Pin the component library at abac8b4: MarkdownDocument (C14.3)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

tasks/TASKS.md

@@ -100,7 +100,7 @@
 - [x] C14.0 前置：`reference/` 加 markion 与 markdown-rs 并钉提交；`scripts/review.sh` 照用户新定（gpt-6.1-sol，effort high，fast，每条最多三轮） — R2 ok
 - [x] C14.1 组件库：`MarkdownRenderer`、`MarkdownEditor`、Markdown 着色、块范围、大纲与链接查找改用 markdown-rs（`documents` 的 `tree`、`markdown`、`render`）；`BlockEditor` 的导入导出不属 ElyMark，仍用 pulldown-cmark；原有测试照过，改了语义的测试写明 markdown-rs 的读法；推送，ElyOffice 钉新提交 — R2 ok
 - [~] C14.2 组件库：公式与 Mermaid（MARK-04）。`typography::Latex` 改由 RaTeX 排出；Mermaid 由 mermaid-rs-renderer 画成图；画不出即显示错误与原文；`MarkdownRenderer` 用二者，本地图片按属主给的文件夹读，网络图片不自动载入 — R1 FAIL 六项已修：版面失败把公式写进日志（只记固定文字）；资源与图集从不释放（`primitives::held` 持有，换内容或离开即释放）；公式失败丢了原文与位置（显示原因、位置与原文）；零边距裁掉字形（按墨迹重取画框）；`file:` 地址把片段当文件名、把主机当相对路径（解析主机，去查询与片段）；Mermaid 节点字色未取 Ely 前景。R2 FAIL 一项已修：一个持有者离开即逐出共享资源（按资源计数）。R3 FAIL 两项已修（不再送审）：最后离开的持有者若未收到图，图集里的图不释放（图存于共享记录，由最后离开者释放，单测 `the_last_holder_frees_the_image_another_painted`）；一行注释 11 词（已缩短）
-- [ ] C14.3 组件库：文件级 Markdown 文档组件。一个 `CodeEditor` 持全文与撤销；可视（变高虚拟列表，逐块渲染，按下的块开成源码，写回为一步撤销）、源码（`CodeEditor` 加 Markdown 着色）、预览（只读）；属主可读写文本、模式、插入点行列、滚动，可跳到行；改动发事件
+- [~] C14.3 组件库：文件级 Markdown 文档组件。一个 `CodeEditor` 持全文与撤销；可视（变高虚拟列表，逐块渲染，按下的块开成源码，写回为一步撤销）、源码（`CodeEditor` 加 Markdown 着色）、预览（只读）；属主可读写文本、模式、插入点行列、滚动，可跳到行；改动发事件 — R1 FAIL 七项已修：写回后按下别的块用旧范围（按偏移换算所按的块，结构变了不开）；插入点偏移撤销后落在字符中间（改用编辑器选区为唯一插入点）；预览收撤销重做（预览不挂动作）；末尾新块的插入点漏算接缝；无插入点与滚动的设定（`set_caret`、`set_top_line`，换模式保持顶行）；输入法组字与撤销重做不受 64 MiB 限制（每条路径都限，含重做）；块不可用键盘到达（Tab 停靠点，Enter、空格打开）。R2 FAIL 三项已修：长文后台解析期间写回后按下仍用旧范围（解析文字与编辑器文字相同才可打开）；块内滚动位置丢失（按块高比例）；换文字后立即设顶行用旧块（要求等其文字解析后落定）。R3 FAIL 四项已修（不再送审）：迟到的帧回调完成了新的要求（要求带编号，只完成自己的）；等待中的顶行越过换成的短文字而崩溃（放时按当下行数夹住）；换文字后的 `reveal` 用旧块（`reveal` 也是等解析的要求）；测试不跑帧回调（`frames` 调 `simulate_next_frame`，并核对要求已完成，块内比例改为零时测试失败）
 - [ ] C14.4 ElyMark 文件会话改为原生（MARK-01，§14.3，QA-21）：视图换成 C14.3 的组件，文本即文件原文，无序列化；BOM、CRLF 照旧；新建、打开、保存、另存、重命名照旧；应用不再依赖 `ely-web-content`
 - [ ] C14.5 删去 CEF：`crates/ely-web-content`、`scripts/fetch-cef.sh`、`scripts/build-mark-content.sh`、`apps/ely-mark/web`、打包里的 CEF 辅助应用与许可、CEF 的测试脚本；PRD 与 `agents.md` 写明新路线，ElyMail 正文不用 CEF 与 Electron
 - [ ] C14.6 编辑模式与大文件（MARK-02、14，PERF-07）：可视、源码、预览按标签切换，切换不改文件，撤销跨模式；超过阈值的文件只开源码并说明；1 MB 文档 2 秒内可编辑，实测记录

tasks/reviews/C14.3-r1.md

@@ -0,0 +1,15 @@
+FAIL
+
+1. `../Ely-GPUI-Components/src/documents/document/visual.rs:51` — Opening another block uses ranges from before the current block was committed. The editor's Changed subscription has not reparsed the document when `open` immediately slices its new text using the old range. With `A\n\nB\n\nC`, delete A in its open field and click C: the probe panics at line 54 because byte 7 exceeds the new six-byte text. Adding `\n\nNew` to A and clicking B instead opens `N`. Preserve the clicked block's identity across the commit, translate its range through the edit, and validate against the matching text revision before opening it; cover length and structure changes. Evidence: `.work/C14.3-r1/probes.log`, `review_click_last_after_deleting_first` and `review_click_next_after_splitting_first`. The unmodified library passed all 1,766 tests and `cargo clippy --all-targets --features test-support -- -D warnings`; logs are in the same directory.
+
+2. `../Ely-GPUI-Components/src/documents/document/mod.rs:211` — The resting caret remains a byte offset into an earlier revision, and clamping to text length does not make it a UTF-8 boundary. Open `éabcd` in Visual, replace the block with `x`, press Escape, then undo. The restored text is correct, but `caret()` panics because `rest == 1` is inside é. An owner reading the caret for its status bar or session state can therefore crash after an ordinary undo. Update the resting position when text/history changes and ensure every offset passed to `Buffer::point` belongs to the current text and a character boundary. Evidence: `.work/C14.3-r1/probes.log`, `review_caret_after_undo_unicode`.
+
+3. `../Ely-GPUI-Components/src/documents/document/visual.rs:250` — Preview installs the same mutating Undo/Redo handlers as Visual, while the backing CodeEditor remains editable. After changing TEXT to `Changed`, switch to Preview and press Ctrl+Z: the supposedly read-only preview restores TEXT and emits a content change. Redo has the same unguarded path. Reject editing/history actions in Preview while allowing owner-driven content updates, and test undo and redo after entering Preview with existing history. Evidence: `.work/C14.3-r1/probes.log`, `review_preview_cannot_undo`; this violates MARK-02.
+
+4. `../Ely-GPUI-Components/src/documents/document/mod.rs:195` — The caret calculation for an appended block omits the separator inserted by `joint(text)`. Starting with `A`, open the add-block field and type `B`: `text()` correctly returns `A\n\nB`, but `caret()` reports `(0, 2)` instead of `(2, 1)`. Compute the position against the effective document text, including the inserted separator, and cover documents ending in zero, one and two newlines. Evidence: `.work/C14.3-r1/probes.log`, `review_append_reports_actual_caret`.
+
+5. `../Ely-GPUI-Components/src/documents/document/mod.rs:231` — C14.3 requires the owner to read and write caret line/column and scroll state, but the component exposes getters and only `reveal(line)`. That method forces column zero and couples scrolling to caret movement; neither the visual resting caret nor its private list scroll can be restored independently. Selecting a source caret through `editor()` also does not synchronize the visual caret: the probe selects `(4, 1)`, switches to Visual and reads `(4, 0)`. Provide the required independent position/scroll setters and synchronize the position used by each mode, with restoration tests covering a nonzero column and a viewport separate from the caret. Evidence: the public API and `.work/C14.3-r1/probes.log`, `review_mode_switch_keeps_caret`.
+
+6. `../Ely-GPUI-Components/src/editor/state.rs:435` — The claimed 64 MiB history limit is enforced only on ordinary commits. IME completion records directly in `ime.rs:69`, and undo/redo move whole snapshots without applying the limit. Three compositions in a 23 MiB editor retain 72,351,744 bytes; replacing `small` with 65 MiB and undoing retains 68,157,440 bytes in redo. Thus composition history can grow without the advertised bound. Enforce the budget on every history insertion/transfer, including redo-only overflow, while preserving a valid undo/redo chain, and cover those paths. Evidence: `.work/C14.3-r1/probes.log`, `review_compositions_also_cap_history` and `review_undo_also_caps_history`; `.work/C14.3-r1/probe-source.log` includes the read-only size instrumentation. The final AGENTS.md decision overstates the current implementation.
+
+7. `../Ely-GPUI-Components/src/documents/document/visual.rs:198` — Visual blocks and the add-block row are pressable only with the mouse: they have no Tab stop, focus ring or keyboard activation. The document's own focus handle is not a Tab stop, and its Up/Down handlers do nothing until a field has already been opened with the mouse. With the component inside a root FocusScope, Tab followed by Enter opens no block, so keyboard users cannot begin visual editing. Make the visual editing targets reachable with visible focus and keyboard activation, including the add-block target, as required by the gpui rules. Evidence: `.work/C14.3-r1/keyboard.log` and its FocusScope-wrapped probe in `.work/C14.3-r1/probe-source.log`.

