# Production progress

## Architecture decisions

- Public `core` types use UTF-16 line/column coordinates; byte offsets remain private. Positions inside surrogate pairs are rejected.
- Documents cache line starts. Atomic edits are validated in original coordinates, ordered/non-overlapping, and applied back-to-front.
- Revisions are monotonic operation identities, including undo/redo. Dirty state compares current content with the exact successfully saved text baseline, not revision numbers.
- `Document` fields are private. Array accessors return detached copies, preventing public alias mutation.
- Undo snapshots are bounded. Piece tables/ropes and delta histories remain future performance work.
- `surface` is a read-only boundary. Hosts perform I/O; core imports no filesystem capability.

## Compatibility status

- Core is target-neutral pure MoonBit source.
- LF and CRLF are indexed; line-ending bytes are excluded from editable columns.
- Storage is UTF-8 and public columns are UTF-16; surrogate splits are invalid.
- moonbit-community/editor remains a future read-only adapter; no upstream editing capability is claimed.
- Rabbita can receive host snapshots without filesystem access.

## WP04 — workspace lifecycle and host effects

WP04 is complete for the audited in-memory orchestration layer. The normative contract is [`WP04_IDENTITY_CONTRACTS.md`](WP04_IDENTITY_CONTRACTS.md).

- Effects carry exact identities; the first matching terminal callback wins.
- Save success installs the exact submitted-text baseline. Current-content equality determines cleanliness even at a newer revision.
- `FileVersion` is opaque and unordered. Notification tokens only deduplicate/supersede in-flight reloads. On the winning `Load`, the host atomically reads latest text and version; that callback snapshot is authoritative even if its token differs from the trigger.
- Every watcher observation deferred during save is reconciled. Unknown or different tokens force stale/conflict rather than selecting or trusting merely the newest observation.
- `OutcomeUnknown` retains the last known pre-save version and never advances it or claims the attempted commit.
- Watcher reload failure preserves prior content and its existing dirty state, marks stale, and remains editable.
- Document-less tabs close immediately without discard confirmation. Exact confirmed discard survives same-revision save/reload terminal transitions, while a newer revision invalidates it.
- Per-URI view state is retained across close/reopen and is cleared only when set to `None`.

## Audit-found problem/fix summary

| Problem | Fix / verification |
|---|---|
| Public `Document` arrays could escape by alias | Made fields private and accessors detached; black-box detached-copy test verifies mutation cannot leak back. |
| Document-less stale tab could wedge on close | Such tabs now close immediately and never request discard confirmation. |
| Same-revision save/reload terminal transition swallowed confirmed close | Preserve exact confirmation through same-revision terminal transitions; invalidate it on newer revision. |
| Reload trigger token was treated as authoritative freshness | Defined atomic latest text-plus-version `Load` response as authoritative; trigger token only controls in-flight dedup/supersession. |
| A test used an invalid `NotFound` variant and a compact Save expectation used a stale snapshot | Corrected the test variant and refreshed the compact Save snapshot to the audited API/effect shape. |

## WP05 — language-provider orchestration

WP05 is verified for the in-memory language package. The detailed contract and trial ledger are in [`WP05_LANGUAGE_LEDGER.md`](WP05_LANGUAGE_LEDGER.md).

- Typed semantic-token, completion, and definition wrappers retain their `RequestKey` and requested range or position. Initial absence is distinct from an accepted empty wrapper.
- A successful fresh request clears only its accepted lane and only after validation and request-ID allocation. Invalid or exhausted requests preserve accepted and pending state.
- Matching terminal valid, invalid, over-budget, and failed responses consume once. Ranged semantic tokens must be contained in the requested range.
- Retained-response accounting uses one aggregate budget across lanes and documents. Public arrays remain detached; internal accounting reads private arrays without copying and does not evaluate skipped lanes.
- Definition wrappers are invalidated atomically when their exact target document key and revision is successfully replaced, closed, or retired by same-URI reopen. Unrelated and accepted-empty results plus pending queries survive, and released units return to the budget.
- Development effort is intentionally unbounded by LOC, planner turns, or time. Positive parser/provider/transport/resource limits for untrusted input remain mandatory product safety requirements.

### WP05 verification

Current full-repository results are **122 wasm**, **122 wasm-gc**, **123 JavaScript**, and **122 native**, all passing. The all-target check with warning list `+73` passed before final interface regeneration. Exact targeted language-package runs passed **41/41 on each of wasm, wasm-gc, JavaScript, and native**; this count was verified directly rather than inferred from repository totals.

MoonCode commands 108–132 included controller/runtime failures and recoveries, not final repository failures. Recurring operational causes were the eight-step planner cap, stale or hallucinated API assumptions, an invalid `moon_cmd fmt` target, and over-broad mechanical rewriting. Fresh-daemon runs, narrow commands, exact diagnostics, line-local repairs, and complete target reruns restored reliable verification. The chronological table is recorded in the WP05 ledger.

### WP05 current limitations

This milestone does not claim a UI, host LSP transport, persistence, a syntax parser, or production latency benchmarks. Synchronization is full-text, and host integration must still provide transport and I/O while enforcing the documented identity, validation, terminal-consumption, and resource bounds.

## Final verified gates

The current final results are **122 wasm**, **122 wasm-gc**, **123 JavaScript**, and **122 native** tests passing. The all-target check with warning list `+73` passed before final interface regeneration. The language package's exact targeted result is **41/41 on each of wasm, wasm-gc, JavaScript, and native**.

## Limitations and provenance

This status describes the audited in-memory core, workspace, and language-provider orchestration layers. It does not imply a complete editor application or deployment stack. The WP04 content above remains governed by [`WP04_IDENTITY_CONTRACTS.md`](WP04_IDENTITY_CONTRACTS.md), and WP05 details and provenance are maintained in [`WP05_LANGUAGE_LEDGER.md`](WP05_LANGUAGE_LEDGER.md).