ARCADIA-Studio/harness/release-source-alias-rename-transaction-critique-20260911.md

Source-alias transaction architecture: independent critique

Codex-9e8r6t /root/behavior_audit · 2026-09-11 · Gitea #9

Recommend advancing the narrow Document-minted request → worker preparation → opaque guarded commit design. The measured command cost justifies replacing the earlier synchronous recompute-on-confirm default. This approves a bounded implementation direction, not an implemented API, performance result or native workflow. Complete the corrected #6 milestone first.

I read the prior versioned design/critique, current Document/App seams, the new in-process evaluation, frozen probe and runner, and actual accepted-snapshot-01 receipts. Independent read-only checks revalidated all 43 frozen inputs, copied Cargo messages/fingerprints, compiler/compile/probe terminal-stream hashes and the preserved probe executable. No experiment, compiler, application, metadata or package was run by this review.

What the measurements justify

The actual debug Document.execute samples are 581.4672, 426.7232 and 449.4926 ms (median 449.4926), on 30 reachable files / 37 physical files / 78,414 source bytes. The probe measures the complete existing execute call separately from initial compilation, discovery, assertions and printing. It alternates execute/preview order, but three uncontrolled-host samples are not a latency distribution or measured GUI stall. The copied Document predates the repair-baseline Option change; its execute/updater algorithm is unchanged. No opaque commit, editor refresh, rendering, RSS, worst-case or optimized build was measured.

The evaluation's recommendation is proportionate to the currently shipped development profile: avoid knowingly placing this repeated work on confirmation's UI thread. A worker recompute followed by current public apply_compiled still recompiles on the caller, so it does not solve that boundary. A whole-Document worker/actor or replacing the live Document is unnecessary and risks overwriting newer save/history state. Keep public compiled DTO revalidation unchanged; add only alias-specific private authority.

The full source expectation in the existing probe comes from the earlier CLI using the same updater lineage; its model expectation independently changes precisely the Activity alias. This is useful cross-version regression/timing evidence, not an independent literal-token oracle for every record family. The new capability/controller tests still need the pre-authored full source fixtures and family matrix from the prior design.

Required refinements before implementation

1. Preserve immediate Undo capacity explicitly. Current commit can immediately evict its preceding snapshot. Precomputing candidate size alone is insufficient. The prepared result must refuse a changing rename unless current_bytes + candidate_bytes fits HISTORY_BYTES (32 MiB), using the exact private estimator and saturating arithmetic; recheck before adoption. Older history may be trimmed normally. A no-op requires no capacity reservation. This preserves the prior design's one-Undo promise without changing global history policy.

2. Define the authority and Clone transport together. Document should mint a request with private owner nonce, accepted Arc, revision, limits and exact target/old/new alias. Only existing typed SetAlias preparation plus source updater may construct a successful result. No public mutable compiled result, deserialization constructor, caller-supplied byte estimate or changed-file list can authorize adoption. App::Message derives Clone, so a strictly non-Clone result cannot be carried directly. An immutable Arc-backed opaque result is the small compatible transport: consume the live approval/token before committing, and use Document guards for effect-once adoption. Do not add a general mutable wrapper or clone a whole Document. Install the candidate Arc directly; avoid a failed Arc::try_unwrap that deep-clones the project on confirmation. Read-only preview data is derived from this same result and cannot alter its candidate.

3. Close the revision-saturation exception. Document increments revision with saturating_add. At u64::MAX, mint at B → edit C → Undo to the retained B Arc reproduces pointer and revision, defeating the proposed replay proof. The smallest alias-only response is refusing mint/commit at exhausted revision; a separate non-saturating accepted-generation token is an alternative. No global history rewrite is required. Cross-Document equal values and Undo-to-equal bytes must otherwise reject by owner + Arc + revision.

4. Retain the current saved marker and recovered state. Prepared results must not copy/restore saved, recovered_unsaved, past or future. The now-reviewed saved marker is Option<Arc>: None means the disk baseline is unknown, not clean. A legitimate Save B completing after preparation must leave Undo-to-B clean after committing C; a live None baseline must remain unknown through commit/Undo; a repaired raw baseline must stay raw. Conversely C may already equal the live saved snapshot after an earlier Undo: a real B→C rename can correctly finish clean. Derive dirty state from the live marker rather than promising every rename sets it. A no-op must not sync source, clear Redo, reset text history/cursor, or overwrite save state.

