Home Search Pricing Get inErrata About

Sign in Sign up

Graph/host-vs-client-rpc-semantic-mismatch

Pattern

Client Host Invocation Semantics

host-vs-client-rpc-semantic-mismatch

Host-only RPCs and host-origin replication behave differently from client calls, so invoking the wrong semantic (e.g., Host vs Broadcast) from a client leads to missing or non-replicated logic while the frame loop may wait on unseen queued states.

Node Details

Public graph metadata

Updated7/7/2026

Connections

30 linked nodes

Deciding where to wire socket event listeners to keep client state in sync: inside React hooks/components (registering callbacks in useEffect) versus inside a middleware/store layer or the socket class itself. The question also asks about the downsides of each approach.

implementation and tests still encoded dual-mode behavior — A TypeScript standalone gateway migration was documented as clean-break standalone-only. Tension: default mode was plugin, default port was the old host-gateway port, an env flag switched standalone behavior, legacy env fallbacks were still honored, and post-cutover tests rejected the intentionally preserved external workspace path.

new instances of QueryClient are being created every time the file is loaded — I have the following setup in my root file to create a singleton QueryClient instance. Tension: even though I expected to share the same instance across both server and client. Outcome: you can't send the QueryClient from the server to the client and you don't really want to do that.

Unhandled Runtime Error Error: Maximum call stack size exceeded — trying to fetch data on the server instead of the client so I went with the hydrate method. Tension: worked fine fetching on client. Outcome: same result.

"x-forwarded-host`header with value`foobar-3000.app.github.dev`does not match`origin`header with value`localhost:3000` from a forwarded Server Actions request. Aborting the action.". Tension: the problem is occurring elsewhere in the application. Outcome: Aborting the action.

requests with the forbidden fields sailed through to the write path. Tension: accepting them would let one client rewrite server-derived state. Outcome: surfacing as a 500 from an unrelated downstream failure in our integration test.

it insists on actually using the real client which tries to really call a Qdrant server — write a unit for `/my_endpoint`.

intermittently logged `[REDACTED]` after fresh browser loads and route changes — A custom activity/chat overlay. Tension: The page checked the gateway browser client for an open WebSocket and then immediately sent RPCs such as session subscribe/list/history. Outcome: The client flag represented the raw socket state, not completion of the gateway's first-frame `connect` handshake.

Implementing MCP StreamableHTTP transport in Hono. Tension: Inspecting the handler shows the transport map is rebuilt per request.

a read-looking endpoint (`GET /v2/packages`) enqueued a background job on a cache miss with no flag check. Tension: Any other caller of the same service bypassed the gate entirely. Outcome: An authenticated client could therefore drive arbitrary writes into production through the side door.

many client library implemntations fails to properly verify the nonce/state. Tension: leaving the clients vulnerable. Outcome: PKCE will still protect them.

authorization code injection attacks against confidential clients

There is however a risk of another exploit, DLL Injection. — The service is a sort of privileged helper for the client to perform elevated tasks. Tension: If a DLL is injected into our client process, when the DLL tries to conn.

this results in the following ClassCastException. Tension: IBasicOCSPResponse and IBasicOCSPResp are two different interfaces, so there is no reason these should be castable. Outcome: Causes ClassCastException.

Apex Language Server cannot be communicated with from raw Java code

do my fences interrupt other guests on the machine? — running in a VM on a cloud provider. Tension: If not, how's that possible since this is an op implemented in hardware and not software? Outcome: Fences are local, affecting only the current thread.

developers are unsure which [Sync] flags to use and when — In s&box multiplayer. Tension: Without the right flags, values either don't replicate or replicate from the wrong authority.

calling [Rpc.Host] from a client does nothing, calling [Rpc.Broadcast] from a client doesn't work as expected, or RPCs fire on the wrong machine — In s&box multiplayer. Tension: The three RPC types have distinct call semantics that differ from Unity's Command/ClientRpc model.

try to kick players in OnActive after they've already joined — Developers implementing server moderation in s&box. Tension: store bans in memory only (lost on restart). Outcome: The correct approach uses INetworkListener.AcceptConnection to reject at the connection stage, and LocalData for persistence.

animate on the client only (causing desync) or use Lerp-based rotation — Developers building interactive doors in s&box. Tension: doesn't support custom easing. Outcome: The correct pattern syncs state and time, uses AnimationCurve for easing, and routes all state changes through the host.

Projectile hit detection in s&box needs to run on the host only, ignore the instigator — Projectile hit detection in s&box. Tension: use ICollisionListener (not trigger volumes). Timed explosives need host-authoritative detonation using TimeSince rather than async delays.

Fall damage in s&box fires on the owning client (via IPlayerEvents.OnLand) but damage must be applied on the host. — via IPlayerEvents.OnLand. Tension: The pattern requires a client-to-host RPC with a host guard, and the fall sound should only play for the local player.

naively fanning out to all confirmed connections fails silently for agents that aren't currently connected via SSE/StreamableHTTP — Agents working in parallel need a way to signal task start/completion to their collaborators without resorting to direct DMs. Tension: The challenge is: how do you deliver to live agents immediately while reliably queuing for offline ones, and how do you store non-status payloads in a schema that was originally designed only for presence events (agent.online/offline)?

Got HTTP 400 with "missing mcp-session-id" on every call. Tension: The MCP StreamableHTTP transport is not stateless — it requires an explicit session handshake before any tool call. Outcome: Implement the full session lifecycle in the client.

strcpy with unchecked length on stack buffer in sunrpc/clnt_gen.c:62 — When the protocol is 'unix', the function copies a user-controlled hostname parameter directly into a 108-byte fixed-size buffer (sun_path). Tension: Hostnames longer than 108 bytes cause the strcpy() to overflow the buffer and corrupt adjacent stack memory, potentially allowing code execution.

This created drift between human install docs, machine-readable agent manifests, llms.txt references, and actual tested client behavior.

Features built on optional capabilities silently degrade across the client matrix. Outcome: Community 4's transport bugs and Community 103's capability detection failures are two symptoms of the same architectural constraint.

relying on non-standard properties like `req.socket._start_time` can lead to incorrect or missing timing data — When calculating request latency in an HTTP server. Tension: especially in environments where the property is not defined. Outcome: This can result in inaccurate latency metrics, which are critical for performance monitoring and debugging.

Switching waves to Gemini-hosted models and a local Ollama model required more than changing model strings — A local agent benchmark was hard-coded around one CLI runtime and its MCP tool naming convention. Tension: the new runtime emitted different JSON events and exposed MCP tools under different names.

naive optimistic updates either (a) flicker because the next server [REDACTED]shot wipes them or (b) get stuck because you can't — In a server-authoritative realtime app (game tick, collaborative doc). Tension: the next server [REDACTED]shot wipes them. Outcome: Switching to derive-from-[REDACTED]+[REDACTED] made the whole thing trivially correct.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata