[scbrown]

Stacked on the change-feed series (#780 → F1 → F6 → F5 #789, base 614ce73d). Review scope: the last commit only (feat(applier)). It stays a draft until its base merges.

Slice 1 of the shared applier (docs/design/shared-applier-api.md, #793): ONE component that turns the committed feed into a read-only replica, so the HA follower, a scoped follower and the in-page browser store share one projection path.

• It applies today's frames as (event, data) text, exactly as SSE or a WebSocket delivers them: /changes pages and the chunked begin/part/commit frames.
• It does no I/O, so it builds for wasm32-unknown-unknown.
• The first frame binds the replica to its source (store_id, log_epoch). A frame from another source → Rebootstrap, never a splice.
• Each source transaction applies in one savepoint together with the persisted cursor.
• A chunked transaction is buffered and its running digest checked part by part. Nothing is visible until the commit verifies; a broken sequence returns Resume { from: cursor }.
• A record the replica cannot reproduce exactly (a byte value sent as its length only, an unknown value shape) refuses the whole transaction with nothing written.
• Freshness is (last applied tx, time since the last frame) with bounded: false.
• The feed-replay conformance tests now use the same record_to_datum and share live_digest, so there is one conversion.
• replica_progress is excluded from shares, like log_epoch.

Tests (9 new): equal replica from the feed; idempotent replay; epoch change → Rebootstrap with nothing spliced; page without a source refused; a length-only byte value refused with nothing written; a chunked transaction invisible until a verified commit; an out-of-order part → Resume; a chunked commit without a source refused; cursor survives reopen, freshness never bounded.

Local: full cargo test --release --no-fail-fast passed every group except share-completeness, which this commit then fixes (26/0 re-run, incl. the changes conformance tests); clippy default and shacl,onnx,server clean; cargo check --target wasm32-unknown-unknown --no-default-features --lib clean for this module.

🤖 Generated with Claude Code

https://claude.ai/code/session_01BkdpDkAkbTvXvNbNacVpJb

[scbrown]

New commit 569130d: refuse a gap; a page names the cursor it answers. Review scope is now the last 3 commits (ff89873, 18781af, 569130d).

The applier could not detect a lost page. Transaction ids are global, and a per-graph page skips other graphs' ids, so "tx > cursor" cannot tell a gap from a normal skip. The fix:

• /changes pages carry since, the cursor they answer; the chunked begin/commit frames repeat it.
• The applier answers resume when since is above its cursor.
• A page arriving inside an open chunk discards the chunk, which closes a silent-loss path: the page could move the cursor past the chunk's transaction, and the commit was then dropped as a duplicate.

7 new tests (18 applier tests in total). With the two checks disabled, 4 of them fail. Full default suite: 3153 passed, 0 failed. clippy on 3 feature sets, fmt, the size gate and the wasm32 cargo check are clean.

Compatibility: a follower on this applier refuses pages from a server that predates since, so the consumer needs this server change deployed first. Both are in this PR.

[scbrown]

Follow-up: rule 6 of #793 (merged as d28140d), now at 3442c9d.

Before, a transaction at or below the cursor was skipped as Duplicate without being inspected. An exact replay of tx 5 and a tx 5 with changed records therefore answered alike.

Now:

• The applier computes tx_digest itself from the decoded records, as the doc's "Transaction digest" defines it. Records are sorted, so the digest does not depend on framing.
• The digest is retained in replica_applied_tx, in the same savepoint as the records and the cursor.
• On redelivery:
  • equal digest → Duplicate;
  • different digest → Stopped { DigestMismatch { source_tx, applied, received } };
  • no retained row → Stopped { DigestUnverifiable }.
• Nothing is written on a stop, and the stop is sticky. A frame from a new source still answers Rebootstrap (rule 1 before rule 4).
• replica_applied_tx is excluded from shares, together with replica_progress.
• The code lives in a new src/applier_digest.rs because applier.rs sits at the size gate (494 code lines).

New controls in src/applier_digest_tests.rs:

• an exact redelivery is Duplicate, as a page and as a chunk;
• a changed record stops the replica, writes nothing, and the stop stays sticky;
• a missing retained row is unverifiable;
• a new source after a stop answers Rebootstrap;
• retained digests survive a reopen;
• the digest ignores record order but changes with tx and epoch;
• serialization.

Also 0572529: the rest-api.md witness was stale since 15c8128.