tasks/reviews/C14.3-r2.md

@@ -0,0 +1,7 @@
+FAIL
+
+1. `../Ely-GPUI-Components/src/documents/document/edit.rs:41` — Round 1 defect 1 remains above the asynchronous parsing threshold. A write-back changes the editor before its Changed subscription advances `edits`; `reparse` schedules background work without invalidating `read`, so `read_now()` still accepts the old block ranges. Start with `A\n\nB\n\nCCCC\n\n` followed by enough paragraphs to exceed 128 KiB, replace A with AAAA, and press B: its field opens `B\n\nC`, including part of the untouched next block. Invalidate the parsed revision synchronously and reject or defer opening until the ranges belong to the current text. Cover write-backs above the threshold. Reproduced by `review_async_parse_cannot_open_a_stale_range` in `.work/C14.3-r2/probes-final.log`; probe source is in `probe-source.log` in that directory.
+
+2. `../Ely-GPUI-Components/src/documents/document/place.rs:55` — Scroll reads discard `offset_in_item`, and the setter at line 79 always writes zero. In a 100-line fenced code block, source top line 40 becomes 0 after switching to Visual. Scrolling 500 pixels into that block in Visual and switching to Preview also jumps to its beginning. Thus round 1 defect 5 is only partly fixed, and the final AGENTS.md claim that mode switches preserve the top line is false. Preserve the position within a block when reading, restoring and switching views; cover tall blocks rather than only separate one-line paragraphs. Both scenarios fail in `review_top_line_inside_a_code_block_survives_modes` and `review_visual_to_preview_keeps_inside_block_offset` in `.work/C14.3-r2/probes-final.log`.
+
+3. `../Ely-GPUI-Components/src/documents/document/place.rs:76` — Restoring scroll immediately after replacing text uses the preceding document's parsed blocks. Open `old` in Visual, then call `reset` with 100 separate paragraphs and `set_top_line(40)` in the same owner update: after parsing and rendering settle, the top line is 0. The replacement's Changed subscription reparses later, but nothing reapplies the requested position. This breaks C14.3's owner-controlled scroll restoration and MARK-12 session restoration. Resolve the request against the replacement revision, deferring it until that revision is parsed when necessary. Reproduced by `review_reset_then_restore_scroll` in `.work/C14.3-r2/probes-final.log`. The unmodified library passed all 1,779 tests and `cargo clippy --all-targets --features test-support -- -D warnings`; logs are in the same directory.

tasks/reviews/C14.3-r3.md

@@ -0,0 +1,9 @@
+FAIL
+
+1. `../Ely-GPUI-Components/src/documents/document/place.rs:130` — A placement callback identifies its request only by line number, so an obsolete callback can finish a newer request for another mode or text revision. With 100 paragraphs, call `set_top_line(40)` in Source and switch to Visual before the next frame: after callbacks settle, the top is 0. The reverse switch also yields 0. In Visual, requesting line 40, resetting to a 100-line fenced block and requesting line 40 again likewise lands at 0. Track request identity together with its mode and text revision; obsolete callbacks must not clear the current request. Cover these interleavings with actual frame callbacks. Reproduced by the two `review_pending_*` probes and `review_inflight_top_then_new_text_same_line` in `.work/C14.3-r3/probes.log`. The final AGENTS.md claim that mode switches preserve the top line is therefore incomplete.
+
+2. `../Ely-GPUI-Components/src/documents/document/place.rs:100` — A deferred top line is clamped only when requested, then indexed against potentially shorter replacement text. In Visual, reset to more than 128 KiB of paragraphs, request top line 40 while parsing is pending, then reset to `short` before placement. Rendering calls `Buffer::line_range(40)` on a one-line buffer and panics: `the len is 1 but the index is 40`. Revalidate pending positions against the current text when placing them, and invalidate obsolete placement state on replacement. Reproduced by `review_waiting_top_then_shorter_reset` in `.work/C14.3-r3/probes.log`.
+
+3. `../Ely-GPUI-Components/src/documents/document/place.rs:160` — `reveal` still resolves its target using the previous parsed blocks and never retries after the replacement is parsed. Open `old` in Visual, then reset to 100 paragraphs and call `reveal(80)` in the same owner update. After parsing and frame callbacks settle, the target block remains outside the viewport. The same reveal succeeds when issued after the new parse, confirming that the jump was lost. Defer the reveal until its text revision is parsed, then resolve and reveal the requested line. Evidence: `review_reveal_after_reset` in `.work/C14.3-r3/probes.log` and the passing `review_reveal_after_read_is_visible` control in `.work/C14.3-r3/mutation.log`.
+
+4. `../Ely-GPUI-Components/src/documents/document/tests.rs:36` — The scroll-test helper refreshes the window without executing `Window::simulate_next_frame`, so the new placement callbacks never run. Assertions on `top_line()` merely read the pending request, masking failures in the final placement. Forcing the callback's within-block offset to zero still passes all 25 original MarkdownDocument tests, including the tall-block restoration test. Execute the next-frame callbacks, verify the request has completed, and assert the resulting viewport position. Evidence: `.work/C14.3-r3/mutation.log` and `mutation-source.log`; the independent probes that execute callbacks expose defects 1–3.