io::Error::new(error.kind(), error.to_string()),	882	}
883	}),	883	Err(Error::Remote(error)) => events.push(Event::Unreachable(io::Error::new(
884	Err(Error::Remote(error)) => {	884	error.error.kind(),
885	Event::Unreachable(io::Error::new(error.error.kind(), error.to_string()))	885	error.to_string(),
		886	))),
		887	Err(error) => events.push(Event::Failed(error.to_string())),
886	}	888	}
887	Err(error) => Event::Failed(error.to_string()),	889	if !events.is_empty() && events.into_iter().all(\|event\| sender.send(event).is_ok())
888	};	890	{
889	if sender.send(event).is_ok() {	891	notify();
890	signal();	892	}
891	}	893	})?
892	})?;	894	};
893	Ok(Self {	895	Ok(Self {
894	file,	896	file,
895	replica,	897	replica,
896	worker: Some(worker),	898	worker: Some(worker),
897	events,	899	events: Mutex::new(events),
898	saves: Some(saves),	900	sender,
899	saved,	901	notify,
900	unsaved,	902	saved: Mutex::new(saved),
901	saver: Some(saver),	903	saves,
		904	unsaved: Arc::new(AtomicUsize::new(0)),
902	})	905	})
903	}	906	}
904		907
...	@@ -910,111 +913,74 @@ impl Section {	...	@@ -910,111 +913,74 @@ impl Section {
910	/// The section file identity, which internal links name as `section-id`	913	/// The section file identity, which internal links name as `section-id`
911	/// (`onestore::page::link::internal_link`).	914	/// (`onestore::page::link::internal_link`).
912	pub fn identity(&self) -> Result<[u8; 16]> {	915	pub fn identity(&self) -> Result<[u8; 16]> {
913	Ok(Store::parse(&self.replica.snapshot()?)?.header.file_id)	916	self.replica.identity()
914	}	917	}
915		918
916	/// Page spaces, titles and outline levels (1 at the top) in section order, from the	919	/// Applies an edit without waiting: it becomes durable on the section thread, which
917	/// local working image.	920	/// reports a refusal as `Event::Rejected`. Edits apply in the order they arrive.
918	pub fn pages(&self) -> Result<Vec<(ExGuid, String, u32)>> {	921	pub fn apply(&self, author: &str, edit: Edit) -> Result<()> {
919	let snapshot = self.replica.snapshot()?;	922	let (sender, notify) = (self.sender.clone(), Arc::clone(&self.notify));
920	let store = Store::parse(&snapshot)?;	923	let root = self.replica.root;
921	let index = RevisionIndex::parse(&store)?;	924	let spaces = crate::queue::spaces(&edit, root);
922	let document = Document::parse(&index)?;	925	self.replica.submit(
923	let pages = document.pages()?;	926	author,
924	let mut spaces = std::collections::BTreeSet::new();	927	edit,
925	pages	928	Box::new(move \|result\| {
926	.into_iter()	929	let event = match result {
927	.map(\|(space, page)\| {	930	Ok(_) => return,
928	if !spaces.insert(space) {	931	Err(Error::Rejected(error)) => Event::Rejected {
929	return Err(onestore::Error {	932	spaces,
930	offset: 0,	933	error: error.to_string(),
931	message: "Choose an object space containing one active page",	934	},
932	}	935	Err(error) => Event::Failed(error.to_string()),
933	.into());	936	};
		937	if sender.send(event).is_ok() {
		938	notify();
934	}	939	}
935	let (title, level) = Page::heading(document.active(space)?, page);	940	}),
936	Ok((space, title, level))	941	)
937	})
938	.collect()
939	}	942	}
940		943
		944	/// Page spaces, titles and outline levels (1 at the top) in section order, as the
		945	/// local edits leave them.
		946	pub fn pages(&self) -> Result<Vec<(ExGuid, String, u32)>> {
		947	self.replica.pages()
		948	}
		949
		950	/// The page to show or edit; O(page), for opening and reloading.
941	pub fn page(&self, space: ExGuid) -> Result<Page> {	951	pub fn page(&self, space: ExGuid) -> Result<Page> {
942	self.replica.page(space)	952	self.replica.page(space)
943	}	953	}
944		954
945	/// Copies a page (usually from another section) to the end of this section as a	955	/// Copies a page (usually from another section) to the end of this section under
946	/// creation and a save queued like the user's own edits, under fresh identities.	956	/// fresh identities, queued like the user's own edits. Returns the new page's space.
947	/// Returns the new page's space. Content outside the model refuses to copy.	957	/// Content outside the model refuses to copy.
948	pub fn import_page(&self, page: &Page, author: &str) -> Result<ExGuid> {	958	pub fn import_page(&self, page: &Page, author: &str) -> Result<ExGuid> {
949	let copy = page.copy()?;
950	let creation = PageCreation::new(None, Some(&page.title), author)?;	959	let creation = PageCreation::new(None, Some(&page.title), author)?;
951	self.replica
952	.create_page(&self.replica.snapshot()?, &creation)?;
953	let space = creation.space();	960	let space = creation.space();
954	loop {	961	self.replica.apply(
955	// The worker may publish the creation, and so replace the working image,	962	author,
956	// between reading it and saving against it.	963	Edit {
957	let source = self.replica.snapshot()?;	964	at: crate::now(),
958	let mut after = Page::from_space(	965	ops: vec![Op::Section(SectionOp::Import {
959	&Document::parse(&RevisionIndex::parse(&Store::parse(&source)?)?)?,	966	creation,
960	space,	967	page: page.copy()?,
961	)?;	968	})],
962	after	969	},
963	.objects	970	)?;
964	.retain(\|object\| matches!(object, onestore::page::PageObject::Title(_)));
965	after.objects.extend(
966	copy.objects
967	.iter()
968	.filter(\|object\| !matches!(object, onestore::page::PageObject::Title(_)))
969	.cloned(),
970	);
971	after.definitions = copy.definitions.clone();
972	match self.replica.save(&source, space, &after, author) {
973	Err(Error::Io(error)) if error.kind() == io::ErrorKind::ResourceBusy => continue,
974	result => result?,
975	};
976	break;
977	}
978	self.wake();
979	Ok(space)	971	Ok(space)
980	}	972	}
981		973
982	/// Removes pages permanently, queued like the user's own edits (a move across	974	/// Removes pages permanently, queued like the user's own edits (a move across
983	/// sections is `import_page` there, then this here).	975	/// sections is `import_page` there, then this here).
984	pub fn delete_pages(&self, pages: &[ExGuid]) -> Result<Option<u64>> {	976	pub fn delete_pages(&self, pages: &[ExGuid]) -> Result<u64> {
985	let id = self	977	self.replica.apply(
986	.replica	978	"",
987	.delete_pages(&self.replica.snapshot()?, pages)?;	979	Edit {
988	self.wake();	980	at: crate::now(),
989	Ok(id)	981	ops: vec![Op::Section(SectionOp::Delete(pages.to_vec()))],
990	}	982	},
991		983	)
992	/// Saves an edited page. `before` is the model the edit started from; a stored page
993	/// that differs from it means the section changed underneath the editor.
994	pub fn save(&self, space: ExGuid, before: &Page, after: &Page, author: &str) -> Result<Save> {
995	Ok(save(&self.replica, space, before, None, after, author)?.0)
996	}
997
998	/// `save` on the section's save thread, returning at once; `saved` reports the outcome.
999	/// Saves queue in order, and one whose `before` is the previous save's `after` continues
1000	/// it: pass each save's `after` as the next one's `before`.
1001	pub fn queue_save(&self, space: ExGuid, before: Page, after: Page, author: &str) -> Result<()> {
1002	let save = PageSave {
1003	space,
1004	before,
1005	after,
1006	author: author.to_owned(),
1007	};
1008	self.unsaved.fetch_add(1, Ordering::Relaxed);
1009	self.saves
1010	.as_ref()
1011	.and_then(\|saves\| saves.send(save).ok())
1012	.ok_or_else(\|\| io::Error::other("The save thread stopped").into())
1013	}
1014
1015	/// Whether a queued save has yet to report, so the stored page may trail the editor's.
1016	pub fn saving(&self) -> bool {
1017	self.unsaved.load(Ordering::Acquire) > 0
1018	}	984	}
1019		985
1020	pub fn status(&self, id: u64) -> Result<Option<EditStatus>> {	986	pub fn status(&self, id: u64) -> Result<Option<EditStatus>> {
...	@@ -1025,78 +991,48 @@ impl Section {	...	@@ -1025,78 +991,48 @@ impl Section {
1025	self.replica.pending()	991	self.replica.pending()
1026	}	992	}
1027		993
1028	/// Every queued edit with its state: pending, awaiting confirmation of a retained	994	/// The unpublished batch the remote no longer accepts, if any. Show `remote_page`
1029	/// attempt, or a conflict awaiting review.	995	/// against `page` for its space, then `resolve`.
1030	pub fn queue(&self) -> Result<Vec<QueuedEdit>> {	996	pub fn conflict(&self) -> Result<Option<Conflict>> {
1031	self.replica	997	self.replica.conflict()
1032	.queued()?
1033	.into_iter()
1034	.map(\|(id, space)\| {
1035	Ok(QueuedEdit {
1036	id,
1037	space,
1038	status: self.replica.status(id)?.unwrap_or(EditStatus::Pending),
1039	})
1040	})
1041	.collect()
1042	}
1043
1044	/// The queued edits whose publication conflicted with a remote change.
1045	pub fn conflicts(&self) -> Result<Vec<(QueuedEdit, ConflictKind)>> {
1046	Ok(self
1047	.queue()?
1048	.into_iter()
1049	.filter_map(\|edit\| match edit.status {
1050	EditStatus::Conflict(kind) => Some((edit, kind)),
1051	_ => None,
1052	})
1053	.collect())
1054	}	998	}
1055		999
1056	/// The page as last observed in the section file, for reviewing a conflict.	1000	/// The page as last observed in the section file, for reviewing a conflict.
1057	pub fn remote_page(&self, space: ExGuid) -> Result<Page> {	1001	pub fn remote_page(&self, space: ExGuid) -> Result<Page> {
1058	let snapshot = self.replica.remote_snapshot()?;	1002	let snapshot = self.replica.remote_snapshot()?;
1059	let store = Store::parse(&snapshot)?;	1003	let arena = onestore::Arena::default();
1060	let index = RevisionIndex::parse(&store)?;	1004	Ok(onestore::Section::open(&arena, snapshot)?.page(space)?)
1061	Ok(Page::from_space(&Document::parse(&index)?, space)?)
1062	}	1005	}
1063		1006
1064	/// Resolves the oldest conflict with a page reviewed against `remote_page`; the	1007	/// Ends a conflict: `Mine` publishes the local page over the remote change, `Theirs`
1065	/// reviewed model publishes as a whole, keeping the edit's id.	1008	/// drops the local edits to the conflicted page (and its later ones).
1066	pub fn review(&self, id: u64, after: &Page) -> Result<()> {	1009	pub fn resolve(&self, id: u64, resolution: Resolution) -> Result<()> {
1067	let local = self.replica.snapshot()?;	1010	self.replica.resolve(id, resolution)
1068	let remote = self.replica.remote_snapshot()?;
1069	self.replica.review_page(id, &local, &remote, after)?;
1070	self.wake();
1071	Ok(())
1072	}	1011	}
1073		1012
1074	/// Retires an uncertain attempt after review, exporting the branch to `archive`	1013	/// Retires an uncertain attempt after review, exporting the queue to `archive` first:
1075	/// first: `Some(page)` continues from the reviewed page against `remote_page`,	1014	/// `Mine` publishes the local edits again, `Theirs` abandons them. Neither claims the
1076	/// `None` abandons the local branch. Neither claims the attempt was acknowledged.	1015	/// attempt was acknowledged.
1077	pub fn release(&self, id: u64, archive: impl AsRef<Path>, after: Option<&Page>) -> Result<()> {	1016	pub fn release(
1078	let local = self.replica.snapshot()?;	1017	&self,
1079	let remote = self.replica.remote_snapshot()?;	1018	id: u64,
1080	self.replica	1019	archive: impl AsRef<Path>,
1081	.release_attempt(id, &local, &remote, archive.as_ref(), after)?;	1020	resolution: Resolution,
1082	self.wake();	1021	) -> Result<()> {
1083	Ok(())	1022	self.replica.release(id, archive.as_ref(), resolution)
1084	}	1023	}
1085		1024
1086	/// Captures both images, the queue and its states in a read-only archive.	1025	/// Captures the queue, its images and its states in a read-only archive.
1087	pub fn export_recovery(&self, path: impl AsRef<Path>) -> Result<()> {	1026	pub fn export_recovery(&self, path: impl AsRef<Path>) -> Result<()> {
1088	self.replica.export_recovery(path)	1027	self.replica.export_recovery(path)
1089	}	1028	}
1090		1029
1091	/// Events since the last poll, oldest first.	1030	/// Events since the last poll, oldest first.
1092	pub fn events(&self) -> Vec<Event> {	1031	pub fn events(&self) -> Vec<Event> {
1093	self.events.try_iter().collect()	1032	self.events
1094	}	1033	.lock()
1095		1034	.map(\|events\| events.try_iter().collect())
1096	/// Outcomes of queued saves since the last poll, oldest first; `notify` runs for each.	1035	.unwrap_or_default()
1097	/// Consecutive saves continuing one another finish as one, reported once.
1098	pub fn saved(&self) -> Vec<(ExGuid, std::result::Result<Save, String>)> {
1099	self.saved.try_iter().collect()
1100	}	1036	}
1101		1037
1102	/// Requests a synchronization attempt now.	1038	/// Requests a synchronization attempt now.
...	@@ -1115,107 +1051,118 @@ impl Section {	...	@@ -1115,107 +1051,118 @@ impl Section {
1115	/// Dropping instead requests cancellation without waiting; the worker retains	1051	/// Dropping instead requests cancellation without waiting; the worker retains
1116	/// cache ownership until that operation finishes. Remote calls must be bounded.	1052	/// cache ownership until that operation finishes. Remote calls must be bounded.
1117	pub fn close(mut self) -> Result<()> {	1053	pub fn close(mut self) -> Result<()> {
1118	drop(self.saves.take());
1119	if let Some(saver) = self.saver.take() {
1120	saver
1121	.join()
1122	.map_err(\|_\| io::Error::other("The save thread panicked"))?;
1123	}
1124	match self.worker.take() {	1054	match self.worker.take() {
1125	Some(worker) => worker.stop(),	1055	Some(worker) => worker.stop(),
1126	None => Ok(()),	1056	None => Ok(()),
1127	}	1057	}
1128	}	1058	}
1129	}
1130		1059
1131	/// Saves `after` unless the stored page no longer matches `before`, returning the working	1060	// Old whole-page session API, kept until the application emits ops.
1132	/// image the save leaves. `known` is the image a previous save of `before` left: while the	1061
1133	/// working image equals it the page is current unread, and otherwise the page `known`	1062	/// Saves an edited page. `before` is the model the edit started from; a stored page
1134	/// stores stands in for `before`.	1063	/// that differs from it means the section changed underneath the editor.
1135	fn save(	1064	pub fn save(&self, space: ExGuid, before: &Page, after: &Page, author: &str) -> Result<Save> {
1136	replica: &Replica,	1065	let outcome = self.replica.ask(\|reply\| crate::working::Request::Save {
1137	space: ExGuid,
1138	before: &Page,
1139	known: Option<&[u8]>,
1140	after: &Page,
1141	author: &str,
1142	) -> Result<(Save, Vec<u8>)> {
1143	let stored = \|image: &[u8]\| -> Result<Page> {
1144	let store = Store::parse(image)?;
1145	Ok(Page::from_space(
1146	&Document::parse(&RevisionIndex::parse(&store)?)?,
1147	space,	1066	space,
1148	)?)	1067	before: before.clone(),
1149	};	1068	after: after.clone(),
1150	loop {	1069	author: author.to_owned(),
1151	let snapshot = replica.snapshot()?;	1070	reply,
1152	if known != Some(snapshot.as_slice()) {	1071	})?;
1153	let current = stored(&snapshot)?;	1072	Ok(outcome.unwrap_or(Save::Unchanged))
1154	let expected = match known {
1155	Some(image) => current == stored(image)?,
1156	None => current == *before,
1157	};
1158	if !expected {
1159	return Ok((Save::Stale, snapshot));
1160	}
1161	}
1162	match replica.save_image(&snapshot, space, after, author) {
1163	Ok((Some(id), image)) => return Ok((Save::Queued(id), image)),
1164	Ok((None, image)) => return Ok((Save::Unchanged, image)),
1165	Err(Error::Io(error)) if error.kind() == io::ErrorKind::ResourceBusy => {}
1166	Err(error) => return Err(error),
1167	}
1168	}	1073	}
1169	}
1170		1074
1171	/// Runs queued saves until the section drops its sender, folding each run of saves that	1075	/// `save` on the section thread, returning at once; `saved` reports the outcome.
1172	/// continue one another into one.	1076	/// Saves queue in order, and one whose `before` is the previous save's `after`
1173	fn save_pages(	1077	/// continues it: pass each save's `after` as the next one's `before`.
1174	replica: &Replica,	1078	pub fn queue_save(&self, space: ExGuid, before: Page, after: Page, author: &str) -> Result<()> {
1175	requests: &Receiver<PageSave>,	1079	let (saves, notify, unsaved) = (
1176	report: impl Fn((ExGuid, std::result::Result<Save, String>), usize),	1080	self.saves.clone(),
1177	) {	1081	Arc::clone(&self.notify),
1178	let mut queue = VecDeque::new();	1082	Arc::clone(&self.unsaved),
1179	// The last save's page and the working image it left.
1180	let mut last: Option<(ExGuid, Page, Vec<u8>)> = None;
1181	loop {
1182	if queue.is_empty() {
1183	match requests.recv() {
1184	Ok(request) => queue.push_back(request),
1185	Err(_) => return,
1186	}
1187	}
1188	queue.extend(requests.try_iter());
1189	let mut request = queue.pop_front().unwrap();
1190	let mut count = 1;
1191	while let Some(next) = queue.front()
1192	&& (next.space, &next.before, &next.author)
1193	== (request.space, &request.after, &request.author)
1194	{
1195	request.after = queue.pop_front().unwrap().after;
1196	count += 1;
1197	}
1198	let known = last
1199	.take()
1200	.filter(\|(space, after, _)\| space == request.space && after == request.before);
1201	let result = save(
1202	replica,
1203	request.space,
1204	&request.before,
1205	known.as_ref().map(\|(_, _, image)\| image.as_slice()),
1206	&request.after,
1207	&request.author,
1208	);	1083	);
1209	let save = match result {	1084	self.unsaved.fetch_add(1, Ordering::Relaxed);
1210	Ok((save, image)) => {	1085	self.replica.send(crate::working::Request::Save {
1211	if save != Save::Stale {	1086	space,
1212	last = Some((request.space, request.after, image));	1087	before,
		1088	after,
		1089	author: author.to_owned(),
		1090	reply: Box::new(move \|outcome\| {
		1091	unsaved.fetch_sub(1, Ordering::Release);
		1092	let outcome = match outcome {
		1093	Ok(None) => return,
		1094	Ok(Some(save)) => Ok(save),
		1095	Err(error) => Err(error.to_string()),
		1096	};
		1097	if saves.send((space, outcome)).is_ok() {
		1098	notify();
1213	}	1099	}
1214	Ok(save)	1100	}),
1215	}	1101	})
1216	Err(error) => Err(error.to_string()),	1102	}
1217	};	1103
1218	report((request.space, save), count);	1104	/// Whether a queued save has yet to report, so the stored page may trail the editor's.
		1105	pub fn saving(&self) -> bool {
		1106	self.unsaved.load(Ordering::Acquire) > 0
		1107	}
		1108
		1109	/// Outcomes of queued saves since the last poll, oldest first; `notify` runs for each.
		1110	/// Consecutive saves continuing one another finish as one, reported once.
		1111	pub fn saved(&self) -> Vec<(ExGuid, std::result::Result<Save, String>)> {
		1112	self.saved
		1113	.lock()
		1114	.map(\|saved\| saved.try_iter().collect())
		1115	.unwrap_or_default()
		1116	}
		1117
		1118	/// Every queued edit with its state: pending, awaiting confirmation of a retained
		1119	/// attempt, or a conflict awaiting review. `space` is the first page it edits.
		1120	pub fn queue(&self) -> Result<Vec<QueuedEdit>> {
		1121	self.replica
		1122	.pending()?
		1123	.into_iter()
		1124	.map(\|edit\| {
		1125	Ok(QueuedEdit {
		1126	id: edit.id,
		1127	space: edit
		1128	.edit
		1129	.ops
		1130	.iter()
		1131	.find_map(\|op\| match op {
		1132	Op::Page { space, .. } => Some(*space),
		1133	Op::Section(_) => None,
		1134	})
		1135	.unwrap_or(self.replica.root),
		1136	status: self.replica.status(edit.id)?.unwrap_or(EditStatus::Pending),
		1137	})
		1138	})
		1139	.collect()
		1140	}
		1141
		1142	/// The conflict as a queue entry, for the review dialog.
		1143	pub fn conflicts(&self) -> Result<Vec<(QueuedEdit, ConflictKind)>> {
		1144	Ok(self
		1145	.replica
		1146	.conflict()?
		1147	.map(\|conflict\| {
		1148	(
		1149	QueuedEdit {
		1150	id: conflict.id,
		1151	space: conflict.space,
		1152	status: EditStatus::Conflict(conflict.kind),
		1153	},
		1154	conflict.kind,
		1155	)
		1156	})
		1157	.into_iter()
		1158	.collect())
		1159	}
		1160
		1161	/// Resolves the conflict holding `id` with a page reviewed against `remote_page`: the
		1162	/// remote page is rewritten to `after`.
		1163	pub fn review(&self, id: u64, after: &Page) -> Result<()> {
		1164	self.replica
		1165	.resolve_with(id, Resolution::Mine, Some(after.clone()))
1219	}	1166	}
1220	}	1167	}
1221		1168

crates/notebook/src/sync.rs+515-490

 @@ -1,9 +1,10 @@
 use super::*;
-use onestore::{CommitError, CommitState, Stamp, Transaction};
+use crate::working::{Rebased, Request, Resolve, Sealed};
+use onestore::{CommitError, CommitState, RevisionIndex, Stamp, Store, Transaction};
 use rusqlite::OptionalExtension;
 use std::{
     collections::BTreeMap,
-    sync::{MutexGuard, TryLockError, atomic::Ordering},
+    sync::{MutexGuard, TryLockError},
 };
 /// A single remote file with fresh reads and native-compatible guarded publication.
 @@ -25,14 +26,32 @@ pub trait Remote {
 pub enum ConflictKind {
     /// The edited page or a selected page no longer exists remotely.
     TargetUnavailable = 0,
-    /// The remote image no longer accepts the intent's publication.
+    /// The remote section no longer accepts the edit.
     UnsupportedEdit = 1,
     /// Page order or indentation changed remotely in a way the batch cannot absorb.
     StructureChanged = 2,
-    /// The remote page changed where the local model changed too; review is required.
+    /// The remote page changed where the local edits changed it too; review is required.
     ContentChanged = 3,
 }
+impl ConflictKind {
+    fn from_stored(kind: i64) -> Result<Self> {
+        Ok(match kind {
+            0 => Self::TargetUnavailable,
+            1 => Self::UnsupportedEdit,
+            2 => Self::StructureChanged,
+            3 => Self::ContentChanged,
+            _ => {
+                return Err(io::Error::new(
+                    io::ErrorKind::InvalidData,
+                    "Unknown cached conflict kind",
+                )
+                .into());
+            }
+        })
+    }
+}
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub enum EditStatus {
     Pending,
 @@ -46,499 +65,534 @@ pub enum EditStatus {
         revision: ExGuid,
     },
     /// Retired unpublished by a reviewed release; the archive at this path holds the
-    /// intent, its attempt evidence and both images.
+    /// edit, its attempt evidence and both images.
     Archived {
         archive: String,
     },
 }
+/// What one synchronization step did: the state its batch reached, named by the batch's
+/// newest edit, and the pages a remote change replaced.
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub struct Synced {
+    pub edit: Option<(u64, EditStatus)>,
+    pub changed: Vec<ExGuid>,
+}
+/// The queue as a synchronization step starts it.
+struct State {
+    base: Stamp,
+    /// The observed remote image's stamp while it is not the base.
+    remote: Option<Stamp>,
+    /// The first batch waiting on a remote answer: sealed, attempted, or in conflict.
+    blocked: Option<Blocked>,
+    queued: bool,
+}
+struct Blocked {
+    batch: i64,
+    attempted: bool,
+    conflict: Option<ConflictKind>,
+    revisions: Option<BTreeMap<ExGuid, ExGuid>>,
+}
+fn state(connection: &Connection) -> Result<State> {
+    let base = base::stamp(connection, base::Image::Base)?
+        .ok_or_else(|| io::Error::new(io::ErrorKind::InvalidData, "The cache has no base image"))?;
+    let blocked = connection
+        .query_row(
+            "SELECT id, attempted, conflict, revisions FROM batches
+             WHERE attempted=1 OR conflict IS NOT NULL ORDER BY id LIMIT 1",
+            [],
+            |row| {
+                Ok((
+                    row.get::<_, i64>(0)?,
+                    row.get::<_, bool>(1)?,
+                    row.get::<_, Option<i64>>(2)?,
+                    row.get::<_, Option<String>>(3)?,
+                ))
+            },
+        )
+        .optional()?
+        .map(|(batch, attempted, conflict, revisions)| {
+            Ok::<_, Error>(Blocked {
+                batch,
+                attempted,
+                conflict: conflict.map(ConflictKind::from_stored).transpose()?,
+                revisions: revisions
+                    .map(|revisions| decode_revisions(&revisions))
+                    .transpose()?,
+            })
+        })
+        .transpose()?;
+    Ok(State {
+        base,
+        remote: base::stamp(connection, base::Image::Remote)?,
+        blocked,
+        queued: connection
+            .query_row("SELECT EXISTS(SELECT 1 FROM batches)", [], |row| row.get(0))?,
+    })
+}
+fn decode_revisions(encoded: &str) -> Result<BTreeMap<ExGuid, ExGuid>> {
+    let revisions: BTreeMap<ExGuid, ExGuid> = serde_json::from_str(encoded)
+        .map_err(|error| io::Error::new(io::ErrorKind::InvalidData, error))?;
+    if revisions
+        .iter()
+        .any(|(space, revision)| space.guid == [0; 16] || revision.guid == [0; 16])
+    {
+        return Err(io::Error::new(
+            io::ErrorKind::InvalidData,
+            "Cached publication evidence is incomplete",
+        )
+        .into());
+    }
+    Ok(revisions)
+}
+/// The revision a batch's seal stored for the first page an edit changes.
+fn revision_of(edit: &onestore::op::Edit, revisions: &BTreeMap<ExGuid, ExGuid>) -> Result<ExGuid> {
+    edit.ops
+        .iter()
+        .find_map(|op| match op {
+            onestore::op::Op::Page { space, .. } => revisions.get(space),
+            onestore::op::Op::Section(_) => None,
+        })
+        .or_else(|| revisions.values().next())
+        .copied()
+        .ok_or_else(|| {
+            io::Error::new(
+                io::ErrorKind::InvalidData,
+                "Cached publication evidence is incomplete",
+            )
+            .into()
+        })
+}
+/// The newest edit of a batch.
+fn newest(connection: &Connection, batch: i64) -> Result<u64> {
+    unsigned(
+        connection.query_row("SELECT max(id) FROM edits WHERE batch=?1", [batch], |row| {
+            row.get(0)
+        })?,
+    )
+}
 impl Replica {
     /// Returns a durable receipt or the persisted state of a locally acknowledged edit.
     pub fn status(&self, id: u64) -> Result<Option<EditStatus>> {
-        let connection = self
+        status(&*self.lock()?, id)
-            .connection
-            .lock()
-            .map_err(|_| io::Error::other("Cache owner panicked"))?;
-        status(&connection, id)
     }
-    /// The last observed remote image, retained alongside the complete local working image.
+    /// The last observed remote image. Observation alone does not acknowledge any pending
-    /// Observation alone does not acknowledge any pending edit's remote durability.
+    /// edit's remote durability.
     pub fn remote_snapshot(&self) -> Result<Vec<u8>> {
-        let connection = self
+        let connection = self.lock()?;
-            .connection
+        let image = match base::read(&connection, base::Image::Remote)? {
-            .lock()
+            Some(image) => Some(image),
-            .map_err(|_| io::Error::other("Cache owner panicked"))?;
+            None => base::read(&connection, base::Image::Base)?,
-        images::base(&connection)
+        };
+        Ok(image.ok_or_else(|| {
+            io::Error::new(io::ErrorKind::InvalidData, "The cache has no base image")
+        })?)
+    }
+    /// The unpublished batch the remote no longer accepts, if any.
+    pub fn conflict(&self) -> Result<Option<Conflict>> {
+        let connection = self.lock()?;
+        let row: Option<(i64, i64, String)> = connection
+            .query_row(
+                "SELECT id, conflict, space FROM batches WHERE conflict IS NOT NULL ORDER BY id LIMIT 1",
+                [],
+                |row| Ok((row.get(0)?, row.get(1)?, row.get(2)?)),
+            )
+            .optional()?;
+        row.map(|(batch, kind, space)| {
+            Ok(Conflict {
+                id: newest(&connection, batch)?,
+                space: space.parse()?,
+                kind: ConflictKind::from_stored(kind)?,
+            })
+        })
+        .transpose()
     }
-    /// Reconciles one pending edit, or refreshes the working image when the queue is empty.
+    /// Publishes the oldest unpublished batch, rebasing the queue first when the remote
-    /// Network I/O holds synchronization ownership without holding the cache mutex.
+    /// changed. Reads the remote image only when its stamp moved; network I/O holds
-    /// Uncertain edits are never replayed; retired formatting may confirm its complete observed effect.
+    /// synchronization ownership without holding the cache mutex. Uncertain attempts are
-    pub fn sync_once(&self, remote: &mut impl Remote) -> Result<Option<(u64, EditStatus)>> {
+    /// never replayed.
+    pub fn sync_once(&self, remote: &mut impl Remote) -> Result<Synced> {
         let _owner = self.sync_owner()?;
-        struct Step<'a>(&'a Replica);
+        let state = state(&*self.lock()?)?;
-        impl Drop for Step<'_> {
+        let observed = remote.stamp().map_err(Error::RemoteIo)?;
-            fn drop(&mut self) {
+        if let (Some(observed), Some(blocked)) = (&observed, &state.blocked)
-                self.0.in_flight.store(0, Ordering::Release);
+            && Some(observed) == state.remote.as_ref().or(Some(&state.base))
-            }
+        {
+            // Nothing new to decide: the remote is as it was when the batch blocked.
+            let id = newest(&*self.lock()?, blocked.batch)?;
+            return Ok(Synced {
+                edit: Some((
+                    id,
+                    status(&*self.lock()?, id)?.unwrap_or(EditStatus::Pending),
+                )),
+                changed: Vec::new(),
+            });
         }
-        let _step = Step(self);
+        let image = match observed {
-        let base = self.remote_snapshot()?;
+            Some(observed) if observed == state.base => None,
-        let changed = match remote.stamp().map_err(Error::RemoteIo)? {
+            _ => {
-            Some(stamp) if stamp == Stamp::of(&base)? => None,
+                let image = remote.read().map_err(Error::RemoteIo)?;
-            _ => Some(remote.read().map_err(Error::RemoteIo)?).filter(|read| *read != base),
+                // A read image is compared whole: a stamp stands for it only when read alone.
-        };
+                let base = base::read(&*self.lock()?, base::Image::Base)?;
-        // An unchanged remote is the base image, validated when it was stored.
+                (base.as_deref() != Some(&image[..])).then_some(image)
-        let identity = changed.as_deref().map(validate).transpose()?;
-        let snapshot = changed.unwrap_or(base);
-        let (intent, attempted) = {
-            let mut connection = self
-                .connection
-                .lock()
-                .map_err(|_| io::Error::other("Cache owner panicked"))?;
-            let transaction =
-                connection.transaction_with_behavior(TransactionBehavior::Immediate)?;
-            if identity.is_none() && images::settled(&transaction)? {
-                return Ok(None);
-            }
-            let (base, working) = images::both(&transaction)?;
-            if let Some(identity) = identity
-                && RevisionIndex::parse(&Store::parse(&base)?)?.root != identity
-            {
-                return Err(io::Error::new(
-                    io::ErrorKind::InvalidInput,
-                    "Remote snapshot belongs to another document",
-                )
-                .into());
             }
-            let intent = {
-                let mut query = transaction
-                    .prepare("SELECT id, space, operation FROM edits ORDER BY id LIMIT 1")?;
-                let mut rows = query.query([])?;
-                rows.next()?.map(pending_edit).transpose()?
-            };
-            let Some(intent) = intent else {
-                images::set_base(&transaction, &base, &snapshot, &snapshot)?;
-                transaction.commit()?;
-                return Ok(None);
-            };
-            self.in_flight.store(
-                i64::try_from(intent.id).map_err(io::Error::other)?,
-                Ordering::Release,
-            );
-            let attempted = transaction
-                .query_row(
-                    "SELECT revisions FROM attempt WHERE edit_id=?1",
-                    [i64::try_from(intent.id).map_err(io::Error::other)?],
-                    |row| row.get::<_, String>(0),
-                )
-                .optional()?;
-            images::set_base(&transaction, &base, &snapshot, &working)?;
-            transaction.commit()?;
-            (intent, attempted)
         };
-        if let Some(encoded) = attempted {
+        let mut changed = Vec::new();
-            let revisions = attempted_revisions(&encoded, intent.space)?;
+        if let Some(image) = image {
-            let mut revision = revisions[&intent.space];
+            if let Some(Blocked {
-            let store = Store::parse(&snapshot)?;
+                batch,
-            let index = RevisionIndex::parse(&store)?;
+                attempted: true,
-            if !revisions.iter().all(|(space, revision)| {
+                revisions,
-                index
+                ..
-                    .spaces
+            }) = &state.blocked
-                    .get(space)
+            {
-                    .is_some_and(|space| space.revisions.contains_key(revision))
+                let id = newest(&*self.lock()?, *batch)?;
-            }) {
+                let revisions = revisions.clone().unwrap_or_default();
-                // A retired attempt confirms only when its complete effect is observed.
+                let store = Store::parse(&image)?;
-                let satisfied = match &intent.operation {
+                if !store.checksum_mismatches.is_empty() {
-                    Operation::Page(edit) if revisions.len() == 1 => {
+                    return Err(io::Error::new(
-                        page_of(&snapshot, intent.space)?.is_some_and(|page| page == edit.after)
+                        io::ErrorKind::InvalidData,
+                        "Notebook transaction checksum damage",
+                    )
+                    .into());
+                }
+                let index = RevisionIndex::parse(&store)?;
+                index.validate_current()?;
+                if index.root != self.root {
+                    return Err(io::Error::new(
+                        io::ErrorKind::InvalidInput,
+                        "Remote snapshot belongs to another document",
+                    )
+                    .into());
+                }
+                let observed = revisions.iter().all(|(space, revision)| {
+                    index
+                        .spaces
+                        .get(space)
+                        .is_some_and(|space| space.revisions.contains_key(revision))
+                });
+                let sealed = working::sealed(&*self.lock()?)?
+                    .filter(|sealed| sealed.batch == *batch)
+                    .and_then(|sealed| sealed.transaction);
+                // Without its revisions the attempt still counts once the remote holds
+                // every page it changed as it changed them; its receipts then name the
+                // remote's revisions.
+                let receipts = if observed {
+                    None
+                } else {
+                    let equal = self.holds(&image, sealed.as_ref(), &revisions)?;
+                    if !equal {
+                        base::write(&*self.lock()?, base::Image::Remote, &image)?;
+                        return Ok(Synced {
+                            edit: Some((
+                                id,
+                                status(&*self.lock()?, id)?.unwrap_or(EditStatus::Pending),
+                            )),
+                            changed,
+                        });
                     }
-                    _ => false,
+                    Some(
+                        revisions
+                            .keys()
+                            .filter_map(|space| Some((*space, index.active(*space).ok()?)))
+                            .collect(),
+                    )
                 };
-                if !satisfied {
+                if let Err(error) = remote.confirm(&image) {
-                    return Ok(Some((
+                    if error.state == CommitState::Committed {
-                        intent.id,
+                        self.acknowledge(*batch, sealed.as_ref(), receipts.as_ref())?;
-                        EditStatus::AwaitingConfirmation { revision },
+                    }
-                    )));
+                    return Err(error.into());
                 }
-                revision = index.active(intent.space)?;
+                self.acknowledge(*batch, sealed.as_ref(), receipts.as_ref())?;
+                let revision = self.receipt(id)?;
+                changed = self.rebase(Some(image), None)?.unwrap_or_default();
+                return Ok(Synced {
+                    edit: Some((id, EditStatus::Published { revision })),
+                    changed,
+                });
             }
-            if let Err(error) = remote.confirm(&snapshot) {
+            match self.rebase(Some(image), None)? {
-                if error.state == CommitState::Committed {
+                Ok(spaces) => changed = spaces,
-                    self.acknowledge(intent.id, revision, &snapshot)?;
+                Err(conflict) => {
+                    return Ok(Synced {
+                        edit: Some((conflict.id, EditStatus::Conflict(conflict.kind))),
+                        changed,
+                    });
                 }
-                return Err(error.into());
             }
-            self.acknowledge(intent.id, revision, &snapshot)?;
+        } else if let Some(blocked) = &state.blocked {
-            return Ok(Some((intent.id, EditStatus::Published { revision })));
+            if state.remote.is_some() {
+                // The remote is back at the base: what blocked the queue is gone.
+                let connection = self.lock()?;
+                base::clear(&connection, base::Image::Remote)?;
+                if blocked.conflict.is_some() {
+                    connection.execute("UPDATE batches SET conflict=NULL, space=NULL", [])?;
+                }
+            }
+            if blocked.attempted {
+                let id = newest(&*self.lock()?, blocked.batch)?;
+                return Ok(Synced {
+                    edit: Some((
+                        id,
+                        status(&*self.lock()?, id)?.unwrap_or(EditStatus::Pending),
+                    )),
+                    changed,
+                });
+            }
+            if let Some(kind) = blocked.conflict
+                && state.remote.is_none()
+            {
+                let id = newest(&*self.lock()?, blocked.batch)?;
+                return Ok(Synced {
+                    edit: Some((id, EditStatus::Conflict(kind))),
+                    changed,
+                });
+            }
+        } else if !state.queued {
+            return Ok(Synced::default());
         }
-        let candidate = match &intent.operation {
+        // The cache lock is released before the section thread, which takes it, seals.
-            Operation::Page(edit) => page_of(&snapshot, intent.space)?
+        let waiting = working::sealed(&*self.lock()?)?;
-                .ok_or(ConflictKind::TargetUnavailable)
+        let sealed = match waiting {
-                .and_then(|current| {
+            Some(sealed) => {
-                    let target = if current == edit.before {
+                if sealed.transaction.is_some() {
-                        edit.after.clone()
+                    self.lock()?
-                    } else {
+                        .execute("UPDATE batches SET attempted=1 WHERE id=?1", [sealed.batch])?;
-                        crate::merge::merge(&edit.before, &edit.after, &current)
-                            .ok_or(ConflictKind::ContentChanged)?
-                    };
-                    PreparedEdit::page(&snapshot, intent.space, &target, &edit.author)
-                        .map_err(|_| ConflictKind::UnsupportedEdit)
-                }),
-            Operation::CreatePage(page) => PreparedEdit::create_page(&snapshot, page)
-                .map_err(|_| ConflictKind::StructureChanged),
-            Operation::Pages(edit) => edit.prepare(&snapshot, intent.space)?,
-            Operation::DeletePages(pages) => {
-                let store = Store::parse(&snapshot)?;
-                let index = RevisionIndex::parse(&store)?;
-                if pages.iter().any(|page| {
-                    index
-                        .spaces
-                        .get(page)
-                        .is_none_or(|space| space.labels.is_empty())
-                }) || Document::parse(&index)?
-                    .pages()?
-                    .iter()
-                    .filter(|(sid, _)| pages.contains(sid))
-                    .count()
-                    != pages.len()
-                {
-                    Err(ConflictKind::TargetUnavailable)
-                } else {
-                    PreparedEdit::delete_pages_permanently(&snapshot, pages)
-                        .map_err(|_| ConflictKind::UnsupportedEdit)
                 }
+                Some(sealed)
             }
+            None => self.ask(|reply| Request::Seal { reply })?,
         };
-        let prepared = match candidate {
+        let Some(Sealed { batch, transaction }) = sealed else {
-            Ok(prepared) => prepared,
+            return Ok(Synced {
-            Err(kind) => {
+                edit: None,
-                let connection = self
+                changed,
-                    .connection
+            });
-                    .lock()
-                    .map_err(|_| io::Error::other("Cache owner panicked"))?;
-                connection.execute("INSERT INTO conflicts(edit_id, kind) VALUES (?1, ?2) ON CONFLICT(edit_id) DO UPDATE SET kind=excluded.kind", params![i64::try_from(intent.id).map_err(io::Error::other)?, kind as i64])?;
-                return Ok(Some((intent.id, EditStatus::Conflict(kind))));
-            }
         };
-        if prepared.as_bytes() == snapshot {
+        let id = newest(&*self.lock()?, batch)?;
-            let store = Store::parse(&snapshot)?;
+        let Some(transaction) = transaction else {
-            let index = RevisionIndex::parse(&store)?;
+            // Edits that changed nothing are published once the remote's image is durable.
-            let revision = index.active(intent.space)?;
+            let base = base::read(&*self.lock()?, base::Image::Base)?.unwrap_or_default();
-            if let Err(error) = remote.confirm(&snapshot) {
+            if let Err(error) = remote.confirm(&base) {
                 if error.state == CommitState::Committed {
-                    self.acknowledge(intent.id, revision, &snapshot)?;
+                    self.acknowledge(batch, None, None)?;
                 }
                 return Err(error.into());
             }
-            self.acknowledge(intent.id, revision, &snapshot)?;
+            self.acknowledge(batch, None, None)?;
-            return Ok(Some((intent.id, EditStatus::Published { revision })));
+            let revision = self.receipt(id)?;
-        }
+            return Ok(Synced {
-        // Once acknowledged this image is the base, which polls trust without validating.
+                edit: Some((id, EditStatus::Published { revision })),
-        validate(prepared.as_bytes())?;
+                changed,
-        let store = Store::parse(prepared.as_bytes())?;
+            });
-        let index = RevisionIndex::parse(&store)?;
+        };
-        let revision = index.active(intent.space)?;
+        match remote.publish(&transaction) {
-        let before_store = Store::parse(&snapshot)?;
-        let before = RevisionIndex::parse(&before_store)?;
-        let mut revisions: BTreeMap<_, _> = index
-            .spaces
-            .iter()
-            .filter_map(|(sid, space)| {
-                let revision = *space.labels.get(&(ExGuid::default(), 1))?;
-                (before
-                    .spaces
-                    .get(sid)
-                    .and_then(|s| s.labels.get(&(ExGuid::default(), 1)))
-                    != Some(&revision))
-                .then_some((*sid, revision))
-            })
-            .collect();
-        // The receipt's space can be unchanged in a multi-space edit.
-        revisions.insert(intent.space, revision);
-        {
-            let mut connection = self
-                .connection
-                .lock()
-                .map_err(|_| io::Error::other("Cache owner panicked"))?;
-            let transaction =
-                connection.transaction_with_behavior(TransactionBehavior::Immediate)?;
-            transaction.execute(
-                "DELETE FROM conflicts WHERE edit_id=?1",
-                [i64::try_from(intent.id).map_err(io::Error::other)?],
-            )?;
-            transaction.execute(
-                "INSERT INTO attempt(id, edit_id, revisions) VALUES (1, ?1, ?2)",
-                params![
-                    i64::try_from(intent.id).map_err(io::Error::other)?,
-                    serde_json::to_string(&revisions).map_err(io::Error::other)?
-                ],
-            )?;
-            transaction.commit()?;
-        }
-        match remote.publish(&prepared.transaction()) {
             Ok(()) => {}
             Err(error) if error.state == CommitState::NotCommitted => {
-                let connection = self
+                self.lock()?
-                    .connection
+                    .execute("UPDATE batches SET attempted=0 WHERE id=?1", [batch])?;
-                    .lock()
-                    .map_err(|_| io::Error::other("Cache owner panicked"))?;
-                connection.execute(
-                    "DELETE FROM attempt WHERE edit_id=?1",
-                    [i64::try_from(intent.id).map_err(io::Error::other)?],
-                )?;
                 return Err(error.into());
             }
             Err(error) if error.state == CommitState::Committed => {
-                self.acknowledge(intent.id, revision, prepared.as_bytes())?;
+                self.acknowledge(batch, Some(&transaction), None)?;
                 return Err(error.into());
             }
             Err(error) => return Err(error.into()),
         }
-        self.acknowledge(intent.id, revision, prepared.as_bytes())?;
+        self.acknowledge(batch, Some(&transaction), None)?;
-        Ok(Some((intent.id, EditStatus::Published { revision })))
+        let revision = self.receipt(id)?;
+        Ok(Synced {
+            edit: Some((id, EditStatus::Published { revision })),
+            changed,
+        })
     }
-    /// Repositions an unattempted page-creation conflict, retaining dependent object identities.
+    /// Whether `image` holds every page in `revisions` as the base with `sealed` has it.
-    pub fn rebase_page_creation_conflict(
+    fn holds(
         &self,
-        id: u64,
+        image: &[u8],
-        local: &[u8],
+        sealed: Option<&Transaction>,
-        remote: &[u8],
+        revisions: &BTreeMap<ExGuid, ExGuid>,
-        before: Option<ExGuid>,
+    ) -> Result<bool> {
-    ) -> Result<()> {
+        let base = base::read(&*self.lock()?, base::Image::Base)?.ok_or_else(|| {
-        self.resolve_conflict(id, local, remote, |intent| {
+            io::Error::new(io::ErrorKind::InvalidData, "The cache has no base image")
-            let Operation::CreatePage(page) = intent.operation else {
+        })?;
-                return Err(io::Error::new(
+        let (local, remote) = (onestore::Arena::default(), onestore::Arena::default());
-                    io::ErrorKind::InvalidInput,
+        let mut local = onestore::Section::open(&local, base)?;
-                    "Select a page-creation conflict",
+        if let Some(sealed) = sealed {
-                )
+            local.replay(sealed)?;
-                .into());
+        }
-            };
+        let remote = onestore::Section::open(&remote, image.to_vec())?;
-            let page = page.reposition(before)?;
+        Ok(revisions.keys().all(
-            PreparedEdit::create_page(remote, &page)?;
+            |space| matches!((local.page(*space), remote.page(*space)), (Ok(a), Ok(b)) if a == b),
-            Ok(Operation::CreatePage(page))
+        ))
-        })
     }
-    /// Reviews a page batch against both cache images, retaining its page and series identities.
+    /// Asks the section thread to replay the queue on `image`; `Err` is the conflict found.
-    pub fn rebase_pages_conflict(
+    fn rebase(
         &self,
-        id: u64,
+        image: Option<Vec<u8>>,
-        local: &[u8],
+        resolve: Option<Resolve>,
-        remote: &[u8],
+    ) -> Result<std::result::Result<Vec<ExGuid>, Conflict>> {
-        edits: &[onestore::PageEdit],
+        Ok(
-    ) -> Result<()> {
+            match self.ask(|reply| Request::Rebase {
-        self.resolve_conflict(id, local, remote, |intent| {
+                image,
-            let Operation::Pages(batch) = intent.operation else {
+                resolve,
-                return Err(io::Error::new(
+                reply,
-                    io::ErrorKind::InvalidInput,
+            })? {
-                    "Select a page movement or indentation conflict",
+                Rebased::Applied { changed } => Ok(changed),
-                )
+                Rebased::Conflict { id, space, kind } => Err(Conflict { id, space, kind }),
-                .into());
+            },
-            };
+        )
-            Ok(Operation::Pages(batch.review(
-                remote,
-                intent.space,
-                edits,
-            )?))
-        })
     }
-    /// Replaces a conflicting page save with a model reviewed against the remote page.
+    fn receipt(&self, id: u64) -> Result<ExGuid> {
-    /// Both supplied images must match `snapshot` and `remote_snapshot`; the reviewed
+        match status(&*self.lock()?, id)? {
-    /// model must publish against the remote image, and its author is retained.
+            Some(EditStatus::Published { revision }) => Ok(revision),
-    pub fn review_page(&self, id: u64, local: &[u8], remote: &[u8], after: &Page) -> Result<()> {
+            _ => Err(io::Error::other("A published edit has no receipt").into()),
-        self.resolve_conflict(id, local, remote, |intent| {
+        }
-            let Operation::Page(edit) = intent.operation else {
-                return Err(io::Error::new(
-                    io::ErrorKind::InvalidInput,
-                    "Select a page save conflict",
-                )
-                .into());
-            };
-            let before = page_of(remote, intent.space)?.ok_or_else(|| {
-                io::Error::new(
-                    io::ErrorKind::InvalidInput,
-                    "The page is no longer in the remote section",
-                )
-            })?;
-            PreparedEdit::page(remote, intent.space, after, &edit.author)?;
-            Ok(Operation::Page(PageIntent {
-                before,
-                after: after.clone(),
-                author: edit.author,
-            }))
-        })
     }
-    /// Retires the oldest edit's uncertain attempt after review. The branch is first
+    /// Records a published batch: the base becomes the image it left, each of its edits
-    /// exported to `archive` (a new file), which is the record: no receipt is written.
+    /// gets a receipt naming the revisions its seal stored, or `revisions`, and it leaves
-    /// `Some(after)` continues from the reviewed page as a fresh intent against the
+    /// the queue.
-    /// current remote page, keeping the edit's id and its dependents; `None` abandons
+    fn acknowledge(
-    /// the whole local branch, whose edits become `Archived`, and the working image
-    /// returns to the remote image. Both need the reviewed images to be current.
-    pub fn release_attempt(
         &self,
-        id: u64,
+        batch: i64,
-        local: &[u8],
+        transaction: Option<&Transaction>,
-        remote: &[u8],
+        revisions: Option<&BTreeMap<ExGuid, ExGuid>>,
-        archive: &Path,
-        after: Option<&Page>,
     ) -> Result<()> {
+        let mut connection = self.lock()?;
+        let database = connection.transaction_with_behavior(TransactionBehavior::Immediate)?;
+        if let Some(transaction) = transaction {
+            base::publish(&database, transaction)?;
+        }
+        let revisions = match revisions {
+            Some(revisions) => revisions.clone(),
+            None => decode_revisions(&database.query_row(
+                "SELECT revisions FROM batches WHERE id=?1",
+                [batch],
+                |row| row.get::<_, String>(0),
+            )?)?,
+        };
+        for queued in queue::load(&database, Some(batch))? {
+            database.execute(
+                "INSERT INTO receipts(edit_id, revision) VALUES (?1, ?2)",
+                params![
+                    signed(queued.id)?,
+                    revision_of(&queued.edit, &revisions)?.to_string()
+                ],
+            )?;
+        }
+        database.execute("DELETE FROM batches WHERE id=?1", [batch])?;
+        queue::collect(&database)?;
+        database.commit()?;
+        Ok(())
+    }
+    /// Resolves the conflict holding edit `id`: the batch and everything queued after it
+    /// drop their ops on the conflicted page; `Mine` rewrites the remote page to the local
+    /// one first. A conflict on another page may follow.
+    pub fn resolve(&self, id: u64, resolution: Resolution) -> Result<()> {
+        self.resolve_with(id, resolution, None)
+    }
+    pub(crate) fn resolve_with(&self, id: u64, keep: Resolution, page: Option<Page>) -> Result<()> {
         let owner = self.sync_owner()?;
-        let intent = self
+        let (first, space) = {
-            .pending()?
+            let connection = self.lock()?;
-            .into_iter()
+            let row: Option<(i64, String)> = connection
-            .next()
+                .query_row(
-            .filter(|intent| intent.id == id)
+                    "SELECT (SELECT min(id) FROM edits WHERE batch=batches.id), space FROM batches
-            .ok_or_else(|| {
+                     WHERE conflict IS NOT NULL AND id=(SELECT batch FROM edits WHERE id=?1)",
-                io::Error::new(
+                    [signed(id)?],
+                    |row| Ok((row.get(0)?, row.get(1)?)),
+                )
+                .optional()?;
+            let Some((first, space)) = row else {
+                return Err(io::Error::new(
                     io::ErrorKind::InvalidInput,
-                    "Only the oldest edit can hold an attempt",
+                    "The edit is not in conflict",
                 )
-            })?;
+                .into());
-        let continued = match after {
+            };
-            Some(after) => {
+            (unsigned(first)?, space.parse()?)
-                let Operation::Page(edit) = intent.operation else {
-                    return Err(io::Error::new(
-                        io::ErrorKind::InvalidInput,
-                        "Select a page save to continue from",
-                    )
-                    .into());
-                };
-                let before = page_of(remote, intent.space)?.ok_or_else(|| {
-                    io::Error::new(
-                        io::ErrorKind::InvalidInput,
-                        "The page is no longer in the remote section",
-                    )
-                })?;
-                PreparedEdit::page(remote, intent.space, after, &edit.author)?;
-                Some(Operation::Page(PageIntent {
-                    before,
-                    after: after.clone(),
-                    author: edit.author,
-                }))
-            }
-            None => None,
         };
-        let mut connection = self
+        // A conflict on another page is recorded like any other.
-            .connection
+        let _ = self.rebase(
-            .lock()
+            None,
-            .map_err(|_| io::Error::other("Cache owner panicked"))?;
+            Some(Resolve {
-        let transaction = connection.transaction_with_behavior(TransactionBehavior::Immediate)?;
+                first,
-        let (base, working) = images::both(&transaction)?;
+                space,
-        if working != local || base != remote {
+                keep,
-            return Err(io::Error::new(
+                page,
-                io::ErrorKind::ResourceBusy,
+            }),
-                "The reviewed cache images changed",
-            )
-            .into());
-        }
-        let id = i64::try_from(id).map_err(io::Error::other)?;
-        let attempted: bool = transaction.query_row(
-            "SELECT EXISTS(SELECT 1 FROM attempt WHERE edit_id=?1)",
-            [id],
-            |row| row.get(0),
         )?;
-        if !attempted {
-            return Err(io::Error::new(
-                io::ErrorKind::InvalidInput,
-                "The edit has no uncertain attempt",
-            )
-            .into());
-        }
-        drop(transaction);
-        drop(connection);
-        self.export_recovery(archive)?;
-        let mut connection = self
-            .connection
-            .lock()
-            .map_err(|_| io::Error::other("Cache owner panicked"))?;
-        let transaction = connection.transaction_with_behavior(TransactionBehavior::Immediate)?;
-        transaction.execute("DELETE FROM attempt WHERE edit_id=?1", [id])?;
-        match continued {
-            Some(operation) => {
-                transaction.execute(
-                    "UPDATE edits SET operation=?1 WHERE id=?2",
-                    params![
-                        serde_json::to_string(&operation).map_err(io::Error::other)?,
-                        id
-                    ],
-                )?;
-            }
-            None => {
-                transaction.execute(
-                    "INSERT INTO archived(edit_id, archive) SELECT id, ?1 FROM edits",
-                    [archive.to_string_lossy().into_owned()],
-                )?;
-                transaction.execute("DELETE FROM edits", [])?;
-                transaction.execute("UPDATE replica SET working=x'' WHERE id=1", [])?;
-            }
-        }
-        transaction.commit()?;
-        drop(connection);
         drop(owner);
         self.wake_sync();
         Ok(())
     }
-    fn resolve_conflict(
+    /// Retires the uncertain attempt of the batch holding edit `id` after review. The
-        &self,
+    /// queue is first exported to `archive` (a new file), which is the record: no receipt
-        id: u64,
+    /// is written. `Mine` publishes the batch again against the current remote; `Theirs`
-        local: &[u8],
+    /// abandons every unpublished edit, which become `Archived`, and the local pages return
-        remote: &[u8],
+    /// to the remote's.
-        update: impl FnOnce(PendingEdit) -> Result<Operation>,
+    pub fn release(&self, id: u64, archive: &Path, resolution: Resolution) -> Result<()> {
-    ) -> Result<()> {
         let owner = self.sync_owner()?;
-        let intent = self
+        let batch: Option<i64> = self
-            .pending()?
+            .lock()?
-            .into_iter()
+            .query_row(
-            .next()
+                "SELECT id FROM batches WHERE attempted=1 AND id=(SELECT batch FROM edits WHERE id=?1)",
-            .filter(|intent| intent.id == id)
+                [signed(id)?],
-            .ok_or_else(|| {
+                |row| row.get(0),
-                io::Error::new(
-                    io::ErrorKind::InvalidInput,
-                    "Only the oldest conflict can be rebased",
-                )
-            })?;
-        let operation = update(intent)?;
-        let mut connection = self
-            .connection
-            .lock()
-            .map_err(|_| io::Error::other("Cache owner panicked"))?;
-        let transaction = connection.transaction_with_behavior(TransactionBehavior::Immediate)?;
-        let (base, working) = images::both(&transaction)?;
-        if working != local || base != remote {
-            return Err(io::Error::new(
-                io::ErrorKind::ResourceBusy,
-                "The reviewed cache images changed",
             )
-            .into());
+            .optional()?;
-        }
+        let Some(batch) = batch else {
-        let id = i64::try_from(id).map_err(io::Error::other)?;
-        let eligible: bool = transaction.query_row(
-            "SELECT EXISTS(SELECT 1 FROM conflicts WHERE edit_id=?1) AND NOT EXISTS(SELECT 1 FROM attempt)",
-            [id], |row| row.get(0),
-        )?;
-        if !eligible {
             return Err(io::Error::new(
                 io::ErrorKind::InvalidInput,
-                "The edit is not an unattempted conflict",
+                "The edit has no uncertain attempt",
             )
             .into());
+        };
+        self.export_recovery(archive)?;
+        {
+            let mut connection = self.lock()?;
+            let transaction =
+                connection.transaction_with_behavior(TransactionBehavior::Immediate)?;
+            match resolution {
+                Resolution::Mine => {
+                    transaction.execute("UPDATE batches SET attempted=0 WHERE id=?1", [batch])?;
+                }
+                Resolution::Theirs => {
+                    transaction.execute(
+                        "INSERT INTO archived(edit_id, archive) SELECT id, ?1 FROM edits",
+                        [archive.to_string_lossy().into_owned()],
+                    )?;
+                    transaction.execute("DELETE FROM batches", [])?;
+                    if let Some(remote) = base::read(&transaction, base::Image::Remote)? {
+                        base::write(&transaction, base::Image::Base, &remote)?;
+                        base::clear(&transaction, base::Image::Remote)?;
+                    }
+                    queue::collect(&transaction)?;
+                }
+            }
+            transaction.commit()?;
+        }
+        if resolution == Resolution::Theirs {
+            self.ask(|reply| Request::Reopen { reply })?;
         }
-        transaction.execute(
-            "UPDATE edits SET operation=?1 WHERE id=?2",
-            params![
-                serde_json::to_string(&operation).map_err(io::Error::other)?,
-                id
-            ],
-        )?;
-        transaction.execute("DELETE FROM conflicts WHERE edit_id=?1", [id])?;
-        transaction.commit()?;
-        drop(connection);
         drop(owner);
         self.wake_sync();
         Ok(())
 @@ -556,34 +610,25 @@ impl Replica {
             })?)
     }
-    fn acknowledge(&self, id: u64, revision: ExGuid, snapshot: &[u8]) -> Result<()> {
+    /// Whether nothing is queued and the remote still has the base's stamp, or the queue
-        let id = i64::try_from(id).map_err(io::Error::other)?;
+    /// is blocked on a remote that has not changed since; reads neither image and does not
-        let mut connection = self
+    /// lock the cache during remote I/O.
-            .connection
+    pub(crate) fn settled(&self, remote: &mut impl Remote) -> Result<bool> {
-            .lock()
+        let state = state(&*self.lock()?)?;
-            .map_err(|_| io::Error::other("Cache owner panicked"))?;
+        let expected = match &state.blocked {
-        let transaction = connection.transaction_with_behavior(TransactionBehavior::Immediate)?;
+            Some(_) => state.remote.unwrap_or(state.base),
-        transaction.execute(
+            None if !state.queued => state.base,
-            "INSERT INTO receipts(edit_id, revision) VALUES (?1, ?2)",
+            None => return Ok(false),
-            params![id, revision.to_string()],
+        };
-        )?;
+        let Some(stamp) = remote.stamp().map_err(Error::RemoteIo)? else {
-        transaction.execute("DELETE FROM edits WHERE id=?1", [id])?;
+            return Ok(false);
-        let (base, working) = images::both(&transaction)?;
+        };
-        let pending: bool =
+        Ok(stamp == expected)
-            transaction.query_row("SELECT EXISTS(SELECT 1 FROM edits)", [], |row| row.get(0))?;
-        images::set_base(
-            &transaction,
-            &base,
-            snapshot,
-            if pending { &working } else { snapshot },
-        )?;
-        transaction.commit()?;
-        Ok(())
     }
 }
 pub(crate) fn status(connection: &Connection, id: u64) -> Result<Option<EditStatus>> {
-    let id = i64::try_from(id).map_err(io::Error::other)?;
+    let id = signed(id)?;
     if let Some(revision) = connection
         .query_row(
             "SELECT revision FROM receipts WHERE edit_id=?1",
 @@ -606,46 +651,26 @@ pub(crate) fn status(connection: &Connection, id: u64) -> Result<Option<EditStat
     {
         return Ok(Some(EditStatus::Archived { archive }));
     }
-    let record: Option<(Option<String>, Option<i64>, String)> = connection.query_row(
+    let record: Option<(bool, Option<i64>, Option<String>, String)> = connection
-        "SELECT attempt.revisions, conflicts.kind, edits.space FROM edits LEFT JOIN attempt ON attempt.edit_id=edits.id LEFT JOIN conflicts ON conflicts.edit_id=edits.id WHERE edits.id=?1", [id], |row| Ok((row.get(0)?,row.get(1)?, row.get(2)?))).optional()?;
+        .query_row(
+            "SELECT batches.attempted, batches.conflict, batches.revisions, edits.edit
+             FROM edits JOIN batches ON batches.id=edits.batch WHERE edits.id=?1",
+            [id],
+            |row| Ok((row.get(0)?, row.get(1)?, row.get(2)?, row.get(3)?)),
+        )
+        .optional()?;
     Ok(match record {
         None => None,
-        Some((Some(revision), _, space)) => Some(EditStatus::AwaitingConfirmation {
+        Some((true, _, revisions, edit)) => {
-            revision: {
+            let revisions = decode_revisions(revisions.as_deref().unwrap_or("{}"))?;
-                let space = space.parse()?;
+            let edit: onestore::op::Edit = serde_json::from_str(&edit)
-                attempted_revisions(&revision, space)?[&space]
+                .map_err(|error| io::Error::new(io::ErrorKind::InvalidData, error))?;
-            },
+            let revision = revision_of(&edit, &revisions)?;
-        }),
+            Some(EditStatus::AwaitingConfirmation { revision })
-        Some((None, Some(kind), _)) => Some(EditStatus::Conflict(match kind {
+        }
-            0 => ConflictKind::TargetUnavailable,
+        Some((false, Some(kind), ..)) => {
-            1 => ConflictKind::UnsupportedEdit,
+            Some(EditStatus::Conflict(ConflictKind::from_stored(kind)?))
-            2 => ConflictKind::StructureChanged,
+        }
-            3 => ConflictKind::ContentChanged,
+        Some((false, None, ..)) => Some(EditStatus::Pending),
-            _ => {
-                return Err(io::Error::new(
-                    io::ErrorKind::InvalidData,
-                    "Unknown cached conflict kind",
-                )
-                .into());
-            }
-        })),
-        Some((None, None, _)) => Some(EditStatus::Pending),
     })
 }
-fn attempted_revisions(encoded: &str, space: ExGuid) -> Result<BTreeMap<ExGuid, ExGuid>> {
-    let revisions: BTreeMap<ExGuid, ExGuid> = serde_json::from_str(encoded)
-        .map_err(|error| io::Error::new(io::ErrorKind::InvalidData, error))?;
-    if !revisions.contains_key(&space)
-        || revisions
-            .iter()
-            .any(|(sid, rid)| sid.guid == [0; 16] || rid.guid == [0; 16])
-    {
-        return Err(io::Error::new(
-            io::ErrorKind::InvalidData,
-            "Cached publication evidence is incomplete",
-        )
-        .into());
-    }
-    Ok(revisions)
-}

