Feat/retire aimdb ws protocol

[lxsaah]

Retire aimdb-ws-protocol — every transport speaks AimX

Deletes the WebSocket-only wire protocol and converges the entire workspace on
the AimX-v3 envelope (aimdb-core::session::aimx). One codec, one error
mapping, one client demux — the WebSocket stack and the browser bridge now ride
the same session engine as UDS/serial/TCP and aimdb-client.

Implements design 047 (docs/design/047-retire-ws-protocol-converge-on-aimx.md).

Why

The workspace shipped two wire protocols for one feature. Every capability —
snapshots, acks, writes, queries, subscribe — existed twice, with two codecs and
two error vocabularies, plus a hand-rolled ~835-line browser demux duplicating
run_client. Both protocols already rode the same session engine, so the fork
was pure duplication.

Convergence removes a 353-line protocol crate, a 507-line codec, two error
mappings, and the browser demux, against a small additive AimX extension
(wildcard subscribe + two result-shape changes) that every transport now
inherits (CLI watch 'temp.#', MCP wildcard reads, future serial/TCP browsers).

What changed

Core (additive AimX extension)

• Wildcard / multi-record live subscribe. A pattern containing #/*
  matches the (builder-frozen) record set once at subscribe time, merges the
  matched records' update streams under one subscription id, and emits one
  snapshot per matched record on open.
• topic_match module — MQTT-style matching over dot-separated keys, shared
  by the core wildcard path and the WS fan-out bus.
• SubUpdate item type — subscription streams now carry
  { topic: Option<Arc<str>>, data, skipped } so each event names the concrete
  record that fired and threads buffer-lag counts through for drop detection.
• Wire additions: optional topic on event, sub on snap, an explicit
  subscribed ack frame (WS only; UDS/serial/TCP stay ack-implicit).
• Query/list result shapes: record.query → { records: [{topic, payload, ts}], total } (canonical QueryRecord row); RecordMetadata gains
  schema_type and entity.
• Version-gated hello — protocol bumped 2.0 → 3.0; an incompatible or
  version-less peer is refused at the handshake (RpcError::VersionMismatch).
• Loss accounting — buffer lag folds into skipped; the server pump does
  seq += skipped + 1; the client demux recovers loss as a seq shortfall.

WebSocket connector

• Speaks AimX on the transport (one codec blob per WS text frame — no extra
  framing). Dispatch converged on record.query / record.list.
• The fan-out bus carries (topic, payload) as Arc-shared updates; the
  per-connection codec envelopes each event (O(1) fan-out preserved).
• record.query falls back to the persistence-registered QueryHandlerFn when
  no custom handler is plugged in; record.list rows are stamped with schema
  names from the connector's StreamableRegistry.
• Removed: WsCodec + id↔topic maps, split_multi_topic, the pre-serialized
  Data-frame broadcast, with_raw_payload, ClientConfig::topic_routed_subs.

Browser bridge (aimdb-wasm-adapter::ws_bridge)

• Rewritten on run_client + ClientHandle over a web_sys::WebSocket-backed
  Connection/Dialer (single-threaded wasm Send/Sync wrappers). Reply and
  subscription correlation now exists exactly once, in core.
• JS API preserved: write, query, listTopics, onStatusChange, offline
  queue, and reconnect are all delegated to the engine.

Deletions

• aimdb-ws-protocol crate, WsCodec, protocol.rs shims, dead aimdb-client
  re-exports.

Breaking changes

• Wire protocol 2.0 → 3.0 — pre-3.x clients are refused at hello. Browser
  clients on the old ws-protocol wire must ship the rebuilt bridge; they fail
  closed against a 3.0 server.
• Removed builder knobs: with_raw_payload, ClientConfig::topic_routed_subs.
• record.query result shape changed from {values:[{record,value,stored_at}], count} to {records:[{topic,payload,ts}],total}.

Lands as one branch in a release already flagged protocol-breaking, one commit
per work item (no stacked PRs).

Testing

make check and make all green. New/updated coverage: AimX codec roundtrip
suite (frames + splice byte-for-byte), topic_match tests, topic_leaf
dual-separator, version-compatibility matrix, query_handler_shape,
UDS handshake_version, rewritten WebSocket e2e.rs (subscribe ack, wildcard
fan-out, late-join), and fan-out encode benchmarks.

Known limitations (accepted)

• Auto-subscribe under engine demux — server-seeded subscriptions carry
  server-chosen sub ids (counted down from u64::MAX); a run_client-based
  consumer drops events for ids it never issued, so engine clients (including the
  new bridge) subscribe explicitly. No user-visible change (the pro hub already
  subscribes by exact name).
• Dynamic record membership — wildcard matches are resolved once at subscribe
  time against the builder-frozen record set; MQTT-style late registration is
  deferred until core grows runtime registration.

[thaodt]

I'm requesting changes for the remaining correctness blockers described inline, primarily the lost snapshot_end marker at the public API boundary and request-ID wraparound.
Separately, I noticed the quiet ws subscription lazy-pruning issue also exists on main and is not a regression of this PR, so it should be tracked in a separate follow-up issue rather than block it.

