Retype the typed prefix when accepting restores a capital in it

[enaboapps]

Closes #912. Stacked on #919; part of the casing plan in #914. The decision is recorded on the issue.

What changed

• worker.rs: for each suggestion, restored compares the typed prefix with the same stretch of the word. Where the word has a capital and the person typed a lowercase letter, the capital is restored; a capital the person typed is kept. When that changes the prefix, the suggestion's label shows the restored word and its insert becomes "delete the prefix, type the whole word". Otherwise the insert is the suffix as before, with nothing deleted. A prefix typed in capitals is never retyped.
• The private Response::Insert carries backspaces. In-process pipe message only; no persisted schema change.
• scan_executor.rs: prediction_text becomes prediction_replace(backspaces, text). It keeps the existing guards (modifiers released, no drag, no switch session, 64-character text limit), refuses more than 32 deletions, releases held input, sends that many Backspace taps, then types. The logic lives in a generic replace_text so tests use the fake injector.
• prediction/mod.rs: after a successful insert, the service queues the same Backspace edits before the appended text, so the worker's buffer matches the screen. The foreground checks before and after injection are unchanged.
• The fake model's prefix filter is now case-insensitive, matching the real model.
• docs/word-prediction.md replaces the "never deletes text" promise with the bounded exception and its limits.

Safety notes

• Only the prefix is deleted, and the prefix comes from the worker's buffer, which holds only text Switchify typed in the current foreground window with no external keyboard or mouse activity since. Any such activity clears the buffer and with it the suggestion.
• Deleting and typing cannot be atomic across applications. If typing fails after the deletion, the prefix is lost; the existing failure path resets prediction context and releases input. Smart punctuation already has the same property with its owned space.
• Tests never inject desktop input; they use the fake injector.

Review follow-up

An independent review found the main process re-checked only the foreground window before deleting, not outside activity. A keypress or click in the same window between the worker's reply and injection could have moved the caret and had other text deleted. The activity epoch is now recorded when the suggestion is chosen and must be unchanged, with a healthy observer, before any deletion; appending without deleting keeps its existing checks. The replace also releases input on a failure part-way through. New tests cover that guard, typing failing after the deletion with no key left down, and the buffer edits queued after a retype. The docs note that the deletion assumes one Backspace removes one typed character.

Validation

Node 24.13.0, Rust 1.97.1, on this top of the stack:

• npm run lint, npm test (244 Vitest tests and 5 Node tests) and npm run build passed. No frontend files changed.
• cargo fmt --check and cargo clippy --all-targets -D warnings passed.
• cargo test passed: 571 tests, including new tests for the restore rule, the accept payload and the executor's delete-then-type sequence and limits.

🤖 Generated with Claude Code