protocol: name every arm instead of letting absence mean one #342

Merged

natsukium merged 1 commit from issue-327 into main 2026-09-22 10:26:27 +09:00

Conversation 0 Commits 1 Files changed 20 +471 -200

natsukium commented 2026-09-22 04:57:03 +09:00

Owner

Copy link

Closes #327

In proto3 a field a peer omitted and a field a peer never knew are the
same bytes, so any union whose unset state carries meaning reads an arm
added after the freeze as whatever the schema nominated as its default.
An old decoder then performs a real operation in place of the one it
could not understand. The first public baseline is the last point at
which naming every arm is free, so all four remaining cases get named
arms: RetargetTarget.carrier gains default_local, SessionAttach's id and
id_prefix become a target oneof at their current numbers, and
GridThemeColor takes the set/reset shape GridPaletteColor already had.
OpsStop.mode already had if_empty; only its decoder defaulted.

Rejected: keeping unset as the default arm, which reads well because the
common case costs no bytes and a producer writing nothing gets the safe
posture. It makes a frame the decoder could not understand identical to
one that meant the default, and those two want opposite answers; it also
puts the default in the reader, so peers built a minor apart disagree
about what was asked while both decode cleanly. SwitchScope already
refused an unset union, and one policy across the families is what keeps
a reader from having to remember which family is which.

Refs #327.

Review

pi luna and sol reviews on the pre-rebase commit both passed (non-blocking findings folded: BREAKING.md now describes the one-sided skew, and the stale ThemeColor.rgb doc comment is gone). Rebased onto #340/#341; just proto-compat, fmt-check, prose-check, clippy and the Windows cross clippy pass locally. The workspace test run shows only the pre-existing socket-path-length failures on this machine (felis-cli cli_bridge lost-daemon / relative-cwd, felis-daemon racing teardown / parked peer).

The Criterion regression gate is a known-flaky bench job and fails on every PR.

Closes #327 In proto3 a field a peer omitted and a field a peer never knew are the same bytes, so any union whose unset state carries meaning reads an arm added after the freeze as whatever the schema nominated as its default. An old decoder then performs a real operation in place of the one it could not understand. The first public baseline is the last point at which naming every arm is free, so all four remaining cases get named arms: RetargetTarget.carrier gains default_local, SessionAttach's id and id_prefix become a target oneof at their current numbers, and GridThemeColor takes the set/reset shape GridPaletteColor already had. OpsStop.mode already had if_empty; only its decoder defaulted. Rejected: keeping unset as the default arm, which reads well because the common case costs no bytes and a producer writing nothing gets the safe posture. It makes a frame the decoder could not understand identical to one that meant the default, and those two want opposite answers; it also puts the default in the reader, so peers built a minor apart disagree about what was asked while both decode cleanly. SwitchScope already refused an unset union, and one policy across the families is what keeps a reader from having to remember which family is which. Refs #327. ## Review pi luna and sol reviews on the pre-rebase commit both passed (non-blocking findings folded: BREAKING.md now describes the one-sided skew, and the stale `ThemeColor.rgb` doc comment is gone). Rebased onto #340/#341; `just proto-compat`, fmt-check, prose-check, clippy and the Windows cross clippy pass locally. The workspace test run shows only the pre-existing socket-path-length failures on this machine (felis-cli cli_bridge lost-daemon / relative-cwd, felis-daemon racing teardown / parked peer). The Criterion regression gate is a known-flaky bench job and fails on every PR.

natsukium added 1 commit 2026-09-22 04:57:03 +09:00

protocol: name every arm instead of letting absence mean one ... d0fc665ec8

In proto3 a field a peer omitted and a field a peer never knew are the
same bytes, so any union whose unset state carries meaning reads an arm
added after the freeze as whatever the schema nominated as its default.
An old decoder then performs a real operation in place of the one it
could not understand. The first public baseline is the last point at
which naming every arm is free, so all four remaining cases get named
arms: RetargetTarget.carrier gains default_local, SessionAttach's id and
id_prefix become a target oneof at their current numbers, and
GridThemeColor takes the set/reset shape GridPaletteColor already had.
OpsStop.mode already had if_empty; only its decoder defaulted.

Rejected: keeping unset as the default arm, which reads well because the
common case costs no bytes and a producer writing nothing gets the safe
posture. It makes a frame the decoder could not understand identical to
one that meant the default, and those two want opposite answers; it also
puts the default in the reader, so peers built a minor apart disagree
about what was asked while both decode cleanly. SwitchScope already
refused an unset union, and one policy across the families is what keeps
a reader from having to remember which family is which.

Refs #327.

Assisted-by: Claude Code

natsukium force-pushed issue-327 from d0fc665ec8 to 9093211109 2026-09-22 09:47:10 +09:00 Compare

natsukium merged commit cba1efc162 into main 2026-09-22 10:26:27 +09:00

natsukium deleted branch issue-327 2026-09-22 10:26:28 +09:00

natsukium referenced this pull request from a commit 2026-09-22 10:26:28 +09:00

protocol: name every arm instead of letting absence mean one (#342)

natsukium referenced this pull request 2026-09-22 14:37:30 +09:00

[v0.1/P1] Final interface simplification audit before public freeze #326

natsukium referenced this pull request 2026-09-22 15:13:09 +09:00

protocol: split the refusal into an attach half and a spawn half #345

Commenting is not possible because the repository is archived.

Reviewers

No reviewers

Labels

Clear labels   

priority/P0

Must be resolved before the v0.1.0 tag

  

priority/P1

Must be settled before the first public contract freezes

  

priority/P2

Explicitly deferred until after v0.1.0

  

release/v0.1.0

Work tracked for the first tagged release

  

status/blocked

Cannot start now: waits on an upstream release, another issue, or a recorded revisit trigger

  

status/planned

Triaged with a source-grounded plan and a passed pi review; ready to implement

  

type/bug

Shipped behavior that contradicts the docs or the code's own intent; needs a product code change

  

type/design

An open scope or trade-off question; needs a recorded decision in the owning explanation doc before code

  

type/test-gap

Documented or reviewed behavior that no test pins; usually split from a review finding, needs no product code change

  

type/tracker

Parent issue that tracks child work

No labels

priority/P0

priority/P1

priority/P2

release/v0.1.0

status/blocked

status/planned

type/bug

type/design

type/test-gap

type/tracker

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

natsukium/felis!342

No description provided.