Fix dataset-ref walk false positive and wire spec-mandated success toasts

- Prune the data payload and top-level datasets keys in all three ref walks
  (extractDatasetRefs, renameDatasetInSpec, resolveDatasetRefs) so a data row
  carrying a field named "data" is no longer misread as a library reference,
  spuriously rewritten, or made to throw DatasetNotFoundError. Adds tests,
  including a guard that lookup-transform refs (from.data) still resolve.
- Wire the deferred success toasts now the Toaster has landed: publish, revert,
  extract-to-dataset, and snippet/dataset delete. Copy follows the council
  title-vs-message rule (title states the action, message adds the consequence).
- Reconcile the spec's blanket toast mandate to "toast only what the user can't
  already see": no toast on visible-result creates (snippet, dataset form);
  Copy Reference stays inline and gains an aria-live announcement (new shared
  .visually-hidden utility) instead of a toast-per-copy.
- Move the toast region to bottom-right so it stops covering the header action
  cluster (Publish/Revert, theme/datasets).
- Update docs/spec 01F/02/05 and docs/architecture/07 + 10 to match.

docs/architecture/07-naming-and-relationships.md

@@ -132,9 +132,14 @@ always mirrors the dataset names actually referenced in the published spec.
 ### 3.1 Extracting referenced names from a spec (pure — `src/core/spec-refs.ts`)
 
 A Vega-Lite spec can reference named data in several places: the top-level
-`data`, per-layer `data`, `data` inside `spec`/`facet`/`hconcat`/`vconcat`, and
-named entries in top-level `datasets`. Rather than enumerate Vega-Lite's grammar,
-we walk the spec recursively and collect every `{ data: { name } }` we find.
+`data`, per-layer `data`, `data` inside `spec`/`facet`/`hconcat`/`vconcat`, and a
+lookup transform's `from.data`. A spec may also define its OWN inline datasets via
+a top-level `datasets` map — those are self-defined, not library references.
+Rather than enumerate Vega-Lite's grammar, we walk the spec recursively and
+collect every `{ data: { name } }` — but **prune two keys**: never recurse into a
+`data` object's payload (its `values`/rows) or the top-level `datasets` map,
+because those hold user data, not nested specs. Without the prune, a data _row_
+carrying a field literally named `data: { name: "x" }` is misread as a reference.
 This is pure, deterministic, and the most heavily unit-tested function here.
 
 ```ts
@@ -142,8 +147,10 @@ This is pure, deterministic, and the most heavily unit-tested function here.
 
 type Json = unknown;
 
-/** Collects every dataset name referenced by `{ data: { name } }` anywhere in the spec. */
+/** Collects every library dataset name referenced by `{ data: { name } }`, excluding self-defined ones. */
 export function extractDatasetRefs(spec: Json): string[] {
+  const root = typeof spec === 'string' ? safeParse(spec) : spec;
+  const selfDefined = selfDefinedNames(root); // names from the spec's own top-level `datasets`
   const names = new Set<string>();
 
   const walk = (node: Json): void => {
@@ -155,13 +162,17 @@ export function extractDatasetRefs(spec: Json): string[] {
       const obj = node as Record<string, Json>;
       const data = obj.data as Record<string, Json> | undefined;
       if (data && typeof data === 'object' && typeof data.name === 'string') {
-        names.add(data.name);
+        if (!selfDefined.has(data.name)) names.add(data.name);
+      }
+      // Prune: a `data` payload and the `datasets` map hold user data, not refs.
+      for (const key of Object.keys(obj)) {
+        if (key === 'data' || key === 'datasets') continue;
+        walk(obj[key]);
       }
-      for (const key of Object.keys(obj)) walk(obj[key]);
     }
   };
 
-  walk(typeof spec === 'string' ? safeParse(spec) : spec);
+  walk(root);
   return [...names];
 }
 
@@ -193,11 +204,20 @@ export function recomputeDatasetRefs(spec: Json): string[] {
   agreeing with what the renderer actually resolves.
 - Recompute and store `datasetRefs` on **publish**, not on every keystroke —
   the draft can be transiently invalid, and only the published spec is shared.
+- Prune the **same two keys** (`data`, `datasets`) in all three ref walks —
+  extraction here, `renameDatasetInSpec`, and the renderer's `resolveDatasetRefs`
+  (`src/core/rendering.ts`). They must agree on what counts as a reference; if one
+  descends into data payloads and another doesn't, extraction and rendering
+  disagree and a row field named `data` either gets counted, rewritten, or throws
+  `DatasetNotFoundError`.
 
 **Don't**
 
 - Don't let two code paths each have their own idea of "referenced names".
