Rust mesh: a raw snapshot pull is one cache commit (mesh-snapshot-atomic)

A snapshot document for a read-only key used to end the pull with the earlier documents kept; C# applies the snapshot as one commit and applies nothing. Stage the pull through put_prepared_batch.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

packages/cultcache-rs/CHANGELOG.md

@@ -11,7 +11,7 @@ only in git history.
 Semver: this is a breaking change in the 0.x line (0.3.x to 0.4.0).
 
 - A record whose payload carries unread slots is read-only. A payload with a slot past its type's declared slots, at any depth (record, nested record, list element, union arm, unit arm), still decodes, and every write or removal of its key is now refused before any store is touched: `put`, `put_envelope`, `put_raw_envelope`, `put_prepared_batch` (the whole batch) and `delete`, so `update` too. The refusal is `SchemaConflictError` with the new `unread_slots`; its message names the type and both slot counts and never a slot value. Holders of such a record used to overwrite it and drop the extra slots silently. The payload nesting refusal still runs first. A held payload this build cannot read at all (an arm it lacks from a newer writer, or a corrupt record) is read-only too: every write or removal is refused with an error naming the type and key (a newer writer's record is read with that build; a corrupt one is restored from a backup or removed at the store itself, as no cache call removes it), and `is_writable` answers false. `load_soa` is a write of every held key it omits or changes, so it refuses to drop or replace a read-only record. `is_writable` also answers false for a key a store carries as a foreign record and for a type other than the one holding the key, as the writes do. Each write over a held key decodes the held payload once to ask (about 40% of a `put` of a 200,000-element record, measured in release); keys nothing holds pay nothing.
-- cultmesh-rs `pull_rudp_catalog_snapshot` applies documents one by one with `put_raw_envelope`, so a snapshot document for a key the node holds read-only ends the pull at that document and the documents before it stay applied. C# applies a raw snapshot as one cache commit, so there a refusal applies nothing: this is a divergence, owed by follow-up `mesh-snapshot-atomic` (stage the pull through `put_prepared_batch`).
+- cultmesh-rs `pull_rudp_catalog_snapshot` applies a snapshot as one cache commit (`put_prepared_batch`), as C# does: a snapshot document for a key the node holds read-only, or any other refusal, applies nothing. It used to apply document by document, so a refusal ended the pull with the earlier documents kept. A snapshot whose types route to different backing stores is now refused whole, as a batch cannot span stores.
 - `SchemaConflictError` gains the public field `unread_slots: Option<UnreadSlots>`; code that builds it with a struct literal must set it (`None`).
 - A unit arm with slots (`[N, [extra...]]`) decodes as the unit arm and marks the record, where the derive refused it.
 - The registration map's value changes from the schema name to a private struct holding the schema name and the unread-slots check.

packages/cultmesh-rs/src/lib.rs

@@ -735,30 +735,31 @@ impl CultMeshNode {
         self.apply_raw_snapshot_documents(documents)
     }
 
-    /// Applies each snapshot document of a registered schema with `put_raw_envelope`. The first refusal ends the pull
-    /// and the documents before it stay applied; a key this node holds read-only (unread slots from a newer peer, or a
-    /// payload this build cannot read) is refused like any other. C# applies a raw snapshot as one cache commit, so a
-    /// refusal there applies nothing: this is a divergence, owed by follow-up mesh-snapshot-atomic (stage the pull through
-    /// `put_prepared_batch`).
+    /// Applies the snapshot documents of registered schemas as one cache commit, as C# does: a refusal (a key this node
+    /// holds read-only because of unread slots from a newer peer or a payload this build cannot read, or any other the cache
+    /// judges) applies nothing. The commit lands in one backing store, so a snapshot spanning stores is refused whole.
     fn apply_raw_snapshot_documents(
         &mut self,
         documents: Vec<cultnet_rs::CultNetRawDocumentRecord>,
     ) -> Result<usize> {
-        let mut applied = 0usize;
+        let mut staged = Vec::new();
         for document in documents {
             let Some(document_type) =
                 registered_document_type_for_schema(&self.documents, &document.schema_id)
             else {
                 continue;
             };
-            self.cache.put_raw_envelope(CultCacheEnvelope {
+            staged.push(CultCacheEnvelope {
                 key: document.record_key,
                 r#type: document_type,
                 payload: document.payload,
                 stored_at: document.stored_at,
                 schema_id: Some(document.schema_id),
-            })?;
-            applied += 1;
+            });
+        }
+        let applied = staged.len();
+        if applied > 0 {
+            self.cache.put_prepared_batch(staged)?;
         }
         Ok(applied)
     }
@@ -1226,7 +1227,7 @@ mod tests {
     }
 
     #[test]
-    fn a_snapshot_document_for_a_read_only_key_ends_the_pull_unlike_csharp_which_applies_nothing() -> Result<()> {
+    fn a_snapshot_document_for_a_read_only_key_refuses_the_whole_pull_as_csharp_does() -> Result<()> {
         let temp = tempfile::tempdir()?;
         let mut node = CultMesh::create_node(temp.path().join("m.cc"), TestDocuments, Default::default())?;
         // A newer peer's note: one slot past the declared one.
@@ -1246,7 +1247,7 @@ mod tests {
         assert_eq!(conflict.record_key, "held");
         assert!(conflict.unread_slots.is_some());
         assert!(!error.to_string().contains("extra slot"));
-        assert_eq!(node.get_required::<Note>("before")?.body, "b");
+        assert!(node.get::<Note>("before")?.is_none());
         assert_eq!(node.get_required::<Note>("held")?.body, "newer body");
         assert!(node.get::<Note>("after")?.is_none());
         Ok(())