fix(blocks): generation counter + envelope-owned padding + idempotent pin

[nyxb]

Closes #46
Closes #47
Closes #48

Stacked on PR #40. The buggy code paths live on that branch — branching from main would lose the necessary context.

What & why

Three regressions reported as separate bugs share one architectural root: block-system state lived at the wrong layer. Each fix moves the invariant to the producer that owns it. No symptom-level patches.

Architectural plan synthesized from a deep read of .reference/zed/ (clock, text, terminal, gpui list state) plus published 2026 Rust streaming-render patterns (arc-swap, Lamport version vectors, sticky-bottom invariant). Brief lives in the PR description; principles distilled into a hard-rules update is a follow-up.

How

#46 — Snapshot cache invalidation

crates/carrot-term/src/block/render_view.rs keyed the active-block snapshot cache on snapshot.total_rows() as u64. In-place cell writes (progress bars, \r overwrites, partial-line emission) leave the row count alone, so the cache key never advanced and the render-side memoize at block_list.rs::memoize_active_snapshot returned the previous frame's stale snapshot. Output looked frozen for seconds, then dumped in one flood when a newline finally flipped the key.

ActiveBlock now carries a Lamport-style generation: AtomicU64 that bumps on every observable mutation — grid writes, atlas interns, hyperlink / grapheme / image inserts, metadata changes, replay-buffer appends, kind promotion. Mirrors text::Buffer::version from Zed's clock crate. The producer holds the single source of truth; the render layer reads block.generation() directly into the existing (id, frame_id) cache key. Relaxed ordering — the surrounding Mutex<Term> already provides synchronization at every mutation site.

Tests in carrot_term::block::active::generation_tests cover the full envelope: starts above zero, advances on every mutation method, holds on no-op (record_bytes with empty slice, repeated promote_kind_to_tui), and the specifically-regressing case where many grid_mut() calls happen without total_rows() changing.

#47 — Block-content left-edge alignment

The block header chips lived inside a div with .px(BLOCK_HEADER_PAD_X); the cell-grid BlockElement was a sibling with no matching inset. Header sat at x=16, grid at x=0, hit-test compensated by subtracting the constant from the wrong coordinate, and terminal_pane.rs reserved BLOCK_HEADER_PAD_X * 2 from the PTY column budget — three independent ideas of the content edge.

The block envelope now owns the inset: a single .px(BLOCK_HEADER_PAD_X) on the parent div in render_block_entry. Both children (header, grid) render flush against the inset. Same consolidation in the fold area — fold_area parent gets the inset, fold-line / fold-counter render flush.

GridOriginStore widened from Option<Pixels> (just y) to Option<Point<Pixels>> (full origin). BlockElement::prepaint writes bounds.origin straight in. hit_test reads x and y from the store and stops re-applying BLOCK_HEADER_PAD_X itself — the constant has exactly two consumers now (the layout call in block_list.rs and the PTY column budget in terminal_pane.rs), one rule, no drift. The block_list/layout.rs duplicate type alias is gone — re-exports the canonical one from carrot-block-render.

#48 — Scroll viewport oscillation

The visible bounce was a §A symptom: with the wrong cache key the active block's measured height drifted between frames, and logical_scroll_top recomputed against shifting heights produced an unstable scroll position. Fixing #46 stabilises the heights, the scroll stops oscillating.

Layered on top: BlockListView now caches last_pinned: Option<BlockId> and only invokes BlockState::pin / unpin when the desired pin actually differs. Pin and unpin are pseudo-idempotent on the state side (no-op when the value matches), but they still take the inner RefCell::borrow_mut — wasteful at one render per PTY tick. The cache moves the no-op all the way out.

No change to BlockState's scroll model itself: the existing follow_tail semantics, logical_scroll_top resolution, and scroll_to_end idempotence are correct (Zed's ListState shape, upstream-validated).

Test plan

• cargo fmt --all -- --check passes
• cargo clippy --workspace --all-targets -- -D warnings passes
• Per-crate cargo test -p for every touched crate (carrot-term, carrot-block-render, carrot-terminal-view)
• New generation_tests (8 tests) verify producer-side counter behaviour, including the in-place-write case that motivated the fix
• Manual E2E: yes | head -n 1000, seq 1 200 | while read i; do echo step $i; sleep 0.05; done, progress-bar emitters — output must stream linearly, not in floods
• Manual E2E: header chips, prompt carrot, output cells, fold lines all aligned to the same x-coordinate
• Manual E2E: scrolling up through scrollback is monotonic, no rebounds; scrolling back to the bottom re-engages tail-following

Performance impact

• Producer-side fetch_add(1, Relaxed) on every mutation site — atomic add, single instruction on x86_64 / aarch64. Lost in the noise vs. the VT writer's actual work.
• Cache hits at the render layer drop the snapshot rebuild (BlockSnapshot::from_pages row clone) when the active block didn't change. Net win at idle / partial-update workloads.
• Pin/unpin idempotency removes one RefCell::borrow_mut per render frame in the common case (no Tui block, or stable Tui pin).

Notes for reviewers

The architectural reasoning lives in the commit body. The hard-rules update for "Block envelope owns horizontal inset" and "Producer-side generation counter is the single dirty signal" is a follow-up doc PR — does not need to land with this fix.

SharedTerminal / ActiveBlockSnapshot / FrozenBlockHandle in carrot-block-render/src/snapshot.rs are unused dead code (set up but never wired through). The dead generation: u64 field on ActiveBlockSnapshot is intentionally untouched in this PR — cleaning up the orphaned types is a separate refactor pass, not in scope here.