3 files changed, 16 insertions, 6 deletions
diff --git a/prototypes/connections/module.c b/prototypes/connections/module.c
index f8ebdd3..ebb746f 100644
--- a/prototypes/connections/module.c
+++ b/prototypes/connections/module.c
@@ -1038,6 +1038,7 @@ void pure_app_stop(PureApp *app) {
         pure_draft_close(app->list_drafts[i]);
     }
     pure_draft_close(app->stored_values);
+    free(app->pending);
     pure_undo_free(&app->undo);
     free(app->arena.bytes);
     free(app->view_arena.bytes);
@@ -1164,6 +1165,13 @@ PureResult pure_app_message(PureApp *app, uint32_t input, const char *key, int64
             PureResult saved = pure_app_save(app);
             if (saved != PURE_OK) return saved;
         }
+        if (app->pending_count == app->pending_capacity) {
+            unsigned capacity = app->pending_capacity ? 2 * app->pending_capacity : 16;
+            struct PurePending *grown = realloc(app->pending, capacity * sizeof(*grown));
+            if (!grown) return PURE_ALLOCATION;
+            app->pending = grown;
+            app->pending_capacity = capacity;
+        }
         PureResult opened = app->data.open(app->data.context, 0, key, &app->document, &app->revision);
         if (opened != PURE_OK) { app->document = NULL; return opened; }
         if (base >= 0 && base != app->revision) { pure_app_finish(app); return PURE_CONFLICT; }
diff --git a/prototypes/connections/module.h b/prototypes/connections/module.h
index c5d4f52..c9fb606 100644
--- a/prototypes/connections/module.h
+++ b/prototypes/connections/module.h
@@ -19,7 +19,7 @@ enum {
     PURE_MODULE_NAME = 32, PURE_MODULE_STRINGS = 32768, PURE_MODULE_HEADER = 40,
     PURE_MODULE_FIELDS = 32, PURE_MODULE_COLLECTIONS = 1, PURE_MODULE_CONSTANTS = 64,
     PURE_MODULE_CONSTANT_BYTES = 8192, PURE_MODULE_RECORDS = 8, PURE_MODULE_RECORD_FIELDS = 64,
-    PURE_RECORD_FIELDS = 16, PURE_MODULE_JOINS = 8, PURE_APP_PENDING = 16
+    PURE_RECORD_FIELDS = 16, PURE_MODULE_JOINS = 8, PURE_APP_PENDING = 256
 };
 
 typedef enum {
@@ -147,7 +147,7 @@ typedef struct { unsigned char *bytes; size_t used, capacity; } PureArena;
  * before it returns (a frame waits for the next one). Deferred, events apply
  * at once and a host saves a burst with one commit: an event is durable once
  * a later save succeeds, and each key's document joins a burst once (a second
- * message for it saves the burst first). */
+ * message for it, or one past PURE_APP_PENDING keys, saves the burst first). */
 typedef struct {
     const PureModule *module;
     PureData data;
@@ -164,8 +164,8 @@ typedef struct {
     double durable_values[PURE_MODULE_STATES];
     PureVersion durable_texts[PURE_MODULE_STATES], durable_lists[PURE_MODULE_STATES];
     uint64_t durable_ticks, durable_events;
-    struct { void *document; char key[65]; bool edited; } pending[PURE_APP_PENDING];
-    unsigned pending_count;
+    struct PurePending { void *document; char key[65]; bool edited; } *pending; /* grows to PURE_APP_PENDING */
+    unsigned pending_count, pending_capacity;
     PureFault fault;
     uint32_t fault_pc;
     uint64_t ticks, events;
diff --git a/prototypes/connections/test-module.c b/prototypes/connections/test-module.c
index e1d1ccf..6f48bc8 100644
--- a/prototypes/connections/test-module.c
+++ b/prototypes/connections/test-module.c
@@ -1697,8 +1697,10 @@ static void deferred_messages(void) {
     pure_app_stop(&app);           /* the last edit was never saved */
     CHECK(pure_app_start(&app, &module_a, pure_tree_data(path)) == PURE_OK && app.values[0] == 4 + PURE_APP_PENDING);
     CHECK(pure_app_message(&app, 0, "k0", -1, (PureSpan){0}) == PURE_OK && app.revision == 2 && replied(&app, "abc"));
-    CHECK(pure_app_message(&app, 0, "m16", -1, (PureSpan){0}) == PURE_NOT_FOUND);
-    CHECK(pure_app_message(&app, 0, "m15", -1, (PureSpan){0}) == PURE_OK && replied(&app, "y"));
+    snprintf(key, sizeof(key), "m%d", PURE_APP_PENDING);
+    CHECK(pure_app_message(&app, 0, key, -1, (PureSpan){0}) == PURE_NOT_FOUND);
+    snprintf(key, sizeof(key), "m%d", PURE_APP_PENDING - 1);
+    CHECK(pure_app_message(&app, 0, key, -1, (PureSpan){0}) == PURE_OK && replied(&app, "y"));
     pure_app_stop(&app);
     remove_store(path);
 }