beatrina 0.8.6 → 0.9.43

package/kernel/worker.R

@@ -63,9 +63,9 @@ local({
 # interactive worker MUST read through R's console (stdin()), because that is
 # the one reader a native browser() prompt shares — a second buffered reader
 # on the same fd would steal bytes from the debugger.
-WORKER_MODE <- Sys.getenv("CARMAR_WORKER_MODE", "batch")
+WORKER_MODE <- Sys.getenv("BEATRINA_WORKER_MODE", "batch")
 sentinel <- if (identical(WORKER_MODE, "interactive")) {
-  Sys.getenv("CARMAR_SENTINEL", "")
+  Sys.getenv("BEATRINA_SENTINEL", "")
 } else {
   args <- commandArgs(trailingOnly = TRUE)
   if (length(args) >= 1L) args[1] else ""
@@ -75,13 +75,89 @@ stopifnot(nzchar(sentinel))
 # mode — a comment, so a line that ever reached R's raw top level would be
 # inert. The prefix is stripped here before parsing.
 CMD_PREFIX <- local({
-  tag <- Sys.getenv("CARMAR_CMD_TAG", "")
+  tag <- Sys.getenv("BEATRINA_CMD_TAG", "")
   if (nzchar(tag)) paste0("#", tag, " ") else ""
 })
 
 PLOT_WIDTH <- 900L
 PLOT_HEIGHT <- 620L
 PLOT_RES <- 110L
+
+#' knitr's OWN figure defaults, captured before any user code runs.
+#'
+#' The baseline that lets knitr_dim_defaults() tell "this document asked for a
+#' 10-inch figure" from "knitr answered with its own 7-inch default". Read at
+#' load time on purpose: after a setup chunk has run it is no longer pristine.
+KNITR_FIG_BASE <- local({
+  if (!requireNamespace("knitr", quietly = TRUE)) return(NULL)
+  tryCatch(knitr::opts_chunk$get(c("fig.width", "fig.height", "dpi")),
+           error = function(e) NULL)
+})
+
+#' The document's own figure defaults, from knitr.
+#'
+#' `knitr::opts_chunk$set(fig.width = 10, dpi = 150)` in a setup chunk is how
+#' every R author states what size their figures are, and until 2026-09-18 an
+#' interactive run ignored it completely: the call looked like configuration
+#' and did nothing, and the PNGs came back at this file's constants whatever
+#' the document said. knitr sizes in INCHES and carries the resolution
+#' separately, which is exactly a raster device's width = inches * dpi.
+#'
+#' Precedence, widest to narrowest: what the page sent for THIS run (the
+#' chunk's own fig.width, or the editor's device settings) wins, because it is
+#' more specific than a document default; then these; then the constants.
+#'
+#' @return A list with any of width/height/res in pixels, or an empty list.
+knitr_dim_defaults <- function() {
+  if (!requireNamespace("knitr", quietly = TRUE)) return(list())
+  got <- tryCatch(knitr::opts_chunk$get(c("fig.width", "fig.height", "dpi")),
+                  error = function(e) NULL)
+  if (!is.list(got)) return(list())
+  # Only what the DOCUMENT set. knitr always answers with something — its own
+  # defaults are 7in by 7in at 72 dpi — so honouring whatever it says would
+  # shrink every plot in every notebook that never mentioned figures, from 900
+  # pixels to 504. KNITR_FIG_BASE is knitr's pristine answer, captured at boot
+  # before a line of anyone's code has run; a value equal to it was not asked
+  # for by this document and is ignored.
+  base <- KNITR_FIG_BASE
+  if (is.list(base)) {
+    for (key in c("fig.width", "fig.height", "dpi")) {
+      if (!is.null(base[[key]]) && !is.null(got[[key]]) && isTRUE(all.equal(base[[key]], got[[key]]))) got[[key]] <- NULL
+    }
+  }
+  num <- function(x) if (is.numeric(x) && length(x) == 1L && is.finite(x) && x > 0) as.numeric(x) else NULL
+  dpi <- num(got$dpi)
+  w <- num(got$fig.width)
+  h <- num(got$fig.height)
+  out <- list()
+  if (!is.null(dpi)) out$res <- as.integer(round(dpi))
+  # Inches become pixels only when there is a resolution to multiply by; with
+  # no dpi set, knitr's own default of 72 is what a figure of that width means.
+  scale <- if (!is.null(dpi)) dpi else 72
+  if (!is.null(w)) out$width <- as.integer(round(w * scale))
+  if (!is.null(h)) out$height <- as.integer(round(h * scale))
+  out
+}
+
+#' The document's chosen display precision, or NULL if it never chose one.
+#'
+#' R's factory default is 7. A document that says `options(digits = 3)` means
+#' its tables to read at three significant digits, and says it once, in a setup
+#' chunk — so the value travels with every frame rather than being asked for
+#' per table.
+display_digits <- function() {
+  d <- getOption("digits", 7L)
+  if (!is.numeric(d) || length(d) != 1L || !is.finite(d) || d == 7L) return(NULL)
+  as.integer(max(1L, min(22L, round(d))))
+}
+
+#' One dimension, resolved: this run's value, else the document's, else ours.
+dim_or <- function(value, key) {
+  if (!is.null(value)) return(value)
+  doc <- knitr_dim_defaults()
+  if (!is.null(doc[[key]])) return(doc[[key]])
+  switch(key, width = PLOT_WIDTH, height = PLOT_HEIGHT, res = PLOT_RES)
+}
 # Hard ceilings for the data viewer. Server-side because the client is one
 # `limit: 1e9` typo away from asking for everything; the reply reports what was
 # clamped, so the UI never has to guess what it actually received.
@@ -114,13 +190,13 @@ try(utils::rc.settings(ipck = TRUE, func = TRUE, args = TRUE, files = TRUE),
 # is started by three different launchers (kernel.R, the Chrome bridge host,
 # and the packaged inst/app/kernel) and none of them guarantee a cwd.
 import_sources <- local({
-  env_dir <- Sys.getenv("CARMAR_WORKER_DIR", "")
+  env_dir <- Sys.getenv("BEATRINA_WORKER_DIR", "")
   file_arg <- grep("^--file=", commandArgs(FALSE), value = TRUE)
   here <- if (nzchar(env_dir)) env_dir
   else if (length(file_arg)) {
     dirname(normalizePath(sub("^--file=", "", file_arg[1L]), mustWork = FALSE))
   } else getwd()
-  file.path(here, c("fileio.R", "sniff.R", "project.R"))
+  file.path(here, c("fileio.R", "sniff.R", "project.R", "workspace-keep.R", "deployment.R"))
 })
 # environment(), not parent.frame(): inside a nested local() the parent frame
 # is the eval machinery's, not this file's private scope, and the functions
@@ -142,9 +218,9 @@ invisible(lapply(Filter(file.exists, import_sources),
 # user already set: their .Rprofile loads here (we deliberately do not use
 # --vanilla), and it is where r-universe and institutional mirrors live.
 local({
-  managed_mirror <- trimws(Sys.getenv("CARMAR_CRAN_MIRROR", ""))
+  managed_mirror <- trimws(Sys.getenv("BEATRINA_CRAN_MIRROR", ""))
   if (nzchar(managed_mirror) && !grepl("^https://", managed_mirror)) {
-    stop("CARMAR_CRAN_MIRROR must be an HTTPS URL.")
+    stop("BEATRINA_CRAN_MIRROR must be an HTTPS URL.")
   }
   repos <- getOption("repos")
   cran <- if (is.null(repos)) NA_character_ else unname(repos["CRAN"])
@@ -191,7 +267,7 @@ R_KEYWORDS <- c("if", "else", "repeat", "while", "function", "for", "in",
 #' CAIRO IS TRIED BEFORE QUARTZ, and that ORDER is a hang fix, not a
 #' preference. `png(type="quartz")` pulls in the macOS Aqua/AppKit graphics
 #' backend, which spawns a Cocoa event loop (an NSEventThread plus grDevices'
-#' own ELThread) the first time it opens. CarmaR's worker is a BackgroundOnly
+#' own ELThread) the first time it opens. Beatrina's worker is a BackgroundOnly
 #' process with no window-server access, so when R pumps that event loop
 #' mid-evaluation — which it does from inside a long R-level loop, e.g. the
 #' permutation loop in `markov_order_test` — `ReceiveNextEventCommon` blocks
@@ -391,7 +467,10 @@ sys.source(file.path(here, "knitr-run.R"), envir = environment())
 # code and every package keep seeing base's own function, and removing the
 # attached frame restores the original behaviour exactly. The delegation is the
 # whole implementation — announce, then let R do what it already did.
-carmar_readline <- function(prompt = "") {
+# The console reader itself, captured BEFORE the namespaces are patched below:
+# the announcing wrapper must call the real one, never itself.
+BASE_READLINE <- if (is.null(attr(base::readline, "beatrina"))) base::readline else attr(base::readline, "beatrina")
+beatrina_readline <- function(prompt = "") {
   text <- tryCatch(as.character(prompt)[[1]], error = function(e) "")
   if (!length(text) || is.na(text)) text <- ""
   # The question belongs to the RUN that asked it, and says so.
@@ -413,7 +492,7 @@ carmar_readline <- function(prompt = "") {
   # id by finding the first `"id":…` in the worker's own bytes, so a prompt
   # containing that text would otherwise be rewritten instead of the id.
   emit(list(type = "input_request", id = RUN_STATE$id, prompt = text))
-  answer <- base::readline(prompt)
+  answer <- BASE_READLINE(prompt)
   # Symmetry matters more than it looks: a page that opened an input row on the
   # request must be told to close it, INCLUDING when the answer arrived by some
   # other route (an interrupt, a second page). Without this the prompt row
@@ -438,7 +517,7 @@ carmar_readline <- function(prompt = "") {
 # RUN_STATE carries the current run's id from run_cell to the shadow.
 RUN_STATE <- new.env(parent = emptyenv())
 RUN_STATE$id <- NULL
-carmar_print <- function(x, ...) {
+beatrina_print <- function(x, ...) {
   if (is.null(RUN_STATE$id) || length(list(...)) || sink.number() > (RUN_STATE$capture_depth %||% 0L)) {
     return(base::print(x, ...))
   }
@@ -457,8 +536,8 @@ carmar_print <- function(x, ...) {
   }
   base::print(x, ...)
 }
-INPUT_SHADOW <- "carmar:input"
-carmar_flush_console <- function() {
+INPUT_SHADOW <- "beatrina:input"
+beatrina_flush_console <- function() {
   if (!is.null(KNIT_CAPTURE)) evaluate::flush_console()
   else utils::flush.console()
   invisible(NULL)
@@ -467,10 +546,136 @@ if (!(INPUT_SHADOW %in% search())) {
   # warn.conflicts = FALSE: masking `readline` (and `print`) is the entire
   # point, and a startup warning about it would be printed into the user's
   # first cell.
-  attach(list(readline = carmar_readline, print = carmar_print, flush.console = carmar_flush_console),
+  attach(list(readline = beatrina_readline, print = beatrina_print, flush.console = beatrina_flush_console),
          name = INPUT_SHADOW, warn.conflicts = FALSE)
 }
 
