feat: editable run and session names

[Timo972]

Run and session names are set at creation today and can never be changed. This makes both editable from their detail pages.

API

Two new endpoints:

• PATCH /api/sessions/{id} — editSession
• PATCH /api/runs/{id} — editRun

They are named editX rather than after the single property they change, and their request bodies (EditSessionRequest, EditRunRequest) declare every property as optional, so both can grow to cover further editable properties without an operation rename or a breaking schema change. name is the only property today; a payload that sets none of them is rejected as a 400 rather than silently succeeding as a no-op.

Validation mirrors session creation exactly: trimmed, non-empty, at most 100 runes. Both routes go through the existing body-size cap and a strict field allowlist (unknown fields, typos, trailing data, and null are refused rather than silently dropped). The store-layer methods stay precise about what they actually do (Rename, RenameRun) — only the HTTP boundary uses the generic edit name.

Renaming a run

A run's variant sessions are named <run name> (axis=value) when the run is created, so a run rename would otherwise leave its variants carrying the old name.

Whether a variant follows the rename is decided by recorded provenance, not by comparing its current name against the name the run would generate. sampling_sessions gains a name_customized column: false for a run child (generated at creation), true for a standalone session and for any session renamed afterwards. The cascade updates only rows where it is false.

Text comparison was the obvious approach and is wrong: a name a person chose can coincide with what a later run name generates. Rename a child to Beta (region=eu), then rename its run Alpha → Beta → Gamma, and the comparison reclassifies the custom name as generated and overwrites it. Provenance is not guessable from the text, so it is stored.

Before (run Alpha → Beta)	After
Alpha (region=eu) (generated)	Beta (region=eu)
Alpha (region=us) (generated)	Beta (region=us)
My custom probe (renamed by hand)	My custom probe
Beta (region=eu) (renamed by hand)	Beta (region=eu)

The migration backfills existing rows the only way available — a child whose name still matches what its run's current name generates is recorded as generated, anything else as customized. An integration test runs the migration's own statements against rows reset to the column default, so that SQL cannot drift from VariantName unnoticed.

This also required moving variantName out of internal/api into internal/variation as exported VariantName, since internal/db needs it and cannot import the API package.

Concurrency

The cascade's child update is conditional in its WHERE clause, so a session rename that commits between the cascade's read and its write is preserved rather than overwritten — it sets name_customized, and the re-evaluated WHERE then matches no row.

Writing a deterministic test for that interleaving surfaced a second problem. The cascade originally took SELECT … FOR UPDATE on the run row, which conflicts with the KEY SHARE lock a child row update needs for its run_id foreign key — deadlocking against a concurrent session rename holding the child's row lock. Renaming never changes the run's key, so the plain rename UPDATE (which takes the weaker FOR NO KEY UPDATE) both serializes concurrent run renames and leaves that foreign-key lock free.

UI

A new EditableTitle component in the session and run detail headers. Click the title to edit in place; Enter or blur saves, Escape discards. An unchanged or empty name is not sent (the API would reject it), and a failed save keeps the typed text on screen with the error surfaced beside it rather than dropping it. Run variants are covered too, since they link out to /sessions/:id.

Interaction with the sampler

Renaming never touches sampling state, so it is valid in any status. A running worker's snapshot write cannot clobber a rename — UpdateSessionSnapshot does not carry the name column. An integration test pins this by renaming a running session and then saving a tick.

Testing

• Handler tests for both endpoints: happy path, whitespace trimming, empty / whitespace-only / over-100-rune rejection, the empty-payload case, a 100-rune boundary using multi-byte characters, oversized bodies, unknown and typo'd fields, trailing and concatenated JSON, and 404s.
• Postgres integration tests for the cascade rule, the coinciding-custom-name case, the concurrent-rename interleaving (forced with a row lock, not timed), the migration backfill, unknown-run and unknown-session errors, and the sampler-tick guard. Each was watched failing before the implementation was restored.
• Component tests for EditableTitle (Enter, Escape, blur, unchanged, emptied, maxLength, pending, failed save) and page-level tests asserting the PATCH body and the refetched name.

Verified on this branch: go test -race ./... exits 0 across all 13 packages against a real Postgres, make web-test passes 102/102, make generate-check exits 0 on a clean tree, and tsc and go vet are clean. The migration was applied and rolled back to check both directions.

Note on the build output: the large shared vendor chunk is now named editable-title-*.js instead of risk-histogram-*.js. That is Rollup renaming the shared chunk as the module graph shifted — same recharts bundle, roughly 1.2 kB larger overall.

🤖 Generated with Claude Code