crates/notebook/src/worker.rs+15-10

 @@ -61,7 +61,8 @@ impl Drop for SyncWorker {
 impl Replica {
     /// Starts one worker, reconnecting through `connect` after transport failures.
     /// Local edits wake it; `interval` controls idle polling and transport retries. While
-    /// nothing is queued, a remote whose `stamp` holds is not read again.
+    /// nothing is queued, or the queue waits on a remote that has not changed since, a
+    /// remote whose `stamp` holds is not read again.
     /// Contended operations returning `NotCommitted` also back off by up to one second.
     /// `observe` runs on the worker after each attempt, including connection errors.
     /// Cache/document errors stop the worker; inspect them through `observe` or `stop`.
 @@ -75,7 +76,7 @@ impl Replica {
     where
         R: Remote + 'static,
         F: FnMut() -> io::Result<R> + Send + 'static,
-        O: FnMut(&Result<Option<(u64, EditStatus)>>) + Send + 'static,
+        O: FnMut(&Result<Synced>) + Send + 'static,
     {
         if interval.is_zero() || Instant::now().checked_add(interval).is_none() {
             return Err(io::Error::new(
 @@ -103,18 +104,19 @@ impl Replica {
                 let mut remote: Option<R> = None;
                 let jitter = RandomState::new();
                 let mut contention = 0_u32;
-                // The first attempt always runs, so `observe` hears once that the remote is
+                // The first step, and the first after a failure, always runs, so `observe`
-                // reachable.
+                // hears that the remote is reachable and what state the queue is in.
-                let mut attempted = false;
+                let mut reported = false;
                 while !worker_signal.stopped.load(Ordering::Acquire) {
                     let result = match remote.as_mut() {
                         Some(remote) => {
-                            if attempted && replica.settled(remote).unwrap_or(false) {
+                            if reported && replica.settled(remote).unwrap_or(false) {
                                 let _ = receiver.recv_timeout(interval);
                                 continue;
                             }
-                            attempted = true;
+                            let result = replica.sync_once(remote);
-                            replica.sync_once(remote)
+                            reported = result.is_ok();
+                            result
                         }
                         None => match connect() {
                             Ok(connected) => {
 @@ -126,11 +128,14 @@ impl Replica {
                     };
                     observe(&result);
                     match result {
-                        Ok(Some((_, EditStatus::Published { .. }))) => {
+                        Ok(Synced {
+                            edit: Some((_, EditStatus::Published { .. })),
+                            ..
+                        }) => {
                             contention = 0;
                             continue;
                         }
-                        Ok(None) => contention = 0,
+                        Ok(Synced { edit: None, .. }) => contention = 0,
                         Ok(_) => {}
                         Err(Error::Remote(onestore::CommitError {
                             state: onestore::CommitState::NotCommitted,

crates/notebook/src/working.rs created+776

...	@@ -0,0 +1,776 @@
1	//! The section thread: the only owner of the parsed section, which is the cached base
2	//! image with each sealed batch replayed and the open batch's edits applied. Edits apply
3	//! here and are written in one SQLite transaction per burst; the sync thread asks it to seal
4	//! and, when the remote changed, to rebase the queue.
5
6	use crate::{
7	ConflictKind, Resolution, Result, base, lock, merge, queue, session::Save, signed,
8	worker::Signal,
9	};
10	use onestore::{
11	Arena, ExGuid, Section, Transaction,
12	op::{Edit, Op, OpError},
13	page::Page,
14	};
15	use rusqlite::{Connection, OptionalExtension, TransactionBehavior, params};
16	use std::{
17	collections::{BTreeMap, BTreeSet, VecDeque},
18	io,
19	sync::{Arc, Mutex, Weak, mpsc},
20	thread,
21	};
22
23	pub(crate) type Reply<T> = Box<dyn FnOnce(Result<T>) + Send>;
24
25	pub(crate) enum Request {
26	Apply {
27	author: String,
28	edit: Edit,
29	reply: Reply<u64>,
30	},
31	/// A whole-page save of the old session API: `None` answers a save a later one
32	/// continuing it absorbed.
33	Save {
34	space: ExGuid,
35	before: Page,
36	after: Page,
37	author: String,
38	reply: Reply<Option<Save>>,
39	},
40	Page {
41	space: ExGuid,
42	reply: Reply<Page>,
43	},
44	Pages {
45	reply: Reply<Vec<(ExGuid, String, u32)>>,
46	},
47	Image {
48	reply: Reply<Vec<u8>>,
49	},
50	/// Seals the open batch, when no sealed batch waits for publication, recording the
51	/// attempt to publish it.
52	Seal {
53	reply: Reply<Option<Sealed>>,
54	},
55	/// Replays the queue on `image` (the stored remote image, or the base, when `None`).
56	Rebase {
57	image: Option<Vec<u8>>,
58	resolve: Option<Resolve>,
59	reply: Reply<Rebased>,
60	},
61	/// Rereads the queue after the sync thread replaced it.
62	Reopen {
63	reply: Reply<()>,
64	},
65	}
66
67	/// A sealed batch: the transaction publishing it, or none when its edits changed nothing.
68	pub(crate) struct Sealed {
69	pub batch: i64,
70	pub transaction: Option<Transaction>,
71	}
72
73	/// A conflict's resolution: the batch it holds and every later edit drop their ops on
74	/// `space`; `Mine` first rewrites the rebased page to the local one (or to `page`).
75	pub(crate) struct Resolve {
76	pub first: u64,
77	pub space: ExGuid,
78	pub keep: Resolution,
79	pub page: Option<Page>,
80	}
81
82	pub(crate) enum Rebased {
83	/// The queue now applies to the image, which is the base; these pages changed.
84	Applied { changed: Vec<ExGuid> },
85	/// The batch holding edit `id` no longer applies; nothing changed but the record.
86	Conflict {
87	id: u64,
88	space: ExGuid,
89	kind: ConflictKind,
90	},
91	}
92
93	impl Request {
94	fn fail(self, message: &str) {
95	let error = \|\| io::Error::other(message.to_owned()).into();
96	match self {
97	Self::Apply { reply, .. } => reply(Err(error())),
98	Self::Save { reply, .. } => reply(Err(error())),
99	Self::Page { reply, .. } => reply(Err(error())),
100	Self::Pages { reply } => reply(Err(error())),
101	Self::Image { reply } => reply(Err(error())),
102	Self::Seal { reply } => reply(Err(error())),
103	Self::Rebase { reply, .. } => reply(Err(error())),
104	Self::Reopen { reply } => reply(Err(error())),
105	}
106	}
107	}
108
109	type Worker = Arc<Mutex<Weak<Signal>>>;
110
111	/// Starts the section thread once the queue opens.
112	pub(crate) fn spawn(
113	connection: Arc<Mutex<Connection>>,
114	worker: Worker,
115	) -> Result<(mpsc::Sender<Request>, thread::JoinHandle<()>, ExGuid)> {
116	let (sender, receiver) = mpsc::channel();
117	let (ready, opened) = mpsc::sync_channel(1);
118	let thread = thread::Builder::new()
119	.name("onestore-section".into())
120	.spawn(move \|\| run(&connection, &worker, &receiver, ready))?;
121	match opened.recv() {
122	Ok(Ok(root)) => Ok((sender, thread, root)),
123	Ok(Err(error)) => {
124	let _ = thread.join();
125	Err(error)
126	}
127	Err(_) => {
128	let _ = thread.join();
129	Err(io::Error::other("The section thread panicked").into())
130	}
131	}
132	}
133
134	enum Next {
135	Stop,
136	Reopen,
137	}
138
139	fn run(
140	connection: &Mutex<Connection>,
141	worker: &Worker,
142	requests: &mpsc::Receiver<Request>,
143	ready: mpsc::SyncSender<Result<ExGuid>>,
144	) {
145	let mut ready = Some(ready);
146	let mut backlog = VecDeque::new();
147	loop {
148	let arena = Arena::default();
149	let working = match Working::open(&arena, connection) {
150	Ok(working) => working,
151	Err(error) => {
152	let message = error.to_string();
153	if let Some(ready) = ready.take() {
154	let _ = ready.send(Err(error));
155	return;
156	}
157	for request in backlog.drain(..).chain(requests.iter()) {
158	request.fail(&message);
159	}
160	return;
161	}
162	};
163	if let Some(ready) = ready.take() {
164	let _ = ready.send(Ok(working.section.root()));
165	}
166	match working.serve(connection, worker, requests, &mut backlog) {
167	Next::Stop => return,
168	Next::Reopen => {}
169	}
170	}
171	}
172
173	/// An edit applied to the section and not yet written, with who waits for it.
174	struct Accepted {
175	author: String,
176	edit: Edit,
177	done: Done,
178	}
179
180	enum Done {
181	Apply(Reply<u64>),
182	Save(Reply<Option<Save>>),
183	}
184
185	impl Done {
186	fn reply(self, written: Result<u64>) {
187	match self {
188	Self::Apply(reply) => reply(written),
189	Self::Save(reply) => reply(written.map(\|id\| Some(Save::Queued(id)))),
190	}
191	}
192	}
193
194	struct Working<'a> {
195	section: Section<'a>,
196	/// The batch collecting edits; sealed batches before it are replayed.
197	open: Option<i64>,
198	/// Spaces the open batch's edits change.
199	touched: BTreeSet<ExGuid>,
200	/// The last whole-page save: its space, the page it was given, and the page as stored.
201	saved: Option<(ExGuid, Page, Page)>,
202	}
203
204	impl<'a> Working<'a> {
205	fn open(arena: &'a Arena, connection: &Mutex<Connection>) -> Result<Self> {
206	let (section, open, touched) = replay(arena, &*lock(connection)?)?;
207	Ok(Self {
208	section,
209	open,
210	touched,
211	saved: None,
212	})
213	}
214
215	fn serve(
216	mut self,
217	connection: &Mutex<Connection>,
218	worker: &Worker,
219	requests: &mpsc::Receiver<Request>,
220	backlog: &mut VecDeque<Request>,
221	) -> Next {
222	loop {
223	let first = match backlog.pop_front() {
224	Some(request) => request,
225	None => match requests.recv() {
226	Ok(request) => request,
227	Err(_) => return Next::Stop,
228	},
229	};
230	let mut burst: VecDeque<Request> = VecDeque::from([first]);
231	burst.extend(backlog.drain(..));
232	burst.extend(requests.try_iter());
233	let mut accepted = Vec::new();
234	while let Some(request) = burst.pop_front() {
235	let reopen = match request {
236	Request::Apply {
237	author,
238	edit,
239	reply,
240	} => self
241	.accept(
242	author,
243	edit,
244	Done::Apply(reply),
245	&mut accepted,
246	connection,
247	worker,
248	)
249	.err()
250	.unwrap_or(false),
251	Request::Save {
252	space,
253	before,
254	mut after,
255	author,
256	reply,
257	} => {
258	// Saves that continue one another are written once.
259	let mut replies = vec![reply];
260	while let Some(Request::Save {
261	space: next,
262	before: continued,
263	author: by,
264	..
265	}) = burst.front()
266	&& (*next, continued, by) == (space, &after, &author)
267	{
268	let Some(Request::Save {
269	after: later,
270	reply,
271	..
272	}) = burst.pop_front()
273	else {
274	unreachable!()
275	};
276	after = later;
277	replies.push(reply);
278	}
279	let last = replies.pop().unwrap();
280	for folded in replies {
281	folded(Ok(None));
282	}
283	match self.save(space, &before, &after) {
284	Ok(Some(edit)) => match self.accept(
285	author,
286	edit,
287	Done::Save(last),
288	&mut accepted,
289	connection,
290	worker,
291	) {
292	Ok(()) => {
293	self.saved = self
294	.section
295	.page(space)
296	.ok()
297	.map(\|stored\| (space, after, stored));
298	false
299	}
300	Err(broken) => broken,
301	},
302	Ok(None) => {
303	self.saved = self
304	.section
305	.page(space)
306	.ok()
307	.map(\|stored\| (space, after, stored));
308	last(Ok(Some(Save::Unchanged)));
309	false
310	}
311	Err(Stale::Stale) => {
312	last(Ok(Some(Save::Stale)));
313	false
314	}
315	Err(Stale::Error(error)) => {
316	last(Err(error));
317	false
318	}
319	}
320	}
321	Request::Page { space, reply } => {
322	reply(self.section.page(space).map_err(Into::into));
323	false
324	}
325	Request::Pages { reply } => {
326	reply(self.section.pages().map_err(Into::into));
327	false
328	}
329	Request::Image { reply } => {
330	if self.flush(connection, worker, &mut accepted) {
331	reply(lock(connection).and_then(\|connection\| image(&connection)));
332	false
333	} else {
334	reply(Err(
335	io::Error::other("The queue could not be written").into()
336	));
337	true
338	}
339	}
340	Request::Seal { reply } => {
341	if !self.flush(connection, worker, &mut accepted) {
342	reply(Err(
343	io::Error::other("The queue could not be written").into()
344	));
345	true
346	} else {
347	let sealed = self.seal(connection);
348	let failed = sealed.is_err();
349	reply(sealed);
350	failed
351	}
352	}
353	Request::Rebase {
354	image,
355	resolve,
356	reply,
357	} => {
358	if !self.flush(connection, worker, &mut accepted) {
359	reply(Err(
360	io::Error::other("The queue could not be written").into()
361	));
362	true
363	} else {
364	let rebased = self.rebase(connection, image, resolve);
365	let reopen = !matches!(rebased, Ok(Rebased::Conflict { .. }));
366	reply(rebased);
367	reopen
368	}
369	}
370	Request::Reopen { reply } => {
371	self.flush(connection, worker, &mut accepted);
372	reply(Ok(()));
373	true
374	}
375	};
376	if reopen {
377	backlog.extend(burst);
378	return Next::Reopen;
379	}
380	}
381	if !self.flush(connection, worker, &mut accepted) {
382	return Next::Reopen;
383	}
384	}
385	}
386
387	/// Applies an edit, keeping it to be written with the burst. A refused edit is answered
388	/// here; `Err(true)` when it failed part way and the section must be reread.
389	fn accept(
390	&mut self,
391	author: String,
392	edit: Edit,
393	done: Done,
394	accepted: &mut Vec<Accepted>,
395	connection: &Mutex<Connection>,
396	worker: &Worker,
397	) -> std::result::Result<(), bool> {
398	match self.section.apply(&author, &edit) {
399	Ok(()) => {
400	self.touched
401	.extend(queue::spaces(&edit, self.section.root()));
402	accepted.push(Accepted { author, edit, done });
403	Ok(())
404	}
405	Err(error) => {
406	let broken = matches!(error, OpError::Failed(_));
407	if broken {
408	self.flush(connection, worker, accepted);
409	}
410	done.reply(Err(error.into()));
411	Err(broken)
412	}
413	}
414	}
415
416	/// The edit that takes the stored page from `before` to `after`. A save continuing
417	/// the previous one finds the page as that one stored it, which may read back
418	/// normalized.
419	fn save(
420	&mut self,
421	space: ExGuid,
422	before: &Page,
423	after: &Page,
424	) -> std::result::Result<Option<Edit>, Stale> {
425	let current = self
426	.section
427	.page(space)
428	.map_err(\|error\| Stale::Error(error.into()))?;
429	let expected = match &self.saved {
430	Some((saved, given, stored)) if *saved == space && given == before => stored,
431	_ => before,
432	};
433	if current != *expected {
434	return Err(Stale::Stale);
435	}
436	let ops = onestore::op::lower_page(&current, after)
437	.map_err(\|error\| Stale::Error(OpError::Unsupported(error.message).into()))?;
438	Ok((!ops.is_empty()).then(\|\| Edit {
439	at: crate::now(),
440	ops: ops.into_iter().map(\|op\| Op::Page { space, op }).collect(),
441	}))
442	}
443
444	/// Writes the accepted edits in one transaction, then answers their senders; false
445	/// when the write failed and the section holds edits the queue lacks.
446	fn flush(
447	&mut self,
448	connection: &Mutex<Connection>,
449	worker: &Worker,
450	accepted: &mut Vec<Accepted>,
451	) -> bool {
452	if accepted.is_empty() {
453	return true;
454	}
455	let written = (\|\| -> Result<Vec<u64>> {
456	let mut connection = lock(connection)?;
457	let transaction =
458	connection.transaction_with_behavior(TransactionBehavior::Immediate)?;
459	let batch = match self.open {
460	Some(batch) => batch,
461	None => {
462	transaction.execute("INSERT INTO batches DEFAULT VALUES", [])?;
463	transaction.last_insert_rowid()
464	}
465	};
466	let mut ids = Vec::new();
467	for edit in accepted.iter() {
468	ids.push(queue::insert(
469	&transaction,
470	None,
471	batch,
472	&edit.author,
473	&edit.edit,
474	)?);
475	}
476	transaction.commit()?;
477	self.open = Some(batch);
478	Ok(ids)
479	})();
480	let ok = written.is_ok();
481	match written {
482	Ok(ids) => {
483	for (edit, id) in accepted.drain(..).zip(ids) {
484	edit.done.reply(Ok(id));
485	}
486	crate::wake(worker);
487	}
488	Err(error) => {
489	let message = error.to_string();
490	for edit in accepted.drain(..) {
491	edit.done
492	.reply(Err(io::Error::other(message.clone()).into()));
493	}
494	}
495	}
496	ok
497	}
498
499	/// Seals the open batch unless a sealed batch still waits for publication.
500	fn seal(&mut self, connection: &Mutex<Connection>) -> Result<Option<Sealed>> {
501	let Some(batch) = self.open else {
502	return Ok(None);
503	};
504	{
505	let connection = lock(connection)?;
506	let waiting: bool = connection.query_row(
507	"SELECT EXISTS(SELECT 1 FROM batches WHERE sealed IS NOT NULL OR conflict IS NOT NULL)",
508	[],
509	\|row\| row.get(0),
510	)?;
511	if waiting {
512	return Ok(None);
513	}
514	}
515	let transaction = self.section.seal()?;
516	// A batch whose edits change nothing is recorded against the section's root.
517	let root = self.section.root();
518	let revisions: BTreeMap<ExGuid, ExGuid> = self
519	.section
520	.revisions()
521	.filter(\|(space, _)\| {
522	self.touched.contains(space) \|\| (self.touched.is_empty() && *space == root)
523	})
524	.collect();
525	// The sync thread publishes what it seals at once: the attempt is recorded with it.
526	lock(connection)?.execute(
527	"UPDATE batches SET sealed=?1, revisions=?2, attempted=?3 WHERE id=?4",
528	params![
529	serde_json::to_string(&transaction).map_err(io::Error::other)?,
530	serde_json::to_string(&revisions).map_err(io::Error::other)?,
531	transaction.is_some(),
532	batch
533	],
534	)?;
535	self.open = None;
536	self.touched.clear();
537	Ok(Some(Sealed { batch, transaction }))
538	}
539
540	/// Replays every queued edit on `image`, keeping it as the base when all apply.
541	fn rebase(
542	&mut self,
543	connection: &Mutex<Connection>,
544	image: Option<Vec<u8>>,
545	resolve: Option<Resolve>,
546	) -> Result<Rebased> {
547	let (base_image, image, edits) = {
548	let connection = lock(connection)?;
549	if connection.query_row(
550	"SELECT EXISTS(SELECT 1 FROM batches WHERE attempted=1)",
551	[],
552	\|row\| row.get::<_, bool>(0),
553	)? {
554	return Err(io::Error::new(
555	io::ErrorKind::InvalidInput,
556	"An uncertain attempt is never rebased",
557	)
558	.into());
559	}
560	let base_image = base::read(&connection, base::Image::Base)?.ok_or_else(\|\| {
561	io::Error::new(io::ErrorKind::InvalidData, "The cache has no base image")
562	})?;
563	let image = match image {
564	Some(image) => image,
565	None => base::read(&connection, base::Image::Remote)?
566	.unwrap_or_else(\|\| base_image.clone()),
567	};
568	(base_image, image, queue::load(&connection, None)?)
569	};
570	// The page the local edits leave, which `Mine` rewrites the remote page to; the
571	// root space lists pages and holds none.
572	let target = match &resolve {
573	Some(Resolve {
574	keep: Resolution::Mine,
575	page: None,
576	space,
577	..
578	}) if space != self.section.root() => Some(self.section.page(space)?),
579	Some(Resolve { page, .. }) => page.clone(),
580	None => None,
581	};
582	let old_arena = Arena::default();
583	let mut old = Section::open(&old_arena, base_image.clone())?;
584	let before: BTreeMap<ExGuid, ExGuid> = old.revisions().collect();
585	let mut after: BTreeMap<ExGuid, ExGuid>;
586	// Pages the remote already holds as the local edits leave them: their ops are done.
587	let mut converged = BTreeSet::new();
588	let outcome = loop {
589	let arena = Arena::default();
590	let mut new = Section::open(&arena, image.clone())?;
591	if old.root() != new.root() {
592	return Err(io::Error::new(
593	io::ErrorKind::InvalidInput,
594	"Remote snapshot belongs to another document",
595	)
596	.into());
597	}
598	after = new.revisions().collect();
599	let outcome = merge::rebase(
600	&mut old,
601	&mut new,
602	&edits,
603	&converged,
604	resolve.as_ref().map(\|resolve\| merge::Resolving {
605	first: resolve.first,
606	space: resolve.space,
607	mine: resolve.keep == Resolution::Mine,
608	target: target.as_ref(),
609	}),
610	)?;
611	if let merge::Outcome::Conflict { space, .. } = &outcome
612	&& !converged.contains(space)
613	&& let Ok(local) = self.section.page(*space)
614	&& Section::open(&Arena::default(), image.clone())?
615	.page(*space)
616	.is_ok_and(\|remote\| remote == local)
617	{
618	converged.insert(*space);
619	continue;
620	}
621	break outcome;
622	};
623	let mut connection = lock(connection)?;
624	let transaction = connection.transaction_with_behavior(TransactionBehavior::Immediate)?;
625	let rebased = match outcome {
626	merge::Outcome::Conflict { id, space, kind } => {
627	transaction.execute("UPDATE batches SET conflict=NULL, space=NULL", [])?;
628	transaction.execute(
629	"UPDATE batches SET conflict=?1, space=?2 WHERE id=(SELECT batch FROM edits WHERE id=?3)",
630	params![kind as i64, space.to_string(), signed(id)?],
631	)?;
632	if image == base_image {
633	base::clear(&transaction, base::Image::Remote)?;
634	} else {
635	base::write(&transaction, base::Image::Remote, &image)?;
636	}
637	// A conflict is reported under its batch's newest edit.
638	let id = crate::unsigned(transaction.query_row(
639	"SELECT max(id) FROM edits WHERE batch=(SELECT batch FROM edits WHERE id=?1)",
640	[signed(id)?],
641	\|row\| row.get(0),
642	)?)?;
643	Rebased::Conflict { id, space, kind }
644	}
645	merge::Outcome::Applied(rewritten) => {
646	base::write(&transaction, base::Image::Base, &image)?;
647	base::clear(&transaction, base::Image::Remote)?;
648	transaction.execute("INSERT INTO batches DEFAULT VALUES", [])?;
649	let batch = transaction.last_insert_rowid();
650	transaction.execute("UPDATE edits SET batch=?1", [batch])?;
651	transaction.execute("DELETE FROM batches WHERE id<>?1", [batch])?;
652	for (id, edit) in rewritten {
653	queue::rewrite(&transaction, id, &edit)?;
654	}
655	if transaction
656	.query_row("SELECT count(*) FROM edits", [], \|row\| row.get::<_, i64>(0))?
657	== 0
658	{
659	transaction.execute("DELETE FROM batches", [])?;
660	}
661	queue::collect(&transaction)?;
662	let mut changed: BTreeSet<ExGuid> = before
663	.iter()
664	.filter(\|(space, rid)\| after.get(space) != Some(rid))
665	.map(\|(space, _)\| *space)
666	.chain(
667	after
668	.keys()
669	.filter(\|space\| !before.contains_key(space))
670	.copied(),
671	)
672	.collect();
673	changed.extend(resolve.as_ref().map(\|resolve\| resolve.space));
674	changed.extend(converged);
675	Rebased::Applied {
676	changed: changed.into_iter().collect(),
677	}
678	}
679	};
680	transaction.commit()?;
681	Ok(rebased)
682	}
683	}
684
685	enum Stale {
686	Stale,
687	Error(crate::Error),
688	}
689
690	/// Batches in order with their sealed transactions: `None` while open, `Some(None)` when
691	/// sealing stored nothing.
692	fn batches(connection: &Connection) -> Result<Vec<(i64, Option<Option<Transaction>>)>> {
693	let mut query = connection.prepare("SELECT id, sealed FROM batches ORDER BY id")?;
694	let mut rows = query.query([])?;
695	let mut batches = Vec::new();
696	while let Some(row) = rows.next()? {
697	let sealed: Option<String> = row.get(1)?;
698	batches.push((
699	row.get(0)?,
700	sealed
701	.map(\|sealed\| serde_json::from_str(&sealed))
702	.transpose()
703	.map_err(\|error\| io::Error::new(io::ErrorKind::InvalidData, error))?,
704	));
705	}
706	Ok(batches)
707	}
708
709	/// The cached base with each sealed batch replayed and the open batch's edits applied,
710	/// with the open batch and the spaces its edits change.
711	fn replay<'a>(
712	arena: &'a Arena,
713	connection: &Connection,
714	) -> Result<(Section<'a>, Option<i64>, BTreeSet<ExGuid>)> {
715	let image = base::read(connection, base::Image::Base)?
716	.ok_or_else(\|\| io::Error::new(io::ErrorKind::InvalidData, "The cache has no base image"))?;
717	let mut section = Section::open(arena, image)?;
718	let mut open = None;
719	let mut touched = BTreeSet::new();
720	for (batch, sealed) in batches(connection)? {
721	if open.is_some() {
722	return Err(io::Error::new(
723	io::ErrorKind::InvalidData,
724	"A cached batch follows the open batch",
725	)
726	.into());
727	}
728	match sealed {
729	Some(Some(transaction)) => section.replay(&transaction)?,
730	Some(None) => {}
731	None => {
732	for queued in queue::load(connection, Some(batch))? {
733	section
734	.apply(&queued.author, &queued.edit)
735	.map_err(\|error\| {
736	io::Error::new(
737	io::ErrorKind::InvalidData,
738	format!("Queued edit {} no longer applies: {error}", queued.id),
739	)
740	})?;
741	touched.extend(queue::spaces(&queued.edit, section.root()));
742	}
743	open = Some(batch);
744	}
745	}
746	}
747	Ok((section, open, touched))
748	}
749
750	/// The image the queue leaves, its unsealed edits sealed as one more revision; that
751	/// revision's identities are fresh on every call. O(section), for tests and recovery.
752	pub(crate) fn image(connection: &Connection) -> Result<Vec<u8>> {
753	let arena = Arena::default();
754	let (mut section, ..) = replay(&arena, connection)?;
755	section.seal()?;
756	Ok(section.image())
757	}
758
759	/// The sealed batch waiting for publication, if any.
760	pub(crate) fn sealed(connection: &Connection) -> Result<Option<Sealed>> {
761	let row: Option<(i64, String)> = connection
762	.query_row(
763	"SELECT id, sealed FROM batches WHERE sealed IS NOT NULL ORDER BY id LIMIT 1",
764	[],
765	\|row\| Ok((row.get(0)?, row.get(1)?)),
766	)
767	.optional()?;
768	row.map(\|(batch, sealed)\| {
769	Ok(Sealed {
770	batch,
771	transaction: serde_json::from_str(&sealed)
772	.map_err(\|error\| io::Error::new(io::ErrorKind::InvalidData, error))?,
773	})
774	})
775	.transpose()
776	}