+# Console reads R's OWN helpers make are announced too (2026-09-19). The shadow
+# above only answers for readline() typed in the user's code: askYesNo(),
+# menu(), select.list(), scan("") and every package reach base and utils
+# through their NAMESPACES, where a search-path shadow is invisible — measured:
+# menu() printed its choices and the run sat blocked with no prompt on the
+# page, and so did askYesNo, select.list and scan. So the readers are announced
+# where everything funnels through them:
+#   - base::readline is the announcing reader in base's namespace and package
+#     env, so askYesNo() and every package's readline() ride it;
+#   - utils::menu's console loop is re-expressed over it (the original reads
+#     the console from C, C_menu, which nothing at R level can observe);
+#   - scan() from the console collects its lines through it and hands them to
+#     the real scan() as `text`.
+# Each READ is announced, so a menu that re-asks after a bad answer opens a
+# fresh prompt instead of having its answer refused by the one-line gate.
+# The originals are kept (as the "beatrina" attribute, BASE_*), and the
+# patching is idempotent.
+
+#' Put `value` in place of `name` in a package's namespace and its attached env.
+#' @return Invisibly, whether every present binding was replaced.
+beatrina_patch <- function(name, value, pkg) {
+  envs <- Filter(Negate(is.null), list(asNamespace(pkg),
+    if (paste0("package:", pkg) %in% search()) as.environment(paste0("package:", pkg)) else NULL))
+  done <- vapply(envs, function(env) {
+    if (!exists(name, envir = env, inherits = FALSE)) return(TRUE)
+    locked <- bindingIsLocked(name, env)
+    if (locked) unlockBinding(name, env)
+    on.exit(if (locked) lockBinding(name, env), add = TRUE)
+    assign(name, value, envir = env)
+    TRUE
+  }, logical(1))
+  invisible(all(done))
+}
+
+#' menu() over the announced reader, faithful to utils::menu's console path:
+#' the same layout, a number or an exact choice, 0 to exit, and the same
+#' sentence on a bad answer. The graphics path is left to the original.
+#' @return The chosen index, or 0.
+BASE_MENU <- if (is.null(attr(utils::menu, "beatrina"))) utils::menu else attr(utils::menu, "beatrina")
+beatrina_menu <- function(choices, graphics = FALSE, title = NULL) {
+  if (!interactive()) stop("menu() cannot be used non-interactively")
+  if (isTRUE(graphics)) return(BASE_MENU(choices, graphics = graphics, title = title))
+  choices <- as.character(choices)
+  nc <- length(choices)
+  if (length(title) && nzchar(title[1L])) cat(title[1L], "\n")
+  op <- paste0(format(seq_len(nc)), ": ", choices)
+  if (nc > 10L) {
+    fop <- format(op)
+    nw <- nchar(fop[1L], "w") + 2L
+    ncol <- getOption("width") %/% nw
+    if (ncol > 1L) op <- paste0(fop, c(rep.int("  ", min(nc, ncol) - 1L), "\n"), collapse = "")
+  }
+  cat("", op, "", sep = "\n")
+  # Recursion, not a loop: ask until the answer names an item (R's own menu
+  # repeats the same way; a person typing nonsense is the only way round).
+  ask <- function() {
+    ans <- trimws(beatrina_readline("Selection: "))
+    ind <- if (grepl("^[0-9]", ans)) suppressWarnings(as.integer(sub("^([0-9]+).*$", "\\1", ans)))
+      else match(ans, choices, nomatch = nc + 1L)
+    if (!is.na(ind) && ind <= nc) return(ind)
+    # gettext() trims the trailing newline off the message; it is said apart.
+    cat(gettext("Enter an item from the menu, or 0 to exit", domain = "R-utils"), "\n", sep = "")
+    ask()
+  }
+  ask()
+}
+attr(beatrina_menu, "beatrina") <- BASE_MENU
+
+#' scan() from the console, through the announced reader. Lines are read the
+#' way the console scan reads them — one prompt per line, numbered by the next
+#' item, until a blank line, `nlines` lines, or `n`/`nmax` items — then the real
+#' scan() parses them as `text`, so every argument keeps its meaning.
+BASE_SCAN <- if (is.null(attr(base::scan, "beatrina"))) base::scan else attr(base::scan, "beatrina")
+beatrina_scan <- BASE_SCAN
+body(beatrina_scan) <- quote({
+  call <- match.call()
+  call[[1L]] <- BASE_SCAN
+  from_console <- is.character(file) && identical(file, "") && missing(text)
+  if (!from_console) return(eval(call, parent.frame()))
+  per_line <- function(line) {
+    parts <- if (nzchar(sep)) strsplit(line, sep, fixed = TRUE)[[1L]] else strsplit(trimws(line), "[ \t]+")[[1L]]
+    length(parts[nzchar(parts)])
+  }
+  want <- max(c(n, nmax, 0L)[c(n, nmax, 0L) > 0L][1L], 0L, na.rm = TRUE)
+  collect <- function(lines, items) {
+    if (nlines > 0L && length(lines) >= nlines) return(lines)
+    if (want > 0L && items >= want) return(lines)
+    line <- beatrina_readline(sprintf("%d: ", items + 1L))
+    if (!nzchar(trimws(line))) return(lines)
+    collect(c(lines, line), items + per_line(line))
+  }
+  call$file <- NULL
+  call$text <- paste(collect(character(), 0L), collapse = "\n")
+  eval(call, parent.frame())
+})
+attr(beatrina_scan, "beatrina") <- BASE_SCAN
+attr(beatrina_readline, "beatrina") <- BASE_READLINE
+environment(beatrina_scan) <- environment()
+
+beatrina_patch("readline", beatrina_readline, "base")
+beatrina_patch("scan", beatrina_scan, "base")
+beatrina_patch("menu", beatrina_menu, "utils")
+
+#' Never ask "Hit <Return> to see next plot".
+#'
+#' This worker is interactive, so a plot that turns page prompting on —
+#' tna's plot() for cliques does `par(ask = TRUE)` by default — makes the
+#' graphics engine read the console before each new page. That read is not
+#' readline(), so nothing announces it: the chunk spun forever and every
+#' chunk behind it queued (test/lab-rmd.e2e, the lab's `plot(cliques_of_two,
+#' 4)`). Every page is captured as its own figure here, so there is no page to
+#' wait for. The hooks run before the engine's check on every new page, base
+#' graphics and grid alike; a package's own `par(ask = TRUE)` is left in place
+#' and simply never gets to ask.
+#'
+#' @return Invisibly NULL.
+beatrina_no_page_prompt <- function() {
+  if (isTRUE(grDevices::devAskNewPage())) grDevices::devAskNewPage(FALSE)
+  invisible(NULL)
+}
+local({
+  already <- function(hook) any(vapply(getHook(hook), identical, logical(1), beatrina_no_page_prompt))
+  if (!already("before.plot.new")) setHook("before.plot.new", beatrina_no_page_prompt)
+  if (!already("before.grid.newpage")) setHook("before.grid.newpage", beatrina_no_page_prompt)
+})
+
 #' A function's formals as one display string, defaults included.
 #'
 #' `formals()` is NULL for primitives like `sum`; `args()` still knows their
@@ -651,9 +856,9 @@ emit_struct <- function(id, name = NULL, path = NULL) {
     child_get(o, k)
   }
   node <- tryCatch(Reduce(step, keys, init = get(name, envir = globalenv())),
-                   error = function(e) structure(class = "carmar_fail",
+                   error = function(e) structure(class = "beatrina_fail",
                                                  list(msg = conditionMessage(e))))
-  if (inherits(node, "carmar_fail")) {
+  if (inherits(node, "beatrina_fail")) {
     emit(list(type = "struct", id = id, name = name, path = as.list(keys),
               error = node$msg))
     return(invisible(NULL))
@@ -955,6 +1160,88 @@ emit_colstats <- function(id, name, column, query = NULL, filters = NULL) {
   )
 }
 
