[codeasier]

Scope

Refs #280. This is the separately authorized minimal runtime input-error follow-up, kept out of tests-only PR #282. It does not choose a parser-v3/frame-tree route or change replay/schema/layout behavior.

• Validate YAML root/query/parameter container shapes and declared field types at the shared loader boundary; preserve existing syntax errors, permissive defaults, extension fields and YAML aliases.
• Validate snapshot entity required keys, container shapes, numeric inputs and string-valued producer block states before unchecked operations. Normalize narrow integer-conversion errors with their cause and SQLite signed-integer overflow through the existing import domain-error path.
• Validate every inner device-trace container before truthiness/device selection, including falsey malformed entries such as device_traces=[None] and [{}].
• Add bounded deterministic Hypothesis regressions for file/string parity, malformed structures and numbers, real replay/SQLite overflow, valid numeric endpoints/sentinels/empty device containers, exact loader counts, input preservation, existing-target preservation, absent-target nonpublication and temporary-file cleanup. Existing negative tests retain their safety assertions while expecting the deliberate domain-error contract.

Current integration (2026-11-05)

The candidate integrates actual main d5adcd4a6192e217fe07a3bf27089486cfd91974 after PR #269. Head dbf7fe45d2571d2abe0bb39e94eaf3952c7e2a77 has parents bb2bde0e55cc7e7bf789755b3b94aa969b115186 and d5adcd4a6192e217fe07a3bf27089486cfd91974, with tree c63c475d2dce6828a84816ee3acf41b222c93f50.

The only overlapping path was append-only src/pt_snap_cli/snapshot/PROVENANCE.md: the complete current main history is retained, followed by the original input-validation entry. All eight other PR files retain their reviewed blobs exactly. All 463 main file entries outside this PR's nine paths remain unchanged; the integrated tree has 472 file entries. This preserves PR #269's frame-tree/cache work and all accepted coverage/focus changes. No code, workflow, test assertion, threshold, fixture or dependency was changed for this integration. No unmerged PR prerequisite remains.

Validation

The original input-boundary changes and producer-state compatibility correction retain their earlier independent reviews. The current integration has an independent static review and verified complete-tree union, dual commit identity and ordered parents. Ordinary tests/builds remain assigned to existing CI, not duplicated locally. Fresh exact-head ordinary CI is pending; older green runs do not validate this new combination.

Producer block state strings remain unchanged: upstream active_awaiting_free, unknown strings and empty strings are not restricted to local replay constants. Non-strings are rejected, existing SQL mappings remain intact, and 99 is only the omitted-column default. No awaiting/pending conversion or new state mapping is introduced. Earlier regression evidence does not claim all replay transitions or upstream GUI support.

Compatibility and issue #280 acceptance

Refs #280. Keep the tracking issue open until the combined acceptance matrix and post-merge CI are complete; closure will be an explicit issue operation after that evidence. Omitted SQL with complete query_variants has an explicit existing authoring/test contract; optional defaults and empty configuration/template objects also have existing tests. Ignored unknown root/query/parameter-definition fields and empty/null loader forms are preserved as existing parser compatibility, not advertised as a general extension API. No contradictory closed-schema rejection rule was found. Illegal shapes/types, missing required fields and non-string block states receive controlled errors. Existing producer state strings remain unchanged; unknown values pass through the current SQL value map, while 99 is only the omitted-column default. No awaiting/pending conversion or new state mapping is introduced. Unknown runtime argument names and unknown output_schema fields retain their existing rejection contract. The known malformed-container and numeric escapes are addressed rather than silently xfailed. Pickle remains trusted code execution, not a sandbox.

Required final acceptance

Current integrated candidate: dbf7fe45d2571d2abe0bb39e94eaf3952c7e2a77 on fix/input-domain-errors-280. The earlier frozen bb2bde0e manual target is superseded. Wait for this exact candidate's ordinary CI to finish before the final manual dispatch target is confirmed.

This snapshot input-boundary change still requires the scheduled/manual installed-wheel dataset acceptance and paired 200-seed profile (400 distinct seed/format identities) from Test, with no custom inputs. The designated validation environment must run the published PR branch and verify the exact run head, wheel/source identity, required dataset results and differential evidence. A PR run's nightly skip, an older head, or a main-branch run is not this evidence.

This PR remains Draft and #280 open until the required exact-head manual evidence, final merge checks and post-merge validation succeed. No workflow/credential/network/runner-policy workaround is introduced.

Snapshot provenance

Snapshot provenance decision: updated

Provenance evaluation: append-only first-party input-validation history added to src/pt_snap_cli/snapshot/PROVENANCE.md; existing attribution/source mapping/license text remains unchanged. No fixture bytes or source-ownership mapping changed.