[thaodt]

The post-handshake stopped check fixes the late-adoption/status-resurrection part. I'm reopening this because disconnect() still cannot interrupt open_rx.await: while the handshake is pending, the socket is not reachable through shared.ws, so the dial future and its callbacks can remain alive until the browser eventually emits an open/close/error event.

The added regression proves that the socket is rejected after the handshake resolves, but it does not prove prompt cancellation while the handshake remains pending. Could we track and close the in-flight socket, and add a test that keeps open_rx pending and verifies that disconnect() settles the dial promptly?

[thaodt]

@lxsaah lemme know whenever you've finished all the changes and want me review the final round I think 😸

[lxsaah]

@thaodt the PR is now again ready to be reviewed! Thanks again!!

[thaodt]

The previous correctness blockers are fixed: snapshot loss is now observable through the public API, request-ID exhaustion is refused rather than wrapped, pending calls are canceled in O(1), the in-flight WASM dial is interruptible, terminal subscription errors are preserved and the browser tests are running successfully in CI.

Again im requesting changes for one confirmed migration blocker: WsBridge.maxOfflineQueue is no longer a hard bound during an initial pending dial or reconnect backoff, despite the preserved public option and design contract.

I also left:

• a security-contract question about the newly automatic persistence query and full record.list exposure
• two lower-priority WASM findings covering synchronous constructor failure and frame-byte budgeting
• a few documentation/counting corrections.

I intentionally did not charge the generic duplicate-subscription-ID issue to this PR because the retired ws codec could already trigger it by reusing the synthesized ID for a repeated topic subscription. Likewise, the unchecked serializer splice follows design 048's explicitly documented trusted-payload contract and is not being treated as a blocker here.

[thaodt]

run_client uses an unbounded command channel, while bound_offline_queue() runs only once before reconnect backoff. Commands accepted during an initial pending dial or during that sleep can exceed the configured cap; if the next dial succeeds, drive_connection flushes them without another trim.

I reproduced max_offline_queue = 2 returning from backoff with 102 queued commands. The retired bridge enforced this limit at enqueue time and design 047 says the JS offline-queue behavior is preserved.

Please enforce the cap continuously while offline, define whether the oldest or newest commands are dropped, and cover both a blocked initial dial and reconnect backoff.

[thaodt]

Is record.query intentionally authorized only at connection level?

With this PR, a WebSocket client authenticated with empty subscribe/write permissions can still invoke the automatic with_persistence() fallback with name: "*". I verified this end-to-end on this head. Persisted records do not need .with_remote_access() and record.list now also returns every database record rather than only the records exposed through the ws connector.

This may be intentional as part of AimX convergence and Im not assuming that subscribe_patterns should automatically govern historical queries. However, the current AuthHandler API has no query/list authorization hook, so applications cannot express a per-client historical-read policy.

Could we make the intended security contract explicit and add a regression for it? If query/list access should follow record visibility, this needs filtering or a dedicated authorization hook before merge.

[thaodt]

A synchronous WebSocket::new failure no longer reaches the connectBridge caller.

The retired bridge constructed the socket in new_internal and returned a JsError when the URL was invalid. The migrated implementation returns the bridge first and later maps the constructor failure to TransportError::Io.

With autoReconnect = false, the engine exits while the observable status remains Connecting. With reconnect enabled, it repeatedly retries a permanent constructor error while still appearing to be in the initial connecting state.
Please surface this terminal failure deterministically and add a malformed-URL browser regression.

[thaodt]

FRAME_QUEUE_CAP bounds the number of frames, but not the amount of retained memory.

Each queued item is an unconstrained Vec<u8> and onmessage copies the complete JS string with into_bytes() before en-queueing it. With the default ws message ceiling allowing very large messages, 1024 queued frames can still represent an impractical amount of browser memory.

Please consider enforcing a per-frame byte limit before copying the string into the Rust queue and treating an oversized frame like queue overflow, close the connection and resubscribe from a clean state.

[thaodt]

This still describes the retired three-field TopicInfo result, but the current impl calls db.list_records() and returns the full RecordMetadata rows.

In that shape, the record key is record_key, name is the Rust type name, not the topic name. WasmDb.discover forwards these rows to JS unchanged. The design note and WASM changelog currently suggest {name, schema_type, entity}, which can lead migrating clients to treat name as the record key.

Could we align the design, changelog and discovery example with the actual canonical RecordMetadata shape and field semantics?

[thaodt]

Nitpick: The active documentation still calls this AimX v2, while PROTOCOL_VERSION and the WebSocket upgrade gate now use 3.0.

The stale wording appears in this design document and several current module/README docs (remote, AimxCodec, aimdb-client, the ws connector and the CLI). Could we update the active documentation to AimX v3 while leaving genuinely historical changelog entries unchanged?

[thaodt]

Nitpick: The publish sequence was updated to 16/16 after removing aimdb-ws-protocol, but the final message still says All 17 crates published successfully.

[lxsaah]

Thanks, as I am on leave this week - I'll need some time to get back to it.