crates/notebook/tests/assets.rs+14-11

...	@@ -1,4 +1,4 @@	...	@@ -1,4 +1,4 @@
1	use notebook::{EditStatus, Error, Operation, Recovery, Replica};	1	use notebook::{EditStatus, Error, Recovery, Replica};
2	use onestore::{	2	use onestore::{
3	ExGuid, RevisionIndex, Store,	3	ExGuid, RevisionIndex, Store,
4	document::Document,	4	document::Document,
...	@@ -13,6 +13,8 @@ use std::{	...	@@ -13,6 +13,8 @@ use std::{
13		13
14	#[path = "support/model_ops.rs"]	14	#[path = "support/model_ops.rs"]
15	mod model_ops;	15	mod model_ops;
		16	#[path = "support/server.rs"]
		17	mod server;
16		18
17	const FIXTURE: &str = "../../corpus/native-external-assets/notebook";	19	const FIXTURE: &str = "../../corpus/native-external-assets/notebook";
18		20
...	@@ -54,10 +56,7 @@ fn queued_cache(root: &Path) -> Replica {	...	@@ -54,10 +56,7 @@ fn queued_cache(root: &Path) -> Replica {
54	.unwrap()	56	.unwrap()
55	.unwrap();	57	.unwrap();
56	let page = onestore::PageCreation::new(None, Some("Queued page"), "Author").unwrap();	58	let page = onestore::PageCreation::new(None, Some("Queued page"), "Author").unwrap();
57	cache	59	server::section_op(&cache, onestore::op::SectionOp::Create(page));
58	.create_page(&cache.snapshot().unwrap(), &page)
59	.unwrap()
60	.unwrap();
61	cache	60	cache
62	}	61	}
63		62
...	@@ -118,7 +117,10 @@ fn downloaded_media_survives_reopen_and_recovery_with_the_queue_intact() {	...	@@ -118,7 +117,10 @@ fn downloaded_media_survives_reopen_and_recovery_with_the_queue_intact() {
118	(summary.cached_assets, summary.cached_asset_bytes),	117	(summary.cached_assets, summary.cached_asset_bytes),
119	(2, 1024)	118	(2, 1024)
120	);	119	);
121	assert_eq!(cache.snapshot().unwrap(), working);	120	assert_eq!(
		121	server::pages(&cache.snapshot().unwrap()),
		122	server::pages(&working)
		123	);
122	assert_eq!(cache.remote_snapshot().unwrap(), remote);	124	assert_eq!(cache.remote_snapshot().unwrap(), remote);
123	assert_eq!(cache.pending().unwrap(), pending);	125	assert_eq!(cache.pending().unwrap(), pending);
124	assert_eq!(cache.status(1).unwrap(), uncertain);	126	assert_eq!(cache.status(1).unwrap(), uncertain);
...	@@ -234,10 +236,11 @@ fn download_network_wait_does_not_block_local_edits() {	...	@@ -234,10 +236,11 @@ fn download_network_wait_does_not_block_local_edits() {
234	release.send(()).unwrap();	236	release.send(()).unwrap();
235	assert_eq!(download.join().unwrap(), bytes);	237	assert_eq!(download.join().unwrap(), bytes);
236	assert_eq!(cache.status(id).unwrap(), Some(EditStatus::Pending));	238	assert_eq!(cache.status(id).unwrap(), Some(EditStatus::Pending));
237	let Operation::Page(intent) = &cache.pending().unwrap()[2].operation else {	239	assert!(matches!(
238	panic!()	240	&cache.pending().unwrap()[2].edit.ops[..],
239	};	241	[onestore::op::Op::Page { op: onestore::op::PageOp::Text { with, .. }, .. }]
240	assert_eq!(intent.text_change().unwrap().3, "during download ");	242	if with == "during download "
		243	));
241	});	244	});
242	}	245	}
243		246
...	@@ -284,7 +287,7 @@ fn a_native_refresh_removing_the_reference_rejects_an_inflight_download() {	...	@@ -284,7 +287,7 @@ fn a_native_refresh_removing_the_reference_rejects_an_inflight_download() {
284	panic!("Unexpected enumeration")	287	panic!("Unexpected enumeration")
285	}	288	}
286	fn read(&mut self, _: &str, _: usize) -> io::Result<Vec<u8>> {	289	fn read(&mut self, _: &str, _: usize) -> io::Result<Vec<u8>> {
287	assert_eq!(self.0.sync_once(&mut Native).unwrap(), None);	290	assert_eq!(self.0.sync_once(&mut Native).unwrap().edit, None);
288	Ok(payload(1024).1)	291	Ok(payload(1024).1)
289	}	292	}
290	}	293	}

crates/notebook/tests/cache.rs+230-270

...	@@ -1,7 +1,8 @@	...	@@ -1,7 +1,8 @@
1	use notebook::{Error, Operation, Replica};	1	use notebook::{Error, Replica};
2	use onestore::{	2	use onestore::{
3	ExGuid, RevisionIndex, Store,	3	ExGuid, RevisionIndex, Store,
4	document::{Document, Kind},	4	document::{Document, Kind},
		5	op::{Edit, Op, PageOp, SectionOp},
5	page::{Outline, PageObject},	6	page::{Outline, PageObject},
6	};	7	};
7	use std::{	8	use std::{
...	@@ -14,6 +15,8 @@ use std::{	...	@@ -14,6 +15,8 @@ use std::{
14		15
15	#[path = "support/model_ops.rs"]	16	#[path = "support/model_ops.rs"]
16	mod model_ops;	17	mod model_ops;
		18	#[path = "support/server.rs"]
		19	mod server;
17		20
18	fn target(source: &[u8]) -> (ExGuid, ExGuid, String) {	21	fn target(source: &[u8]) -> (ExGuid, ExGuid, String) {
19	let store = Store::parse(source).unwrap();	22	let store = Store::parse(source).unwrap();
...	@@ -36,25 +39,23 @@ fn target(source: &[u8]) -> (ExGuid, ExGuid, String) {	...	@@ -36,25 +39,23 @@ fn target(source: &[u8]) -> (ExGuid, ExGuid, String) {
36	.unwrap()	39	.unwrap()
37	}	40	}
38		41
39	fn text_of(page: &onestore::page::Page, text: ExGuid) -> String {	42	/// An edit typing `with` at the start of a text.
40	model_ops::paragraph_with(page, text)	43	fn typed(space: ExGuid, text: ExGuid, with: &str) -> Edit {
41	.unwrap()	44	Edit {
42	.text()	45	at: model_ops::now(),
43	.unwrap()	46	ops: vec![Op::Page {
44	.text	47	space,
45	.text()	48	op: PageOp::Text {
46	.to_owned()	49	text,
47	}	50	range: 0..0,
48		51	with: with.into(),
49	fn intent(replica: &Replica, at: usize) -> notebook::PageIntent {	52	},
50	match &replica.pending().unwrap()[at].operation {	53	}],
51	Operation::Page(intent) => intent.clone(),
52	other => panic!("{other:?}"),
53	}	54	}
54	}	55	}
55		56
56	#[test]	57	#[test]
57	fn cache_reopen_preserves_exact_images_and_intents() {	58	fn cache_reopen_preserves_the_base_and_queued_edits() {
58	let dir = tempfile::tempdir().unwrap();	59	let dir = tempfile::tempdir().unwrap();
59	let path = dir.path().join("section.sqlite");	60	let path = dir.path().join("section.sqlite");
60	let source = onestore::create_section("section.one", "café 🦀", "Fixture").unwrap();	61	let source = onestore::create_section("section.one", "café 🦀", "Fixture").unwrap();
...	@@ -72,77 +73,102 @@ fn cache_reopen_preserves_exact_images_and_intents() {	...	@@ -72,77 +73,102 @@ fn cache_reopen_preserves_exact_images_and_intents() {
72	})	73	})
73	.unwrap()	74	.unwrap()
74	.unwrap();	75	.unwrap();
75	let edited = replica.snapshot().unwrap();	76	assert_eq!(target(&replica.snapshot().unwrap()).2, "café 🐈 日本語");
76	assert_eq!(target(&edited).2, "café 🐈 日本語");	77	let edits = replica.pending().unwrap();
77	let intents = replica.pending().unwrap();	78	assert_eq!(edits.len(), 1);
78	assert_eq!(intents.len(), 1);
79	assert_eq!((intents[0].id, intents[0].space), (first, sid));
80	let first_intent = intent(&replica, 0);
81	assert_eq!(	79	assert_eq!(
82	first_intent.text_change(),	80	(edits[0].id, edits[0].author.as_str()),
83	Some((oid, "café 🦀".into(), 5..7, "🐈 日本語".into()))	81	(first, model_ops::AUTHOR)
84	);	82	);
85	assert_eq!(first_intent.author, model_ops::AUTHOR);	83	assert!(matches!(
		84	&edits[0].edit.ops[..],
		85	[Op::Page { space, op: PageOp::Text { text, range, with } }]
		86	if (space, text, range.clone(), with.as_str()) == (sid, oid, 5..7, "🐈 日本語")
		87	));
		88	let beside = \|suffix: &str\| {
		89	let mut file = path.as_os_str().to_owned();
		90	file.push(suffix);
		91	std::path::PathBuf::from(file)
		92	};
		93	// Commits go to the write-ahead log; its index stays in memory.
		94	assert!(beside("-wal").exists());
		95	assert!(!beside("-shm").exists());
86	drop(replica);	96	drop(replica);
		97	assert!(
		98	!beside("-wal").exists(),
		99	"closing checkpoints and removes the log"
		100	);
87	let replica = Replica::open(&path).unwrap();	101	let replica = Replica::open(&path).unwrap();
88	assert_eq!(replica.snapshot().unwrap(), edited);	102	assert_eq!(target(&replica.snapshot().unwrap()).2, "café 🐈 日本語");
89	assert_eq!(replica.pending().unwrap(), intents);	103	assert_eq!(replica.pending().unwrap(), edits);
90	let second = model_ops::save(&replica, oid, \|page\| {	104	let second = replica
91	model_ops::replace_text(page, oid, 0..0, "Recovered ")	105	.apply(model_ops::AUTHOR, typed(sid, oid, "Recovered "))
92	})	106	.unwrap();
93	.unwrap()	107	assert!(second > first);
94	.unwrap();
95	assert_eq!(second, first, "an unattempted save is replaced in place");
96	let coalesced = intent(&replica, 0);
97	assert_eq!(coalesced.before, first_intent.before);
98	assert_eq!(text_of(&coalesced.after, oid), "Recovered café 🐈 日本語");
99	assert_eq!(	108	assert_eq!(
100	target(&replica.snapshot().unwrap()).2,	109	target(&replica.snapshot().unwrap()).2,
101	"Recovered café 🐈 日本語"	110	"Recovered café 🐈 日本語"
102	);	111	);
		112	assert_eq!(replica.pending().unwrap().len(), 2);
103	}	113	}
104		114
105	#[test]	115	#[test]
106	fn failed_saves_preserve_both_intent_queue_and_working_image() {	116	fn refused_edits_and_failed_writes_leave_the_queue_as_it_was() {
107	let dir = tempfile::tempdir().unwrap();	117	let dir = tempfile::tempdir().unwrap();
108	let path = dir.path().join("section.sqlite");	118	let path = dir.path().join("section.sqlite");
109	let source = onestore::create_section("section.one", "café 🦀", "Fixture").unwrap();	119	let source = onestore::create_section("section.one", "café 🦀", "Fixture").unwrap();
110	let replica = Replica::create(&path, &source).unwrap();	120	let replica = Replica::create(&path, &source).unwrap();
111	let (sid, oid, _) = target(&source);	121	let (sid, oid, _) = target(&source);
112	let (_, mut page) = model_ops::locate(&source, oid);	122	let empty = Outline {
113	let mut empty = Outline {
114	id: onestore::page::text::new_id().unwrap(),	123	id: onestore::page::text::new_id().unwrap(),
115	title: false,	124	title: false,
116	min_width: None,	125	min_width: None,
117	layout: Default::default(),	126	layout: onestore::document::Layout {
		127	x: Some(72.0),
		128	y: Some(400.0),
		129	..Default::default()
		130	},
118	indents: Vec::new(),	131	indents: Vec::new(),
119	paragraphs: Vec::new(),	132	paragraphs: Vec::new(),
120	unsupported: Vec::new(),	133	unsupported: Vec::new(),
121	};	134	};
122	empty.layout.x = Some(72.0);	135	let refused = Edit {
123	empty.layout.y = Some(400.0);	136	at: model_ops::now(),
124	page.objects.push(PageObject::Outline(empty));	137	ops: vec![
125	assert!(replica.save(&source, sid, &page, "Author").is_err());	138	Op::Page {
126	let (_, mut page) = model_ops::locate(&source, oid);	139	space: sid,
127	model_ops::replace_text(&mut page, oid, 0..0, "Elsewhere ");	140	op: PageOp::Text {
128	let foreign = ExGuid::default();	141	text: oid,
129	assert!(replica.save(&source, foreign, &page, "Author").is_err());	142	range: 0..0,
		143	with: "Undone ".into(),
		144	},
		145	},
		146	Op::Page {
		147	space: sid,
		148	op: PageOp::Add {
		149	object: PageObject::Outline(empty),
		150	before: None,
		151	},
		152	},
		153	],
		154	};
		155	assert!(matches!(
		156	replica.apply("Author", refused),
		157	Err(Error::Rejected(_))
		158	));
		159	assert!(matches!(
		160	replica.apply("Author", typed(ExGuid::default(), oid, "Elsewhere ")),
		161	Err(Error::Rejected(_))
		162	));
130	assert_eq!(replica.snapshot().unwrap(), source);	163	assert_eq!(replica.snapshot().unwrap(), source);
131	assert!(replica.pending().unwrap().is_empty());	164	assert!(replica.pending().unwrap().is_empty());
132	drop(replica);	165	drop(replica);
133	let connection = rusqlite::Connection::open(&path).unwrap();	166	let connection = rusqlite::Connection::open(&path).unwrap();
134	connection.execute_batch("CREATE TRIGGER fail_image BEFORE UPDATE ON replica BEGIN SELECT RAISE(ABORT, 'Injected image update failure'); END;").unwrap();	167	connection.execute_batch("CREATE TRIGGER fail_edit BEFORE INSERT ON edits BEGIN SELECT RAISE(ABORT, 'Injected queue failure'); END;").unwrap();
135	drop(connection);	168	drop(connection);
136	let replica = Replica::open(&path).unwrap();	169	let replica = Replica::open(&path).unwrap();
137	assert!(matches!(	170	assert!(replica.apply("Author", typed(sid, oid, "lost? ")).is_err());
138	model_ops::save(&replica, oid, \|page\| model_ops::replace_text(	171	assert_eq!(replica.snapshot().unwrap(), source);
139	page,
140	oid,
141	0..0,
142	"lost? "
143	)),
144	Err(Error::Database(_))
145	));
146	drop(replica);	172	drop(replica);
147	let replica = Replica::open(&path).unwrap();	173	let replica = Replica::open(&path).unwrap();
148	assert_eq!(replica.snapshot().unwrap(), source);	174	assert_eq!(replica.snapshot().unwrap(), source);
...	@@ -155,7 +181,7 @@ fn concurrent_recovery_exports_capture_one_complete_acknowledged_queue() {	...	@@ -155,7 +181,7 @@ fn concurrent_recovery_exports_capture_one_complete_acknowledged_queue() {
155		181
156	let directory = tempfile::tempdir().unwrap();	182	let directory = tempfile::tempdir().unwrap();
157	let source = onestore::create_section("recovery.one", "base", "Fixture").unwrap();	183	let source = onestore::create_section("recovery.one", "base", "Fixture").unwrap();
158	let (_, object, _) = target(&source);	184	let (space, object, _) = target(&source);
159	let replica = Replica::create(directory.path().join("live.sqlite"), &source).unwrap();	185	let replica = Replica::create(directory.path().join("live.sqlite"), &source).unwrap();
160	let start = Barrier::new(4);	186	let start = Barrier::new(4);
161	std::thread::scope(\|scope\| {	187	std::thread::scope(\|scope\| {
...	@@ -164,18 +190,12 @@ fn concurrent_recovery_exports_capture_one_complete_acknowledged_queue() {	...	@@ -164,18 +190,12 @@ fn concurrent_recovery_exports_capture_one_complete_acknowledged_queue() {
164	scope.spawn(move \|\| {	190	scope.spawn(move \|\| {
165	start.wait();	191	start.wait();
166	for edit in 0..20 {	192	for edit in 0..20 {
167	loop {	193	replica
168	let marker = format!("[{writer}:{edit}] ");	194	.apply(
169	match model_ops::save(replica, object, \|page\| {	195	"Fixture",
170	model_ops::replace_text(page, object, 0..0, &marker)	196	typed(space, object, &format!("[{writer}:{edit}] ")),
171	}) {	197	)
172	Ok(Some(_)) => break,	198	.unwrap();
173	Err(Error::Io(error)) if error.kind() == ErrorKind::ResourceBusy => {
174	continue;
175	}
176	other => panic!("Unexpected local edit: {other:?}"),
177	}
178	}
179	}	199	}
180	});	200	});
181	}	201	}
...	@@ -185,20 +205,22 @@ fn concurrent_recovery_exports_capture_one_complete_acknowledged_queue() {	...	@@ -185,20 +205,22 @@ fn concurrent_recovery_exports_capture_one_complete_acknowledged_queue() {
185	replica.export_recovery(&path).unwrap();	205	replica.export_recovery(&path).unwrap();
186	let archive = Recovery::open(path).unwrap();	206	let archive = Recovery::open(path).unwrap();
187	let pending = archive.pending().unwrap();	207	let pending = archive.pending().unwrap();
188	let snapshot = target(&archive.snapshot().unwrap()).2;	208	// Each edit types at the start, so the text is the queue read backwards.
189	match pending.as_slice() {	209	let expected: String = pending
190	[] => assert_eq!(snapshot, "base"),	210	.iter()
191	[single] => {	211	.rev()
192	let Operation::Page(intent) = &single.operation else {	212	.map(\|edit\| match &edit.edit.ops[..] {
193	panic!()	213	[
194	};	214	Op::Page {
195	let (id, before, range, replacement) = intent.text_change().unwrap();	215	op: PageOp::Text { with, .. },
196	assert_eq!((id, before.as_str(), range), (object, "base", 0..0));	216	..
197	assert_eq!(snapshot, format!("{replacement}base"));	217	},
198	assert_eq!(text_of(&intent.after, object), snapshot);	218	] => with.as_str(),
199	}	219	other => panic!("{other:?}"),
200	more => panic!("saves to one page coalesce: {more:?}"),	220	})
201	}	221	.chain(["base"])
		222	.collect();
		223	assert_eq!(target(&archive.snapshot().unwrap()).2, expected);
202	assert_eq!(archive.remote_snapshot().unwrap(), source);	224	assert_eq!(archive.remote_snapshot().unwrap(), source);
203	assert_eq!(	225	assert_eq!(
204	archive.summary().unwrap().queued_edits,	226	archive.summary().unwrap().queued_edits,
...	@@ -207,7 +229,7 @@ fn concurrent_recovery_exports_capture_one_complete_acknowledged_queue() {	...	@@ -207,7 +229,7 @@ fn concurrent_recovery_exports_capture_one_complete_acknowledged_queue() {
207	assert!(archive.receipts().unwrap().is_empty());	229	assert!(archive.receipts().unwrap().is_empty());
208	}	230	}
209	});	231	});
210	assert_eq!(replica.pending().unwrap().len(), 1);	232	assert_eq!(replica.pending().unwrap().len(), 60);
211	let content = target(&replica.snapshot().unwrap()).2;	233	let content = target(&replica.snapshot().unwrap()).2;
212	for writer in 0..3 {	234	for writer in 0..3 {
213	for edit in 0..20 {	235	for edit in 0..20 {
...	@@ -242,9 +264,10 @@ fn ownership_and_foreign_file_rejection_preserve_existing_data() {	...	@@ -242,9 +264,10 @@ fn ownership_and_foreign_file_rejection_preserve_existing_data() {
242	.unwrap();	264	.unwrap();
243	for sql in [	265	for sql in [
244	"PRAGMA application_id=0".to_owned(),	266	"PRAGMA application_id=0".to_owned(),
		267	// Schema 14 converts; older caches do not.
245	format!(	268	format!(
246	"PRAGMA application_id=1330529615; PRAGMA user_version={}",	269	"PRAGMA application_id=1330529615; PRAGMA user_version={}",
247	current - 1	270	current - 2
248	),	271	),
249	format!("PRAGMA user_version={}", current + 1),	272	format!("PRAGMA user_version={}", current + 1),
250	] {	273	] {
...	@@ -289,52 +312,26 @@ fn ownership_and_foreign_file_rejection_preserve_existing_data() {	...	@@ -289,52 +312,26 @@ fn ownership_and_foreign_file_rejection_preserve_existing_data() {
289	}	312	}
290		313
291	#[test]	314	#[test]
292	fn twelve_local_editors_reject_stale_images_and_coalesce_into_one_save() {	315	fn twelve_local_editors_queue_every_edit_once_in_order() {
293	let dir = tempfile::tempdir().unwrap();	316	let dir = tempfile::tempdir().unwrap();
294	let path = dir.path().join("section.sqlite");	317	let path = dir.path().join("section.sqlite");
295	let source = onestore::create_section("section.one", "Shared café 🦀", "Fixture").unwrap();	318	let source = onestore::create_section("section.one", "Shared café 🦀", "Fixture").unwrap();
296	let replica = Replica::create(&path, &source).unwrap();	319	let replica = Replica::create(&path, &source).unwrap();
297	let (sid, oid, _) = target(&source);	320	let (sid, oid, _) = target(&source);
298	let barrier = Barrier::new(12);	321	let barrier = Barrier::new(12);
299	let deadline = Instant::now() + Duration::from_secs(60);
300	let outcomes = std::thread::scope(\|scope\| {	322	let outcomes = std::thread::scope(\|scope\| {
301	let handles: Vec<_> = (0..12)	323	let handles: Vec<_> = (0..12)
302	.map(\|writer\| {	324	.map(\|writer\| {
303	let (replica, source, barrier) = (&replica, &source, &barrier);	325	let (replica, barrier) = (&replica, &barrier);
304	scope.spawn(move \|\| {	326	scope.spawn(move \|\| {
305	let (_, mut page) = model_ops::locate(source, oid);
306	model_ops::replace_text(&mut page, oid, 0..0, &format!("[initial-{writer}] "));
307	barrier.wait();	327	barrier.wait();
308	let mut ids = Vec::new();	328	(0..20)
309	let first_won = match replica.save(source, sid, &page, model_ops::AUTHOR) {	329	.map(\|edit\| {
310	Ok(Some(id)) => {	330	replica
311	ids.push(id);	331	.apply("Fixture", typed(sid, oid, &format!("[{writer}-{edit}] ")))
312	true	332	.unwrap()
313	}	333	})
314	Err(Error::Io(error)) if error.kind() == ErrorKind::ResourceBusy => false,	334	.collect::<Vec<_>>()
315	other => panic!("Unexpected first edit: {other:?}"),
316	};
317	for edit in 0..20 {
318	loop {
319	assert!(
320	Instant::now() < deadline,
321	"Writer {writer} stopped progressing at {edit}"
322	);
323	let marker = format!("[{writer}-{edit}] ");
324	match model_ops::save(replica, oid, \|page\| {
325	model_ops::replace_text(page, oid, 0..0, &marker)
326	}) {
327	Ok(Some(id)) => {
328	ids.push(id);
329	break;
330	}
331	Err(Error::Io(error))
332	if error.kind() == ErrorKind::ResourceBusy => {}
333	other => panic!("Unexpected edit: {other:?}"),
334	}
335	}
336	}
337	(first_won, ids)
338	})	335	})
339	})	336	})
340	.collect();	337	.collect();
...	@@ -343,31 +340,29 @@ fn twelve_local_editors_reject_stale_images_and_coalesce_into_one_save() {	...	@@ -343,31 +340,29 @@ fn twelve_local_editors_reject_stale_images_and_coalesce_into_one_save() {
343	.map(\|handle\| handle.join().unwrap())	340	.map(\|handle\| handle.join().unwrap())
344	.collect::<Vec<_>>()	341	.collect::<Vec<_>>()
345	});	342	});
346	assert_eq!(outcomes.iter().filter(\|(won, _)\| *won).count(), 1);	343	for ids in &outcomes {
347	let ids: BTreeSet<_> = outcomes.into_iter().flat_map(\|(_, ids)\| ids).collect();	344	assert!(
348	assert_eq!(ids.len(), 1, "every save replaced the unattempted head");	345	ids.windows(2).all(\|pair\| pair[0] < pair[1]),
349	let final_bytes = replica.snapshot().unwrap();	346	"a writer's edits keep its order"
350	let content = target(&final_bytes).2;	347	);
351	let pending = replica.pending().unwrap();	348	}
352	assert_eq!(pending.len(), 1);	349	let ids: BTreeSet<_> = outcomes.into_iter().flatten().collect();
353	assert_eq!(pending[0].id, *ids.first().unwrap());	350	assert_eq!(ids.len(), 240);
354	let (id, before, range, replacement) = intent(&replica, 0).text_change().unwrap();	351	let content = target(&replica.snapshot().unwrap()).2;
355	assert_eq!((id, before.as_str(), range), (oid, "Shared café 🦀", 0..0));	352	assert!(content.ends_with("Shared café 🦀"));
356	assert_eq!(content, format!("{replacement}Shared café 🦀"));
357	assert_eq!(content.matches("[initial-").count(), 1);
358	for writer in 0..12 {	353	for writer in 0..12 {
359	for edit in 0..20 {	354	for edit in 0..20 {
360	assert_eq!(content.matches(&format!("[{writer}-{edit}] ")).count(), 1);	355	assert_eq!(content.matches(&format!("[{writer}-{edit}] ")).count(), 1);
361	}	356	}
362	}	357	}
363	let (_, mut stale) = model_ops::locate(&source, oid);	358	let pending = replica.pending().unwrap();
364	model_ops::replace_text(&mut stale, oid, 0..0, "stale ");	359	assert_eq!(
365	assert!(	360	pending.iter().map(\|edit\| edit.id).collect::<BTreeSet<_>>(),
366	matches!(replica.save(&source, sid, &stale, "Author"), Err(Error::Io(error)) if error.kind() == ErrorKind::ResourceBusy)	361	ids
367	);	362	);
368	drop(replica);	363	drop(replica);
369	let reopened = Replica::open(&path).unwrap();	364	let reopened = Replica::open(&path).unwrap();
370	assert_eq!(reopened.snapshot().unwrap(), final_bytes);	365	assert_eq!(target(&reopened.snapshot().unwrap()).2, content);
371	assert_eq!(reopened.pending().unwrap(), pending);	366	assert_eq!(reopened.pending().unwrap(), pending);
372	}	367	}
373		368
...	@@ -375,11 +370,10 @@ fn twelve_local_editors_reject_stale_images_and_coalesce_into_one_save() {	...	@@ -375,11 +370,10 @@ fn twelve_local_editors_reject_stale_images_and_coalesce_into_one_save() {
375	fn seeded_unicode_edits_and_restarts_match_an_independent_text_model() {	370	fn seeded_unicode_edits_and_restarts_match_an_independent_text_model() {
376	let dir = tempfile::tempdir().unwrap();	371	let dir = tempfile::tempdir().unwrap();
377	let path = dir.path().join("model.sqlite");	372	let path = dir.path().join("model.sqlite");
378	let original = "ab🚀ab🦀 é repeated repeated".to_owned();	373	let mut text = "ab🚀ab🦀 é repeated repeated".to_owned();
379	let mut text = original.clone();
380	let source = onestore::create_section("model.one", &text, "Fixture").unwrap();	374	let source = onestore::create_section("model.one", &text, "Fixture").unwrap();
381	let mut replica = Replica::create(&path, &source).unwrap();	375	let mut replica = Replica::create(&path, &source).unwrap();
382	let (space, object, _) = target(&source);	376	let (_, object, _) = target(&source);
383	let mut random = 911_u64;	377	let mut random = 911_u64;
384	let mut next = \|\| {	378	let mut next = \|\| {
385	random ^= random << 13;	379	random ^= random << 13;
...	@@ -387,8 +381,7 @@ fn seeded_unicode_edits_and_restarts_match_an_independent_text_model() {	...	@@ -387,8 +381,7 @@ fn seeded_unicode_edits_and_restarts_match_an_independent_text_model() {
387	random ^= random << 17;	381	random ^= random << 17;
388	random	382	random
389	};	383	};
390	let mut acknowledged = 0;	384	let mut acknowledged = Vec::new();
391	let mut pending = Vec::new();
392	for step in 0..512 {	385	for step in 0..512 {
393	let boundaries: Vec<_> = text	386	let boundaries: Vec<_> = text
394	.char_indices()	387	.char_indices()
...	@@ -403,47 +396,45 @@ fn seeded_unicode_edits_and_restarts_match_an_independent_text_model() {	...	@@ -403,47 +396,45 @@ fn seeded_unicode_edits_and_restarts_match_an_independent_text_model() {
403	let replacement = ["", "🐈", "日本語", "repeated", "é", "ab🦀ab"][next() as usize % 6];	396	let replacement = ["", "🐈", "日本語", "repeated", "é", "ab🦀ab"][next() as usize % 6];
404	let mut expected = text.clone();	397	let mut expected = text.clone();
405	expected.replace_range(bytes, replacement);	398	expected.replace_range(bytes, replacement);
406	let before = replica.snapshot().unwrap();
407	let acknowledgement = model_ops::save(&replica, object, \|page\| {	399	let acknowledgement = model_ops::save(&replica, object, \|page\| {
408	model_ops::replace_text(page, object, range.clone(), replacement)	400	model_ops::replace_text(page, object, range.clone(), replacement)
409	})	401	})
410	.unwrap();	402	.unwrap();
411	if let Some(id) = acknowledgement {	403	match acknowledgement {
412	assert_ne!(text, expected);	404	Some(id) => {
413	acknowledged += 1;	405	assert_ne!(text, expected);
414	pending = replica.pending().unwrap();	406	assert!(acknowledged.last().is_none_or(\|last\| *last < id));
415	assert_eq!(pending.len(), 1);	407	acknowledged.push(id);
416	assert_eq!((pending[0].id, pending[0].space), (1, space));
417	let saved = intent(&replica, 0);
418	assert_eq!(id, 1);
419	assert_eq!(text_of(&saved.before, object), original);
420	assert_eq!(text_of(&saved.after, object), expected);
421	if step % 37 == 0 {
422	let (_, mut stale) = model_ops::locate(&before, object);
423	model_ops::replace_text(&mut stale, object, 0..0, "stale");
424	assert!(
425	matches!(replica.save(&before, space, &stale, "Author"), Err(Error::Io(error)) if error.kind() == ErrorKind::ResourceBusy)
426	);
427	}	408	}
428	} else {	409	None => assert_eq!(text, expected),
429	assert_eq!(text, expected);
430	}	410	}
431	text = expected;	411	text = expected;
432	let source = replica.snapshot().unwrap();	412	assert_eq!(
433	assert_eq!(target(&source).2, text, "seed 911, step {step}");	413	target(&replica.snapshot().unwrap()).2,
		414	text,
		415	"seed 911, step {step}"
		416	);
434	if step % 37 == 0 {	417	if step % 37 == 0 {
		418	let pending = replica.pending().unwrap();
435	drop(replica);	419	drop(replica);
436	replica = Replica::open(&path).unwrap();	420	replica = Replica::open(&path).unwrap();
437	assert_eq!(replica.snapshot().unwrap(), source);	421	assert_eq!(target(&replica.snapshot().unwrap()).2, text);
438	assert_eq!(replica.pending().unwrap(), pending);	422	assert_eq!(replica.pending().unwrap(), pending);
439	}	423	}
440	}	424	}
441	assert!(acknowledged > 256, "Most random edits change the text");	425	assert!(
442	let source = replica.snapshot().unwrap();	426	acknowledged.len() > 256,
443	drop(replica);	427	"Most random edits change the text"
444	let replica = Replica::open(&path).unwrap();	428	);
445	assert_eq!(replica.pending().unwrap(), pending);	429	assert_eq!(
446	assert_eq!(replica.snapshot().unwrap(), source);	430	replica
		431	.pending()
		432	.unwrap()
		433	.iter()
		434	.map(\|edit\| edit.id)
		435	.collect::<Vec<_>>(),
		436	acknowledged
		437	);
447	}	438	}
448		439
449	#[test]	440	#[test]
...	@@ -465,71 +456,43 @@ fn twelve_local_clients_preserve_inserted_identities_and_dependent_edits() {	...	@@ -465,71 +456,43 @@ fn twelve_local_clients_preserve_inserted_identities_and_dependent_edits() {
465	let mut objects = Vec::new();	456	let mut objects = Vec::new();
466	barrier.wait();	457	barrier.wait();
467	for sequence in 0..4 {	458	for sequence in 0..4 {
		459	assert!(Instant::now() < deadline, "Client {client} stopped");
468	let content = if sequence == 0 {	460	let content = if sequence == 0 {
469	format!("Client {client}")	461	format!("Client {client}")
470	} else {	462	} else {
471	format!("Paragraph {client}:{sequence}")	463	format!("Paragraph {client}:{sequence}")
472	};	464	};
473	let mut inserted = None;	465	let mut inserted = None;
474	loop {	466	let id = model_ops::save(cache, anchor, \|page\| {
475	assert!(	467	let text = if sequence == 0 {
476	Instant::now() < deadline,	468	model_ops::insert_outline(
477	"Client {client} stopped at insertion {sequence}"	469	page,
478	);	470	72.0,
479	let result = model_ops::save(cache, anchor, \|page\| {	471	144.0 + client as f32 * 72.0,
480	let text = if sequence == 0 {	472	&content,
481	model_ops::insert_outline(	473	)
482	page,	474	.2
483	72.0,	475	} else {
484	144.0 + client as f32 * 72.0,	476	model_ops::insert_after(page, *objects.last().unwrap(), &content).1
485	&content,	477	};
486	)	478	let end = content.encode_utf16().count() as u32;
487	.2	479	model_ops::restyle(page, text, 0..end, \|format\| format.italic = None);
488	} else {	480	model_ops::restyle(page, text, 0..6, italic);
489	model_ops::insert_after(	481	inserted = Some(text);
490	page,	482	})
491	*objects.last().unwrap(),	483	.unwrap()
492	&content,	484	.unwrap();
493	)	485	ids.push(id);
494	.1	486	objects.push(inserted.unwrap());
495	};
496	let end = content.encode_utf16().count() as u32;
497	model_ops::restyle(page, text, 0..end, \|format\| {
498	format.italic = None
499	});
500	model_ops::restyle(page, text, 0..6, italic);
501	inserted = Some(text);
502	});
503	match result {
504	Ok(Some(id)) => {
505	ids.push(id);
506	objects.push(inserted.unwrap());
507	break;
508	}
509	Err(Error::Io(e)) if e.kind() == ErrorKind::ResourceBusy => {}
510	other => panic!("{other:?}"),
511	}
512	}
513	if sequence == 0 {	487	if sequence == 0 {
514	continue;	488	continue;
515	}	489	}
516	let text = *objects.last().unwrap();	490	let text = *objects.last().unwrap();
517	loop {	491	ids.push(
518	assert!(	492	cache
519	Instant::now() < deadline,	493	.apply(model_ops::AUTHOR, typed(sid, text, "Edited "))
520	"Client {client} stopped at text {sequence}"	494	.unwrap(),
521	);	495	);
522	match model_ops::save(cache, text, \|page\| {
523	model_ops::replace_text(page, text, 0..0, "Edited ")
524	}) {
525	Ok(Some(id)) => {
526	ids.push(id);
527	break;
528	}
529	Err(Error::Io(e)) if e.kind() == ErrorKind::ResourceBusy => {}
530	other => panic!("{other:?}"),
531	}
532	}
533	}	496	}
534	(ids, objects)	497	(ids, objects)
535	})	498	})
...	@@ -544,12 +507,14 @@ fn twelve_local_clients_preserve_inserted_identities_and_dependent_edits() {	...	@@ -544,12 +507,14 @@ fn twelve_local_clients_preserve_inserted_identities_and_dependent_edits() {
544	.iter()	507	.iter()
545	.flat_map(\|(ids, _)\| ids.iter().copied())	508	.flat_map(\|(ids, _)\| ids.iter().copied())
546	.collect();	509	.collect();
547	assert_eq!(all.iter().map(\|(ids, _)\| ids.len()).sum::<usize>(), 84);	510	assert_eq!(ids.len(), 84);
548	assert_eq!(ids.len(), 1);
549	let snapshot = cache.snapshot().unwrap();	511	let snapshot = cache.snapshot().unwrap();
550	drop(cache);	512	drop(cache);
551	let cache = Replica::open(&path).unwrap();	513	let cache = Replica::open(&path).unwrap();
552	assert_eq!(cache.snapshot().unwrap(), snapshot);	514	assert_eq!(
		515	server::pages(&cache.snapshot().unwrap()),
		516	server::pages(&snapshot)
		517	);
553	assert_eq!(	518	assert_eq!(
554	cache	519	cache
555	.pending()	520	.pending()
...	@@ -588,8 +553,8 @@ fn twelve_local_clients_preserve_inserted_identities_and_dependent_edits() {	...	@@ -588,8 +553,8 @@ fn twelve_local_clients_preserve_inserted_identities_and_dependent_edits() {
588	}	553	}
589		554
590	#[test]	555	#[test]
591	fn unrecognized_persisted_operations_are_rejected_without_dropping_fields() {	556	fn unrecognized_persisted_ops_are_rejected_without_dropping_fields() {
592	for operation in ["Page", "CreatePage", "Pages", "DeletePages"] {	557	for kind in ["Text", "Create", "Pages", "Delete"] {
593	let directory = tempfile::tempdir().unwrap();	558	let directory = tempfile::tempdir().unwrap();
594	let path = directory.path().join("unknown.sqlite");	559	let path = directory.path().join("unknown.sqlite");
595	let first = onestore::create_section("unknown.one", "Original", "Author").unwrap();	560	let first = onestore::create_section("unknown.one", "Original", "Author").unwrap();
...	@@ -598,52 +563,47 @@ fn unrecognized_persisted_operations_are_rejected_without_dropping_fields() {	...	@@ -598,52 +563,47 @@ fn unrecognized_persisted_operations_are_rejected_without_dropping_fields() {
598	.unwrap()	563	.unwrap()
599	.as_bytes()	564	.as_bytes()
600	.to_vec();	565	.to_vec();
601	let (_, oid, _) = target(&source);	566	let (space, oid, _) = target(&source);
602	let store = Store::parse(&source).unwrap();	567	let store = Store::parse(&source).unwrap();
603	let index = RevisionIndex::parse(&store).unwrap();	568	let index = RevisionIndex::parse(&store).unwrap();
604	let sid = Document::parse(&index).unwrap().pages().unwrap()[1].0;	569	let sid = Document::parse(&index).unwrap().pages().unwrap()[1].0;
605	let cache = Replica::create(&path, &source).unwrap();	570	let cache = Replica::create(&path, &source).unwrap();
606	match operation {	571	let section = \|op\| {
607	"Page" => {	572	server::section_op(&cache, op);
608	model_ops::save(&cache, oid, \|page\| {	573	};
609	model_ops::replace_text(page, oid, 0..0, "New ")	574	match kind {
610	})	575	"Text" => {
611	.unwrap()	576	cache.apply("Author", typed(space, oid, "New ")).unwrap();
612	.unwrap();
613	}
614	"CreatePage" => {
615	let page = onestore::PageCreation::new(None, Some("Created"), "Author").unwrap();
616	cache.create_page(&source, &page).unwrap().unwrap();
617	}
618	"Pages" => {
619	cache
620	.pages(&source, &[onestore::PageEdit::set_level(sid, 2).unwrap()])
621	.unwrap()
622	.unwrap();
623	}
624	_ => {
625	cache.delete_pages(&source, &[sid]).unwrap().unwrap();
626	}	577	}
		578	"Create" => section(SectionOp::Create(
		579	onestore::PageCreation::new(None, Some("Created"), "Author").unwrap(),
		580	)),
		581	"Pages" => section(SectionOp::Pages(vec![
		582	onestore::PageEdit::set_level(sid, 2).unwrap(),
		583	])),
		584	_ => section(SectionOp::Delete(vec![sid])),
627	}	585	}
628	drop(cache);	586	drop(cache);
629	let db = rusqlite::Connection::open(&path).unwrap();	587	let encoded: String = rusqlite::Connection::open(&path)
630	let encoded: String = db	588	.unwrap()
631	.query_row("SELECT operation FROM edits", [], \|r\| r.get(0))	589	.query_row("SELECT edit FROM edits", [], \|r\| r.get(0))
632	.unwrap();	590	.unwrap();
633	let mut value: serde_json::Value = serde_json::from_str(&encoded).unwrap();	591	for target in ["", "/ops/0", "/ops/0/Page/op/Text", "/ops/0/Section"] {
634	if value[operation].is_object() {	592	let mut value: serde_json::Value = serde_json::from_str(&encoded).unwrap();
635	value[operation]["future_option"] = true.into();	593	let Some(object) = value.pointer_mut(target).and_then(\|v\| v.as_object_mut()) else {
636	} else {	594	continue;
637	value["future_option"] = true.into();	595	};
		596	object.insert("future_option".into(), true.into());
		597	rusqlite::Connection::open(&path)
		598	.unwrap()
		599	.execute("UPDATE edits SET edit=?1", [value.to_string()])
		600	.unwrap();
		601	let before = fs::read(&path).unwrap();
		602	assert!(
		603	matches!(Replica::open(&path),Err(Error::Io(error))if error.kind()==ErrorKind::InvalidData),
		604	"{kind} {target}"
		605	);
		606	assert_eq!(fs::read(&path).unwrap(), before);
638	}	607	}
639	db.execute("UPDATE edits SET operation=?1", [value.to_string()])
640	.unwrap();
641	drop(db);
642	let before = fs::read(&path).unwrap();
643	assert!(
644	matches!(Replica::open(&path),Err(Error::Io(error))if error.kind()==ErrorKind::InvalidData),
645	"{operation}"
646	);
647	assert_eq!(fs::read(&path).unwrap(), before);
648	}	608	}
649	}	609	}

