Write bounded drawing arenas in place and share their slots between checkpoints - #759

A bounded drawing arena (the line, box and label arenas the generated code builds from a script's declared max_lines_count, max_boxes_count and max_labels_count) replaced its whole state with a deep copy on every create, every delete and every setter, whether or not a script-state checkpoint still shared it. The copy covered every slot, the text of every label, the directory and the order. A script that moves a few of its live drawings on every bar therefore paid time proportional to the bound on every call, and the first write after each checkpoint paid it again. The unbound arena already avoids this: its records live in blocks of 32 that copies share, and a write clones only the block it reaches.

The new test test_drawing_bound_checkpoint_cost is the bounded twin of test_coof_drawing_checkpoint_cost. It fills an arena to its bound, then runs the scheduler's checkpoint sequence (snapshot, restore, execute, commit) around an execution that deletes the oldest label, creates one, moves three and changes one text, with texts that are never inline so that a record copy allocates:

What changes

• The slots of a bounded arena live in a DrawingRecordStore, the block store the unbound arena already uses. A copy of the arena's state shares the blocks and copies only the directory and the order (an integer per occupant); a write copies the one block it reaches, and only while another copy still holds it.
• Creation, deletion and every setter give the arena a state of its own when a checkpoint shares it, then change it in place. Each does every step that can allocate or throw (the state's copy, the copy of the slot's block, the directory's room, the order's growth) before its first change and only steps that cannot throw after it, so a refused allocation leaves the arena and its checkpoint as they were (test_drawing_slot_atomicity refuses an allocation at every site of each operation).
• The search for the lowest free slot starts at a recorded index below which every slot is occupied, so the order in which slots are reused is unchanged and a creation no longer scans from slot 0.
• Unchanged: the bound, the typed overflow outcome and its diagnostic, the stale-handle no-ops, the id issue, and every value a script reads.
• The source allocation-bound gate's reviewed site inventory and manifest move with the change: the two groups for the removed whole-state copies are deleted, the OPEN ceiling drops by two, and the groups for the slots, the directory and the state's allocation gain the new site identities. The inventory is the gate's own proposal for this tree.

Verification

Every run is on Linux aarch64, GCC 13.3, against this branch built from its two commits.

• Tests first. The test commit alone, on main: the cost row fails (8 passed, 3 failed in the new binary; 1 of the 13 drawing rows red in ctest), for the reason in the table above; its model row (the arena equals a plain ordered-map model of the same operations after every execution) and its unchanged-checkpoint row pass on main by design. With the change: 11 passed, 0 failed, and 13 of 13 drawing rows pass, the twelve older ones unmodified (test_drawing, test_drawing_bound_status, test_drawing_bounded_builtins, test_drawing_bounded_creation_failure, test_drawing_checkpoint, test_drawing_id_domain, test_drawing_slot_atomicity, test_drawing_slot_bound, test_drawing_slot_checkpoint, test_drawing_slot_defaults, test_drawing_slot_reuse, test_coof_drawing_checkpoint_cost).
• AddressSanitizer and UndefinedBehaviorSanitizer (Debug build): the same 13 drawing rows pass, the new test included (it runs a third of its executions there, and its numbers match the release build's), and so does test_drawing_slot_atomicity, which refuses an allocation at every site while the sanitizers watch for leaks and use after free.
• The source allocation-bound gate passes with the new inventory, which is byte for byte what the gate itself proposes for this tree; its mutation controls (scripts/test_cr150_source_gate.py, 91 tests) pass with the real-tree count pin moved by two; the dangling-comment-name guard, the native source guard, the public-wording guard and the doc-lint test pass.

Not run on this head: x86, the whole suite, and any run of generated strategies (the code generator emits unbound arenas on main, so no corpus strategy reaches this path until it emits the bound).

Limits

• The first copy of a freshly created state builds its blocks from the initial vector (O(bound), once per arena); every later copy shares.
• The directory and the order are still copied once per script execution that writes the arena: an integer per occupant, not a record.
• A setter's edit is applied where the record is, so it must not throw. Every builtin setter is a scalar store or a string move assignment.

🤖 Generated with Claude Code