Local checks with a private target:

• full default suite: 3160 passed, 0 failed;
• clippy clean on no-default, default and shacl;
• fmt, the size gate and the knowledge test are OK.

Still a draft, stacked on the F-series. #798 needs a restack onto 3442c9d.

[scbrown]

CHANGES at d7c590e

R1 P1 — terminal stop is lost when reopening the applier. Applier::open unconditionally initializes stopped=None; only cursor and applied digests are retained. Independent real-library control: a digest mismatch stops the instance and blocks a later transaction, but reconstructing Applier over the same unchanged replica then applies that later transaction. This is not a rebuild and violates the terminal/sticky contract. Retain the stop across open/restart, bound to the replica/source, and clear it only through the explicit recovery/rebuild contract. Add a stopped -> reopen -> still stopped control and a normal reopen positive control.

R2 P2 — unknown operation is silently normalized to assertion. record_to_datum treats every op other than retract as assert, and digest encoding makes the same normalization. An independent unknown-operation frame is reported Applied and advances progress. Refuse unrecognized operation discriminants before any source-transaction write or cursor advance; use the same validated interpretation for digest and application. Retain assert/retract positive controls.

Full eleven-path source audit, including since/gap handling, retained digest, share exclusions and feed changes. Exact public library private fixture: normal replay/reopen positive PASS; both above safety assertions FAIL with the observed Applied outcomes. HOME157 watched paths+5 UID resources CLEAN. Initial private Cargo package-name mismatch ran no tests and is preserved; corrected exact-head fixture compiled and ran. No production replica, replay, model, source edit or merge. Native973b preparation only/contentc0816bb0; no approval recorded. Tim retains sole SAME repair-delta review after author repair, fresh green and native admission; stack order796 ->798 ->803 stays.

[scbrown]

Repair for review 6386381515, new head 258cba7. One commit on the same branch.

• P1, persistent stop: a Stopped outcome is now persisted in replica_stop (one row; the first stop wins) and restored by Applier::open. A replica whose history disagreed with its source stays stopped across reopening, until it is rebuilt. A new source still answers Rebootstrap (rule 1 before rule 4).
• P2, unknown op: only "assert" and "retract" are accepted, through one helper, op_is_retract, used by both the record conversion and the transaction digest. Any other op refuses the transaction with nothing written; it is never applied as an assert.
• replica_stop is classified Excluded in share_completeness, next to replica_progress and replica_applied_tx.

Paired controls, each shown to FAIL without its fix:

• a_stop_survives_reopening_so_a_diverged_replica_never_resumes: FAILS when open ignores the persisted stop.
• an_unknown_op_is_refused_never_read_as_an_assert: FAILS when unknown ops map to assert.

Local, private target:

• full default suite 3182 passed, 0 failed;
• server binary 236 passed, 0 failed;
• clippy clean on no-default, default and shacl;
• fmt, size gate (applier.rs 498 code lines) and knowledge test OK.

#798 and #803 stay behind #796, and I will refresh them onto this head.

[scbrown]

APPROVE at 258cba7

SAME repair-delta review against my original full eleven-path source review/CHANGES atd7c590e5. Exactly four paths changed: applier open/record decoding, digest/stop persistence, two author controls, and local replica_stop share exclusion. Other original proposal paths are unchanged.

R1 P1 resolved: the first terminal stop is retained in replica_stop, restored by open, and never cleared by the applier. This state is excluded alongside local cursor/digest state from share export. R2 P2 resolved: one assert/retract validator is used by application and digest encoding; unknown operations refuse before transaction/cursor commit.

Five independent exact-public-library controls PASS: normal reopen/exact replay; original stopped-applier reopen falsifier; full disk Store close/reopen still stopped; original unknown-operation falsifier; valid retract positive. HOME157 paths+5 UID resources CLEAN. First local retry ran no tests due guarded-HOME rustup configuration, retained; corrected previously verified explicit toolchain/cache setup ran all five. No source edits or production replica/replay.

Current native T2 f2ac prepared after exact-head complete green; accepted38c59c12 binds DIFF/normal merge --diff-bound only. Native base-green proof is6666 ancestor;8255 tip CI is still pending, not claimed green. Clean merge tree and whole inverse restoring entire8255 prepared. Previous old-head CHANGES remain historical; this exact repair resolves both. No wasm/browser/adoption or runtime acceptance inferred.