-  Renamer and ref-recomputer must use the same extractor.
+  Renamer, ref-recomputer, and renderer must use the same walk shape.
+- Don't "enumerate the grammar" (scope the walk to a fixed list of container
+  keys) to fix the payload-descent problem — pruning the two data-bearing keys
+  stays correct as Vega-Lite's composition grammar grows; an allow-list rots.
 
 ---
 
@@ -323,19 +343,21 @@ The spec rewrite is pure; the orchestration reads and writes stores.
 /** Returns a copy of `spec` with every data.name === oldName replaced by newName. */
 export function renameDatasetInSpec(spec: Json, oldName: string, newName: string): Json {
   const obj = typeof spec === 'string' ? safeParse(spec) : spec;
+  const selfDefined = selfDefinedNames(obj); // never rename a spec's own inline dataset name
 
   const rewrite = (node: Json): Json => {
     if (Array.isArray(node)) return node.map(rewrite);
     if (node && typeof node === 'object') {
       const out: Record<string, Json> = {};
       for (const [k, v] of Object.entries(node as Record<string, Json>)) {
-        if (
-          k === 'data' &&
-          v &&
-          typeof v === 'object' &&
-          (v as Record<string, Json>).name === oldName
-        ) {
-          out[k] = { ...(v as object), name: newName };
+        // A `data` object is a reference site: rename a matching name, but never
+        // recurse into its payload. `datasets` (self-defined inline data) is left
+        // whole. Same prune as extractDatasetRefs — see §3.1.
+        if (k === 'data' && v && typeof v === 'object' && !Array.isArray(v)) {
+          const dv = v as Record<string, Json>;
+          out[k] = dv.name === oldName && !selfDefined.has(oldName) ? { ...dv, name: newName } : dv;
+        } else if (k === 'data' || k === 'datasets') {
+          out[k] = v;
         } else {
           out[k] = rewrite(v);
         }

docs/architecture/10-interaction-and-feedback.md

@@ -43,6 +43,28 @@ nature of the message, not by convenience.
   consent-for-destruction in a toast.
 - **Errors persist; success fades.** An error/warning toast waits for the user (a critical
   message must not vanish on a timer); success/info auto-dismiss (~6s).
+- **Toasts sit bottom-right**, not top-right. Carbon's default is the top, but our header's
+  action cluster (Publish/Revert, theme/datasets) lives top-right — a toast there covers the
+  control the user just used. Bottom-anchored, the stack grows upward with the newest toast
+  nearest the corner, and still clears the centered confirm dialog. (`Toaster.module.css`.)
+- **Toast copy: title states it, message adds to it.** Every toast renders a `title` and a
+  `message`. The title is the short headline — the action or what stopped, **no terminal
+  period** ("Snippet published", "Storage full"). The message is **one short sentence that
+  must not paraphrase the title** (Carbon, `components/notification/usage.mdx` §Body
+  content: _"Don't repeat or paraphrase the title"_); it carries the **consequence** for a
+  success ("Your draft is now the published version") or the **next step** for a fixable
+  error. Name the specific item in the message when toasts can stack — a delete confirms
+  _which_ one went ("…removed `\"Sales\"`…").
+- **Toast only what the user can't already see.** A success toast is for an outcome with no
+  strong on-screen cue: a **side effect** (Extract creates a dataset off-screen while the
+  user is in the editor), a **disappearance** (delete), or a **state flip** (publish/revert).
+  An action whose result is immediately visible — a created snippet opening in the editor, a
+  new dataset shown selected — is confirmed by that visible change; adding a toast is noise
+  (NN/g aesthetic-and-minimalist; Carbon `notification/usage.mdx` "Deciding what to use").
+  An **invisible** outcome that still shouldn't toast is **copy-to-clipboard**: confirm it
+  _inline on the control_ ("Copied") with a polite `aria-live` announcement for assistive
+  tech, never a toast-per-copy. This refines the spec's earlier blanket "every action
+  toasts" (spec §01F/§02/§05, reconciled).
 - **The same failure can light up two channels.** An unrenderable spec shows the _same_
   message inline in both the editor (§03E) and the preview (§04) — one producer
   (`PreviewStore`), two subscribers. That's intentional, not duplication.

docs/spec/01-application-shell.md

@@ -99,13 +99,17 @@ Transient toast messages appear in a corner of the screen to confirm actions or
 - Each toast auto-dismisses after a few seconds, and can also be dismissed manually via its close control.
 - Multiple toasts stack rather than replacing one another, and appear/disappear with a brief fade.