+#' The grid's copy door, R's half: one column, every row, as text.
+#'
+#' `Copy Column (all rows, through R)` (lib/panel.js `columnValues`,
+#' lib/command-system.js): the page holds one window of rows, so a whole
+#' column has to come from here. Same object resolution, same query and
+#' filters as `view` and `colstats`, so what is copied is the column of the
+#' rows the grid is showing — every one of them, not one page. Written the way
+#' `write.csv` writes it (header quoted, text quoted, numbers at full
+#' precision, NA bare, no row names) to a temporary file and read back: no
+#' sink, nothing evaluated but the name. Read-only.
+#'
+#' Bounded at COLUMN_VALUES_MAX values and refused above it with a sentence:
+#' a twenty-million-line clipboard is not a copy, it is an export, and the
+#' Export door sits one row down in the same menu.
+#'
+#' @param id Request id.
+#' @param name Object name or expression, as for `view`.
+#' @param column The column to copy.
+#' @param query,filters The viewer's active search and column filters.
+COLUMN_VALUES_MAX <- 1000000L
+
+emit_column_values <- function(id, name, column, query = NULL, filters = NULL) {
+  column <- if (is.character(column) && length(column)) column[[1L]] else ""
+  reply <- function(...) emit(list(type = "column_values", id = id, name = name,
+                                   column = column, ...))
+  if (!is.character(name) || length(name) != 1L || is.na(name) || !nzchar(name)) {
+    reply(error = "bad name")
+    return(invisible(NULL))
+  }
+  obj <- tryCatch(eval(parse(text = name), globalenv()), error = function(e) NULL)
+  # NULL is checked BEFORE coercion: as.data.frame(NULL) is an empty frame,
+  # not NULL, and a missing object would otherwise read as "no such column".
+  if (is.null(obj)) {
+    reply(error = "not found")
+    return(invisible(NULL))
+  }
+  if (!is.data.frame(obj)) obj <- tryCatch(as.data.frame(obj, stringsAsFactors = FALSE),
+                                           error = function(e) NULL)
+  if (is.null(obj) || !nzchar(column)) {
+    reply(error = "not found")
+    return(invisible(NULL))
+  }
+  total <- nrow(obj)
+  narrowed <- view_filter(obj, query, filters)
+  obj <- narrowed$obj
+  hit <- match(column, names(obj))
+  if (is.na(hit)) hit <- match(column, substr(names(obj), 1L, MAX_VIEW_LABEL_CHARS))
+  if (is.na(hit)) {
+    reply(error = "no such column")
+    return(invisible(NULL))
+  }
+  n <- nrow(obj)
+  if (n > COLUMN_VALUES_MAX) {
+    reply(error = sprintf("%s has %s values; copying through R stops at %s. Export the table instead.",
+                          column, format(n, big.mark = ","),
+                          format(COLUMN_VALUES_MAX, big.mark = ",")),
+          rows = n, totalRows = total)
+    return(invisible(NULL))
+  }
+  # A temporary file, not a textConnection: the connection grows its vector a
+  # line at a time and took 16 s for 100,000 rows where the file takes 50 ms
+  # (measured 2026-09-17, identical text). UTF-8 both ways, so Windows' native
+  # code page never enters the text. as.data.frame() first: a tibble or
+  # data.table has its own `[`, and this must be base's one-column frame.
+  tf <- tempfile("column-values-", fileext = ".csv")
+  on.exit(unlink(tf), add = TRUE)
+  written <- tryCatch({
+    utils::write.csv(as.data.frame(obj)[hit], tf, row.names = FALSE, fileEncoding = "UTF-8")
+    TRUE
+  }, interrupt = function(i) FALSE, error = function(e) e)
+  if (isTRUE(written)) {
+    reply(text = paste(readLines(tf, encoding = "UTF-8", warn = FALSE), collapse = "\n"),
+          rows = n, totalRows = total,
+          filtered = nzchar(narrowed$query) || narrowed$count > 0L)
+  } else if (isFALSE(written)) {
+    reply(error = "interrupted")
+  } else {
+    reply(error = conditionMessage(written))
+  }
+  invisible(NULL)
+}
+
 #' Autocomplete via R's own engine — the one behind TAB in the console,
 #' RStudio and Jupyter. Not hand-rolled: the engine already understands `$`
 #' and `@` access, argument names inside a call, `::` namespaces, library()
@@ -1051,15 +1338,125 @@ emit_complete <- function(id, line = NULL, cursor = NULL, max_items = MAX_COMPLE
     }
     list(value = v, kind = "variable", detail = detail)
   }
+  comps <- c(st$comps, case_blind_extras(st$token, st$comps, line, st$start, quoted))
+  # R answers a `df$xyz` that matches nothing with the bare stub `df$`. As a
+  # completion that is worse than none: accepting it REPLACES the token, so it
+  # deletes the `xyz` the user typed and leaves incomplete syntax behind. It is
+  # dropped only when the token already carries the separator — offering `x$`
+  # for a token of `x`, or `stats::` for `stat`, is the useful "there is more
+  # inside this" hint RStudio gives, and those stay. `pkg::` behaves the same
+  # way as `$` and `@` here, so all three are one rule.
+  SEP_END <- "([$@]|:::?)$"
+  if (grepl("([$@]|::)", st$token) && !grepl(SEP_END, st$token)) {
+    comps <- comps[!grepl(SEP_END, comps)]
+  }
   frame <- list(type = "complete", id = id, start = st$start, end = cursor,
                 token = st$token,
-                items = lapply(utils::head(st$comps, max_items), describe_item),
-                truncated = length(st$comps) > max_items)
+                items = lapply(utils::head(comps, max_items), describe_item),
+                truncated = length(comps) > max_items)
   frame$args <- I(completion_call_args(fn))
   frame$columns <- completion_columns(data, max_items)
   emit(frame)
 }
 
+#' Names that match the typed token when case is ignored.
+#'
+#' R's own completion engine (`utils:::.completeToken`) matches case-SENSITIVELY
+#' and has no option not to: typing `rda` offers nothing at all for an object
+#' called `Rdata`, and `myv` offers nothing for `myVar`. The page's own
+#' candidates — the names it parses out of the notebook's source — have always
+#' matched case-blind (`lib/completion-merge.js`), so the same keystroke
+#' completed a name written in a chunk and did NOT complete the same name once
+#' it existed in the session. One editor, two rules, decided by where the name
+#' happened to live.
+#'
+#' Case is ignored for EVERY token, `myV` as much as `rda`. A first shape of
+#' this left mixed-case tokens to R's exact matching on the theory that a
+#' capital typed mid-word was deliberate — but the page's parsed candidates
+#' never made that distinction, so it would have rebuilt the same split this
+#' function exists to close, one spelling further along. Completion is case
+#' insensitive; there is no second rule.
+#'
+#' These are EXTRAS, appended: an exact-case match is still found the way it
+#' always was, and `lib/completion-merge.js` already sorts a prefix match that
+#' differs in case below one that does not, so nothing moves in a list that was
+#' already right.
+#'
+#' Refused where a dotted or quoted context means the names are not the search
+#' path's: `df$`, `obj@`, `pkg::` and a path inside a string are R's to answer,
+#' and sweeping globals into them would offer names that cannot be used there.
+#'
+#' Measured at 2.4 ms over a 2,482-name search path — one sweep per keystroke
+#' that reaches the kernel, against a round trip that costs more than that.
+#'
+#' Every context R answers is covered, because "autocomplete is case
+#' insensitive" with an exception is two rules again: a bare name against the
+#' search path, `df$col`, `obj@slot`, and `pkg::name`. Each gets its OWN
+#' candidate set — the object's names, the object's slots, the namespace's
+#' exports — so nothing is offered where it could not be used.
+#'
+#' NOTHING IS EVALUATED to answer a keystroke. The head of a `$`/`@`/`::` is
+#' accepted only as a plain name and looked up with `get0`, and a namespace is
+#' read only when it is ALREADY loaded — the same rule
+#' `completion_call_args()` follows, for the same reason.
+#'
+#' @param token The token R guessed, as typed. R reports the WHOLE token for a
+#'   dotted context (`x$al`, not `al`), which is what makes splitting it here
+#'   the right place rather than re-deriving the head from the line.
+#' @param comps What R already matched, so nothing is offered twice.
+#' @param line The whole line, for the character before the token.
+#' @param start R's own start offset for the token (1-based, before the token).
+#' @param quoted Whether the token sits inside a string.
+#' @return Character vector of extra completions, spelled as R spells them
+#'   (prefix included for a dotted context); empty when the context is one this
+#'   cannot answer.
+case_blind_extras <- function(token, comps, line, start, quoted) {
+  if (isTRUE(quoted)) return(character(0))
+  if (!is.character(token) || length(token) != 1L || is.na(token)) return(character(0))
+  # A prefix is safe to splice back only because `is_completion_name` vets the
+  # head; the one regex metacharacter either half can carry is then the dot.
+  starts_with <- function(pool, tail) {
+    if (!length(pool)) return(character(0))
+    pattern <- paste0("^", gsub(".", "\\.", tail, fixed = TRUE))
+    pool[grepl(pattern, pool, ignore.case = TRUE)]
+  }
+  # `x$al` / `obj@sl` / `pkg::na` — R hands the whole thing over as one token.
+  dotted <- regmatches(token, regexec("^(.*?)(\\$|@|:::?)([^$@:]*)$", token))[[1L]]
+  if (length(dotted) == 4L) {
+    head <- dotted[[2L]]; sep <- dotted[[3L]]; tail <- dotted[[4L]]
+    if (!is_completion_name(head)) return(character(0))
+    pool <- if (sep %in% c("::", ":::")) {
+      if (head %in% loadedNamespaces())
+        tryCatch(ls(asNamespace(head)), error = function(...) character(0))
+      else character(0)
+    } else {
+      obj <- tryCatch(get0(head, envir = globalenv()), error = function(...) NULL)
+      if (is.null(obj)) character(0)
+      else if (identical(sep, "@")) tryCatch(methods::slotNames(obj), error = function(...) character(0))
+      else if (is.environment(obj)) tryCatch(ls(obj), error = function(...) character(0))
+      else tryCatch(names(obj), error = function(...) character(0))
+    }
+    matched <- starts_with(pool, tail)
+    # `paste0("x", "$", character(0))` is "x$", not nothing — paste recycles a
+    # zero-length argument as "". Without this the empty answer for an object
+    # that does not exist came back as a completion to the bare prefix.
+    if (!length(matched)) return(character(0))
+    hits <- paste0(head, sep, matched)
+    return(setdiff(hits, c(comps, sub("\\($", "", comps))))
+  }
+  if (!is_completion_name(token)) return(character(0))
+  # A bare tail sitting right after a separator is a shape this cannot place —
+  # the head is not in the token, so refuse rather than sweep in globals that
+  # could not be used there.
+  before <- if (start > 1L) substr(line, start - 1L, start - 1L) else ""
+  if (before %in% c("$", "@", ":")) return(character(0))
+  names <- unique(unlist(lapply(search(), function(e)
+    tryCatch(ls(e), error = function(...) character(0)))))
+  # Drop what R already offered, in either of the two spellings it ships
+  # (`name` and `name(` for a function).
+  setdiff(starts_with(names, token), c(comps, sub("\\($", "", comps)))
+}
+
 #' A bare R name, or `pkg::name` — the only shape a completion context may
 #' name. Anything else (a call, a subset, an expression) is refused, because
 #' these names are looked up, and a lookup must never become an evaluation.
@@ -1110,6 +1507,57 @@ completion_columns <- function(data, max_items = MAX_COMPLETIONS) {
   lapply(cols, function(nm) list(value = nm, type = class(df[[nm]])[1L]))
 }
 
