Qualify VS Code file edit, save, revert, and hot-exit recovery

[wieslawsoltes]

Parent epic: SceneTech/AppScene#122
Workspace/provider prerequisite: #252
Navigation prerequisite: SceneTech/AppScene#124
Native/local picker stack: SceneTech/AppScene#123 → #248
Release-wide acceptance: #260

Problem

Opening a selected folder and rendering Explorer does not prove that unchanged VS Code OSS can maintain file models safely. The current focused hierarchy has no owner for the complete remote editor lifecycle: open bytes, dirty state, Save, Save As, revert, conflict handling, backups/hot exit, and recovery after reload, navigation, crash, or restart.

The broad AppScene storage issue #33 proves durable browser storage for a typed record, and AppScene #32 covers app-corpus file transfer. Neither proves VS Code's text-file model, remote file-service writes, backup metadata, overwrite/error UX, or watcher/model reconciliation.

Investigation

Trace unchanged VS Code 1.137 from Explorer/file activation through ITextFileService, model creation, encoding/EOL detection, dirty-state transitions, IFileService read/write/stat, backup working copies, dialogs, and final watcher refresh. Record the exact reusable WebScene/AppScene contract at the first failure; keep raw paths limited to isolated fixtures.

Cover:

• existing remote file open, edit, Save, Save All, Auto Save, Save As, revert, close-dirty prompt, and working-copy backup;
• untitled-to-file, read-only, permission denied, missing/deleted, renamed, externally modified, stale etag, symlink, disk-full/short-write, disconnect/reconnect, and canceled overwrite flows;
• UTF-8/BOM/UTF-16, EOL preservation, Unicode normalization, empty/binary/large/sparse files, long names, percent-encoded URI components, case-sensitive roots, and platform path separators;
• atomic create/replace semantics, flush/durability expectations, no partial target on failure, own-write watcher de-duplication, and exact-once dirty/model/view updates;
• backup/hot-exit restoration across reload, folder A → B → A, same-window navigation, host termination, crash recovery, profile restart, and unavailable original paths;
• language-service/diagnostic/SCM/Search state after save, revert, rename, and recovery.

Ownership boundaries

• Qualify remote workspace bootstrap, Explorer contents, and watcher refresh #252 owns workspace reconstruction, remote provider registration, Explorer enumeration, and watcher delivery.
• This issue owns file-model/read/write/revert/backup reconciliation once the provider and workspace exist.
• AppScene [GPU 11/20] Complete WebGPU async errors, mapping, copies and device-loss semantics #33 owns durable storage/origin/profile primitives; this issue consumes them through unchanged VS Code hot-exit behavior.
• AppScene Support nested CSS rules in modal layouts #123 and Implement File System Access pickers and handles over AppScene native panels #248 own native/local Save As and persisted path grants. Remote Save As continues through the SimpleFileDialog lane from Qualify VS Code remote file and folder picker interaction #247.
• AppScene Emit browser-compatible punctuation keyboard events #124 owns document navigation/lifecycle. AppScene [GPU 06/20] Implement Linux external-memory and semaphore interop #28 owns generic modal/focus behavior.
• Establish Chromium/AppScene visual and geometry regression gates for unchanged Code OSS #259 owns shared Chromium visual/geometry machinery, Qualify Code OSS accessibility semantics, keyboard navigation, and native exposure #262 shared accessibility/keyboard exposure, Bound visual-tree churn, idle publication, and memory across panel mutations #258 retained-scene/RSS workloads, and Publish a Code OSS Web API capability ledger and expand WPT coverage #263 the Web API/WPT ledger.

Acceptance

• Opening a remote fixture yields byte-exact editor content, encoding, EOL, language mode, resource URI, and one model.
• Edit → Save → close → reopen preserves bytes and clears dirty state exactly once; Save All and Auto Save have explicit successful/canceled/error outcomes.
• Remote and native/local Save As preserve the selected URI, requested target, overwrite policy, and grant lifetime without a VS Code source patch.
• Revert and external-change conflicts match Chromium semantics and never silently discard unsaved bytes.
• Failed, canceled, denied, stale, short, or disconnected writes leave the prior durable file intact and expose the correct recoverable error/focus state.
• Hot exit restores every dirty working copy and untitled resource after reload/crash/restart, including multi-root workspaces; successful save removes obsolete backups.
• Watcher events caused by the app and externally are reconciled once without duplicate models, prompts, Explorer rows, SCM entries, or diagnostics.
• Path/URI, Unicode, symlink, encoding, large-file, and platform-separator fixtures pass with explicit supported/unsupported declarations.
• Chromium/AppScene semantic, visual, focus, and accessibility comparisons pass for dirty tabs, prompts, conflicts, errors, and recovery.
• Record cold/warm p50/p95 for open-to-editor, edit-to-dirty, save, revert, backup, and restore. Bound copied bytes, filesystem calls, DOM/scene publications, CPU, RSS, models, backups, watches, and handles over 100 cycles and representative large files.
• WPT-derived file/stream/storage contracts, native failure-injection tests, unchanged packaged Code OSS acceptance, and final installed-SDK release gates pass.

