Preserve checked client snapshots / 保留受检客户端快照与有界恢复

[tiye]

中文

关联 #62、calcit-lang/calcit#1529/#1865、mvc-works/ws-edn.calcit#53。基于已合并 #69，目标分支为 main；不再受 alpha.20 短路证明问题阻塞。本 PR 包含 #74 的四处已获授权非空判断迁移，避免重复合并。

实现

• 复用已发布 Recollect 0.0.57 的 try-patch-twig，不在应用复制 op/path/index 校验。
• app.client-state 依次校验 envelope、change-op、安全执行 patch、deep decode ClientStore。错误只暴露阶段 tag。
• ClientSnapshot 一次提交 raw base 与 typed ClientStore；组件直接消费解码结果，避免重新退化为 Dynamic。
• 断线或失败保留最后有效快照，每轮最多主动重连一次；恢复时只接受包含完整 root replacement 的快照，成功后才复位恢复状态。
• 正常使用已发布 ws-edn 0.0.37 的 :on-error：非文本帧、非法 EDN 和连接错误进入 :wire 恢复阶段，既不读取也不输出宿主错误对象；patch/深层 decode 保留各自阶段。
• CLI/npm 使用正式 alpha.23 配对，包含 core 短路谓词证明修复；宏内 some? 与 watcher 旧入口已迁移。没有改模块缓存、扩大业务 schema、增加 unsafe 或调整质量 baseline。
• 原 wire/存储协议不变。内存 StorePayload 改变，升级需完整刷新页面，不沿用旧 hot-reload Ref。

验证

当前修复 HEAD：83bf05b3d32e42b327785eef310cf5e01f3cff1e。使用 crates.io CLI/npm alpha.23、Node 24.4.1 与正常 Caps 安装的模块。

• 原 fix --workflow strict --verify、双入口 check-only、client/server 原全部 check-public（含新增 namespace）、format 与 diff 检查通过。
• 73 条 native 附带测试、58 条同 AST JS 回放、原 8 条浏览器合同、credentials/dispatch/date/wire 合同通过。
• 新增消息错误宿主断言在修复前明确失败：非文本帧抛出 [ws-edn/message] expected a text WebSocket message；修复后非文本和非法 EDN 均不逃出回调，raw/typed 快照对象保留、至多一次恢复连接、拒绝中间增量、完整快照恢复、无业务 dispatch 或私有输入日志。
• 原 JS/Vite build 通过，729.30 kB chunk 警告保留，未调整预算。
• 最新 HEAD 83bf05b 的完整 CI 37962214824 已成功，包括原 strict、全部测试、构建及 PR preview；没有复用旧提交的绿灯。

仍需外部 review 后合并。路由 payload 等剩余开放边界归 #63，不在本 PR 伪称完成；本 PR 也不代表 alpha.24 或稳定版最终消费者验收。

English

Refs #62, calcit-lang/calcit#1529/#1865 and mvc-works/ws-edn.calcit#53. Based on merged #69 and now targeting main. The alpha.20 short-circuit proof blocker is resolved. This includes the four authorized nil-predicate migrations from #74, avoiding duplicate merge work.

Implementation

Reuse published Recollect 0.0.57 try-patch-twig. A pure boundary validates envelope and operations, applies the checked patch and deep-decodes ClientStore. ClientSnapshot atomically commits raw patch base and typed store; components consume the typed value. Failures preserve the last valid snapshot, allow at most one recovery connection per cycle, and require a full root replacement before accepting more increments.

Published ws-edn 0.0.37 now feeds non-text frames, invalid EDN and connection errors through its existing on-error callback into the application's :wire recovery stage. Opaque host errors are neither inspected nor logged; patch/decode retain separate stage tags. Use the published alpha.23 CLI/npm pair containing the general short-circuit proof repair, with obsolete nil/watcher names migrated. No module-cache edits, business-schema widening, added unsafe or baseline changes. Wire/storage protocols remain unchanged; refresh the page for the new in-memory StorePayload representation.

Verification

Repair HEAD: 83bf05b3d32e42b327785eef310cf5e01f3cff1e. Actual crates.io/npm alpha.23, Node 24.4.1 and normally installed published dependencies.

Original strict workflow, both entries, all client/server public checks including the new namespace, format and diff checks passed. Original 73 native attached tests, 58 identical-AST JS replays, eight browser contracts and credential/dispatch/date/wire tests passed. New host assertions failed before the fix on the unhandled non-text frame, then passed after the fix: preserved raw/typed snapshot identity, bounded reconnect, rejected intermediate increments, full-snapshot recovery, no business dispatch or private-frame logging. Original JS/Vite build passed with the unchanged budget and an existing 729.30 kB chunk warning.

Latest HEAD 83bf05b passed full CI 37962214824, including original strict, all tests, build and PR preview. External review is still required. Route/open UI boundaries remain under #63. This PR does not claim final alpha.24/stable consumer acceptance.