fix: apply multi-child MovableList diffs as moves without losing elements

[zxch3n]

Summary

Fixes two defects in MovableListHandler::apply_delta (crates/loro-internal/src/handler/movable_list_apply_delta.rs). That function is the movable-list path of LoroDoc::apply_diff, revert_to, and UndoManager undo/redo. Both defects were found while cross-checking the loro.js port (#1131, review round 3, B3 and the mixed-operation random matrix).

1. applyDiff that moves several children drops one. Swapping two LoroText children with [{delete: 2}, {insert: ["🦜:" + b.id, "🦜:" + a.id]}] produced {l: ["A"]} instead of {l: ["B", "A"]}. Rotations, reversals, and children moved among scalars could also lose elements or put them in the wrong order.
2. Undo/redo panics. Undo replays the inverse diff through the same handler. Minimal case: [text t2, "s"], two moves that cancel out, Rust diff → apply_diff → undo(). Main hits index - 1 with index == 0: a subtract overflow in debug, and in release/WASM mov(0, usize::MAX) → OutOfBound → .unwrap() panic.

B2 (adjacent delete items dropping a freshly inserted value) was not reproducible in Rust. The public ListDiffItem → DeltaRope conversion merges adjacent deletes. This PR adds Rust and WASM regression tests for that shape anyway, and the new algorithm does not rely on the merge.

Root cause

The old code deferred every delete to the end. It tracked the slots vacated by moved children with ad-hoc index arithmetic (deleted_indices, next_deleted, index_shift) and assumed a moved child's old slot lay behind the current index. Once two or more children moved, or a child was re-inserted before its own delete, the arithmetic went wrong in three ways:

• it deleted a moved child;
• it inserted at the wrong index;
• it underflowed and made an out-of-range mov behind process_replacements(..).unwrap(), which is the undo panic.

Fix

apply_delta now runs in three passes. The invariant is documented in the module docs and in context/movable-list-apply-diff.md.

1. Plan: record the delete ranges in original indices, and decide which deleted children are re-inserted ("claimed"). The lookup follows container_remap as before.
2. Delete the unclaimed elements right to left, so original indices stay valid.
3. Place: walk the delta with a live cursor. Each inserted value goes right after the previous target element. live[cursor..] is always the unplaced claimed children of the current delete gap, followed by the unmoved originals. A retain skips both. A claimed child found before the cursor moves to cursor - 1. Claimed children are located with get_child_index (O(log n)).

Behavior that is kept: container values without a claim create a new child and record the remap. from_move inserts whose child still exists elsewhere are skipped. The O(n) contains_container scan is replaced by the state's child index. The old per-op position updates cost O(#deleted children) each; those are gone.

Validation

• New crates/loro/tests/movable_list_apply_diff.rs: 9 tests.
  • Targeted: the JS swap, rotations, children mixed with scalars (moves left, moves right past retains, into later gaps), child content edited in the same batch, adjacent delete items, and the minimal undo panic.
  • Seeded random tests:
    • Rust diff → apply_diff → undo → redo (64 seeds × root/nested × 4 rounds).
    • Synthesized deltas with multi-child moves and split deletes, then undo/redo across every step (128 seeds).
    • Two-peer mix of local ops, revert-style apply_diff, sync, and undo/redo: no panic, and the peers converge (48 seeds).
  • Against main, 8 of 9 fail. The adjacent-deletes test already passes there, as explained above.
• Review-style matrix (160 seeds × root/nested × 4 segments of 8 random ops, Rust diff → apply → undo → redo):

	pass	apply wrong	undo wrong	redo wrong	error/panic
main	200/320	40	30	1	49
this PR	320/320	0	0	0	0

• cargo test -p loro -p loro-internal: 1188 passed, 0 failed.
• pnpm check (clippy --all-features -D warnings) passes.
• cargo fmt is clean for the changed files. The pre-existing formatting drift in dag.rs, undo.rs, moon_transcode.rs, and shallow_checkout_equal_value.rs is deliberately not included.
• pnpm -C crates/loro-wasm build-dev: vitest 380 passed, including 2 new applyDiff cases in movable_list.test.ts. tsc, deno, bun, and the CommonJS smoke test pass.