crates/notebook/tests/migrate.rs created+384

...	@@ -0,0 +1,384 @@
1	//! Converting schema-14 caches: whole-page edits become ops, verified page by page against
2	//! the old working image, with a recovery archive first and nothing changed on a mismatch.
3
4	use notebook::{ConflictKind, EditStatus, Replica, Resolution};
5	use onestore::{ExGuid, PageCreation, PageEdit, PreparedEdit, page::Page};
6	use rusqlite::{Connection, params};
7	use serde_json::json;
8	use std::path::Path;
9
10	#[path = "support/server.rs"]
11	mod server;
12	use server::*;
13	#[path = "support/model_ops.rs"]
14	mod model_ops;
15
16	const SOURCE: &[u8] = include_bytes!("../../../corpus/outline-edit/before/notebook/synthetic.one");
17
18	/// The body pages of the fixture with their first body text.
19	fn body_pages(source: &[u8]) -> Vec<(ExGuid, ExGuid)> {
20	pages(source)
21	.into_iter()
22	.filter_map(\|(space, page)\| {
23	let text = page.objects.iter().find_map(\|object\| match object {
24	onestore::page::PageObject::Outline(outline) => {
25	outline.paragraphs.first()?.text().map(\|text\| text.id)
26	}
27	_ => None,
28	})?;
29	Some((space, text))
30	})
31	.collect()
32	}
33
34	/// A schema-14 queue entry.
35	enum Queued {
36	Page(ExGuid, Page),
37	Create(PageCreation),
38	Pages(Vec<PageEdit>),
39	Delete(Vec<ExGuid>),
40	}
41
42	/// Writes a schema-14 cache holding `queue` on `base`, as that schema stored it; returns
43	/// the working image.
44	fn v14(path: &Path, base: &[u8], queue: &[Queued], working: Option<&[u8]>) -> Vec<u8> {
45	let mut image = base.to_vec();
46	let mut edits = Vec::new();
47	for entry in queue {
48	let (space, operation, next) = match entry {
49	Queued::Page(space, after) => {
50	let before = model_ops::page_of(&image, *space);
51	let next = PreparedEdit::page(&image, *space, after, "Author").unwrap();
52	(
53	*space,
54	json!({"Page": {"before": before, "after": after, "author": "Author"}}),
55	next.as_bytes().to_vec(),
56	)
57	}
58	Queued::Create(creation) => (
59	creation.space(),
60	json!({"CreatePage": creation}),
61	PreparedEdit::create_page(&image, creation)
62	.unwrap()
63	.as_bytes()
64	.to_vec(),
65	),
66	Queued::Pages(batch) => {
67	let observed: Vec<_> = pages(&image)
68	.into_iter()
69	.map(\|(space, _)\| (space, 1))
70	.collect();
71	(
72	root(&image),
73	json!({"Pages": {"edits": batch, "observed": observed}}),
74	PreparedEdit::pages(&image, batch)
75	.unwrap()
76	.as_bytes()
77	.to_vec(),
78	)
79	}
80	Queued::Delete(spaces) => (
81	root(&image),
82	json!({"DeletePages": spaces}),
83	PreparedEdit::delete_pages_permanently(&image, spaces)
84	.unwrap()
85	.as_bytes()
86	.to_vec(),
87	),
88	};
89	edits.push((space, operation));
90	image = next;
91	}
92	let working = working.map_or(image, <[u8]>::to_vec);
93	std::fs::File::create_new(path).unwrap();
94	let connection = Connection::open(path).unwrap();
95	connection
96	.execute_batch(
97	"PRAGMA application_id=1330529615; PRAGMA user_version=14;
98	CREATE TABLE replica (id INTEGER PRIMARY KEY CHECK(id=1), base BLOB NOT NULL, working BLOB NOT NULL) STRICT;
99	CREATE TABLE edits (id INTEGER PRIMARY KEY AUTOINCREMENT CHECK(id>0), space TEXT NOT NULL, operation TEXT NOT NULL) STRICT;
100	CREATE TABLE attempt (id INTEGER PRIMARY KEY CHECK(id=1), edit_id INTEGER NOT NULL UNIQUE REFERENCES edits(id) ON DELETE CASCADE, revisions TEXT NOT NULL) STRICT;
101	CREATE TABLE receipts (edit_id INTEGER PRIMARY KEY CHECK(edit_id>0), revision TEXT NOT NULL) STRICT;
102	CREATE TABLE archived (edit_id INTEGER PRIMARY KEY CHECK(edit_id>0), archive TEXT NOT NULL) STRICT;
103	CREATE TABLE conflicts (edit_id INTEGER PRIMARY KEY REFERENCES edits(id) ON DELETE CASCADE, kind INTEGER NOT NULL CHECK(kind BETWEEN 0 AND 3)) STRICT;
104	CREATE TABLE assets (name TEXT PRIMARY KEY NOT NULL, data BLOB NOT NULL, sha256 BLOB NOT NULL CHECK(length(sha256)=32)) STRICT;",
105	)
106	.unwrap();
107	// Schema 14 kept the working image as its length and the runs differing from the base.
108	let mut patch = (working.len() as u64).to_le_bytes().to_vec();
109	patch.extend_from_slice(&0_u64.to_le_bytes());
110	patch.extend_from_slice(&(working.len() as u64).to_le_bytes());
111	patch.extend_from_slice(&working);
112	connection
113	.execute(
114	"INSERT INTO replica VALUES (1, ?1, ?2)",
115	params![base, patch],
116	)
117	.unwrap();
118	connection
119	.execute(
120	"INSERT INTO receipts VALUES (1, ?1)",
121	[ExGuid {
122	guid: [7; 16],
123	n: 1,
124	}
125	.to_string()],
126	)
127	.unwrap();
128	connection
129	.execute(
130	"INSERT INTO sqlite_sequence(name, seq) VALUES ('edits', 1)",
131	[],
132	)
133	.unwrap();
134	for (space, operation) in edits {
135	connection
136	.execute(
137	"INSERT INTO edits(space, operation) VALUES (?1, ?2)",
138	params![space.to_string(), operation.to_string()],
139	)
140	.unwrap();
141	}
142	working
143	}
144
145	fn root(image: &[u8]) -> ExGuid {
146	onestore::RevisionIndex::parse(&onestore::Store::parse(image).unwrap())
147	.unwrap()
148	.root
149	}
150
151	fn appended(source: &[u8], space: ExGuid, text: ExGuid, suffix: &str) -> Page {
152	let mut page = model_ops::page_of(source, space);
153	let end = model_ops::paragraph_with(&page, text)
154	.unwrap()
155	.text()
156	.unwrap()
157	.text
158	.text()
159	.encode_utf16()
160	.count() as u32;
161	model_ops::replace_text(&mut page, text, end..end, suffix);
162	page
163	}
164
165	fn archive(path: &Path) -> std::path::PathBuf {
166	let mut archive = path.as_os_str().to_owned();
167	archive.push(".v14-recovery");
168	archive.into()
169	}
170
171	#[test]
172	fn a_schema_14_queue_converts_to_ops_that_reach_its_working_pages_and_publish() {
173	let body = body_pages(SOURCE);
174	let ((a, a_text), (b, b_text)) = (body[0], body[1]);
175	let directory = tempfile::tempdir().unwrap();
176	let path = directory.path().join("cache.sqlite");
177	let creation = PageCreation::new(None, Some("Created offline"), "Author").unwrap();
178	let first = appended(SOURCE, a, a_text, " one");
179	let working = v14(
180	&path,
181	SOURCE,
182	&[
183	Queued::Page(a, first.clone()),
184	Queued::Page(b, appended(SOURCE, b, b_text, " other")),
185	Queued::Create(creation.clone()),
186	Queued::Pages(vec![PageEdit::move_to(b, Some(a), 1).unwrap()]),
187	Queued::Page(
188	a,
189	appended(
190	PreparedEdit::page(SOURCE, a, &first, "Author")
191	.unwrap()
192	.as_bytes(),
193	a,
194	a_text,
195	" two",
196	),
197	),
198	Queued::Delete(vec![body[2].0]),
199	],
200	None,
201	);
202	let cache = Replica::open(&path).unwrap();
203	assert!(archive(&path).exists());
204	let pending = cache.pending().unwrap();
205	assert_eq!(
206	pending.iter().map(\|edit\| edit.id).collect::<Vec<_>>(),
207	[2, 3, 4, 5, 6, 7]
208	);
209	assert!(pending.iter().all(\|edit\| !edit.edit.ops.is_empty()));
210	assert_eq!(
211	cache.status(1).unwrap(),
212	Some(EditStatus::Published {
213	revision: ExGuid {
214	guid: [7; 16],
215	n: 1
216	}
217	})
218	);
219	let local = pages(&cache.snapshot().unwrap());
220	assert_eq!(local, pages(&working));
221	drop(cache);
222	// A converted cache opens as it is.
223	let cache = Replica::open(&path).unwrap();
224	assert_eq!(pages(&cache.snapshot().unwrap()), local);
225	let next = cache
226	.apply(
227	"Author",
228	onestore::op::Edit {
229	at: 133_000_000_000_000_000,
230	ops: vec![onestore::op::Op::Page {
231	space: b,
232	op: onestore::op::PageOp::Text {
233	text: b_text,
234	range: 0..0,
235	with: " three".into(),
236	},
237	}],
238	},
239	)
240	.unwrap();
241	assert!(next > 7);
242	let mut server = Server::new(SOURCE);
243	assert!(matches!(
244	cache.sync_once(&mut server).unwrap().edit,
245	Some((id, EditStatus::Published { .. })) if id == next
246	));
247	let published = pages(&server.durable);
248	assert_eq!(published, pages(&cache.snapshot().unwrap()));
249	assert!(
250	published
251	.iter()
252	.any(\|(space, _)\| *space == creation.space())
253	);
254	assert!(published.iter().all(\|(space, _)\| *space != body[2].0));
255	}
256
257	#[test]
258	fn an_uncertain_attempt_and_a_conflict_keep_their_states() {
259	let body = body_pages(SOURCE);
260	let (a, a_text) = body[0];
261	let directory = tempfile::tempdir().unwrap();
262
263	// The oldest edit was attempted: its schema-14 evidence names the revision it published.
264	let path = directory.path().join("attempted.sqlite");
265	let after = appended(SOURCE, a, a_text, " attempted");
266	let published = PreparedEdit::page(SOURCE, a, &after, "Author").unwrap();
267	let revision =
268	onestore::RevisionIndex::parse(&onestore::Store::parse(published.as_bytes()).unwrap())
269	.unwrap()
270	.active(a)
271	.unwrap();
272	v14(&path, SOURCE, &[Queued::Page(a, after.clone())], None);
273	Connection::open(&path)
274	.unwrap()
275	.execute(
276	"INSERT INTO attempt VALUES (1, 2, ?1)",
277	[json!({a.to_string(): revision.to_string()}).to_string()],
278	)
279	.unwrap();
280	let cache = Replica::open(&path).unwrap();
281	let awaiting = EditStatus::AwaitingConfirmation { revision };
282	assert_eq!(cache.status(2).unwrap(), Some(awaiting.clone()));
283	let mut unchanged = Server::new(SOURCE);
284	assert_eq!(
285	cache.sync_once(&mut unchanged).unwrap().edit,
286	Some((2, awaiting))
287	);
288	assert_eq!(unchanged.publications, 0);
289	let mut landed = Server::new(published.as_bytes());
290	assert_eq!(
291	cache.sync_once(&mut landed).unwrap().edit,
292	Some((2, EditStatus::Published { revision }))
293	);
294	assert_eq!(landed.publications, 0);
295	drop(cache);
296
297	// The oldest edit was in conflict: the conversion lowered it onto the remote page the
298	// conflict was recorded against, and keeping mine publishes it.
299	let path = directory.path().join("conflicted.sqlite");
300	let remote = PreparedEdit::page(SOURCE, a, &appended(SOURCE, a, a_text, " remote"), "Native")
301	.unwrap()
302	.as_bytes()
303	.to_vec();
304	let local = appended(SOURCE, a, a_text, " local");
305	let working = PreparedEdit::page(SOURCE, a, &local, "Author")
306	.unwrap()
307	.as_bytes()
308	.to_vec();
309	{
310	// Schema 14 stored the remote as the base and kept the local working image.
311	v14(&path, &remote, &[], Some(&working));
312	let connection = Connection::open(&path).unwrap();
313	connection
314	.execute(
315	"INSERT INTO edits(space, operation) VALUES (?1, ?2)",
316	params![
317	a.to_string(),
318	json!({"Page": {"before": model_ops::page_of(SOURCE, a), "after": local, "author": "Author"}}).to_string()
319	],
320	)
321	.unwrap();
322	connection
323	.execute("INSERT INTO conflicts VALUES (2, 3)", [])
324	.unwrap();
325	}
326	let cache = Replica::open(&path).unwrap();
327	assert_eq!(
328	cache.status(2).unwrap(),
329	Some(EditStatus::Conflict(ConflictKind::ContentChanged))
330	);
331	assert_eq!(
332	model_ops::page_of(&cache.snapshot().unwrap(), a),
333	model_ops::page_of(&working, a)
334	);
335	let mut server = Server::new(&remote);
336	assert_eq!(
337	cache.sync_once(&mut server).unwrap().edit,
338	Some((2, EditStatus::Conflict(ConflictKind::ContentChanged)))
339	);
340	cache.resolve(2, Resolution::Mine).unwrap();
341	assert!(matches!(
342	cache.sync_once(&mut server).unwrap().edit,
343	Some((2, EditStatus::Published { .. }))
344	));
345	assert_eq!(
346	model_ops::page_of(&server.durable, a),
347	model_ops::page_of(&working, a)
348	);
349	}
350
351	#[test]
352	fn a_page_the_conversion_cannot_reproduce_leaves_the_cache_untouched() {
353	let body = body_pages(SOURCE);
354	let (a, a_text) = body[0];
355	let directory = tempfile::tempdir().unwrap();
356	let path = directory.path().join("cache.sqlite");
357	// The working image holds a page the queued edit does not reach.
358	let stray = PreparedEdit::page(SOURCE, a, &appended(SOURCE, a, a_text, " stray"), "Author")
359	.unwrap()
360	.as_bytes()
361	.to_vec();
362	v14(
363	&path,
364	SOURCE,
365	&[Queued::Page(a, appended(SOURCE, a, a_text, " queued"))],
366	Some(&stray),
367	);
368	let before = std::fs::read(&path).unwrap();
369	let Err(notebook::Error::Io(error)) = Replica::open(&path) else {
370	panic!("the conversion must fail")
371	};
372	assert_eq!(error.kind(), std::io::ErrorKind::InvalidData);
373	assert!(error.to_string().contains(".v14-recovery"), "{error}");
374	assert_eq!(std::fs::read(&path).unwrap(), before);
375	assert!(archive(&path).exists());
376	let version: u32 = Connection::open(archive(&path))
377	.unwrap()
378	.pragma_query_value(None, "user_version", \|row\| row.get(0))
379	.unwrap();
380	assert_eq!(version, 14);
381	// A second open tries again from the same untouched cache.
382	assert!(Replica::open(&path).is_err());
383	assert_eq!(std::fs::read(&path).unwrap(), before);
384	}

crates/notebook/tests/session.rs+26-15

 @@ -1,5 +1,5 @@
 use notebook::{
-    ConflictKind, EditStatus, Recovery,
+    ConflictKind, EditStatus, Recovery, Resolution,
     session::{Event, Notebook, QueuedEdit, Save, Section},
 };
 use onestore::{ExGuid, PreparedEdit, page::Page};
 @@ -62,10 +62,14 @@ fn wait(section: &Section, mut accept: impl FnMut(&Event) -> bool) {
 }
 fn published(section: &Section, id: u64) {
-    wait(
+    let deadline = Instant::now() + Duration::from_secs(20);
-        section,
+    while !matches!(
-        |event| matches!(event, Event::Attempt { id: n, status: EditStatus::Published { .. } } if *n == id),
+        section.status(id).unwrap(),
-    );
+        Some(EditStatus::Published { .. })
+    ) {
+        assert!(Instant::now() < deadline, "the edit was not published");
+        std::thread::sleep(Duration::from_millis(20));
+    }
 }
 fn stored_page(file: &Path, space: ExGuid) -> Page {
 @@ -79,6 +83,13 @@ fn assert_same(actual: Page, expected: &Page) {
     assert_eq!(actual, expected);
 }
+#[test]
+fn a_section_is_shared_between_threads() {
+    fn shared<T: Send + Sync>() {}
+    shared::<Section>();
+    shared::<notebook::Replica>();
+}
 #[test]
 fn a_section_opens_through_its_replica_and_a_save_reaches_the_file_and_survives_relaunch() {
     let directory = tempfile::tempdir().unwrap();
 @@ -765,7 +776,7 @@ fn a_conflicting_save_is_reviewed_against_the_remote_page_and_archived_for_recov
 mod server;
 /// An uncertain attempt survives a restart as `AwaitingConfirmation`; after exporting the
-/// archive the user either continues from a reviewed page or abandons the branch. Neither
+/// archive the user either publishes the local edits again or abandons the branch. Neither
 /// path records a receipt for the uncertain attempt.
 #[test]
 fn an_uncertain_attempt_is_released_after_restart_by_review() {
 @@ -778,10 +789,8 @@ fn an_uncertain_attempt_is_released_after_restart_by_review() {
         let replica = notebook::Replica::create(&cache, &source).unwrap();
         let space = space_of(&source);
         let page = model_ops::page_of(&source, space);
-        let text = first_text(&page);
         let local = edited(&page, "Uncertain ");
-        let id = replica
+        let id = model_ops::save_as(&replica, space, &local, "Author")
-            .save(&source, space, &local, "Author")
             .unwrap()
             .unwrap();
         let mut faulty = server::Server::new(&source);
 @@ -815,14 +824,12 @@ fn an_uncertain_attempt_is_released_after_restart_by_review() {
         assert_same(section.page(space).unwrap(), &local);
         let archive = directory.path().join("review.sqlite");
         if continued {
-            let mut reviewed = section.remote_page(space).unwrap();
+            section.release(id, &archive, Resolution::Mine).unwrap();
-            model_ops::replace_text(&mut reviewed, text, 0..0, "Reviewed ");
-            section.release(id, &archive, Some(&reviewed)).unwrap();
             assert_eq!(section.status(id).unwrap(), Some(EditStatus::Pending));
             published(&section, id);
-            assert_same(stored_page(&file, space), &reviewed);
+            assert_same(stored_page(&file, space), &local);
         } else {
-            section.release(id, &archive, None).unwrap();
+            section.release(id, &archive, Resolution::Theirs).unwrap();
             assert_eq!(
                 section.status(id).unwrap(),
                 Some(EditStatus::Archived {
 @@ -841,7 +848,11 @@ fn an_uncertain_attempt_is_released_after_restart_by_review() {
         assert!(section.queue().unwrap().is_empty());
         assert!(
             section
-                .release(id, directory.path().join("again.sqlite"), None)
+                .release(
+                    id,
+                    directory.path().join("again.sqlite"),
+                    Resolution::Theirs
+                )
                 .is_err()
         );
         section.close().unwrap();

crates/notebook/tests/smb_queue.rs created+249

...	@@ -0,0 +1,249 @@
1	//! The op queue against a disposable Samba lab (`ONESTORE_SMB_LAB=127.0.0.1:PORT`, share
2	//! `agent`): publications read only the file's header, a native change is read once and
3	//! merged, and a session edits through the embedded client.
4	#![cfg(feature = "smb")]
5
6	use notebook::{
7	EditStatus, Remote, Replica, SmbRemote,
8	session::{Event, Section},
9	smb::{Client, Credentials},
10	};
11	use onestore::{
12	CommitError, ExGuid, Stamp, Transaction,
13	op::{Edit, Op, PageOp},
14	};
15	use std::{
16	io,
17	time::{Duration, Instant, SystemTime, UNIX_EPOCH},
18	};
19
20	fn client() -> Client {
21	Client::connect(
22	&std::env::var("ONESTORE_SMB_LAB").unwrap(),
23	"agent",
24	Credentials::default(),
25	Duration::from_secs(5),
26	)
27	.unwrap()
28	}
29
30	fn unique(name: &str) -> String {
31	format!(
32	"{name}-{}.one",
33	SystemTime::now()
34	.duration_since(UNIX_EPOCH)
35	.unwrap()
36	.as_nanos()
37	)
38	}
39
40	/// The remote, counting whole-file reads.
41	struct Counted {
42	remote: SmbRemote,
43	reads: usize,
44	stamps: usize,
45	}
46
47	impl Remote for Counted {
48	fn read(&mut self) -> io::Result<Vec<u8>> {
49	self.reads += 1;
50	self.remote.read()
51	}
52	fn stamp(&mut self) -> io::Result<Option<Stamp>> {
53	self.stamps += 1;
54	self.remote.stamp()
55	}
56	fn publish(&mut self, transaction: &Transaction) -> Result<(), CommitError> {
57	self.remote.publish(transaction)
58	}
59	fn confirm(&mut self, snapshot: &[u8]) -> Result<(), CommitError> {
60	self.remote.confirm(snapshot)
61	}
62	}
63
64	/// The first page's space and first body text.
65	fn target(replica: &Replica) -> (ExGuid, ExGuid) {
66	let space = replica.pages().unwrap()[0].0;
67	let text = replica
68	.page(space)
69	.unwrap()
70	.objects
71	.iter()
72	.find_map(\|object\| match object {
73	onestore::page::PageObject::Outline(outline) => outline
74	.paragraphs
75	.iter()
76	.find_map(\|p\| p.text().map(\|t\| t.id)),
77	_ => None,
78	})
79	.unwrap();
80	(space, text)
81	}
82
83	fn typed(space: ExGuid, text: ExGuid, at: u32, with: &str) -> Edit {
84	Edit {
85	at: 133_000_000_000_000_000,
86	ops: vec![Op::Page {
87	space,
88	op: PageOp::Text {
89	text,
90	range: at..at,
91	with: with.into(),
92	},
93	}],
94	}
95	}
96
97	fn text_of(replica: &Replica, space: ExGuid, text: ExGuid) -> String {
98	let page = replica.page(space).unwrap();
99	page.objects
100	.iter()
101	.find_map(\|object\| match object {
102	onestore::page::PageObject::Outline(outline) => outline
103	.paragraphs
104	.iter()
105	.find_map(\|p\| p.text().filter(\|t\| t.id == text)),
106	_ => None,
107	})
108	.unwrap()
109	.text
110	.text()
111	.to_owned()
112	}
113
114	#[test]
115	#[ignore = "requires ONESTORE_SMB_LAB pointing to disposable Samba"]
116	fn live_keystrokes_publish_reading_only_the_header_and_a_native_change_merges() {
117	let lab = client();
118	let path = unique("queue");
119	let source = onestore::create_section(&path, "Body", "Author").unwrap();
120	lab.create(&path, &source).unwrap();
121	let directory = tempfile::tempdir().unwrap();
122	let replica = Replica::create(directory.path().join("cache.sqlite"), &source).unwrap();
123	let (space, text) = target(&replica);
124	let mut remote = Counted {
125	remote: SmbRemote::new(client(), path.clone(), 1 << 24),
126	reads: 0,
127	stamps: 0,
128	};
129	for n in 0..20 {
130	let at = 4 + n;
131	let id = replica
132	.apply("Author", typed(space, text, at, "x"))
133	.unwrap();
134	assert!(matches!(
135	replica.sync_once(&mut remote).unwrap().edit,
136	Some((published, EditStatus::Published { .. })) if published == id
137	));
138	}
139	assert_eq!(remote.reads, 0, "publications read only the header");
140	assert_eq!(remote.stamps, 20);
141	assert_eq!(
142	lab.read(&path, 1 << 24).unwrap(),
143	replica.snapshot().unwrap()
144	);
145	for _ in 0..5 {
146	assert_eq!(replica.sync_once(&mut remote).unwrap().edit, None);
147	}
148	assert_eq!(remote.reads, 0, "idle polls read only the header");
149
150	// Another writer types at the start of the same text; a local edit at its end merges.
151	let native = {
152	let arena = onestore::Arena::default();
153	let mut section =
154	onestore::Section::open(&arena, lab.read(&path, 1 << 24).unwrap()).unwrap();
155	section
156	.apply("Native", &typed(space, text, 0, "Native "))
157	.unwrap();
158	section.seal().unwrap().unwrap()
159	};
160	lab.commit_transaction(&path, &native).unwrap();
161	let end = text_of(&replica, space, text).encode_utf16().count() as u32;
162	let id = replica
163	.apply("Author", typed(space, text, end, " local"))
164	.unwrap();
165	let synced = replica.sync_once(&mut remote).unwrap();
166	assert_eq!(synced.changed, [space]);
167	assert!(
168	matches!(synced.edit, Some((published, EditStatus::Published { .. })) if published == id)
169	);
170	assert_eq!(remote.reads, 1, "a changed remote is read once");
171	let merged = text_of(&replica, space, text);
172	assert!(merged.starts_with("Native Body"), "{merged}");
173	assert!(merged.ends_with(" local"), "{merged}");
174	assert_eq!(
175	lab.read(&path, 1 << 24).unwrap(),
176	replica.snapshot().unwrap()
177	);
178	lab.delete(&path).unwrap();
179	}
180
181	#[test]
182	#[ignore = "requires ONESTORE_SMB_LAB pointing to disposable Samba"]
183	fn live_session_applies_edits_through_the_embedded_client_and_reopens() {
184	let lab = client();
185	let path = unique("session");
186	let source = onestore::create_section(&path, "Session", "Author").unwrap();
187	lab.create(&path, &source).unwrap();
188	let directory = tempfile::tempdir().unwrap();
189	let cache = directory.path().join("cache.sqlite");
190	let section = Section::resume_smb(
191	path.clone(),
192	Replica::create(&cache, &source).unwrap(),
193	1 << 24,
194	\|\| {
195	Client::connect(
196	&std::env::var("ONESTORE_SMB_LAB").unwrap(),
197	"agent",
198	Credentials::default(),
199	Duration::from_secs(5),
200	)
201	},
202	\|\| {},
203	)
204	.unwrap();
205	let (space, text) = target(section.replica());
206	for n in 0..10 {
207	section
208	.apply("Author", typed(space, text, n, &n.to_string()))
209	.unwrap();
210	}
211	// Applying does not wait: the edits are done when the file holds them.
212	let remote_text = \|bytes: Vec<u8>\| {
213	let arena = onestore::Arena::default();
214	let section = onestore::Section::open(&arena, bytes).unwrap();
215	let page = section.page(space).unwrap();
216	page.objects
217	.iter()
218	.find_map(\|object\| match object {
219	onestore::page::PageObject::Outline(outline) => {
220	outline.paragraphs.iter().find_map(\|p\| {
221	p.text()
222	.filter(\|t\| t.id == text)
223	.map(\|t\| t.text.text().to_owned())
224	})
225	}
226	_ => None,
227	})
228	.unwrap()
229	};
230	let deadline = Instant::now() + Duration::from_secs(30);
231	while remote_text(lab.read(&path, 1 << 24).unwrap()) != "0123456789Session"
232	\|\| !section.pending().unwrap().is_empty()
233	{
234	assert!(Instant::now() < deadline, "the edits were not published");
235	for event in section.events() {
236	assert!(
237	!matches!(event, Event::Rejected { .. } \| Event::Failed(_)),
238	"{event:?}"
239	);
240	}
241	std::thread::sleep(Duration::from_millis(50));
242	}
243	let published = lab.read(&path, 1 << 24).unwrap();
244	section.close().unwrap();
245	let replica = Replica::open(&cache).unwrap();
246	assert_eq!(text_of(&replica, space, text), "0123456789Session");
247	assert_eq!(replica.snapshot().unwrap(), published);
248	lab.delete(&path).unwrap();
249	}

crates/notebook/tests/support/model_ops.rs+63-12

...	@@ -225,28 +225,79 @@ pub fn delete_paragraph(page: &mut Page, text: ExGuid) {	...	@@ -225,28 +225,79 @@ pub fn delete_paragraph(page: &mut Page, text: ExGuid) {
225	panic!("text is on the page");	225	panic!("text is on the page");
226	}	226	}
227		227
228	/// Saves `edit` applied to the page containing `text`, using the replica's current image.	228	/// FILETIME now.
		229	pub fn now() -> u64 {
		230	let unix = std::time::SystemTime::now()
		231	.duration_since(std::time::UNIX_EPOCH)
		232	.unwrap();
		233	(unix.as_secs() + 11_644_473_600) * 10_000_000
		234	}
		235
		236	/// Queues the ops taking the page in `space` to `after`, or nothing when they are equal.
		237	pub fn save_as(
		238	cache: &Replica,
		239	space: ExGuid,
		240	after: &Page,
		241	author: &str,
		242	) -> Result<Option<u64>, notebook::Error> {
		243	save_from(cache, space, &cache.page(space)?, after, author)
		244	}
		245
		246	/// Queues the ops taking `before`, the page in `space` as it was read, to `after`.
		247	pub fn save_from(
		248	cache: &Replica,
		249	space: ExGuid,
		250	before: &Page,
		251	after: &Page,
		252	author: &str,
		253	) -> Result<Option<u64>, notebook::Error> {
		254	let ops = onestore::op::lower_page(before, after)?;
		255	if ops.is_empty() {
		256	return Ok(None);
		257	}
		258	cache
		259	.apply(
		260	author,
		261	onestore::op::Edit {
		262	at: now(),
		263	ops: ops
		264	.into_iter()
		265	.map(\|op\| onestore::op::Op::Page { space, op })
		266	.collect(),
		267	},
		268	)
		269	.map(Some)
		270	}
		271
		272	/// Queues `edit` of the page in `space`.
		273	pub fn save_page(
		274	cache: &Replica,
		275	space: ExGuid,
		276	edit: impl FnOnce(&mut Page),
		277	) -> Result<Option<u64>, notebook::Error> {
		278	let before = cache.page(space)?;
		279	let mut after = before.clone();
		280	edit(&mut after);
		281	save_from(cache, space, &before, &after, AUTHOR)
		282	}
		283
		284	/// Queues `edit` of the page containing `text`.
229	pub fn save(	285	pub fn save(
230	cache: &Replica,	286	cache: &Replica,
231	text: ExGuid,	287	text: ExGuid,
232	edit: impl FnOnce(&mut Page),	288	edit: impl FnOnce(&mut Page),
233	) -> Result<Option<u64>, notebook::Error> {	289	) -> Result<Option<u64>, notebook::Error> {
234	let source = cache.snapshot()?;	290	let (space, _) = locate(&cache.snapshot()?, text);
235	let (space, mut page) = locate(&source, text);	291	save_page(cache, space, edit)
236	edit(&mut page);
237	cache.save(&source, space, &page, AUTHOR)
238	}	292	}
239		293
240	/// Reviews a conflicting save by applying `edit` to the current remote page.	294	/// Resolves a conflict by taking the remote page, then queues `edit` of it.
241	pub fn review(	295	pub fn review(
242	cache: &Replica,	296	cache: &Replica,
243	id: u64,	297	id: u64,
244	text: ExGuid,	298	text: ExGuid,
245	edit: impl FnOnce(&mut Page),	299	edit: impl FnOnce(&mut Page),
246	) -> Result<(), notebook::Error> {	300	) -> Result<Option<u64>, notebook::Error> {
247	let local = cache.snapshot()?;	301	cache.resolve(id, notebook::Resolution::Theirs)?;
248	let remote = cache.remote_snapshot()?;	302	save(cache, text, edit)
249	let (_, mut page) = locate(&remote, text);
250	edit(&mut page);
251	cache.review_page(id, &local, &remote, &page)
252	}	303	}

crates/notebook/tests/support/model_schedule.rs+66-79

 @@ -3,7 +3,7 @@
 use crate::model_ops::{self, AUTHOR};
 use crate::server::{Fault, Server};
-use notebook::{EditStatus, Operation, Remote, Replica};
+use notebook::{EditStatus, Remote, Replica, Resolution};
 use onestore::{
     CommitError, ExGuid, PreparedEdit, RevisionIndex, Store, Transaction,
     document::Document,
 @@ -126,11 +126,10 @@ pub(crate) fn move_subtree(
     }
 }
-/// Asserts the publication invariants that survive the page model, then delegates.
+/// Asserts the publication invariants, then delegates.
 struct Session<'a> {
     server: &'a mut Server,
-    intent: Option<(u64, Operation)>,
+    /// The head batch was already attempted, so its publication must never be repeated.
-    /// The intent was already attempted, so its publication must never be repeated.
     retired: bool,
     publications: usize,
 }
 @@ -144,18 +143,6 @@ impl Remote for Session<'_> {
         assert!(!self.retired, "a retired attempt was replayed");
         self.publications += 1;
         assert_eq!(self.publications, 1);
-        let Some((_, Operation::Page(intent))) = &self.intent else {
-            panic!("the schedule queues page saves only")
-        };
-        let mut image = self.server.visible.clone();
-        if transaction.apply(&mut image).is_ok()
-            && model_ops::page_of(&self.server.visible, SOURCE.1) == intent.before
-        {
-            assert_eq!(
-                shape(&model_ops::page_of(&image, SOURCE.1)),
-                shape(&intent.after)
-            );
-        }
         self.server.publish(transaction)
     }
 @@ -164,6 +151,11 @@ impl Remote for Session<'_> {
     }
 }
+/// The page's shape as the replica's queue leaves it.
+fn local(cache: &Replica) -> Vec<String> {
+    shape(&cache.page(SOURCE.1).unwrap())
+}
 fn statuses(cache: &Replica) -> Vec<(u64, Option<EditStatus>)> {
     cache
         .pending()
 @@ -190,12 +182,13 @@ pub fn run(input: &[u8]) {
         let path = directory.path().join(format!("{actor}.sqlite"));
         let cache = replicas[actor].get_or_insert_with(|| Replica::create(&path, source).unwrap());
         let snapshot = cache.snapshot().unwrap();
+        let before = local(cache);
         let pending = cache.pending().unwrap();
-        let local = rows(&snapshot);
+        let rows_now = rows(&snapshot);
         match step[1] % 8 {
             0..=2 => {
-                let row = local[usize::from(step[2]) % local.len()].clone();
+                let row = rows_now[usize::from(step[2]) % rows_now.len()].clone();
-                let other = local[usize::from(step[4]) % local.len()].clone();
+                let other = rows_now[usize::from(step[4]) % rows_now.len()].clone();
                 let change: Box<dyn Fn(&mut Page)> = match step[3] % 6 {
                     0 if !row.2.is_empty() => Box::new(move |page| {
                         model_ops::replace_text(
 @@ -229,24 +222,20 @@ pub fn run(input: &[u8]) {
                     }),
                     _ => Box::new(|_| {}),
                 };
-                let mut after = model_ops::page_of(&snapshot, *space);
+                let mut after = cache.page(*space).unwrap();
                 change(&mut after);
-                match cache.save(&snapshot, *space, &after, AUTHOR) {
+                match model_ops::save_as(cache, *space, &after, AUTHOR) {
                     Ok(id) => {
                         let next = cache.pending().unwrap();
                         let ids = |edits: &[notebook::PendingEdit]| -> Vec<u64> {
                             edits.iter().map(|edit| edit.id).collect()
                         };
                         assert_eq!(ids(&next)[..pending.len()], ids(&pending)[..]);
-                        assert!(next.len() <= pending.len() + 1);
+                        assert_eq!(next.len(), pending.len() + usize::from(id.is_some()));
-                        assert_eq!(id.is_some(), cache.snapshot().unwrap() != snapshot);
+                        assert_eq!(local(cache), shape(&after));
-                        assert_eq!(
-                            shape(&model_ops::page_of(&cache.snapshot().unwrap(), *space)),
-                            shape(&after)
-                        );
                     }
                     Err(_) => {
-                        assert_eq!(cache.snapshot().unwrap(), snapshot);
+                        assert_eq!(local(cache), before);
                         assert_eq!(cache.pending().unwrap(), pending);
                     }
                 }
 @@ -270,9 +259,6 @@ pub fn run(input: &[u8]) {
                                 Some(EditStatus::AwaitingConfirmation { .. })
                             )
                         }),
-                        intent: pending
-                            .first()
-                            .map(|edit| (edit.id, edit.operation.clone())),
                         server: &mut server,
                         publications: 0,
                     };
 @@ -280,22 +266,27 @@ pub fn run(input: &[u8]) {
                 };
                 server.fault = Fault::None;
                 let next = cache.pending().unwrap();
-                if next.len() == pending.len() {
+                // Edits leave the queue oldest first, each with a durable receipt.
-                    assert_eq!(next, pending);
+                let left = pending.len() - next.len();
-                    if !next.is_empty() {
+                assert!(
-                        assert_eq!(cache.snapshot().unwrap(), snapshot);
+                    next.iter()
-                    }
+                        .all(|edit| pending[left..].iter().any(|kept| kept.id == edit.id))
-                } else {
+                );
-                    assert_eq!(next, pending[1..]);
+                for edit in &pending[..left] {
-                    let Some(EditStatus::Published { revision }) =
+                    let Some(EditStatus::Published { revision }) = cache.status(edit.id).unwrap()
-                        cache.status(head.unwrap()).unwrap()
                     else {
-                        panic!("an intent leaves the queue only with its receipt")
+                        panic!("an edit leaves the queue only with its receipt")
                     };
                     durable(&server, revision);
                 }
                 if next.is_empty() && result.is_ok() {
-                    assert_eq!(cache.snapshot().unwrap(), cache.remote_snapshot().unwrap());
+                    assert_eq!(
+                        local(cache),
+                        shape(&model_ops::page_of(
+                            &cache.remote_snapshot().unwrap(),
+                            *space
+                        ))
+                    );
                 }
             }
             5 => {
 @@ -317,44 +308,40 @@ pub fn run(input: &[u8]) {
                 }
             }
             6 => {
-                if let Some(head) = pending.first()
+                if let Some(conflict) = cache.conflict().unwrap() {
-                    && matches!(
+                    let keep = if step[2] & 1 == 0 {
-                        cache.status(head.id).unwrap(),
+                        Resolution::Mine
-                        Some(EditStatus::Conflict(_))
+                    } else {
-                    )
+                        Resolution::Theirs
-                {
+                    };
-                    let remote = cache.remote_snapshot().unwrap();
+                    let remote = model_ops::page_of(&cache.remote_snapshot().unwrap(), *space);
-                    let published = rows(&remote);
+                    cache.resolve(conflict.id, keep).unwrap();
-                    let row = published[usize::from(step[2]) % published.len()].clone();
+                    match cache.conflict().unwrap() {
-                    let mut after = model_ops::page_of(&remote, *space);
+                        Some(next) => assert_ne!(next.space, conflict.space),
-                    if !row.2.is_empty() {
+                        None => assert_eq!(
-                        model_ops::replace_text(&mut after, row.1, 0..1, "R");
+                            local(cache),
+                            match keep {
+                                Resolution::Mine => before.clone(),
+                                Resolution::Theirs => shape(&remote),
+                            }
+                        ),
                     }
-                    if cache
+                    let (result, publications) = {
-                        .review_page(head.id, &snapshot, &remote, &after)
+                        let mut session = Session {
-                        .is_ok()
+                            retired: false,
-                    {
+                            server: &mut server,
-                        assert_eq!(cache.status(head.id).unwrap(), Some(EditStatus::Pending));
+                            publications: 0,
-                        let (result, publications) = {
-                            let mut session = Session {
-                                intent: Some((
-                                    head.id,
-                                    cache.pending().unwrap()[0].operation.clone(),
-                                )),
-                                retired: false,
-                                server: &mut server,
-                                publications: 0,
-                            };
-                            (cache.sync_once(&mut session), session.publications)
                         };
-                        assert!(publications <= 1);
+                        (cache.sync_once(&mut session), session.publications)
-                        if let Ok(Some((id, EditStatus::Published { revision }))) = result {
+                    };
-                            assert_eq!(id, head.id);
+                    assert!(publications <= 1);
-                            durable(&server, revision);
+                    if let Ok(notebook::Synced {
-                            assert!(cache.pending().unwrap().iter().all(|e| e.id != id));
+                        edit: Some((id, EditStatus::Published { revision })),
-                        }
+                        ..
-                    } else {
+                    }) = result
-                        assert_eq!(cache.pending().unwrap(), pending);
+                    {
+                        durable(&server, revision);
+                        assert!(cache.pending().unwrap().iter().all(|e| e.id != id));
                     }
                 }
             }
 @@ -362,7 +349,7 @@ pub fn run(input: &[u8]) {
                 let recorded = statuses(cache);
                 replicas[actor] = None;
                 let cache = Replica::open(&path).unwrap();
-                assert_eq!(cache.snapshot().unwrap(), snapshot);
+                assert_eq!(local(&cache), before);
                 assert_eq!(cache.pending().unwrap(), pending);
                 assert_eq!(statuses(&cache), recorded);
                 replicas[actor] = Some(cache);

crates/notebook/tests/support/page_schedule.rs+55-103

 @@ -1,7 +1,7 @@
-use crate::disk;
+use crate::{disk, model_ops};
-use notebook::{EditStatus, Operation, Remote, Replica};
+use notebook::{EditStatus, Remote, Replica, Resolution};
 use onestore::{
-    CommitError, ExGuid, PageEdit, PagePosition, PreparedEdit, RevisionIndex, Store, Transaction,
+    CommitError, ExGuid, PageEdit, PreparedEdit, RevisionIndex, Store, Transaction,
     document::{Document, Format, Kind, Layout},
     page::{
         Outline, Page, PageObject, PageParagraph, Paragraph, ParagraphContent, TextObject,
 @@ -97,27 +97,9 @@ pub fn body_outline(page: &mut Page, text: &str) -> ExGuid {
     id
 }
-/// The text identity of the first body outline's first paragraph.
+/// Publishes through the crash-injecting disk, asserting each commit is atomic.
-fn body_text(page: &Page) -> ExGuid {
-    page.objects
-        .iter()
-        .find_map(|object| match object {
-            PageObject::Outline(outline) => outline.paragraphs[0].text().map(|text| text.id),
-            _ => None,
-        })
-        .unwrap()
-}
-fn page_of(source: &[u8], space: ExGuid) -> Page {
-    let store = Store::parse(source).unwrap();
-    let index = RevisionIndex::parse(&store).unwrap();
-    let document = Document::parse(&index).unwrap();
-    Page::from_space(&document, space).unwrap()
-}
 struct Session<'a> {
     disk: &'a mut disk::Disk,
-    operation: Option<&'a Operation>,
 }
 impl Remote for Session<'_> {
 @@ -128,41 +110,6 @@ impl Remote for Session<'_> {
     fn publish(&mut self, transaction: &Transaction) -> Result<(), CommitError> {
         let mut image = self.disk.visible.clone();
         transaction.apply(&mut image).unwrap();
-        let mut expected = pages(&self.disk.visible);
-        match self.operation.unwrap() {
-            Operation::CreatePage(page) => expected.push((page.space(), page.object(), 1)),
-            Operation::Pages(batch) => {
-                for change in &batch.edits {
-                    let at = expected.iter().position(|p| p.0 == change.space()).unwrap();
-                    expected[at].2 = change.level();
-                    if let PagePosition::Before(before) = change.position() {
-                        let page = expected.remove(at);
-                        let at = before.map_or(expected.len(), |before| {
-                            expected.iter().position(|p| p.0 == before).unwrap()
-                        });
-                        expected.insert(at, page);
-                    }
-                }
-            }
-            Operation::Page(intent) => {
-                let body = body_text(&intent.after);
-                let store = Store::parse(&image).unwrap();
-                let index = RevisionIndex::parse(&store).unwrap();
-                let document = Document::parse(&index).unwrap();
-                let matching: Vec<_> = document
-                    .spaces
-                    .values()
-                    .filter_map(|space| {
-                        let view = &space.revisions[&space.contexts[&ExGuid::default()]];
-                        view.nodes.get(&body)
-                    })
-                    .collect();
-                assert_eq!(matching.len(), 1);
-                assert!(matches!(&matching[0].kind, Kind::RichText { text, .. } if text == BODY));
-            }
-            _ => panic!(),
-        }
-        assert_eq!(pages(&image), expected);
         let old = current::current(&self.disk.durable);
         let new = current::current(&image);
         let result = transaction.commit(self.disk);
 @@ -179,6 +126,16 @@ impl Remote for Session<'_> {
     }
 }
+fn section_op(cache: &Replica, op: onestore::op::SectionOp) -> Result<u64, notebook::Error> {
+    cache.apply(
+        "Author",
+        onestore::op::Edit {
+            at: 133_000_000_000_000_000,
+            ops: vec![onestore::op::Op::Section(op)],
+        },
+    )
+}
 pub fn run(input: &[u8]) {
     let directory = tempfile::tempdir().unwrap();
     let mut replicas: [Option<Replica>; 12] = std::array::from_fn(|_| None);
 @@ -196,21 +153,27 @@ pub fn run(input: &[u8]) {
         let path = directory.path().join(format!("{actor}.sqlite"));
         let cache = replicas[actor].get_or_insert_with(|| Replica::create(&path, &SOURCE).unwrap());
         let snapshot = cache.snapshot().unwrap();
+        let listed = pages(&snapshot);
         let pending = cache.pending().unwrap();
         match step[1] % 8 {
             0 | 1 => {
-                let title = (step[2] & 1 != 0).then_some("Same 🦋 é");
+                let title = (step[2] & 1 != 0).then_some("Same 🦋 é");
                 let page = onestore::PageCreation::new(None, title, "Author").unwrap();
-                cache.create_page(&snapshot, &page).unwrap().unwrap();
+                section_op(cache, onestore::op::SectionOp::Create(page.clone())).unwrap();
                 owned[actor].push((page.space(), page.object()));
                 if step[1] % 8 == 1 {
-                    let source = cache.snapshot().unwrap();
+                    let mut model = cache.page(page.space()).unwrap();
-                    let mut model = page_of(&source, page.space());
                     body_outline(&mut model, BODY);
-                    cache
+                    model_ops::save_as(cache, page.space(), &model, "Author")
-                        .save(&source, page.space(), &model, "Author")
                         .unwrap()
                         .unwrap();
+                    let local = cache.page(page.space()).unwrap();
+                    assert!(
+                        local
+                            .objects
+                            .iter()
+                            .any(|object| matches!(object, PageObject::Outline(o) if o.paragraphs[0].text().is_some_and(|t| t.text.text() == BODY)))
+                    );
                 }
             }
             2 => {
 @@ -220,7 +183,7 @@ pub fn run(input: &[u8]) {
                     .collect();
                 replicas[actor] = None;
                 let cache = Replica::open(&path).unwrap();
-                assert!(cache.snapshot().unwrap() == snapshot);
+                assert_eq!(pages(&cache.snapshot().unwrap()), listed);
                 assert_eq!(cache.pending().unwrap(), pending);
                 assert_eq!(
                     pending
 @@ -240,15 +203,20 @@ pub fn run(input: &[u8]) {
                 let prior = pending
                     .first()
                     .and_then(|edit| cache.status(edit.id).unwrap());
-                let mut session = Session {
+                let result = cache.sync_once(&mut Session { disk: &mut disk });
-                    disk: &mut disk,
-                    operation: pending.first().map(|edit| &edit.operation),
-                };
-                let result = cache.sync_once(&mut session);
                 if matches!(prior, Some(EditStatus::AwaitingConfirmation { .. })) {
                     assert!(
                         result.is_err()
-                            || !matches!(result.unwrap(), Some((_, EditStatus::Conflict(_))))
+                            || !matches!(
+                                result.as_ref().unwrap().edit,
+                                Some((_, EditStatus::Conflict(_)))
+                            )
+                    );
+                }
+                if result.is_ok() && cache.pending().unwrap().is_empty() {
+                    assert_eq!(
+                        pages(&cache.snapshot().unwrap()),
+                        pages(&cache.remote_snapshot().unwrap())
                     );
                 }
             }
 @@ -257,13 +225,12 @@ pub fn run(input: &[u8]) {
                 disk.fail_at = None;
             }
             6 => {
-                let order = pages(&snapshot);
                 let count = 1 + usize::from(step[3] & 1 != 0);
                 let selected: Vec<_> = (0..count)
-                    .map(|i| order[(usize::from(step[2]) + i) % order.len()].0)
+                    .map(|i| listed[(usize::from(step[2]) + i) % listed.len()].0)
                     .collect();
                 let anchor = (step[4] & 1 != 0)
-                    .then_some(order[usize::from(step[5]) % order.len()].0)
+                    .then_some(listed[usize::from(step[5]) % listed.len()].0)
                     .filter(|sid| !selected.contains(sid));
                 let edits: Vec<_> = selected
                     .iter()
 @@ -278,43 +245,28 @@ pub fn run(input: &[u8]) {
                     })
                     .collect();
                 let expected = PreparedEdit::pages(&snapshot, &edits);
-                match cache.pages(&snapshot, &edits) {
+                match section_op(cache, onestore::op::SectionOp::Pages(edits)) {
-                    Ok(id) => {
+                    Ok(_) => assert_eq!(
-                        let expected = expected.unwrap();
+                        pages(&cache.snapshot().unwrap()),
-                        assert_eq!(
+                        pages(expected.unwrap().as_bytes())
-                            current::current(&cache.snapshot().unwrap()),
+                    ),
-                            current::current(expected.as_bytes())
-                        );
-                        assert_eq!(id.is_some(), expected.as_bytes() != snapshot);
-                    }
                     Err(_) => {
                         assert!(expected.is_err());
-                        assert_eq!(cache.snapshot().unwrap(), snapshot);
+                        assert_eq!(pages(&cache.snapshot().unwrap()), listed);
                         assert_eq!(cache.pending().unwrap(), pending);
                     }
                 }
             }
             7 => {
-                if let Some(edit) = pending.first()
+                if let Some(conflict) = cache.conflict().unwrap() {
-                    && matches!(
+                    // Taking theirs for the page list would drop the pages this actor made.
-                        cache.status(edit.id).unwrap(),
+                    let root = listed.iter().all(|(sid, ..)| *sid != conflict.space);
-                        Some(EditStatus::Conflict(_))
+                    let keep = if root || step[2] & 1 == 0 {
-                    )
+                        Resolution::Mine
-                    && let Operation::Pages(batch) = &edit.operation
+                    } else {
-                {
+                        Resolution::Theirs
-                    let remote = cache.remote_snapshot().unwrap();
+                    };
-                    let order = pages(&remote);
+                    if cache.resolve(conflict.id, keep).is_err() {
-                    let anchor = (step[2] & 1 != 0)
-                        .then_some(order[usize::from(step[3]) % order.len()].0)
-                        .filter(|sid| batch.edits.iter().all(|e| e.space() != *sid));
-                    let edits: Vec<_> = batch
-                        .edits
-                        .iter()
-                        .map(|edit| edit.reposition(PagePosition::Before(anchor), 1).unwrap())
-                        .collect();
-                    let result = cache.rebase_pages_conflict(edit.id, &snapshot, &remote, &edits);
-                    assert_eq!(cache.snapshot().unwrap(), snapshot);
-                    if result.is_err() {
                         assert_eq!(cache.pending().unwrap(), pending);
                     }
                 }

