[karolkulesza]

Description

Swift leg of the scaling work done for Dart (#3314, #3345), Python (#3326) and web_core (#3327).
Fixes #3375.

Timing runner

MessageProcessorScalingConformanceTests runs conformance/core/message_processor_scaling.yaml:
it writes each payload at its two sizes, times processMessages on a new processor once untimed
and then five times in turn, and expects the ratio of the median times to be at most max_ratio.
It runs only when A2UI_RUN_TIMING=1 (A2UI_TIMING_RUNS and A2UI_TIMING_CASE narrow a local
run), so swift test skips it. It fails when the suite has a case it can't parse, or when no
case ran (a typo in A2UI_TIMING_CASE, say). A new performance job in swift_build_and_test.yml runs it in a
release build.

The composition case is skipped as a known gap: SurfaceViewModel resolves the whole node tree
after every components change, which grows with n squared and dominates at 1000/4000. #3231
reworks resolution, so this PR leaves it alone.

Per-batch graph check

Under a config that allows dangling references and a missing root (as .relaxed, the default,
does), the whole-surface graph check can only fail on a self-reference, a cycle, a chain deeper
than the depth limit, or a composition constraint. The surface passed the check before the batch,
so MessageProcessor keeps a ComponentGraphBound per surface, as the Dart core does:

• the references of the batch components replace their old ones; a self-reference fails;
• the height bound of each batch component is recomputed and raised through its holders until
  none rises, so a cycle (which must pass through a batch component) or a chain over the limit
  exceeds the limit;
• composition constraints are checked for the root when the batch holds it, for each batch
  component and its children, and for each holder outside the batch and the batch component it
  holds.

When the bound cannot show the batch passes, the whole surface is checked as before, so the error,
its type and message are those of the whole-surface check. Other configs (strict, or root
required) always use the whole-surface check. The bound is dropped on deleteSurface, and is only
used while it belongs to the same SurfaceViewModel and that surface's components are still at
the SurfaceComponentsModel revision the bound describes.

GraphTopologyValidator only changes maxGlobalDepth and lookupComponentAPI from private to
internal.

Numbers

M2 Pro, swift test -c release -Xswiftc -enable-testing, median processMessages time:

case	main	this PR
relaxed v1.0, 200 / 800	2.02 s / 17.57 s, 8.71	1.51 s / 9.49 s, 6.28
no config v1.0, 200 / 800	2.01 s / 17.57 s, 8.72	1.49 s / 9.37 s, 6.29
composition, 1000 / 4000	not run	13.2 s / 137.5 s, 10.44 (skipped, known gap)

Re-run on the same machine after merging main on 2026-10-30 (3 runs): relaxed 0.24 s / 1.46 s,
ratio 6.02; no config 0.31 s / 1.24 s, ratio 4.03. Absolute times dropped with main's changes;
both ratios stay under 8.

Tests

ComponentGraphBatchCheckTests sends each batch to a processor under .relaxed and checks the
same surface with the batch applied through GraphTopologyValidator.validate; both must accept
it, or both reject it with the same kind of error, and the surface must hold the same components.
Cases: a child after its container, a container after its child, a disallowed child added later,
a container rewritten to drop a disallowed child, a held child whose type changes, a holder the
child doesn't allow, a root the surface may not hold, a cycle closed by a later message, a
self-reference, a chain over the depth limit arriving from its end, two chains joined in the
middle, a cycle closed through an array of ComponentId, a component replaced outside the
processor, a duplicate id in one batch while a bound is cached, and 200 random sequences of 20 batches with and without composition constraints.
Only the kind of error is compared, because when a surface breaks several rules the whole-surface
check reports the first one in dictionary order. Disabling the holder check makes 6 of these
fail. Existing validator and message-processor conformance suites pass unchanged.

