Declare state stores shared by 0.9 and 0.10 instances unsupported (#7494)

* Save states with the schema hash 0.9 workers check

Since #7461, `_serialize` wrote the new `_to_schema` hash (field names and
types only) next to each pickled state. Workers of 0.9.x and 0.10.0a1 compare
that hash with their own, which includes the defaults, and replace the state
with a fresh one on any mismatch. A rolling deploy or a rollback sharing Redis
or the disk state manager with them therefore silently reset every session,
and the old worker wrote the fresh state back, so the data was lost for good.
The rest of the payload was already readable by those workers.

Save the previous format's hash (`_legacy_state_schema`, now cached like
`_to_schema`) next to the pickle, and record the new hash inside the pickled
dict under `__reflex_schema__`. Older workers keep that entry as a plain
instance attribute and write it back, which stays correct because they only
accept a state whose names, types and defaults match their own.
`_deserialize` checks the recorded hash when present, so defaults remain
outside the schema for this release, and falls back to the saved hash for
pickles from 0.10.0a2 and older releases.

Fixes #7470

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SjCrbdguMkfe4bhbaREiwo

* Serialize non-class field types in the previous-release schema helper

The helper that recomputes the hash 0.9 workers check mirrored only the
class branch of the old _serialize_type, so a state with a generic or
union annotation would raise instead of being checked. Mirror the other
branch too, as the 0.9.12 implementation did.

Refs #7470

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SjCrbdguMkfe4bhbaREiwo

* Declare state stores shared by 0.9 and 0.10 instances unsupported

Drop the change that wrote the 0.9 schema hash next to each pickled state so
0.9 and 0.10.0a1 workers could load state saved by this release, and restore
reflex/state.py and its tests to main. Instead, a `breaking` news fragment and
the Self Hosting docs state that instances of 0.9 and 0.10 cannot share a
Redis or disk state store: 0.10 still loads state saved by 0.9, but a 0.9
instance discards state saved by 0.10, so a rolling deploy that runs both
versions, or a rollback against the same store, resets the sessions that reach
the older instance. The field-descriptors fragment no longer claims that
states saved by this release load in workers of the previous one, which has
not held since the names-and-types schema hash.

Refs #7470

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SjCrbdguMkfe4bhbaREiwo

* Stop saving the entries that let 0.9 workers load a pickle

`__getstate__` added empty `dirty_vars`, `dirty_substates` and
`_backend_vars` entries so workers of the previous release could restore
a state of this one. Those workers never get past the schema check on a
state saved by this release, so the entries only made every pickle
larger. `__setstate__` keeps dropping them, and the `_backend_vars` dict,
from pickles written by 0.9 and 0.10.0a2 workers.

Refs #7470

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SjCrbdguMkfe4bhbaREiwo

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: masenf

docs/hosting/self-hosting.md

@@ -61,6 +61,13 @@ Alternatively, put a reverse proxy in front of both processes and route the
 backend routes (`/_event`, `/ping`, `/_upload`, `/_health`) to the backend
 port, as the `Caddyfile`s in the container examples below do.
 
