@quantiya/codevibe-core 2.0.91 → 2.0.93

package/dist/local-executor/anchored-cas.d.ts

@@ -1,35 +1,102 @@
+import { type BlobStore } from './blob-store';
+import type { BlobRef } from './change-manifest';
 import { type AnchoredFsIdentity } from './anchored-fs';
 import { type WorkspaceRootAuthority } from './workspace-authority';
+import { spawnIsolatedHelper } from './bounded-helper';
 import { CasHelperCrashStage, CasRecoveryAuthority } from './shadow-protocol';
 export declare function casRecoveryAuthorityFor(root: WorkspaceRootAuthority, rel: string, expectedHash: string | null, expectedMode: number | null, postHash: string | null, postMode: number | null): CasRecoveryAuthority;
+/**
+ * P63 Slice 2 (§9.4) — byte cap for a post-image streamed from a blob: the capture cap. The helper copies and hashes in
+ * 1 MiB chunks, so this bounds disk, not memory.
+ */
+export declare const MAX_PROMOTED_BLOB_BYTES: number;
 export interface AcceptedAlternateImage {
     hash: string | null;
     mode: number | null;
 }
+export declare function markCasHelperStillRunning(err: unknown): void;
+/** True when the failed request's helper was still running after its retirement returned (N1). */
+export declare function casHelperStillRunning(err: unknown): boolean;
 export declare class WorkspaceCasUnresolvedError extends Error {
     readonly recoveryName?: string;
     constructor(recoveryName?: string, detail?: string);
 }
-export declare function replacePromotedFile(workingDir: string, rel: string, content: string, mode: number, expectedHash: string | null, expectedMode: number | null, beforeCommit?: () => Promise<void> | undefined, afterValidation?: () => Promise<void> | undefined, afterDisplacement?: (recoveryName: string) => Promise<void> | undefined, beforeTargetQuarantine?: (quarantineName: string) => Promise<void> | undefined, beforeFinalUnlink?: (recoveryName: string) => Promise<void> | undefined, afterPrepared?: () => Promise<void> | undefined, expectedRootIdentity?: AnchoredFsIdentity | WorkspaceRootAuthority, helperOpts?: {
+/**
+ * F-APPLY-300K-UNRESOLVED (e4bfix1): an unresolved promotion was logged with its paths only, so which of the ways a
+ * committed CAS can end unresolved had happened was unknowable. Maps the error text to a fixed code (no paths, no
+ * stderr, no user content) that is safe for the shape-only logs; an exit status is kept, nothing else of the text.
+ */
+export declare function casUnresolvedReasonCode(message: string): string;
+interface CasChannel {
+    child: ReturnType<typeof spawnIsolatedHelper>;
+    closedPromise: Promise<number | null>;
+    isClosed(): boolean;
+    closeCode(): number | null;
+    stderrText(): string;
+    waitForClose(timeoutMs: number): Promise<number | null>;
+    nextMessage(timeoutMs: number): Promise<Record<string, unknown>>;
+    /** F-APPLY-300K-UNRESOLVED: record one protocol line sent (a closed kind, never content). */
+    noteSent(kind: CasProtocolSentKind): void;
+    /** The last protocol events, oldest first: `s:<kind>@<ms>` / `r:<type>@<ms>` since the helper started. */
+    trail(): string[];
+}
+/**
+ * F-APPLY-300K-UNRESOLVED (E2E-4b): the closed protocol vocabulary a reply-timeout trail may carry. A timeout names
+ * the exact step at which the desktop and the helper stopped hearing each other, without any path or content.
+ */
+export type CasProtocolSentKind = 'request' | 'VALIDATE_CHAIN' | 'COMMIT' | 'CONTINUE_PREPARED' | 'CONTINUE' | 'UNLINK' | 'QUARANTINE' | 'ABORT' | 'END';
+/** The helper's own protocol trail carried by a reply-timeout message (closed tokens only), or null. */
+export declare function casHelperTrail(message: string): string[] | null;
+/** The protocol trail carried by a reply-timeout message (closed tokens only), or null. */
+export declare function casProtocolTrail(message: string): string[] | null;
+/**
+ * F-CAS-BATCH — one helper for a whole apply, instead of one process launch per file. Every request runs the same
+ * `execute()` with the same handshake and the same fsyncs; only the launch is shared. Any failure of a request retires
+ * the helper, and the next request starts a fresh one. `close()` belongs in a `finally`: it ends the helper whatever happened.
