fix(search): keep follow scans open for appends

[siriusctrl]

Independent review result

This is a fresh review of the complete origin/main..agent/record-timeline-follow implementation and the relevant pre-PR viewer/load code. I did not rely on the implementation thread's summary.

PR #5 moved the target while this review was in progress and already merged equivalent fixes for explicit follow controls, transactional newer cursors, pending-tail verification, synchronized frame commits, and the other reviewer's bounded prefix-probe overlap design. I did not stack a second overlap model on top of that work.

This draft contains the two remaining review changes:

• extend an in-flight search when a refresh appends formatted lines, and invalidate an exact match count so a match committed at the old tail is not missed;
• correct the follow performance contract: reverse reads use fixed-size buffers, but total first-open work is proportional to the incomplete EOF suffix, so a newline-free file can require reading to offset zero. The built-in file source is explicitly append-oriented and bounded samples cannot prove arbitrary unchanged-metadata in-place rewrites.

Findings and selectable checkpoints

The separately pushed branch agent/review-record-timeline-follow-a47bdc77 preserves the requested clean checkpoints on exact base 5faa172:

Slice	Commit	Disposition on current target
A: follow prompt, paused End/G, Shift+Wheel	20c28e0	Equivalent behavior is already present after PR #5 / PR #4
B: outer synchronized frame commit	cf2fdfe	Equivalent b0bcce9 is already present after PR #5
C: defer overlap removal until lazy loading reaches the true committed prefix	7fc5fca	Alternative only; intentionally not included here because current target chose 5ed4cb6's narrower non-consuming prefix probe
D1: transactional newer cursor publication	45e1678	Equivalent 606168b is already present after PR #5
D2: active search includes appends	a89f298	Included in this draft; not otherwise present on the target

The C alternative avoids a synchronous prefix probe and reconciles only when normal reverse loading reaches the true prefix. Its cost is substantially more consumer state: overlap removal must shift viewport, search, structure, and tool anchors. The merged prefix-probe API adds one source-neutral non-consuming operation but keeps the consumer append-only and the public ViewFileChange narrower. I consider the merged prefix-probe design the better final choice and keep C only as a separately selectable comparison.

Correctness coverage

Focused timeline integration: 38/38 passed, covering:

• CRLF, empty records, no final newline, and a very large record;
• million-record tail-first open and multi-MiB append bursts;
• truncate, inode replacement, copytruncate, same-size rewrites, pending-tail rewrite plus growth, short-read retry safety, and reset overlap across lazy batches;
• legitimate adjacent duplicates and replacement matches away from the prefix;
• attached/detached/paused follow state, PageDown reattach, End/G while paused, prompt f, and shifted horizontal wheel input;
• older/newer search arrival, wrapped older loading, and the new append-during-active-search boundary.

No crossterm, raw-mode, terminal lifecycle, poll cadence, or frame-commit type enters fmtview-core; those remain in the root package.

Frame and visual evidence

For the same sized PTY interaction (initial frame, two scroll draws, quit):

• before B (20c28e0): 0 synchronized-update opens, 0 closes, 9,795 transcript bytes;
• after B (cf2fdfe or current target): 3 opens, 3 closes, 9,859 transcript bytes.

The writer regression additionally asserts CSI ?2026h < frame content > CSI ?2026l. Ordinary, diff, and follow PTY smokes exited 0; the current transcripts contained one balanced pair per actual draw (3/3 ordinary, 1/1 diff, 5/5 follow).

A fresh Kitty/Xvfb/ffmpeg follow run produced 190 frames, 13 action-adjacent keyframes, and 10 scripted actions. Settled frames were visually inspected and showed attached append, detached append without a tail jump, PageDown reattach, explicit pause with no append jump, and resume with the fourth record visible. Layout, role/tool gutters, title, and footer remained legible.

The software-GL capture alternated complete front-buffer images with non-preserved partial back-buffer images even while the application emitted no bytes; disabling vsync and direct window capture reproduced it. Therefore the video supports semantic/layout verification but is not used to claim pixel-level tearing absence. The balanced PTY protocol bytes and writer regression are the deterministic frame-commit evidence.

Verification

• cargo fmt --all -- --check
• cargo check --workspace --all-targets --locked
• cargo test --workspace --all-targets --locked (root 8, CLI 38, core 230, headless 3, timeline 38; 317 passed total)
• cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
• RUSTDOCFLAGS='-D warnings' cargo doc --workspace --no-deps --locked
• cargo build --workspace --release --locked
• cargo build --release --locked --target x86_64-unknown-linux-musl
• package file lists: fmtview-core 144 files; fmtview 46 files
• cargo publish -p fmtview-core --dry-run --locked: passed, 144 files, 808.8 KiB / 151.1 KiB compressed
• cargo publish -p fmtview --dry-run --locked: expected pre-release sequencing failure because fmtview-core 0.5.4 has not actually been uploaded; this matches docs/releasing.md
• npm wrapper executed the static PIE as fmtview 0.5.4; npm pack --dry-run --json contained exactly README, JS shim, manifest, and bundled binary
• redirected JSON, JSONL, Markdown, and diff output matched the reviewed baseline hashes; redirected --follow exited 1 with the documented TTY error
• benches/load-performance.sh --samples 3 --case timeline: medians 0.639 ms tail-open, 1.493 ms older, 2.229 ms newer, 2.911 ms follow
• real PTY ordinary/diff/follow smokes and the Kitty/Xvfb/ffmpeg recording described above

No merge is requested; this remains a draft for the implementation thread to choose.

[siriusctrl]

Superseded by #12, which implements append-aware search using disjoint scan spans and includes independent-review fixes for lazy-prefix ordering, backward multi-append priority, and short-read safety.