T8: Round-trip safety and determinism

[PrjShrestha]

Importance: Must have · Size: L · Depends on: nothing — but everything depends on it

Why. Two acceptance criteria, and the product's central promise: a form with hand-authored
columns round-trips through the builder without losing them, and the same edit always produces the
same output. This is what makes it safe to point the tool at a config someone else wrote.

Scope.

• Preserve columns and sheets the tool does not understand, verbatim and in their original
  positions.
• Deterministic output: the same edit produces byte-identical results every time.
• ⚠ Read a spreadsheet cell's computed result, not its formula text. A cell containing a
  formula has both; writing the formula text back produces expressions the runtime cannot
  evaluate.
• ⚠ Preserve grouping in logical expressions. Dropping parentheses changes the meaning,
  because and binds more tightly than or, and the failure direction tends to be permissive.
• ⚠ All-or-nothing parsing of code bodies. Where the tool models only some shapes of a code
  block, it must either represent the whole block or keep the original bytes. Emitting the parts
  it recognised and discarding the rest yields code that compiles and then fails at runtime.
• ⚠ Never substitute a convention for the author's input. Where a value is read and written
  back, write back what was read. Emitting the "standard" form of an expression changes
  behaviour on any project that spells it differently.
• ⚠ Scope every find-and-replace. Renaming or removing a definition must target the
  definition, not the first textual match, which is usually a usage.
• ⚠ A rename must rewrite every reference to the renamed item, across all columns that can
  contain one. A dangling reference blocks the whole deploy.
• Reuse the platform's own compiler and deploy tooling. Building a parallel implementation is an
  explicit non-goal.
• Build a non-canonical fixture corpus: files in the shapes real projects actually use, not
  in the shape the code expects.
• Cross-file and cross-language logic lives in the shared parser package as pure functions, not
  inside UI event handlers, so it can be unit-tested at all.

Not in scope. Reconstructing an arbitrary hand-written form in the builder's own grammar — the
design doc rules this out; such forms open read-mostly.

Acceptance.

1. Opening any panel and saving with zero edits, on several real projects of differing
   conventions, produces an empty diff.
2. The same edit applied twice produces byte-identical output.
3. Round-trip tests exercise the writer, over non-canonical fixtures. ⚠ A fixture produced
   by the tool's own writer is already in the shape the code expects and will pass while real input
   corrupts.

---