Plan: Post-Audit Hardening 2026-08-20

Context

The repository audit after 183f256 found runtime and gate defects that are independent of the already accepted text-property layout architecture. This plan stays inside phase-kp-overhaul-20260726; it does not reopen closed issues or weaken the source-clean display contract.

Goals

Make public buffer width errors fail before projection mutation and keep the previous projection intact on every rejected request.
Define and test the backward-delete live projection invariant before changing the row-crossing owner.
Resolve locale spellings to the exact bundled dictionary before short-code fallback, and reject malformed C position vectors at the module boundary.
Restore the showcase's automatic inline-code contract and make every test runner use current source and the complete ERT set.
Remove manual buffer integrations when no projection or auto-mode owner remains.
Re-profile issue018/task030 after the correctness fixes with a source-fresh evaluator and close it only if the locked source-instrumented 16 ms contract is actually met.

Scope and milestones

M1 (task037, task042): buffer width validation, failure atomicity, and integration lifecycle.
M2 (task038): backward-delete projection semantics and a regression that drives the public edit path.
M3 (task039, task040): exact hyphenation locale lookup and complete C position-vector validation, with direct boundary tests.
M4 (task041): showcase automatic inline face, source-first test loading, and complete random/isolated selection.
M5 (task030, issue028): make the locked width/engine matrix source-fresh, then optimize only the remaining structural commit owner.

Non-goals

Do not change valid KP output, the 15-field C ABI, or the source-clean buffer representation.
Do not hide latency with debounce, stale layout reuse, skipped publication, global GC changes, or test-only exceptions.
Do not close issue018 from byte-compiled production numbers alone.
Do not rewrite historical postmortems; append current decisions and verification evidence.

Acceptance gates

Invalid or non-positive buffer widths signal before any owned property, span, filter, hook, point, mark, or modified-state change.
Backward deletion either preserves the committed projection as specified or has an explicit revised contract documented and tested through the public command path.
de-CH/de_CH and equivalent exact locale spellings select the same exact dictionary; unknown locales use the documented short-code fallback.
Out-of-range, unsorted, or duplicate C hyphen/forbidden positions signal ekp-c-invalid-input; valid arrays retain exact Elisp/C parity.
Clean source, stale bytecode, normal, random, and isolated test runners all exercise the same complete current ERT inventory and the showcase's automatic inline contract.
The live evaluator explicitly loads source from both baseline and candidate roots; a bytecode-backed pass:true is not valid evidence.
Full ERT, fuzz, C build/tests, byte compilation, checkdoc, package-lint, release, dictionary, and focused performance gates pass before closure.

Risks and dependencies

Backward-delete behavior is a product invariant, not a local condition; implementation must follow the existing spec and real public-path evidence.
C position validation must match the DP's exclusive break-index domain and preserve sorted-vector assumptions used by binary search.
The performance gate depends on trustworthy source loading; stale ignored .elc files must not influence any result.

Stop condition

Stop only when all tasks in this plan have current issue/task evidence, closed issues have user-visible or contract-level verification, issue018 is either genuinely closed by its locked gate or explicitly remains open with fresh measurements, and the complete diff is committed and reviewed.

3.9 KiB Raw Blame History