perf(core): prepare each restore block once per transaction

[chh-ay]

Summary

Architecture layer: prepare each transaction once.

A restoreBlock operation carries a DEFLATE-compressed packed cell block. Each transaction decoded it 3–5 times, with one more decode per row-bridge projection and two per rebase transform. A new internal TransactionPreparation module owns the decoded block and its derived facts (normalized ranges, required sheets, formula and reference presence) for one synchronous apply. Validation, mutation policy, paged preflight, engine apply and row-bridge projection all read from it.

• Callbacks still mutable: if a callback rewrites an operation, its revision stamp changes and that operation is prepared again, so the existing revalidation regressions still hold.
• Undo compaction: reuses the block it already built instead of encoding and then inflating it again. The block is released when the commit finishes.
• Rebase: keeps one private decoded block across all its transforms and encodes once at the end. Conflict order, output and caller inputs are unchanged.
• No public change: wire operations, events and published signatures are untouched. Sync transport admission is out of scope.

Path	Decodes before	After
Dense local apply	3	1
Paged apply with a validation rule	5	1
Protection resolver installed	5	1
Row-bridge projection	4	1
Rebase, 10 structural transforms	20	1
Compact large-clear undo, per restore	3	0

Performance gate

Baseline 4997890, one detached worktree. 2 A/A control rounds, then 5 alternating rounds. Each scenario runs in a fresh Bun process pinned to CPU 4 under the shared lock.

Scenario	Base	Target	Change	Peak RSS
Near-ceiling restore (4,000,000 cells, 60 MB JSON)	2,213 ms	1,346 ms	−39%	1,224 → 1,161 MiB
Undo of a 1,000,000-cell clear (5 compact restores)	2,536 ms	1,833 ms	−28%	1,030 → 841 MiB
Untouched control: block admission	609 ms	604 ms	−0.9%	–
Untouched control: offline sync queue	2.50 ms	2.50 ms	−0.1%	–

A/A noise bands: 2.6%, 4.8%, 22% and 0.5%. No untouched workload is slower.

Changesets

prepare-restore-once: @sheetwrite/core minor.

Verification

• Core tests: 551 on the branch; 573 core and docs tests after merging the current docs: rework the landing and showcases, add the 0.5.0 guides, and cut per-page transfer #84 tip. Bench tests: 114.
• Typecheck, lint (two existing unrelated warnings), api:check and docs:check pass.
• Collaboration browser specs: 9 of 9 on the merged tree, including the atomic multi-version restore and conflict recovery.
• New regressions cover callback replacement of restore data, invalid byte claims, a missing sheet rejected before an earlier operation mutates anything, row-bridge projection of revised restores, and multi-transform rebase preserving caller inputs and conflict order.