+#' A progress callback for keep_save()/keep_resume() that emits id-less
+#' `keep_progress` frames — the supervisor broadcasts an id-less frame to every
+#' page, which is what lets the page that asked AND a page that follows a
+#' handoff both draw it. Throttled to four a second; the last one always goes.
+#' @param phase "save" or "restore".
+#' @return function(done, total, bytes, name).
+keep_progress_emitter <- function(phase) {
+  last <- 0
+  function(done, total, bytes = 0, name = "") {
+    now <- as.numeric(Sys.time())
+    if (done < total && now - last < 0.25) return(invisible(NULL))
+    last <<- now
+    emit(list(type = "keep_progress", phase = phase, done = done, total = total,
+              bytes = as.numeric(bytes %||% 0), name = as.character(name)[1L]))
+  }
+}
+
+#' "Restart, keep variables", step one: save the global environment
+#' (spike/workspace-keep.R). No deadline — Stop (the supervisor's
+#' suspend_cancel) interrupts it, and the partial copy is removed.
+#' @param id Request id.
+#' @return Invisibly NULL. Emits one `suspend` frame: token, saved, bytes,
+#'   skipped — or cancelled, or error.
+emit_suspend <- function(id) {
+  out <- tryCatch(keep_save(globalenv(), progress = keep_progress_emitter("save")),
+                  error = function(e) list(error = conditionMessage(e)),
+                  interrupt = function(i) list(cancelled = TRUE))
+  emit(c(list(type = "suspend", id = id), out))
+}
+
+#' "Restart, keep variables", step two, in the NEW worker: load the kept
+#' objects back and restore the working directory. Asked by the supervisor
+#' only, never by a page (it is not in FORWARDED), with a token the save minted.
+#' @param id Request id.
+#' @param token The kept workspace's token.
+#' @return Invisibly NULL. Emits one `resume` frame: restored, failed, skipped,
+#'   cwd — or error.
+emit_resume <- function(id, token) {
+  out <- tryCatch(keep_resume(token, globalenv(), progress = keep_progress_emitter("restore")),
+                  error = function(e) list(error = conditionMessage(e)),
+                  interrupt = function(i) list(error = "The restore was interrupted."))
+  # The directory R was in comes back too — unless it is gone (the old R's
+  # tempdir() dies with the old R), which the report then says in words.
+  if (is.character(out$wd) && nzchar(out$wd)) {
+    moved <- dir.exists(out$wd) && !inherits(try(setwd(out$wd), silent = TRUE), "try-error")
+    if (!moved) out$wd_missing <- out$wd
+  }
+  out$wd <- NULL
+  emit(c(list(type = "resume", id = id, cwd = getwd()), out))
+}
+
 #' Coerce a wire-supplied count, falling back rather than erroring: a malformed
 #' offset from a client must degrade to the default, not kill the pane.
 #'
@@ -1397,14 +1845,14 @@ emit_sniff <- function(id, path = NULL, opts = NULL) {
     if (!file.exists(p) || dir.exists(p)) return(fail("not a readable file"))
   }
   if (!exists("sniff_file", inherits = TRUE)) {
-    return(fail("this kernel is too old for the import wizard - restart CarmaR"))
+    return(fail("this kernel is too old for the import wizard - restart Beatrina"))
   }
   res <- tryCatch(
     sniff_file(p, if (is.list(opts)) opts else list()),
-    error = function(e) structure(class = "carmar_fail", list(msg = conditionMessage(e))),
-    interrupt = function(i) structure(class = "carmar_fail", list(msg = "interrupted"))
+    error = function(e) structure(class = "beatrina_fail", list(msg = conditionMessage(e))),
+    interrupt = function(i) structure(class = "beatrina_fail", list(msg = "interrupted"))
   )
-  if (inherits(res, "carmar_fail")) return(fail(res$msg))
+  if (inherits(res, "beatrina_fail")) return(fail(res$msg))
   emit(c(list(type = "sniff", id = id), res))
 }
 
@@ -1443,10 +1891,10 @@ emit_import <- function(id, path = NULL, name = NULL) {
   }
   obj <- tryCatch(
     if (requireNamespace("rio", quietly = TRUE)) rio::import(p) else read_by_ext(p),
-    error = function(e) structure(class = "carmar_fail", list(msg = conditionMessage(e))),
-    interrupt = function(i) structure(class = "carmar_fail", list(msg = "interrupted"))
+    error = function(e) structure(class = "beatrina_fail", list(msg = conditionMessage(e))),
+    interrupt = function(i) structure(class = "beatrina_fail", list(msg = "interrupted"))
   )
-  if (inherits(obj, "carmar_fail")) return(fail(obj$msg))
+  if (inherits(obj, "beatrina_fail")) return(fail(obj$msg))
   nm <- if (is.character(name) && length(name) == 1L && nzchar(name)) name
         else make.names(tools::file_path_sans_ext(basename(p)))
   assign(nm, obj, envir = globalenv())
@@ -1709,14 +2157,14 @@ emit_package_action <- function(id, action, name, lib = NULL) {
 
 #' Project and renv state, without paths or lockfile contents on the wire.
 emit_project_status <- function(id) {
-  result <- tryCatch(carmar_project_status(), error = function(e)
+  result <- tryCatch(beatrina_project_status(), error = function(e)
     list(error = conditionMessage(e)))
   emit(c(list(type = "project_status", id = id), result))
 }
 
 #' One explicit, visible environment action: install renv or restore its lock.
 emit_project_action <- function(id, action) {
-  result <- tryCatch(carmar_project_action(action), error = function(e)
+  result <- tryCatch(beatrina_project_action(action), error = function(e)
     list(ok = FALSE, error = conditionMessage(e)))
   emit(c(list(type = "project_action", id = id, action = action), result))
 }
@@ -1777,7 +2225,7 @@ emit_help <- function(id, topic) {
     } else {
       txt <- paste(utils::capture.output(base::print(paths)), collapse = "\n")
       if (!nzchar(trimws(txt))) NULL
-      else paste0("<pre class=\"carmar-help-text\">",
+      else paste0("<pre class=\"beatrina-help-text\">",
                   gsub("<", "&lt;", gsub("&", "&amp;", txt), fixed = TRUE), "</pre>")
     }
   }, error = function(e) NULL)
@@ -1927,7 +2375,7 @@ emit_wd <- function(id, path = NULL) {
 
