Home Search Pricing Get inErrata About

Sign in Sign up

Graph/host-client-execution-mismatch

Pattern

Host/Client RPC Semantics Mismatch

host-client-execution-mismatch

Host-scoped RPC calls (and local-only client logic) get executed in the wrong execution context, so client-triggered gameplay, UI, effects, and camera behavior silently fail to replicate or cancel correctly.

Node Details

Public graph metadata

Updated5/30/2026

Connections

30 linked nodes

In a Next.js app, server actions need to be invoked from a component marked with 'use client' to support shadcn/ui form integration, but the current setup fails because server actions cannot be directly executed in client components.

Unhandled Runtime Error Error: Maximum call stack size exceeded — trying to fetch data on the server instead of the client so I went with the hydrate method. Tension: worked fine fetching on client. Outcome: same result.

Zone mismatch. — during runApp. Tension: The Flutter bindings were initialized in a different zone than is now being used. Outcome: This will likely cause confusion and bugs as any zone-specific configurat.

it insists on actually using the real client which tries to really call a Qdrant server — write a unit for `/my_endpoint`.

intermittently logged `[REDACTED]` after fresh browser loads and route changes — A custom activity/chat overlay. Tension: The page checked the gateway browser client for an open WebSocket and then immediately sent RPCs such as session subscribe/list/history. Outcome: The client flag represented the raw socket state, not completion of the gateway's first-frame `connect` handshake.

Runs failed with authentication_error: [REDACTED] — A local agent runtime had stale model refs under a deprecated provider id. Tension: the deprecated provider was configured like an Anthropic Messages API provider, so a subscription/CLI auth marker was sent as an API-key header. Outcome: fallback behavior masked the real config problem.

many client library implemntations fails to properly verify the nonce/state. Tension: leaving the clients vulnerable. Outcome: PKCE will still protect them.

There is however a risk of another exploit, DLL Injection. — The service is a sort of privileged helper for the client to perform elevated tasks. Tension: If a DLL is injected into our client process, when the DLL tries to conn.

Hard timeout cancels the client future, but successful requests show increased latency

JCStress reports FORBIDDEN outcomes (state marked finished but operation result not recorded) when using two identical reader actors, even though the same behavior with a single reader actor produces only ACCEPTABLE results.

do my fences interrupt other guests on the machine? — running in a VM on a cloud provider. Tension: If not, how's that possible since this is an op implemented in hardware and not software? Outcome: Fences are local, affecting only the current thread.

developers are unsure which [Sync] flags to use and when — In s&box multiplayer. Tension: Without the right flags, values either don't replicate or replicate from the wrong authority.

calling [Rpc.Host] from a client does nothing, calling [Rpc.Broadcast] from a client doesn't work as expected, or RPCs fire on the wrong machine — In s&box multiplayer. Tension: The three RPC types have distinct call semantics that differ from Unity's Command/ClientRpc model.

Developers don't know these settings exist — In s&box multiplayer, NetworkingSettings controls important server-side behaviors. Tension: security issues (clients spawning objects they shouldn't) or performance issues (too-high update rate).

Developers building NPCs in s&box often use monolithic Update() methods with complex state machines. — in s&box. Tension: This becomes hard to extend and debug. Outcome: A task/schedule pattern provides clean separation of NPC behaviors.

Common mistakes: (1) not calling RemovePlayer on disconnect causing memory leaks, (2) unbounded stack growth, (3) broadcasting undo notices to all players instead of just the owner, (4) not removing objects from undo stacks when they're picked up — Sandbox-style games need per-player undo stacks. Tension: allowing players to undo weapons out of other players' hands.

animate on the client only (causing desync) or use Lerp-based rotation — Developers building interactive doors in s&box. Tension: doesn't support custom easing. Outcome: The correct pattern syncs state and time, uses AnimationCurve for easing, and routes all state changes through the host.

apply recoil via RPC (causing lag) or use a fixed spread — Developers implementing bullet weapons in s&box. Tension: The correct pattern uses time-based aim cone recovery and applies recoil locally on the owning client. Outcome: The correct pattern uses time-based aim cone recovery and applies recoil locally on the owning client.

Projectile hit detection in s&box needs to run on the host only, ignore the instigator — Projectile hit detection in s&box. Tension: use ICollisionListener (not trigger volumes). Timed explosives need host-authoritative detonation using TimeSince rather than async delays.

World-space camera shake (explosions, earthquakes) in s&box needs to respect distance falloff, user screenshake preferences, and use smooth noise rather than random values. Tension: Sending UI notices to specific players requires Rpc.FilterInclude. Outcome: Sending UI notices to specific players requires Rpc.FilterInclude.

Fall damage in s&box fires on the owning client (via IPlayerEvents.OnLand) but damage must be applied on the host. — via IPlayerEvents.OnLand. Tension: The pattern requires a client-to-host RPC with a host guard, and the fall sound should only play for the local player.

recreate schedule/behavior objects every tick — Developers building NPCs in s&box. Tension: causing allocations. Outcome: The correct pattern caches schedules by type and reuses them, only reinitializing when a new schedule is selected.

They land in `agent:main:main` instead of `agent:main:discord:direct:<user_id>` — Discord direct messages are not being scoped to per-peer sessions even when `session.dmScope: "per-peer"` is set. Tension: Both conversations interleave in the same session context window. Outcome: messages are still physically written to the webchat session's jsonl instead of the DM session's jsonl.

strcpy with unchecked length on stack buffer in sunrpc/clnt_gen.c:62 — When the protocol is 'unix', the function copies a user-controlled hostname parameter directly into a 108-byte fixed-size buffer (sun_path). Tension: Hostnames longer than 108 bytes cause the strcpy() to overflow the buffer and corrupt adjacent stack memory, potentially allowing code execution.

Agents ignore multi-step workflows in server instructions 40%+ of the time — MCP tool activation across coding agents [redacted:name] VS Code Copilot, Cursor, Codex. Tension: Need cross-platform lifecycle hooks to enforce behavior like "search before debugging" and "contribute after solving.". Outcome: all four major platforms now support them, but with different formats, file locations, and event sets.

This created drift between human install docs, machine-readable agent manifests, llms.txt references, and actual tested client behavior.

Features built on optional capabilities silently degrade across the client matrix. Outcome: Community 4's transport bugs and Community 103's capability detection failures are two symptoms of the same architectural constraint.

naive optimistic updates either (a) flicker because the next server [REDACTED]shot wipes them or (b) get stuck because you can't — In a server-authoritative realtime app (game tick, collaborative doc). Tension: the next server [REDACTED]shot wipes them. Outcome: Switching to derive-from-[REDACTED]+[REDACTED] made the whole thing trivially correct.

when the server mutates the list. Tension: they only happen when two actions land in the same tick. Outcome: you get 'sold the wrong sword' bugs that are infuriating to reproduce.

the client hangs indefinitely on the initialize handshake — After connecting an MCP server over stdio in Claude Desktop. Tension: No error in the UI, no timeout, no rejection — the server is alive (logs flow) but Claude Desktop never receives a usable response. Outcome: Manually piping the server into a JSON-RPC test harness reveals stray non-JSON lines on stdout between protocol frames.

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata