Repository navigation
Validate patches before committing client state / 在提交客户端状态前校验 patch #62
Description
中文
关联 calcit-lang/calcit#1529/#1538/#1542。审阅基线 787fb808：on-server-data、ClientStore decoder。本轮未运行新反例。
当前收到 :patch changes 后先 assert 为 List、执行 patch-twig，再 deep decode ClientStore；成功分支忽略 decoded store、保存 raw next-store。这已经有最终校验，应保留，但不能让 malformed patch 在最终 decoder 前进入 unchecked 执行，也不应让已解码结果再次退化到组件 Dynamic。
目标数据流
受检 message/patch Result → 安全执行 patch Result → 深层 ClientStore decode Result → 一次一致提交 raw patch base 与 typed ClientStore → render 使用 decoded ClientStore。若 patch 库无受检入口，用最小显式验证/adapter，不能仅改 schema。
raw base 可因 diff 协议留在局部边界；它和 typed store 必须代表同一 revision。路径/操作合法与业务 shape 合法分两次验证，不能把任意 patch 推断为 T→T。
验收
- 合法初始快照与增量 patch 在连续多次更新后保持 raw/typed 同步，组件消费一次解码结果
- 非 list changes、未知 op、错 arity、非法 path/index、非预期 base、结果深层字段错型均明确失败；保留上一份有效状态，不能半提交
- 沿用有界 resync 策略；重复失败不无限 reconnect，失败信息不泄露完整私有 payload
- 网络 parsing、patch adapter 与 deep decoder 各自错误能定位，错误到达后不触发成功 render/业务 dispatch
- Native/JS 适用测试及真实客户端 smoke；Calcit
:tests覆盖正反消息和跨多patch状态一致性 - CLI 展示 Dynamic source→patch→decode→store sink，修复建议默认需 review；不自动加 unsafe/丢 patch/改默认值
- 与存储及 route/ClientStore schema 迁移保持协议兼容，更新先后顺序记录清楚
English
Source review at 787fb808; no new reproducer run. Current on-server-data asserts the change list, patches raw state, then deeply validates ClientStore while discarding the decoded value. Preserve final validation but check malformed messages/operations before execution.
Target checked message/patch → checked application → deep ClientStore decode → one coherent commit of raw patch base and typed store; render consumes the decoded result. Keep raw transport state localized and revision-consistent. Operation/path validity does not establish business result shape.
Accept repeated valid patches and malformed list/op/arity/path/index/base/nested-result cases; every failure preserves prior valid state without partial commit. Keep bounded resync and private-payload-safe errors. Test native/applicable JS and client smoke, and expose source-to-sink diagnostics. Adapter/protocol/schema choices remain reviewed, never automatic unsafe, dropped changes or invented defaults.
Activity
tiye commentedon Oct 4, 2026
中文
重新核对当前源码和固定依赖 recollect 0.0.53：
on-server-data在 deep decoder 前直接调用会抛错的patch-twig；未知操作的异常会包含完整 change。用正式 Calcit 0.27.0 执行已有 patch API 的最小反例，:boguspayload 为测试字符串fixture-password时，捕获的异常确实包含该字符串。这里只验证了底层异常内容，尚未宣称真实客户端错误通道已经修复或验收。当前
StorePayload :online仍只保存Map<Tag,Dynamic>，成功 decoder 分支丢弃ClientStore。下一步先加入同一 Calcit 边界的消息/操作校验与安全 Result adapter，再把 raw patch base 与 decoded store 成对提交；组件消费 typed store。保留既有有界 resync，失败输出只保留阶段/路径，不转发底层私有 payload。此任务不以 unsafe、删除 patch 或修改业务默认值收尾。存储/凭证工作的正式 JS 验收仍等待已发布 core runtime 修复（calcit#1747/#1750），隔离预览不替代正式兼容证明。
English
Rechecked current source with pinned recollect 0.0.53.
on-server-datacalls throwingpatch-twigbefore deep decoding; unknown-operation errors include the full change. A minimal replay through the existing patch API with formal Calcit 0.27.0 confirms that a:bogusoperation containing the fixture stringfixture-passwordincludes that string in its caught error. This proves the low-level error content only, not fixed or accepted client error handling.StorePayload :onlinestill holds onlyMap<Tag,Dynamic>and the successful decoder branch discardsClientStore. Next implement checked message/operation handling and a safe Result adapter, then commit raw patch base and decoded store coherently so components consume typed data. Preserve bounded resync; failures expose stage/path rather than private underlying payloads. No unsafe cast, dropped patch or invented business default.Formal JS acceptance of the storage/credentials work still requires published core runtime fixes (calcit#1747/#1750); isolated previews are not formal compatibility evidence.
