feat: prototype embedded sync runtime

[thorgas]

Status

Warning

Draft only. This is an experimental local protocol workflow, not usable sync support. Do not merge, release, or advertise it yet.

Summary

• temporarily copies the Apache-2.0 protocol/client crates; the canonical source remains private
• atomically persists bounded outbox/outcomes, optimistic/confirmed records, cursor, scope and opaque checkpoint in embedded SurrealDB
• uses native content-bound fingerprints and the bounded canonical-CBOR surrealdb-sync/1 codec
• adds a bounded application-owned HTTP adapter with whole-operation timeout, content-type checks and fail-closed response limits
• adds a single-flight scheduler with injected connectivity, coalesced triggers, bounded full-jitter transient retry, auth/terminal halt and periodic pull
• adds optional WebSocket invalidation hints with fresh application-supplied URL/ticket per connection; hints only wake HTTP pull and never define ordering or durability
• defaults to periodic HTTP pull, latches terminal failures until explicit recovery, isolates stop/restart generations, and bounds token/codec work as part of the request deadline
• requires HTTPS/WSS except an explicit loopback-only development escape hatch; client-side WebSocket frame closing remains defense-in-depth behind an authority/proxy frame limit
• replays private authority accepted/pull/reset vectors through embedded SurrealKV close/reopen
• keeps the private boundary: no Quint model, authority, wiki, experiments or comprehensive checker suites are copied

The direct ciborium 0.2.2, sha2 0.10.9 and other runtime pins match versions used by the pinned upstream SurrealDB workspace.

Verification

• cargo test --workspace: 53 passed, one authenticated-server test ignored
• ./scripts/verify-core.sh: Rust fmt, warning-denied Clippy, workspace tests, iOS simulator target and Android NDK target passed
• package build/typecheck/Vitest/release check: 7 files and 39 tests passed; package is ready to pack
• iOS device/simulator XCFramework and Android arm64/x86_64 Release artifacts regenerated successfully
• RN 0.86 standard Harness E2E: 13/13 passed on iPhone 17 Pro/iOS 26.1 and 13/13 on Pixel 9/Android 16, including offline scheduler resume and pull-only invalidation
• dedicated SurrealKV process restart, local-authority, 3.2.1-to-3.2.4 migration and 64-cycle churn traces previously passed on iOS and Android
• private checker: 41 deterministic Quint tests, fixed-seed simulation, TLC, all three expected broken-model counterexamples, Rust/Quint Connect/conformance and export verification passed
• private authority live matrix: 22/22 passed across SurrealKV and RocksDB, including random checkpoint issuance and lost-response retry

Use Node 22.22.0 and pnpm 11.5.0. Rock currently prints non-fatal TypeScript type-stripping diagnostics while discovering its config.

Still missing / release gates

• no deployed authenticated authority; the local gateway still uses a fixed development principal/scope
• the private authority has durable random checkpoint issuance, but Cloud/provider transaction, retention, failover, row-volume, alerting and revocation exercises remain unverified
• copied runtime crates need a long-term single-source/public-export mechanism
• scheduler integration still needs a real application's lifecycle, connectivity source and token refresh policy
• structured/numeric record-ID keys that the current RN tag parser cannot reproduce fail closed
• Harness functional runs are Debug/Metro; a normal bundled Release functional runner and repeated physical-device RSS baselines are still required
• GitHub Actions are queued because the private account cannot currently allocate runners

See docs/SYNC_RUNTIME_HANDOFF.md for exact boundaries and commands.

[thorgas]

Lifecycle follow-up is pushed through 790edd8 (implementation df9b6c4, permanent device E2E/docs 0412b00). The injected coordinator fails closed outside the active app state, aborts stale refresh work, permits one application-owned refresh per 401/403, and preserves the native durable outbox/checkpoint boundary. The real local-authority suite now passes 2/2 on iOS and 2/2 on Android for offline enqueue, invalid-to-valid token recovery, background stop, foreground catch-up, missed-hint periodic pull, and the existing conflict trace. This remains draft-only, non-releasable prototype work; no production identity provider or deployed authority is included.

[thorgas]

Local durable sync benchmark added and verified on both RN86 native hosts. Implementation: 1a2d738; methodology/results docs: 4a24640. The profile uses persistent app-private SurrealKV and file-backed OP-SQLite (WAL, synchronous=FULL), resets to an identical empty logical state before each enqueue sample, uses 3 warmups + 10 samples, alternates execution order, and verifies matching semantic checksums for a fixed 25-record/25-commit state. First Debug diagnostics: iOS simulator single/10-record sync enqueue medians 12.38/20.35 ms versus SQLite lower bounds 0.27/0.77 ms; Android emulator 4.61/8.30 ms versus 2.14/4.24 ms. These are deliberately not release or end-to-end replication claims; SQLite omits fingerprinting, protocol validation, optimistic reconstruction, and conflict bookkeeping. Commands: benchmark:ios:sync and benchmark:android:sync.