Feat/retire aimdb ws protocol

[lxsaah]

Retire aimdb-ws-protocol — every transport speaks AimX

Deletes the WebSocket-only wire protocol and converges the entire workspace on
the AimX-v3 envelope (aimdb-core::session::aimx). One codec, one error
mapping, one client demux — the WebSocket stack and the browser bridge now ride
the same session engine as UDS/serial/TCP and aimdb-client.

Implements design 047 (docs/design/047-retire-ws-protocol-converge-on-aimx.md).

Why

The workspace shipped two wire protocols for one feature. Every capability —
snapshots, acks, writes, queries, subscribe — existed twice, with two codecs and
two error vocabularies, plus a hand-rolled ~835-line browser demux duplicating
run_client. Both protocols already rode the same session engine, so the fork
was pure duplication.

Convergence removes a 353-line protocol crate, a 507-line codec, two error
mappings, and the browser demux, against a small additive AimX extension
(wildcard subscribe + two result-shape changes) that every transport now
inherits (CLI watch 'temp.#', MCP wildcard reads, future serial/TCP browsers).

What changed

Core (additive AimX extension)

• Wildcard / multi-record live subscribe. A pattern containing #/*
  matches the (builder-frozen) record set once at subscribe time, merges the
  matched records' update streams under one subscription id, and emits one
  snapshot per matched record on open.
• topic_match module — MQTT-style matching over dot-separated keys, shared
  by the core wildcard path and the WS fan-out bus.
• SubUpdate item type — subscription streams now carry
  { topic: Option<Arc<str>>, data, skipped } so each event names the concrete
  record that fired and threads buffer-lag counts through for drop detection.
• Wire additions: optional topic on event, sub on snap, an explicit
  subscribed ack frame (WS only; UDS/serial/TCP stay ack-implicit).
• Query/list result shapes: record.query → { records: [{topic, payload, ts}], total } (canonical QueryRecord row); RecordMetadata gains
  schema_type and entity.
• Version-gated hello — protocol bumped 2.0 → 3.0; an incompatible or
  version-less peer is refused at the handshake (RpcError::VersionMismatch).
• Loss accounting — buffer lag folds into skipped; the server pump does
  seq += skipped + 1; the client demux recovers loss as a seq shortfall.

WebSocket connector

• Speaks AimX on the transport (one codec blob per WS text frame — no extra
  framing). Dispatch converged on record.query / record.list.
• The fan-out bus carries (topic, payload) as Arc-shared updates; the
  per-connection codec envelopes each event (O(1) fan-out preserved).
• record.query falls back to the persistence-registered QueryHandlerFn when
  no custom handler is plugged in; record.list rows are stamped with schema
  names from the connector's StreamableRegistry.
• Removed: WsCodec + id↔topic maps, split_multi_topic, the pre-serialized
  Data-frame broadcast, with_raw_payload, ClientConfig::topic_routed_subs.

Browser bridge (aimdb-wasm-adapter::ws_bridge)

• Rewritten on run_client + ClientHandle over a web_sys::WebSocket-backed
  Connection/Dialer (single-threaded wasm Send/Sync wrappers). Reply and
  subscription correlation now exists exactly once, in core.
• JS API preserved: write, query, listTopics, onStatusChange, offline
  queue, and reconnect are all delegated to the engine.

Deletions

• aimdb-ws-protocol crate, WsCodec, protocol.rs shims, dead aimdb-client
  re-exports.

Breaking changes

• Wire protocol 2.0 → 3.0 — pre-3.x clients are refused at hello. Browser
  clients on the old ws-protocol wire must ship the rebuilt bridge; they fail
  closed against a 3.0 server.
• Removed builder knobs: with_raw_payload, ClientConfig::topic_routed_subs.
• record.query result shape changed from {values:[{record,value,stored_at}], count} to {records:[{topic,payload,ts}],total}.

Lands as one branch in a release already flagged protocol-breaking, one commit
per work item (no stacked PRs).

Testing

make check and make all green. New/updated coverage: AimX codec roundtrip
suite (frames + splice byte-for-byte), topic_match tests, topic_leaf
dual-separator, version-compatibility matrix, query_handler_shape,
UDS handshake_version, rewritten WebSocket e2e.rs (subscribe ack, wildcard
fan-out, late-join), and fan-out encode benchmarks.

Known limitations (accepted)

• Auto-subscribe under engine demux — server-seeded subscriptions carry
  server-chosen sub ids (counted down from u64::MAX); a run_client-based
  consumer drops events for ids it never issued, so engine clients (including the
  new bridge) subscribe explicitly. No user-visible change (the pro hub already
  subscribes by exact name).
• Dynamic record membership — wildcard matches are resolved once at subscribe
  time against the builder-frozen record set; MQTT-style late registration is
  deferred until core grows runtime registration.

[thaodt]

The previous correctness blockers are fixed: snapshot loss is now observable through the public API, request-ID exhaustion is refused rather than wrapped, pending calls are canceled in O(1), the in-flight WASM dial is interruptible, terminal subscription errors are preserved and the browser tests are running successfully in CI.

Again im requesting changes for one confirmed migration blocker: WsBridge.maxOfflineQueue is no longer a hard bound during an initial pending dial or reconnect backoff, despite the preserved public option and design contract.

I also left:

• a security-contract question about the newly automatic persistence query and full record.list exposure
• two lower-priority WASM findings covering synchronous constructor failure and frame-byte budgeting
• a few documentation/counting corrections.

I intentionally did not charge the generic duplicate-subscription-ID issue to this PR because the retired ws codec could already trigger it by reusing the synthesized ID for a repeated topic subscription. Likewise, the unchecked serializer splice follows design 048's explicitly documented trusted-payload contract and is not being treated as a blocker here.