Performance

crates/loro/tests/perf_movable_list_apply_diff.rs is an ignored test (cargo test --release -p loro --test perf_movable_list_apply_diff -- --ignored --nocapture). Setup: native release, a 100k-element list, median of 5 samples, then the median across 3 alternating main/PR rounds.

scenario	apply main	apply PR	undo main	undo PR
move child to end	65.5 µs	63.2 µs	98.5 µs	106.3 µs
move child to front	41.3 µs	39.0 µs	95.8 µs	89.7 µs
insert child at tail	36.8 µs	36.4 µs	80.8 µs	79.5 µs
delete 100k scalars	89.4 ms	80.4 ms	343.3 ms	335.2 ms
rotate 1k children	3.75 ms ✗	3.03 ms	17.0 ms	15.5 ms
reverse 1k children	7.56 ms ✗	6.39 ms	15.8 ms	20.1 ms
rotate 5k children	39.2 ms ✗	17.0 ms	109.6 ms	90.5 ms
reverse 5k children	115.4 ms ✗	102.5 ms	108.8 ms	170.1 ms

✗ means main produces a wrong list: rotate loses 1 child, reverse 1k loses 499, reverse 5k loses 2499. The reverse-5k undo rows are therefore not comparable, because main's undo restores a much smaller, already-broken change. A breakdown on this PR shows its undo is dominated by the checkout-based diff() (103 ms at 8k children), which this PR does not touch. apply_diff of the inverse took 17 ms, about 2× issuing the same moves directly.

Coordination with open PRs

• fix: reject malformed movable list move/set ops on import instead of aborting #1125 (50d200d8, movable-list op validation) touches movable_list_state.rs, loro.rs, state.rs, the import path, and adds lines to AGENTS.md / crates/loro-internal/AGENTS.md. fix: restore deleted mergeable children once on revert/apply_diff/undo #1134 (92e4780b, mergeable revert) touches handler.rs (the map path and its use lines), loro.rs, state.rs, and undo.rs.
• This PR only changes handler/movable_list_apply_delta.rs and the std import line of handler.rs. Its AGENTS pointers sit in different hunks from fix: reject malformed movable list move/set ops on import instead of aborting #1125's.
• A test merge of this branch + fix: reject malformed movable list move/set ops on import instead of aborting #1125 + fix: restore deleted mergeable children once on revert/apply_diff/undo #1134 is conflict-free. On that merge, this PR's tests, movable_list_invalid_ops, mergeable_revert, contracts, and the full loro-internal suite pass.
• Rebase plan: whichever lands first, the others rebase onto main with no expected textual conflicts. If fix: restore deleted mergeable children once on revert/apply_diff/undo #1134 lands first, rerun this PR's random tests, because undo then transforms against KeptChange diffs.

Follow-ups (not in this PR)

• A container id with an unknown type in a list/movable-list apply_diff insert still panics in Handler::new_unattached (unreachable!()), for example "🦜:cid:0@1:Unknown(9)" from JS. This is pre-existing and shared with ListHandler. It should become an Err validated before any op is applied.
• Moves are not minimal for "delete all, insert permuted" deltas: delete 3, insert [b, c, a] moves b and c. Deltas from LoroDoc::diff only move elements that really moved, so they are unaffected. An LIS pass could reduce ops for hand-written deltas.
• loro.js (fix(loro.js): include reattached child containers' state in diff() and revertTo() #1131) still needs the equivalent B2/B3 fix on the TS side.

🤖 Generated with Claude Code

[github-actions]

WASM Size Report

• Original size: 3209.89 KB
• Gzipped size: 1063.81 KB
• Brotli size: 745.00 KB