crates/notebook/tests/support/server.rs+32

...	@@ -133,3 +133,35 @@ pub fn text(source: &[u8]) -> (ExGuid, ExGuid, String) {	...	@@ -133,3 +133,35 @@ pub fn text(source: &[u8]) -> (ExGuid, ExGuid, String) {
133	})	133	})
134	.unwrap()	134	.unwrap()
135	}	135	}
		136
		137	/// Every page of an image, in section order: what two images holding the same edits under
		138	/// different revision identities share.
		139	pub fn pages(source: &[u8]) -> Vec<(ExGuid, onestore::page::Page)> {
		140	let store = Store::parse(source).unwrap();
		141	let index = RevisionIndex::parse(&store).unwrap();
		142	let document = Document::parse(&index).unwrap();
		143	document
		144	.pages()
		145	.unwrap()
		146	.into_iter()
		147	.map(\|(space, _)\| {
		148	(
		149	space,
		150	onestore::page::Page::from_space(&document, space).unwrap(),
		151	)
		152	})
		153	.collect()
		154	}
		155
		156	/// Queues a section op as its own edit.
		157	pub fn section_op(cache: &notebook::Replica, op: onestore::op::SectionOp) -> u64 {
		158	cache
		159	.apply(
		160	"Fixture",
		161	onestore::op::Edit {
		162	at: 133_000_000_000_000_000,
		163	ops: vec![onestore::op::Op::Section(op)],
		164	},
		165	)
		166	.unwrap()
		167	}

crates/notebook/tests/sync.rs+233-230

 @@ -1,7 +1,7 @@
-//! Replica protocol: durable receipts, retired attempts, conflict review and contention.
+//! Replica protocol: durable receipts, retired attempts, conflict resolution and contention.
-use notebook::{ConflictKind, EditStatus, Error, Remote, Replica};
+use notebook::{ConflictKind, EditStatus, Error, Remote, Replica, Resolution};
-use onestore::{CommitError, CommitState, ExGuid, Transaction, page::Page};
+use onestore::{CommitError, CommitState, ExGuid, Transaction};
 use std::{io, ops::Range};
 #[path = "support/server.rs"]
 @@ -10,13 +10,6 @@ use server::*;
 #[path = "support/model_ops.rs"]
 mod model_ops;
-/// The page holding `text`, with a UTF-16 range of that text replaced.
-fn edited(bytes: &[u8], text: ExGuid, range: Range<u32>, replacement: &str) -> Page {
-    let (_, mut page) = model_ops::locate(bytes, text);
-    model_ops::replace_text(&mut page, text, range, replacement);
-    page
-}
 /// Saves a replacement of `range` in the page holding `text`.
 fn save(cache: &Replica, text: ExGuid, range: Range<u32>, replacement: &str) -> Option<u64> {
     model_ops::save(cache, text, |page| {
 @@ -56,16 +49,16 @@ fn an_unchanged_stamp_publishes_and_settles_without_reading_the_remote() {
         reads: 0,
     };
     assert!(matches!(
-        cache.sync_once(&mut remote).unwrap(),
+        cache.sync_once(&mut remote).unwrap().edit,
         Some((published, EditStatus::Published { .. })) if published == id
     ));
-    assert_eq!(cache.sync_once(&mut remote).unwrap(), None);
+    assert_eq!(cache.sync_once(&mut remote).unwrap().edit, None);
     assert_eq!(remote.reads, 0);
     // Another writer's commit moves the header, so the next step reads the file.
     let native =
         onestore::replace_text(&remote.server.visible, sid, object, 0..0, "Native ").unwrap();
     remote.server.visible.clone_from(&native);
-    assert_eq!(cache.sync_once(&mut remote).unwrap(), None);
+    assert_eq!(cache.sync_once(&mut remote).unwrap().edit, None);
     assert_eq!(remote.reads, 1);
     assert_eq!(cache.snapshot().unwrap(), native);
 }
 @@ -82,7 +75,7 @@ fn recovery_archive_preserves_the_queue_uncertainty_and_receipts_without_becomin
     let cache = Replica::create(&path, &source).unwrap();
     let published = save(&cache, object, 0..0, "Published ").unwrap();
     let mut server = Server::new(&source);
-    let (_, receipt) = cache.sync_once(&mut server).unwrap().unwrap();
+    let (_, receipt) = cache.sync_once(&mut server).unwrap().edit.unwrap();
     let attempted = save(&cache, object, 0..0, "Uncertain ").unwrap();
     server.fault = Fault::UnknownBefore;
     assert!(matches!(
 @@ -94,10 +87,7 @@ fn recovery_archive_preserves_the_queue_uncertainty_and_receipts_without_becomin
     ));
     save(&cache, object, 0..0, "Queued ").unwrap();
     let created = onestore::PageCreation::new(None, Some("Recovery 🦀"), "Fixture").unwrap();
-    cache
+    section_op(&cache, onestore::op::SectionOp::Create(created));
-        .create_page(&cache.snapshot().unwrap(), &created)
-        .unwrap()
-        .unwrap();
     save(&cache, object, 0..0, "Last ").unwrap();
     let working = cache.snapshot().unwrap();
     let remote = cache.remote_snapshot().unwrap();
 @@ -109,8 +99,8 @@ fn recovery_archive_preserves_the_queue_uncertainty_and_receipts_without_becomin
         conflicts: 0,
         uncertain_edits: 1,
         published_receipts: 1,
-        working_bytes: working.len() as u64,
+        base_bytes: remote.len() as u64,
-        remote_bytes: remote.len() as u64,
+        remote_bytes: 0,
         cached_assets: 0,
         cached_asset_bytes: 0,
     };
 @@ -123,7 +113,7 @@ fn recovery_archive_preserves_the_queue_uncertainty_and_receipts_without_becomin
     assert!(Recovery::open(&path).is_err());
     let archive = Recovery::open(&archive_path).unwrap();
     assert_eq!(archive.summary().unwrap(), summary);
-    assert_eq!(archive.snapshot().unwrap(), working);
+    assert_eq!(pages(&archive.snapshot().unwrap()), pages(&working));
     assert_eq!(archive.remote_snapshot().unwrap(), remote);
     assert_eq!(archive.pending().unwrap(), pending);
     assert_eq!(archive.status(published).unwrap(), Some(receipt.clone()));
 @@ -150,7 +140,7 @@ fn recovery_archive_preserves_the_queue_uncertainty_and_receipts_without_becomin
     assert_eq!(std::fs::read(&path).unwrap(), source_file);
     assert_eq!(std::fs::read(&archive_path).unwrap(), archive_bytes);
     save(&cache, object, 0..0, "Later ").unwrap();
-    assert_eq!(archive.snapshot().unwrap(), working);
+    assert_eq!(pages(&archive.snapshot().unwrap()), pages(&working));
     assert_eq!(archive.pending().unwrap(), pending);
     drop(archive);
     assert_eq!(
 @@ -193,7 +183,7 @@ fn recovery_archive_retains_conflict_images_and_rejects_foreign_or_future_archiv
     let id = save(&cache, object, 0..8, "Local").unwrap();
     let changed = onestore::replace_text(&source, space, object, 0..8, "Remote").unwrap();
     let mut server = Server::new(&changed);
-    let outcome = cache.sync_once(&mut server).unwrap().unwrap();
+    let outcome = cache.sync_once(&mut server).unwrap().edit.unwrap();
     assert_eq!(
         outcome,
         (id, EditStatus::Conflict(ConflictKind::ContentChanged))
 @@ -232,7 +222,7 @@ fn disjoint_remote_changes_merge_and_persist_the_remote_receipt() {
     let id = save(&cache, oid, 2..4, "🐈").unwrap();
     let remote = onestore::replace_text(&source, sid, oid, 0..6, "Xab🦀cYd").unwrap();
     let mut server = Server::new(&remote);
-    let outcome = cache.sync_once(&mut server).unwrap().unwrap();
+    let outcome = cache.sync_once(&mut server).unwrap().edit.unwrap();
     assert_eq!(outcome.0, id);
     assert!(matches!(outcome.1, EditStatus::Published { .. }));
     assert_eq!(text(&server.durable).2, "Xab🐈cYd");
 @@ -241,7 +231,7 @@ fn disjoint_remote_changes_merge_and_persist_the_remote_receipt() {
     drop(cache);
     let cache = Replica::open(&path).unwrap();
     assert_eq!(cache.status(id).unwrap(), Some(outcome.1.clone()));
-    assert_eq!(cache.sync_once(&mut server).unwrap(), None);
+    assert_eq!(cache.sync_once(&mut server).unwrap().edit, None);
     assert_eq!(server.publications, 1);
     assert_eq!(cache.status(id + 1).unwrap(), None);
     let next = save(&cache, oid, 0..0, "Later ").unwrap();
 @@ -260,13 +250,13 @@ fn overlapping_changes_preserve_both_images_and_survive_restart() {
     let remote = onestore::replace_text(&source, sid, oid, 1..2, "R").unwrap();
     let mut server = Server::new(&remote);
     assert_eq!(
-        cache.sync_once(&mut server).unwrap(),
+        cache.sync_once(&mut server).unwrap().edit,
         Some((id, EditStatus::Conflict(ConflictKind::ContentChanged)))
     );
     assert_eq!(server.publications, 0);
     drop(cache);
     let cache = Replica::open(&path).unwrap();
-    assert_eq!(cache.snapshot().unwrap(), local);
+    assert_eq!(pages(&cache.snapshot().unwrap()), pages(&local));
     assert_eq!(cache.remote_snapshot().unwrap(), remote);
     assert_eq!(cache.pending().unwrap().len(), 1);
     assert_eq!(
 @@ -298,7 +288,7 @@ fn lost_replies_and_process_termination_never_blindly_replay_an_attempt() {
         assert!(matches!(attempted, EditStatus::AwaitingConfirmation { .. }));
         drop(cache);
         let cache = Replica::open(&path).unwrap();
-        let result = cache.sync_once(&mut server).unwrap().unwrap();
+        let result = cache.sync_once(&mut server).unwrap().edit.unwrap();
         if matches!(fault, Fault::UnknownAfter | Fault::PanicAfter) {
             assert!(matches!(result.1, EditStatus::Published { .. }));
             assert_eq!(text(&server.durable).2, "Once abc");
 @@ -333,7 +323,7 @@ fn failed_confirmation_does_not_promote_visible_bytes_to_a_receipt() {
         Some(EditStatus::AwaitingConfirmation { .. })
     ));
     assert!(matches!(
-        cache.sync_once(&mut server).unwrap(),
+        cache.sync_once(&mut server).unwrap().edit,
         Some((_, EditStatus::Published { .. }))
     ));
     assert_eq!(server.publications, 1);
 @@ -383,7 +373,7 @@ fn proven_unpublished_attempts_retry_and_committed_cleanup_errors_keep_receipts(
         if matches!(fault, Fault::Before) {
             assert_eq!(cache.status(id).unwrap(), Some(EditStatus::Pending));
             assert!(matches!(
-                cache.sync_once(&mut server).unwrap(),
+                cache.sync_once(&mut server).unwrap().edit,
                 Some((_, EditStatus::Published { .. }))
             ));
             assert_eq!(server.publications, 2);
 @@ -392,7 +382,7 @@ fn proven_unpublished_attempts_retry_and_committed_cleanup_errors_keep_receipts(
                 cache.status(id).unwrap(),
                 Some(EditStatus::Published { .. })
             ));
-            assert_eq!(cache.sync_once(&mut server).unwrap(), None);
+            assert_eq!(cache.sync_once(&mut server).unwrap().edit, None);
             assert_eq!(server.publications, 1);
         }
         assert_eq!(text(&server.durable).2, "Once abc");
 @@ -401,7 +391,10 @@ fn proven_unpublished_attempts_retry_and_committed_cleanup_errors_keep_receipts(
 #[test]
 fn database_failures_before_and_after_publication_preserve_recovery_state() {
-    for table in ["attempt", "receipts"] {
+    for (table, event) in [
+        ("attempt", "UPDATE OF attempted ON batches"),
+        ("receipts", "INSERT ON receipts"),
+    ] {
         let dir = tempfile::tempdir().unwrap();
         let path = dir.path().join("cache.sqlite");
         let source = onestore::create_section("sync.one", "abc", "Fixture").unwrap();
 @@ -410,7 +403,7 @@ fn database_failures_before_and_after_publication_preserve_recovery_state() {
         let id = save(&cache, oid, 0..0, "Once ").unwrap();
         drop(cache);
         let db = rusqlite::Connection::open(&path).unwrap();
-        db.execute_batch(&format!("CREATE TRIGGER interrupted BEFORE INSERT ON {table} BEGIN SELECT RAISE(ABORT,'Injected cache failure'); END;")).unwrap();
+        db.execute_batch(&format!("CREATE TRIGGER interrupted BEFORE {event} BEGIN SELECT RAISE(ABORT,'Injected cache failure'); END;")).unwrap();
         drop(db);
         let cache = Replica::open(&path).unwrap();
         let mut server = Server::new(&source);
 @@ -426,7 +419,7 @@ fn database_failures_before_and_after_publication_preserve_recovery_state() {
         drop(db);
         let cache = Replica::open(&path).unwrap();
         assert!(matches!(
-            cache.sync_once(&mut server).unwrap(),
+            cache.sync_once(&mut server).unwrap().edit,
             Some((_, EditStatus::Published { .. }))
         ));
         assert!(matches!(
 @@ -474,7 +467,7 @@ fn twelve_local_editors_progress_during_remote_reads_publication_and_confirmatio
     for phase in ["read", "publish", "confirm"] {
         let dir = tempfile::tempdir().unwrap();
         let source = onestore::create_section("sync.one", "abc", "Fixture").unwrap();
-        let (_, oid, _) = text(&source);
+        let (sid, oid, _) = text(&source);
         let cache = Replica::create(dir.path().join("cache.sqlite"), &source).unwrap();
         let first = save(&cache, oid, 0..0, "First ").unwrap();
         let mut server = Server::new(&source);
 @@ -493,9 +486,17 @@ fn twelve_local_editors_progress_during_remote_reads_publication_and_confirmatio
         let mut server = std::thread::scope(|scope| {
             let running = scope.spawn(|| {
                 let result = cache.sync_once(&mut paused);
-                assert!(
+                assert!(matches!(
-                    matches!(result, Ok(Some((id, EditStatus::Published { .. }))) if id == first)
+                    result,
-                );
+                    Ok(notebook::Synced {
+                        edit: Some((_, EditStatus::Published { .. })),
+                        ..
+                    })
+                ));
+                assert!(matches!(
+                    cache.status(first).unwrap(),
+                    Some(EditStatus::Published { .. })
+                ));
                 paused.server
             });
             entered_rx
 @@ -504,26 +505,31 @@ fn twelve_local_editors_progress_during_remote_reads_publication_and_confirmatio
             assert!(
                 matches!(cache.sync_once(&mut Server::new(&source)),Err(Error::Io(error)) if error.kind()==io::ErrorKind::WouldBlock)
             );
-            let reviewed = edited(&source, oid, 0..0, "Reviewed ");
             assert!(
-                matches!(cache.review_page(first, &[], &[], &reviewed), Err(Error::Io(error)) if error.kind() == io::ErrorKind::WouldBlock)
+                matches!(cache.resolve(first, Resolution::Theirs), Err(Error::Io(error)) if error.kind() == io::ErrorKind::WouldBlock)
             );
             let started = std::time::Instant::now();
             let handles: Vec<_> = (0..12)
                 .map(|writer| {
                     let cache = &cache;
                     scope.spawn(move || {
-                        loop {
+                        // Ops, unlike models, commute with the other writers' edits.
-                            let marker = format!("[{writer}] ");
+                        cache
-                            match model_ops::save(cache, oid, |page| {
+                            .apply(
-                                model_ops::replace_text(page, oid, 0..0, &marker)
+                                model_ops::AUTHOR,
-                            }) {
+                                onestore::op::Edit {
-                                Ok(Some(id)) => break id,
+                                    at: model_ops::now(),
-                                Err(Error::Io(error))
+                                    ops: vec![onestore::op::Op::Page {
-                                    if error.kind() == io::ErrorKind::ResourceBusy => {}
+                                        space: sid,
-                                other => panic!("Unexpected local outcome {other:?}"),
+                                        op: onestore::op::PageOp::Text {
-                            }
+                                            text: oid,
-                        }
+                                            range: 0..0,
+                                            with: format!("[{writer}] "),
+                                        },
+                                    }],
+                                },
+                            )
+                            .unwrap()
                     })
                 })
                 .collect();
 @@ -531,12 +537,7 @@ fn twelve_local_editors_progress_during_remote_reads_publication_and_confirmatio
                 .into_iter()
                 .map(|handle| handle.join().unwrap())
                 .collect();
-            assert_eq!(ids.len(), 1, "saves to one page coalesce");
+            assert_eq!(ids.len(), 12, "every local edit is its own");
-            assert_eq!(
-                ids.contains(&first),
-                phase == "read",
-                "saves coalesce into the head only until a step selects it"
-            );
             assert!(
                 started.elapsed() < std::time::Duration::from_secs(2),
                 "Local edits waited for remote {phase}"
 @@ -544,14 +545,18 @@ fn twelve_local_editors_progress_during_remote_reads_publication_and_confirmatio
             resume_tx.send(()).unwrap();
             running.join().unwrap()
         });
-        assert_eq!(cache.pending().unwrap().len(), usize::from(phase != "read"));
+        // Edits arriving while a batch publishes form the next batch.
+        assert_eq!(
+            cache.pending().unwrap().len(),
+            if phase == "read" { 0 } else { 12 }
+        );
         let expected = text(&cache.snapshot().unwrap()).2;
         for writer in 0..12 {
             assert_eq!(expected.matches(&format!("[{writer}] ")).count(), 1);
         }
         while !cache.pending().unwrap().is_empty() {
             assert!(matches!(
-                cache.sync_once(&mut server).unwrap(),
+                cache.sync_once(&mut server).unwrap().edit,
                 Some((_, EditStatus::Published { .. }))
             ));
         }
 @@ -573,136 +578,155 @@ fn unrelated_remote_files_never_replace_a_local_cache() {
         if pending {
             save(&cache, oid, 0..0, "Local ").unwrap();
         }
-        let before = cache.snapshot().unwrap();
+        let before = pages(&cache.snapshot().unwrap());
         assert!(
             matches!(cache.sync_once(&mut server),Err(Error::Io(error)) if error.kind()==io::ErrorKind::InvalidInput)
         );
-        assert_eq!(cache.snapshot().unwrap(), before);
+        assert_eq!(pages(&cache.snapshot().unwrap()), before);
         assert_eq!(cache.remote_snapshot().unwrap(), source);
         assert_eq!(server.publications, 0);
     }
 }
+/// The text object's content in an image.
+fn content(bytes: &[u8], text: ExGuid) -> String {
+    let (_, page) = model_ops::locate(bytes, text);
+    model_ops::paragraph_with(&page, text)
+        .unwrap()
+        .text()
+        .unwrap()
+        .text
+        .text()
+        .to_owned()
+}
 #[test]
-fn reviewing_a_conflict_preserves_the_dependent_save_and_survives_reopen() {
+fn a_conflict_holds_later_edits_until_resolved_either_way_and_survives_reopen() {
-    let dir = tempfile::tempdir().unwrap();
+    for resolution in [Resolution::Mine, Resolution::Theirs] {
-    let path = dir.path().join("cache.sqlite");
+        let dir = tempfile::tempdir().unwrap();
-    let source = onestore::create_section("resolve.one", "abc", "Fixture").unwrap();
+        let path = dir.path().join("cache.sqlite");
-    let (sid, oid, _) = text(&source);
+        let source = onestore::create_section("resolve.one", "abc", "Fixture").unwrap();
-    let cache = Replica::create(&path, &source).unwrap();
+        let (sid, oid, _) = text(&source);
-    let first = save(&cache, oid, 1..2, "L").unwrap();
+        let cache = Replica::create(&path, &source).unwrap();
-    let remote = onestore::replace_text(&source, sid, oid, 0..3, "aRcZ").unwrap();
+        let first = save(&cache, oid, 1..2, "L").unwrap();
-    let mut server = Server::new(&remote);
+        let remote = onestore::replace_text(&source, sid, oid, 0..3, "aRcZ").unwrap();
-    assert_eq!(
+        let mut server = Server::new(&remote);
-        cache.sync_once(&mut server).unwrap(),
+        let conflict = EditStatus::Conflict(ConflictKind::ContentChanged);
-        Some((first, EditStatus::Conflict(ConflictKind::ContentChanged)))
+        assert_eq!(
-    );
+            cache.sync_once(&mut server).unwrap().edit,
-    let mut dependent = None;
+            Some((first, conflict.clone()))
-    for n in 0..12 {
+        );
-        dependent = save(&cache, oid, 0..0, &format!("[{n}] "));
+        let mut dependent = None;
-    }
+        for n in 0..12 {
-    let dependent = dependent.unwrap();
+            dependent = save(&cache, oid, 0..0, &format!("[{n}] "));
-    assert_ne!(dependent, first, "a conflicted save is never rewritten");
+        }
-    let local = cache.snapshot().unwrap();
+        let dependent = dependent.unwrap();
-    let pending = cache.pending().unwrap();
+        assert_ne!(dependent, first);
-    assert_eq!(pending.len(), 2);
+        assert_eq!(cache.status(dependent).unwrap(), Some(conflict.clone()));
-    model_ops::review(&cache, first, oid, |page| {
+        let local = content(&cache.snapshot().unwrap(), oid);
-        model_ops::replace_text(page, oid, 1..2, "L")
+        assert!(local.ends_with("[0] aLc"), "{local}");
-    })
+        let pending = cache.pending().unwrap();
-    .unwrap();
+        assert_eq!(pending.len(), 13);
-    assert_eq!(cache.snapshot().unwrap(), local);
+        assert_eq!(
-    assert_eq!(cache.remote_snapshot().unwrap(), remote);
+            cache.sync_once(&mut server).unwrap().edit,
-    let reviewed = cache.pending().unwrap();
+            Some((dependent, conflict.clone())),
-    assert_eq!(reviewed[1..], pending[1..]);
+            "an unchanged remote leaves the conflict as it was"
-    assert_eq!(reviewed[0].id, first);
+        );
-    let notebook::Operation::Page(intent) = &reviewed[0].operation else {
+        assert_eq!(server.publications, 0);
-        panic!()
+        drop(cache);
-    };
+        let cache = Replica::open(&path).unwrap();
-    assert_eq!(
+        assert_eq!(cache.pending().unwrap(), pending);
-        intent.text_change(),
+        assert_eq!(content(&cache.snapshot().unwrap(), oid), local);
-        Some((oid, "aRcZ".into(), 1..2, "L".into()))
+        assert_eq!(
-    );
+            cache.conflict().unwrap(),
-    assert_eq!(intent.author, model_ops::AUTHOR);
+            Some(notebook::Conflict {
-    assert_eq!(cache.status(first).unwrap(), Some(EditStatus::Pending));
+                id: dependent,
-    drop(cache);
+                space: sid,
-    let cache = Replica::open(&path).unwrap();
+                kind: ConflictKind::ContentChanged
-    assert_eq!(cache.pending().unwrap(), reviewed);
+            })
-    assert_eq!(cache.snapshot().unwrap(), local);
-    for intent in &pending {
-        assert!(
-            matches!(cache.sync_once(&mut server).unwrap(), Some((id, EditStatus::Published { .. })) if id == intent.id)
         );
+        cache.resolve(first, resolution).unwrap();
+        assert_eq!(cache.conflict().unwrap(), None);
+        assert_eq!(cache.remote_snapshot().unwrap(), remote);
+        let expected = match resolution {
+            Resolution::Mine => local.clone(),
+            Resolution::Theirs => "aRcZ".to_owned(),
+        };
+        assert_eq!(content(&cache.snapshot().unwrap(), oid), expected);
+        drop(cache);
+        let cache = Replica::open(&path).unwrap();
+        match resolution {
+            Resolution::Mine => {
+                assert!(matches!(
+                    cache.sync_once(&mut server).unwrap().edit,
+                    Some((_, EditStatus::Published { .. }))
+                ));
+                assert_eq!(server.publications, 1);
+                for edit in &pending {
+                    assert!(matches!(
+                        cache.status(edit.id).unwrap(),
+                        None | Some(EditStatus::Published { .. })
+                    ));
+                }
+                assert!(matches!(
+                    cache.status(first).unwrap(),
+                    Some(EditStatus::Published { .. })
+                ));
+            }
+            Resolution::Theirs => {
+                // The emptied edits are acknowledged once the remote image is flushed.
+                assert!(matches!(
+                    cache.sync_once(&mut server).unwrap().edit,
+                    Some((id, EditStatus::Published { .. })) if id == dependent
+                ));
+                assert_eq!((server.publications, server.confirmations), (0, 1));
+                assert!(matches!(
+                    cache.status(first).unwrap(),
+                    Some(EditStatus::Published { .. })
+                ));
+            }
+        }
+        assert_eq!(content(&server.durable, oid), expected);
+        assert_eq!(pages(&cache.snapshot().unwrap()), pages(&server.durable));
+        assert!(cache.pending().unwrap().is_empty());
     }
-    assert_eq!(server.publications, 2);
-    assert_eq!(text(&server.durable).2, text(&local).2 + "Z");
-    assert_eq!(cache.snapshot().unwrap(), server.durable);
-    assert!(cache.pending().unwrap().is_empty());
 }
 #[test]
-fn conflict_review_rejects_stale_images_and_nonconflicting_states() {
+fn resolution_refuses_edits_that_are_not_in_conflict() {
     let dir = tempfile::tempdir().unwrap();
     let source = onestore::create_section("resolve.one", "abc", "Fixture").unwrap();
     let (sid, oid, _) = text(&source);
     let cache = Replica::create(dir.path().join("cache.sqlite"), &source).unwrap();
     let id = save(&cache, oid, 1..2, "L").unwrap();
-    let local = cache.snapshot().unwrap();
+    let refused = |cache: &Replica, id| matches!(cache.resolve(id, Resolution::Mine), Err(Error::Io(error)) if error.kind() == io::ErrorKind::InvalidInput);
-    let pending_review = edited(&source, oid, 1..2, "L");
+    assert!(refused(&cache, id));
-    assert!(
-        matches!(cache.review_page(id, &local, &source, &pending_review), Err(Error::Io(error)) if error.kind() == io::ErrorKind::InvalidInput)
-    );
     let remote = onestore::replace_text(&source, sid, oid, 0..3, "🦀Rc").unwrap();
     let mut server = Server::new(&remote);
     assert!(matches!(
-        cache.sync_once(&mut server).unwrap(),
+        cache.sync_once(&mut server).unwrap().edit,
         Some((_, EditStatus::Conflict(_)))
     ));
     let pending = cache.pending().unwrap();
-    let reviewed = edited(&remote, oid, 2..3, "L");
+    assert!(refused(&cache, id + 1));
-    assert!(
-        matches!(cache.review_page(id + 1, &local, &remote, &reviewed), Err(Error::Io(error)) if error.kind() == io::ErrorKind::InvalidInput)
-    );
     assert_eq!(cache.pending().unwrap(), pending);
-    save(&cache, oid, 0..0, "Later ").unwrap();
+    cache.resolve(id, Resolution::Mine).unwrap();
-    let changed = cache.snapshot().unwrap();
-    assert!(
-        matches!(cache.review_page(id, &local, &remote, &reviewed), Err(Error::Io(error)) if error.kind() == io::ErrorKind::ResourceBusy)
-    );
-    let new_remote = onestore::replace_text(&remote, sid, oid, 2..3, "Q").unwrap();
-    server.visible = new_remote.clone();
-    server.durable = new_remote;
-    assert!(matches!(
-        cache.sync_once(&mut server).unwrap(),
-        Some((_, EditStatus::Conflict(_)))
-    ));
-    assert!(
-        matches!(cache.review_page(id, &changed, &remote, &reviewed), Err(Error::Io(error)) if error.kind() == io::ErrorKind::ResourceBusy)
-    );
-    assert_eq!(cache.snapshot().unwrap(), changed);
-    assert_eq!(cache.pending().unwrap()[0], pending[0]);
-    assert_eq!(server.publications, 0);
-    let current = cache.remote_snapshot().unwrap();
-    let reviewed = edited(&current, oid, 2..3, "L");
-    cache
-        .review_page(id, &changed, &current, &reviewed)
-        .unwrap();
     server.fault = Fault::UnknownBefore;
     assert!(
         matches!(cache.sync_once(&mut server), Err(Error::Remote(error)) if error.state == CommitState::Unknown)
     );
     let attempted = cache.status(id).unwrap();
-    let pending = cache.pending().unwrap();
+    assert!(matches!(
-    assert!(
+        attempted,
-        matches!(cache.review_page(id, &changed, &current, &reviewed), Err(Error::Io(error)) if error.kind() == io::ErrorKind::InvalidInput)
+        Some(EditStatus::AwaitingConfirmation { .. })
-    );
+    ));
+    assert!(refused(&cache, id));
     assert_eq!(cache.status(id).unwrap(), attempted);
-    assert_eq!(cache.pending().unwrap(), pending);
     assert_eq!(server.publications, 1);
 }
 #[test]
-fn failure_between_review_and_conflict_clear_rolls_back_the_entire_resolution() {
+fn a_failed_resolution_leaves_the_conflict_as_it_was() {
     let dir = tempfile::tempdir().unwrap();
     let path = dir.path().join("cache.sqlite");
     let source = onestore::create_section("resolve.one", "abc", "Fixture").unwrap();
 @@ -712,30 +736,29 @@ fn failure_between_review_and_conflict_clear_rolls_back_the_entire_resolution()
     let remote = onestore::replace_text(&source, sid, oid, 0..3, "XaRc").unwrap();
     let mut server = Server::new(&remote);
     cache.sync_once(&mut server).unwrap();
-    let local = cache.snapshot().unwrap();
+    let local = pages(&cache.snapshot().unwrap());
     let pending = cache.pending().unwrap();
     let status = cache.status(id).unwrap();
     drop(cache);
     let connection = rusqlite::Connection::open(&path).unwrap();
-    connection.execute_batch("CREATE TRIGGER fail_clear BEFORE DELETE ON conflicts BEGIN SELECT RAISE(ABORT, 'test conflict clear failure'); END;").unwrap();
+    connection.execute_batch("CREATE TRIGGER fail_clear BEFORE DELETE ON batches BEGIN SELECT RAISE(ABORT, 'test resolution failure'); END;").unwrap();
     drop(connection);
     let cache = Replica::open(&path).unwrap();
-    let reviewed = edited(&remote, oid, 2..3, "L");
     assert!(matches!(
-        cache.review_page(id, &local, &remote, &reviewed),
+        cache.resolve(id, Resolution::Mine),
         Err(Error::Database(_))
     ));
     drop(cache);
     let cache = Replica::open(&path).unwrap();
     assert_eq!(cache.pending().unwrap(), pending);
     assert_eq!(cache.status(id).unwrap(), status);
-    assert_eq!(cache.snapshot().unwrap(), local);
+    assert_eq!(pages(&cache.snapshot().unwrap()), local);
     assert_eq!(cache.remote_snapshot().unwrap(), remote);
     assert_eq!(server.publications, 0);
 }
 #[test]
-fn seeded_reviews_preserve_unicode_around_the_reviewed_replacement() {
+fn seeded_conflicts_resolve_to_the_remote_text_and_later_edits_publish_once() {
     let dir = tempfile::tempdir().unwrap();
     let original: Vec<_> = "abcdefghij🦀klmnop".chars().collect();
     let mut seed = 911_u64;
 @@ -757,8 +780,7 @@ fn seeded_reviews_preserve_unicode_around_the_reviewed_replacement() {
         let (sid, oid, _) = text(&source);
         let cache = Replica::create(dir.path().join(format!("{case}.sqlite")), &source).unwrap();
         let id = save(&cache, oid, start..end, "λ🦊μ").unwrap();
-        let dependent = save(&cache, oid, start + 1..start + 3, "🐕").unwrap();
+        save(&cache, oid, start + 1..start + 3, "🐕").unwrap();
-        assert_eq!(dependent, id, "case {case}, seed {seed}");
         let mut remote_text = original.clone();
         remote_text.splice(at..at + 1, "Ω🐈π".chars());
         let remote_text = prefix.clone() + &remote_text.iter().collect::<String>() + &suffix;
 @@ -771,18 +793,21 @@ fn seeded_reviews_preserve_unicode_around_the_reviewed_replacement() {
         )
         .unwrap();
         let mut server = Server::new(&remote);
-        assert_eq!(
+        assert!(
-            cache.sync_once(&mut server).unwrap(),
+            matches!(
-            Some((id, EditStatus::Conflict(ConflictKind::ContentChanged))),
+                cache.sync_once(&mut server).unwrap().edit,
+                Some((_, EditStatus::Conflict(ConflictKind::ContentChanged)))
+            ),
             "case {case}, seed {seed}"
         );
         let at_remote = start + prefix.len() as u32;
-        model_ops::review(&cache, id, oid, |page| {
+        let reviewed = model_ops::review(&cache, id, oid, |page| {
             model_ops::replace_text(page, oid, at_remote..at_remote + 4, "λ🐕μ")
         })
+        .unwrap()
         .unwrap();
         assert!(
-            matches!(cache.sync_once(&mut server).unwrap(), Some((actual, EditStatus::Published { .. })) if actual == id),
+            matches!(cache.sync_once(&mut server).unwrap().edit, Some((actual, EditStatus::Published { .. })) if actual == reviewed),
             "case {case}, seed {seed}"
         );
         let mut expected = original.clone();
 @@ -799,7 +824,7 @@ fn seeded_reviews_preserve_unicode_around_the_reviewed_replacement() {
 }
 #[test]
-fn remote_changes_after_review_cannot_be_overwritten_by_the_reviewed_page() {
+fn remote_changes_after_resolution_are_never_overwritten() {
     struct ChangedAfterRead {
         server: Server,
         change: Option<Vec<u8>>,
 @@ -826,20 +851,22 @@ fn remote_changes_after_review_cannot_be_overwritten_by_the_reviewed_page() {
         let (sid, oid, _) = text(&source);
         let cache = Replica::create(dir.path().join("cache.sqlite"), &source).unwrap();
         let id = save(&cache, oid, 1..2, "L").unwrap();
-        let local = cache.snapshot().unwrap();
         let remote = onestore::replace_text(&source, sid, oid, 1..2, "R").unwrap();
         let mut remote = ChangedAfterRead {
             server: Server::new(&remote),
             change: None,
         };
         assert!(matches!(
-            cache.sync_once(&mut remote).unwrap(),
+            cache.sync_once(&mut remote).unwrap().edit,
             Some((_, EditStatus::Conflict(_)))
         ));
-        model_ops::review(&cache, id, oid, |page| {
+        let id = model_ops::review(&cache, id, oid, |page| {
             model_ops::replace_text(page, oid, 1..2, "L")
         })
+        .unwrap()
         .unwrap();
+        let local = content(&cache.snapshot().unwrap(), oid);
+        assert_eq!(local, "aLc");
         let changed = onestore::replace_text(&remote.server.visible, sid, oid, 1..2, "Q").unwrap();
         if after_read {
             remote.change = Some(changed.clone());
 @@ -854,20 +881,19 @@ fn remote_changes_after_review_cannot_be_overwritten_by_the_reviewed_page() {
             assert_eq!(cache.status(id).unwrap(), Some(EditStatus::Pending));
         }
         assert_eq!(
-            cache.sync_once(&mut remote).unwrap(),
+            cache.sync_once(&mut remote).unwrap().edit,
             Some((id, EditStatus::Conflict(ConflictKind::ContentChanged)))
         );
         assert_eq!(remote.server.durable, changed);
         assert_eq!(remote.server.visible, changed);
         assert_eq!(remote.server.publications, usize::from(after_read));
-        assert_eq!(cache.snapshot().unwrap(), local);
+        assert_eq!(content(&cache.snapshot().unwrap(), oid), local);
-        let notebook::Operation::Page(intent) = &cache.pending().unwrap()[0].operation else {
+        assert!(cache.pending().unwrap()[0].edit.ops.is_empty());
-            panic!()
+        assert!(matches!(
-        };
+            &cache.pending().unwrap()[1].edit.ops[..],
-        assert_eq!(
+            [onestore::op::Op::Page { op: onestore::op::PageOp::Text { range, with, .. }, .. }]
-            intent.text_change(),
+                if *range == (1..2) && with == "L"
-            Some((oid, "aRc".into(), 1..2, "L".into()))
+        ));
-        );
     }
 }
 @@ -880,7 +906,7 @@ fn remote_restore_retains_historical_receipts_without_replaying_them() {
     let cache = Replica::create(&path, &source).unwrap();
     let mut server = Server::new(&source);
     let published = save(&cache, object, 0..0, "Published ").unwrap();
-    let (_, receipt) = cache.sync_once(&mut server).unwrap().unwrap();
+    let (_, receipt) = cache.sync_once(&mut server).unwrap().edit.unwrap();
     assert!(matches!(receipt, EditStatus::Published { .. }));
     let published_image = cache.snapshot().unwrap();
     cache
 @@ -891,7 +917,7 @@ fn remote_restore_retains_historical_receipts_without_replaying_them() {
     server.visible.clone_from(&source);
     server.durable.clone_from(&source);
     let cache = Replica::open(&path).unwrap();
-    assert_eq!(cache.sync_once(&mut server).unwrap(), None);
+    assert_eq!(cache.sync_once(&mut server).unwrap().edit, None);
     assert_eq!(cache.snapshot().unwrap(), source);
     assert_eq!(cache.remote_snapshot().unwrap(), source);
     assert_eq!(cache.status(published).unwrap(), Some(receipt.clone()));
 @@ -918,7 +944,7 @@ fn remote_restore_rebases_unsent_work_but_never_replays_an_uncertain_attempt() {
         let cache = Replica::create(&path, &source).unwrap();
         let mut server = Server::new(&source);
         let published = save(&cache, object, 0..0, "Published ").unwrap();
-        let (_, receipt) = cache.sync_once(&mut server).unwrap().unwrap();
+        let (_, receipt) = cache.sync_once(&mut server).unwrap().edit.unwrap();
         let end = u32::try_from(text(&cache.snapshot().unwrap()).2.encode_utf16().count()).unwrap();
         let queued = save(&cache, object, end..end, " Local").unwrap();
         if uncertain {
 @@ -936,14 +962,14 @@ fn remote_restore_rebases_unsent_work_but_never_replays_an_uncertain_attempt() {
         server.durable.clone_from(&source);
         let attempts = server.publications;
         let cache = Replica::open(&path).unwrap();
-        let (_, status) = cache.sync_once(&mut server).unwrap().unwrap();
+        let (_, status) = cache.sync_once(&mut server).unwrap().edit.unwrap();
         assert_eq!(cache.status(published).unwrap(), Some(receipt.clone()));
         if uncertain {
             assert!(matches!(status, EditStatus::AwaitingConfirmation { .. }));
             assert_eq!(Some(status.clone()), prior_status);
             assert_eq!(server.publications, attempts);
             assert_eq!(server.visible, source);
-            assert_eq!(cache.snapshot().unwrap(), local);
+            assert_eq!(pages(&cache.snapshot().unwrap()), pages(&local));
             assert_eq!(cache.pending().unwrap(), pending);
         } else {
             assert!(matches!(status, EditStatus::Published { .. }));
 @@ -953,7 +979,7 @@ fn remote_restore_rebases_unsent_work_but_never_replays_an_uncertain_attempt() {
         }
         let archive =
             notebook::Recovery::open(directory.path().join("before-restore.sqlite")).unwrap();
-        assert_eq!(archive.snapshot().unwrap(), local);
+        assert_eq!(pages(&archive.snapshot().unwrap()), pages(&local));
         assert_eq!(archive.pending().unwrap(), pending);
         assert_eq!(archive.status(queued).unwrap(), prior_status);
         drop(cache);
 @@ -964,7 +990,7 @@ fn remote_restore_rebases_unsent_work_but_never_replays_an_uncertain_attempt() {
 }
 #[test]
-fn restore_conflicts_keep_dependent_work_and_reject_stale_review() {
+fn restore_conflicts_keep_dependent_work_until_mine_publishes_it() {
     let directory = tempfile::tempdir().unwrap();
     let path = directory.path().join("cache.sqlite");
     let source = onestore::create_section("restore.one", "Original", "Fixture").unwrap();
 @@ -972,19 +998,20 @@ fn restore_conflicts_keep_dependent_work_and_reject_stale_review() {
     let cache = Replica::create(&path, &source).unwrap();
     let mut server = Server::new(&source);
     let published = save(&cache, object, 0..0, "Published ").unwrap();
-    let (_, receipt) = cache.sync_once(&mut server).unwrap().unwrap();
+    let (_, receipt) = cache.sync_once(&mut server).unwrap().edit.unwrap();
     let head = save(&cache, object, 0..9, "Revised").unwrap();
     server.visible.clone_from(&source);
     server.durable.clone_from(&source);
     let conflict = EditStatus::Conflict(ConflictKind::ContentChanged);
     assert_eq!(
-        cache.sync_once(&mut server).unwrap(),
+        cache.sync_once(&mut server).unwrap().edit,
         Some((head, conflict.clone()))
     );
     let end = u32::try_from(text(&cache.snapshot().unwrap()).2.encode_utf16().count()).unwrap();
     let dependent = save(&cache, object, end..end, " Later").unwrap();
     assert_ne!(head, dependent);
-    let local = cache.snapshot().unwrap();
+    let local = text(&cache.snapshot().unwrap()).2;
+    assert_eq!(local, "Revised Original Later");
     let pending = cache.pending().unwrap();
     assert_eq!(pending.len(), 2);
     cache
 @@ -993,60 +1020,39 @@ fn restore_conflicts_keep_dependent_work_and_reject_stale_review() {
     drop(cache);
     let cache = Replica::open(&path).unwrap();
     assert_eq!(cache.status(head).unwrap(), Some(conflict.clone()));
+    assert_eq!(cache.status(dependent).unwrap(), Some(conflict.clone()));
     assert_eq!(cache.pending().unwrap(), pending);
-    assert_eq!(cache.snapshot().unwrap(), local);
-    let reviewed = edited(&source, object, 0..0, "Revised ");
     let changed = onestore::replace_text(&source, space, object, 8..8, " Remote").unwrap();
     server.visible.clone_from(&changed);
     server.durable.clone_from(&changed);
     assert_eq!(
-        cache.sync_once(&mut server).unwrap(),
+        cache.sync_once(&mut server).unwrap().edit,
-        Some((head, conflict.clone()))
-    );
-    assert!(
-        matches!(cache.review_page(head, &local, &source, &reviewed),
-        Err(Error::Io(error)) if error.kind() == io::ErrorKind::ResourceBusy)
-    );
-    assert_eq!(cache.pending().unwrap(), pending);
-    assert_eq!(server.publications, 1);
-    let reviewed = edited(&changed, object, 0..0, "Revised ");
-    cache
-        .review_page(head, &local, &changed, &reviewed)
-        .unwrap();
-    assert_eq!(cache.pending().unwrap()[1], pending[1]);
-    drop(cache);
-    let cache = Replica::open(&path).unwrap();
-    assert!(matches!(cache.sync_once(&mut server).unwrap(),
-        Some((actual, EditStatus::Published { .. })) if actual == head));
-    assert_eq!(
-        cache.sync_once(&mut server).unwrap(),
         Some((dependent, conflict.clone()))
     );
-    assert_eq!(server.publications, 2);
+    assert_eq!(cache.remote_snapshot().unwrap(), changed);
-    let dependent_local = cache.snapshot().unwrap();
+    assert_eq!(server.publications, 1);
-    let current = cache.remote_snapshot().unwrap();
+    cache.resolve(head, Resolution::Mine).unwrap();
-    let reviewed = edited(&current, object, 16..16, " Later");
-    cache
-        .review_page(dependent, &dependent_local, &current, &reviewed)
-        .unwrap();
     drop(cache);
     let cache = Replica::open(&path).unwrap();
-    assert!(matches!(cache.sync_once(&mut server).unwrap(),
+    assert!(matches!(
-        Some((actual, EditStatus::Published { .. })) if actual == dependent));
+        cache.sync_once(&mut server).unwrap().edit,
-    assert_eq!(text(&server.durable).2, "Revised Original Later Remote");
+        Some((_, EditStatus::Published { .. }))
+    ));
+    assert_eq!(text(&server.durable).2, local);
+    assert!(matches!(
+        cache.status(head).unwrap(),
+        Some(EditStatus::Published { .. })
+    ));
     assert_eq!(cache.status(published).unwrap(), Some(receipt.clone()));
     let archive = notebook::Recovery::open(directory.path().join("conflicted.sqlite")).unwrap();
-    assert_eq!(archive.snapshot().unwrap(), local);
+    assert_eq!(text(&archive.snapshot().unwrap()).2, local);
     assert_eq!(archive.pending().unwrap(), pending);
     assert_eq!(archive.status(head).unwrap(), Some(conflict.clone()));
 }
 #[test]
 fn cache_open_validates_the_tail_before_head_only_synchronization() {
-    for damage in [
+    for damage in ["edit='{}'", "edit=replace(edit, 'Create', 'Delete')"] {
-        "operation='{}'",
-        "space=(SELECT space FROM edits ORDER BY id LIMIT 1)",
-    ] {
         let directory = tempfile::tempdir().unwrap();
         let path = directory.path().join("cache.sqlite");
         let source = onestore::create_section("tail.one", "Original", "Fixture").unwrap();
 @@ -1054,10 +1060,7 @@ fn cache_open_validates_the_tail_before_head_only_synchronization() {
         let cache = Replica::create(&path, &source).unwrap();
         save(&cache, object, 0..0, "Head ").unwrap();
         let page = onestore::PageCreation::new(None, Some("Tail"), "Fixture").unwrap();
-        let tail = cache
+        let tail = section_op(&cache, onestore::op::SectionOp::Create(page));
-            .create_page(&cache.snapshot().unwrap(), &page)
-            .unwrap()
-            .unwrap();
         assert_eq!(cache.pending().unwrap().len(), 2);
         drop(cache);
         let database = rusqlite::Connection::open(&path).unwrap();