tiye commentedon Oct 8, 2026
中文
核对 #69 当前 c7139cd：依赖已是 Recollect 0.0.57，on-server-data 已调用现有 decode-changes；它递归检查 op 标签、arity 与载荷基础类型。历史描述中的仅 assert 已过时，后续不要重复实现一套 op decoder。
实际剩余：decoder 与 patch 执行仍会抛错，部分底层错误带完整 change；ClientStore decoder 成功值仍被丢弃，StorePayload :online 只存 raw Map，组件再次解码；失败分支仍可能覆盖为 initial。应复用现有 decoder，加受检且不泄露 payload 的 adapter、base/path/index 合法性验证和 raw/typed 一致提交，并保留原有有界 resync。这是当前源码审计，不是这些行为已经修复或运行验收。
English
At current #69 c7139cd, Recollect is 0.0.57 and on-server-data already uses decode-changes, which recursively validates operation tags, arity and basic payload types. The historical assert-only description is stale; do not duplicate the existing operation decoder.
Remaining: decoding and patch application still throw, some lower-level errors include full changes, successful ClientStore decoding is discarded, StorePayload :online stores only the raw Map and components decode again, and failure can still overwrite state with initial. Reuse the decoder with a checked payload-safe adapter, base/path/index validation and coherent raw/typed commit while retaining bounded resync. This is a current-source audit, not claimed implementation or runtime acceptance.
tiye commentedon Oct 8, 2026
中文
已提交堆叠草稿 #73，基于 #69。复用 Recollect 已发布的 checked patch API，raw/typed 一次提交、旧快照保留和有界 resync 已有 native/JS 及真实 WebSocket/组件回放。
完整 strict 被 Calcit #1865 的短路条件证据丢失阻断；解析回调缺口归 ws-edn #53。先完成通用修复与发布回放，不修改共享模块、不删门禁，本 issue 不关闭。详细验证集中在 PR。
English
Stacked draft #73 builds on #69. Published checked patch reuse, coherent raw/typed commit, preserved snapshots and bounded recovery now have native/JS and real WebSocket/component replay.
Full strict is blocked by short-circuit proof loss in Calcit #1865; parsing notification belongs to ws-edn #53. Complete the shared repairs and released replay without cache edits or removed gates. Keep this issue open; full evidence is in the PR.
tiye commentedon Oct 8, 2026
中文
短路证据修复已提交 calcit-lang/calcit#1867。开发 CLI 下原 73 项 native、58 项同 AST JS 与浏览器边界回放通过；完整 strict 下一处阻塞是 calcit-lang/recollect#76 的动态 Struct 写入。PR #73 仍为草稿，还需该边界、mvc-works/ws-edn.calcit#53 及正式版本验收，不绕过原门禁。
English
Short-circuit repair is submitted as calcit-lang/calcit#1867. The development CLI passes the original 73 native, 58 same-AST JS and browser boundary replay; full strict next stops at the dynamic Struct boundary tracked by calcit-lang/recollect#76. PR #73 remains draft pending that boundary, mvc-works/ws-edn.calcit#53 and released-package acceptance, without gate bypasses.
tiye commentedon Oct 9, 2026
中文
后续证据见 PR #75，HEAD
d294773，已发布 CLI/npm alpha.24、Respo alpha.10、std39、JS-FFI16。完整原 strict、公共定义、76 native、61 同 AST JS、原8宿主合同与构建本地通过；新增三项:tests只约束组件子状态的 Tag 键，不改变 patch 协议或既有业务数据默认值。本轮真实 Chrome 运行实际
app.client/main!与 Diary editor，应用 WebSocket 注入本地 fixture（不连接生产）。真实 callbacks 接受初始快照及增量 count1→2；深层 nickname 错型的组合 patch 不半提交，保留整份快照 identity；只发起一次恢复连接，重复错误和增量不能恢复；完整 replace 后 count5，raw/typed 与渲染一致。编辑草稿仍保存在 typed DiaryEditorState。主动恢复关闭产生现有 Lost connection! 日志，已读真实堆栈；正常渲染/输入无新增异常，不隐藏日志。前述补齐真实客户端 smoke，不自动完成 CLI source-to-sink 证据或全部存储/路由迁移验收；PR 尚待最新 HEAD CI/review，本单保持开放。
English
PR #75 (d294773) uses the published alpha.24 pair with Respo10/std39/JS-FFI16; all original local strict/public/76 native/61 same-AST JS/eight host/build gates pass. Three new attached tests check component-state keys, not a changed patch protocol or business default.
Actual Chrome runs app.client/main! and the Diary editor with injected application sockets, never production traffic. Real callbacks accept initial and incremental snapshots, preserve the complete snapshot identity after an invalid deep nickname field, reconnect only once, refuse incremental/repeated-error recovery and recover raw/typed/rendered count 5 after full replacement. Local draft input remains typed. The existing expected recovery-close log was inspected rather than hidden.
This completes new real-client smoke evidence only, not every source-to-sink/storage/route criterion. Keep the issue open while latest PR CI/review and the remaining scoped acceptance are pending.