Choose guarded worker preparation for Text alias rename

harness/release-source-alias-rename-design-20260911.md

@@ -1,6 +1,6 @@
-# Text-caret alias rename — proposal for critique, 2026-09-11
+# Text-caret alias rename — measured design, 2026-09-11
 
-Codex-9e8r6t `/root/behavior_audit`; [issue 9](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/9). Inspected production commit `36db9356cce3c7614ae37eec9fe17678ca210afe`, issue 9 and `.local/next-slice-audit-20260911.md`. This is a source-derived design, not implementation, executed tests or native acceptance. The frozen #6 GUI `DF7126B8…` remains separate; finish its acceptance before adding this slice. No source8, calculation, library, core or CLI change is proposed here.
+Codex-9e8r6t `/root`, with independent design and review; [issue 9](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/9). The original source-derived design inspected `36db9356`; the transaction choice below now incorporates an exact `eeeaa126`-era experiment and a second critique. This is an implementation direction, not implemented Text rename or native acceptance. Finish the #6 repair correction and navigation milestone before adding this slice. No source8, calculation, library, core or CLI change is proposed here.
 
 **Recommendation:** an editor-local **Rename alias · F2** action opens a compact modal, prepares a complete source preview against the current accepted document, then explicitly adopts that exact candidate as one model/source change. Refuse pending drafts and uncertain target/source membership. Keep Save separate.
 
@@ -21,11 +21,15 @@ Codex-9e8r6t `/root/behavior_audit`; [issue 9](http://217.177.34.108:3000/soroki
 | Reuse Properties, immediately apply SetAlias | Existing semantic capability, but it leaves Text context and lacks complete change review. Generic command dispatch can also accept an unrelated property draft. |
 | Compact modal with explicit Preview, exact candidate, guarded Document adoption | Select. It separates identity/name, keeps a visible change boundary and prevents background actions from retargeting an open form. A persistent side inspector would further narrow the editor; repeated inline expandable diffs would displace it. |
 
-For transaction implementation, select **recompute-on-confirm through `Document::execute(SetAlias)`**. Preview uses the same `prepare_command` plus `update_bundle_with_identity_map` on the pinned accepted snapshot, without live commit. A private form-owned value holds immutable target UUID, old/exact new alias, base and complete preview output; rendering receives read-only data and Confirm carries only its token. After exact freshness/no-op/draft checks, execute that stored typed intent directly, bypassing generic App command dispatch. Already accepted IDs plus alias-only intent make this deterministic; tests must compare the complete actual result with the reviewed output. Never execute then Undo to obtain a preview: that destroys an existing Redo branch and can evict history.
+Select **Document-minted alias request → worker preparation → opaque guarded commit**. The [accepted-snapshot experiment](experiments/source-alias-rename-preparation-20260911/in-process/README.md) measured actual copied `Document::execute(SetAlias)` at 426.7–581.5 ms in three debug samples on the 30-source engineering model. That makes synchronous recomputation on the UI thread a poor default for the shipped development profile. It does not measure a GUI stall, an optimized build or the new prepared commit. A worker followed by public `apply_compiled` would still recompile on the caller; replacing the live Document with a worker clone could overwrite newer save/history state. The narrow alias-only result avoids both problems while retaining public DTO validation.
 
-Add a narrow **read-only** Document history-capacity check, using its existing estimate/budget, before Preview becomes confirmable and again before execution. Refuse if `estimated(before) + estimated(candidate) > HISTORY_BYTES`; a no-op requires no reservation. Older history may still be trimmed normally. Do not duplicate the private byte estimator in App or introduce a general compiled-accept method for this command.
+Document privately captures its owner nonce, accepted `Arc`, engineering revision, limits and exact target UUID/old/new alias. Only existing typed `prepare_command(SetAlias)` and `update_bundle_with_identity_map` construct the result. The worker also computes the complete bounded diff and history estimate. App's Clone messages may transport an immutable `Arc`-backed opaque result, but approval is consumed in current controller state before adoption. Candidate bytes, private estimates and intent are not caller-mutable or deserializable authority. Install the candidate `Arc` into the live Document through its shared history algorithm; do not deep-clone the candidate on Confirm or expose generic unchecked compiled adoption. Never execute then Undo to obtain a preview.
 