+Instances of Reflex 0.9 and 0.10 cannot share a state store, whether Redis or
+the disk state manager's directory. A 0.10 instance loads state saved by 0.9,
+but a 0.9 instance discards state saved by 0.10, so a rolling deploy that runs
+both versions, or a rollback to 0.9 against the same store, resets the sessions
+that reach the older instance. Upgrade every instance of an app together, and
+clear the store (or point the app at a fresh one) when rolling back.
+
 ```md alert warning
 # Reverse Proxy and Websockets
 Because the backend uses websockets, some reverse proxy servers, like [nginx](https://nginx.org/en/docs/http/websocket.html) or [apache](https://httpd.apache.org/docs/2.4/mod/mod_proxy.html#protoupgrade), must be configured to pass the `Upgrade` header to allow backend connectivity.

news/+field-descriptors.breaking.md

@@ -1 +1 @@
-A substate may now declare a var or computed var with the same name as an inherited var: it gets an independent one of its own, instead of raising `BaseVarShadowsInheritedVarError` or `ComputedVarShadowsBaseVarsError`. A dynamic route arg only conflicts with a var of the state it is installed on. Assigning an undeclared state attribute still raises `SetUndefinedStateVarError` outside of prod mode, but no longer in prod. The internal class maps `backend_vars`, `inherited_vars` and `inherited_backend_vars`, `get_skip_vars()` and the instance `_backend_vars` are removed: use `get_fields()`, whose fields know the state they belong to. States saved by this release still load in workers of the previous one, so rolling deploys sharing Redis keep working, with one exception: while old workers remain, an in-place change to a mutable backend var (like `self._items.append(x)`) made on an old worker to a state saved by this release is not persisted. Assigning backend vars, and any change to frontend vars, is unaffected.
+A substate may now declare a var or computed var with the same name as an inherited var: it gets an independent one of its own, instead of raising `BaseVarShadowsInheritedVarError` or `ComputedVarShadowsBaseVarsError`. A dynamic route arg only conflicts with a var of the state it is installed on. Assigning an undeclared state attribute still raises `SetUndefinedStateVarError` outside of prod mode, but no longer in prod. The internal class maps `backend_vars`, `inherited_vars` and `inherited_backend_vars`, `get_skip_vars()` and the instance `_backend_vars` are removed: use `get_fields()`, whose fields know the state they belong to.

news/+state-store-mixed-versions.breaking.md

@@ -0,0 +1 @@
+Instances of Reflex 0.9 and 0.10 can no longer share a Redis or disk state store. A 0.10 instance loads state saved by 0.9, but a 0.9 instance discards state saved by 0.10, so a rolling deploy that runs both versions, or a rollback to 0.9 against the same store, resets the sessions that reach the older instance. Upgrade every instance of an app together, and clear the store (or start a fresh one) when rolling back.

reflex/state.py

@@ -97,14 +97,6 @@
 from reflex.utils import console, format, types
 from reflex.utils.exec import is_testing_env
 
-# Entries in each pickle for workers of the previous release, which kept the
-# dirty tracking and backend vars in the instance dict. Remove in 1.0.
-_PREVIOUS_RELEASE_PICKLE_KEYS: dict[str, Any] = {
-    "dirty_vars": set(),
-    "dirty_substates": set(),
-    "_backend_vars": {},
-}
-
 
 @functools.cache
 def _stale_pickle_keys(cls: type[BaseState]) -> frozenset[str]:
@@ -2049,8 +2041,7 @@ def __getstate__(self):
         for name, f in cls.__fields__.items():
             if f._owner is cls and name not in fields:
                 fields[name] = f.default_value()
-        # Empty entries that let workers of the previous release load it.
-        return {**fields, **_PREVIOUS_RELEASE_PICKLE_KEYS}
+        return fields
 
     def __setstate__(self, state: builtins.dict[str, Any]):
         """Set the state from redis deserialization.

tests/units/test_state.py

@@ -6671,6 +6671,26 @@ def combined(self) -> str:
         state_cls._potentially_dirty_states.discard(consumer_name)
 
 
+def test_getstate_holds_only_the_fields_of_the_state():
+    """A pickle holds the state's own fields and nothing for older workers.
+
+    Workers of the previous release cannot load a state of this one, so the
+    empty entries once added for them are gone.
+    """
+
+    class OwnFieldsState(BaseState):
+        count: int = 0
+        _secret: str = ""
+
+    state = OwnFieldsState(_reflex_internal_init=True)  # pyright: ignore [reportCallIssue]
+    state.count = 2
+
+    pickled = state.__getstate__()
+    assert pickled["count"] == 2
+    assert pickled["_secret"] == ""
+    assert not {"dirty_vars", "dirty_substates", "_backend_vars"} & pickled.keys()
+
+
 def test_setstate_migrates_older_pickles():
     """Older pickles kept backend vars in a dict of their own and the dirty sets."""