 # The file system lives in fileio.R (shared with the supervisor). Each op is
 # `emit(fs_x(...))`: fileio.R returns the frame, this process sends it. The
-# worker still answers them when the supervisor forwards (CARMAR_FILE_OPS=worker,
+# worker still answers them when the supervisor forwards (BEATRINA_FILE_OPS=worker,
 # the transition flag), so nothing here may diverge from fileio.R.
 emit_files <- function(id, path = NULL, all = FALSE) emit(fs_files(id, path, all, wd = getwd()))
 emit_mkdir <- function(id, path = NULL) emit(fs_mkdir(id, path, wd = getwd()))
@@ -1940,7 +2388,7 @@ emit_writefile <- function(id, path = NULL, text = "", expected = NULL, encoding
   emit(fs_writefile(id, path, text, expected, encoding, base64, wd = getwd()))
 emit_writefiles_atomic <- function(id, files = NULL) emit(fs_writefiles_atomic(id, files, wd = getwd()))
 
-#' Check whether CarmaR's current R session is usable without collecting user
+#' Check whether Beatrina's current R session is usable without collecting user
 #' material.
 #'
 #' This reply is deliberately a FACT ALLOW-LIST. It never contains getwd(),
@@ -1954,12 +2402,12 @@ emit_writefiles_atomic <- function(id, files = NULL) emit(fs_writefiles_atomic(i
 emit_doctor <- function(id) {
   can_create_in <- function(dir) {
     if (!is.character(dir) || length(dir) != 1L || !dir.exists(dir)) return(FALSE)
-    probe <- tempfile(".carmar-doctor-", tmpdir = dir)
+    probe <- tempfile(".beatrina-doctor-", tmpdir = dir)
     on.exit(unlink(probe, force = TRUE), add = TRUE)
     isTRUE(tryCatch(file.create(probe, showWarnings = FALSE), error = function(e) FALSE))
   }
 
-  q_configured <- trimws(Sys.getenv("CARMAR_QUARTO", ""))
+  q_configured <- trimws(Sys.getenv("BEATRINA_QUARTO", ""))
   q_path <- if (nzchar(q_configured)) q_configured else unname(Sys.which("quarto"))
   q_available <- is.character(q_path) && length(q_path) == 1L && nzchar(q_path) && file.exists(q_path)
   q_version <- ""
@@ -2005,16 +2453,26 @@ emit_doctor <- function(id) {
       version = q_version
     ),
     required_packages = required,
-    deployment = list(
-      loopback = Sys.getenv("CARMAR_BIND", "127.0.0.1") %in% c("", "127.0.0.1", "localhost", "::1"),
-      confinement = nzchar(Sys.getenv("CARMAR_ROOT", "")),
-      audit = nzchar(Sys.getenv("CARMAR_LOG", "")),
-      ai_local_only = identical(Sys.getenv("CARMAR_AI_LOCAL_ONLY", ""), "1"),
-      ai_policy = nzchar(Sys.getenv("CARMAR_AI_POLICY", "")) || nzchar(Sys.getenv("CARMAR_AI_PROVIDERS", "")),
-      origin_required = !identical(Sys.getenv("CARMAR_REQUIRE_ORIGIN", "1"), "0"),
-      trusted_proxy = identical(Sys.getenv("CARMAR_TRUST_PROXY", ""), "1"),
-      unauthenticated = identical(Sys.getenv("CARMAR_ALLOW_UNAUTHENTICATED", ""), "1")
-    ),
+    # ASKED, not re-derived. Doctor's own copy of the posture rule had drifted:
+    # `!identical(Sys.getenv("BEATRINA_REQUIRE_ORIGIN", "1"), "0")` is TRUE
+    # whenever the variable is unset, while the real rule (deployment.R, and
+    # host/deployment.mjs, which agree) is `== "1" || !loopback` — FALSE on a
+    # default desktop session. So Doctor reported an origin check the host was
+    # not enforcing, and lib/doctor.js computes its managed-remote verdict from
+    # exactly these fields. The loopback list had drifted too, missing "[::1]".
+    deployment = local({
+      d <- beatrina_deployment(as.integer(Sys.getenv("BEATRINA_PORT", "0")))
+      list(
+        loopback = isTRUE(d$loopback),
+        confinement = nzchar(Sys.getenv("BEATRINA_ROOT", "")),
+        audit = nzchar(Sys.getenv("BEATRINA_LOG", "")),
+        ai_local_only = identical(Sys.getenv("BEATRINA_AI_LOCAL_ONLY", ""), "1"),
+        ai_policy = nzchar(Sys.getenv("BEATRINA_AI_POLICY", "")) || nzchar(Sys.getenv("BEATRINA_AI_PROVIDERS", "")),
+        origin_required = isTRUE(d$require_origin),
+        trusted_proxy = isTRUE(d$trust_proxy),
+        unauthenticated = isTRUE(d$allow_unauthenticated)
+      )
+    }),
     proxy = list(
       http = nzchar(Sys.getenv("HTTP_PROXY", "")) || nzchar(Sys.getenv("http_proxy", "")),
       https = nzchar(Sys.getenv("HTTPS_PROXY", "")) || nzchar(Sys.getenv("https_proxy", "")),
@@ -2033,9 +2491,9 @@ emit_doctor <- function(id) {
 #' @param seq Index of the top-level expression, to keep filenames unique.
 #' @return Invisibly NULL.
 open_plot_device <- function(dir, seq, dims = NULL) {
-  width  <- if (!is.null(dims$width))  dims$width  else PLOT_WIDTH
-  height <- if (!is.null(dims$height)) dims$height else PLOT_HEIGHT
-  res    <- if (!is.null(dims$res))    dims$res    else PLOT_RES
+  width  <- dim_or(dims$width,  "width")
+  height <- dim_or(dims$height, "height")
+  res    <- dim_or(dims$res,    "res")
   if (plot_is_svg(dims)) {
     # A vector device is sized in INCHES and has no resolution at all — which
     # is the whole point: its cost does not grow with dpi. The client sends
@@ -2088,9 +2546,9 @@ emit_plot_frame <- function(id, f, dims = NULL) {
   # older client would have rendered nothing at all.
   svg <- grepl("\\.svg$", f)
   emit(list(type = "plot", id = id, mime = if (svg) "image/svg+xml" else "image/png",
-            width  = if (!is.null(dims$width))  dims$width  else PLOT_WIDTH,
-            height = if (!is.null(dims$height)) dims$height else PLOT_HEIGHT,
-            res    = if (!is.null(dims$res))    dims$res    else PLOT_RES,
+            width  = dim_or(dims$width,  "width"),
+            height = dim_or(dims$height, "height"),
+            res    = dim_or(dims$res,    "res"),
             data = jsonlite::base64_enc(readBin(f, "raw", file.info(f)$size))))
   invisible(NULL)
 }
@@ -2121,9 +2579,9 @@ emit_plot_frame <- function(id, f, dims = NULL) {
 .blank_png_cache <- new.env(parent = emptyenv())
 is_blank_plot <- function(f, dims) {
   if (!identical(RASTER_DEVICE, "ragg")) return(FALSE)
-  w <- if (!is.null(dims$width))  dims$width  else PLOT_WIDTH
-  h <- if (!is.null(dims$height)) dims$height else PLOT_HEIGHT
-  r <- if (!is.null(dims$res))    dims$res    else PLOT_RES
+  w <- dim_or(dims$width,  "width")
+  h <- dim_or(dims$height, "height")
+  r <- dim_or(dims$res,    "res")
   key <- paste(w, h, r, sep = "x")
   blank <- .blank_png_cache[[key]]
   if (is.null(blank)) {
@@ -2315,6 +2773,16 @@ emit_dataframe <- function(id, df, source = NULL) {
     # jsonlite drops a NULL, so a frame with no name is byte-identical to what
     # this emitted before the field existed.
     source = source,
+    # How many significant digits this document asked its numbers to be SHOWN
+    # with. The values on the wire stay full precision — the page exports and
+    # copies from them, and rounding here would write 0 for 1.2e-5 the way
+    # jsonlite's own digits = 4 once did. So `options(digits = 3)` becomes a
+    # display instruction the table renderer honours, instead of a call that
+    # looks like configuration and changes nothing: auto-printing a data.frame
+    # never passes through print.data.frame, which is what would have applied
+    # it. NULL (dropped by jsonlite) whenever the document left R's default of
+    # 7 alone, so an untouched notebook's frames are unchanged.
+    digits = display_digits(),
     rows = head_df
   ))
   invisible(NULL)
@@ -2383,7 +2851,7 @@ widget_standalone_html <- function(w, fit = FALSE) {
     "<style>html,body{margin:0;padding:0;height:100%;}</style>"
   }
   fit_js <- if (fit) paste0(
-    "<script>(function(){var r=function(){try{parent.postMessage({carmarHtmlHeight:",
+    "<script>(function(){var r=function(){try{parent.postMessage({beatrinaHtmlHeight:",
     "Math.ceil(document.documentElement.getBoundingClientRect().height)},'*')}catch(e){}};",
     "window.addEventListener('load',r);if(window.ResizeObserver){new ResizeObserver(r)",
     ".observe(document.documentElement)}setTimeout(r,0);setTimeout(r,250)})()</script>") else ""
@@ -2411,7 +2879,7 @@ widget_standalone_html <- function(w, fit = FALSE) {
 #'   when `v` is not HTML.
 rich_html_of <- function(v) {
   if (inherits(v, "htmlwidget")) return(list(x = v, kind = "widget"))
-  if (inherits(v, "carmar_html")) return(list(x = htmltools::HTML(unclass(v)), kind = "html"))
+  if (inherits(v, "beatrina_html")) return(list(x = htmltools::HTML(unclass(v)), kind = "html"))
   if (inherits(v, c("shiny.tag", "shiny.tag.list", "html"))) return(list(x = v, kind = "html"))
   if (inherits(v, "knit_asis")) return(list(x = htmltools::HTML(paste(as.character(v), collapse = "\n")), kind = "html"))
   if (inherits(v, "knitr_kable") && identical(attr(v, "format"), "html")) {
@@ -2593,7 +3061,7 @@ apply_fn_breaks <- function() {
           suppressMessages(trace(
             h$name,
             tracer = bquote({
-              .carmar_debug_entered(.(file), .(line), "breakpoint")
+              .beatrina_debug_entered(.(file), .(line), "breakpoint")
               browser()
             }),
             at = h$at, where = h$env, print = FALSE))
@@ -2657,7 +3125,7 @@ debug_stack <- function(calls, frames, max_frames = 40L) {
   # frame's environment holds the TRACER EXPRESSION as an unforced promise —
   # mget() forces what it reads, so describing that frame re-entered the
   # tracer recursively (a second paused frame, a browser "Called from: mget").
-  ours <- "^(\\.carmar_debug_entered|\\.carmar_debug_where|\\.doTrace|browser\\(|eval\\(expr|eval\\.parent|Reduce\\(|\\{)"
+  ours <- "^(\\.beatrina_debug_entered|\\.beatrina_debug_where|\\.doTrace|browser\\(|eval\\(expr|eval\\.parent|Reduce\\(|\\{)"
   while (to >= from && grepl(ours, texts[[to]])) to <- to - 1L
   if (to < from) return(list())
   idx <- seq.int(from, to)
@@ -2684,7 +3152,7 @@ debug_stack <- function(calls, frames, max_frames = 40L) {
 #'
 #'   THE HARNESS IS TRIMMED. The bottom frames are this file's own
 #'   (`run_cell`, `withCallingHandlers`, the `lapply` over expressions) and
-#'   showing them teaches the reader that their error came from CarmaR. Frames
+#'   showing them teaches the reader that their error came from Beatrina. Frames
 #'   are dropped up to and including the last `eval(e, globalenv())`, which is
 #'   the boundary between our code and theirs.
 #'
@@ -2748,7 +3216,7 @@ capture_trace <- function(max_frames = 40L) {
 #' The narrow message fallback covers older R releases.  In both cases the
 #' allow-list is deliberately the same one used by `package_action`, so an
 #' error message can never become code or an arbitrary install target.
-carmar_missing_package <- function(error) {
+beatrina_missing_package <- function(error) {
   valid <- function(value) {
     is.character(value) && length(value) == 1L && !is.na(value) &&
       grepl("^[A-Za-z][A-Za-z0-9.]*$", value)
@@ -2776,12 +3244,12 @@ run_cell <- function(id, source, dims = NULL, srcname = NULL) {
   # one established outside the cell's own tryCatch, so the cell's exiting
   # handlers, being inner, are still the ones that take a real Stop.
   withCallingHandlers(run_cell_impl(id, source, dims, srcname),
-                      interrupt = function(i) if (carmar_interrupt_is_stray(id)) carmar_resume_if_stray(i))
+                      interrupt = function(i) if (beatrina_interrupt_is_stray(id)) beatrina_resume_if_stray(i))
 }
 run_cell_impl <- function(id, source, dims = NULL, srcname = NULL) {
   stopifnot(is.character(source), length(source) == 1L)
   # First: a signal that arrived between commands must not end THIS cell.
-  carmar_drain_stray_interrupt(id)
+  beatrina_drain_stray_interrupt(id)
   # The srcname is the chunk's identity in the debugger: functions defined
   # here carry it in their srcrefs, which is what lets findLineNum resolve
   # "chunk:<id>#line" to a function and a step. Wire-supplied; anything not a
@@ -2818,7 +3286,7 @@ run_cell_impl <- function(id, source, dims = NULL, srcname = NULL) {
   status <- "ok"
   detail <- NULL
   missing_package <- NULL
-  plot_dir <- tempfile("carmar-plots-")
+  plot_dir <- tempfile("beatrina-plots-")
   dir.create(plot_dir)
   seen <- character(0)
   # Asked for vector, cannot give it: SAY SO. Falling back to a raster the
@@ -2829,7 +3297,7 @@ run_cell_impl <- function(id, source, dims = NULL, srcname = NULL) {
     emit(list(type = "stream", id = id, kind = "warning",
               text = paste("Vector output is not available in this R —",
                            "install the svglite package (or XQuartz, for Cairo)",
-                           "and restart. Drawing at", dims$res %||% PLOT_RES,
+                           "and restart. Drawing at", dim_or(dims$res, "res"),
                            "dpi instead.\n")))
   }
 
