Cache protocol manifests and recover retired-page live streams

[patrickleet]

Cause and fix

Every verified-principal query/subscription constructed a projection request seed that rebuilt the entire selected client manifest. Native sampling of Forge identified manifest projection lowering on that path; a trivial authenticated query cost about 1.1 seconds.

Retain the exact selected export built by the engine and cache its immutable manifest in an export-owned Arc/OnceLock. Clones share metadata; public manifest callers receive independent copies. No global cache and no actor, session, token, row, preset value or authorization decision caching. Principal/surface selection, preset validation, scope HMAC, issuance time and visibility checks remain per request.

Targets v5 at 6217944, which is the current Forge pin and open PR227 baseline. No application generation/schema contract changes intended.

Validation

• Full framework library: 1052 passed, 0 failed, 3 explicit ignored.
• HTTP GraphQL protocol, identity and causal transport: 43 passed, 0 failed.
• New tests: concurrent reuse, independent mutable returns, selection/limits isolation, fresh engine isolation, and repeated actual protocol accumulators sharing metadata while releasing request authority.
• Forge runner rebuilt; retained local gateway restarted without data reset. Same-route browser timing checks include successful sign-in and retained-data rendering. The older gateway.live.mjs fixture expects a Workspaces heading, while the current dashboard says Repositories; that fixture failed and was not weakened. Independent current-dashboard SSR/hydration/reload assertions passed.
• rustfmt on changed files and git diff --check passed.

Measured result

Same authenticated user and routes in the retained local Forge stack:

Warm document DOM-ready	Before	After
Dashboard	3140ms	116ms
Personal repository plus default-ref redirect	7445ms	291ms
Organization People	3350ms	192ms
ChangeSets	4123ms	97ms

Three direct authenticated GraphQL queries: 1143/1135/1072ms before; 22/15/14ms after. Observations are not timing assertions or SLA claims. The first repository load after development restart still took 18.7 seconds; cold development cost remains documented separately.

No user-facing copy changes. See docs/protocol-manifest-reuse.md for scope and evidence.

Retired-page live ownership recovery (c3040a2)

Forge repository creation exposed a second measured client defect: a preparation snapshot stream started before the old creation page retired its shared relationship ownership. Confirmed records advanced while root membership remained fenced forever. Preserve rejection of the old queued frames, but reopen only the receiver blocked by that retired owner with a fresh stream start. Still-active owners, scope fences, stale callbacks and unrelated retained layout subscriptions remain intact. Recovery is bounded by the retirement transition, not every blocked frame.

• Regression failed before implementation (expected 3 receivers, received 2); original empty-root safety assertions retained. Tests cover fresh confirmed root membership, discarded old callbacks, active-owner fencing, single recovery, unrelated layout continuity and disposal.
• All JS tests: 403 passed, zero failures/skips (node --test tests/*.test.mjs from js).
• TypeScript and generated TypeScript: npm --prefix js run check passed. git diff --check passed.
• Unchanged Forge repository-creation.live.mjs passed actual creation, readiness without refresh, reload, explicit Open repository click and final navigation for creation-proof-1790025124816. This is not an automatic redirect.
• No application polling/reload workaround, no disabled optimism/fences, no reset, no diagnostic instrumentation retained.

See docs/live-retired-owner-handoff.md. Forge adopts exact c3040a2 in its existing PR1; this framework PR remains unmerged.

Reload delivery follow-up

Commit 6579a5bc fixes a startup/reload failure found during retained Forge inventory verification. A typed ApplicationReloading error now maps to retryable retain-and-stop at both service admission paths: NAK exact delivery and surface the error to the host's bounded retry. Real permanent business rejections retain their existing settlement. HTTP reports503. No lifecycle gate bypass, blanket Stop policy, event discard or cursor reset.

Validation: cargo test -p distributed --lib --features http,metrics —816passed,0failed (40.20s), including reload→NAK/stop→activation→same-event success and permanent business rejection classification. General infrastructure-outage NAK backoff is unchanged and remains a separate follow-up.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: ca6a0655-4f2a-4733-8341-405a692c9ff6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}