[x] 18310 Add immutable per-group transaction history and cursor, [x] 18309 Bind transaction groups across window generations, [x] 18308 Hard-cut dock topology persistence to keyed workspace records
blocking
[x] 18316 Add Workstation multi-window undo, redo, save, and reload, [x] 18272 An N-slot topology commit restores N documents and one view: no consumer has a sibling projection to converge, [x] 18314 Unify Dock and Neural Link undo on the group cursor, [x] 18313 Record observed popup placement as a transaction participant
closedAt
Sep 5, 2026, 10:45 PM
Commit multi-workspace dock transactions atomically
WorkspaceDocument.commit() already returns before/after truth for one participant. D#18224 kept it pure and moved transaction ownership upward: a Group must coordinate every affected Workspace and placement participant without coupling the model to managers or native windows.
The Problem
A multi-window operation currently has no single serialized commit. Sequential writes can leave one Workspace updated when a later adoption fails; moving a cursor before durable truth or recording requested window effects invents history. The current InstanceService undo path also partially replays before a structured refusal.
The Architectural Reality
The Group owns the queue and transaction boundary; participants own pure prepare/adopt/compensate operations. Semantic document truth commits before projection. Native open/move/close is not ACID and records a separate observed-effect receipt. Mode is two axes: cursorAction = append | preserve | undo | redo plus provenance/cause.
The Fix
Implement the six-step Group write: capture and prepare all at the queue head; adopt all with reverse-order compensation; append the immutable row; move cursor; publish one current topology snapshot; release the queue. Capture participant generations/revisions with their values, prebuild recursively frozen payloads, and recheck generations/revisions immediately before synchronous, effect-free adoption. Compensation covers every invoked adopter, including one that mutates before throwing, and any fallible history/cursor update. Publish notifications only after the semantic state is consistent. Projection and effect receipts run after the semantic write. Cold hydrate preserves cursor state, user restore appends, warm rebind writes nothing, undo/redo append nothing. Reject mixed dock/non-dock batches until compensation covers both.
Required prerequisite: the #18303 hard-cut authority leaf.
Discussion Criteria Mapping
Owns criterion 8 and the transaction boundary in criteria 1/7.
Acceptance Criteria
Every participant prepares before any adoption; a prepare refusal leaves all participants, history, cursor, and snapshot unchanged.
A failure on adoption N compensates every invoked participant in reverse order, including N if it mutated before throwing. Inject that second-participant failure: all participant truth, history membership, cursor, and snapshot remain byte-identical, with no publication or projection.
Successful order is exactly prepare → adopt/compensate → append row → cursor → snapshot → queue release; participant adoption is synchronous and performs no presentation or native effect.
A failed write rejects observably but does not poison the next queued write.
append, preserve, undo, and redo semantics match their no-extra-row rules and carry explicit provenance/cause.
Projection/effect receipts cannot make a semantic commit appear failed or invent a commit after semantic refusal.
Mixed dock/non-dock batches are structurally rejected until cross-domain compensation is present; pure dock origins share this path.
With two queued calls and a delayed first prepare, B captures A's committed after-state at its own queue head. A generation/revision change before adoption refuses before a stale write.
Inject a history-append or cursor-update failure after participant adoption: compensate the participant and history/cursor changes, preserve the previous snapshot, emit no committed snapshot event, and allow the next queued write to run.
History and Group observers first see recursively frozen rows and consistent participant/history/cursor/snapshot state. A synchronous listener that reads state and enqueues another operation cannot observe an intermediate commit; a notification failure is reported separately and cannot turn an already published semantic commit into a refusal.
No recording inside WorkspaceDocument; no Promise fan-out of state writes; no cursor-first update; no requested-effect fiction; no swallowed failure tail.
Related
Part of #18303. Blocked by Group binding and immutable history. Enables topology projection and undo migration.
Detailed source contract and failure controls: Emmy's D#18224 transaction protocol. Existing primitives include the Collection update bracket and Provider effect batching; collection.Base#splice / core.Observable#fire dispatch synchronously, so frozen-after-return alone is insufficient.
Context
WorkspaceDocument.commit()already returns before/after truth for one participant. D#18224 kept it pure and moved transaction ownership upward: a Group must coordinate every affected Workspace and placement participant without coupling the model to managers or native windows.The Problem
A multi-window operation currently has no single serialized commit. Sequential writes can leave one Workspace updated when a later adoption fails; moving a cursor before durable truth or recording requested window effects invents history. The current InstanceService undo path also partially replays before a structured refusal.
The Architectural Reality
The Group owns the queue and transaction boundary; participants own pure prepare/adopt/compensate operations. Semantic document truth commits before projection. Native open/move/close is not ACID and records a separate observed-effect receipt. Mode is two axes:
cursorAction = append | preserve | undo | redoplus provenance/cause.The Fix
Implement the six-step Group write: capture and prepare all at the queue head; adopt all with reverse-order compensation; append the immutable row; move cursor; publish one current topology snapshot; release the queue. Capture participant generations/revisions with their values, prebuild recursively frozen payloads, and recheck generations/revisions immediately before synchronous, effect-free adoption. Compensation covers every invoked adopter, including one that mutates before throwing, and any fallible history/cursor update. Publish notifications only after the semantic state is consistent. Projection and effect receipts run after the semantic write. Cold hydrate preserves cursor state, user restore appends, warm rebind writes nothing, undo/redo append nothing. Reject mixed dock/non-dock batches until compensation covers both.
Contract Ledger
WorkspaceDocument.commit; D#18224 criterion 8Decision Record impact
Implements amended ADR 0029's semantic-commit-before-effect rule.
Decision Record
Required prerequisite: the #18303 hard-cut authority leaf.
Discussion Criteria Mapping
Owns criterion 8 and the transaction boundary in criteria 1/7.
Acceptance Criteria
append,preserve,undo, andredosemantics match their no-extra-row rules and carry explicit provenance/cause.Out of Scope
Geometry quiescence, command/UI wiring, topology parser changes, or cross-Group two-phase commit.
Avoided Traps
No recording inside WorkspaceDocument; no Promise fan-out of state writes; no cursor-first update; no requested-effect fiction; no swallowed failure tail.
Related
Part of #18303. Blocked by Group binding and immutable history. Enables topology projection and undo migration.
Detailed source contract and failure controls: Emmy's D#18224 transaction protocol. Existing primitives include the Collection update bracket and Provider effect batching;
collection.Base#splice/core.Observable#firedispatch synchronously, so frozen-after-return alone is insufficient.Origin Session ID: 01a06b6d-3323-7fa0-a10b-bbc4871c8780
Retrieval Hint:
D18224 six-step Group write compensation cursorAction effect receiptCreation freshness: live latest-open and all-status A2A sweeps found no equivalent atomic-transaction leaf.