[zxch3n]

Summary

Third PR of the MovableList stack, based on #1166 (the MovableList model PR; review only the commits after it). It makes loro.js import, importBatch and importJsonUpdates all-or-nothing, matching the Rust contract in context/import-batch-atomicity.md. A failed import leaves no trace in history, pending changes, version, frontiers, containers, state, events, subscriptions or UndoManager, and the document stays usable.

LoroDoc.#atomically in document.ts:

• While an import runs, every in-place change to history structures pushes an undo closure onto #importUndo: records, per-peer arrays and ends, merged records, Map/Tree op indexes, created containers and roots, and snapshot-sequence entries.
• Fields the import replaces wholesale are saved by reference or copied: frontiers, pending changes, deferred snapshot history/state, shallow root and its entry index, and counters.
• On failure the closures run in reverse and the saved fields come back, and the per-container record index is invalidated.
• The state is rebuilt from the restored history only if the import had already changed container state, so the rebuild happens only on the failure path.
• A snapshot container that the import first completed from its own history (fix(loro.js): model MovableList like Rust (positions and LWW elements) #1166) keeps that replay, which equals its snapshot state, and gets its snapshot entry back.
• A pristine document skips the journal; a failure empties it again.
• Events are emitted only after the whole import succeeded, and a multi-blob importBatch succeeds or fails as a whole.

A checkout/attach that fails already restores the previous version on main (#transitionTo, from #1126). This PR only adds a test for it.

Rationale

Before this, an import that failed midway could:

• leave history integrated but state half-applied;
• emit partial events;
• push a partial undo item.

The next PR rejects invalid MovableList moves/sets the way the merged Rust #1125 does, and a rejection is only useful if nothing of the import remains. Rust gives the same guarantee through import_batch rollback. The "loro.js" section of context/import-batch-atomicity.md now describes the TS side.

Validation

• pnpm -C loro-js check: passes.
• New tests/import-atomicity.test.ts (8 tests) covers:
  • an op failure during application: value, version, frontiers, change and op counts, and events;
  • importBatch with one bad blob, and with a corrupt blob;
  • pending changes kept across a failed import and unlocked later;
  • a failed attach after a detached import;
  • a corrupted snapshot into an empty doc;
  • undo unaffected by a failed import;
  • a failed batch on a snapshot-loaded doc after the import completed a container from its history;
  • import cost independent of the number of snapshot-hydrated containers (scaling ratio).
• The differential suites (MovableList and test(loro.js): add a multi-peer differential fuzz harness #1141 with MovableList) pass on the stack tip; see fix(loro.js): reject invalid MovableList move/set refs (port Rust #1125) #1168.
• Performance: a successful import only records in-place history changes, O(1) extra work per changed structure. bench:b4 update import (median of 5 rounds): main 112.3 ms, fix(loro.js): model MovableList like Rust (positions and LWW elements) #1166 111.4 ms, stack tip 113.3 ms; the MovableList import benchmarks on the stack tip are within 5% of fix(loro.js): model MovableList like Rust (positions and LWW elements) #1166.

Known limitations

• Rust applies an update whose changes partly depend on history before a shallow root partially, then returns ImportUpdatesThatDependsOnOutdatedVersion. loro.js rejects the whole blob.

Merge order

1. test(loro.js): add a Rust differential suite for MovableList #1132, the differential suite.
2. fix(loro.js): model MovableList like Rust (positions and LWW elements) #1166, the MovableList model (this PR's base).
3. This PR.
4. fix(loro.js): reject invalid MovableList move/set refs (port Rust #1125) #1168, MovableList move/set validation (stacked on this one).

🤖 Generated with Claude Code

[github-actions]

WASM Size Report

• Original size: 3277.59 KB
• Gzipped size: 1089.33 KB
• Brotli size: 762.83 KB