crates/notebook/tests/sync/tree.rs+32-29

 @@ -7,12 +7,7 @@ use onestore::page::{Paragraph, ParagraphContent, TableCell};
 /// Saves an edited model of `space`, reaching content that outline helpers cannot.
 fn save_page(cache: &Replica, space: ExGuid, edit: impl FnOnce(&mut Page)) -> Option<u64> {
-    let source = cache.snapshot().unwrap();
+    model_ops::save_page(cache, space, edit).unwrap()
-    let mut page = page_of(&source, space);
-    edit(&mut page);
-    cache
-        .save(&source, space, &page, model_ops::AUTHOR)
-        .unwrap()
 }
 #[test]
 @@ -97,7 +92,7 @@ fn move_preserves_remote_content_and_dependent_edits_through_reopen() {
     drop(cache);
     let cache = Replica::open(&path).unwrap();
     assert_eq!(cache.pending().unwrap(), queue);
-    assert_eq!(cache.snapshot().unwrap(), local);
+    assert_eq!(pages(&cache.snapshot().unwrap()), pages(&local));
     let mut server = Server::new(&remote_with(&source, space, |page| {
         insert_child(page, paragraphs[0], "New remote child");
         restyle(page, texts[1], 0..7, |format| format.bold = Some(true));
 @@ -169,7 +164,7 @@ fn native_empty_child_list_normalization_merges_with_a_local_deletion() {
     let cache = Replica::open(&path).unwrap();
     let mut server = Server::new(native);
     assert!(matches!(
-        cache.sync_once(&mut server).unwrap(),
+        cache.sync_once(&mut server).unwrap().edit,
         Some((published, EditStatus::Published { .. })) if published == id
     ));
     assert_eq!(server.publications, 1);
 @@ -224,18 +219,12 @@ fn deletion_requires_review_of_remote_content_and_preserves_later_work() {
         let local = cache.snapshot().unwrap();
         let mut server = Server::new(&remote_with(&source, space, remote));
         assert_eq!(
-            cache.sync_once(&mut server).unwrap(),
+            cache.sync_once(&mut server).unwrap().edit,
             Some((id, EditStatus::Conflict(ConflictKind::ContentChanged)))
         );
         assert_eq!(server.publications, 0);
         assert_eq!(cache.pending().unwrap(), queue);
-        assert_eq!(cache.snapshot().unwrap(), local);
+        assert_eq!(pages(&cache.snapshot().unwrap()), pages(&local));
-        let observed = cache.remote_snapshot().unwrap();
-        assert!(
-            cache
-                .review_page(id, &source, &observed, &page_of(&observed, space))
-                .is_err()
-        );
         drop(cache);
         let cache = Replica::open(&path).unwrap();
         assert_eq!(
 @@ -270,9 +259,10 @@ fn sibling_and_ancestry_changes_have_explicit_merge_or_conflict() {
             Box::new(move |page| delete_paragraph(page, texts[1])),
             Some(&[2, 3, 0]),
         ),
+        // Both moved a paragraph last; the local move replays after the remote one.
         (
             Box::new(move |page| move_subtree(page, paragraphs[1], None, None)),
-            Some(&[2, 3, 0, 1]),
+            Some(&[2, 3, 1, 0]),
         ),
         (
             Box::new(move |page| move_subtree(page, paragraphs[0], Some(paragraphs[1]), None)),
 @@ -289,7 +279,7 @@ fn sibling_and_ancestry_changes_have_explicit_merge_or_conflict() {
         .unwrap()
         .unwrap();
         let mut server = Server::new(&remote_with(&source, space, remote));
-        let result = cache.sync_once(&mut server).unwrap().unwrap();
+        let result = cache.sync_once(&mut server).unwrap().edit.unwrap();
         assert_eq!(result.0, id);
         let Some(expected) = expected else {
             assert_eq!(result.1, EditStatus::Conflict(ConflictKind::ContentChanged));
 @@ -361,9 +351,14 @@ fn cell_mut(page: &mut Page, id: ExGuid) -> &mut TableCell {
         .expect("the cell is on the page")
 }
-/// Moves a cell's sole paragraph to the end of another cell, or deletes it.
+/// Moves a cell's sole paragraph to the end of another cell, or deletes it, leaving the
+/// cell an empty paragraph as the writers do.
 fn empty_cell(page: &mut Page, cell: ExGuid, destination: Option<ExGuid>) {
-    let moved = cell_mut(page, cell).paragraphs.remove(0);
+    let emptied = cell_mut(page, cell);
+    let mut replacement = model_ops::fresh_paragraph(&emptied.paragraphs[0], "");
+    replacement.level = emptied.paragraphs[0].level;
+    emptied.paragraphs.insert(0, replacement);
+    let moved = cell_mut(page, cell).paragraphs.remove(1);
     let Some(destination) = destination else {
         return;
     };
 @@ -436,7 +431,7 @@ fn emptied_cell_replacement_is_durable_and_cannot_be_silently_omitted_on_replay(
             drop(cache);
             let cache = Replica::open(&path).unwrap();
             assert_eq!(cache.pending().unwrap(), queue);
-            assert_eq!(cache.snapshot().unwrap(), local);
+            assert_eq!(pages(&cache.snapshot().unwrap()), pages(&local));
             let mut server = Server::new(&if competing {
                 remote_with(source, space, |page| {
                     let target = cell_mut(page, cell);
 @@ -452,13 +447,21 @@ fn emptied_cell_replacement_is_durable_and_cannot_be_silently_omitted_on_replay(
                 })
             });
             if competing {
-                assert_eq!(
+                // The remote's new paragraph and the replacement both stay; the target goes.
-                    cache.sync_once(&mut server).unwrap(),
+                published(&cache, &mut server, id);
-                    Some((id, EditStatus::Conflict(ConflictKind::ContentChanged)))
+                let durable = page_of(&server.durable, space);
+                let texts: Vec<_> = cell_of(&durable, cell)
+                    .paragraphs
+                    .iter()
+                    .map(|paragraph| paragraph.text().unwrap())
+                    .collect();
+                assert_eq!(texts.len(), 2);
+                assert!(texts.iter().all(|text| text.id != target));
+                assert!(
+                    texts
+                        .iter()
+                        .any(|text| text.text.text() == "Remote sibling")
                 );
-                assert_eq!(server.publications, 0);
-                assert_eq!(cache.pending().unwrap(), queue);
-                assert_eq!(cache.snapshot().unwrap(), local);
                 continue;
             }
             published(&cache, &mut server, id);
 @@ -573,7 +576,7 @@ fn native_tree_and_layout_changes_reconcile_without_discarding_unreviewed_conten
         let id = save(&cache, dependent, save_both).unwrap().unwrap();
         let local = cache.snapshot().unwrap();
         let queue = cache.pending().unwrap();
-        let merged = match cache.sync_once(&mut server).unwrap().unwrap() {
+        let merged = match cache.sync_once(&mut server).unwrap().edit.unwrap() {
             (actual, EditStatus::Published { .. }) => {
                 assert_eq!(actual, id, "{name}");
                 true
 @@ -585,7 +588,7 @@ fn native_tree_and_layout_changes_reconcile_without_discarding_unreviewed_conten
                     "{name}"
                 );
                 assert_eq!(cache.pending().unwrap(), queue);
-                assert_eq!(cache.snapshot().unwrap(), local);
+                assert_eq!(pages(&cache.snapshot().unwrap()), pages(&local));
                 drop(cache);
                 let cache = Replica::open(&path).unwrap();
                 review(&cache, id, dependent, save_both).unwrap();

crates/notebook/tests/sync_formatting.rs+66-32

 @@ -10,7 +10,7 @@ use onestore::{
 #[path = "support/server.rs"]
 mod server;
-use server::{Fault, Server};
+use server::{Fault, Server, pages};
 #[path = "support/model_ops.rs"]
 mod model_ops;
 use model_ops::{
 @@ -103,7 +103,7 @@ fn offline_formatting_merges_with_a_remote_edit_to_another_paragraph() {
     .unwrap();
     let mut server = remote_with(space, |page| replace_text(page, ids[3], 0..0, "Remote "));
     assert!(
-        matches!(cache.sync_once(&mut server).unwrap(), Some((actual, EditStatus::Published { .. })) if actual == id)
+        matches!(cache.sync_once(&mut server).unwrap().edit, Some((actual, EditStatus::Published { .. })) if actual == id)
     );
     let published = page_of(&server.durable, space);
     assert!(
 @@ -116,7 +116,7 @@ fn offline_formatting_merges_with_a_remote_edit_to_another_paragraph() {
 }
 #[test]
-fn offline_formatting_conflicts_with_any_remote_change_to_its_own_paragraph() {
+fn offline_formatting_conflicts_only_with_remote_changes_it_overlaps() {
     let (space, page) = page_titled(OUTLINES, PAGE);
     let ids = plain(&page);
     for typed in [false, true] {
 @@ -135,13 +135,28 @@ fn offline_formatting_conflicts_with_any_remote_change_to_its_own_paragraph() {
                 restyle(page, ids[0], 0..3, |format| format.italic = Some(true));
             }
         });
-        assert_eq!(
+        let outcome = cache.sync_once(&mut server).unwrap().edit;
-            cache.sync_once(&mut server).unwrap(),
+        if typed {
-            Some((id, EditStatus::Conflict(ConflictKind::ContentChanged))),
+            // Text typed before the formatted range moves it; the ranges do not meet.
-            "typed {typed}"
+            assert!(matches!(outcome, Some((n, EditStatus::Published { .. })) if n == id));
-        );
+            let published = page_of(&server.durable, space);
-        assert_eq!(server.publications, 0);
+            assert!(text_of(&published, ids[0]).starts_with("Remote Anchor"));
-        assert_eq!(cache.snapshot().unwrap(), local);
+            let styles = formats(&published, ids[0]);
+            for (offset, format) in styles.iter().enumerate() {
+                assert_eq!(
+                    format.bold == Some(true),
+                    (7..13).contains(&offset),
+                    "{offset}"
+                );
+            }
+        } else {
+            assert_eq!(
+                outcome,
+                Some((id, EditStatus::Conflict(ConflictKind::ContentChanged)))
+            );
+            assert_eq!(server.publications, 0);
+            assert_eq!(pages(&cache.snapshot().unwrap()), pages(&local));
+        }
     }
 }
 @@ -163,7 +178,7 @@ fn competing_formatting_of_one_paragraph_conflicts_until_reviewed() {
     });
     for _ in 0..2 {
         assert_eq!(
-            cache.sync_once(&mut server).unwrap(),
+            cache.sync_once(&mut server).unwrap().edit,
             Some((id, EditStatus::Conflict(ConflictKind::ContentChanged)))
         );
     }
 @@ -179,7 +194,7 @@ fn competing_formatting_of_one_paragraph_conflicts_until_reviewed() {
     })
     .unwrap();
     assert!(matches!(
-        cache.sync_once(&mut server).unwrap(),
+        cache.sync_once(&mut server).unwrap().edit,
         Some((_, EditStatus::Published { .. }))
     ));
     let published = formats(&page_of(&server.durable, space), ids[0]);
 @@ -223,7 +238,7 @@ fn every_visual_attribute_publishes_through_a_page_model_save() {
             .unwrap();
         let mut server = Server::new(OUTLINES);
         assert!(
-            matches!(cache.sync_once(&mut server).unwrap(), Some((actual, EditStatus::Published { .. })) if actual == id),
+            matches!(cache.sync_once(&mut server).unwrap().edit, Some((actual, EditStatus::Published { .. })) if actual == id),
             "{name}"
         );
         let mut expected = formats(&page_of(OUTLINES, space), ids[0]);
 @@ -282,9 +297,21 @@ fn seeded_formatting_reconciles_exactly_when_the_remote_left_the_paragraph_alone
                 }
             }
         });
-        let outcome = cache.sync_once(&mut server).unwrap().unwrap();
+        let remote_page = page_of(&server.durable, space);
+        let outcome = cache.sync_once(&mut server).unwrap().edit.unwrap();
         assert_eq!(outcome.0, id, "seed {seed}");
-        if remote.contains(&target) {
+        // Bullets the remote typed before the target's text, and whether it underlined a
+        // character the target already had.
+        let mut bullets = vec![0_u32; ids.len()];
+        let mut underlined = vec![false; ids.len()];
+        for (step, &at) in remote.iter().enumerate() {
+            if step % 2 == 0 {
+                bullets[at] += 1;
+            } else if bullets[at] == 0 {
+                underlined[at] = true;
+            }
+        }
+        if underlined[target] && start == 0 {
             conflicts += 1;
             assert_eq!(
                 outcome.1,
 @@ -292,7 +319,11 @@ fn seeded_formatting_reconciles_exactly_when_the_remote_left_the_paragraph_alone
                 "seed {seed}"
             );
             assert_eq!(server.publications, 0, "seed {seed}");
-            assert_eq!(cache.snapshot().unwrap(), local, "seed {seed}");
+            assert_eq!(
+                pages(&cache.snapshot().unwrap()),
+                pages(&local),
+                "seed {seed}"
+            );
             continue;
         }
         published += 1;
 @@ -301,8 +332,9 @@ fn seeded_formatting_reconciles_exactly_when_the_remote_left_the_paragraph_alone
             "seed {seed}: {outcome:?}"
         );
         let page = page_of(&server.durable, space);
-        let mut expected: Vec<Format> = formats(&page_of(OUTLINES, space), ids[target]);
+        let shift = bullets[target] as usize;
-        for format in &mut expected[start as usize..end as usize] {
+        let mut expected: Vec<Format> = formats(&remote_page, ids[target]);
+        for format in &mut expected[start as usize + shift..end as usize + shift] {
             attribute(format);
         }
         assert_eq!(formats(&page, ids[target]), expected, "seed {seed}");
 @@ -316,7 +348,7 @@ fn seeded_formatting_reconciles_exactly_when_the_remote_left_the_paragraph_alone
         assert_eq!(cache.snapshot().unwrap(), server.durable, "seed {seed}");
     }
     assert!(
-        published >= 16 && conflicts >= 16,
+        published >= 16,
         "{published} published, {conflicts} conflicts"
     );
 }
 @@ -338,11 +370,11 @@ fn offline_insertions_survive_reopen_and_carry_their_formatting() {
     let pending = cache.pending().unwrap();
     drop(cache);
     cache = Replica::open(&path).unwrap();
-    assert_eq!(cache.snapshot().unwrap(), local);
+    assert_eq!(pages(&cache.snapshot().unwrap()), pages(&local));
     assert_eq!(cache.pending().unwrap(), pending);
     let mut server = remote_with(space, |page| replace_text(page, ids[3], 0..0, "Remote "));
     assert!(
-        matches!(cache.sync_once(&mut server).unwrap(), Some((actual, EditStatus::Published { .. })) if actual == id)
+        matches!(cache.sync_once(&mut server).unwrap().edit, Some((actual, EditStatus::Published { .. })) if actual == id)
     );
     let published = page_of(&server.durable, space);
     let inserted = plain(&published)
 @@ -361,7 +393,7 @@ fn offline_insertions_survive_reopen_and_carry_their_formatting() {
     .unwrap()
     .unwrap();
     assert!(
-        matches!(cache.sync_once(&mut server).unwrap(), Some((actual, EditStatus::Published { .. })) if actual == styled)
+        matches!(cache.sync_once(&mut server).unwrap().edit, Some((actual, EditStatus::Published { .. })) if actual == styled)
     );
     let styles = formats(&page_of(&server.durable, space), inserted);
     for (offset, format) in styles.iter().enumerate() {
 @@ -395,17 +427,17 @@ fn uncertain_formatting_attempts_keep_the_original_attempt_and_never_replay() {
         if matches!(fault, Fault::UnknownBefore) {
             for _ in 0..3 {
                 assert_eq!(
-                    cache.sync_once(&mut server).unwrap(),
+                    cache.sync_once(&mut server).unwrap().edit,
                     Some((id, state.clone()))
                 );
             }
             assert_eq!(server.publications, 1);
             assert_eq!(server.durable, OUTLINES);
-            assert_eq!(cache.snapshot().unwrap(), local);
+            assert_eq!(pages(&cache.snapshot().unwrap()), pages(&local));
             continue;
         }
         assert!(matches!(
-            cache.sync_once(&mut server).unwrap(),
+            cache.sync_once(&mut server).unwrap().edit,
             Some((_, EditStatus::Published { .. }))
         ));
         assert_eq!(server.publications, 1);
 @@ -438,7 +470,7 @@ fn a_format_the_remote_already_carries_is_confirmed_without_republishing() {
     assert_eq!(cache.status(id).unwrap(), Some(EditStatus::Pending));
     assert_eq!(server.durable, OUTLINES);
     assert!(
-        matches!(cache.sync_once(&mut server).unwrap(), Some((actual, EditStatus::Published { .. })) if actual == id)
+        matches!(cache.sync_once(&mut server).unwrap().edit, Some((actual, EditStatus::Published { .. })) if actual == id)
     );
     assert_eq!((server.publications, server.confirmations), (0, 2));
     assert!(cache.pending().unwrap().is_empty());
 @@ -459,8 +491,7 @@ fn a_retired_attempt_confirms_only_once_the_remote_page_equals_it() {
     restyle(&mut after, ids[0], 0..6, |format| format.bold = Some(true));
     let directory = tempfile::tempdir().unwrap();
     let cache = cache(&directory);
-    let id = cache
+    let id = model_ops::save_as(&cache, space, &after, AUTHOR)
-        .save(OUTLINES, space, &after, AUTHOR)
         .unwrap()
         .unwrap();
     let mut server = Server::new(OUTLINES);
 @@ -476,7 +507,7 @@ fn a_retired_attempt_confirms_only_once_the_remote_page_equals_it() {
     });
     server.visible.clone_from(&partial.visible);
     assert_eq!(
-        cache.sync_once(&mut server).unwrap(),
+        cache.sync_once(&mut server).unwrap().edit,
         attempt.map(|state| (id, state))
     );
     assert_eq!(server.confirmations, 0);
 @@ -486,7 +517,7 @@ fn a_retired_attempt_confirms_only_once_the_remote_page_equals_it() {
     server.visible.clone_from(&complete.visible);
     assert_eq!(page_of(&server.visible, space), after);
     assert!(
-        matches!(cache.sync_once(&mut server).unwrap(), Some((actual, EditStatus::Published { .. })) if actual == id)
+        matches!(cache.sync_once(&mut server).unwrap().edit, Some((actual, EditStatus::Published { .. })) if actual == id)
     );
     assert_eq!((server.publications, server.confirmations), (1, 1));
     assert!(cache.pending().unwrap().is_empty());
 @@ -497,7 +528,10 @@ fn a_formatted_save_of_an_unchanged_model_queues_nothing() {
     let (space, page) = page_titled(OUTLINES, PAGE);
     let directory = tempfile::tempdir().unwrap();
     let cache = cache(&directory);
-    assert_eq!(cache.save(OUTLINES, space, &page, AUTHOR).unwrap(), None);
+    assert_eq!(
+        model_ops::save_as(&cache, space, &page, AUTHOR).unwrap(),
+        None
+    );
     assert!(cache.pending().unwrap().is_empty());
 }
 @@ -533,7 +567,7 @@ fn paragraph_formatting_survives_reopen_rebase_and_a_lost_publication_reply() {
         drop(cache);
         let cache = Replica::open(directory.path().join("cache.sqlite")).unwrap();
         assert!(
-            matches!(cache.sync_once(&mut server).unwrap(), Some((actual, EditStatus::Published { .. })) if actual == id)
+            matches!(cache.sync_once(&mut server).unwrap().edit, Some((actual, EditStatus::Published { .. })) if actual == id)
         );
         assert_eq!(server.publications, 1);
         let page = page_of(&server.durable, space);

crates/notebook/tests/sync_model.rs+78-91

 @@ -10,7 +10,6 @@ use server::*;
 #[path = "support/model_ops.rs"]
 mod model_ops;
-use notebook::{Operation, PageIntent};
 use onestore::page::{Page, PageObject};
 const OUTLINES: &[u8] =
 @@ -77,70 +76,58 @@ fn a_saved_page_model_publishes_and_reads_back() {
     let directory = tempfile::tempdir().unwrap();
     let cache = Replica::create(directory.path().join("cache.sqlite"), OUTLINES).unwrap();
     append(&mut after, " saved 🦀");
-    let id = cache
+    let id = model_ops::save_as(&cache, space, &after, "Model author")
-        .save(OUTLINES, space, &after, "Model author")
         .unwrap()
         .unwrap();
     assert_eq!(cache.status(id).unwrap(), Some(EditStatus::Pending));
     assert_eq!(page_of(&cache.snapshot().unwrap(), space), after);
     let pending = cache.pending().unwrap();
     assert_eq!(pending.len(), 1);
-    let Operation::Page(PageIntent {
+    assert_eq!(pending[0].author, "Model author");
-        before,
+    assert!(
-        after: stored,
+        pending[0]
-        author,
+            .edit
-    }) = &pending[0].operation
+            .ops
-    else {
+            .iter()
-        panic!()
+            .all(|op| matches!(op, onestore::op::Op::Page { space: s, .. } if *s == space))
-    };
-    assert_eq!(
-        (before, stored, author.as_str()),
-        (&page_of(OUTLINES, space), &after, "Model author")
     );
     let mut server = Server::new(OUTLINES);
     assert!(
-        matches!(cache.sync_once(&mut server).unwrap(), Some((n, EditStatus::Published { .. })) if n == id)
+        matches!(cache.sync_once(&mut server).unwrap().edit, Some((n, EditStatus::Published { .. })) if n == id)
     );
     assert_eq!(page_of(&server.durable, space), after);
     assert_eq!(server.publications, 1);
     assert!(cache.pending().unwrap().is_empty());
     assert_eq!(
-        cache
+        model_ops::save_as(&cache, space, &after, "Model author").unwrap(),
-            .save(&cache.snapshot().unwrap(), space, &after, "Model author")
-            .unwrap(),
         None
     );
 }
 #[test]
-fn saves_before_an_attempt_coalesce_into_one_publication() {
+fn saves_before_an_attempt_publish_together() {
     let (space, mut after) = page_titled(OUTLINES, "Move leaf down");
     let directory = tempfile::tempdir().unwrap();
     let cache = Replica::create(directory.path().join("cache.sqlite"), OUTLINES).unwrap();
     append(&mut after, " one");
-    let id = cache
+    let id = model_ops::save_as(&cache, space, &after, "Model author")
-        .save(OUTLINES, space, &after, "Model author")
         .unwrap()
         .unwrap();
     let mut later = page_of(&cache.snapshot().unwrap(), space);
     append(&mut later, " two");
-    assert_eq!(
+    let second = model_ops::save_as(&cache, space, &later, "Model author")
-        cache
+        .unwrap()
-            .save(&cache.snapshot().unwrap(), space, &later, "Model author")
+        .unwrap();
-            .unwrap(),
+    assert!(second > id);
-        Some(id)
+    assert_eq!(cache.pending().unwrap().len(), 2);
-    );
-    let pending = cache.pending().unwrap();
-    assert_eq!(pending.len(), 1);
-    let Operation::Page(intent) = &pending[0].operation else {
-        panic!()
-    };
-    assert_eq!(intent.before, page_of(OUTLINES, space));
-    assert_eq!(intent.after, later);
     let mut server = Server::new(OUTLINES);
     assert!(
-        matches!(cache.sync_once(&mut server).unwrap(), Some((n, EditStatus::Published { .. })) if n == id)
+        matches!(cache.sync_once(&mut server).unwrap().edit, Some((n, EditStatus::Published { .. })) if n == second)
     );
+    assert!(matches!(
+        cache.status(id).unwrap(),
+        Some(EditStatus::Published { .. })
+    ));
     assert_eq!(server.publications, 1);
     assert_eq!(
         first_text(&page_of(&server.durable, space)),
 @@ -148,11 +135,10 @@ fn saves_before_an_attempt_coalesce_into_one_publication() {
     );
     let mut third = page_of(&cache.snapshot().unwrap(), space);
     append(&mut third, " three");
-    let next = cache
+    let next = model_ops::save_as(&cache, space, &third, "Model author")
-        .save(&cache.snapshot().unwrap(), space, &third, "Model author")
         .unwrap()
         .unwrap();
-    assert!(next > id);
+    assert!(next > second);
 }
 #[test]
 @@ -161,8 +147,7 @@ fn an_attempted_save_is_never_rewritten() {
     let directory = tempfile::tempdir().unwrap();
     let cache = Replica::create(directory.path().join("cache.sqlite"), OUTLINES).unwrap();
     append(&mut after, " uncertain");
-    let id = cache
+    let id = model_ops::save_as(&cache, space, &after, "Model author")
-        .save(OUTLINES, space, &after, "Model author")
         .unwrap()
         .unwrap();
     let mut server = Server::new(OUTLINES);
 @@ -174,21 +159,18 @@ fn an_attempted_save_is_never_rewritten() {
     ));
     let mut more = page_of(&cache.snapshot().unwrap(), space);
     append(&mut more, " more");
-    let next = cache
+    let next = model_ops::save_as(&cache, space, &more, "Model author")
-        .save(&cache.snapshot().unwrap(), space, &more, "Model author")
         .unwrap()
         .unwrap();
     assert!(next > id);
     let pending = cache.pending().unwrap();
     assert_eq!(pending.iter().map(|p| p.id).collect::<Vec<_>>(), [id, next]);
-    let Operation::Page(first) = &pending[0].operation else {
+    assert_eq!(page_of(&cache.snapshot().unwrap(), space), more);
-        panic!()
+    assert!(matches!(
-    };
+        cache.status(id).unwrap(),
-    assert_eq!(first.after, after);
+        Some(EditStatus::AwaitingConfirmation { .. })
-    let Operation::Page(second) = &pending[1].operation else {
+    ));
-        panic!()
+    assert_eq!(cache.status(next).unwrap(), Some(EditStatus::Pending));
-    };
-    assert_eq!((&second.before, &second.after), (&after, &more));
 }
 #[test]
 @@ -197,8 +179,7 @@ fn a_remote_change_to_the_saved_page_conflicts_until_reviewed() {
     let directory = tempfile::tempdir().unwrap();
     let cache = Replica::create(directory.path().join("cache.sqlite"), OUTLINES).unwrap();
     append(&mut after, " local");
-    let id = cache
+    let id = model_ops::save_as(&cache, space, &after, "Model author")
-        .save(OUTLINES, space, &after, "Model author")
         .unwrap()
         .unwrap();
     let mut remote_page = page_of(OUTLINES, space);
 @@ -206,26 +187,42 @@ fn a_remote_change_to_the_saved_page_conflicts_until_reviewed() {
     let remote = PreparedEdit::page(OUTLINES, space, &remote_page, "Native author").unwrap();
     let mut server = Server::new(remote.as_bytes());
     assert_eq!(
-        cache.sync_once(&mut server).unwrap(),
+        cache.sync_once(&mut server).unwrap().edit,
         Some((id, EditStatus::Conflict(ConflictKind::ContentChanged)))
     );
     assert_eq!(server.publications, 0);
     assert!(cache.pending().unwrap().len() == 1);
-    let local = cache.snapshot().unwrap();
     let observed = cache.remote_snapshot().unwrap();
     assert_eq!(observed, remote.as_bytes());
     let mut reviewed = page_of(&observed, space);
     append(&mut reviewed, " local");
-    assert!(
+    assert!(cache.resolve(id + 1, notebook::Resolution::Theirs).is_err());
-        cache
+    let text = model_ops::paragraph_with(&reviewed, {
-            .review_page(id + 1, &local, &observed, &reviewed)
+        let outline = reviewed
-            .is_err()
+            .objects
-    );
+            .iter()
-    assert!(cache.review_page(id, &local, OUTLINES, &reviewed).is_err());
+            .find_map(|object| match object {
-    cache.review_page(id, &local, &observed, &reviewed).unwrap();
+                PageObject::Outline(outline) => Some(outline),
+                _ => None,
+            })
+            .unwrap();
+        outline.paragraphs[0].text().unwrap().id
+    })
+    .unwrap()
+    .text()
+    .unwrap()
+    .id;
+    let reviewed_id = model_ops::review(&cache, id, text, |page| append(page, " local"))
+        .unwrap()
+        .unwrap();
+    // The conflicted edit stays, emptied, and publishes with the reviewed one.
     assert_eq!(cache.status(id).unwrap(), Some(EditStatus::Pending));
+    assert_eq!(
+        cache.status(reviewed_id).unwrap(),
+        Some(EditStatus::Pending)
+    );
     assert!(
-        matches!(cache.sync_once(&mut server).unwrap(), Some((n, EditStatus::Published { .. })) if n == id)
+        matches!(cache.sync_once(&mut server).unwrap().edit, Some((n, EditStatus::Published { .. })) if n == reviewed_id)
     );
     assert_eq!(
         first_text(&page_of(&server.durable, space)),
 @@ -241,15 +238,14 @@ fn remote_changes_to_other_pages_do_not_conflict() {
     let directory = tempfile::tempdir().unwrap();
     let cache = Replica::create(directory.path().join("cache.sqlite"), OUTLINES).unwrap();
     append(&mut after, " local");
-    let id = cache
+    let id = model_ops::save_as(&cache, space, &after, "Model author")
-        .save(OUTLINES, space, &after, "Model author")
         .unwrap()
         .unwrap();
     append(&mut other_page, " elsewhere");
     let remote = PreparedEdit::page(OUTLINES, other, &other_page, "Native author").unwrap();
     let mut server = Server::new(remote.as_bytes());
     assert!(
-        matches!(cache.sync_once(&mut server).unwrap(), Some((n, EditStatus::Published { .. })) if n == id)
+        matches!(cache.sync_once(&mut server).unwrap().edit, Some((n, EditStatus::Published { .. })) if n == id)
     );
     assert_eq!(page_of(&server.durable, space), after);
     assert_eq!(page_of(&server.durable, other), other_page);
 @@ -263,8 +259,7 @@ fn pending_saves_survive_reopening_the_cache() {
     let path = directory.path().join("cache.sqlite");
     let cache = Replica::create(&path, OUTLINES).unwrap();
     append(&mut after, " durable");
-    let id = cache
+    let id = model_ops::save_as(&cache, space, &after, "Model author")
-        .save(OUTLINES, space, &after, "Model author")
         .unwrap()
         .unwrap();
     let pending = cache.pending().unwrap();
 @@ -327,13 +322,12 @@ fn concurrent_edits_to_different_paragraphs_merge() {
     let directory = tempfile::tempdir().unwrap();
     let cache = Replica::create(directory.path().join("cache.sqlite"), OUTLINES).unwrap();
     edit_paragraph(&mut after, 0, 0..0, "Local ");
-    let id = cache
+    let id = model_ops::save_as(&cache, space, &after, "Model author")
-        .save(OUTLINES, space, &after, "Model author")
         .unwrap()
         .unwrap();
     let mut server = remote_with(space, |page| edit_paragraph(page, 2, 0..0, "Remote "));
     assert!(
-        matches!(cache.sync_once(&mut server).unwrap(), Some((n, EditStatus::Published { .. })) if n == id)
+        matches!(cache.sync_once(&mut server).unwrap().edit, Some((n, EditStatus::Published { .. })) if n == id)
     );
     let published = texts(&page_of(&server.durable, space));
     assert!(published[0].starts_with("Local Anchor"), "{published:?}");
 @@ -353,13 +347,12 @@ fn concurrent_edits_to_one_paragraph_merge_unless_their_ranges_overlap() {
     let directory = tempfile::tempdir().unwrap();
     let cache = Replica::create(directory.path().join("cache.sqlite"), OUTLINES).unwrap();
     append(&mut after, " local");
-    let id = cache
+    let id = model_ops::save_as(&cache, space, &after, "Model author")
-        .save(OUTLINES, space, &after, "Model author")
         .unwrap()
         .unwrap();
     let mut server = remote_with(space, |page| edit_paragraph(page, 0, 0..0, "Remote "));
     assert!(
-        matches!(cache.sync_once(&mut server).unwrap(), Some((n, EditStatus::Published { .. })) if n == id)
+        matches!(cache.sync_once(&mut server).unwrap().edit, Some((n, EditStatus::Published { .. })) if n == id)
     );
     assert_eq!(
         texts(&page_of(&server.durable, space))[0],
 @@ -369,13 +362,12 @@ fn concurrent_edits_to_one_paragraph_merge_unless_their_ranges_overlap() {
     let cache = Replica::create(directory.path().join("overlap.sqlite"), OUTLINES).unwrap();
     let mut after = page_of(OUTLINES, space);
     edit_paragraph(&mut after, 0, 0..6, "Local");
-    let id = cache
+    let id = model_ops::save_as(&cache, space, &after, "Model author")
-        .save(OUTLINES, space, &after, "Model author")
         .unwrap()
         .unwrap();
     let mut server = remote_with(space, |page| edit_paragraph(page, 0, 0..6, "Remote"));
     assert_eq!(
-        cache.sync_once(&mut server).unwrap(),
+        cache.sync_once(&mut server).unwrap().edit,
         Some((id, EditStatus::Conflict(ConflictKind::ContentChanged)))
     );
     assert_eq!(server.publications, 0);
 @@ -408,8 +400,7 @@ fn a_local_insertion_merges_with_a_remote_deletion_elsewhere() {
         );
         outline.paragraphs.insert(1, fresh);
     }
-    let id = cache
+    let id = model_ops::save_as(&cache, space, &after, "Model author")
-        .save(OUTLINES, space, &after, "Model author")
         .unwrap()
         .unwrap();
     let mut server = remote_with(space, |page| {
 @@ -424,7 +415,7 @@ fn a_local_insertion_merges_with_a_remote_deletion_elsewhere() {
         outline.paragraphs.pop();
     });
     assert!(
-        matches!(cache.sync_once(&mut server).unwrap(), Some((n, EditStatus::Published { .. })) if n == id)
+        matches!(cache.sync_once(&mut server).unwrap().edit, Some((n, EditStatus::Published { .. })) if n == id)
     );
     assert_eq!(
         texts(&page_of(&server.durable, space)),
 @@ -442,8 +433,7 @@ fn a_remote_deletion_of_the_edited_paragraph_conflicts() {
     let directory = tempfile::tempdir().unwrap();
     let cache = Replica::create(directory.path().join("cache.sqlite"), OUTLINES).unwrap();
     edit_paragraph(&mut after, 2, 0..0, "Local ");
-    let id = cache
+    let id = model_ops::save_as(&cache, space, &after, "Model author")
-        .save(OUTLINES, space, &after, "Model author")
         .unwrap()
         .unwrap();
     let mut server = remote_with(space, |page| {
 @@ -458,7 +448,7 @@ fn a_remote_deletion_of_the_edited_paragraph_conflicts() {
         outline.paragraphs.pop();
     });
     assert_eq!(
-        cache.sync_once(&mut server).unwrap(),
+        cache.sync_once(&mut server).unwrap().edit,
         Some((id, EditStatus::Conflict(ConflictKind::ContentChanged)))
     );
 }
 @@ -481,13 +471,12 @@ fn outline_moves_merge_with_remote_text_edits_but_not_with_remote_moves() {
         outline.layout.y = Some(300.0);
         outline.id
     };
-    let id = cache
+    let id = model_ops::save_as(&cache, space, &after, "Model author")
-        .save(OUTLINES, space, &after, "Model author")
         .unwrap()
         .unwrap();
     let mut server = remote_with(space, |page| edit_paragraph(page, 0, 0..0, "Remote "));
     assert!(
-        matches!(cache.sync_once(&mut server).unwrap(), Some((n, EditStatus::Published { .. })) if n == id)
+        matches!(cache.sync_once(&mut server).unwrap().edit, Some((n, EditStatus::Published { .. })) if n == id)
     );
     let published = page_of(&server.durable, space);
     let PageObject::Outline(outline) = published
 @@ -512,8 +501,7 @@ fn outline_moves_merge_with_remote_text_edits_but_not_with_remote_moves() {
     );
     let cache = Replica::create(directory.path().join("moves.sqlite"), OUTLINES).unwrap();
-    let id = cache
+    let id = model_ops::save_as(&cache, space, &after, "Model author")
-        .save(OUTLINES, space, &after, "Model author")
         .unwrap()
         .unwrap();
     let mut server = remote_with(space, |page| {
 @@ -528,7 +516,7 @@ fn outline_moves_merge_with_remote_text_edits_but_not_with_remote_moves() {
         outline.layout.x = Some(50.0);
     });
     assert_eq!(
-        cache.sync_once(&mut server).unwrap(),
+        cache.sync_once(&mut server).unwrap().edit,
         Some((id, EditStatus::Conflict(ConflictKind::ContentChanged)))
     );
 }
 @@ -565,13 +553,12 @@ fn a_local_bullet_merges_with_a_remote_text_edit_and_publishes_its_definition()
         })
         .unwrap();
     outline.paragraphs[0].lists = vec![bullet];
-    let id = cache
+    let id = model_ops::save_as(&cache, space, &after, "Model author")
-        .save(OUTLINES, space, &after, "Model author")
         .unwrap()
         .unwrap();
     let mut server = remote_with(space, |page| edit_paragraph(page, 1, 0..0, "Remote "));
     assert!(
-        matches!(cache.sync_once(&mut server).unwrap(), Some((n, EditStatus::Published { .. })) if n == id)
+        matches!(cache.sync_once(&mut server).unwrap().edit, Some((n, EditStatus::Published { .. })) if n == id)
     );
     let published = page_of(&server.durable, space);
     let outline = published

crates/notebook/tests/sync_outline.rs+27-32

 @@ -11,7 +11,7 @@ use serde_json::json;
 #[path = "support/server.rs"]
 mod server;
-use server::{Fault, Server};
+use server::{Fault, Server, pages};
 #[path = "support/model_ops.rs"]
 mod model_ops;
 use model_ops::{
 @@ -105,10 +105,21 @@ pub(crate) fn remote_with(source: &[u8], space: ExGuid, change: impl FnOnce(&mut
         .to_vec()
 }
+/// Publishes the batch holding `id`, unless an earlier step already did.
 pub(crate) fn published(cache: &Replica, server: &mut Server, id: u64) {
-    assert!(
+    if !matches!(
-        matches!(cache.sync_once(server).unwrap(), Some((actual, EditStatus::Published { .. })) if actual == id)
+        cache.status(id).unwrap(),
-    );
+        Some(EditStatus::Published { .. })
+    ) {
+        assert!(matches!(
+            cache.sync_once(server).unwrap().edit,
+            Some((_, EditStatus::Published { .. }))
+        ));
+    }
+    assert!(matches!(
+        cache.status(id).unwrap(),
+        Some(EditStatus::Published { .. })
+    ));
 }
 fn moved(x: f32, y: f32) -> impl Fn(&mut Outline) {
 @@ -144,7 +155,7 @@ fn layout_and_dependent_text_survive_reopen_and_a_remote_format_of_the_same_page
         drop(cache);
         let cache = Replica::open(&path).unwrap();
         assert_eq!(cache.pending().unwrap(), pending);
-        assert_eq!(cache.snapshot().unwrap(), local);
+        assert_eq!(pages(&cache.snapshot().unwrap()), pages(&local));
         let mut server = Server::new(&remote_with(&source, space, |page| {
             restyle(page, text_id, 0..8, |format| format.bold = Some(true));
         }));
 @@ -232,7 +243,7 @@ fn an_uncertain_move_confirms_from_the_remote_revision_and_adopts_the_remote_tit
 }
 #[test]
-fn competing_layout_requires_review_against_the_current_remote_page() {
+fn competing_layout_conflicts_until_the_local_page_is_kept() {
     let (source, space, outline, text_id) = fixture();
     let cases: [(Change<Outline>, Change<Outline>); 2] = [
         (Box::new(moved(180.0, 216.0)), Box::new(moved(288.0, 216.0))),
 @@ -255,41 +266,25 @@ fn competing_layout_requires_review_against_the_current_remote_page() {
             remote_change(outline_mut(page, outline));
         }));
         assert_eq!(
-            cache.sync_once(&mut server).unwrap(),
+            cache.sync_once(&mut server).unwrap().edit,
             Some((id, EditStatus::Conflict(ConflictKind::ContentChanged)))
         );
         assert_eq!(server.publications, 0);
-        assert_eq!(cache.snapshot().unwrap(), local);
+        assert_eq!(pages(&cache.snapshot().unwrap()), pages(&local));
         let dependent = save(&cache, text_id, |page| {
             replace_text(page, text_id, 0..0, "Local ")
         })
         .unwrap()
         .unwrap();
-        let queue = cache.pending().unwrap();
         let local = cache.snapshot().unwrap();
-        let observed = cache.remote_snapshot().unwrap();
-        assert!(
-            cache
-                .review_page(id, &source, &observed, &page_of(&observed, space))
-                .is_err()
-        );
-        assert!(
-            cache
-                .review_page(id, &local, &source, &page_of(&source, space))
-                .is_err()
-        );
         drop(cache);
         let cache = Replica::open(&path).unwrap();
         assert_eq!(
             cache.status(id).unwrap(),
             Some(EditStatus::Conflict(ConflictKind::ContentChanged))
         );
-        review(&cache, id, text_id, |page| {
+        cache.resolve(id, notebook::Resolution::Mine).unwrap();
-            local_change(outline_mut(page, outline))
-        })
-        .unwrap();
         assert_eq!(cache.status(id).unwrap(), Some(EditStatus::Pending));
-        assert_eq!(cache.pending().unwrap()[1], queue[1]);
         drop(cache);
         let cache = Replica::open(&path).unwrap();
         for id in [id, dependent] {
 @@ -354,7 +349,7 @@ fn twelve_offline_writers_preserve_all_layout_intents_through_review_and_restart
             let expected = page_of(&cache.snapshot().unwrap(), space);
             drop(cache);
             let cache = Replica::open(&path).unwrap();
-            if cache.sync_once(&mut server).unwrap()
+            if cache.sync_once(&mut server).unwrap().edit
                 == Some((id, EditStatus::Conflict(ConflictKind::ContentChanged)))
             {
                 review(&cache, id, text_id, change).unwrap();
 @@ -411,17 +406,17 @@ fn an_uncertain_layout_attempt_confirms_by_revision_or_by_an_equal_remote_page()
             continue;
         }
         assert_eq!(
-            cache.sync_once(&mut server).unwrap(),
+            cache.sync_once(&mut server).unwrap().edit,
             Some((id, status.clone()))
         );
         server.visible = remote_with(&source, space, |page| {
             resized(216.0, true)(outline_mut(page, outline));
         });
         assert_eq!(
-            cache.sync_once(&mut server).unwrap(),
+            cache.sync_once(&mut server).unwrap().edit,
             Some((id, status.clone()))
         );
-        assert_eq!(cache.snapshot().unwrap(), local);
+        assert_eq!(pages(&cache.snapshot().unwrap()), pages(&local));
         server.visible = remote_with(&source, space, |page| {
             resized(144.0, true)(outline_mut(page, outline));
         });
 @@ -503,7 +498,7 @@ fn native_moves_deletions_and_layout_changes_merge_or_require_review() {
         let id = save(&cache, dependent, save_both).unwrap().unwrap();
         let local = cache.snapshot().unwrap();
         let queue = cache.pending().unwrap();
-        let merged = match cache.sync_once(&mut server).unwrap().unwrap() {
+        let merged = match cache.sync_once(&mut server).unwrap().edit.unwrap() {
             (actual, EditStatus::Published { .. }) => {
                 assert_eq!(actual, id, "{name}");
                 true
 @@ -515,7 +510,7 @@ fn native_moves_deletions_and_layout_changes_merge_or_require_review() {
                     "{name}"
                 );
                 assert_eq!(cache.pending().unwrap(), queue);
-                assert_eq!(cache.snapshot().unwrap(), local);
+                assert_eq!(pages(&cache.snapshot().unwrap()), pages(&local));
                 drop(cache);
                 let cache = Replica::open(&path).unwrap();
                 review(&cache, id, dependent, save_both).unwrap();
 @@ -590,7 +585,7 @@ fn a_new_native_wrap_reservation_requires_review_before_width_replacement() {
     .unwrap();
     let mut server = Server::new(NATIVE);
     assert_eq!(
-        cache.sync_once(&mut server).unwrap(),
+        cache.sync_once(&mut server).unwrap().edit,
         Some((id, EditStatus::Conflict(ConflictKind::ContentChanged)))
     );
     review(&cache, id, text_id, |page| {

