53 lines
9.6 KiB
Markdown
53 lines
9.6 KiB
Markdown
# Source-alias transaction architecture: independent critique
|
|
|
|
Codex-9e8r6t /root/behavior_audit · 2026-09-11 · Gitea #9
|
|
|
|
Recommend advancing the narrow Document-minted request → worker preparation → opaque guarded commit design. The measured command cost justifies replacing the earlier synchronous recompute-on-confirm default. This approves a bounded implementation direction, not an implemented API, performance result or native workflow. Complete the corrected #6 milestone first.
|
|
|
|
I read the prior versioned design/critique, current Document/App seams, the new in-process evaluation, frozen probe and runner, and actual accepted-snapshot-01 receipts. Independent read-only checks revalidated all 43 frozen inputs, copied Cargo messages/fingerprints, compiler/compile/probe terminal-stream hashes and the preserved probe executable. No experiment, compiler, application, metadata or package was run by this review.
|
|
|
|
## What the measurements justify
|
|
|
|
The actual debug Document.execute samples are 581.4672, 426.7232 and 449.4926 ms (median 449.4926), on 30 reachable files / 37 physical files / 78,414 source bytes. The probe measures the complete existing execute call separately from initial compilation, discovery, assertions and printing. It alternates execute/preview order, but three uncontrolled-host samples are not a latency distribution or measured GUI stall. The copied Document predates the repair-baseline Option change; its execute/updater algorithm is unchanged. No opaque commit, editor refresh, rendering, RSS, worst-case or optimized build was measured.
|
|
|
|
The evaluation's recommendation is proportionate to the currently shipped development profile: avoid knowingly placing this repeated work on confirmation's UI thread. A worker recompute followed by current public apply_compiled still recompiles on the caller, so it does not solve that boundary. A whole-Document worker/actor or replacing the live Document is unnecessary and risks overwriting newer save/history state. Keep public compiled DTO revalidation unchanged; add only alias-specific private authority.
|
|
|
|
The full source expectation in the existing probe comes from the earlier CLI using the same updater lineage; its model expectation independently changes precisely the Activity alias. This is useful cross-version regression/timing evidence, not an independent literal-token oracle for every record family. The new capability/controller tests still need the pre-authored full source fixtures and family matrix from the prior design.
|
|
|
|
## Required refinements before implementation
|
|
|
|
1. Preserve immediate Undo capacity explicitly. Current commit can immediately evict its preceding snapshot. Precomputing candidate size alone is insufficient. The prepared result must refuse a changing rename unless current_bytes + candidate_bytes fits HISTORY_BYTES (32 MiB), using the exact private estimator and saturating arithmetic; recheck before adoption. Older history may be trimmed normally. A no-op requires no capacity reservation. This preserves the prior design's one-Undo promise without changing global history policy.
|
|
|
|
2. Define the authority and Clone transport together. Document should mint a request with private owner nonce, accepted Arc, revision, limits and exact target/old/new alias. Only existing typed SetAlias preparation plus source updater may construct a successful result. No public mutable compiled result, deserialization constructor, caller-supplied byte estimate or changed-file list can authorize adoption. App::Message derives Clone, so a strictly non-Clone result cannot be carried directly. An immutable Arc-backed opaque result is the small compatible transport: consume the live approval/token before committing, and use Document guards for effect-once adoption. Do not add a general mutable wrapper or clone a whole Document. Install the candidate Arc directly; avoid a failed Arc::try_unwrap that deep-clones the project on confirmation. Read-only preview data is derived from this same result and cannot alter its candidate.
|
|
|
|
3. Close the revision-saturation exception. Document increments revision with saturating_add. At u64::MAX, mint at B → edit C → Undo to the retained B Arc reproduces pointer and revision, defeating the proposed replay proof. The smallest alias-only response is refusing mint/commit at exhausted revision; a separate non-saturating accepted-generation token is an alternative. No global history rewrite is required. Cross-Document equal values and Undo-to-equal bytes must otherwise reject by owner + Arc + revision.
|
|
|
|
4. Retain the current saved marker and recovered state. Prepared results must not copy/restore saved, recovered_unsaved, past or future. The now-reviewed saved marker is Option<Arc<SourceBundle>>: None means the disk baseline is unknown, not clean. A legitimate Save B completing after preparation must leave Undo-to-B clean after committing C; a live None baseline must remain unknown through commit/Undo; a repaired raw baseline must stay raw. Conversely C may already equal the live saved snapshot after an earlier Undo: a real B→C rename can correctly finish clean. Derive dirty state from the live marker rather than promising every rename sets it. A no-op must not sync source, clear Redo, reset text history/cursor, or overwrite save state.