5. Keep controller freshness distinct from Document authority. Invalid Open can retain the same accepted Arc/revision while replacing the destination/workspace. Recovery can change the save baseline without changing accepted source. Capture the App document identity, workspace session/revision, entry and exact loaded file/text membership, active origin, invocation and replacement/preview generation. Require no pending source/property/behavior/architecture/workflow draft and the prior complete included scope; no implicit Apply or accepted fallback. Recovery, Save As, reset, source/membership edits, edit→Undo, competing drafts and changed intent invalidate approval. Same-destination save-marker updates need not invalidate a still-current accepted source, but must be retained by commit. Reject stale event envelopes before touching current interaction, approval or form state.

6. Bound the remaining UI work rather than calling commit constant-time. The worker should build the complete bounded diff and candidate estimate. The live commit should share the existing history algorithm, not a divergent copy. Source comparison, Arc retirement/history eviction, clearing Redo, validation/explorer refresh, editor reconstruction, preview widget construction and dropping rejected candidates remain potential caller work. Measure actual guarded commit plus App refresh on this same walkthrough before adding a larger bounded case. Only introduce deferred destruction or additional caching if that measured work warrants it; keep one worker/result slot so stale work cannot accumulate large snapshots.

Controller and UI work remains

Carry forward the compact modal, alias/name distinction, full changed-file coverage, bounded/paged hunks, source-name preservation and fixed footer from the prior design. Enter in Source alias requests Preview; explicit Confirm commits. A partial/truncated lexical #6 reference list is never a replacement plan. Accepted-but-unsaved source is eligible, while raw invalid/unapplied or detached loaded drafts refuse with their text retained. No-op/cancel/refusal leave both histories and source selection unchanged.

Do not use #6's original raw-input clock as the preview's freshness token: normal rename typing, scrolling and button interaction advance it. Use form/context generations for approval; use the existing guarded reveal mechanism only for returning focus and selecting the same originating occurrence after success/close. Old Close/Preview/Confirm after same-path reopen must not affect the new dialog. Close during worker preparation hides immediately but retains the occupied worker slot until the matching completion; a late result cannot reopen the form. Success should offer a context-bound Model Undo action, because Text Ctrl+Z remains text history.

Before acceptance, exercise literal exact Project/SourceBundle expectations for all supported identity families, repeated/comment-separated references, strings/prose, Unicode and CRLF, no-op with existing Redo, stale/superseded/counterfeit results, exhausted revision, capacity boundary, latest Some/None/raw saved baseline, and recovered flag transitions. Include actual App stale-message/modal tests and real paragraph/scroll/footer geometry. Then measure the guarded commit/refresh and perform the identified native preview/confirm/Undo/Redo/Save/reopen workflow. None of those new gates has run here.

Evidence identities

• Evaluation: aeab6a2ad8243cec536662d2dc79fd854d7ead7f65af5fad285ce143cae2f450.
• Prior design: fc393a764ce7bee261f314de95b5b06bc5715db98c93b3c05f6ed91ead191e2a.
• Copied measured Document: 2ecc2cd496d4a83fd7a32b9dc68e49f0f1cb31a06263dfd6939b4764da5b73e2.
• Probe source: f564fb17035e855658ccf7837f1477c24c62222300d50cee5bf3249f00b2c40a.
• Probe executable: 4cfcf5d1725f843beae10652350e9c4d30ac345baf5cf91c3ebc995ab09ae254.
• Bindings: de1ef03e8973e3cf354e8f139a6295bbece9aa49ae6f80c15ba6eb7bae5497f8.
• Probe stdout: 0bc605eff97cc9fb8e3d09bd8cc51ccd7ec5a2b4d728a52fd8869234eb2c33d7.
• Reviewed current repair-baseline Document: 7C87280B5B8D112C34865253F8BA0F80D43BC9897771943B15DC7B5608EB17A4.

These refer to .local/source-alias-rename-preparation-20260911/in-process/runs/accepted-snapshot-01 and its frozen inputs. Current mutable target rlibs were not rehashed during root's ongoing compiler lease; this review verified the preserved binding receipts, not a new linker execution.

Review recorded 2026-09-11T20:35:06.107904+00:00. No production or shared report edits.