Finding #10: bulk post-sync completion snapshot (vendored blob rebuild)

[bcourbage]

Draft — for review, do not merge. Finding #10 (fast, safe sync completion), integrated on top of the cumulative main (PRs #16–#21) at 968f4ae. Includes the authorized vendored-blob bump a57f5c4e → 2f345306 and OCaml patch 0005.

Problem

finalizeSyncUI made O(n) per-row unison_bridge_ri_get_details bridge calls on the main thread at sync completion (a completion freeze on large syncs); per-row progress used an O(n) node walk.

Fix

• OCaml patches/0005 — syncComplete carries the final post-sync stateItem array (!theState after do_unisonSynchronize). No new OCaml allocation; C reads final values via the already-registered accessors while the array is GC-rooted.
• C (transactional, shared deliver_sync_snapshot) — resolve accessors and marshal ONE complete snapshot (progress + details + bytes) with the exn-safe wrappers; any accessor raise / OOM / bad shape aborts before publishing → ok=false, never partial, never "no failures". ABI guards: Is_block/tag-0 before Wosize_val, size_t→int bound; the Swift trampoline rejects ok+count>0+null-rows.
• Coordinator — SyncResults .available/.unavailable → effects .presentSyncResults(SessionID, snapshot) / .presentSyncUnavailable(SessionID, reason:), bound to the exact pending (SessionID, OperationID), lease released once, and NEITHER entering restartRequired (engine is quiescent post-commit).
• Swift — finalizeSyncUI(snapshot:) applies once on main via the pure SyncCompletionModel (identical details-based attribution, zero bridge calls); a count mismatch routes to finalizeSyncUnavailable. The per-row getter loop is gone; an O(1) rowToNode index is rebuilt atomically with items/tree.
• Results-unavailable gate — a first-class ReconcileActionGate state blocks every engine-reaching action (Direction/Revert, Ignore incl. its phase-independent path, Diff incl. canDiff, Details, Go/Sync) at both validation and method boundaries; only Rescan/Profiles/Quit remain. finalizeSyncUnavailable shows a dedicated orange warning (not the green success check).

Cumulative integration (PRs #16–#21 preserved)

Merged current green main via a normal merge. The two conflicts were resolved preserving both sides:

• Tests/BridgeTests.swift: kept PR Finding #10: bulk post-sync completion snapshot (vendored blob rebuild) #22's four sync-snapshot tests AND PR L1: app-global diff-request broker (owner + drain) + genuine run_show_diffs fault test #21's real diff-fault test (test_r); the co-located append had matched the trailing brace as common — added the one missing method brace.
• TODO.md: consolidated to one entry per finding (In-process close→reopen leaves the embedded Unison engine unable to reopen (stall / corrupted protocol) #8/Finding #2: Revert to Recommendation is a real engine inverse (unisonRiRevert) + first-class changedFromDefault #12, feat(shutdown): reap wedged ssh transport children on exit — exact-PID registry (issue #6) #9, docs(todo): correct patch accounting + track post-#6 follow-ups #10, Bridge safety: GC rooting, exception containment, transactional publication, and reconciliation action-gating #11, Finding #7: lossless profile-directive preservation on save (source / include? / source? / raw) #13, L1) with no duplicate or historical layers.
  AppDelegate and ReconcileWindowController auto-merged cleanly and retain both PR L1: app-global diff-request broker (owner + drain) + genuine run_show_diffs fault test #21's app-global diff broker (owner routing + drain contract) and PR Finding #10: bulk post-sync completion snapshot (vendored blob rebuild) #22's post-sync snapshot / results-unavailable gate / exact (SessionID, OperationID) ownership / row-index / presentation.

Validation (at merge 2ab70c7; final head 0aef318 adds a README-only fix)

• make build (Debug) + make build CONFIG=Release succeed.
• Full cumulative suite 674 tests, 0 failures (1 pre-existing env-gated skip).
• Real local synchronization (test_h_realSync_propagatesFiles_andDeliversSnapshot): the REAL public path — unison_bridge_synchronize() → do_unisonSynchronize → syncComplete !theState (patch 0005's real caller, not the Debug seam) → C marshaller → Swift handler — over conflict-free one-sided files: one ok=true snapshot, count == scanned, plausible fields, files actually propagated on disk. ✅
• PR L1: app-global diff-request broker (owner + drain) + genuine run_show_diffs fault test #21's real diff-fault/recovery (test_r_runShowDiffs_realBridgeRaise_thenEngineUsable): real unison_bridge_run_show_diffs forced through bridge_call2_exn's raise path → false return, no callback published, broker cleared, subsequent real diff succeeds. ✅
• Release-hook scan (nm): the UNISON_DEBUG_HOOKS-gated seams (run_sync_snapshot, fail_snapshot_accessor_at, fail_strdup_at, force_next_callbacks_raise, …) are absent from the Release binary; they are present/functional in the Debug test host (the accessor-raise and alloc-failure tests exercise them and pass). unison_bridge_test_status is an ungated, always-compiled synthetic-status helper (pre-existing), not one of the gated seams.

Vendor provenance

Base 91421d0, OCaml 5.5.0, patches 0002, 0003, 0004, 0005 (no 0006). Blob SHA-256 2f345306314305d8e921fea587d913b628b86872553bc3776047ef58fe1dfc89. vendor/README.md provenance updated for internal consistency (the Reproducibility line now lists the full 0002+0003+0004+0005 set).

Limitations

• os_log-style runtime redaction is N/A here; the controller UI wiring (finalizeSyncUI/finalizeSyncUnavailable) is not driven by an AppKit UI harness — the gate, coordinator, SyncCompletionModel, index builder, and the real C marshaller (Debug seam + the real unison_bridge_synchronize path) are all tested.
• A full live remote (ssh) sync is still not driven by an automated harness; the local-replica real path and the marshaller are covered.

[bcourbage]

Verification pass (final) — 050894d7, CI green

Test evidence updated (verification-only; production code unchanged aside from extracting the internal convertSyncCompletion test seam):

• Real end-to-end sync (test_h_realSync_propagatesFiles_andDeliversSnapshot): drives the actual unison_bridge_synchronize() → vendored unisonSynchronize → do_unisonSynchronize → syncComplete !theState (patch 0005) → C marshaller → Swift handler over a local fixture with conflict-free one-sided files. Asserts dispatch UNISON_BRIDGE_OK, exactly one ok=true completion, snapshot count == scanned rows, plausible terminal fields, and that both one-sided files were actually propagated between roots. Uses the real OCaml caller, not the test seam.
• Accessor failure across all three fields (progress/details/bytes) at row 1 — each → one ok=false, zero partial rows, then a clean snapshot.
• Direct Swift malformed-success guard via UnisonBridge.convertSyncCompletion: ok=true+count>0+null-rows and negative count → unavailable; ok=true+count 0+null-rows → genuine empty success.
• Wrong-OperationID: after the bogus completion the real op is asserted still pending (.syncing(s, op)), then the genuine completion transitions to .ready.

Totals: full suite 571, 0 failures; Debug + Release build green; Debug test symbols absent from Release (nm); blob unchanged at 2f345306314305d8e921fea587d913b628b86872553bc3776047ef58fe1dfc89, patches/ unchanged.