-This choice incorporates the [independent critique](release-source-alias-rename-critique-20260911.md), read after the initial independent draft (SHA256 `A1B68F330EEB4ED62B31788B8EEFE2D205E5A1593686633D9C9E38BDB1775512`). The first draft preferred guarded `apply_compiled`; the critique correctly distinguishes internal consistency from exact SetAlias correspondence. A self-consistent but unrelated source replacement is not rename authority. Recompute the immutable typed intent instead. An opaque **alias-specific** Document-owned prepared result remains the alternative if measured representative valid-project preparation/confirmation latency warrants it; keep construction private and consuming adoption guarded. No public mutable `CompiledSourceProject` or `PreparedCommand` is that capability. Root will measure before choosing a more complex API; #6 lexical timings do not settle this question.
+Use Document's exact history estimator before Preview becomes confirmable and recheck private sizes before adoption. Refuse a changing rename if saturating `estimated(before) + estimated(candidate) > HISTORY_BYTES` (32 MiB); a no-op requires no reservation. Otherwise Confirm could evict its own immediate Undo. Older history may still be trimmed normally. Do not duplicate the estimator in App or introduce a general compiled-accept method.
+
+The [first critique](release-source-alias-rename-critique-20260911.md) rejected public compiled DTOs as exact rename authority and led to the simpler recompute-on-confirm proposal. The measured cost now warrants the private result, as refined by the [transaction critique](release-source-alias-rename-transaction-critique-20260911.md). Keep owner + accepted-Arc + revision guards, and refuse request/commit at exhausted `u64::MAX` revision: current saturating revisions otherwise admit edit→Undo replay to the same retained Arc. App workspace/session/invocation/draft guards remain necessary when invalid Open retains the accepted Document while changing destination.
+
+Commit preserves the live saved baseline (including unknown `None`) and recovered flag. It uses the live histories under normal insertion, eviction and Redo rules rather than installing worker histories. A legitimate Save completion during preparation remains authoritative; an earlier Undo may mean the new candidate already equals saved bytes, so a changing rename need not finish dirty. No-op/cancel/refusal must not call `sync` or reset either history/cursor. Measure actual guarded commit plus App refresh before claiming responsiveness: source comparisons, history destruction, editor rebuilding and preview rendering still consume UI time. This bounded implementation will determine whether further changes are justified.
 
 ## Exact contract
 
@@ -45,7 +49,7 @@ Preview rows are derived from every changed file in the complete candidate. Beca
 
 After the target is pinned, typing in the rename field, scrolling the preview and focusing its buttons must remain usable: do not compare all dialog input to #6's original raw-input clock, which those legitimate interactions advance. Keep source/workspace/document freshness separate from form input generation. Passive lint/viewport receipts do not approve or cancel a current preview.
 
-Confirm rechecks all admission predicates, exact old/new alias, target UUID and the exact approved candidate, then recomputes and executes only the stored `SetAlias` through Document once. Consume the approval before dispatch to make repeated Confirm harmless. It neither reruns name resolution from the current caret nor calls generic `Message::Command`, `App::apply`, `apply_source`, Save or migration. If command/source validation or history admission fails, show the error and retain the replacement; no accepted bytes, save baseline, revisions, selection or histories change. Successful adoption follows normal accepted-source synchronization, stays in Text, and selects the new alias at the **same origin occurrence**, using an exact before/after line/token position map. No whole-buffer search for the first new alias. Apply the existing guarded reveal mechanism so a stale focus task cannot steal focus.
+Confirm rechecks all admission predicates, exact old/new alias, target UUID, controller generation and the opaque result's Document authority, then adopts that exact prepared alias candidate once. Consume the live approval before dispatch to make repeated Confirm harmless. It neither reruns name resolution from the current caret nor calls generic `Message::Command`, `App::apply`, `apply_source`, Save or migration. If preparation, freshness or history admission fails, show the error and retain the replacement; no accepted bytes, save baseline, revisions, selection or histories change. Successful adoption follows normal accepted-source synchronization, stays in Text, and selects the new alias at the **same origin occurrence**, using an exact before/after line/token position map. No whole-buffer search for the first new alias. Apply the existing guarded reveal mechanism so a stale focus task cannot steal focus.
 
