Bounded undo/redo history for a (value, cursor) pair, held by the app.

Why the app holds it

It cannot live inside Harlock.TextBuffer or Harlock.TextArea. The app model owns :value and is free to rewrite it without the widget seeing — loading a file, clearing a form, applying a Cmd result. A history kept inside the widget would drift out of sync with the truth and start restoring text the user never typed. So the stack is a plain value the app keeps in its model and feeds explicitly:

def update({:harlock_edit, :body, {value, cursor}}, m) do
  %{m | body: value, cursor: cursor, undo: UndoStack.record(m.undo, {value, cursor})}
end

def update({:key, {:char, ?z}, [:ctrl]}, m) do
  case UndoStack.undo(m.undo) do
    {:ok, {value, cursor}, undo} -> %{m | body: value, cursor: cursor, undo: undo}
    :error -> m
  end
end

Because the app decides when to record/2, a programmatic rewrite can simply skip it — or call reset/2 to make the new content the new baseline.

Snapshots, not commands

Each entry is a whole {value, cursor} pair. For buffers the size a terminal edits, copying the string is cheaper than the bookkeeping an inverse-command stack needs, and it cannot get out of step with the text.

The ring is capped (default 100 committed entries); the oldest are dropped. An edit still in progress is held separately and adds at most one more step, so depth/1 can read one above the limit while you are mid-word.

Coalescing is contract, not implementation

A run of insertions collapses into one undo step, so typing a word and pressing undo removes the word rather than the last letter. That run breaks on:

• a newline — paragraphs are natural units, and one undo should not swallow several of them
• a cursor jump — moving somewhere else ends the edit you were making
• a delete after an insert — changing direction starts a new step

These are guarantees, not tuning. Coalescing too eagerly is worse than having no undo at all: a user who types a paragraph, presses undo expecting to lose a word, and loses the paragraph has had work destroyed rather than merely not restored.