 
+Toasts confirm outcomes the user **cannot already see** — a side effect, a disappearance, or a state change with no strong on-screen cue. An action whose result is immediately visible (a newly created snippet opening in the editor; a new dataset shown selected in its detail pane) is confirmed by that visible change, not by an added toast, which would only be noise (Nielsen Norman "aesthetic and minimalist design"; Carbon notification usage; see _docs/architecture/10 → Toast copy_). Assistive-technology users still receive an announcement on the changed region.
+
 Events that raise toasts include:
 
-- Snippet actions: creating, duplicating, deleting, publishing a draft, and reverting/discarding a draft.
-- Dataset actions: creating, deleting, and extracting inline data into a dataset.
+- Snippet actions: **duplicating** (the copy is easily mistaken for an edit of the original), **deleting** (the snippet disappears), **publishing** a draft, and **reverting** a draft. _Creating_ a snippet opens it in the editor and needs no toast.
+- Dataset actions: **deleting**, and **extracting** inline data into a dataset (the dataset is created off-screen while the user is in the editor). _Creating_ a dataset in the Datasets modal is confirmed by the new dataset appearing selected.
 - Import/Export: results of an import (success/partial/failure) and confirmation of an export.
 - Errors: spec/data validation failures and local-storage capacity warnings.
 
+**Copy Reference** (Datasets) is the exception that proves the rule: a clipboard write is invisible, but the universal pattern confirms it _inline on the control_ ("Copied"), announced politely to assistive tech — a toast per copy would be noise.
+
 ## G. Offline & Installable
 
 Astrolabe is local-first and usable without a network connection.

docs/spec/02-snippet-library.md

@@ -57,9 +57,9 @@ When a snippet is active, a metadata panel (within the left pane) exposes its ed
 
 ## Snippet Operations
 
-The library provides the lifecycle operations for snippets. Each operation gives clear feedback via a toast notification (see _Application Shell & Navigation_).
+The library provides the lifecycle operations for snippets. An operation whose outcome the user can't already see confirms it with a toast; an operation whose result is immediately visible needs none (see _Application Shell & Navigation_ → Toasts).
 
-- **Create New**: starts a new snippet from a small sample Vega-Lite bar-chart template (a few inline category/value rows), assigns it an auto-generated default name (see _Naming & Tags_), saves it, and makes it the active snippet.
+- **Create New**: starts a new snippet from a small sample Vega-Lite bar-chart template (a few inline category/value rows), assigns it an auto-generated default name (see _Naming & Tags_), saves it, and makes it the active snippet. Opening in the editor _is_ the confirmation, so no toast is raised.
 - **Duplicate**: creates an independent copy of the active snippet with a name suffixed "(copy)". The copy carries over the specification, comment, tags, and dataset references, gets fresh created/modified timestamps and a new identity, and becomes the active snippet. A success toast confirms the duplication.
 - **Delete**: permanently removes the active snippet after the user confirms a warning that the action cannot be undone. After deletion no snippet is active. A toast confirms the deletion.
 - These operations never affect other snippets.

docs/spec/05-datasets.md

@@ -84,11 +84,12 @@ The detail pane for a selected dataset shows:
 
 ## Actions
 
-Each action raises a confirming toast (or an error toast on failure).
+A destructive or off-screen outcome raises a confirming toast; an action whose result is immediately visible is confirmed by that change. Any action may raise an error toast on failure (see _Application Shell & Navigation_ → Toasts).
 
 - **Copy Reference** — copies the by-name reference object to the clipboard, ready to paste into a spec:
   `{ "data": { "name": "MyDataset" } }`
-- **New / Create New** — opens the create form in the detail pane with fields: **name** (required, unique), **source** toggle (Inline / URL), the **data** (a paste area for inline, a URL field for URL source), and an optional **comment**. Save is disabled until a name and valid data/URL are present. On success the new dataset is selected.
+  The clipboard write is invisible, so it is confirmed _inline on the control_ ("Copied"), announced politely to assistive technology — not a toast.
+- **New / Create New** — opens the create form in the detail pane with fields: **name** (required, unique), **source** toggle (Inline / URL), the **data** (a paste area for inline, a URL field for URL source), and an optional **comment**. Save is disabled until a name and valid data/URL are present. On success the new dataset is shown selected in the detail pane — that visible result is the confirmation, so no toast is raised (a dataset created _off-screen_ via Extract does toast; see _Spec Editor_).
 - **Edit** — rename, edit the comment, and update the data (re-paste inline data or refresh the URL). Updating inline data re-profiles it; the modified timestamp advances.
 - **Delete** — asks for confirmation ("Delete \"Name\"? This cannot be undone."), then removes the dataset and clears the selection.