@@ -2876,9 +3344,9 @@ run_cell_impl <- function(id, source, dims = NULL, srcname = NULL) {
           } else {
             NA_integer_
           }
-          # Stop, read at the boundary (carmar_stop_requested): the line after a
+          # Stop, read at the boundary (beatrina_stop_requested): the line after a
           # busy call that no signal could interrupt does not run.
-          carmar_stop_if_requested(id)
+          beatrina_stop_if_requested(id)
           # Where R is, for the page's progress bar (RStudio's green line
           # down the chunk): one frame per top-level expression, BEFORE it
           # runs, naming the lines it spans — so a 40-second model fit shows
@@ -2896,7 +3364,7 @@ run_cell_impl <- function(id, source, dims = NULL, srcname = NULL) {
           res <- if (!is.na(at_line) && at_line %in% bp_lines) {
             wrapped <- as.call(list(
               as.name("{"),
-              bquote(.carmar_debug_entered(.(srcname), .(at_line), "breakpoint")),
+              bquote(.beatrina_debug_entered(.(srcname), .(at_line), "breakpoint")),
               quote(browser()),
               e))
             withVisible(eval(wrapped, globalenv()))
@@ -2934,11 +3402,11 @@ run_cell_impl <- function(id, source, dims = NULL, srcname = NULL) {
           }
         }))
         # …and after the last expression: a Stop that arrived while it ran ends the cell interrupted.
-        carmar_stop_if_requested(id)
+        beatrina_stop_if_requested(id)
       },
       # The stray-signal rule (see run_cell), established INSIDE the cell's own
       # tryCatch so it is asked before the exiting handler below can unwind.
-      interrupt = function(i) if (carmar_interrupt_is_stray(id)) carmar_resume_if_stray(i),
+      interrupt = function(i) if (beatrina_interrupt_is_stray(id)) beatrina_resume_if_stray(i),
       warning = function(w) {
         emit(list(type = "stream", id = id, kind = "warning",
                   text = conditionMessage(w)))
@@ -2961,7 +3429,7 @@ run_cell_impl <- function(id, source, dims = NULL, srcname = NULL) {
     # dispatch loop and zombie the worker; invoking this restart instead
     # unwinds the browser and the rest of the cell, lands here, and the cell
     # reports itself stopped like any interrupt.
-    carmar_abort_cell = function() {
+    beatrina_abort_cell = function() {
       status <<- "interrupted"
       detail <<- "Stopped from the debugger"
     }
@@ -2969,7 +3437,7 @@ run_cell_impl <- function(id, source, dims = NULL, srcname = NULL) {
     error = function(e) {
       status <<- "error"
       detail <<- conditionMessage(e)
-      missing_package <<- carmar_missing_package(e)
+      missing_package <<- beatrina_missing_package(e)
       # A parse error has no stack and no expression index; its position comes
       # from the message instead, exactly as the analyzer reads it.
       emit(list(type = "traceback", id = id,
@@ -3008,13 +3476,13 @@ run_cell_impl <- function(id, source, dims = NULL, srcname = NULL) {
 #' on to the next line unless a second signal happens to land in the instant
 #' between system() returning and that line starting — on Linux it never did
 #' (`beatrina check`, 2026-09-16). So the supervisor also writes a flag file,
-#' `stop-<id>` in CARMAR_STOP_DIR, and the cell reads it at every top-level
+#' `stop-<id>` in BEATRINA_STOP_DIR, and the cell reads it at every top-level
 #' expression boundary. The flag is removed when read; no directory, no flag.
 #'
 #' @param id The wire id of the running cell.
 #' @return TRUE when a stop was requested (and the flag consumed), else FALSE.
-carmar_stop_requested <- function(id) {
-  dir <- Sys.getenv("CARMAR_STOP_DIR", "")
+beatrina_stop_requested <- function(id) {
+  dir <- Sys.getenv("BEATRINA_STOP_DIR", "")
   if (!nzchar(dir) || !is.character(id) || length(id) != 1L || is.na(id)) return(FALSE)
   flag <- file.path(dir, paste0("stop-", id))
   if (!file.exists(flag)) return(FALSE)
@@ -3026,8 +3494,8 @@ carmar_stop_requested <- function(id) {
 #' through the same `interrupt` handler a signal reaches.
 #' @param id The wire id of the running cell.
 #' @return NULL, invisibly, when no stop was requested.
-carmar_stop_if_requested <- function(id) {
-  if (carmar_stop_requested(id)) {
+beatrina_stop_if_requested <- function(id) {
+  if (beatrina_stop_requested(id)) {
     signalCondition(structure(class = c("interrupt", "condition"),
                               list(message = "Execution interrupted", call = NULL)))
   }
@@ -3037,23 +3505,23 @@ carmar_stop_if_requested <- function(id) {
 #' Is a stop flag for run `id` on disk? Read without consuming it.
 #' @param id The wire id of the running cell.
 #' @return TRUE when the supervisor has asked this run to stop.
-carmar_stop_pending <- function(id) {
-  dir <- Sys.getenv("CARMAR_STOP_DIR", "")
+beatrina_stop_pending <- function(id) {
+  dir <- Sys.getenv("BEATRINA_STOP_DIR", "")
   if (!nzchar(dir) || !is.character(id) || length(id) != 1L || is.na(id)) return(FALSE)
   file.exists(file.path(dir, paste0("stop-", id)))
 }
 
