fix(history): preserve transaction state when rejecting non-LIFO completion #13

Verified on branch / awaiting merge

Production implementation: dd5979c613b0fe8ebd9f7026f25001ceee9f8cee. Delivered head: dbae93e8f211d45a69cdffdb6afa3a33a0af0fa5; the subsequent diff contains documentation/acceptance evidence only. Exact-head CI: Engine CI and NuGet dependency graph passed; all six checks on this exact head are successful. All applicable acceptance conditions for this issue are verified; unavailable physical/manual device checks are explicitly scoped, not reported passed.

Owner: Editor Interactions History. Implementation commits: fa794a5a.

Evidence: complete report, exact-head delivery attachment, portable test-case/raw-measurement/requirement indexes linked by the report. Specific proof: Contracts: EditorHistoryTests non-LIFO Commit/Rollback/Dispose and retained stack.

Commands: official tests/Invoke-EditorUiAcceptance.ps1 Contracts/Workflows/Visual/Lifecycle/Products with SDK-selected independent outputs; complete source/entry preparation; formal InnoEngine.Build scripts --ide for the three companions; tests/Invoke-WikiChecks.ps1; controlled public performance fixtures where applicable. The report records original command owners, TRX/binlogs, negative tests, failures, skips, input hashes and device limits.

Profiles overlap; do not sum their pass counts into a distinct-test claim. Windows-only sharing fixtures and Unix-only filesystem fixtures are scoped to the executing host. Real native contexts/simulated display metrics and hidden product feature journeys are not a claim of physical display, OS IME or manual Mac testing. No BGCS/vendor/package/generated-binding modification, parallel Core system, test hook, IVT or private reflection was used.

Keep this issue Open. PR #26 includes an individual Fixes #13 and will close it only when the user merges to master. No automatic merge or premature master-resolution claim.

Original defect, ownership and accepted work

The following baseline observations describe the issue as opened. The verification above supersedes intermediate pending checkpoints; original failed/negative logs remain preserved. Acceptance checkboxes are checked only after the exact delivery-head verification completes.

Confirmed defect

An out-of-order transaction completion removes the current transaction before validating its ID. A rejected operation therefore corrupts subsequent rollback and can leave an applied edit without an Undo entry.

Owner: Inno.Editor.Interactions, History/EditorHistory.cs, transaction completion (TryPop before ID validation).

Reproduction

Through EditorInteractionRuntime, the public history API and a normal registered history handler:

1. Begin outer and inner transactions.
2. Apply an edit inside the inner transaction (0 to 5).
3. Call outer.Commit() while inner is still open; observe the expected rejection.
4. Roll back inner, then outer.

Actual: inner rollback fails, outer rollback does not restore the value, and Undo is unavailable.
Expected: rejection must leave transaction stack, payloads, applied state and Undo/Redo unchanged; normal LIFO rollback must still work.

Implementation boundary

Validate the current transaction before mutation. Preserve existing atomic handler rollback, stable history payloads and Core identity/serialization contracts. Do not add a second transaction stack or compatibility wrapper. Inno.Core.Execution.ExecutionSlot already demonstrates validation before changing LIFO ownership.

Acceptance

• Public-boundary tests for rejected outer Commit/rollback/disposal followed by valid inner/outer completion.
• Successful nested commit, rollback, redo-branch release and payload cleanup remain correct.
• No IVT, private reflection or test-only production API.

Evidence

Audit finding F03 in records/architecture/acceptance/FULL_ENGINE_AUDIT_2026_10_24.md; local evidence artifacts/acceptance/core-audit-2026-10-24/history-probe-project/result.json. This is a confirmed existing defect, independent of BGCS.