Bad code: record command provenance as immutable edit-planning events #168

Problem

PR #167 made :why useful, but the review fixes exposed a structural debt: some command provenance is still reconstructed later from mutable editor/text-authority state. That makes it too easy for stale lastVimEdit, stale receipts, stale registers, or later non-Vim edits to impersonate the command that actually produced a settled edit.

The patched branch fixed the known symptoms, but the safer design is to make command provenance an immutable planning artifact.

Desired Direction

When a meaningful command is planned and queued, create a first-class provenance event or draft witness at that point, keyed by the pending client sequence/request id. Later Echo receipts, admission status, and history rows should enrich that event instead of reconstructing command facts from whatever the editor currently remembers.

Suggested shape:

• command/provenance event created at edit planning time;
• event keyed by pending client sequence/request id;
• target/range/register facts captured from the resolver that produced the edit;
• receipt/admission fields attached when Echo settles;
• history drawer and :why read the event/witness, not stale mutable fallback state;
• unsupported commands explicitly produce target unavailable or provenance unavailable, not synthesized facts.

Why Now

The #167 review found this class of bugs:

• a later insert edit could reuse stale Vim provenance;
• dot-repeat could report an old target if repeat facts were not refreshed;
• a pending command could show a stale prior receipt;
• a command without target facts could synthesize a target from an unrelated register source.

Those concrete bugs were fixed in #167, but the root smell remains: provenance should be durable command evidence, not a best-effort late reconstruction.

Acceptance Sketch

• :why and Echo History explain the event attached to the edit request/receipt.
• A later unrelated edit cannot inherit an older Vim command summary.
• Pending receipt posture cannot accidentally reuse an older receipt id.
• Commands without target facts remain honest instead of inventing stale ranges.
• Tests prove command facts survive settlement through request/event identity, not through mutable editor fallback.

Scope Guard

This is implementation debt cleanup for WF-0108, not a request to expand the command set or build historical preview.

Related: #131, PR #167.