Proposed PR stack

1. Investigation-only correlated observer and product-neutral file-model/read/write fixture.
2. Smallest provider/stream/write/error contract fix, if reproduced, with direct failure-injection and byte-integrity gates.
3. Backup/hot-exit/restart contract over the durable storage primitives from AppScene [GPU 11/20] Complete WebGPU async errors, mapping, copies and device-loss semantics #33.
4. Native/local Save As integration after AppScene Support nested CSS rules in modal layouts #123 and Implement File System Access pickers and handles over AppScene native panels #248, preserving the same file-model gates.
5. Unchanged Code OSS cumulative acceptance plus visual/accessibility/performance/lifecycle gates; release qualification remains AppScene Keep captured Performance methods on one timeline #130.

Schedule

Start the remote open/edit/save slice after #247 and the minimal #252 provider/root path are proven. Run backup/recovery investigation in parallel with AppScene #33's released-SDK cleanup. Add native/local Save As only after the #123 → #248 stack. Merge focused reusable fixes before cumulative product acceptance.

[wieslawsoltes]

The first concrete file-model prerequisite found by the unchanged VS Code audit is now implemented: #441 merged as WebScene 622a955c512dbf1853a042effe6a5b41cad53052.

VS Code routes local file watches through HTMLFileSystemProvider.watch() and FileSystemObserver. Before this merge WebScene had no FileSystemObserver, so local watches were silently disabled. The new opaque-handle observer supplies appeared/disappeared/modified/errored records, recursive relative components, non-overlapping bounded polling, and unobserve/disconnect/document-lifecycle cleanup. This unblocks external-edit/conflict and post-save reconciliation without a VS Code source change.

Validation was intentionally skipped under the current implementation-only priority. #438 retains the exact browser/native/performance/lifecycle/product debt. #269 remains open for unchanged-product open/edit/save/revert/Save As, own-write de-duplication, dirty conflict UX, IndexedDB backup/hot-exit recovery, reload/crash/restart, encoding/error cases, and resource bounds.

[wieslawsoltes]

Post-#441 hot-exit ownership trace — no second implementation

A source-level trace of unchanged VS Code 1.137 does not prove another reusable runtime primitive is missing after the watcher merge.

• BrowserWorkingCopyBackupService always roots browser backups at vscode-userdata:/Backups/<workspace-id>.
• web.main.ts registers vscode-userdata through IndexedDBFileSystemProvider backed by the durable vscode-web-db / vscode-userdata-store database. WebScene PR Add durable IndexedDB storage for Code OSS browser profiles #94 already owns and implements durable, partitioned IndexedDB across engine/process restart.
• BrowserWorkingCopyBackupTracker schedules backups while the page is live and synchronously vetoes final shutdown when a modified working copy lacks the current content-version backup. It does not require an async native shutdown write.
• BrowserLifecycleService consumes beforeunload for the veto and pagehide for terminal notification. WebScene already implements both native/script close paths with one terminal pagehide.
• IndexedDBFileSystemProvider uses BroadcastDataChannel only when watchCrossWindowChanges is enabled to publish live provider change notifications. If BroadcastChannel is absent, VS Code falls back to storage events. Neither route writes or restores backup bytes, and the current AppScene package has one workbench document/window for this scenario.

Therefore a realm-local BroadcastChannel shim or new AppScene persistence ABI would be speculative and would not prove cross-window/process semantics. No code or new issue is justified until unchanged-product tracing shows a failed backup write/load/restore, content-version veto, lifecycle event, or an actual second-window invalidation requirement.

Remaining #269 work is product evidence: dirty saved and untitled backup creation, IndexedDB durable bytes/metadata, current-version veto, reload/navigation/host termination/crash/restart restoration, successful-save cleanup, corruption/quota/unavailable-original handling, and only then a focused fix at the earliest observed failing boundary. Validation remains skipped under the current implementation-only priority.