crates/notebook/tests/sync_page.rs+166-71

 @@ -1,7 +1,8 @@
 //! Page creation reconciliation: dependent body saves, uncertain publication, anchor review,
 //! and deterministic multi-actor schedules.
-use notebook::{ConflictKind, EditStatus, Operation, Recovery, Replica};
+use notebook::{ConflictKind, EditStatus, Recovery, Replica, Resolution};
+use onestore::op::SectionOp;
 use onestore::{
     ExGuid, PageCreation, RevisionIndex, Store,
     document::{Document, Kind},
 @@ -49,47 +50,38 @@ fn offline_page_creation_rebases_with_dependent_edits_and_duplicate_titles() {
         let path = directory.path().join(format!("{actor}.sqlite"));
         let cache = Replica::create(&path, &source).unwrap();
         let page = PageCreation::new(None, Some("Same 🦋 é"), "Offline author").unwrap();
-        let id = cache.create_page(&source, &page).unwrap().unwrap();
+        let id = section_op(&cache, SectionOp::Create(page.clone()));
-        let mut created = model_ops::page_of(&cache.snapshot().unwrap(), page.space());
+        let mut created = cache.page(page.space()).unwrap();
         let body = body_outline(&mut created, "Body");
-        let save = cache
+        let save = model_ops::save_as(&cache, page.space(), &created, model_ops::AUTHOR)
-            .save(
-                &cache.snapshot().unwrap(),
-                page.space(),
-                &created,
-                model_ops::AUTHOR,
-            )
             .unwrap()
             .unwrap();
-        assert_eq!(
+        let dependent = model_ops::save(&cache, body, |page| {
-            model_ops::save(&cache, body, |page| model_ops::replace_text(
+            model_ops::replace_text(page, body, 4..4, &format!(" {actor}"))
-                page,
+        })
-                body,
+        .unwrap()
-                4..4,
+        .unwrap();
-                &format!(" {actor}")
+        assert!(id < save && save < dependent);
-            ))
-            .unwrap(),
-            Some(save),
-            "a dependent text edit coalesces into the unattempted body save"
-        );
         let original = cache.pending().unwrap();
-        assert_eq!(original.len(), 2);
+        assert_eq!(original.len(), 3);
         assert!(
-            matches!(&original[0].operation, Operation::CreatePage(retained) if retained == &page)
+            matches!(&original[0].edit.ops[..], [onestore::op::Op::Section(SectionOp::Create(retained))] if retained == &page)
         );
         let local = cache.snapshot().unwrap();
         drop(cache);
         let cache = Replica::open(&path).unwrap();
         assert_eq!(cache.pending().unwrap(), original);
-        assert_eq!(cache.snapshot().unwrap(), local);
+        assert_eq!(pages(&cache.snapshot().unwrap()), pages(&local));
-        for edit in original {
-            assert!(matches!(cache.sync_once(&mut server).unwrap(),
-                Some((published, EditStatus::Published { .. })) if published == edit.id));
-        }
         assert!(matches!(
-            cache.status(id).unwrap(),
+            cache.sync_once(&mut server).unwrap().edit,
-            Some(EditStatus::Published { .. })
+            Some((published, EditStatus::Published { .. })) if published == dependent
         ));
+        for edit in original {
+            assert!(matches!(
+                cache.status(edit.id).unwrap(),
+                Some(EditStatus::Published { .. })
+            ));
+        }
         expected.push((page.space(), page.object(), body, format!("Body {actor}")));
     }
     let store = Store::parse(&server.durable).unwrap();
 @@ -103,7 +95,7 @@ fn offline_page_creation_rebases_with_dependent_edits_and_duplicate_titles() {
         let view = &space.revisions[&space.contexts[&ExGuid::default()]];
         assert!(matches!(&view.nodes[text].kind, Kind::RichText { text, .. } if text == expected));
     }
-    assert_eq!(server.publications, 24);
+    assert_eq!(server.publications, 12);
     if let Some(output) = std::env::var_os("ONESTORE_OFFLINE_PAGE_OUTPUT") {
         std::fs::create_dir(&output).unwrap();
         std::fs::write(
 @@ -127,7 +119,7 @@ fn uncertain_page_publication_retains_both_revisions_and_never_replays() {
         let path = directory.path().join("pages.sqlite");
         let cache = Replica::create(&path, &source).unwrap();
         let page = PageCreation::new(None, Some("Created"), "Author").unwrap();
-        let id = cache.create_page(&source, &page).unwrap().unwrap();
+        let id = section_op(&cache, SectionOp::Create(page.clone()));
         let local = cache.snapshot().unwrap();
         let mut server = Server::new(&source);
         server.fault = fault;
 @@ -145,7 +137,11 @@ fn uncertain_page_publication_retains_both_revisions_and_never_replays() {
         drop(cache);
         let db = rusqlite::Connection::open(&path).unwrap();
         let encoded: String = db
-            .query_row("SELECT revisions FROM attempt", [], |row| row.get(0))
+            .query_row(
+                "SELECT revisions FROM batches WHERE attempted=1",
+                [],
+                |row| row.get(0),
+            )
             .unwrap();
         let revisions: BTreeMap<ExGuid, ExGuid> = serde_json::from_str(&encoded).unwrap();
         assert_eq!(revisions.len(), 2);
 @@ -153,7 +149,7 @@ fn uncertain_page_publication_retains_both_revisions_and_never_replays() {
         drop(db);
         let cache = Replica::open(&path).unwrap();
         let observed = server.visible.clone();
-        let result = cache.sync_once(&mut server).unwrap().unwrap();
+        let result = cache.sync_once(&mut server).unwrap().edit.unwrap();
         let visible = matches!(fault, Fault::UnknownAfter | Fault::PanicAfter);
         assert_eq!(server.publications, 1);
         assert_eq!(server.confirmations, usize::from(visible));
 @@ -164,7 +160,7 @@ fn uncertain_page_publication_retains_both_revisions_and_never_replays() {
             assert!(observed[252..] == server.durable[252..]);
         } else {
             assert_eq!(result, (id, attempted.clone()));
-            assert_eq!(cache.snapshot().unwrap(), local);
+            assert_eq!(pages(&cache.snapshot().unwrap()), pages(&local));
         }
     }
 }
 @@ -176,7 +172,7 @@ fn surviving_page_revision_alone_does_not_confirm_section_publication() {
     let path = directory.path().join("pages.sqlite");
     let cache = Replica::create(&path, &source).unwrap();
     let page = PageCreation::new(None, None, "Author").unwrap();
-    let id = cache.create_page(&source, &page).unwrap().unwrap();
+    let id = section_op(&cache, SectionOp::Create(page.clone()));
     let mut server = Server::new(&source);
     server.fault = Fault::UnknownAfter;
     assert!(cache.sync_once(&mut server).is_err());
 @@ -184,7 +180,11 @@ fn surviving_page_revision_alone_does_not_confirm_section_publication() {
     drop(cache);
     let db = rusqlite::Connection::open(&path).unwrap();
     let encoded: String = db
-        .query_row("SELECT revisions FROM attempt", [], |row| row.get(0))
+        .query_row(
+            "SELECT revisions FROM batches WHERE attempted=1",
+            [],
+            |row| row.get(0),
+        )
         .unwrap();
     let revisions: BTreeMap<ExGuid, ExGuid> = serde_json::from_str(&encoded).unwrap();
     drop(db);
 @@ -222,21 +222,21 @@ fn surviving_page_revision_alone_does_not_confirm_section_publication() {
     );
     let cache = Replica::open(&path).unwrap();
     assert_eq!(
-        cache.sync_once(&mut server).unwrap(),
+        cache.sync_once(&mut server).unwrap().edit,
         Some((id, attempted.clone()))
     );
     assert_eq!(server.confirmations, 0);
     assert_eq!(server.publications, 1);
     server.visible = complete;
     assert!(matches!(
-        cache.sync_once(&mut server).unwrap(),
+        cache.sync_once(&mut server).unwrap().edit,
         Some((_, EditStatus::Published { .. }))
     ));
     assert_eq!(server.publications, 1);
 }
 #[test]
-fn changed_page_anchor_requires_review_without_regenerating_dependent_identities() {
+fn changed_page_anchor_conflicts_until_kept_without_regenerating_dependent_identities() {
     let source = include_bytes!("../../../corpus/page-lifecycle/03-renamed/notebook/Lifecycle.one");
     let remote = include_bytes!("../../../corpus/page-lifecycle/04-nested/notebook/Lifecycle.one");
     let store = Store::parse(source).unwrap();
 @@ -246,48 +246,36 @@ fn changed_page_anchor_requires_review_without_regenerating_dependent_identities
     let path = directory.path().join("pages.sqlite");
     let cache = Replica::create(&path, source).unwrap();
     let page = PageCreation::new(Some(pages[4].0), Some("Created"), "Author").unwrap();
-    let id = cache.create_page(source, &page).unwrap().unwrap();
+    let id = section_op(&cache, SectionOp::Create(page.clone()));
-    let mut created = model_ops::page_of(&cache.snapshot().unwrap(), page.space());
+    let mut created = cache.page(page.space()).unwrap();
     let body = body_outline(&mut created, "Retained body");
-    cache
+    let save = model_ops::save_as(&cache, page.space(), &created, "Author")
-        .save(&cache.snapshot().unwrap(), page.space(), &created, "Author")
         .unwrap()
         .unwrap();
     let local = cache.snapshot().unwrap();
     let pending = cache.pending().unwrap();
     let mut server = Server::new(remote);
     assert_eq!(
-        cache.sync_once(&mut server).unwrap(),
+        cache.sync_once(&mut server).unwrap().edit,
-        Some((id, EditStatus::Conflict(ConflictKind::StructureChanged)))
+        Some((save, EditStatus::Conflict(ConflictKind::StructureChanged)))
     );
-    assert!(
+    cache.resolve(id, Resolution::Mine).unwrap();
-        cache
-            .rebase_page_creation_conflict(id, source, remote, None)
-            .is_err()
-    );
-    assert!(
-        cache
-            .rebase_page_creation_conflict(id, &local, source, None)
-            .is_err()
-    );
-    cache
-        .rebase_page_creation_conflict(id, &local, remote, None)
-        .unwrap();
-    assert_eq!(cache.snapshot().unwrap(), local);
     assert_eq!(cache.pending().unwrap()[1], pending[1]);
-    let Operation::CreatePage(reviewed) = &cache.pending().unwrap()[0].operation else {
+    assert!(matches!(
-        panic!()
+        &cache.pending().unwrap()[0].edit.ops[..],
-    };
+        [onestore::op::Op::Section(SectionOp::Create(reviewed))] if *reviewed == page.reposition(None).unwrap()
-    assert_eq!(*reviewed, page.reposition(None).unwrap());
+    ));
+    assert_eq!(
+        model_ops::page_of(&cache.snapshot().unwrap(), page.space()),
+        model_ops::page_of(&local, page.space())
+    );
     drop(cache);
     let cache = Replica::open(&path).unwrap();
-    for _ in 0..2 {
+    assert!(matches!(
-        assert!(matches!(
+        cache.sync_once(&mut server).unwrap().edit,
-            cache.sync_once(&mut server).unwrap(),
+        Some((_, EditStatus::Published { .. }))
-            Some((_, EditStatus::Published { .. }))
+    ));
-        ));
+    assert_eq!(server.publications, 1);
-    }
-    assert_eq!(server.publications, 2);
     let store = Store::parse(&server.durable).unwrap();
     let index = RevisionIndex::parse(&store).unwrap();
     let document = Document::parse(&index).unwrap();
 @@ -296,3 +284,110 @@ fn changed_page_anchor_requires_review_without_regenerating_dependent_identities
     assert!(matches!(&view.nodes[&body].kind,
         Kind::RichText { text, .. } if text == "Retained body"));
 }
+#[test]
+fn keeping_mine_puts_back_a_page_the_remote_removed_where_it_stood() {
+    let source = include_bytes!("../../../corpus/page-lifecycle/04-nested/notebook/Lifecycle.one");
+    let order = |image: &[u8]| -> Vec<(ExGuid, String, u32)> {
+        let arena = onestore::Arena::default();
+        onestore::Section::open(&arena, image.to_vec())
+            .unwrap()
+            .pages()
+            .unwrap()
+    };
+    let pages = order(source);
+    // A subpage without subpages of its own and with a page after it, so it has a position
+    // and a level to return to.
+    let at = (0..pages.len() - 1)
+        .find(|at| {
+            pages[*at].2 > 1
+                && pages[*at + 1].2 <= pages[*at].2
+                && model_ops::page_of(source, pages[*at].0)
+                    .objects
+                    .iter()
+                    .any(|object| matches!(object, onestore::page::PageObject::Outline(_)))
+        })
+        .expect("a subpage with body text");
+    let (space, _, level) = pages[at].clone();
+    let text = model_ops::page_of(source, space)
+        .objects
+        .iter()
+        .find_map(|object| match object {
+            onestore::page::PageObject::Outline(outline) => {
+                outline.paragraphs[0].text().map(|t| t.id)
+            }
+            _ => None,
+        })
+        .unwrap();
+    for keep in [Resolution::Mine, Resolution::Theirs] {
+        let directory = tempfile::tempdir().unwrap();
+        let cache = Replica::create(directory.path().join("pages.sqlite"), source).unwrap();
+        let id = model_ops::save(&cache, text, |page| {
+            model_ops::replace_text(page, text, 0..0, "Kept ")
+        })
+        .unwrap()
+        .unwrap();
+        let local = cache.page(space).unwrap();
+        let removed = onestore::PreparedEdit::delete_pages_permanently(source, &[space])
+            .unwrap()
+            .as_bytes()
+            .to_vec();
+        let mut server = Server::new(&removed);
+        assert_eq!(
+            cache.sync_once(&mut server).unwrap().edit,
+            Some((id, EditStatus::Conflict(ConflictKind::TargetUnavailable)))
+        );
+        assert_eq!(
+            server.publications, 0,
+            "a removed page is not edited in place"
+        );
+        cache.resolve(id, keep).unwrap();
+        assert!(matches!(
+            cache.sync_once(&mut server).unwrap().edit,
+            Some((_, EditStatus::Published { .. }))
+        ));
+        let published = order(&server.durable);
+        assert!(published.iter().all(|(page, ..)| *page != space));
+        match keep {
+            Resolution::Mine => {
+                assert_eq!(published.len(), pages.len());
+                let (restored, title, restored_level) = published[at].clone();
+                assert_eq!(
+                    (title.as_str(), restored_level),
+                    (pages[at].1.as_str(), level)
+                );
+                let page = model_ops::page_of(&server.durable, restored);
+                let texts = |page: &onestore::page::Page| -> Vec<String> {
+                    page.objects
+                        .iter()
+                        .filter_map(|object| match object {
+                            onestore::page::PageObject::Outline(outline) => Some(outline),
+                            _ => None,
+                        })
+                        .flat_map(|outline| &outline.paragraphs)
+                        .filter_map(|p| p.text().map(|t| t.text.text().to_owned()))
+                        .collect()
+                };
+                assert_eq!(texts(&page), texts(&local));
+                assert!(texts(&page)[0].starts_with("Kept "));
+                let others: Vec<_> = published
+                    .iter()
+                    .map(|(page, ..)| *page)
+                    .filter(|page| *page != restored)
+                    .collect();
+                let before: Vec<_> = pages
+                    .iter()
+                    .map(|(page, ..)| *page)
+                    .filter(|page| *page != space)
+                    .collect();
+                assert_eq!(others, before);
+            }
+            Resolution::Theirs => assert_eq!(published, order(&removed)),
+        }
+        assert_eq!(pages_of(&cache), published);
+    }
+}
+fn pages_of(cache: &Replica) -> Vec<(ExGuid, String, u32)> {
+    cache.pages().unwrap()
+}

crates/notebook/tests/sync_pages.rs+102-124

 @@ -1,7 +1,8 @@
 //! Page batch reconciliation: atomic batches with dependent body saves, competing moves and
 //! indentation, uncertain batches, and native page movement fixtures.
-use notebook::{ConflictKind, EditStatus, Operation, Recovery, Replica};
+use notebook::{ConflictKind, EditStatus, Recovery, Replica, Resolution};
+use onestore::op::{Op, SectionOp};
 use onestore::{
     ExGuid, PageEdit, PagePosition, PreparedEdit, RevisionIndex, Store,
     document::{Document, Format, Kind, Layout},
 @@ -117,8 +118,7 @@ fn atomic_page_batches_survive_reopen_with_dependent_text() {
         .iter()
         .map(|(sid, level)| PageEdit::move_to(*sid, None, *level).unwrap())
         .collect();
-    let id = cache.pages(SOURCE, &edits).unwrap().unwrap();
+    let id = section_op(&cache, SectionOp::Pages(edits.to_vec()));
-    assert!(cache.pages(SOURCE, &edits).is_err());
     let mut expected_text = texts(SOURCE);
     let (&(sid, oid), original) = expected_text
         .iter()
 @@ -132,17 +132,22 @@ fn atomic_page_batches_survive_reopen_with_dependent_text() {
     .unwrap()
     .unwrap();
     let queue = cache.pending().unwrap();
-    assert!(matches!(&queue[0].operation, Operation::Pages(batch) if batch.edits == edits));
+    assert!(
+        matches!(&queue[0].edit.ops[..], [Op::Section(SectionOp::Pages(batch))] if *batch == edits)
+    );
     let local = cache.snapshot().unwrap();
     drop(cache);
     let cache = Replica::open(&path).unwrap();
     assert_eq!(cache.pending().unwrap(), queue);
-    assert_eq!(cache.snapshot().unwrap(), local);
+    assert_eq!(
+        server::pages(&cache.snapshot().unwrap()),
+        server::pages(&local)
+    );
     let mut server = Server::new(SOURCE);
-    for edit in queue {
+    assert!(matches!(
-        assert!(matches!(cache.sync_once(&mut server).unwrap(),
+        cache.sync_once(&mut server).unwrap().edit,
-            Some((published, EditStatus::Published { .. })) if published == edit.id));
+        Some((_, EditStatus::Published { .. }))
-    }
+    ));
     let expected = [
         before[..3].to_vec(),
         before[6..].to_vec(),
 @@ -155,7 +160,7 @@ fn atomic_page_batches_survive_reopen_with_dependent_text() {
         cache.status(id).unwrap(),
         Some(EditStatus::Published { .. })
     ));
-    assert_eq!(server.publications, 2);
+    assert_eq!(server.publications, 1);
 }
 #[test]
 @@ -164,10 +169,10 @@ fn indentation_only_edits_preserve_remote_page_movement() {
     let cache = Replica::create(directory.path().join("pages.sqlite"), SOURCE).unwrap();
     let before = order(SOURCE);
     let sid = before[4].0;
-    let id = cache
+    let id = section_op(
-        .pages(SOURCE, &[PageEdit::set_level(sid, 3).unwrap()])
+        &cache,
-        .unwrap()
+        SectionOp::Pages([PageEdit::set_level(sid, 3).unwrap()].to_vec()),
-        .unwrap();
+    );
     let mut server = Server::new(SOURCE);
     PreparedEdit::pages(
         SOURCE,
 @@ -178,22 +183,19 @@ fn indentation_only_edits_preserve_remote_page_movement() {
     .unwrap();
     let mut expected = order(&server.durable);
     expected.iter_mut().find(|p| p.0 == sid).unwrap().1 = 3;
-    assert!(matches!(cache.sync_once(&mut server).unwrap(),
+    assert!(matches!(cache.sync_once(&mut server).unwrap().edit,
         Some((published, EditStatus::Published { .. })) if published == id));
     assert_eq!(order(&server.durable), expected);
 }
 #[test]
-fn competing_page_moves_require_current_review_and_retain_intent_identities() {
+fn competing_page_moves_conflict_until_mine_is_kept_with_its_identities() {
     let directory = tempfile::tempdir().unwrap();
     let cache = Replica::create(directory.path().join("pages.sqlite"), SOURCE).unwrap();
     let pages = order(SOURCE);
     let sid = pages[6].0;
     let original = PageEdit::move_to(sid, None, 1).unwrap();
-    let id = cache
+    let id = section_op(&cache, SectionOp::Pages(vec![original.clone()]));
-        .pages(SOURCE, std::slice::from_ref(&original))
-        .unwrap()
-        .unwrap();
     let mut server = Server::new(SOURCE);
     PreparedEdit::pages(
         SOURCE,
 @@ -205,37 +207,20 @@ fn competing_page_moves_require_current_review_and_retain_intent_identities() {
     let remote = server.visible.clone();
     let local = cache.snapshot().unwrap();
     assert_eq!(
-        cache.sync_once(&mut server).unwrap(),
+        cache.sync_once(&mut server).unwrap().edit,
         Some((id, EditStatus::Conflict(ConflictKind::StructureChanged)))
     );
     assert_eq!(server.publications, 0);
-    assert_eq!(cache.snapshot().unwrap(), local);
+    assert_eq!(
-    let revised = original
+        server::pages(&cache.snapshot().unwrap()),
-        .reposition(PagePosition::Before(Some(pages[2].0)), 1)
+        server::pages(&local)
-        .unwrap();
-    let fresh = PageEdit::move_to(sid, Some(pages[2].0), 1).unwrap();
-    assert!(
-        cache
-            .rebase_pages_conflict(id, &local, &remote, &[fresh])
-            .is_err()
-    );
-    assert!(
-        cache
-            .rebase_pages_conflict(id, SOURCE, &remote, std::slice::from_ref(&revised))
-            .is_err()
-    );
-    assert!(
-        cache
-            .rebase_pages_conflict(id, &local, SOURCE, std::slice::from_ref(&revised))
-            .is_err()
     );
-    cache
+    // Keeping mine moves the page last again, from where the remote put it.
-        .rebase_pages_conflict(id, &local, &remote, std::slice::from_ref(&revised))
+    cache.resolve(id, Resolution::Mine).unwrap();
-        .unwrap();
+    assert!(matches!(&cache.pending().unwrap()[0].edit.ops[..],
-    assert!(matches!(&cache.pending().unwrap()[0].operation,
+        [Op::Section(SectionOp::Pages(batch))] if *batch == [original.clone()]));
-        Operation::Pages(batch) if batch.edits == [revised.clone()]));
+    let expected = PreparedEdit::pages(&remote, &[original]).unwrap();
-    let expected = PreparedEdit::pages(&remote, &[revised]).unwrap();
+    assert!(matches!(cache.sync_once(&mut server).unwrap().edit,
-    assert!(matches!(cache.sync_once(&mut server).unwrap(),
         Some((published, EditStatus::Published { .. })) if published == id));
     assert_eq!(order(&server.durable), order(expected.as_bytes()));
 }
 @@ -245,16 +230,13 @@ fn one_competing_level_prevents_publication_of_the_whole_batch() {
     let directory = tempfile::tempdir().unwrap();
     let cache = Replica::create(directory.path().join("pages.sqlite"), SOURCE).unwrap();
     let pages = order(SOURCE);
-    let id = cache
+    let id = section_op(
-        .pages(
+        &cache,
-            SOURCE,
+        SectionOp::Pages(vec![
-            &[
+            PageEdit::set_level(pages[4].0, 3).unwrap(),
-                PageEdit::set_level(pages[4].0, 3).unwrap(),
+            PageEdit::set_level(pages[5].0, 2).unwrap(),
-                PageEdit::set_level(pages[5].0, 2).unwrap(),
+        ]),
-            ],
+    );
-        )
-        .unwrap()
-        .unwrap();
     let local = cache.snapshot().unwrap();
     let mut server = Server::new(SOURCE);
     PreparedEdit::pages(SOURCE, &[PageEdit::set_level(pages[5].0, 1).unwrap()])
 @@ -263,12 +245,15 @@ fn one_competing_level_prevents_publication_of_the_whole_batch() {
         .unwrap();
     let remote = server.durable.clone();
     assert_eq!(
-        cache.sync_once(&mut server).unwrap(),
+        cache.sync_once(&mut server).unwrap().edit,
         Some((id, EditStatus::Conflict(ConflictKind::StructureChanged)))
     );
     assert_eq!(server.publications, 0);
     assert_eq!(server.durable, remote);
-    assert_eq!(cache.snapshot().unwrap(), local);
+    assert_eq!(
+        server::pages(&cache.snapshot().unwrap()),
+        server::pages(&local)
+    );
 }
 #[test]
 @@ -287,7 +272,7 @@ fn uncertain_page_batches_survive_recovery_and_do_not_replay() {
             PageEdit::set_level(pages[4].0, 3).unwrap(),
             PageEdit::set_level(pages[5].0, 2).unwrap(),
         ];
-        let id = cache.pages(SOURCE, &edits).unwrap().unwrap();
+        let id = section_op(&cache, SectionOp::Pages(edits.to_vec()));
         let local = cache.snapshot().unwrap();
         let queue = cache.pending().unwrap();
         let mut server = Server::new(SOURCE);
 @@ -304,13 +289,12 @@ fn uncertain_page_batches_survive_recovery_and_do_not_replay() {
         let recovery = Recovery::open(&archive).unwrap();
         assert_eq!(recovery.pending().unwrap(), queue);
         assert_eq!(recovery.status(id).unwrap(), Some(attempted.clone()));
-        assert_eq!(recovery.snapshot().unwrap(), local);
+        assert_eq!(
-        assert!(
+            server::pages(&recovery.snapshot().unwrap()),
-            cache
+            server::pages(&local)
-                .rebase_pages_conflict(id, &local, SOURCE, &edits)
-                .is_err()
         );
-        let result = cache.sync_once(&mut server).unwrap().unwrap();
+        assert!(cache.resolve(id, Resolution::Mine).is_err());
+        let result = cache.sync_once(&mut server).unwrap().edit.unwrap();
         assert_eq!(server.publications, 1);
         if matches!(fault, Fault::UnknownAfter | Fault::PanicAfter) {
             assert!(matches!(result.1, EditStatus::Published { .. }));
 @@ -341,10 +325,10 @@ fn an_unchanged_section_revision_cannot_confirm_a_changed_page() {
     let directory = tempfile::tempdir().unwrap();
     let path = directory.path().join("pages.sqlite");
     let cache = Replica::create(&path, &source).unwrap();
-    let id = cache
+    let id = section_op(
-        .pages(&source, &[PageEdit::set_level(sid, 3).unwrap()])
+        &cache,
-        .unwrap()
+        SectionOp::Pages([PageEdit::set_level(sid, 3).unwrap()].to_vec()),
-        .unwrap();
+    );
     let mut server = Server::new(&source);
     server.fault = Fault::UnknownAfter;
     assert!(cache.sync_once(&mut server).is_err());
 @@ -352,7 +336,9 @@ fn an_unchanged_section_revision_cannot_confirm_a_changed_page() {
     drop(cache);
     let db = rusqlite::Connection::open(&path).unwrap();
     let encoded: String = db
-        .query_row("SELECT revisions FROM attempt", [], |r| r.get(0))
+        .query_row("SELECT revisions FROM batches WHERE attempted=1", [], |r| {
+            r.get(0)
+        })
         .unwrap();
     let proofs: BTreeMap<ExGuid, ExGuid> = serde_json::from_str(&encoded).unwrap();
     assert_eq!(proofs.len(), 2);
 @@ -368,13 +354,13 @@ fn an_unchanged_section_revision_cannot_confirm_a_changed_page() {
     let complete = server.visible.clone();
     server.visible = source;
     assert_eq!(
-        cache.sync_once(&mut server).unwrap(),
+        cache.sync_once(&mut server).unwrap().edit,
         Some((id, attempted.clone()))
     );
     assert_eq!(server.confirmations, 0);
     server.visible = complete;
     assert!(matches!(
-        cache.sync_once(&mut server).unwrap(),
+        cache.sync_once(&mut server).unwrap().edit,
         Some((_, EditStatus::Published { .. }))
     ));
     assert_eq!(server.publications, 1);
 @@ -386,16 +372,13 @@ fn an_explicit_anchor_is_retained_even_when_originally_in_place() {
     let directory = tempfile::tempdir().unwrap();
     let cache = Replica::create(directory.path().join("pages.sqlite"), SOURCE).unwrap();
     let pages = order(SOURCE);
-    let id = cache
+    let id = section_op(
-        .pages(
+        &cache,
-            SOURCE,
+        SectionOp::Pages(vec![
-            &[
+            PageEdit::move_to(pages[6].0, Some(pages[7].0), 1).unwrap(),
-                PageEdit::move_to(pages[6].0, Some(pages[7].0), 1).unwrap(),
+            PageEdit::set_level(pages[4].0, 3).unwrap(),
-                PageEdit::set_level(pages[4].0, 3).unwrap(),
+        ]),
-            ],
+    );
-        )
-        .unwrap()
-        .unwrap();
     let mut server = Server::new(SOURCE);
     PreparedEdit::pages(
         SOURCE,
 @@ -405,7 +388,7 @@ fn an_explicit_anchor_is_retained_even_when_originally_in_place() {
     .commit(&mut server)
     .unwrap();
     assert_eq!(
-        cache.sync_once(&mut server).unwrap(),
+        cache.sync_once(&mut server).unwrap().edit,
         Some((id, EditStatus::Conflict(ConflictKind::StructureChanged)))
     );
     assert_eq!(server.publications, 0);
 @@ -416,10 +399,10 @@ fn convergent_page_indentation_requires_confirmation_without_republishing() {
     let directory = tempfile::tempdir().unwrap();
     let cache = Replica::create(directory.path().join("pages.sqlite"), SOURCE).unwrap();
     let sid = order(SOURCE)[4].0;
-    let id = cache
+    let id = section_op(
-        .pages(SOURCE, &[PageEdit::set_level(sid, 1).unwrap()])
+        &cache,
-        .unwrap()
+        SectionOp::Pages([PageEdit::set_level(sid, 1).unwrap()].to_vec()),
-        .unwrap();
+    );
     let mut server = Server::new(SOURCE);
     PreparedEdit::pages(SOURCE, &[PageEdit::set_level(sid, 1).unwrap()])
         .unwrap()
 @@ -429,7 +412,7 @@ fn convergent_page_indentation_requires_confirmation_without_republishing() {
     assert!(cache.sync_once(&mut server).is_err());
     assert_eq!(cache.status(id).unwrap(), Some(EditStatus::Pending));
     assert_eq!(server.publications, 0);
-    assert!(matches!(cache.sync_once(&mut server).unwrap(),
+    assert!(matches!(cache.sync_once(&mut server).unwrap().edit,
         Some((published, EditStatus::Published { .. })) if published == id));
     assert_eq!(server.publications, 0);
     assert_eq!(server.confirmations, 2);
 @@ -464,7 +447,7 @@ fn native_page_changes_reconcile_with_atomic_offline_batches_and_review() {
                     .map(|(sid, level)| PageEdit::move_to(*sid, None, *level).unwrap())
                     .collect()
             };
-            let id = cache.pages(SOURCE, &edits).unwrap().unwrap();
+            let id = section_op(&cache, SectionOp::Pages(edits.to_vec()));
             let text_id = model_ops::save(&cache, text_object, |page| {
                 model_ops::replace_text(page, text_object, 0..0, "Offline ")
             })
 @@ -484,8 +467,11 @@ fn native_page_changes_reconcile_with_atomic_offline_batches_and_review() {
                     "02-promoted-parent" | "03-selected-group-move" | "06-promoted-level-two"
                 )
             };
-            let first = cache.sync_once(&mut server).unwrap().unwrap();
+            let first = if expected_conflict {
-            assert_eq!(first.0, id);
+                cache.sync_once(&mut server).unwrap().edit.unwrap()
+            } else {
+                (text_id, EditStatus::Pending)
+            };
             let mut reviewed = edits.clone();
             if expected_conflict {
                 assert_eq!(
 @@ -494,26 +480,25 @@ fn native_page_changes_reconcile_with_atomic_offline_batches_and_review() {
                     "{mode}:{phase}"
                 );
                 assert_eq!(server.publications, 0);
-                assert_eq!(cache.snapshot().unwrap(), local);
+                assert_eq!(
-                if mode == "indent" && phase == "08-collapsed-group-move" {
+                    server::pages(&cache.snapshot().unwrap()),
-                    reviewed[0] = reviewed[0].reposition(PagePosition::Keep, 1).unwrap();
+                    server::pages(&local)
-                }
-                cache
-                    .rebase_pages_conflict(id, &local, &native, &reviewed)
-                    .unwrap();
-                assert!(matches!(cache.sync_once(&mut server).unwrap(),
-                    Some((published, EditStatus::Published { .. })) if published == id));
-            } else {
-                assert!(
-                    matches!(first.1, EditStatus::Published { .. }),
-                    "{mode}:{phase}"
                 );
+                // Keeping mine drops the moves that no longer apply.
+                cache.resolve(id, Resolution::Mine).unwrap();
+                reviewed = match &cache.pending().unwrap()[0].edit.ops[..] {
+                    [Op::Section(SectionOp::Pages(kept))] => kept.clone(),
+                    [] => Vec::new(),
+                    other => panic!("{other:?}"),
+                };
             }
+            assert!(
+                matches!(cache.sync_once(&mut server).unwrap().edit, Some((published, EditStatus::Published { .. })) if published == text_id),
+                "{mode}:{phase}"
+            );
             counts[usize::from(expected_conflict)] += 1;
             drop(cache);
             let cache = Replica::open(&path).unwrap();
-            assert!(matches!(cache.sync_once(&mut server).unwrap(),
-                Some((published, EditStatus::Published { .. })) if published == text_id));
             assert!(cache.pending().unwrap().is_empty());
             let mut expected = order(&native);
             for edit in &reviewed {
 @@ -529,10 +514,7 @@ fn native_page_changes_reconcile_with_atomic_offline_batches_and_review() {
             }
             assert_eq!(order(&server.durable), expected, "{mode}:{phase}");
             assert_eq!(texts(&server.durable), expected_text, "{mode}:{phase}");
-            assert_eq!(
+            assert_eq!(server.publications, 1);
-                server.publications,
-                1 + usize::from(expected != order(&native))
-            );
             if let Some(output) = std::env::var_os("ONESTORE_OFFLINE_PAGE_EDIT_OUTPUT") {
                 let output = std::path::Path::new(&output);
                 assert!(output.is_absolute());
 @@ -580,13 +562,12 @@ fn twelve_disjoint_page_batches_merge_with_dependent_bodies_without_review() {
             PageEdit::move_to(group[1].space(), Some(group[0].space()), 1).unwrap(),
             PageEdit::set_level(group[2].space(), 2).unwrap(),
         ];
-        cache.pages(&source, &edits).unwrap().unwrap();
+        section_op(&cache, SectionOp::Pages(edits.to_vec()));
         let body = format!("Actor {actor} 🦀 e\u{301}");
         let local = cache.snapshot().unwrap();
         let mut model = model_ops::page_of(&local, group[1].space());
         let text = body_outline(&mut model, &body);
-        cache
+        model_ops::save_as(&cache, group[1].space(), &model, "Author")
-            .save(&local, group[1].space(), &model, "Author")
             .unwrap()
             .unwrap();
         expected.extend([
 @@ -601,18 +582,18 @@ fn twelve_disjoint_page_batches_merge_with_dependent_bodies_without_review() {
     for (path, queue) in &queues {
         let cache = Replica::open(path).unwrap();
         assert_eq!(cache.pending().unwrap(), *queue);
-        for edit in queue {
+        assert!(matches!(
-            assert!(matches!(cache.sync_once(&mut server).unwrap(),
+            cache.sync_once(&mut server).unwrap().edit,
-                Some((published, EditStatus::Published { .. })) if published == edit.id));
+            Some((_, EditStatus::Published { .. }))
-        }
+        ));
         assert!(cache.pending().unwrap().is_empty());
     }
-    assert_eq!(server.publications, 24);
+    assert_eq!(server.publications, 12);
     assert_eq!(order(&server.durable), expected);
     assert_eq!(texts(&server.durable), expected_text);
     for (path, queue) in &queues {
         let cache = Replica::open(path).unwrap();
-        assert_eq!(cache.sync_once(&mut server).unwrap(), None);
+        assert_eq!(cache.sync_once(&mut server).unwrap().edit, None);
         assert_eq!(order(&cache.snapshot().unwrap()), expected);
         for edit in queue {
             assert!(matches!(
 @@ -631,10 +612,7 @@ fn twelve_disjoint_page_batches_merge_with_dependent_bodies_without_review() {
             .map(|(_, queue)| {
                 queue
                     .iter()
-                    .map(|edit| {
+                    .map(|edit| serde_json::json!({"id": edit.id, "edit": edit.edit}))
-                        serde_json::json!({"id": edit.id, "space": edit.space,
-                "operation": edit.operation})
-                    })
                     .collect::<Vec<_>>()
             })
             .collect();

crates/notebook/tests/sync_paragraph.rs+59-54

 @@ -11,7 +11,7 @@ use std::path::Path;
 #[path = "support/server.rs"]
 mod server;
-use server::{Fault, Server};
+use server::{Fault, Server, pages};
 #[path = "support/model_ops.rs"]
 mod model_ops;
 use model_ops::{AUTHOR, outlines_mut, page_of, replace_text};
 @@ -178,16 +178,13 @@ fn save_page(
     let source = cache.snapshot()?;
     let (space, mut page) = holder(&source, text);
     edit(&mut page);
-    cache.save(&source, space, &page, AUTHOR)
+    model_ops::save_as(cache, space, &page, AUTHOR)
 }
-/// Reviews a conflicting save by applying `edit` to the page the remote now holds.
+/// Resolves a conflict by taking the remote page, then saves `edit` of it.
 fn review_page(cache: &Replica, id: u64, text: ExGuid, edit: impl FnOnce(&mut Page)) {
-    let local = cache.snapshot().unwrap();
+    cache.resolve(id, notebook::Resolution::Theirs).unwrap();
-    let remote = cache.remote_snapshot().unwrap();
+    save_page(cache, text, edit).unwrap().unwrap();
-    let (_, mut page) = holder(&remote, text);
-    edit(&mut page);
-    cache.review_page(id, &local, &remote, &page).unwrap();
 }
 /// The styled text of an object anywhere on a page.
 @@ -246,18 +243,20 @@ fn reconcile_controls() -> (Vec<u8>, Vec<serde_json::Value>) {
         let mut cache = Replica::create(&path, BEFORE).unwrap();
         let mut after = original.clone();
         apply(&mut after);
-        let id = cache.save(BEFORE, space, &after, AUTHOR).unwrap().unwrap();
+        let id = model_ops::save_as(&cache, space, &after, AUTHOR)
+            .unwrap()
+            .unwrap();
         let pending = cache.pending().unwrap();
         drop(cache);
         cache = Replica::open(&path).unwrap();
         assert_eq!(cache.pending().unwrap(), pending);
-        let (actual, status) = cache.sync_once(&mut server).unwrap().unwrap();
+        let (actual, status) = cache.sync_once(&mut server).unwrap().edit.unwrap();
         assert_eq!(actual, id);
         let reviewed = matches!(status, EditStatus::Conflict(_));
         let receipt = if reviewed {
             assert_eq!(cache.pending().unwrap(), pending);
             review_page(&cache, id, left, apply);
-            cache.sync_once(&mut server).unwrap().unwrap().1
+            cache.sync_once(&mut server).unwrap().edit.unwrap().1
         } else {
             automatic += 1;
             status
 @@ -293,7 +292,7 @@ fn reconcile_controls() -> (Vec<u8>, Vec<serde_json::Value>) {
         let dependent = save_page(&cache, target, |page| dependent_edit(page, target))
             .unwrap()
             .unwrap();
-        let (actual, status) = cache.sync_once(&mut server).unwrap().unwrap();
+        let (actual, status) = cache.sync_once(&mut server).unwrap().edit.unwrap();
         assert_eq!(actual, dependent);
         let EditStatus::Published {
             revision: dependent_revision,
 @@ -309,7 +308,7 @@ fn reconcile_controls() -> (Vec<u8>, Vec<serde_json::Value>) {
             "receipt": revision, "dependent_receipt": dependent_revision}),
         );
     }
-    assert_eq!((recorded.len(), automatic), (16, 6));
+    assert_eq!((recorded.len(), automatic), (16, 8));
     assert_eq!(server.publications, 32);
     (server.durable, recorded)
 }
 @@ -321,19 +320,20 @@ fn native_keyboard_edits_merge_with_offline_splits_and_joins_or_survive_review()
         ("Split remote prefix", "automatic", vec!["Xab", "🦀Cd"]),
         ("Split remote boundary", "automatic", vec!["abX", "🦀Cd"]),
         ("Split remote child", "reviewed", vec!["ab", "🦀Cd"]),
-        ("Split remote list", "automatic", vec!["ab", "🦀Cd"]),
+        // A split names copies of its paragraph's list nodes; the remote's new list has none.
+        ("Split remote list", "reviewed", vec!["ab", "🦀Cd"]),
         ("Split remote tag", "automatic", vec!["ab", "🦀Cd"]),
         ("Split remote format", "reviewed", vec!["ab", "🦀Cd"]),
         ("Split remote sibling", "automatic", vec!["ab", "🦀Cd"]),
         ("Join remote prefix", "reviewed", vec!["Xab🦀CdRightY"]),
-        ("Join left boundary", "reviewed", vec!["ab🦀CdXRight"]),
+        ("Join left boundary", "automatic", vec!["ab🦀CdXRight"]),
         ("Join right boundary", "reviewed", vec!["ab🦀CdXRight"]),
-        ("Join remote child", "reviewed", vec!["ab🦀CdRight"]),
+        ("Join remote child", "automatic", vec!["ab🦀CdRight"]),
         ("Join remote list", "reviewed", vec!["ab🦀CdRight"]),
         ("Join remote tag", "reviewed", vec!["ab🦀CdRight"]),
         ("Join remote format", "reviewed", vec!["ab🦀CdRight"]),
         ("Join remote sibling", "automatic", vec!["ab🦀CdRight"]),
-        ("Join empty adoption", "reviewed", vec!["XIight"]),
+        ("Join empty adoption", "automatic", vec!["XIight"]),
     ];
     for (case, (name, outcome, prefix)) in cases.iter().zip(expected) {
         assert_eq!(case["case"], name);
 @@ -363,17 +363,19 @@ fn a_native_text_object_replacement_conflicts_with_every_offline_split_and_join(
         } else {
             join_paragraphs(&mut after, left, body(&original)[1].text().unwrap().id);
         }
-        let id = cache.save(BEFORE, space, &after, AUTHOR).unwrap().unwrap();
+        let id = model_ops::save_as(&cache, space, &after, AUTHOR)
+            .unwrap()
+            .unwrap();
         let local = cache.snapshot().unwrap();
         let pending = cache.pending().unwrap();
         assert_eq!(
-            cache.sync_once(&mut server).unwrap(),
+            cache.sync_once(&mut server).unwrap().edit,
             Some((id, EditStatus::Conflict(ConflictKind::ContentChanged))),
             "{name}"
         );
         drop(cache);
         let cache = Replica::open(&path).unwrap();
-        assert_eq!(cache.snapshot().unwrap(), local);
+        assert_eq!(pages(&cache.snapshot().unwrap()), pages(&local));
         assert_eq!(cache.pending().unwrap(), pending);
         assert_eq!(
             cache.status(id).unwrap(),
 @@ -448,6 +450,7 @@ fn offline_paragraphs(output: Option<&Path>) {
         let cases = if split { &manifest["cases"] } else { &manifest };
         let mut entries = Vec::new();
         let mut refused: Vec<String> = Vec::new();
+        let mut reviewed: Vec<String> = Vec::new();
         for case in cases
             .as_array()
             .unwrap()
 @@ -474,16 +477,10 @@ fn offline_paragraphs(output: Option<&Path>) {
                 continue;
             };
             let id = queued.unwrap();
-            entries.push(
+            let mut entry = serde_json::json!({"case": case["case"], "id": id, "space": space,
-                serde_json::json!({"case": case["case"], "id": id, "space": space,
+                "intent": intent, "remote_prefix": prefixed});
-                "intent": intent, "remote_prefix": prefixed}),
-            );
             drop(cache);
             cache = Replica::open(&path).unwrap();
-        }
-        let mut reviewed: Vec<String> = Vec::new();
-        for entry in &mut entries {
-            let id = entry["id"].as_u64().unwrap();
             let case = entry["case"].as_str().unwrap().to_owned();
             let intent = entry["intent"].clone();
             let mut uncertain = id % 2 == 0;
 @@ -501,11 +498,20 @@ fn offline_paragraphs(output: Option<&Path>) {
                         drop(cache);
                         cache = Replica::open(&path).unwrap();
                     }
-                    Ok(Some((actual, EditStatus::Published { revision }))) => {
+                    Ok(notebook::Synced {
-                        assert_eq!(actual, id);
+                        edit: Some((_, EditStatus::Published { revision })),
+                        ..
+                    }) => {
+                        assert!(matches!(
+                            cache.status(id).unwrap(),
+                            Some(EditStatus::Published { .. })
+                        ));
                         break revision;
                     }
-                    Ok(Some((actual, EditStatus::Conflict(_)))) => {
+                    Ok(notebook::Synced {
+                        edit: Some((actual, EditStatus::Conflict(_))),
+                        ..
+                    }) => {
                         assert_eq!(actual, id);
                         server.fault = Fault::None;
                         reviewed.push(case.clone());
 @@ -518,16 +524,15 @@ fn offline_paragraphs(output: Option<&Path>) {
                             replay(page, &placed, split)
                         });
                     }
-                    other => panic!("{name} {}: {other:?}", entry["case"]),
+                    other => panic!("{name} {case}: {other:?}"),
                 }
             };
             entry["revision"] = serde_json::to_value(revision).unwrap();
+            entries.push(entry);
         }
-        // A split inside a table cell the remote also changed overlaps at the cell.
-        let structural = ["Split cell".to_owned()];
         let unrepresentable = ["Join inherited styles".to_owned()];
         let expected: (usize, &[String], &[String]) = match name {
-            "splits" | "joins" => (12, &structural, &[]),
+            "splits" | "joins" => (12, &[], &[]),
             "inheritance" => (4, &[], &unrepresentable),
             _ => (3, &[], &[]),
         };
 @@ -537,7 +542,7 @@ fn offline_paragraphs(output: Option<&Path>) {
             "{name}"
         );
         assert_eq!(server.publications, entries.len());
-        assert_eq!(cache.sync_once(&mut server).unwrap(), None);
+        assert_eq!(cache.sync_once(&mut server).unwrap().edit, None);
         assert_eq!(cache.snapshot().unwrap(), server.durable);
         if output.is_some() {
             cache
 @@ -585,7 +590,7 @@ fn a_split_publishes_two_paragraphs_and_a_join_puts_them_back() {
         .unwrap()
         .unwrap();
     assert!(matches!(
-        cache.sync_once(&mut server).unwrap(),
+        cache.sync_once(&mut server).unwrap().edit,
         Some((_, EditStatus::Published { .. }))
     ));
     let published = page_of(&server.durable, space);
 @@ -598,7 +603,7 @@ fn a_split_publishes_two_paragraphs_and_a_join_puts_them_back() {
         .unwrap()
         .unwrap();
     assert!(matches!(
-        cache.sync_once(&mut server).unwrap(),
+        cache.sync_once(&mut server).unwrap().edit,
         Some((_, EditStatus::Published { .. }))
     ));
     assert_eq!(
 @@ -623,7 +628,7 @@ fn a_split_merges_with_a_remote_edit_to_another_paragraph() {
         .unwrap();
     let mut server = remote_with(space, |page| replace_text(page, other, 0..0, "Remote "));
     assert!(
-        matches!(cache.sync_once(&mut server).unwrap(), Some((actual, EditStatus::Published { .. })) if actual == id)
+        matches!(cache.sync_once(&mut server).unwrap().edit, Some((actual, EditStatus::Published { .. })) if actual == id)
     );
     assert_eq!(
         texts(&page_of(&server.durable, space)),
 @@ -645,13 +650,13 @@ fn a_join_conflicts_when_the_remote_changed_the_paragraph_it_removes() {
         .unwrap();
     let mut server = remote_with(space, |page| replace_text(page, right, 0..0, "Remote "));
     assert_eq!(
-        cache.sync_once(&mut server).unwrap(),
+        cache.sync_once(&mut server).unwrap().edit,
         Some((id, EditStatus::Conflict(ConflictKind::ContentChanged)))
     );
     assert_eq!(server.publications, 0);
     review_page(&cache, id, left, |page| join_paragraphs(page, left, right));
     assert!(matches!(
-        cache.sync_once(&mut server).unwrap(),
+        cache.sync_once(&mut server).unwrap().edit,
         Some((_, EditStatus::Published { .. }))
     ));
     assert_eq!(
 @@ -674,7 +679,7 @@ fn edits_dependent_on_a_published_split_survive_reopen() {
     save_page(&cache, left, |page| split_paragraph(page, left, 2))
         .unwrap()
         .unwrap();
-    cache.sync_once(&mut server).unwrap().unwrap();
+    cache.sync_once(&mut server).unwrap().edit.unwrap();
     let tail = body(&page_of(&cache.snapshot().unwrap(), space))[1]
         .text()
         .unwrap()
 @@ -688,7 +693,7 @@ fn edits_dependent_on_a_published_split_survive_reopen() {
     let pending = cache.pending().unwrap();
     drop(cache);
     cache = Replica::open(&path).unwrap();
-    assert_eq!(cache.snapshot().unwrap(), local);
+    assert_eq!(pages(&cache.snapshot().unwrap()), pages(&local));
     assert_eq!(cache.pending().unwrap(), pending);
     let mut remote = page_of(&server.durable, space);
     replace_text(&mut remote, other, 0..0, "Remote ");
 @@ -698,7 +703,7 @@ fn edits_dependent_on_a_published_split_survive_reopen() {
         .to_vec();
     server.durable.clone_from(&server.visible);
     assert!(
-        matches!(cache.sync_once(&mut server).unwrap(), Some((actual, EditStatus::Published { .. })) if actual == dependent)
+        matches!(cache.sync_once(&mut server).unwrap().edit, Some((actual, EditStatus::Published { .. })) if actual == dependent)
     );
     assert_eq!(
         texts(&page_of(&server.durable, space)),
 @@ -751,7 +756,7 @@ fn uncertain_splits_and_joins_keep_the_original_attempt_across_reopen() {
                     assert_eq!(state, EditStatus::Pending);
                     assert_eq!(cache.pending().unwrap(), pending);
                     assert!(matches!(
-                        cache.sync_once(&mut server).unwrap().unwrap().1,
+                        cache.sync_once(&mut server).unwrap().edit.unwrap().1,
                         EditStatus::Published { .. }
                     ));
                     assert_eq!(server.publications, 2);
 @@ -759,10 +764,10 @@ fn uncertain_splits_and_joins_keep_the_original_attempt_across_reopen() {
                 Fault::UnknownBefore => {
                     assert!(matches!(state, EditStatus::AwaitingConfirmation { .. }));
                     assert_eq!(cache.pending().unwrap(), pending);
-                    assert_eq!(cache.snapshot().unwrap(), local);
+                    assert_eq!(pages(&cache.snapshot().unwrap()), pages(&local));
                     for _ in 0..3 {
                         assert_eq!(
-                            cache.sync_once(&mut server).unwrap(),
+                            cache.sync_once(&mut server).unwrap().edit,
                             Some((id, state.clone()))
                         );
                     }
 @@ -772,9 +777,9 @@ fn uncertain_splits_and_joins_keep_the_original_attempt_across_reopen() {
                 }
                 Fault::UnknownAfter => {
                     assert!(matches!(state, EditStatus::AwaitingConfirmation { .. }));
-                    assert_eq!(cache.snapshot().unwrap(), local);
+                    assert_eq!(pages(&cache.snapshot().unwrap()), pages(&local));
                     assert!(matches!(
-                        cache.sync_once(&mut server).unwrap().unwrap().1,
+                        cache.sync_once(&mut server).unwrap().edit.unwrap().1,
                         EditStatus::Published { .. }
                     ));
                     assert_eq!(server.publications, 1);
 @@ -791,7 +796,7 @@ fn uncertain_splits_and_joins_keep_the_original_attempt_across_reopen() {
                 &["ab", "\u{1f980}cd", "Right", "Preserved sibling"]
             };
             assert_eq!(texts(&page_of(&server.durable, space)), expected);
-            assert_eq!(cache.sync_once(&mut server).unwrap(), None);
+            assert_eq!(cache.sync_once(&mut server).unwrap().edit, None);
             assert_eq!(cache.snapshot().unwrap(), server.durable);
         }
     }
 @@ -818,17 +823,17 @@ fn a_competing_join_leaves_the_other_client_a_reviewable_split() {
     let pending = second.pending().unwrap();
     let mut server = Server::new(BEFORE);
     assert!(matches!(
-        first.sync_once(&mut server).unwrap().unwrap().1,
+        first.sync_once(&mut server).unwrap().edit.unwrap().1,
         EditStatus::Published { .. }
     ));
     assert_eq!(
-        second.sync_once(&mut server).unwrap(),
+        second.sync_once(&mut server).unwrap().edit,
         Some((id, EditStatus::Conflict(ConflictKind::ContentChanged)))
     );
     assert_eq!(server.publications, 1);
     drop(second);
     let second = Replica::open(&path).unwrap();
-    assert_eq!(second.snapshot().unwrap(), local);
+    assert_eq!(pages(&second.snapshot().unwrap()), pages(&local));
     assert_eq!(second.pending().unwrap(), pending);
     assert_eq!(
         second.status(id).unwrap(),
 @@ -838,7 +843,7 @@ fn a_competing_join_leaves_the_other_client_a_reviewable_split() {
         split_paragraph(page, left, 2);
     });
     assert!(matches!(
-        second.sync_once(&mut server).unwrap().unwrap().1,
+        second.sync_once(&mut server).unwrap().edit.unwrap().1,
         EditStatus::Published { .. }
     ));
     assert_eq!(

