playbook: publish undo on its own gesture (#1088)

[edwin-zvs]

Fixes #1088, the last member of the family #1116 addressed.

C-x u mutated the buffer and returned. The undone document never left the client, and because the next keystroke's anchored edit was then derived from a base the daemon had never seen, everything typed afterwards failed to apply as well — the same shape paste and template buttons had. The in-editor C-/ alias never had the bug: it goes through handle_playbook_key, which publishes for every key.

The fix, and a small refactor

Rather than hand-roll the snapshot-and-flush dance a fourth time, this extracts the pair that spec 0171 asks every non-keystroke mutation to use:

let before = self.playbook_buffer_snapshot();
self.undo_playbook_edit();
self.publish_playbook_mutation(before).await;

Paste and the template button are rewritten in terms of it, so there is one obvious way to satisfy the invariant instead of three copies that each had to remember the same three steps. Net effect on those two call sites is a reduction; the only behavior change is undo.

Tests

playbook_undo_reaches_the_daemon is new. It deliberately follows the undo with no further input — the recovery path added for #1089 would reconcile this on the next keystroke, which is a different guarantee, and undo has to stand on its own. Verified it fails without the fix:

undo never reached the daemon: it is still on "seedXYZ\n"

All four in the file pass with it:

test playbook_paste_normalizes_carriage_returns ... ok
test playbook_paste_reaches_the_daemon ... ok
test playbook_recovers_from_a_diverged_buffer ... ok
test playbook_undo_reaches_the_daemon ... ok

One test got weaker, and now says so

playbook_recovers_from_a_diverged_buffer used C-x u to open the divergence that #1089's recovery path repairs. With undo fixed there is no divergence left to create, so it no longer reaches that path — it now guards the weaker property that an undo and the keystroke after it both land. Its doc comment said "#1088 … today mutates without publishing", which this PR makes false, so it has been retitled and rewritten to describe what it actually covers now.

That leaves #1089's recovery with no deterministic e2e trigger: it fires on a genuine race between an agent's write and a keystroke. It is still exercised indirectly — it is the same merge C-x C-s performs — but if we want it pinned directly, that wants a client-level unit test with a stubbed IPC client rather than an e2e. Flagging rather than silently dropping the coverage.

Binaries

Only crates/cli changes → construct:

/Users/moon/agentd/.claude/worktrees/fix-playbook-undo-sync/target/debug/construct