Detect cap rotation via first-row hash to keep scrollback fresh

Follow-up correctness fix on top of the scrollback-in-buffer commit,
in a separate commit so it can be reverted independently.

When libghostty's scrollback hits its byte cap and starts evicting
the oldest rows in lockstep with new ones being pushed, the row at
scrollback index 0 changes underneath us. The normal delta-detection
in redraw() tracks `total_rows` deltas, but those don't capture
content rotation — and worse, the existing trim path (delta < 0)
removes our top rows under the assumption they match the rows
libghostty just evicted, which isn't true after rotation has shifted
the content.

User-visible symptom: after sustained streaming past the cap,
isearch / consult-line over the buffer's scrollback returns rows
that no longer exist in libghostty.

Fix:
- Add `wrote_since_redraw: bool` and `first_scrollback_row_hash: u64`
  to the Terminal struct.
- vtWrite sets `wrote_since_redraw = true`. The end of redraw clears
  it. resize() also clears `first_scrollback_row_hash` because reflow
  invalidates the row content.
- Add `computeFirstScrollbackRowHash` helper: scrolls libghostty's
  viewport to the top, reads the first row's first ~16 cells, mixes
  them into an FNV-1a 64-bit hash, restores the viewport. Six
  libghostty calls — cheap, gated to only run when rotation is
  suspected (writes happened + we have scrollback + we have a stored
  hash).
- At the start of redraw, before the existing delta sync, run the
  rotation check. If the stored hash differs from the freshly
  sampled hash, libghostty's scrollback has rotated underneath us:
  eraseBuffer, set scrollback_in_buffer = 0, force a full redraw.
  The delta-sync below will then see libghostty_sb - 0 = libghostty_sb
  and refetch everything fresh via insertScrollbackRange.
- After the delta-sync, update the stored hash whenever we have
  scrollback so the next redraw has a fresh baseline.

Why hash-the-row instead of comparing counts: libghostty's
total_rows is allowed to plateau OR shrink when the cap is hit
(it depends on page allocation and eviction semantics). Counter
comparison alone misses the case where total_rows is steady at the
cap with content rotating, and is wrong in the case where total_rows
shrinks while content has actually rotated. Sampling the first row's
content is the only signal that always tracks rotation correctly.

Test (test/ghostel-test.el):
- ghostel-test-scrollback-rotation-rebuild — write 5000 EARLY rows
  into a tiny-cap terminal (libghostty saturates at ~920 rows) +
  redraw, then write 5000 LATE rows without an intervening redraw,
  then redraw. The second redraw must detect rotation and rebuild
  so the buffer no longer contains any "early-" markers and shows
  the most recent late- rows.

A previous version of this commit also included a "batched
multi-row insert" optimization in insertScrollbackRange that
collapsed N per-row env.insert calls into roughly N/page_rows
calls. Empirically it only bought ~2-8% on the streaming bench
because libghostty's vt_write parsing dominates redraw cost in
that workload, not Elisp FFI. The added complexity (~140 lines:
new RowMeta struct, new flushScrollbackChunk helper, cumulative
char_offset arithmetic, chunk overflow handling, oversized-row
fallback) wasn't worth the small gain. The batched-insert patch
is preserved at .claude/batched-insert.patch and can be re-applied
with `git apply .claude/batched-insert.patch` if the streaming
hot path becomes more important later.

Author: dakra

src/render.zig

@@ -396,6 +396,56 @@ fn isRowPrompt(term: *Terminal) bool {
     return semantic != 0;
 }
 