crates/notebook/tests/sync_worker.rs+72-54

 @@ -111,7 +111,12 @@ fn reconnects_after_connect_read_and_uncertain_publish_without_replaying() {
             },
             move |result| {
                 observed_tx
-                    .send(result.as_ref().cloned().map_err(|error| error.to_string()))
+                    .send(
+                        result
+                            .as_ref()
+                            .map(|synced| synced.edit.clone())
+                            .map_err(|error| error.to_string()),
+                    )
                     .unwrap();
             },
         )
 @@ -166,7 +171,9 @@ fn local_saves_wake_an_idle_worker_and_publish_every_writer_marker() {
             Duration::from_secs(3600),
             move || Ok(shared.clone()),
             move |result| {
-                observed_tx.send(result.as_ref().unwrap().clone()).unwrap();
+                observed_tx
+                    .send(result.as_ref().unwrap().edit.clone())
+                    .unwrap();
                 if first {
                     first = false;
                     resume_rx.recv_timeout(Duration::from_secs(5)).unwrap();
 @@ -185,16 +192,11 @@ fn local_saves_wake_an_idle_worker_and_publish_every_writer_marker() {
                 let cache = &cache;
                 scope.spawn(move || {
                     let marker = format!("[{writer}] ");
-                    loop {
+                    model_ops::save(cache, oid, |page| {
-                        match model_ops::save(cache, oid, |page| {
+                        model_ops::replace_text(page, oid, 0..0, &marker)
-                            model_ops::replace_text(page, oid, 0..0, &marker)
+                    })
-                        }) {
+                    .unwrap()
-                            Ok(Some(id)) => break id,
+                    .unwrap()
-                            Err(Error::Io(error))
-                                if error.kind() == io::ErrorKind::ResourceBusy => {}
-                            other => panic!("Unexpected local outcome: {other:?}"),
-                        }
-                    }
                 })
             })
             .collect::<Vec<_>>()
 @@ -203,11 +205,9 @@ fn local_saves_wake_an_idle_worker_and_publish_every_writer_marker() {
             .collect::<std::collections::BTreeSet<_>>()
     });
     resume_tx.send(()).unwrap();
-    let mut published = std::collections::BTreeSet::new();
     while !cache.pending().unwrap().is_empty() {
-        if let Some((id, status)) = observed_rx.recv_timeout(Duration::from_secs(5)).unwrap() {
+        if let Some((_, status)) = observed_rx.recv_timeout(Duration::from_secs(5)).unwrap() {
             assert!(matches!(status, EditStatus::Published { .. }), "{status:?}");
-            published.insert(id);
         }
     }
     assert!(
 @@ -215,7 +215,12 @@ fn local_saves_wake_an_idle_worker_and_publish_every_writer_marker() {
         "Edits waited for the hourly poll"
     );
     worker.stop().unwrap();
-    assert_eq!(published, queued);
+    for id in &queued {
+        assert!(matches!(
+            cache.status(*id).unwrap(),
+            Some(EditStatus::Published { .. })
+        ));
+    }
     let content = text(&cache.snapshot().unwrap()).2;
     for writer in 0..12 {
         assert_eq!(content.matches(&format!("[{writer}] ")).count(), 1);
 @@ -223,7 +228,8 @@ fn local_saves_wake_an_idle_worker_and_publish_every_writer_marker() {
     assert!(content.ends_with("abc"));
     let server = server.lock().unwrap();
     assert_eq!(text(&server.durable).2, content);
-    assert_eq!(server.publications, queued.len());
+    // Edits queued while the worker was busy publish together.
+    assert_eq!(server.publications, 1);
     assert_eq!(cache.snapshot().unwrap(), server.durable);
 }
 @@ -308,7 +314,7 @@ fn dropping_during_publication_is_nonblocking_and_retains_ownership_until_recove
             Duration::from_secs(3600),
             move || Ok(shared.clone()),
             move |result| {
-                tx.send(result.as_ref().unwrap().clone()).unwrap();
+                tx.send(result.as_ref().unwrap().edit.clone()).unwrap();
             },
         )
         .unwrap();
 @@ -332,7 +338,7 @@ fn cache_failures_stop_retries_and_return_the_error_without_remote_publication()
     let id = save(&cache, oid, 0..0, "L ").unwrap();
     drop(cache);
     let connection = rusqlite::Connection::open(&path).unwrap();
-    connection.execute_batch("CREATE TRIGGER fail_attempt BEFORE INSERT ON attempt BEGIN SELECT RAISE(ABORT, 'test cache write failure'); END;").unwrap();
+    connection.execute_batch("CREATE TRIGGER fail_attempt BEFORE UPDATE OF attempted ON batches BEGIN SELECT RAISE(ABORT, 'test cache write failure'); END;").unwrap();
     drop(connection);
     let cache = Arc::new(Replica::open(&path).unwrap());
     let server = Arc::new(Mutex::new(Server::new(&source)));
 @@ -356,14 +362,14 @@ fn cache_failures_stop_retries_and_return_the_error_without_remote_publication()
 }
 #[test]
-fn polling_preserves_conflicts_and_absent_uncertain_revisions_without_replay() {
+fn polling_reports_a_blocked_queue_once_per_remote_change_without_replay() {
     for uncertain in [false, true] {
         let dir = tempfile::tempdir().unwrap();
         let source = onestore::create_section("worker.one", "abc", "Fixture").unwrap();
         let (sid, oid, _) = text(&source);
         let cache = Arc::new(Replica::create(dir.path().join("cache.sqlite"), &source).unwrap());
         let id = save(&cache, oid, 1..2, "L").unwrap();
-        let local = cache.snapshot().unwrap();
+        let local = text(&cache.snapshot().unwrap()).2;
         let mut server = if uncertain {
             Server::new(&source)
         } else {
 @@ -380,38 +386,48 @@ fn polling_preserves_conflicts_and_absent_uncertain_revisions_without_replay() {
                 Duration::from_millis(10),
                 move || Ok(shared.clone()),
                 move |result| {
-                    tx.send(result.as_ref().cloned().map_err(|_| ())).unwrap();
+                    tx.send(
+                        result
+                            .as_ref()
+                            .map(|synced| synced.edit.clone())
+                            .map_err(|_| ()),
+                    )
+                    .unwrap();
                 },
             )
             .unwrap();
         if uncertain {
             assert!(rx.recv_timeout(Duration::from_secs(5)).unwrap().is_err());
         }
-        let mut previous = None;
+        let expected = |status: &EditStatus| {
-        let started = Instant::now();
+            if uncertain {
-        for _ in 0..5 {
+                matches!(status, EditStatus::AwaitingConfirmation { .. })
+            } else {
+                *status == EditStatus::Conflict(ConflictKind::ContentChanged)
+            }
+        };
+        for round in 0..3 {
             let (actual, status) = rx
                 .recv_timeout(Duration::from_secs(5))
                 .unwrap()
                 .unwrap()
                 .unwrap();
             assert_eq!(actual, id);
-            if uncertain {
+            assert!(expected(&status), "{status:?}");
-                assert!(matches!(status, EditStatus::AwaitingConfirmation { .. }));
+            // An unchanged remote is not read or reported again.
-            } else {
+            assert!(rx.recv_timeout(Duration::from_millis(100)).is_err());
-                assert_eq!(status, EditStatus::Conflict(ConflictKind::ContentChanged));
+            // Another writer's change elsewhere in the text is read and decided again.
-            }
+            let mut server = server.lock().unwrap();
-            if let Some(previous) = previous {
+            let changed =
-                assert_eq!(previous, status);
+                onestore::replace_text(&server.visible, sid, oid, 0..0, &round.to_string())
-            }
+                    .unwrap();
-            previous = Some(status.clone());
+            server.visible = changed.clone();
+            server.durable = changed;
+            drop(server);
+            worker.wake();
         }
-        assert!(
-            started.elapsed() >= Duration::from_millis(30),
-            "Worker spun instead of waiting between retries"
-        );
         worker.stop().unwrap();
-        assert_eq!(cache.snapshot().unwrap(), local);
+        assert_eq!(text(&cache.snapshot().unwrap()).2, local);
         assert_eq!(cache.pending().unwrap().len(), 1);
         let server = server.lock().unwrap();
         assert_eq!(server.publications, usize::from(uncertain));
 @@ -511,7 +527,7 @@ fn invalid_intervals_and_callback_panics_leave_worker_ownership_recoverable() {
             Duration::from_secs(3600),
             move || Ok(shared.clone()),
             move |result| {
-                tx.send(result.as_ref().unwrap().clone()).unwrap();
+                tx.send(result.as_ref().unwrap().edit.clone()).unwrap();
             },
         )
         .unwrap();
 @@ -521,7 +537,7 @@ fn invalid_intervals_and_callback_panics_leave_worker_ownership_recoverable() {
 }
 #[test]
-fn reviewed_conflict_wakes_the_worker_and_publishes_the_original_intent_once() {
+fn a_resolved_conflict_wakes_the_worker_and_publishes_the_original_edit_once() {
     let dir = tempfile::tempdir().unwrap();
     let source = onestore::create_section("resolve.one", "abc", "Fixture").unwrap();
     let (sid, oid, _) = text(&source);
 @@ -538,7 +554,7 @@ fn reviewed_conflict_wakes_the_worker_and_publishes_the_original_intent_once() {
             Duration::from_secs(3600),
             move || Ok(shared.clone()),
             move |result| {
-                tx.send(result.as_ref().unwrap().clone()).unwrap();
+                tx.send(result.as_ref().unwrap().edit.clone()).unwrap();
                 if first {
                     first = false;
                     resume_rx.recv_timeout(Duration::from_secs(5)).unwrap();
 @@ -550,10 +566,7 @@ fn reviewed_conflict_wakes_the_worker_and_publishes_the_original_intent_once() {
         rx.recv_timeout(Duration::from_secs(5)).unwrap(),
         Some((id, EditStatus::Conflict(ConflictKind::ContentChanged)))
     );
-    model_ops::review(&cache, id, oid, |page| {
+    cache.resolve(id, notebook::Resolution::Mine).unwrap();
-        model_ops::replace_text(page, oid, 1..2, "L")
-    })
-    .unwrap();
     assert_eq!(cache.status(id).unwrap(), Some(EditStatus::Pending));
     resume_tx.send(()).unwrap();
     assert!(
 @@ -618,8 +631,13 @@ fn ordinary_read_and_unpublished_write_contention_reuse_the_connection() {
             Duration::from_millis(1),
             move || Ok(remote.take().expect("Contention caused a reconnect")),
             move |result| {
-                tx.send(result.as_ref().cloned().map_err(|error| error.to_string()))
+                tx.send(
-                    .unwrap();
+                    result
+                        .as_ref()
+                        .map(|synced| synced.edit.clone())
+                        .map_err(|error| error.to_string()),
+                )
+                .unwrap();
             },
         )
         .unwrap();
 @@ -675,14 +693,14 @@ fn publication_backoff_drains_local_wakes_without_waiting_for_the_idle_poll() {
                     failed = true;
                     let page =
                         onestore::PageCreation::new(None, Some("Queued"), "Fixture").unwrap();
-                    let second = observed
+                    let second = section_op(&observed, onestore::op::SectionOp::Create(page));
-                        .create_page(&observed.snapshot().unwrap(), &page)
-                        .unwrap()
-                        .unwrap();
                     tx.send((second, None)).unwrap();
                 }
-                Ok(Some((id, status))) => tx.send((*id, Some(status.clone()))).unwrap(),
+                Ok(notebook::Synced {
-                Ok(None) => {}
+                    edit: Some((id, status)),
+                    ..
+                }) => tx.send((*id, Some(status.clone()))).unwrap(),
+                Ok(_) => {}
                 other => panic!("Unexpected worker result: {other:?}"),
             },
         )

crates/onestore/src/commit.rs+13

...	@@ -644,6 +644,19 @@ impl Transaction {	...	@@ -644,6 +644,19 @@ impl Transaction {
644	}	644	}
645	}	645	}
646		646
		647	/// The image this transaction applies to.
		648	pub fn base(&self) -> &Stamp {
		649	&self.base
		650	}
		651
		652	/// The bytes a commit writes, by offset, in the order `apply` writes them; the header,
		653	/// last, covers bytes 0..1024.
		654	pub fn writes(&self) -> impl Iterator<Item = (u64, &[u8])> {
		655	std::iter::once((self.base.length, self.append.as_slice()))
		656	.chain(self.patches.iter().map(\|(offset, bytes)\| (*offset, bytes.as_slice())))
		657	.chain(std::iter::once((0, self.header.as_slice())))
		658	}
		659
647	/// Writes this transaction into its base image, as a successful commit leaves the file.	660	/// Writes this transaction into its base image, as a successful commit leaves the file.
648	pub fn apply(&self, image: &mut Vec<u8>) -> Result<(), crate::Error> {	661	pub fn apply(&self, image: &mut Vec<u8>) -> Result<(), crate::Error> {
649	if Stamp::of(image)? != self.base {	662	if Stamp::of(image)? != self.base {

crates/onestore/src/op/apply.rs+4-3

 @@ -15,7 +15,7 @@ use crate::{
     active::{ActivePage, Changes},
     document::Kind,
     page::{
-        Attachment, Image, Ink, Page, PageObject, PageParagraph, Paragraph, ParagraphContent,
+        Attachment, Image, Ink, PageObject, PageParagraph, Paragraph, ParagraphContent,
         TableCell, TableColumn,
     },
 };
 @@ -57,12 +57,13 @@ impl<'a> Section<'a> {
     /// Lowers `after` against the page `space` holds and applies the result as one edit;
     /// returns the ops, which reach `after` where the writers can store it.
-    pub fn apply_page(
+    #[cfg(test)]
+    pub(crate) fn apply_page(
         &mut self,
         author: &str,
         at: u64,
         space: ExGuid,
-        after: &Page,
+        after: &crate::page::Page,
     ) -> Result<Vec<PageOp>, OpError> {
         let before = self.page(space).map_err(|error| self.classify(Failure::Rejected(error)))?;
         let ops = super::lower_page(&before, after)

crates/onestore/src/op/lower.rs+2-1

...	@@ -20,7 +20,8 @@ fn invalid(message: &'static str) -> Error {	...	@@ -20,7 +20,8 @@ fn invalid(message: &'static str) -> Error {
20	Error { offset: 0, message }	20	Error { offset: 0, message }
21	}	21	}
22		22
23	/// The ops that turn `before`, a page as stored, into `after`.	23	/// The ops that turn `before`, a page as stored, into `after`: O(page), for importing a
		24	/// page, converting queued whole-page edits and resolving a conflict, never per keystroke.
24	pub fn lower_page(before: &Page, after: &Page) -> Result<Vec<PageOp>, Error> {	25	pub fn lower_page(before: &Page, after: &Page) -> Result<Vec<PageOp>, Error> {
25	let old = View::new(before, false)?;	26	let old = View::new(before, false)?;
26	let new = View::new(after, false)?;	27	let new = View::new(after, false)?;

crates/onestore/src/op/mod.rs+5

...	@@ -28,6 +28,7 @@ pub(crate) type Values = Vec<(u32, Vec<u8>)>;	...	@@ -28,6 +28,7 @@ pub(crate) type Values = Vec<(u32, Vec<u8>)>;
28		28
29	/// One user action, applied whole or not at all.	29	/// One user action, applied whole or not at all.
30	#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]	30	#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
		31	#[serde(deny_unknown_fields)]
31	pub struct Edit {	32	pub struct Edit {
32	/// FILETIME when the action happened; the modification time of what it changes.	33	/// FILETIME when the action happened; the modification time of what it changes.
33	pub at: u64,	34	pub at: u64,
...	@@ -35,6 +36,7 @@ pub struct Edit {	...	@@ -35,6 +36,7 @@ pub struct Edit {
35	}	36	}
36		37
37	#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]	38	#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
		39	#[serde(deny_unknown_fields)]
38	pub enum Op {	40	pub enum Op {
39	Page { space: ExGuid, op: PageOp },	41	Page { space: ExGuid, op: PageOp },
40	Section(SectionOp),	42	Section(SectionOp),
...	@@ -43,6 +45,7 @@ pub enum Op {	...	@@ -43,6 +45,7 @@ pub enum Op {
43	/// A change to the page an object space holds. Targets are stored identities; paragraph	45	/// A change to the page an object space holds. Targets are stored identities; paragraph
44	/// properties name the paragraph, text edits its text object.	46	/// properties name the paragraph, text edits its text object.
45	#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]	47	#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
		48	#[serde(deny_unknown_fields)]
46	pub enum PageOp {	49	pub enum PageOp {
47	/// Replaces a range; inserted text takes the format of the run it lands in, the	50	/// Replaces a range; inserted text takes the format of the run it lands in, the
48	/// following run at a boundary except at the end.	51	/// following run at a boundary except at the end.
...	@@ -159,6 +162,7 @@ pub enum PageOp {	...	@@ -159,6 +162,7 @@ pub enum PageOp {
159	}	162	}
160		163
161	#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]	164	#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
		165	#[serde(deny_unknown_fields)]
162	pub enum TableEdit {	166	pub enum TableEdit {
163	/// New rows before a row, or last, each with one cell per column.	167	/// New rows before a row, or last, each with one cell per column.
164	Rows {	168	Rows {
...	@@ -185,6 +189,7 @@ pub enum TableEdit {	...	@@ -185,6 +189,7 @@ pub enum TableEdit {
185	}	189	}
186		190
187	#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]	191	#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
		192	#[serde(deny_unknown_fields)]
188	pub enum SectionOp {	193	pub enum SectionOp {
189	Create(PageCreation),	194	Create(PageCreation),
190	/// A page created with `creation` holding `page`'s content under the identities it	195	/// A page created with `creation` holding `page`'s content under the identities it

crates/onestore/src/section.rs+8-1

 @@ -202,6 +202,13 @@ impl<'a> Section<'a> {
         image
     }
+    /// Each object space with the active revision the sealed image stores for it.
+    pub fn revisions(&self) -> impl Iterator<Item = (ExGuid, ExGuid)> + '_ {
+        self.spaces
+            .iter()
+            .filter_map(|(space, stored)| Some((*space, stored.rid?)))
+    }
     /// The page an object space holds, with the changes applied since the last seal.
     pub fn page(&self, space: ExGuid) -> Result<Page> {
         let stored = self.spaces.get(&space).ok_or(Error {
 @@ -429,7 +436,7 @@ impl<'a> Section<'a> {
     }
     /// The root object space, which lists the pages.
-    pub(crate) fn root(&self) -> ExGuid {
+    pub fn root(&self) -> ExGuid {
         self.root
     }

crates/onestore/src/store.rs+1-1

...	@@ -86,7 +86,7 @@ pub struct Header {	...	@@ -86,7 +86,7 @@ pub struct Header {
86	}	86	}
87		87
88	impl Header {	88	impl Header {
89	pub(crate) fn parse(data: &[u8]) -> Result<Self> {	89	pub fn parse(data: &[u8]) -> Result<Self> {
90	let mut c = Cursor {	90	let mut c = Cursor {
91	bytes: data,	91	bytes: data,
92	offset: 0,	92	offset: 0,

tools/cache_images.py+34-14

...	@@ -1,17 +1,37 @@	...	@@ -1,17 +1,37 @@
1	"""The cache's working image, stored as the byte ranges where it differs from the base."""	1	"""Reading a notebook cache (schema 15) from outside: its section images, stored as 16 KiB
		2	chunk rows, and the state of its write-ahead log."""
2	import struct	3	import struct
3		4
4		5
5	def working(connection):	6	def image(connection, table='base'):
6	base, patch = connection.execute('SELECT base, working FROM replica WHERE id=1').fetchone()	7	"""The `base` image the queued edits apply to, or the observed `remote` image (None
7	if not patch: return base	8	unless a conflict or uncertain attempt holds one)."""
8	length, = struct.unpack_from('<Q', patch)	9	chunks = connection.execute(f'SELECT chunk, bytes FROM {table} ORDER BY chunk').fetchall()
9	image = bytearray(base[:length].ljust(length, b'\0'))	10	assert [chunk for chunk, _ in chunks] == list(range(len(chunks))), 'Damaged cached image'
10	at = 8	11	return b''.join(bytes(data) for _, data in chunks) or None
11	while at < len(patch):	12
12	offset, size = struct.unpack_from('<QQ', patch, at)	13
13	at += 16	14	def wal_commits(path):
14	assert at + size <= len(patch) and offset + size <= length, 'Damaged working image'	15	"""Commits in `<cache>-wal` since its last reset: frames whose header records the
15	image[offset:offset + size] = patch[at:at + size]	16	database size after them, among the frames carrying the log's current salts. Frames
16	at += size	17	after the last commit belong to a transaction that has not committed."""
17	return bytes(image)	18	try:
		19	data = path.with_name(path.name + '-wal').read_bytes()
		20	except FileNotFoundError:
		21	return 0, 0
		22	if len(data) < 32:
		23	return 0, 0
		24	magic, _, page_size, _, salt1, salt2 = struct.unpack_from('>IIIIII', data)
		25	assert magic in (0x377f0682, 0x377f0683), 'Not a SQLite write-ahead log'
		26	commits = pending = 0
		27	at = 32
		28	while at + 24 + page_size <= len(data):
		29	_, committed, frame1, frame2 = struct.unpack_from('>IIII', data, at)
		30	if (frame1, frame2) != (salt1, salt2):
		31	break
		32	if committed:
		33	commits, pending = commits + 1, 0
		34	else:
		35	pending += 1
		36	at += 24 + page_size
		37	return commits, pending

tools/offline_cache_crash.py+16-23

 @@ -1,6 +1,7 @@
 #!/usr/bin/env python3
 """Interrupt owned offline-cache writers and verify every retained intent and image."""
 import argparse
+import cache_images
 import hashlib
 import json
 import os
 @@ -31,7 +32,7 @@ def run(binary, output):
     retained = []
     retained_ids = []
     results = []
-    delays = [None, "ack", "unack", "journal", "database-write", 0, .001, .01, .02, .04, .08, .16, .32, .64, 1.28, 2.56, None, "ack"]
+    delays = [None, "ack", "unack", "wal", 0, .001, .01, .02, .04, .08, .16, .32, .64, 1.28, 2.56, None, "ack"]
     for operation, delay in enumerate(delays, 1):
         with (output / f"owner-{operation}.stderr").open("w") as stderr:
             owner = subprocess.Popen([binary, "edit", cache], stdin=subprocess.PIPE,
 @@ -48,34 +49,28 @@ def run(binary, output):
                 contender = subprocess.run([binary, "read", cache], capture_output=True, text=True, timeout=15)
                 (output / f"contender-{operation}.stderr").write_text(contender.stderr)
                 assert contender.returncode != 0 and "DatabaseBusy" in contender.stderr, contender
-                before_write = cache.stat().st_mtime_ns
                 owner.stdin.write(f"{operation} {'unack' if delay == 'unack' else 'ack'}\n")
                 owner.stdin.flush()
                 expect(f"editing {operation}")
                 acknowledgement = None
-                journal_observation = None
+                log_observation = None
                 if delay == "ack":
                     acknowledgement = expect(f"ack {operation}")
                 elif delay == "unack":
                     expect(f"durable {operation}")
-                elif delay in ("journal", "database-write"):
+                elif delay == "wal":
+                    # Cut the edit's transaction once its frames are in the log and its
+                    # commit frame is not.
                     deadline = time.monotonic() + 10
-                    journal = cache.with_name(cache.name + "-journal")
+                    committed, _ = cache_images.wal_commits(cache)
                     while time.monotonic() < deadline:
-                        try:
+                        commits, pending = cache_images.wal_commits(cache)
-                            with journal.open("rb") as active:
+                        if commits == committed and pending:
-                                header = active.read(28)
+                            log_observation = {"wal_commits": commits, "uncommitted_frames": pending}
-                            size = journal.stat().st_size
+                            break
-                            database_changed = cache.stat().st_mtime_ns != before_write
+                        if commits != committed:
-                            if (header[:8] == bytes.fromhex("d9d505f920a163d7") and
+                            break
-                                    (delay == "journal" or database_changed)):
+                    assert log_observation, "No uncommitted log frames observed"
-                                journal_observation = {"header": header.hex(), "bytes": size,
-                                                       "database_changed": database_changed}
-                                break
-                        except FileNotFoundError:
-                            pass
-                        time.sleep(.0001)
-                    assert journal_observation, f"No active {delay} phase observed"
                 elif delay is not None:
                     time.sleep(delay)
                 owner.kill()
 @@ -88,9 +83,7 @@ def run(binary, output):
                 actual = json.loads(read.stdout)
                 operations = actual["operations"]
                 ids = actual["ids"]
-                # A save replaces the newest pending save of its page under the same intent.
+                assert operations in (retained, retained + [operation]), (retained, operation, actual)
-                coalesced = retained[:-1] + [operation] if ids == retained_ids else None
-                assert operations in (retained, retained + [operation], coalesced), (retained, operation, actual)
                 assert ids[:len(retained_ids)] == retained_ids, (retained_ids, actual)
                 if acknowledgement:
                     assert operations[-1] == operation
 @@ -105,7 +98,7 @@ def run(binary, output):
                                 "retained_operations": operations, "ids": ids,
                                 "section_bytes": actual["section_bytes"],
                                 "complete_payloads": True, "exclusive_owner": True,
-                                "journal_observation": journal_observation})
+                                "log_observation": log_observation})
                 retained, retained_ids = operations, ids
                 (output / "results.json").write_text(json.dumps(results, indent=2))
                 print(json.dumps(results[-1]), flush=True)

tools/offline_publication_crash.py+17-19

 @@ -31,11 +31,6 @@ def run_command(binary, args, output):
 def kill_at(binary, args, phase, output, receipt_window=None):
     events = queue.Queue()
     database = Path(args[1]) / 'cache.sqlite'
-    journal = database.with_name(database.name + '-journal')
-    def header():
-        try:
-            with journal.open('rb') as stream: return stream.read(8)
-        except FileNotFoundError: return b''
     with output.with_suffix('.jsonl').open('w') as log, output.with_suffix('.stderr').open('w') as error:
         process = subprocess.Popen([str(binary), *map(str, args)], stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=error, text=True,
                                    env={**os.environ, 'ONESTORE_RECOVERY_PAUSE': phase})
 @@ -57,24 +52,26 @@ def kill_at(binary, args, phase, output, receipt_window=None):
                 if event.get('event') == 'phase' and event['name'] == phase:
                     if receipt_window is not None:
                         assert args[0] == 'sync' and phase == 'publish-after'
-                        assert receipt_window in ('journal', 'database')
+                        assert receipt_window == 'wal'
-                        before_mtime = database.stat().st_mtime_ns
+                        # The receipt transaction is cut once its frames are in the log and
+                        # its commit frame is not.
+                        committed, _ = cache_images.wal_commits(database)
                         process.stdin.write('\n')
                         process.stdin.flush()
                         deadline = time.monotonic() + 5
                         while True:
-                            if header() == bytes.fromhex('d9d505f920a163d7') and (receipt_window == 'journal' or database.stat().st_mtime_ns != before_mtime): break
+                            commits, pending = cache_images.wal_commits(database)
-                            assert process.poll() is None, 'Receipt transaction finished before the requested cut'
+                            if commits == committed and pending: break
+                            assert commits == committed and process.poll() is None, 'Receipt transaction finished before the requested cut'
                             assert time.monotonic() < deadline, 'Receipt transaction window was not observed'
-                            time.sleep(.0001)
                     process.kill()
                     break
             assert process.wait(timeout=10) == -signal.SIGKILL, 'Expected an actual process kill'
             proof = {'pid': process.pid, 'exit': process.returncode, 'phase': phase}
             if receipt_window is not None:
-                proof.update(journal_header_after_kill=header().hex(), database_changed=database.stat().st_mtime_ns != before_mtime, receipt_window=receipt_window)
+                commits, pending = cache_images.wal_commits(database)
-                assert proof['journal_header_after_kill'] == 'd9d505f920a163d7', 'Receipt transaction committed before the process died'
+                proof.update(wal_commits_before=committed, wal_commits_after_kill=commits, uncommitted_frames=pending, receipt_window=receipt_window)
-                assert receipt_window != 'database' or proof['database_changed']
+                assert commits == committed, 'Receipt transaction committed before the process died'
             output.with_suffix('.cut.json').write_text(json.dumps(proof, indent=2))
         finally:
             if process.poll() is None: process.kill()
 @@ -103,7 +100,7 @@ def state(rows, original):
     else:
         assert len(result['pending']) == 1, 'Unacknowledged intent was lost or duplicated'
         pending, = result['pending']
-        assert pending['id'] == 1 and pending['before'] == original and pending['replacement'] == TOKEN
+        assert pending['id'] == 1 and pending['replacement'] == TOKEN
         at = len(original.encode('utf-16-le')) // 2
         assert pending['range'] == [at, at], 'Durable intent range changed'
     return result
 @@ -187,11 +184,12 @@ def run(source, output):
         try:
             assert connection.execute('PRAGMA quick_check').fetchall() == [('ok',)]
             assert connection.execute('PRAGMA foreign_key_check').fetchall() == []
-            local_image = save_image(output, cache_images.working(connection))
+            # The image the queue applies to; the local text is the probe's, checked above.
+            base_image = save_image(output, cache_images.image(connection))
         finally:
             connection.close()
         result = {'case': index, 'phase': phase, 'during_confirmation': confirmation, 'before_status': before['status'], 'after_status': after['status'],
-                  'visible_before_recovery': before['remote_text'] != original, 'remote_image': remote_image, 'local_image': local_image,
+                  'visible_before_recovery': before['remote_text'] != original, 'remote_image': remote_image, 'base_image': base_image,
                   'remote_text': after['remote_text'], 'local_text': after['local_text']}
         results.append(result)
         (output / 'results.json').write_text(json.dumps(results, indent=2))
 @@ -206,14 +204,14 @@ def run(source, output):
 def receipt_windows(source, output):
     binary, source_hash = prepare_run(source, output)
     results = []
-    for window in ('journal', 'database'):
+    for window in ('wal',):
         folder = output / window
         initialized = run_command(binary, ['init', folder, source], output / (window+'-init'))
         original = next(row['remote_text'] for row in initialized if row['event'] == 'state')
         state(initialized, original)
         kill_at(binary, ['sync', folder], 'publish-after', output / (window+'-kill'), receipt_window=window)
         before = state(run_command(binary, ['inspect', folder], output / (window+'-inspect')), original)
-        assert before['status'] == 'uncertain' and before['remote_text'] == original+TOKEN, 'Hot-journal recovery lost the pending confirmation'
+        assert before['status'] == 'uncertain' and before['remote_text'] == original+TOKEN, 'Log recovery lost the pending confirmation'
         before_bytes = (folder / 'remote.one').read_bytes()
         recovered = run_command(binary, ['sync', folder], output / (window+'-recover'))
         after = state(recovered, original)
 @@ -226,7 +224,7 @@ def receipt_windows(source, output):
         print(json.dumps({'receipt_window':window, 'status':after['status'], 'remote_image':digest}), flush=True)
     assert hashlib.sha256(source.read_bytes()).hexdigest() == source_hash
     (output/'results.json').write_text(json.dumps(results, indent=2))
-    (output/'summary.json').write_text(json.dumps({'process_kills':2, 'recovered_receipts':2, 'republished_edits':0}, indent=2))
+    (output/'summary.json').write_text(json.dumps({'process_kills':len(results), 'recovered_receipts':len(results), 'republished_edits':0}, indent=2))
 if __name__ == '__main__':

tools/test_offline_history.py+5-4

 @@ -139,9 +139,10 @@ class OfflineLedgerTests(unittest.TestCase):
                 events.extend({'event': 'reopened_receipt', 'id': op+1, 'revision': f'{actor}-{op}'} for op in range(2))
                 events.append({'event': 'done'})
                 connection = sqlite3.connect(output / 'rust' / f'{actor}.sqlite')
-                connection.executescript('CREATE TABLE receipts(edit_id INTEGER, revision TEXT); CREATE TABLE edits(id INTEGER); CREATE TABLE attempt(id INTEGER); CREATE TABLE conflicts(id INTEGER); CREATE TABLE replica(id INTEGER, base BLOB, working BLOB);')
+                # Schema 15 in WAL mode, as a drained cache leaves it.
+                connection.executescript('PRAGMA journal_mode=WAL; CREATE TABLE receipts(edit_id INTEGER, revision TEXT); CREATE TABLE edits(id INTEGER); CREATE TABLE batches(id INTEGER); CREATE TABLE payloads(sha256 BLOB); CREATE TABLE base(chunk INTEGER, bytes BLOB); CREATE TABLE remote(chunk INTEGER, bytes BLOB);')
                 connection.executemany('INSERT INTO receipts VALUES (?,?)', [(op+1, f'{actor}-{op}') for op in range(2)])
-                connection.execute('INSERT INTO replica VALUES (1, ?, ?)', (b'opaque image', b''))
+                connection.execute('INSERT INTO base VALUES (0, ?)', (b'opaque image',))
                 connection.commit()
                 connection.close()
             for i in range(4):
 @@ -165,8 +166,8 @@ class OfflineLedgerTests(unittest.TestCase):
             os.utime(output / 'rust/stop', ns=(0, 0))
             connection = sqlite3.connect(output / 'rust/w0.sqlite')
             for sql, undo in [("UPDATE receipts SET revision='wrong' WHERE edit_id=1", "UPDATE receipts SET revision='w0-0' WHERE edit_id=1"),
-                              ('INSERT INTO attempt VALUES (1)', 'DELETE FROM attempt'),
+                              ('INSERT INTO batches VALUES (1)', 'DELETE FROM batches'),
-                              ("UPDATE replica SET working=X'00'", "UPDATE replica SET working=X''")]:
+                              ("INSERT INTO remote VALUES (0, X'00')", 'DELETE FROM remote')]:
                 connection.execute(sql)
                 connection.commit()
                 with self.assertRaises(AssertionError): verify(output)

tools/test_offline_publication_crash.py+2-2

tools/verify_offline.py+3-3

 @@ -4,6 +4,7 @@ import argparse
 import hashlib
 import json
 from pathlib import Path
+import cache_images
 import sqlite3
 from native_stress import edit_history, native_history
 @@ -41,12 +42,11 @@ def verify(output, max_gap=120):
         try:
             assert connection.execute('PRAGMA quick_check').fetchall() == [('ok',)], 'Cache integrity failed'
             assert connection.execute('PRAGMA foreign_key_check').fetchall() == [], 'Cache foreign keys failed'
-            for table in ('edits', 'attempt', 'conflicts'):
+            for table in ('edits', 'batches', 'payloads', 'remote'):
                 assert connection.execute(f'SELECT count(*) FROM {table}').fetchone() == (0,), 'Completed cache retains unresolved state'
             persisted = dict(connection.execute('SELECT edit_id, revision FROM receipts'))
             assert persisted == {id: event['revision'] for id, event in receipts.items()}, 'SQLite receipts differ from observed acknowledgements'
-            base, working = connection.execute('SELECT base, working FROM replica WHERE id=1').fetchone()
+            base = cache_images.image(connection)
-            assert working == b'', 'A drained cache retained a divergent local branch'
             caches[actor] = {'receipts': len(persisted), 'image_bytes': len(base), 'image_sha256': hashlib.sha256(base).hexdigest(), 'database_sha256': hashlib.sha256(path.read_bytes()).hexdigest()}
         finally:
             connection.close()

author	clover caruso <git@paperclover.net> 2026-09-26 10:05:26-07:00
committer	clover caruso <git@paperclover.net> 2026-09-27 04:23:49-07:00
log	4292e4deb721a9526b18e9d9385d225c033b245c
tree	9f5b4fa9e49dc1994ada3a0db13e3e550ef05955
parent	216e64b3c750a6df75ac13a7f3779327f01cbe9e
signature	Signed by SSH key SHA256:52mNGHRsVFBDED9IAX5pe+LRWUefqTbxEReunq21QvU

...	@@ -28,7 +28,7 @@ class RecoveryOracleTests(unittest.TestCase):	...	@@ -28,7 +28,7 @@ class RecoveryOracleTests(unittest.TestCase):
28	at = len(original.encode('utf-16-le')) // 2	28	at = len(original.encode('utf-16-le')) // 2
29	row = {'event': 'state', 'status': 'uncertain', 'revision': 'new', 'remote_revision': 'old',	29	row = {'event': 'state', 'status': 'uncertain', 'revision': 'new', 'remote_revision': 'old',
30	'local_text': original+TOKEN, 'remote_text': original,	30	'local_text': original+TOKEN, 'remote_text': original,
31	'pending': [{'id': 1, 'before': original, 'replacement': TOKEN, 'range': [at, at]}]}	31	'pending': [{'id': 1, 'replacement': TOKEN, 'range': [at, at]}]}
32	self.assertEqual(state([row], original), row)	32	self.assertEqual(state([row], original), row)
33	for field, value in [('revision', None), ('revision', 'old'), ('local_text', original),	33	for field, value in [('revision', None), ('revision', 'old'), ('local_text', original),
34	('remote_text', original+TOKEN+TOKEN), ('status', 'missing'), ('pending', [])]:	34	('remote_text', original+TOKEN+TOKEN), ('status', 'missing'), ('pending', [])]:
...	@@ -36,7 +36,7 @@ class RecoveryOracleTests(unittest.TestCase):	...	@@ -36,7 +36,7 @@ class RecoveryOracleTests(unittest.TestCase):
36	changed[field] = value	36	changed[field] = value
37	with self.subTest(field=field):	37	with self.subTest(field=field):
38	with self.assertRaises(AssertionError): state([changed], original)	38	with self.assertRaises(AssertionError): state([changed], original)
39	for field, value in [('id', 2), ('before', 'other'), ('replacement', 'other'), ('range', [at-1, at-1])]:	39	for field, value in [('id', 2), ('replacement', 'other'), ('range', [at-1, at-1])]:
40	changed = copy.deepcopy(row)	40	changed = copy.deepcopy(row)
41	changed['pending'][0][field] = value	41	changed['pending'][0][field] = value
42	with self.assertRaises(AssertionError): state([changed], original)	42	with self.assertRaises(AssertionError): state([changed], original)

feat(data): the notebook queues ops and publishes sealed transactions