Restore displaced and current models when a model load fails

[fumitoh]

What changed

ModelReader.read_model (serializers 4-7) now restores the system's pre-existing models when a load fails partway:

• Displaced model gets its name back. RenameParser runs at AT_PARSE and renames the half-built model to its saved name immediately during parsing, displacing a same-named existing model to <name>_BAK<n>. Previously, a failed read closed only the half-built model, leaving the user's model stranded under the backup name with nothing under the original name.
• The previously current model becomes current again. parse_dir's mx.new_model() makes the half-built model current, and close_model nulls currentmodel instead of restoring the prior one — so after any failed read, mx.cur_model() was None and the next current-model-dependent call (e.g. mx.defcells, mx.new_space) silently created a brand-new model.

The fix is shared: a new modelx/serialize/reader_state.py defines SystemStateSnapshot, which records system.models and system.currentmodel before each read; the except paths of serializer 4/5/6 (7 inherits 6) call state.restore() after closing the half-built model and rolling back the IOManager journal (#256). Restoration is guarded by identity checks so it only renames back a model this read displaced, and only when the original name is free.

Successful reads are unchanged: the displaced model intentionally keeps its _BAK name (covered by the existing test_restore_model_leave_old).

Tests

New modelx/tests/serialize/test_read_error_recovery.py (16 tests, versions 4-7). The failure is produced without mocks by truncating a space file mid-statement in a copy of the compat fixtures, so the load aborts after the displacing rename — the worst-case failure point. Scenarios: displaced model restored by identity under its original name, prior cur_model() restored, no-prior-model reads left untouched, and the success path still displacing to _BAK.

Without the fix, 8 of the 16 fail (both defects, all four versions); with it, the full suite is green (1144 passed, 6 skipped).

Notes for review

• Branch is rebased onto FIX: Roll back IOManager registrations when model reads fail #256 (1ab0bcf), which restructured the same except blocks; state.restore() runs after that fix's close() + rollback_journal block, before raise.
• Scoped deliberately to rename/currentmodel restoration; the IOManager leak was fixed separately in FIX: Roll back IOManager registrations when model reads fail #256.

🤖 Generated with Claude Code