Fix findings from a full source review (core 0.3.1, actioncable 0.2.4, client 0.4.3)

[jpcamara]

Applies the HIGH findings and the important MEDIUMs from a full src review of all components (Rust ext, ActionCable concern, TS client, packaging, demo). Findings that live on the open PRs (#33 live-maps, #38 gap-strike) are intentionally NOT here.

Core — Rust (yrby 0.3.1)

update_ready? is now exact — fixes silent ack-and-drop of real content (empirically reproduced).
It only checked the per-client clock lower bound, but yrs's integration gate also requires origin/right-origin/parent blocks (routinely other clients') and post-Skip blocks in merged updates. A cross-client-origin delta on a server missing that client's content passed ready?; update_advances? then misread the parked result as an already-applied retry (pending doesn't move a state vector) → acked :applied and dropped. Now: trial-integration on a probe seeded with the doc's integrated state (clock check kept as a cheap pre-filter). update_advances? also gained defense in depth: a parked update reports as advancing, never a duplicate. Regression-tested with a new real-Y.js CrossClientOrigin fixture + a merged-Skip-gap Rust test.

read_text process-deadlock. A chained temporary held one read txn while acquiring a second; yrs's write-preferring lock deadlocked reader-vs-writer inside nogvl (uninterruptible — kill -9 territory). Single txn now, plus a threads-vs-writers hammer test.

TOCTOU in gap-free encoding. has_pending + encode ran in separate txns; a concurrent gappy apply between them could serve pending anyway. One txn now.

Perf: update_advances? skips its full O(doc) probe when the update carries blocks beyond the doc's SV — the common novel-update case no longer rebuilds the doc. read_xml: Lexical linebreak/tab emit \n/\t (no more "foo⏎bar" → "foobar").

ActionCable concern (yrby-actioncable 0.2.4)

• Retries re-broadcast. Record-then-crash-before-broadcast previously left live subscribers permanently stale: the retry was settled :applied without distributing, and nothing else could reach them. Idempotent apply makes the duplicate free.
• Missing document key fails closed (Y::Error) instead of silently recording under nil, broadcasting to a dead stream, and still acking (AnyCable fresh-instance + forgotten key).
• Floor → yrby >= 0.3.1 (the ack-and-drop fix lives in core).

Client (yrby-client 0.4.3)

• rejected() handler — an auth-rejected subscription surfaces via onError + tears down, instead of hanging at "connecting" forever while silently queueing edits.
• Awareness content validation — a partially-malformed payload previously mutated awareness entry-by-entry with no event fired; now dry-run-validated (incl. trailing bytes inside the blob) before apply.
• bfcache presence restore — pagehide stashes local presence, pageshow(persisted) restores it; a restored page no longer rejoins as a ghost.
• Guarded transport sends — sync throws and promise rejections (@anycable/web) surface via onError; reliable frames stay queued.
• CJS TypeScript types — dist/cjs/*.d.ts + per-condition types exports; fixes TS1479 for CJS consumers under node16 resolution.

Packaging / demo

• yrby no longer ships the yrby-decoder gem's files (frozen duplicate could shadow the standalone gem across the load path — was latent in published 0.3.0).
• Cargo.lock ships in the source gem (build the crate graph CI tested).
• Demo: the unauthenticated audit-control endpoint (history wipe + delay injection) is no longer mounted in production.

Verification

• Rust: 27 tests, clippy -D warnings + rustfmt clean
• Ruby: 95 runs / 235 assertions, rubocop clean — includes the cross-client-origin resync test, fail-closed key test, retry re-broadcast tests, and the read_text deadlock hammer
• Client: 50 tests, tsc --noEmit clean
• The ack-and-drop bug was reproduced against 0.3.0 before fixing and its repro is now a permanent fixture/regression

🤖 Generated with Claude Code

[jpcamara]

Verification addendum — every claim re-audited

Each fix's regression test was run against the original buggy code where feasible:

Fix	Discrimination proof
read_text deadlock	Old code: thread hammer deadlocked so hard the process survived SIGTERM for 7+ min (threads in uninterruptible nogvl), needed SIGKILL. Fixed: passes in 4ms.
Ack-and-drop (update_ready?)	Reproduced empirically pre-fix; cross-client-origin + merged-Skip fixtures fail on old semantics by construction.
Awareness half-application	Old code: exactly the 2 new tests fail — "the valid entry was NOT half-applied" proves the partial-mutation behavior existed.
TOCTOU (integrated_update)	Honest negative: 20k racing iterations could not hit the ns-wide window even against the buggy two-txn form. The concurrency test is documented as a contention net; the guarantee is structural (single transaction).

Added in the follow-up commit: bfcache tests (previously zero coverage, via a window shim), gemspec packaging regressions, and the Rust contention net. Totals: Rust 28 / Ruby 98 / client 52, clippy+fmt+rubocop clean.

e2e on this branch: CI ran the full demo battery (durability, 4-browser, collab, Falcon, cross-process, AnyCable) — green. Locally ran the CI-excluded suites: crash_recovery ✅, all 4 audit scenarios ✅, stress 3/3 ✅ (~20k msgs, 0 server errors; one cold-start connection flake on the very first run, not reproducible).

Known remaining caveat: the linebreak/tab extraction test uses a structure modeled on @lexical/yjs storage, not bytes captured from a live Lexical editor.

[jpcamara]

Caveat closed — and it caught a real bug. Driving a live Lexxy editor (agent-browser: type foo, real Shift+Enter keystroke, type barbaz) and running read_xml on the captured durable state returned "foobarbaz" — the hand-built linebreak test had modeled the structure wrong. A Lexical LineBreakNode is an embedded Y.Map { __type: "linebreak" } (same shape as the per-text-node metadata maps the walker deliberately skips), not an XmlText child.

Fixed the Out::YMap arm to consult __type (linebreak → \n, tab → \t, metadata stays silent), replaced the hand-built test with the real structure, and added fixtures/lexical_linebreak.bin — ground-truth bytes from the live editor — asserting "foo\nbarbaz". Verified end-to-end via Doc#read_xml on the captured bytes. Rust 29 / Ruby 98 / clippy+fmt clean.