|
|
|
|
5. Keep controller freshness distinct from Document authority. Invalid Open can retain the same accepted Arc/revision while replacing the destination/workspace. Recovery can change the save baseline without changing accepted source. Capture the App document identity, workspace session/revision, entry and exact loaded file/text membership, active origin, invocation and replacement/preview generation. Require no pending source/property/behavior/architecture/workflow draft and the prior complete included scope; no implicit Apply or accepted fallback. Recovery, Save As, reset, source/membership edits, edit→Undo, competing drafts and changed intent invalidate approval. Same-destination save-marker updates need not invalidate a still-current accepted source, but must be retained by commit. Reject stale event envelopes before touching current interaction, approval or form state.
|
|
|
|
6. Bound the remaining UI work rather than calling commit constant-time. The worker should build the complete bounded diff and candidate estimate. The live commit should share the existing history algorithm, not a divergent copy. Source comparison, Arc retirement/history eviction, clearing Redo, validation/explorer refresh, editor reconstruction, preview widget construction and dropping rejected candidates remain potential caller work. Measure actual guarded commit plus App refresh on this same walkthrough before adding a larger bounded case. Only introduce deferred destruction or additional caching if that measured work warrants it; keep one worker/result slot so stale work cannot accumulate large snapshots.
|
|
|
|
## Controller and UI work remains
|
|
|
|
Carry forward the compact modal, alias/name distinction, full changed-file coverage, bounded/paged hunks, source-name preservation and fixed footer from the prior design. Enter in Source alias requests Preview; explicit Confirm commits. A partial/truncated lexical #6 reference list is never a replacement plan. Accepted-but-unsaved source is eligible, while raw invalid/unapplied or detached loaded drafts refuse with their text retained. No-op/cancel/refusal leave both histories and source selection unchanged.
|
|
|
|
Do not use #6's original raw-input clock as the preview's freshness token: normal rename typing, scrolling and button interaction advance it. Use form/context generations for approval; use the existing guarded reveal mechanism only for returning focus and selecting the same originating occurrence after success/close. Old Close/Preview/Confirm after same-path reopen must not affect the new dialog. Close during worker preparation hides immediately but retains the occupied worker slot until the matching completion; a late result cannot reopen the form. Success should offer a context-bound Model Undo action, because Text Ctrl+Z remains text history.
|
|
|
|
Before acceptance, exercise literal exact Project/SourceBundle expectations for all supported identity families, repeated/comment-separated references, strings/prose, Unicode and CRLF, no-op with existing Redo, stale/superseded/counterfeit results, exhausted revision, capacity boundary, latest Some/None/raw saved baseline, and recovered flag transitions. Include actual App stale-message/modal tests and real paragraph/scroll/footer geometry. Then measure the guarded commit/refresh and perform the identified native preview/confirm/Undo/Redo/Save/reopen workflow. None of those new gates has run here.
|
|
|
|
## Evidence identities
|
|
|
|
- Evaluation: aeab6a2ad8243cec536662d2dc79fd854d7ead7f65af5fad285ce143cae2f450.
|
|
- Prior design: fc393a764ce7bee261f314de95b5b06bc5715db98c93b3c05f6ed91ead191e2a.
|
|
- Copied measured Document: 2ecc2cd496d4a83fd7a32b9dc68e49f0f1cb31a06263dfd6939b4764da5b73e2.
|
|
- Probe source: f564fb17035e855658ccf7837f1477c24c62222300d50cee5bf3249f00b2c40a.
|
|
- Probe executable: 4cfcf5d1725f843beae10652350e9c4d30ac345baf5cf91c3ebc995ab09ae254.
|
|
- Bindings: de1ef03e8973e3cf354e8f139a6295bbece9aa49ae6f80c15ba6eb7bae5497f8.
|
|
- Probe stdout: 0bc605eff97cc9fb8e3d09bd8cc51ccd7ec5a2b4d728a52fd8869234eb2c33d7.
|
|
- Reviewed current repair-baseline Document: 7C87280B5B8D112C34865253F8BA0F80D43BC9897771943B15DC7B5608EB17A4.
|
|
|
|
These refer to .local/source-alias-rename-preparation-20260911/in-process/runs/accepted-snapshot-01 and its frozen inputs. Current mutable target rlibs were not rehashed during root's ongoing compiler lease; this review verified the preserved binding receipts, not a new linker execution.
|
|
|
|
Review recorded 2026-09-11T20:35:06.107904+00:00. No production or shared report edits.
|