[wangyeyu1129]

Description

Migrates the existing server-resume-rejection-v1 increment from wangyeyu1129/vRT#1 onto current upstream main. Scope remains four server recovery-rejection/ACK-boundary cases; no new profile beyond the original Draft or expanded matrix is introduced.

Issue association

Refs #17. Original dependency #46 and principal isolation #47 are merged. This independent branch starts at main c864f64; its diff contains only the former Draft's net increment plus necessary integration with current main, not a reintroduction of #44/#45/#46/#47.

Migration provenance: original fork base 2f9b9e8025ee03855d482a5dd0eaaf177407aeb2 is an ancestor of Draft head 68a372ece71559ee8511fdc4a3bc14fb641fcf49. The binary net diff base..head was saved and applied with git apply --3way --index to new branch feat/conformance-server-resume-rejection-upstream. Eight common integration/docs conflicts were resolved against current main. No merge commit was cherry-picked, no original branch was rewritten, and no unrelated pending code is included. The fork Draft remains open/draft as historical review context; this is a new upstream PR, not a changed target repository.

Behaviours Completed

• Unchanged stable IDs: server/resume-rejection/unknown, /ahead, /ack-history, /ack-boundary. Explicit server+driver-only profile; absent instrumentation/fixture policy/inventory yields incomplete/nonzero. fullSuite remains incomplete.
• Unknown/closed session: RESUME_FAILED, recoverable:false, seq 0, then 4404, no ready or replacement model (§5.4 step 2).
• Ahead and discarded-history cursors: explicit non-recoverable bound-stream failure and wire close, no partial replay/business, no new model; a third connection verifies the failed session ended. Ready-before-failure remains allowed by §5.4 steps 3–5; a bound-history close code is not invented.
• Exact ACK boundary: retained history seq 1/2, actual ACK upTo 1, cursor 1 receives unchanged seq 2 and a fresh seq-3 marker. Cursor 0 fails in the separately controlled discard-history case.
• Local fixture prerequisite: §4.2 MAY discard permits retaining acknowledged history. The profile requires declared retention.acknowledged:"discard"; retaining/unsupported policies are incomplete for this profile, not declared globally wire-incompatible. Instrumentation never deletes cache entries itself.
• waitResumeAck confirms the real wire ACK only after public Connection.receive applies it (synchronous in the official SDK); a queued control request is not receipt. Closed model counts use public fake-model state; no private Inbox/Outbox/ownership table is read.
• Same-seq identical message/error retransmission remains one logical message, conflicting content fails. Rejection and successful boundary cases finish with actual wire close/completion markers and bounded effects; extra peers are finally-owned.
• Latest main's normal recovery, principal isolation, four-token post-cleanup redaction, PrincipalFailure/ResumeFailure multi-peer evidence, input validation, heartbeat-only flags, capability/schema gates and old driver contracts are all preserved.

Files Changed

• conformance/scenarios/server-resume-rejection.json, src/node/server-resume-rejection.ts: existing four scenarios, real ACK delivery/close barriers, exact-boundary suffix/new marker and failed-session third probe.
• conformance/src/resume-rejection-oracle.ts: independent refusal/numbering, boundary replay and bounded effect expectations, using existing schema/capability/sequence validation.
• conformance/src/node/drivers/server-resume.ts, drivers/typescript-server.ts: explicitly selected public recovery instrumentation; normal recovery keeps its original two-connection snapshots/commands, rejection permits three and adds receipt/closed-model observations.
• conformance/src/node/fixtures/resume-rejection-server.ts, test/server-resume-rejection.test.mjs: unchanged real-wire faults, accepted alternatives/retransmissions and lifecycle checks.
• conformance/src/node/{runner,cli}.ts, src/report.ts, build.mjs, test/consumer.mjs: additive integration into current main, required inventory, distributed assets and installed-package checks.
• README.md, conformance/{README.md,driver-protocol.md}: existing profile usage/contract, retention policy and limits integrated with current docs.

The scenario, node scenario helper, oracle, fault fixture, test file and public recovery driver extension were byte-compared identical to the original Draft. Production SDK, normative spec/schema/vector, Python, package manifest/lockfile and dependency contents are unchanged.

Brief Explanation

This promotes already reviewed/tested work from a fork-only stack now that its base is merged. Runner owns ordering/deadlines/lifecycle, transport records actual traffic, driver controls only public model/server/edge APIs, and the independent Oracle checks state and expected history. Necessary edits are confined to integration with #47 and the other merged profiles; no expectation was weakened or additional workflow abstraction introduced.

The raw test client intentionally exercises unavailable history under an explicit discard policy. Unknown sessions remain unbound while known recovery binds before replay checking; the error sequence must reflect that distinction. Complete wire closure, the successful new marker and public finite effects prevent treating a first ready/error or quiet interval as completion.

Testing

Environment: macOS 26.6.2 arm64; Node 22.23.3. Counts below are from this migration run, not copied from the fork Draft.