 #' Is an interrupt raised inside run `id` NOT this run's Stop?
 #'
-#' Under a supervisor that writes stop flags (CARMAR_STOP_DIR set), every real
+#' Under a supervisor that writes stop flags (BEATRINA_STOP_DIR set), every real
 #' Stop writes `stop-<id>` BEFORE it sends a signal, so a signal-borne interrupt
 #' with no flag for this run was sent for another — one that has already ended.
 #' Without a flag folder (an older supervisor) nothing can be told apart, and
 #' every interrupt is this run's, as it always was.
 #' @param id The wire id of the running cell.
 #' @return TRUE only when a flag folder exists and holds no flag for `id`.
-carmar_interrupt_is_stray <- function(id) {
-  nzchar(Sys.getenv("CARMAR_STOP_DIR", "")) && !carmar_stop_pending(id)
+beatrina_interrupt_is_stray <- function(id) {
+  nzchar(Sys.getenv("BEATRINA_STOP_DIR", "")) && !beatrina_stop_pending(id)
 }
 
 #' Resume from an interrupt that belongs to a run that has already ended.
@@ -3081,7 +3549,7 @@ carmar_interrupt_is_stray <- function(id) {
 #'
 #' @param i The interrupt condition.
 #' @return Does not return when a `resume` restart exists; NULL otherwise.
-carmar_resume_if_stray <- function(i) {
+beatrina_resume_if_stray <- function(i) {
   if (!is.null(findRestart("resume"))) invokeRestart("resume")
   invisible(NULL)
 }
@@ -3102,13 +3570,13 @@ carmar_resume_if_stray <- function(i) {
 #' has nothing worth resuming anyway.
 #' @param id The wire id of the cell about to run.
 #' @return NULL, invisibly.
-carmar_drain_stray_interrupt <- function(id) {
+beatrina_drain_stray_interrupt <- function(id) {
   raised <- tryCatch({
     n <- 0L
     for (k in seq_len(1200L)) n <- n + 1L
     FALSE
   }, interrupt = function(i) TRUE)
-  if (isTRUE(raised) && carmar_stop_pending(id)) {
+  if (isTRUE(raised) && beatrina_stop_pending(id)) {
     signalCondition(structure(class = c("interrupt", "condition"),
                               list(message = "Execution interrupted", call = NULL)))
   }
@@ -3125,12 +3593,12 @@ carmar_drain_stray_interrupt <- function(id) {
 #' whole worker down with it, ending the session.
 #' @param line One line as read_command returned it.
 #' @return The command list, or NULL.
-carmar_parse_command <- function(line) {
+beatrina_parse_command <- function(line) {
   withCallingHandlers({
     cmd <- tryCatch(jsonlite::fromJSON(line), error = function(e) NULL)
     if (!is.list(cmd) || !is.character(cmd$type) || length(cmd$type) != 1L) return(NULL)
     resolve_cmdfile(cmd)
-  }, interrupt = carmar_resume_if_stray)
+  }, interrupt = beatrina_resume_if_stray)
 }
 
 #' Read one command line from stdin, tolerating an interrupt that lands while
@@ -3157,14 +3625,14 @@ read_command <- function(con) {
   # half-way through when its interrupt fired — the supervisor's `ack` deadline
   # (host/worker-plane.mjs) is the answer to that one.
   line <- tryCatch(
-    withCallingHandlers(readLines(con, n = 1L, warn = FALSE), interrupt = carmar_resume_if_stray),
+    withCallingHandlers(readLines(con, n = 1L, warn = FALSE), interrupt = beatrina_resume_if_stray),
     interrupt = function(i) NA_character_
   )
   # Strip the supervisor's comment tag; a line without it (older supervisor,
   # test harness writing bare NDJSON) passes through untouched.
   if (length(line) == 1L && !is.na(line) && nzchar(CMD_PREFIX) &&
       startsWith(line, CMD_PREFIX)) {
-    line <- substring(line, nchar(CMD_PREFIX) + 1L)
+    line <- substring(line, nchar(CMD_PREFIX) + 1L, nchar(line))
   }
   line
 }
@@ -3197,13 +3665,13 @@ resolve_cmdfile <- function(cmd) {
 # `View(df)` must do what it does in RStudio. Overriding it on the SEARCH PATH
 # rather than in globalenv keeps the user's environment clean (the Environment
 # pane shows their objects, not ours) while still shadowing utils::View.
-carmar_tools <- new.env()
+beatrina_tools <- new.env()
 # Debug hooks live on the SEARCH PATH, not in this file's private scope, for a
 # reason of visibility: a trace() tracer evaluates in the traced function's
 # frame, whose lexical chain ends at globalenv() and then the search path —
 # the worker's private local() is not on it. Same for expressions typed at a
-# Browse prompt, which is how .carmar_debug_where is called.
-carmar_tools$.carmar_debug_entered <- function(file, line, reason = "breakpoint") {
+# Browse prompt, which is how .beatrina_debug_where is called.
+beatrina_tools$.beatrina_debug_entered <- function(file, line, reason = "breakpoint") {
   # Snapshot FIRST, then drop this function's own frame. Taking sys.calls()
   # lazily inside the emit arguments would extend the stack through
   # debug_stack/frame_vars themselves, defeat the machinery trimming, and put
@@ -3217,7 +3685,7 @@ carmar_tools$.carmar_debug_entered <- function(file, line, reason = "breakpoint"
             locals = frame_vars(parent.frame())))
   invisible(NULL)
 }
-carmar_tools$.carmar_debug_where <- function() {
+beatrina_tools$.beatrina_debug_where <- function() {
   calls <- sys.calls()
   frames <- sys.frames()
   n <- length(calls)
@@ -3232,7 +3700,7 @@ carmar_tools$.carmar_debug_where <- function() {
 #' @param x HTML as a character vector (joined with newlines) or any value
 #'   `rich_html_of()` understands.
 #' @return Invisibly `x`.
-carmar_tools$display_html <- function(x) {
+beatrina_tools$display_html <- function(x) {
   rich <- if (is.character(x)) {
     list(x = htmltools::HTML(paste(x, collapse = "\n")), kind = "html")
   } else {
@@ -3247,16 +3715,16 @@ carmar_tools$display_html <- function(x) {
   emit_rich(RUN_STATE$id, rich)
   invisible(x)
 }
-carmar_tools$View <- function(x, title = NULL) {
+beatrina_tools$View <- function(x, title = NULL) {
   # The LABEL is what the user typed; the FETCH NAME is where the viewer reads
-  # it from. Conflating them titled `View(mtcars)` as `.carmar_view`, because
+  # it from. Conflating them titled `View(mtcars)` as `.beatrina_view`, because
   # mtcars lives in the datasets package rather than the global environment.
   label <- if (!is.null(title)) title else deparse(substitute(x))
-  assign(".carmar_view", x, envir = globalenv())
-  emit_view("view-request", ".carmar_view", label = label)
+  assign(".beatrina_view", x, envir = globalenv())
+  emit_view("view-request", ".beatrina_view", label = label)
   invisible(NULL)
 }
-attach(carmar_tools, name = "carmar:tools", warn.conflicts = FALSE)
+attach(beatrina_tools, name = "beatrina:tools", warn.conflicts = FALSE)
 
 # Interactive mode reads the console; batch mode opens fd 0 as a connection.
 # The console read is what lets browser() prompts and the dispatch loop share
@@ -3277,7 +3745,7 @@ if (identical(WORKER_MODE, "interactive")) {
 }
 
 # macOS 26 registers command-line R as a foreground application after Aqua or
-# AppKit initializes, even when the process was launched by CarmaR's UIElement
+# AppKit initializes, even when the process was launched by Beatrina's UIElement
 # helper. The supervisor loads the packaged marker before sourcing this file
 # (preventing an initial Dock flash); repeat the transition here, after all
 # worker initialization and immediately before `ready`, so any framework that
@@ -3286,11 +3754,11 @@ if (identical(WORKER_MODE, "interactive")) {
 # or restarted worker reaches this point automatically.
 # OPT-IN — see macos_background_boot in kernel.R. The background transform hides
 # the Dock icon but wedges R's console read on a GUI-launched macOS 26 worker,
-# so it is off unless CARMAR_MARK_BACKGROUND=1 is set.
+# so it is off unless BEATRINA_MARK_BACKGROUND=1 is set.
 if (identical(unname(Sys.info()[["sysname"]]), "Darwin") &&
-    identical(Sys.getenv("CARMAR_MARK_BACKGROUND", "0"), "1") &&
-    is.loaded("carmar_mark_background")) {
-  invisible(try(.C("carmar_mark_background", result = integer(1)), silent = TRUE))
+    identical(Sys.getenv("BEATRINA_MARK_BACKGROUND", "0"), "1") &&
+    is.loaded("beatrina_mark_background")) {
+  invisible(try(.C("beatrina_mark_background", result = integer(1)), silent = TRUE))
 }
 
