[ixuz]

What and why

The Studio's listing of a draft (draftLibraryDeck) found the title, license and creators of each of the draft's sources by going over every statement of the draft, several times per source. That work grew with the square of the number of sources. On a draft drawn from many sources, the release diff and the trial stopped responding each time they were opened, because each makes the listing more than once.

This pull request:

• Groups by subject in one pass. draftLibraryDeck now gathers the sources' statements by subject in one pass, as sourcesOf already does. A source named twice is listed once.
• Makes the listing fewer times. The release diff screen (releaseDrafts.ts) makes the listing once and hands it to releaseDiff and simulateLearnerUpgrade, and simulateLearnerUpgrade hands it on to draftLibraryContent. Each takes it as an optional last parameter that defaults to making it, so existing callers don't change. This saves repeated work but doesn't change how the time grows.
• Adds growth tests. New growth tests check that the listing, the release diff and the learner upgrade take linear time in the number of sources. docs/testing.md lists them in the domain row.

For reviewers: this branch, fix/graph-address-bound and fix/type-index-one-edit each add to the same domain row of the growth tests in docs/testing.md, so they conflict there. Merge them one at a time, and rebase each later branch on main before merging it.

Refs: GHSA-6pp3-vp4m-5m87

Checklist

• One issue. This pull request addresses one issue, linked above.
• One step. This pull request does not finish its issue, so it says Refs:, not Closes:. Leave this unchecked otherwise.
• Done, as AGENTS.md defines it: npm run check passes (lint, Markdown and spelling included), npm run lint:reuse too if a file was added, and npm run crosscheck too if ns/ or decks/ changed. (lint:reuse and crosscheck n/a: no file added, ns/ and decks/ unchanged)
• Tests. New and changed code has its tests, and every package stays at 100% coverage (docs/testing.md).
• Docs. The docs say what changed, and a new page in docs/ is listed in docs/docs.ttl.
• Languages. A new or changed message is in every locale: en, sv, ko, de, es and fr (packages/ui/src/i18n/). (n/a: no message changed)
• Vocabulary and shapes. Any change to ns/ was agreed in an issue first; no published ns/shapes/*/vN.ttl or decks/*/vN.ttl was edited; generated files were regenerated, not edited. (n/a: ns/, decks/ and generated files unchanged)
• Breaking? Nothing in the public API breaks, or a commit says so (! and a BREAKING CHANGE: footer). npm run check:breaking sees a line of api/ that goes, but not a feature removed, nor a reader that reads less than before.
• Pod data. Any change to what the app writes to a pod comes with its migration (docs/migrations.md). (n/a: nothing written to a pod changes)
• Policy. Any change to an external rule the code follows (SM-2, the plural rules, a specification) is cited. (n/a: no external rule changes)
• Licenses. New content is MIT, or a deck states its own license; a new file has its SPDX header (npm run lint:reuse), or a new deck its line in REUSE.toml; third-party content is credited. (n/a: no file or deck added)
• Architecture. Imports follow docs/boundaries.md and the layers of docs/architecture.md.
• Run. I ran the app (npm run dev) and tried the change, and considered the user journeys.
• Authorship. I read and understand every line of this pull request, and answer for it, whatever tools helped write it (CONTRIBUTING.md).
• Commits. Each commit is one logical change, in Conventional Commits form (type(scope): subject, ! and a BREAKING CHANGE: footer if it breaks something), with an imperative subject and a body that explains why (CONTRIBUTING.md).