ARCADIA-Studio/harness/experiments/source-alias-rename-preparation-20260911/in-process/evaluation.md

In-process alias transaction evidence and recommendation

2026-09-11, Codex-9e8r6t /root/linux_readiness. Independent readback of root's completed experiment; no compilation, rerun, native input, production change or publication by this audit. Frozen preparation files remain historical and unchanged. This note supersedes their preparation-only status solely for in-process/runs/accepted-snapshot-01.

Verified execution

The actual GUI-v3 build receipt identifies HEAD eeeaa1262748800c4c9aaa1eca79a7de96757358, captured-input base f4e426ae2a6971395e1ca7e6f094b0c20056cf93, and unchanged inputs. The probe binds that build's Cargo artifact messages, not a newest-file guess. Rechecked all 43 frozen input hashes/sizes, both current bound rlibs, copied fingerprint hashes, Cargo-message bytes, compiler/compile/probe raw-stream hashes and terminal exit codes. The resulting probe binary still matches 4cfcf5d1725f843beae10652350e9c4d30ac345baf5cf91c3ebc995ab09ae254.

• Exact copied Document: 2ecc2cd496d4a83fd7a32b9dc68e49f0f1cb31a06263dfd6939b4764da5b73e2.
• Binding receipt: de1ef03e8973e3cf354e8f139a6295bbece9aa49ae6f80c15ba6eb7bae5497f8.
• Probe stdout: 0bc605eff97cc9fb8e3d09bd8cc51ccd7ec5a2b4d728a52fd8869234eb2c33d7.
• rustc 1.98.1, Windows gnullvm, LLVM 22.1.8; probe and bound core use opt-level 0/debug assertions. Compile passed with warnings denied in 5.143 s, separately from the 3.656 s complete probe process. Both stderr logs are empty; both exit codes are 0.
• Real release1 baseline: 30 reachable files, 37 physical files, 78,414 source bytes; three samples. Each verified complete expected Project and SourceBundle, preserved UUID set, unchanged captured preview snapshot, exact Undo/Redo/history/dirty transitions, and all physical bytes unchanged. Source expectation is the separately preserved historical CLI preview; model expectation changes only the selected Activity alias.

Raw receipts: in-process/runs/accepted-snapshot-01/{bindings.json,compile.status.json,probe.status.json,probe.stdout.log,result.json}. The historical CLI's whole-process 1.6/2.19-second observations remain a different experiment.

Phase	Sample 1	Sample 2	Sample 3	Median
Initial Document compile/history estimate, ms	126.687	125.334	110.139	125.334
prepare_command, ms	15.894	42.111	26.364	26.364
Source updater/revalidation, ms	399.168	353.238	359.321	359.321
Actual Document::execute, ms	581.467	426.723	449.493	449.493
Undo, microseconds	1.8	1.2	1.5	1.5
Redo, microseconds	1.6	0.6	0.7	0.7

Disk discovery/load was separately 325.910 ms. Each sample initialized a fresh Document; execute ran before preview in samples 1/3 and after preview in sample 2. Cloning, validation assertions, file readback, logging and destruction of returned results are outside individual command intervals. Internal production allocations are included. The host was uncontrolled; these are three debug observations, not a distribution, UI freeze measurement, scaling/RSS study or release-build prediction. Do not subtract separate phase medians to claim an isolated commit cost.

Recommendation: prepare off-thread, commit an opaque alias-specific result

The measured hundreds of milliseconds make synchronous recomputation on the UI thread a poor default for this workflow. They justify moving preparation off-thread; they do not yet prove any alternative's commit latency. Prefer a narrow private prepared-alias capability inside document.rs, independently reviewed before implementation. Reuse existing command/source validation in its constructor, retaining public DTO distrust.

