fix(loro.js): make import and importBatch atomic

.changeset/loro-js-atomic-import.md

@@ -0,0 +1,5 @@
+---
+"loro.js": patch
+---
+
+`import`, `importBatch` and `importJsonUpdates` are atomic: when an import fails, history, pending changes, version, containers and state are restored, and no event is emitted, so subscribers and `UndoManager` see nothing of it. A multi-blob `importBatch` imports every blob or none.

context/import-batch-atomicity.md

@@ -111,3 +111,37 @@ regression on out-of-order batches, where every blob parks and is later unlocked
   `import_batch_failure_leaves_doc_attached_and_unchanged`.
 - `crates/loro-internal/src/oplog/pending_changes.rs`: the `import_batch_*` regressions
   that assert the doc is attached after a batch.
+
+## loro.js
+
+Verified against code 2026-09-30. `loro-js/src/runtime/document.ts` gives
+`import`, `importBatch` and `importJsonUpdates` the same all-or-nothing contract
+through `LoroDoc.#atomically`:
+
+- While an import runs, every in-place change to history structures (records,
+  per-peer arrays and ends, merged records, Map/Tree operation indexes,
+  containers and roots) and to the snapshot-sequence entries
+  (`#journalSnapshotSequence`) pushes an undo closure onto `#importUndo`. The
+  snapshot-sequence table can hold one entry per hydrated Text/List/MovableList,
+  so copying it made every import O(hydrated containers). Fields the import
+  replaces wholesale (frontiers, pending changes, deferred snapshot
+  history/state, shallow root and its entry index, counters) are saved by
+  reference or copied, since they are small.
+- On failure the closures run in reverse and the saved fields are restored.
+  If the import had started to change container state (`#applyRecords`,
+  `#hydrateState` or `#rebuildFromHistory` ran), state is rebuilt from the
+  restored history at the previous version. The rebuild only happens on this
+  failure path. The per-container record index is invalidated. A snapshot
+  container that the import completed from its own history first
+  (`#prepareSnapshotImport`) keeps that replay, which equals its snapshot
+  state, and gets its snapshot entry back.
+- Importing into a pristine document skips the journal: a failure empties it
+  again.
+- `import` and `importBatch` emit their event only after the import succeeded,
+  so subscribers and `UndoManager` never see a partial import. A multi-blob
+  batch fails as a whole.
+- `checkout`/`attach` that fail (for example on a forged op a detached import
+  recorded) restore the previous version and attachment instead of leaving the
+  document half switched (`#transitionTo`, from loro-dev/loro#1126).
+
+Tests: `loro-js/tests/import-atomicity.test.ts`.

context/loro-js-movable-list.md

@@ -8,8 +8,8 @@ reproduce, the loro.js model that implements them, and how the differential
 suite checks the two against each other. Complexity rules still come from
 [loro-js-performance.md](loro-js-performance.md).
 
-Status: the model below is implemented. Import validation and atomic rollback
-("Validation and import atomicity") land in follow-up changes.
+Status: the model below and atomic imports are implemented. Import validation
+("Validation and import atomicity") lands in a follow-up change.
 
 ## Rust semantics (the contract)
 
@@ -211,7 +211,8 @@ Rust's rule for `from_move` inserts that transforms leave behind
 
 ## Validation and import atomicity
 
-Planned; not implemented yet. Import validation follows Rust #1125. A `Move`/`Set` whose element is unknown,
+Atomicity is implemented ([import-batch-atomicity.md](import-batch-atomicity.md),
+"loro.js"). Validation is planned. It follows Rust #1125. A `Move`/`Set` whose element is unknown,
 lives in another container, is outside the op's causal history, or (on a
 shallow doc) was deleted before the root is rejected with an error. So is a
 `from`/`to` outside the op-index range of its causal view. A `Move`/`Set` of a

context/loro-js-performance.md

@@ -91,6 +91,10 @@ JavaScript constant factor.
   produce the final event.
 - A pending transaction stores its accumulated operation length and causal
   version incrementally. Never recover either by reducing all pending ops.
+- An import journals its history changes (a few undo closures per imported
+  change) so a failure can roll back; importing into an empty document skips
+  the journal. Only a failure after state changed pays for a history replay
+  ([import-batch-atomicity.md](import-batch-atomicity.md)).
 - Plain Text/List elements allocate delete, value, and move metadata only when
   an operation needs it; Text style metadata lives in the range index. A
   multi-scalar Text insertion stores its string and UTF-16 boundaries once in a