[thaodt]

run_client uses an unbounded command channel, while bound_offline_queue() runs only once before reconnect backoff. Commands accepted during an initial pending dial or during that sleep can exceed the configured cap; if the next dial succeeds, drive_connection flushes them without another trim.

I reproduced max_offline_queue = 2 returning from backoff with 102 queued commands. The retired bridge enforced this limit at enqueue time and design 047 says the JS offline-queue behavior is preserved.

Please enforce the cap continuously while offline, define whether the oldest or newest commands are dropped, and cover both a blocked initial dial and reconnect backoff.

[lxsaah]

Fixed: max_offline_queue is now enforced in ClientHandle::enqueue. The handle holds an MPMC receiver clone and trims to cap - 1 before the send, so the bound also covers the initial pending dial and the backoff sleep, the command being enqueued is never the one dropped and the reconnect_after trim is gone.

The drop policy is documented as oldest-first and is caller-visible — a trimmed call resolves Internal, a trimmed subscribe ends its stream — with tests for both the bound and the caller-visible drop.

[thaodt]

Moving the trim to ClientHandle::enqueue fixes the original initial-dial/backoff bypass.

Two hard-bound cases still remain I think:

1. With max_offline_queue = 0, saturating_sub(1) produces keep = 0, the empty queue is not trimmed and the following try_send retains one command. A focused regression test observes cmd_rx.len() == 1. The retired wasm bridge retained no commands when the configured cap was zero.

2. ClientHandle is cloneable, but len/trim followed by try_send is not one atomic admission operation. Concurrent handles can all observe room before sending. With cap 1, a focused multi-producer test reproducibly left a queue length of 2.

Could we serialize the trim-and-send admission across handle clones, or use a genuinely bounded queue with explicit eviction semantics? Please also cover cap 0 and concurrent cloned handles in the regression tests.

[lxsaah]

Took your second suggestion. The command channel is now async_channel::bounded and enqueue uses force_send. Cap 0 is clamped to 1 rather than honored, since every command reaches the engine through this channel and a zero-capacity one could never deliver. The default also drops from usize::MAX to 256 as the ring is preallocated, with regressions for the clamp at both ends.

[thaodt]

The bounded command queue can evict the only CancelCall for an RPC that is already in pending, reopening the pending-call leak under saturation.

CancelOnDrop sends CancelCall through the same force_send queue as ordinary calls and writes, while enqueue discards the evicted item. I reproduced this deterministically with capacity 1, let the engine consume a call and insert its reply sender into pending, queue its CancelCall, then enqueue a write before the engine can receive again. The write evicts the cancellation after the engine sends the write, the canceled call's reply sender is still retained in pending.

The existing 1000-cancellation regression uses an unbounded channel, so it cannot cover this failure mode.

Since this is a correctness hole in the bounded-queue change itself, I think the specific eviction case should be fixed in this PR rather than deferred. A contained fix could either make cancellation non-evictable or detectan evicted CancelCall and trigger an engine-side prune of canceled pending senders, the reply sender already exposes is_canceled(). Please also add a saturated capacity-1 regression.

If the preferred long-term solution requires a larger control/data queue redesign, that redesign can be tracked in a follow-up issue, but the current cancellation-loss should be closed before merge.

[lxsaah]

Fixed in this PR with both halves of your suggestion combined: CancelOnDrop now uses a plain try_send so a cancellation never evicts caller work and enqueue detects an evicted CancelCall and raises a prune signal that wakes the engine to sweep pending by is_canceled(). Also added a saturated capacity-1 end-to-end regression reproducing your exact interleaving (call filed in pending, its queued cancellation evicted by a write) and verified it fails against the pre-fix behavior.

[lxsaah]

Thanks, as I am on leave this week - I'll need some time to get back to it.

[lxsaah]

@thaodt I implemented the changes and the PR is ready for review again. Thanks!

[thaodt]

@thaodt I implemented the changes and the PR is ready for review again. Thanks!

hey @lxsaah sorry I missed your ping. I'll take a look tmr morning, provided this doesn't block your work. Otherwise, plz go ahead and merge it. We can handle any additions later in a separate PR.

[lxsaah]

@thaodt I implemented the changes and the PR is ready for review again. Thanks!

hey @lxsaah sorry I missed your ping. I'll take a look tmr morning, provided this doesn't block your work. Otherwise, plz go ahead and merge it. We can handle any additions later in a separate PR.

no issue! take your time

[lxsaah]

@thaodt I implemented your suggested changes. Let's go for one additional review round, but add follow-up issues for the remaining tasks. What do you think?

[thaodt]

Hey I've jusst completed one final review pass.

Most of the previous concerns now look addressed, however I found two remaining code issues, see my inline comments.

I think these should be addressed before merge. I also found 2 documentation migrations that are suitable for linked follow-up issues.
Im fine with tracking those documentation sweeps as follow-up issues, provided they are linked here.

[thaodt]

The MQTT query-grammar fix was applied to WsSession, but the generic AimxDispatch still maps an omitted record.query.name to "*".

Under the new grammar, * covers exactly one dot-separated segment, only # means all records. I reproduced this through the real generic dispatch. {} reached the registered query handler as name == "*", while the ws dispatch now sends "#".

This makes the same AimX request behave differently over WebSocket versus UDS/serial/TCP and silently omits nested records on the generic transports. Please change this default to "#" and add a transport-neutral regression.

[lxsaah]

Fixed. Both the generic AimxDispatch and the WS dispatch now default an omitted record.query.name through the shared remote::QUERY_ALL_PATTERN ("#") constant and a transport-neutral regression drives the real generic dispatch (Dispatch::open → Session::call) asserting the handler receives #.