Use the Rust file client and live queries through WASM

Merged
VA
3d ago
+7935-4541

Problem

The browser duplicated harness transport, retry, outbox and transcript state. Removing it must preserve remote platform attachment and offline recovery, while sharing the Rust file client and query reducer with native clients.

Design

Expose platform TaskVolume, FileClient, QuerySubscription and FileViews through WASM. Remote browsers use the existing Rust Streams session pool for multiplexed push follows and reconnect; a single Rust owner drains the private-volume outbox on admission, pushed recovery and standalone durability watermarks from both the private outbox and target. Each endpoint follows its captured, commit-checked cursor through the same pool, including outbox-only durability and reconnects with a local target. Transient HTTP failures schedule bounded error backoff through the same injected executor, without restarting a healthy socket. Platform I/O and spawn/sleep are injected into that same pool, using Tokio natively and browser futures/timers on WASM. Credentials are resolved per physical request.

Terminal target rejection is checkpointed and retired; indeterminate publication remains pending. Enqueue reserves waiting-call count and bytes synchronously before retaining a JS buffer in a future, including the entire backing buffer and permitted growth, checks durable capacity before copying, and validates the Rust offline-safety policy before persistence. Enqueue/flush reservations release on completion or cancellation. Idle waits release their command reservation after mailbox registration, leaving capacity for the flush that settles them; the worker independently permits one registered idle waiter. Request-key validation is shared with native admission and retains its error classification. Unknown nested owner metadata is rejected in the canonical volume type. The file-tool fixture is regenerated from the merged Rust definitions, retaining main's tool changes and the strict VolumeOwner schemas. Query output is validated before publication and cursor advancement; text views retain shared segments and expose chunk deltas.

Decisions

Only platform Streams and volume APIs carry task state. There is no harness gateway, daemon or second socket protocol. The browser socket adapter speaks the existing platform session protocol; the local HTTP/WebSocket host is a test fixture. File writes remain submissions and live queries remain views. Rust owns recovery, cursors and credit; TypeScript is platform I/O and rendering. Preserve the branch history for #722. The shared Rust pool now exports canonical ALL/LATEST and Children subscriptions, full resume cursors, checked anchors, bounded credit and conflated standalone watermarks. The same WasmStream API is exported by the harness module, so callers can share its connection across task volumes and status follows.

Keep Client::with_transport, transport::{Transport, Endpoint, Connect, Requests, Responses} and runtime::{Executor, PlatformExecutor} public and general for #722. Streaming HTTP reads retain message, trailer and header bounds without applying the unary aggregate-response budget or one-second unary total deadline to an entire history. Unary calls retain that deadline. Dropping a streaming read still cancels its fetch; I/O failures still propagate.

Keep main’s build-time binding generation from #638: generated protobuf/WASM files remain untracked and are rebuilt by the public package command.

The main merge reuses its single task-file publication retry loop. Its error type is caller-selected so client admission retains structured terminal/transient failures, while execution publishers retain their existing authorization errors. No second retry implementation is added. Waiting reservations are event-loop-owned plain counters; mailbox synchronization continues through the existing modeled shim.

Deletions

Remove duplicated TS client storage, transport, wire transport and retry paths, and repoint exports, examples and consumers to WASM. The native legacy headless transcript/journal migration is a separate follow-up.

Net delta from the merge base: +3,390 lines (+7,931 / -4,541), including fuzz lockfiles and verification coverage.