• npm run test:conformance: 168 passed = 144 current-main tests + 24 migrated tests. Includes fresh production/conformance builds and conformance typecheck. All merged profiles, feat(conformance): verify normal server resume and replay #46 normal recovery, feat(conformance): verify resume authentication and principal isolation #47 principal isolation and four rejection cases pass.
• Fifteen real wire/control faults fail their matching stable rejection case IDs: silent new unknown session, accepted ahead cursor, partial ACK history, rejected exact boundary, missing close, business after failure, retained failed session, wrong bound/unbound numbering, unknown wrong close, recoverable failure, dropped/changed/conflicting retained replay and missing observations. Fixtures do not fabricate runner reports.
• Accepted controls preserve identical retained-message/error replay, alternative bound-failure close code and refusal without requiring ready first. Retained-ACK policy or missing/malformed instrumentation yields incomplete/nonzero.
• Lifecycle tests cover held ready/ACK/close/finish, ACK command error, startup/injection exit, early recovery close, repeated close/EOF and refusal-no-close. Every variant checks all recorded direct-child PIDs are absent after return.
• npm run test:conformance:consumer: passed; actual tarball installed outside the checkout without SDK peer installation. Removing server/resume-rejection/ack-history produces inventory incomplete/exit 1; schema/scenario/driver assets resolve from the installation.
• npm test: 465 passed, 26 SDK files. npm run test:e2e: 7 passed. npm run typecheck, npm run check:spec: passed (23 schemas, 1 capability, 156 control vectors, 9 audio vectors).
• Build and npm run check:budgets: passed, including dependency/import rules; protocol 2.16 KB min+gzip / 5 KB, core 5.11/15, client 5.26/20 unchanged.
• Full validation used /private/tmp/vrt-open-migration-eo3ghpen, byte-compared against every tracked source in the requested checkout. Workspace dependencies resolve to the matching mirrored packages; external versions are unchanged. The isolated run used same-host-version temporary binaries (0.25.10 repository build/budget; 0.28.2 Vite), with no dependency/config workaround committed.
• Unlike the earlier Desktop blockage recorded on the fork, this run's bounded native build probe passed. In /Users/wangyeyu/Desktop/vRealTime, native npm run build:conformance completed without ESBUILD_BINARY_PATH override, then the official server-resume-replay-v1, server-resume-principal-v1 and server-resume-rejection-v1 each passed all four cases through the built CLI, fullSuite incomplete.
• git diff --check: passed. No separate lint/format script is configured. Python, standalone Workers and production SDK pack/consumer/release dry-run were not rerun for this conformance migration; actual conformance tarball validation was run. Hosted CI is separate evidence. No package published.

Unsure About

• The original design choices remain reviewable: explicit discard-ACK fixture prerequisite rather than a protocol MUST; public ACK state-application receipt; bound vs unbound refusal numbering; no invented bound-history close code or prohibition on ready-before-failure.
• A foreign asynchronous SDK must provide its own public ACK-application completion before confirming receipt. Snapshot/drain are trusted finite instrumentation, not private-state inspection, dishonest-driver detection, arbitrary-work supervision or process-tree isolation.
• The third hello probes a closed session without replaying old application messages. This does not implement client retry/RESUME_FAILED lifecycle or durable side-effect recovery.
• Full bidirectional/automatic recovery, expiry, capacity eviction, lost tool results, Python driver and the remaining full suite are still out of scope. No production defect was found requiring a separate repair.

Implementation Order and Acceptance — #17

The current upstream checklist was re-read. Permissions remain read-only, so upstream issue text/checkmarks were not modified. Checked subitems mean migrated and locally verified, upstream PR pending merge; creating this PR does not mean the increment is already on main. The original fork Draft is historical review context and remains open.

• 引入 spec: Language-neutral protocol spec and JSON Schemas as the source of truth #16 fixtures、双向恢复、心跳和 binary 场景，再接 python: Thin Python client SDK (vrealtime on PyPI) #18 Python driver。
  • 原 fork Draft Tooling: build, test, CI and size budgets #1 的服务端恢复拒绝／ACK 历史与游标边界净增量已迁移至最新 main 的独立分支；四个原有 case 不扩展范围 — upstream #48, migrated/locally verified, upstream merge pending.
  • 迁移后真实 wire 正负／重传／清理、feat(conformance): verify normal server resume and replay #46/feat(conformance): verify resume authentication and principal isolation #47 及当前 main 全部 profile、实际 tarball 仓库外验收 — upstream #48, 168 conformance tests; original fork Draft #1 retained as review history.
  • 完整双向恢复、恢复过期、容量耗尽、丢失工具结果及 Python driver。
• Merge this upstream PR and verify the increment exists on main.
• Full conformance: Black-box conformance suite for clients and servers #17 acceptance.

#35–#47 are merged at this migration baseline. No other merged PR or original fork code branch was edited; no broad parent or issue was marked complete.