 **Undo, Save and reopening.** Success supplies a context-bound “Undo rename” action and identifies “Undo model” as the persistent control; Text Ctrl+Z remains Undo text. The immediate Undo action must refuse pending source/property/behavior drafts and a newer accepted revision rather than applying them or undoing some later operation. Undo restores the entire preceding Project and exact accepted SourceBundle; Redo restores the exact candidate, each as one model-history transition. A successful new rename clears the previous redo branch normally; cancel, invalid, stale and no-op paths preserve it. Successful sync has the existing accepted-buffer history behavior; do not promise older per-file draft Undo stacks survive it.
 

harness/release-source-alias-rename-transaction-critique-20260911.md

@@ -0,0 +1,52 @@
+# Source-alias transaction architecture: independent critique
+
+Codex-9e8r6t /root/behavior_audit · 2026-09-11 · Gitea #9
+
+Recommend advancing the narrow Document-minted request → worker preparation → opaque guarded commit design. The measured command cost justifies replacing the earlier synchronous recompute-on-confirm default. This approves a bounded implementation direction, not an implemented API, performance result or native workflow. Complete the corrected #6 milestone first.
+
+I read the prior versioned design/critique, current Document/App seams, the new in-process evaluation, frozen probe and runner, and actual accepted-snapshot-01 receipts. Independent read-only checks revalidated all 43 frozen inputs, copied Cargo messages/fingerprints, compiler/compile/probe terminal-stream hashes and the preserved probe executable. No experiment, compiler, application, metadata or package was run by this review.
+
+## What the measurements justify
+
+The actual debug Document.execute samples are 581.4672, 426.7232 and 449.4926 ms (median 449.4926), on 30 reachable files / 37 physical files / 78,414 source bytes. The probe measures the complete existing execute call separately from initial compilation, discovery, assertions and printing. It alternates execute/preview order, but three uncontrolled-host samples are not a latency distribution or measured GUI stall. The copied Document predates the repair-baseline Option change; its execute/updater algorithm is unchanged. No opaque commit, editor refresh, rendering, RSS, worst-case or optimized build was measured.
+
+The evaluation's recommendation is proportionate to the currently shipped development profile: avoid knowingly placing this repeated work on confirmation's UI thread. A worker recompute followed by current public apply_compiled still recompiles on the caller, so it does not solve that boundary. A whole-Document worker/actor or replacing the live Document is unnecessary and risks overwriting newer save/history state. Keep public compiled DTO revalidation unchanged; add only alias-specific private authority.
+
+The full source expectation in the existing probe comes from the earlier CLI using the same updater lineage; its model expectation independently changes precisely the Activity alias. This is useful cross-version regression/timing evidence, not an independent literal-token oracle for every record family. The new capability/controller tests still need the pre-authored full source fixtures and family matrix from the prior design.
+
+## Required refinements before implementation
+
+1. Preserve immediate Undo capacity explicitly. Current commit can immediately evict its preceding snapshot. Precomputing candidate size alone is insufficient. The prepared result must refuse a changing rename unless current_bytes + candidate_bytes fits HISTORY_BYTES (32 MiB), using the exact private estimator and saturating arithmetic; recheck before adoption. Older history may be trimmed normally. A no-op requires no capacity reservation. This preserves the prior design's one-Undo promise without changing global history policy.
+
+2. Define the authority and Clone transport together. Document should mint a request with private owner nonce, accepted Arc, revision, limits and exact target/old/new alias. Only existing typed SetAlias preparation plus source updater may construct a successful result. No public mutable compiled result, deserialization constructor, caller-supplied byte estimate or changed-file list can authorize adoption. App::Message derives Clone, so a strictly non-Clone result cannot be carried directly. An immutable Arc-backed opaque result is the small compatible transport: consume the live approval/token before committing, and use Document guards for effect-once adoption. Do not add a general mutable wrapper or clone a whole Document. Install the candidate Arc directly; avoid a failed Arc::try_unwrap that deep-clones the project on confirmation. Read-only preview data is derived from this same result and cannot alter its candidate.
+
+3. Close the revision-saturation exception. Document increments revision with saturating_add. At u64::MAX, mint at B → edit C → Undo to the retained B Arc reproduces pointer and revision, defeating the proposed replay proof. The smallest alias-only response is refusing mint/commit at exhausted revision; a separate non-saturating accepted-generation token is an alternative. No global history rewrite is required. Cross-Document equal values and Undo-to-equal bytes must otherwise reject by owner + Arc + revision.