 # The ready frame says WHICH R this is. A session that silently uses the wrong
@@ -3308,13 +3776,13 @@ if (identical(unname(Sys.info()[["sysname"]]), "Darwin") &&
 # Advertising the vocabulary lets a client know instantly. Kernels older than
 # this simply omit the field, and clients fall back to probing.
 #
-# A fresh worker is a fresh R, always. Until 7.59 a "Restart into" handoff
-# asked this worker to `save.image()` and the successor's first worker loaded
-# it back (`workspace_save` / CARMAR_RESTORE_WORKSPACE / a `restored` field
-# here). That is gone by decision — the owner's "restore work has been
-# abysmally bad and almost invariably a failure" — and the rule is: a session
-# is a process you can see; open → R starts, close → R stops, restart → a
-# fresh R. The saved document is the record. Do not add a restore path back.
+# A worker starts as a fresh R. Until 7.59 a "Restart into" handoff asked this
+# worker to `save.image()` and the successor loaded one file back inside a
+# deadline; that failed on large sessions and was removed ("restore work has
+# been abysmally bad"). Since 0.8.5 "Restart, keep variables" is an explicit
+# choice built differently (spike/workspace-keep.R): the page asks `suspend`
+# with no deadline, the new worker is asked `resume` by the supervisor after
+# `ready`, one file per object, and the report names what did not come back.
 emit(list(type = "ready", pid = Sys.getpid(), r = R.version.string, cwd = getwd(),
           # I(): a single library path must still ship as an array.
           home = R.home(), libs = I(.libPaths()),
@@ -3328,8 +3796,9 @@ emit(list(type = "ready", pid = Sys.getpid(), r = R.version.string, cwd = getwd(
                          "project_status", "project_action",
                          "help", "hover", "wd", "files", "sniff",
                          "import", "readfile", "writefile", "writefiles_atomic", "view", "colstats",
+                         "column_values",
                          "mkdir", "renamepath", "deletepath", "copypath", "revealpath",
-                         "rm",
+                         "rm", "suspend",
                          if (identical(WORKER_MODE, "interactive")) "debug_breaks"))))
 # (No package count here on purpose: installed.packages() reads every
 # package's DESCRIPTION — 0.3–1.8 s on a big library — and no client ever
@@ -3342,7 +3811,7 @@ emit(list(type = "ready", pid = Sys.getpid(), r = R.version.string, cwd = getwd(
 # parser's (a late signal, resumed), the dispatcher's (Stop as the cell's own
 # outcome) — and the loop around them has the last word: an interrupt that
 # escapes an iteration ends that iteration, never the loop, and one that escapes
-# the loop itself re-enters it through the `carmar_serve_again` restart from a
+# the loop itself re-enters it through the `beatrina_serve_again` restart from a
 # global calling handler. Before 2026-09-16 the parse step had no handler at all,
 # and a late Stop signal raised there unwound the whole worker script into R's
 # top-level prompt — where the `options(error=)` guard ended the process, or,
@@ -3365,7 +3834,7 @@ emit(list(type = "ready", pid = Sys.getpid(), r = R.version.string, cwd = getwd(
 # view) catch it themselves, with meaning. The outer handler exists for the
 # narrow window where one lands outside those — an uncaught interrupt ends
 # the worker script, and the supervisor treats a dead worker as fatal.
-carmar_dispatch <- function(cmd) {
+beatrina_dispatch <- function(cmd) {
   if (identical(cmd$type, "exec")) {
     if (is.null(cmd$document)) run_cell(cmd$id, cmd$source, cmd$dims, cmd$srcname)
     else run_document_cell(cmd$id, cmd$source, cmd$document, cmd$dims, cmd$srcname)
@@ -3379,6 +3848,8 @@ carmar_dispatch <- function(cmd) {
   if (identical(cmd$type, "doctor"))   emit_doctor(cmd$id)
   if (identical(cmd$type, "complete")) emit_complete(cmd$id, cmd$line, cmd$cursor,
                                                      fn = cmd$fn, data = cmd$data)
+  if (identical(cmd$type, "suspend"))  emit_suspend(cmd$id)
+  if (identical(cmd$type, "resume"))   emit_resume(cmd$id, cmd$token)
   if (identical(cmd$type, "packages")) emit_packages(cmd$id, cmd$scope)
   if (identical(cmd$type, "package_action")) emit_package_action(cmd$id, cmd$action, cmd$name, cmd$lib)
   if (identical(cmd$type, "package_help")) emit_package_help(cmd$id, cmd$name)
@@ -3411,6 +3882,9 @@ carmar_dispatch <- function(cmd) {
   if (identical(cmd$type, "colstats")) emit_colstats(cmd$id, cmd$name, cmd$column,
                                                      query = cmd$query,
                                                      filters = cmd$filters)
+  if (identical(cmd$type, "column_values")) emit_column_values(cmd$id, cmd$name, cmd$column,
+                                                               query = cmd$query,
+                                                               filters = cmd$filters)
   if (identical(cmd$type, "rm"))       emit_rm(cmd$id, cmd$names)
   invisible(NULL)
 }
@@ -3424,7 +3898,7 @@ carmar_dispatch <- function(cmd) {
 # interrupts around the eval, but one landing in its epilogue (unlink,
 # flush, the emit itself) used to escape this loop, end the worker script,
 # and take the supervisor's event loop down with it.
-carmar_fail_frame <- function(cmd, text, outcome = "error") {
+beatrina_fail_frame <- function(cmd, text, outcome = "error") {
   id_ok <- is.character(cmd$id) && length(cmd$id) == 1L
   if (identical(cmd$type, "exec")) {
     if (id_ok) emit(list(type = "done", id = cmd$id, status = outcome,
@@ -3438,11 +3912,11 @@ carmar_fail_frame <- function(cmd, text, outcome = "error") {
 #' Serve one command. Returns "eof" when the supervisor has gone, "shutdown"
 #' when it said so, NULL after a command or a line that was not one.
 #' @param con The command connection (the console in interactive mode).
-carmar_serve_one <- function(con) {
+beatrina_serve_one <- function(con) {
   line <- read_command(con)
   if (length(line) == 0L) return("eof")                 # EOF: supervisor went away
   if (is.na(line) || !nzchar(trimws(line))) return(NULL)
-  cmd <- carmar_parse_command(line)
+  cmd <- beatrina_parse_command(line)
   if (is.null(cmd)) return(NULL)
   if (identical(cmd$type, "shutdown")) return("shutdown")
   # The acknowledgement: the supervisor wrote this command to an idle worker and
@@ -3453,10 +3927,10 @@ carmar_serve_one <- function(con) {
   # only wait forever — an exec has no deadline, by design. With it, a command
   # that is never acknowledged is failed with a sentence and the queue moves on.
   if (is.character(cmd$id) && length(cmd$id) == 1L && !is.na(cmd$id)) emit(list(type = "ack", id = cmd$id))
-  tryCatch(carmar_dispatch(cmd),
-           error = function(e) carmar_fail_frame(cmd, paste("command failed:", conditionMessage(e))),
+  tryCatch(allowInterrupts(beatrina_dispatch(cmd)),
+           error = function(e) beatrina_fail_frame(cmd, paste("command failed:", conditionMessage(e))),
            # Cleanup interrupts mean the same thing as interrupts during eval.
-           interrupt = function(i) carmar_fail_frame(cmd, "Execution interrupted", "interrupted"))
+           interrupt = function(i) beatrina_fail_frame(cmd, "Execution interrupted", "interrupted"))
   NULL
 }
 
@@ -3464,9 +3938,9 @@ carmar_serve_one <- function(con) {
 #' iteration and nothing else.
 #' @param con The command connection.
 #' @return "eof" or "shutdown", invisibly.
-carmar_serve <- function(con) {
+beatrina_serve <- function(con) {
   repeat {
-    outcome <- tryCatch(carmar_serve_one(con), interrupt = function(i) NULL)
+    outcome <- tryCatch(beatrina_serve_one(con), interrupt = function(i) NULL)
     if (identical(outcome, "eof") || identical(outcome, "shutdown")) return(invisible(outcome))
   }
 }
@@ -3479,13 +3953,18 @@ carmar_serve <- function(con) {
 # the process, as the `options(error=)` guard does for an error: a worker at
 # R's top-level prompt is a zombie the supervisor cannot tell from an idle one.
 globalCallingHandlers(interrupt = function(i) {
-  if (!is.null(findRestart("carmar_serve_again"))) invokeRestart("carmar_serve_again")
+  if (!is.null(findRestart("beatrina_serve_again"))) invokeRestart("beatrina_serve_again")
   quit(save = "no", status = 70L)
 })
-repeat {
-  outcome <- withRestarts(carmar_serve(con), carmar_serve_again = function() NULL)
-  if (!is.null(outcome)) break
-}
+# Signals between commands must not unwind a consumed line or the loop's
+# restart setup. Only dispatch enables interrupts; run_cell distinguishes a
+# flagged Stop from a late signal, and its handlers are installed before entry.
+suspendInterrupts({
+  repeat {
+    outcome <- withRestarts(beatrina_serve(con), beatrina_serve_again = function() NULL)
+    if (!is.null(outcome)) break
+  }
+})
 
 # stdin() is R's console, not ours to close. And an interactive R does not
 # exit when the script does — it would sit at the top-level prompt waiting for