Alternative	Assessment
Preview, then synchronous Document::execute on confirmation	Smallest change and preserves today's validation/history. Repeats the measured 427–581 ms command on the UI thread; unsuitable as the default unless later actual UI evidence overturns that concern.
Recompute on a worker at confirmation, then call current apply_compiled	A safe public-DTO boundary remains, but apply_compiled recompiles on the caller (document.rs:324) and commit still computes history size. Its end-to-end latency was not measured. It also repeats work after the user already reviewed a preview. Do not call it a solved nonblocking path.
Private alias request → worker preparation → opaque prepared result → guarded commit	Reuses the accepted immutable snapshot and exact reviewed intent; computes once, keeps public DTOs untrusted and can avoid revalidation on the UI thread without a generic bypass. Requires explicit authority, history and lifetime invariants below. Recommended bounded design.

A whole-Document asynchronous actor could serialize existing execute safely, but changing general Document ownership is larger than #9. Returning a worker-cloned Document and replacing the live one is not a safe shortcut: it can overwrite intervening history/save-baseline/session state.

Required authority and transaction rules

1. Document mints the request. Capture its private owner/session token, immutable accepted Arc snapshot, engineering revision, limits and exact (target UUID, old alias, new alias) intent. Accept no caller-supplied CompiledSourceProject as authority. Snapshot pointer identity plus revision prevents equal-by-value replacements and Undo-to-identical-state replay; an owner token prevents another Document/session from accepting the result. Keep fields private with no deserialize/from-DTO constructor.
2. Worker validates through existing code. Run prepare_command(SetAlias) and update_bundle_with_identity_map from that captured snapshot; precompute the history byte estimate there. Return a private, preferably consumed-once result and a separate bounded display DTO. The UI's changed-file preview, lexical results, alias strings or hashes cannot substitute for the capability. Edited preview DTOs must have no effect on adopted bytes. Do not add public unchecked apply_compiled/general prepared-Command adoption.
3. Confirm checks both Document and UI context. Match current owner, accepted snapshot identity, engineering revision and requested intent; controller must also match request/preview generation and current workspace/session/draft state. Reject changed/partial/detached/ambiguous/unapplied inputs before adoption, preserving them. New draft text can change without an accepted Document revision, so Document-only checking is insufficient. Close/cancel/superseding requests cannot later commit or steal focus. Bound pending work to one request/result; do not accumulate stale snapshots.
4. Commit into the current Document. Reuse its exact model/source-history semantics, limits, redo clearing and revision/view-index updates; retain the live saved baseline and recovery state rather than installing a worker copy. A legitimate Save completion during preparation must not be overwritten. Distinguish unsaved accepted model changes from unapplied editor drafts. Same-alias/no-change confirmation consumes the result without dirtying, revision change or history insertion; successful rename is one entry; any refusal changes none of these.
5. Measure remaining UI work. Precomputing JSON-based history size avoids knowingly leaving that traversal on confirm. Source equality, history eviction/destruction, cache refresh, source-editor rebuild and preview rendering still need boundedness and measurement. An opaque token alone does not prove constant-time commit. Enforce existing input limits and a bounded changed-file preview, with no silent truncation treated as exhaustive authority.

Falsifiers before adopting this design

Test stale/replayed results after accepted edit, draft-only edit, Undo/Redo back to identical bytes, new Document with identical content, changed alias intent, Close/cancel and superseded worker completion. Tampering with a public compiled DTO or preview must never reach the private commit. Confirm after Save-marker updates must preserve the newest legitimate saved baseline. Assert exact full Project/source/UUID preservation and one Undo/Redo entry, no-op behavior, unchanged rejection state, history eviction and recovery-state behavior. Exercise source/preview size limits and prompt disposal of stale worker results.

Then measure preparation and actual guarded commit plus editor refresh separately on this same walkthrough before adding a bounded larger synthetic case. Finish with the real minimum-window preview/confirm/Undo/Redo/save/reopen workflow. No capability has been implemented, benchmarked or accepted by this note; #6 corrected native acceptance remains root's immediate priority.