Pre-launch Checklist

• I signed the CLA.
• I read the Contributors Guide.
• I read the Style Guide.
• I have built and run at least one sample.
• I have updated the relevant CHANGELOG.md file. (no Swift CHANGELOG)
• I updated/added relevant documentation. (conformance/README.md)
• My code changes (if any) have tests.
• If my branch is on a fork, I have verified that scripts/e2e_test.sh passes.

[gemini-code-assist]

Code Review

This pull request introduces an incremental component graph validation optimization in the Swift core (MessageProcessor) using a new ComponentGraphBound class. When the validation configuration allows dangling references and missing roots, the processor now validates only the updated batch of components against the cached bounds of the existing graph, rather than re-validating the entire surface. This reduces the validation cost to scale with the batch size rather than the total surface size. The PR also adds comprehensive unit tests for this batch validation logic, performance/scaling conformance tests, and updates the documentation. There are no review comments, so I have no feedback to provide.

[Varun-S10]

Hi @karolkulesza, thank you for raising the PR to fix #3375. We have checked the changes and confirmed that they resolve the issue. Before merging, please rebase onto main to fix the merge conflict in conformance/README.md. Also, in MessageProcessor, please use a change counter on SurfaceComponentsModel instead of bound.count == held.count (so same-count direct updates don't leave bound stale), and clear graphBounds in dispose(). Could you please update the PR and let us know? Thank you for your contribution and understanding.

[karolkulesza]

@Varun-S10 thanks, done in 78cc5b2, and rebased onto main:

• SurfaceComponentsModel now has an internal revision, raised by addComponent, removeComponent and applyBatch. The bound records the revision left by the processor's own applyBatch, and a batch is checked against it only while the surface is still at that revision; otherwise the whole surface is checked and the bound rebuilt. ComponentGraphBound.count is gone. New test: sameCountChangeOutsideProcessorIsChecked closes a cycle by replacing a component through applyBatch / addComponent (same count) and expects the next batch to be rejected; it fails with the old count check.
• dispose() clears graphBounds. There is no test for it: the map is private, and a surface created again under the same id is a new SurfaceViewModel, which the bound.surface === surface check already ignored.
• conformance/README.md: kept main's paragraph and added the Swift sentence before its last sentence.
• fix(core): read arrays of ComponentId as child references #3346 (arrays of ComponentId) changed only the field path the validator reports; the bound reads references through the same extractReferences. Added cycleClosedThroughArrayOfComponentIdIsRejected to cover that shape.

swift test passes apart from the two locale failures from #3144; the timing suite in release gives ratios of 6.2 and 6.5 (max 8).

[karolkulesza]

Rebased onto main again after #3386 landed: swift_build_and_test.yml now has both the ios-build job from #3386 and this PR's performance job (prettier check passes). No code changes; lint is clean and swift test passes apart from the #3144 locale cases, which #3372 fixes.

[karolkulesza]

Rebased onto main once more: #3326 rewrote the timing paragraph in conformance/README.md, so I kept its Python sentence and added the Swift one before the closing sentence. No code changes; lint is clean and swift test passes apart from the #3144 locale cases (fixed by #3372).

[Varun-S10]

Hi @karolkulesza, thank you for making the requested updates and rebasing onto main. We have verified the new revision counter on SurfaceComponentsModel and the dispose cleanup, and everything works now. I will escalate this PR to the team for final review. Thank you for your patience and understanding.
Hi @pinieb, Could you please take a look?

[karolkulesza]

Merged main. #3582 moved updateComponents validation into validateComponentsBatch and buildCombinedComponentsForTopology, so the graph check now hooks in there:

• validateComponentGraph runs after main's per-component checks.
• It rejects a duplicate id in the batch before trying the ComponentGraphBound.
• When the bound can't admit the batch, it falls back to main's whole-surface check (buildCombinedComponentsForTopology + GraphTopologyValidator.validate), so errors and their order stay the same as on main.

I also switched ComponentGraphBatchCheckTests to the 1.0 wire version (018ff34). All swift/core tests pass, including message_processor_scaling.yaml.

[pinieb]

Thank you for the PR!