fix(loro.js): reject invalid MovableList move/set refs (port Rust #1125)

[zxch3n]

Summary

Last PR of the MovableList stack, based on #1167 (review only the commits after it). It ports the merged Rust #1125 to loro.js: a MovableList move or set that cannot mean anything is rejected, and the whole import or batch rolls back. A move or set of a deleted element stays valid and keeps its concurrent CRDT meaning.

#validateMovableListRefs in document.ts mirrors OpLog::validate_movable_list_elem_refs_since. It runs on every imported change after integration: FastUpdates, non-initializing snapshots and importBatch. Like Rust, it skips the snapshot that seeds an empty document. It rejects a Move/Set whose element:

• is unknown, or is not a movable-list-insert into the same list;
• is outside the op's causal history;
• on a shallow document, is older than the root but missing from the root state (shallow_root_has_movable_list_elem), that is, it was deleted before the root.

MovableListState.applyMove already rejects a from/to outside the op-index range of the op's causal view before it mutates anything. With #1167, that rejection also rolls the import back.

Complexity:

• Each check maps (peer, lamport) to an op ID by binary search over the peer's indexed changes: O(log changes).
• While a snapshot's history is still deferred, only the overlay is indexed. A miss there means the element comes from the snapshot base. It is accepted without decoding history when the list's hydrated state holds it and the op has seen the whole base; a regression test uses an undecodable snapshot history to prove it.
• The shallow-root element set is built once per root store and list.

Validation

• pnpm -C loro-js check: passes.
• loro-js/tests/movable-list-invalid-ops.test.ts ports crates/loro/tests/movable_list_invalid_ops.rs (12 tests):
  • the deleted-element move/set, identical on every import path;
  • unknown, cross-container and out-of-history elements, and out-of-range indices, each on a plain doc and on one with a concurrent edit;
  • a detached import, and importBatch rollback;
  • shallow-root elements, and a snapshot-loaded doc;
  • a move that must not decode snapshot history.
• The same file runs against a WASM build of current main (with fix: reject malformed movable list move/set ops on import instead of aborting #1125) through a module alias. 11 of the 12 tests pass unchanged apart from the error pattern; the twelfth needs loro.js's codec. The two agree on values, which imports are rejected, the rollback, and the document staying usable. Error texts differ: Rust says "Decode error" / "movable list diff retains N items but state only has M", loro.js says "causal history" / "out of range".
• The differential suites at 588aa35d (later commits only change docs), with a Rust reference built from current main:
  • MovableList suite (test(loro.js): add a Rust differential suite for MovableList #1132): each of the 8 profiles × 300 seeds from 1000 and 300 seeds from 2000, 150 steps each (4,800 runs): 0 divergences.
  • test(loro.js): add a multi-peer differential fuzz harness #1141 multi-peer fuzz with map,list,text,counter,movableList,nested, all oracles, lockstep with Rust: seeds 0–799 pass. With the same settings, main fails 24 of seeds 0–49 (19 checkout-vs-replay on a MovableList, 5 lockstep).

Known limitations

Rust rules that loro.js does not copy; both are edge cases, listed in context/loro-js-movable-list.md:

• Rust rejects any List/MovableList/Text op position ≥ 1,073,741,822 when it decodes ops, on every path. loro.js rejects such a move only when it applies it, so a detached import records it until attach fails.
• Rust bounds-checks the composed diff of an import, so an out-of-bounds move that a later op in the same import cancels is accepted. loro.js checks each op and rejects the import.

Merge order

1. test(loro.js): add a Rust differential suite for MovableList #1132, the differential suite.
2. fix(loro.js): model MovableList like Rust (positions and LWW elements) #1166, the MovableList model.
3. fix(loro.js): make import and importBatch atomic #1167, atomic import/importBatch (this PR's base).
4. This PR.

🤖 Generated with Claude Code

[github-actions]

WASM Size Report

• Original size: 3277.59 KB
• Gzipped size: 1089.33 KB
• Brotli size: 762.83 KB