+/// Hash the first ~16 cells of libghostty's first scrollback row using
+/// FNV-1a. Returns 0 if there is no scrollback or if anything fails.
+///
+/// Used to detect rotation: when libghostty's scrollback is plateaued at
+/// its byte cap, sustained writes evict the oldest row in lockstep with
+/// new rows being pushed, so `total_rows` doesn't change and the normal
+/// delta-detection sees no work to do. Sampling the first scrollback
+/// row's content lets us detect that the row at index 0 has changed
+/// underneath us.
+///
+/// Scrolls libghostty's viewport to the top to read the row, then
+/// restores the previous viewport offset. Cheap (~6 libghostty calls);
+/// gated by the caller to only run when rotation is suspected.
+fn computeFirstScrollbackRowHash(term: *Terminal) u64 {
+    const sb = term.getScrollbar() orelse return 0;
+    const saved_offset = sb.offset;
+
+    term.scrollViewport(gt.SCROLL_TOP, 0);
+    defer {
+        term.scrollViewport(gt.SCROLL_TOP, 0);
+        if (saved_offset > 0) {
+            term.scrollViewport(gt.SCROLL_DELTA, @intCast(saved_offset));
+        }
+    }
+
+    if (gt.c.ghostty_render_state_update(term.render_state, term.terminal) != gt.SUCCESS) return 0;
+    if (gt.c.ghostty_render_state_get(term.render_state, gt.RS_DATA_ROW_ITERATOR, @ptrCast(&term.row_iterator)) != gt.SUCCESS) return 0;
+    if (!gt.c.ghostty_render_state_row_iterator_next(term.row_iterator)) return 0;
+    if (gt.c.ghostty_render_state_row_get(term.row_iterator, gt.RS_ROW_DATA_CELLS, @ptrCast(&term.row_cells)) != gt.SUCCESS) return 0;
+
+    // FNV-1a 64-bit hash. We mix in the first ~16 cells' first
+    // codepoints (or a space for empty cells) — enough entropy to
+    // distinguish rotation states without scanning the whole row.
+    const fnv_prime: u64 = 0x100000001b3;
+    var hash: u64 = 0xcbf29ce484222325;
+    var i: usize = 0;
+    while (i < 16 and gt.c.ghostty_render_state_row_cells_next(term.row_cells)) : (i += 1) {
+        var graphemes_len: u32 = 0;
+        if (gt.c.ghostty_render_state_row_cells_get(term.row_cells, gt.RS_CELLS_DATA_GRAPHEMES_LEN, @ptrCast(&graphemes_len)) != gt.SUCCESS) continue;
+        if (graphemes_len == 0) {
+            hash = (hash ^ ' ') *% fnv_prime;
+            continue;
+        }
+        var codepoints: [4]u32 = undefined;
+        if (gt.c.ghostty_render_state_row_cells_get(term.row_cells, gt.RS_CELLS_DATA_GRAPHEMES_BUF, @ptrCast(&codepoints)) != gt.SUCCESS) continue;
+        hash = (hash ^ codepoints[0]) *% fnv_prime;
+    }
+    return hash;
+}
+
 /// Result from buildRowContent: byte length for make_string, char count for properties.
 const RowContent = struct {
     byte_len: usize,
@@ -671,7 +721,9 @@ fn insertScrollbackRange(
 ///
 /// When `force_full` is true, the viewport region is fully re-rendered
 /// instead of using the incremental dirty-row path.
-pub fn redraw(env: emacs.Env, term: *Terminal, force_full: bool) void {
+pub fn redraw(env: emacs.Env, term: *Terminal, force_full_arg: bool) void {
+    var force_full = force_full_arg;
+
     // Lock the libghostty viewport to the bottom. Users navigate history
     // through Emacs now, so any lingering scroll offset (e.g. from an
     // explicit ghostel--scroll) would desync our scrollback tracker.
@@ -693,6 +745,37 @@ pub fn redraw(env: emacs.Env, term: *Terminal, force_full: bool) void {
     _ = gt.c.ghostty_render_state_get(term.render_state, gt.RS_DATA_COLOR_FOREGROUND, @ptrCast(&default_fg));
     _ = gt.c.ghostty_render_state_get(term.render_state, gt.RS_DATA_COLOR_BACKGROUND, @ptrCast(&default_bg));
 
+    // ---- Scrollback rotation detection ------------------------------------
+    // When libghostty's scrollback is at its byte cap, sustained writes
+    // evict the oldest rows and push new ones, so the row at scrollback
+    // index 0 changes underneath us. The normal delta-sync below tracks
+    // `total_rows` deltas, but those don't capture content rotation —
+    // if the count is unchanged (or even shrinking) the trim path would
+    // remove our top rows under the *assumption* they match the rows
+    // libghostty just evicted, which isn't true after rotation.
+    //
+    // Detect rotation by hashing the first scrollback row whenever
+    // writes have happened since the last redraw and we have scrollback.
+    // A change means the top row is no longer the row we materialized
+    // → wipe the buffer and let the delta-sync below re-fetch everything
+    // fresh from libghostty.
+    if (term.wrote_since_redraw and term.scrollback_in_buffer > 0 and term.first_scrollback_row_hash != 0) {
+        const new_hash = computeFirstScrollbackRowHash(term);
+        // computeFirstScrollbackRowHash scrolled libghostty's viewport to
+        // sample row 0 and the defer restored the offset, but the render
+        // state may now be stale — refresh it before continuing.
+        if (gt.c.ghostty_render_state_update(term.render_state, term.terminal) != gt.SUCCESS) return;
+        if (new_hash != term.first_scrollback_row_hash) {
+            // Rotation detected — erase the buffer entirely and force a
+            // full viewport render. The delta-sync below will then see
+            // libghostty_sb - 0 = libghostty_sb and refetch everything.
+            env.eraseBuffer();
+            term.scrollback_in_buffer = 0;
+            term.first_scrollback_row_hash = 0;
+            force_full = true;
+        }
+    }
+
     // ---- Scrollback sync ---------------------------------------------------
     // libghostty stores scrollback + active screen in a single row space.
     // The rows "above" the viewport are scrollback; our invariant is that
@@ -1012,4 +1095,17 @@ pub fn redraw(env: emacs.Env, term: *Terminal, force_full: bool) void {
     if (term.getPwd()) |pwd| {
         _ = env.call1(emacs.sym.@"ghostel--update-directory", env.makeString(pwd));
     }
+
+    // Update the cached first-scrollback-row hash for the next redraw's
+    // rotation check. Always re-sample (cheap) because previous-redraw
+    // promotion/insert/trim could have shifted the row at index 0.
+    if (term.scrollback_in_buffer > 0) {
+        term.first_scrollback_row_hash = computeFirstScrollbackRowHash(term);
+    } else {
+        term.first_scrollback_row_hash = 0;
+    }
+
+    // Clear the write flag so the next redraw can detect "writes happened
+    // since last redraw" for the rotation check.
+    term.wrote_since_redraw = false;
 }

src/terminal.zig

@@ -36,6 +36,19 @@ rows: u16,
 /// libghostty's scrollback cap.
 scrollback_in_buffer: usize = 0,
 