Tests

  • Outbox durability delta at 88ad8997f: real Chromium with a remote outbox and local target independently saves the request and its checkpoint, with no target update or polling. whenIdle resolves only after the second pushed outbox watermark; reopen retains the committed cursor and retries append no duplicate checkpoint. The 9 s Chromium gate passes; focused WASM tests 19/19, 0.926 s. Public WASM builds, TS projects and type contracts pass. The real pool Loom suite and missing-watermark/connection-wakeup negative controls pass, 27/27 in 1.85 s. Windows harness and Streams --lib --tests checks pass through lb.ps1, 2m45s after queueing. No synchronization primitive is added: the worker remains one event-loop owner and reuses the modeled pool and mailbox.
  • Main merge at 0f0dc677d preserves the split volume schema, hooks and context-capture fixtures from #749/#755/#760. No README file is changed. Windows Streams --lib --tests passed in 11.00 s and harness --lib --tests in 1m44s. bb1 file-client 25/25 (0.08 s), query 16/16 (0.03 s), task-volume 45/45; WASM client/query/watermark tests 19/19 (0.893 s), real Chromium Streams and harness scenarios, TS/type checks and public WASM builds passed. Fresh installed archive 40/40 (3.06 s); installed Chromium framework and reload/follow checks passed.
  • Streaming deadline review delta at 076831730: real Chromium Streams and harness scenarios pass, each runner capped at 9 s. A shrinking property delivers real server frames under 32 generated virtual-time/chunk-boundary schedules; every complete history survives beyond the unary deadline. Restoring the old deadline is rejected and shrinks to [501 ms, 1 byte]; the actual unary deadline is independently asserted. Public Streams/harness WASM builds and TS project/type contracts pass. Windows Streams --lib --tests passes, 0.56 s.
  • Idle/flush review delta at 9729b59e3: actual WASM client/memory tests 23/23, 0.826 s (one-command progress regression 0.61 ms); Rust reservation properties and negative controls 4/4, <0.01 s; TS project/type contracts pass; Windows harness --lib --tests passes, 9.13 s. Reuse the unchanged gates below.
  • bb1 file-client: 25/25, 0.08 s; query: 16/16, 0.03 s. Shared publication prefix property: 1/1, <0.01 s; production publication/owner revalidation Loom models and negative controls: 2/2, 0.63 s.
  • Actual WASM client/query/durability/memory and file-tool contracts after #743: 37/37, 0.927 s. Includes rejected→valid→reopen, every offline-safety rejection, nested-owner credential negative control, no linear-memory growth for oversize admission, synchronous waiting command/byte quotas, sliced backing buffers and resizable buffers.
  • Sessions: 72/72, 3.06 s, including 10k agents; follow protocol properties: 7/7, 0.01 s; independent follow contract: 4/4, 0.03 s; ASAN Streams frame/subscription fuzz: 13,991 runs in 4 s.
  • Chromium against the real local platform server: 17-record history beyond the former unary budget, overlapping read pages, ALL/LATEST follows, reconnect without another record, automatic Rust outbox drain, HTTP recovery without reconnect, standalone durability after final data, rejection recovery and streaming text; no JS flush/retry. Runner has a 9 s deadline.
  • Production mailbox Loom shim and missing-wake control: 2/2, <0.01 s. Streams pool Loom shim and controls: 27/27, 0.59 s.
  • Streaming-response policy and framing: 29/29, 0.19 s, including shrinking properties and aggregate-limit negative control. Error-backoff properties and omitted-retry control: 2/2, <0.01 s. Waiting-call count/byte accounting, idle progress and both omitted/retained-reservation controls: 4/4, <0.01 s. The retained-idle control shrinks to a one-command counterexample.
  • Pinned-nightly ASAN offline-policy fuzz target: 1,428 runs in 4 s; shared shrinking oracle and checked-in seeds.
  • Fresh installed archive: 40/40, 1.450 s; installed Chromium React/Svelte and reload/follow checks pass. Fixture uses issueScope and the current mailbox/model stock-turn input with its required authority and pinned context manifest; token counting verifies the pinned instructions were loaded.
  • TS project and type contracts pass. Windows lb.ps1 harness --lib --tests after #743: 1m58s; Streams --lib --tests: 13.13 s; standalone vendor tests and both fuzz targets compile. Boundary checks pass.

Follow-ups

Selected swarm file views through WASM; native headless migration from its temporary persisted transcript to volume queries.