natsukium/felis
Archived
Watch
1
Code Issues 23 Pull requests Projects Releases 6 Packages Wiki Activity Actions

[v0.1/P1] Do not silently drop out-of-range Grid RowDelta rows #304

Closed
opened 2026-09-21 12:08:09 +09:00 by natsukium · 1 comment
natsukium commented 2026-09-21 12:08:09 +09:00
Owner
Copy link

Problem

felis-client-core silently drops a GridMsg::RowDelta when row >= MAX_SHADOW_ROWS in ShadowScreen::write_row.

This avoids an allocation, but a valid protobuf frame with an out-of-range row can leave the client shadow diverged from the daemon without a protocol error, resync request, or user-visible indication. The same path currently combines resize-race tolerance with corruption handling.

Proposed resolution

Separate expected resize races from invalid wire data. For an out-of-range row, either:

  • reject the frame/connection as corruption, or
  • request a complete shadow resynchronization and make the recovery visible to the driver.

Keep the legitimate resize overshoot behavior for rows within the documented race bound, but do not silently discard rows beyond the protocol's admitted limits.

Acceptance criteria

  • The behavior for an out-of-range RowDelta.row is specified in docs/reference/ipc.md and the row-codec/renderer documentation as appropriate.
  • A test proves that an invalid row cannot silently leave the shadow in an unreported divergent state.
  • Resize-race tests continue to prove that valid rehydrate/damage bursts are accepted.
  • Receiver-side allocation limits remain enforced.

Sources

  • crates/felis-client-core/src/shadow.rs (write_row)
  • crates/felis-protocol/src/messages.rs (grid limits)
  • docs/reference/ipc.md (semantic limits and corruption behavior)
## Problem `felis-client-core` silently drops a `GridMsg::RowDelta` when `row >= MAX_SHADOW_ROWS` in `ShadowScreen::write_row`. This avoids an allocation, but a valid protobuf frame with an out-of-range row can leave the client shadow diverged from the daemon without a protocol error, resync request, or user-visible indication. The same path currently combines resize-race tolerance with corruption handling. ## Proposed resolution Separate expected resize races from invalid wire data. For an out-of-range row, either: - reject the frame/connection as corruption, or - request a complete shadow resynchronization and make the recovery visible to the driver. Keep the legitimate resize overshoot behavior for rows within the documented race bound, but do not silently discard rows beyond the protocol's admitted limits. ## Acceptance criteria - The behavior for an out-of-range `RowDelta.row` is specified in `docs/reference/ipc.md` and the row-codec/renderer documentation as appropriate. - A test proves that an invalid row cannot silently leave the shadow in an unreported divergent state. - Resize-race tests continue to prove that valid rehydrate/damage bursts are accepted. - Receiver-side allocation limits remain enforced. ## Sources - `crates/felis-client-core/src/shadow.rs` (`write_row`) - `crates/felis-protocol/src/messages.rs` (grid limits) - `docs/reference/ipc.md` (semantic limits and corruption behavior)
natsukium commented 2026-09-21 13:02:46 +09:00
Author
Owner
Copy link

Direction agreed 2026-09-21 after three sol design-review rounds (final verdict PASS). Full plan and batch order: see the comment on #12.

  • #304 / #315 / #308 — one policy: a daemon-impossible Grid value returns
    ShadowError and closes only that attachment; reconnect/rehydrate recovers.
    Resize-race tolerance is kept only for row indices/widths within
    MAX_GRID_ROWS / MAX_GRID_COLS. Unresolved cluster/hyperlink handles in a
    decoded row are corruption; degraded rendering is removed. Id 0, over-cap
    ids and over-length text are rejected before allocation.
Direction agreed 2026-09-21 after three `sol` design-review rounds (final verdict PASS). Full plan and batch order: see the comment on #12. - **#304 / #315 / #308** — one policy: a daemon-impossible Grid value returns `ShadowError` and closes only that attachment; reconnect/rehydrate recovers. Resize-race tolerance is kept only for row indices/widths within `MAX_GRID_ROWS` / `MAX_GRID_COLS`. Unresolved cluster/hyperlink handles in a decoded row are corruption; degraded rendering is removed. Id 0, over-cap ids and over-length text are rejected before allocation.
Commenting is not possible because the repository is archived.
No Branch/Tag specified
Branches Tags
main
v0.1.0-rc.9
v0.1.0-rc.8
v0.1.0-rc.7
v0.1.0-rc.6
v0.1.0-rc.5
v0.1.0-rc.4
v0.1.0-rc.3
v0.1.0-rc.2
v0.1.0-rc.1
Labels
Clear labels   
priority/P0
Must be resolved before the v0.1.0 tag

  
priority/P1
Must be settled before the first public contract freezes

  
priority/P2
Explicitly deferred until after v0.1.0

  
release/v0.1.0
Work tracked for the first tagged release

  
status/blocked
Cannot start now: waits on an upstream release, another issue, or a recorded revisit trigger

  
status/planned
Triaged with a source-grounded plan and a passed pi review; ready to implement

  
type/bug
Shipped behavior that contradicts the docs or the code's own intent; needs a product code change

  
type/design
An open scope or trade-off question; needs a recorded decision in the owning explanation doc before code

  
type/test-gap
Documented or reviewed behavior that no test pins; usually split from a review finding, needs no product code change

  
type/tracker
Parent issue that tracks child work

No labels
priority/P0
priority/P1
priority/P2
release/v0.1.0
status/blocked
status/planned
type/bug
type/design
type/test-gap
type/tracker
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
natsukium/felis#304
No description provided.