+/// Set by `vtWrite`, cleared at the end of `redraw`. Used to detect that
+/// libghostty has been written to since the last redraw — required by
+/// the cap-bound stale-scrollback rebuild trigger to distinguish "no
+/// activity" from "writes happened but total_rows plateaued".
+wrote_since_redraw: bool = false,
+
+/// Hash of the first scrollback row's content, sampled at the end of
+/// each redraw that touched scrollback. Used to detect rotation
+/// (libghostty evicting the oldest row in lockstep with new ones being
+/// pushed) when `total_rows` is plateaued at the cap. Zero means "no
+/// scrollback" or "not yet sampled".
+first_scrollback_row_hash: u64 = 0,
+
 /// Cached Emacs env pointer — only valid during a callback from Emacs.
 env: ?emacs.Env = null,
 
@@ -187,6 +200,7 @@ pub fn getColorBackground(self: *Self, out: *gt.ColorRgb) bool {
 /// Feed VT data from the PTY into the terminal.
 pub fn vtWrite(self: *Self, data: []const u8) void {
     gt.c.ghostty_terminal_vt_write(self.terminal, data.ptr, data.len);
+    self.wrote_since_redraw = true;
 }
 
 /// Resize the terminal.
@@ -202,6 +216,7 @@ pub fn resize(self: *Self, cols: u16, rows: u16) !void {
     self.cols = cols;
     self.rows = rows;
     self.scrollback_in_buffer = 0;
+    self.first_scrollback_row_hash = 0;
 }
 
 /// Scroll the viewport.

test/ghostel-test.el

@@ -263,6 +263,54 @@ detection, ghostel-prompt) stay attached."
               (should (string-match-p "second-05" content)))))
       (kill-buffer buf))))
 
+(ert-deftest ghostel-test-scrollback-rotation-rebuild ()
+  "Verify cap rotation triggers a rebuild so the buffer reflects libghostty.
+The test fills libghostty past its scrollback cap with EARLY markers,
+redraws once so the buffer matches the current libghostty state, then
+writes a much bigger batch of LATE markers (without an intervening
+redraw).  When the next redraw runs, libghostty's `total_rows' is
+plateaued at the cap so the normal delta-detection sees nothing to do
+— the rotation-detect path must kick in, notice the first scrollback
+row's hash has changed, erase the buffer, and let the bootstrap fetch
+re-sync from libghostty so the buffer reflects the LATE rows."
+  (let ((buf (generate-new-buffer " *ghostel-test-sb-rotate*")))
+    (unwind-protect
+        (with-current-buffer buf
+          (let* (;; 4 KB cap empirically holds ~920 rows of short content
+                 ;; in libghostty's compact storage.
+                 (term (ghostel--new 5 80 (* 4 1024)))
+                 (inhibit-read-only t))
+            ;; Phase 1: write 5000 EARLY rows. libghostty's scrollback
+            ;; saturates at ~920 rows so the surviving rows are
+            ;; early-04080..early-04999 (the most recent 920 of 5000).
+            (dotimes (i 5000)
+              (ghostel--write-input term (format "early-%05d\r\n" i)))
+            (ghostel--redraw term t)
+            ;; After this redraw, buffer's scrollback_in_buffer matches
+            ;; libghostty's count (~920) and contains those high-numbered
+            ;; early rows.
+            (let ((content (buffer-substring-no-properties (point-min) (point-max))))
+              (should (string-match-p "early-04999" content)))
+            ;; Phase 2: write 5000 LATE rows WITHOUT redrawing in
+            ;; between. libghostty rotates: every new write evicts an
+            ;; early row and pushes a late row. After 5000 writes, all
+            ;; survivors are late-* (since 5000 > 920 cap).
+            (dotimes (i 5000)
+              (ghostel--write-input term (format "late-%05d\r\n" i)))
+            ;; Final redraw: total_rows hasn't changed (libghostty is
+            ;; still at the cap) but the content has fully rotated.
+            ;; Without rotation-detect this would be a no-op and the
+            ;; buffer would still show early-* rows.
+            (ghostel--redraw term t)
+            (let ((content (buffer-substring-no-properties (point-min) (point-max))))
+              ;; Late rows must be present (libghostty kept the most
+              ;; recent ones, the rebuild fetched them into the buffer).
+              (should (string-match-p "late-04999" content))
+              ;; Early rows must NOT be present anywhere — libghostty
+              ;; evicted them AND the rebuild flushed our stale copy.
+              (should-not (string-match-p "early-" content)))))
+      (kill-buffer buf))))
+
 ;; -----------------------------------------------------------------------
 ;; Test: clear screen (ghostel-clear)
 ;; -----------------------------------------------------------------------