+
+4. Retain the current saved marker and recovered state. Prepared results must not copy/restore saved, recovered_unsaved, past or future. The now-reviewed saved marker is Option<Arc<SourceBundle>>: None means the disk baseline is unknown, not clean. A legitimate Save B completing after preparation must leave Undo-to-B clean after committing C; a live None baseline must remain unknown through commit/Undo; a repaired raw baseline must stay raw. Conversely C may already equal the live saved snapshot after an earlier Undo: a real B→C rename can correctly finish clean. Derive dirty state from the live marker rather than promising every rename sets it. A no-op must not sync source, clear Redo, reset text history/cursor, or overwrite save state.
+
+5. Keep controller freshness distinct from Document authority. Invalid Open can retain the same accepted Arc/revision while replacing the destination/workspace. Recovery can change the save baseline without changing accepted source. Capture the App document identity, workspace session/revision, entry and exact loaded file/text membership, active origin, invocation and replacement/preview generation. Require no pending source/property/behavior/architecture/workflow draft and the prior complete included scope; no implicit Apply or accepted fallback. Recovery, Save As, reset, source/membership edits, edit→Undo, competing drafts and changed intent invalidate approval. Same-destination save-marker updates need not invalidate a still-current accepted source, but must be retained by commit. Reject stale event envelopes before touching current interaction, approval or form state.
+
+6. Bound the remaining UI work rather than calling commit constant-time. The worker should build the complete bounded diff and candidate estimate. The live commit should share the existing history algorithm, not a divergent copy. Source comparison, Arc retirement/history eviction, clearing Redo, validation/explorer refresh, editor reconstruction, preview widget construction and dropping rejected candidates remain potential caller work. Measure actual guarded commit plus App refresh on this same walkthrough before adding a larger bounded case. Only introduce deferred destruction or additional caching if that measured work warrants it; keep one worker/result slot so stale work cannot accumulate large snapshots.
+
+## Controller and UI work remains
+
+Carry forward the compact modal, alias/name distinction, full changed-file coverage, bounded/paged hunks, source-name preservation and fixed footer from the prior design. Enter in Source alias requests Preview; explicit Confirm commits. A partial/truncated lexical #6 reference list is never a replacement plan. Accepted-but-unsaved source is eligible, while raw invalid/unapplied or detached loaded drafts refuse with their text retained. No-op/cancel/refusal leave both histories and source selection unchanged.
+
+Do not use #6's original raw-input clock as the preview's freshness token: normal rename typing, scrolling and button interaction advance it. Use form/context generations for approval; use the existing guarded reveal mechanism only for returning focus and selecting the same originating occurrence after success/close. Old Close/Preview/Confirm after same-path reopen must not affect the new dialog. Close during worker preparation hides immediately but retains the occupied worker slot until the matching completion; a late result cannot reopen the form. Success should offer a context-bound Model Undo action, because Text Ctrl+Z remains text history.
+
+Before acceptance, exercise literal exact Project/SourceBundle expectations for all supported identity families, repeated/comment-separated references, strings/prose, Unicode and CRLF, no-op with existing Redo, stale/superseded/counterfeit results, exhausted revision, capacity boundary, latest Some/None/raw saved baseline, and recovered flag transitions. Include actual App stale-message/modal tests and real paragraph/scroll/footer geometry. Then measure the guarded commit/refresh and perform the identified native preview/confirm/Undo/Redo/Save/reopen workflow. None of those new gates has run here.
+
+## Evidence identities
+
+- Evaluation: aeab6a2ad8243cec536662d2dc79fd854d7ead7f65af5fad285ce143cae2f450.
+- Prior design: fc393a764ce7bee261f314de95b5b06bc5715db98c93b3c05f6ed91ead191e2a.
+- Copied measured Document: 2ecc2cd496d4a83fd7a32b9dc68e49f0f1cb31a06263dfd6939b4764da5b73e2.
+- Probe source: f564fb17035e855658ccf7837f1477c24c62222300d50cee5bf3249f00b2c40a.
+- Probe executable: 4cfcf5d1725f843beae10652350e9c4d30ac345baf5cf91c3ebc995ab09ae254.
+- Bindings: de1ef03e8973e3cf354e8f139a6295bbece9aa49ae6f80c15ba6eb7bae5497f8.
+- Probe stdout: 0bc605eff97cc9fb8e3d09bd8cc51ccd7ec5a2b4d728a52fd8869234eb2c33d7.
+- Reviewed current repair-baseline Document: 7C87280B5B8D112C34865253F8BA0F80D43BC9897771943B15DC7B5608EB17A4.
+
+These refer to .local/source-alias-rename-preparation-20260911/in-process/runs/accepted-snapshot-01 and its frozen inputs. Current mutable target rlibs were not rehashed during root's ongoing compiler lease; this review verified the preserved binding receipts, not a new linker execution.
+
+Review recorded 2026-09-11T20:35:06.107904+00:00. No production or shared report edits.