fix: cursor-jump and char-rollback during widget typing

[LikeSundayLikeRain]

Summary

• Fixes a BRAT-reported regression where typing bursts caused the widget cursor to jump to position 0 and/or roll back 1–2 recently-typed characters (e.g. nums[i] → nums[])
• Introduces a stored childDirty boolean + CM6 updateListener as the authoritative "child has unsynced typing" sentinel, replacing the fragile recentlyFlushed(200) timestamp heuristic
• Adds IME composition awareness so that Chinese/Japanese/Korean Pinyin candidate-menu pauses (up to 4 s) keep childDirty = true through the full composition window
• Adds a sliding-window safety timer (hard-linked TTL) to bound the maximum childDirty hold time even if compositionend never fires
• Cleans up dead code: removes the recentlyFlushed gate and unneeded syncHandle plumbing; annotates self-originated child dispatches; arms SelfWriteSuppression consistently from fence-body writers

Background

See .planning/debug/widget-cursor-jump-and-char-rollback.md for the full debug workflow record.

Four root causes were identified:

1. DebouncedWriter resets pending = false before the modify echo fires — both hasPending() clobber gates open during the flush→echo gap
2. syncHandle gate is permanently dead code — this.syncHandle is never assigned in production; the optional-chain ?.hasPending?.() evaluates undefined !== true silently
3. reloadFromDisk full-doc replace + line/col clamp — when typed chars don't yet exist on disk, the cursor clamps to a shorter line and typed chars vanish
4. pushParentToChild catch fallback sets cursor to prefixLen — when LCP starts at byte 0, cursor is slammed to widget position 0

Commits A/B/C on main (quick task 260605-vny) closed the dominant clobber paths via narrow fixes. This branch replaces the recentlyFlushed heuristic at the heart of Fix C with the principled childDirty boolean and adds IME + sliding-timer robustness.

Approach

Wave 1 — prework (3 commits)

• refactor(widget): remove dead syncHandle gate and field — deletes the permanently-undefined syncHandle field and the structurally-dead gate at liveModeViewPlugin.ts:159
• refactor(widget): annotate self-originated child dispatches — adds ChildOriginAnnotation so parent-doc listeners can distinguish child-sourced transactions without a full hash comparison
• refactor(writers): arm SelfWriteSuppression for fence-body writers — ensures every fence-body write path arms suppression before vault.process, closing a secondary echo-miss vector
• test(probe): empirical modify-event behavior for byte-identical writes — probe test establishing the macrotask-ordering invariant that Waves 3–4 rely on (Pitfall 27)

Wave 2 — derived childDirty accessor (1 commit)

• refactor(widget): introduce derived childDirty accessor — replaces the recentlyFlushed(200) boolean read-site with a single get childDirty() accessor that encapsulates the sentinel logic; no behavioral change yet, but all call-sites now go through one place

Wave 3 — stored boolean + IME + sliding timer (5 commits)

• feat(widget): stored childDirty boolean + CM6 updateListener — childDirty becomes a stored boolean field; a CM6 updateListener sets it true on every non-self-originated child transaction and clears it when markChildClean() is called after a successful flush
• fix(widget): markChildClean compares LIVE child hash, not snapshot — fixes a subtle race where markChildClean was comparing the snapshot hash captured at flush-start rather than the live child doc, leaving childDirty = false even when the user typed during the flush await
• feat(widget): IME composition keeps childDirty true through compose window — installs compositionstart/compositionend DOM listeners on the child EditorView's DOM; isComposing flag suppresses markChildClean during the candidate-menu pause
• feat(widget): sliding-window safety timer + hard-linked TTL — bounds maximum childDirty = true hold to flushDebounceMs * 4 (default ~2 s) via a clearTimeout/setTimeout pair reset on each keystroke; prevents permanent childDirty lock if compositionend is lost (e.g. focus steal, crash recovery)
• test(widget): regression tests for Wave 3 childDirty fixes — covers: normal typing sets dirty, flush clears dirty, IME window holds dirty, safety timer expires dirty, markChildClean live-hash comparison

Wave 4 — cleanup (2 commits)

• refactor(widget): remove obsolete recentlyFlushed(200) gate — deletes the lastFlushCompletedAt field and recentlyFlushed() method from DebouncedWriter now that childDirty is authoritative; removes the recentlyFlushed?.(200) call-site in main.ts
• test(widget): rewrite parentToChildCursorPreservation against childDirty — updates the Plan-21-17-era cursor-preservation test to assert against the childDirty sentinel rather than the removed recentlyFlushed API
• docs(planning): update PITFALLS.md and CLAUDE.md for Wave 3 design — records the IME composition ordering guarantee and the markChildClean live-hash invariant as permanent pitfall entries

Test plan

• Build passes (npm run build)
• Full test suite passes (npm test)
• Manual: type a long burst in a fence in BRAT dev-vault — no cursor jump, no char rollback
• Manual: type Chinese via Pinyin IME in a fence — composition draft preserved across 4 s candidate-menu pause
• Manual: split-pane LP+LP typing in pane B while pane A flushes — pane B not clobbered
• Manual: external Obsidian Sync edit during typing — ConflictModal opens (not silent-reload)
• Manual: byte-identical-write probe — run OBSIDIAN_DEV_VAULT_PROBE=1 npm test against real dev-vault, verify modify event fires (Pitfall 27)

Reverts available

Each wave is a clean revert candidate. The 13 commits are organized so:

• Revert the Wave 4 cleanup commits alone to restore recentlyFlushed as a fallback while debugging childDirty
• Revert the sliding-timer commit (feat(widget): sliding-window safety timer + hard-linked TTL) alone if the safety timer regresses IME behavior
• Revert Wave 3 entirely (5 commits) to fall back to the Wave 2 derived-accessor state
• Waves 1 and 2 are safe to keep regardless — they are cleanups with no behavioral change