[codeasier]

Compatibility review found an insufficiency in the currently green 3fbab2a0 candidate: the old local Block.state Literal is narrower than the producer vocabulary. PyTorch documents active_awaiting_free (official snapshot structure), while the local constants use active_pending_free. The newly added closed-enum rejection must not turn a type-check repair into a new input-compatibility restriction.

The existing runtime passed string states through. SqliteTable.get_insert_values_by_records uses value_map.get(value, value): unknown strings remain unchanged; 99 is only the default for an omitted SQL column, not an unknown-string mapping. The correction in preparation preserves that behavior and rejects only non-string states, with honest string typing and no cast/ignore or new awaiting↔pending/unknown mapping. Independent review will cover all consumers, upstream/unknown/empty-string positive regressions, existing non-string negative regressions and real SQL behavior. The previous green checks are not sufficient final-candidate evidence; this PR remains Draft and its final head still requires full CI plus the planned nightly/manual dataset and 200-seed acceptance. This does not claim upstream GUI or parser-v3 compatibility.

[codeasier]

Final integrated candidate is frozen at bb2bde0e55cc7e7bf789755b3b94aa969b115186 (tree 9d2e999918b891c6b0c9483489a539d22dbbae79), based on actual main 81af6698675efcc0bd63c8b9be0a331b14241f66. Independent union review verified the nine intended files and preservation of every merged coverage/focus change. No unmerged PR dependency remains.

All 12 applicable ordinary checks passed on this exact head: Test 41329852328, Platform 41329852395. Python 3.13: 3568 passed, coverage 94.56%, all ten critical floors; audited, actually installed wheel offline CLI/skills acceptance passed. The source-state compatibility positive and negative properties executed. Actual main's post-merge Test / Platform also passed.

Remaining required acceptance — not yet executed: manually dispatch Test on fix/input-domain-errors-280, expected head exactly bb2bde0e55cc7e7bf789755b3b94aa969b115186, no custom inputs ({}). Equivalent command:

gh workflow run test.yml --repo codeasier/pt-snap-cli --ref fix/input-domain-errors-280

Verify the run event/ref/head, actual wheel/source identity and the required installed-wheel dataset results; the paired differential gate must prove 200 seeds per v1/v2 (400 distinct identities), matching coverage/query/scratch evidence and zero unexpected failures/skips. See this head's workflow guide lines 117–119 and 149–161. Ordinary PR event-policy skips are not this evidence. No available connector dispatch action or authorized cloud coding environment was found; no credentials, false events, workflow changes or user Mac are used as a workaround.

Refs #280. Keep the tracking issue open and this PR Draft until that required evidence is complete; subsequent normal merge and post-merge checks still apply.

[codeasier]

Integrated candidate and ordinary CI complete

The new frozen target is dbf7fe45d2571d2abe0bb39e94eaf3952c7e2a77 on fix/input-domain-errors-280, tree c63c475d2dce6828a84816ee3acf41b222c93f50. It normally merges actual main d5adcd4a6192e217fe07a3bf27089486cfd91974 into the existing PR branch. This supersedes the earlier bb2bde0e manual target and the pending-CI text above.

Independent review and full-tree verification found no integration blocker: all 463 main file entries outside this PR's nine paths and all eight non-provenance PR blobs are unchanged. The only conflict was resolved by retaining main's complete provenance history and appending the original input-validation entry. Both commit identities and ordered parents were verified. No unmerged PR prerequisite remains.

All 12 applicable ordinary checks passed on this exact head, attempt 1:

• Test 41985449888: Python 3.10–3.13, lint/format/type checks, append-only provenance and required Chromium. Python 3.13 recorded 3631 passed, 94.52% total coverage and all ten independent critical floors. The actual built wheel passed source auditing and installed offline CLI/skills acceptance, including both dataset formats on the small fixture. Chromium recorded 12/12 with zero skips.
• Platform 41985449916: all four Windows partitions and macOS succeeded; macOS recorded 3615 passed.

Remaining required manual acceptance

No workflow_dispatch run exists for this new head as of this receipt. The PR-event dataset job was skipped by its existing event policy; it is not dataset/200-seed pass evidence.

In the designated validation environment, open Test → Run workflow, select fix/input-domain-errors-280, and run with no custom inputs. Equivalent command:

gh workflow run test.yml --repo codeasier/pt-snap-cli --ref fix/input-domain-errors-280

Before accepting the result, verify event/ref/head exactly match this target, the wheel/source identity, both required installed-wheel dataset cases (1,000,000 events and the 500,002-event short-final-shard boundary), and the paired 200-seed v1/v2 profile with 400 distinct identities, matching coverage/query/scratch evidence and zero unexpected failures or skips. See the exact-head workflow guide and differential gate. Older-head or main-branch results do not substitute.

Refs #280. The branch is frozen for this acceptance; keep the PR Draft and issue #280 open. Normal final merge checks and post-merge validation remain after the required receipt. No tag, deployment or approval review was performed.