+ */
+export interface AnchoredCasSession {
+    /** @internal the running helper, started if there is none. */
+    acquire(helperTimeoutMs: number): CasChannel;
+    /** @internal a request failed: end this helper, whatever state it is in. */
+    retire(channel: CasChannel): Promise<void>;
+    close(): Promise<void>;
+}
+export declare function createAnchoredCasSession(): AnchoredCasSession;
+export declare function replacePromotedFile(workingDir: string, rel: string, 
+/** The post-image: inline text, or (P63 Slice 2 §9.4) a verified blob streamed to the helper in 1 MiB chunks. */
+content: string | {
+    blob: BlobRef;
+    store: BlobStore;
+}, mode: number, expectedHash: string | null, expectedMode: number | null, beforeCommit?: () => Promise<void> | undefined, afterValidation?: () => Promise<void> | undefined, afterDisplacement?: (recoveryName: string) => Promise<void> | undefined, beforeTargetQuarantine?: (quarantineName: string) => Promise<void> | undefined, beforeFinalUnlink?: (recoveryName: string) => Promise<void> | undefined, afterPrepared?: () => Promise<void> | undefined, expectedRootIdentity?: AnchoredFsIdentity | WorkspaceRootAuthority, helperOpts?: {
     helperTimeoutMs?: number;
-    testHangStage?: 'root' | 'parent' | 'target';
+    testHangStage?: 'root' | 'parent' | 'target' | 'prepared';
     testCrashStage?: CasHelperCrashStage;
     allowPostImageRecovery?: boolean;
     acceptedAlternate?: AcceptedAlternateImage;
+    session?: AnchoredCasSession;
+    /** F-CAS-BATCH: the target is a disposable copy, not the user's folder: no fsyncs. */
+    disposableTarget?: boolean;
 }): Promise<boolean>;
 export declare function removePromotedFile(workingDir: string, rel: string, expectedHash: string | null, expectedMode: number | null, beforeCommit?: () => Promise<void> | undefined, afterValidation?: () => Promise<void> | undefined, afterDisplacement?: (recoveryName: string) => Promise<void> | undefined, beforeTargetQuarantine?: (quarantineName: string) => Promise<void> | undefined, beforeFinalUnlink?: (recoveryName: string) => Promise<void> | undefined, expectedRootIdentity?: AnchoredFsIdentity | WorkspaceRootAuthority, helperOpts?: {
     helperTimeoutMs?: number;
-    testHangStage?: 'root' | 'parent' | 'target';
+    testHangStage?: 'root' | 'parent' | 'target' | 'prepared';
     testCrashStage?: CasHelperCrashStage;
     allowPostImageRecovery?: boolean;
     acceptedAlternate?: AcceptedAlternateImage;
+    session?: AnchoredCasSession;
+    /** F-CAS-BATCH: the target is a disposable copy, not the user's folder: no fsyncs. */
+    disposableTarget?: boolean;
 }): Promise<boolean>;
 /** Hardened reverse-apply surface shared by promotion and durable revert. */
 export declare function replaceWorkspaceFileIfMatches(args: {
     workingDir: string;
     workspaceRootAuthority: WorkspaceRootAuthority;
     path: string;
-    content: string;
+    /** Inline text, or (P63 Slice 2 §9.4) a verified blob streamed to the helper — a team revert's pre-image. */
+    content: string | {
+        blob: BlobRef;
+        store: BlobStore;
+    };
     mode: number;
     expectedHash: string | null;
     expectedMode: number | null;
@@ -46,13 +113,15 @@ export declare function replaceWorkspaceFileIfMatches(args: {
     /** @internal lower deterministic CAS-helper deadline for tests. */
     helperTimeoutMs?: number;
     /** @internal deterministic CAS-helper target-filesystem stall seam. */
-    testHangHelperStage?: 'root' | 'parent' | 'target';
+    testHangHelperStage?: 'root' | 'parent' | 'target' | 'prepared';
     /** @internal deterministic helper death after COMMIT/mutation. */
     testCrashHelperStage?: CasHelperCrashStage;
     /** Re-drive deterministic recovery names owned by an existing durable journal. */
     allowPostImageRecovery?: boolean;
     /** Exact terminal image that authorizes cleanup-only replay for same-path chains. */
     acceptedAlternate?: AcceptedAlternateImage;
+    /** F-CAS-BATCH: run in this session's helper. */
+    session?: AnchoredCasSession;
 }): Promise<boolean>;
 /** Hardened reverse-delete surface shared by promotion and durable revert. */
 export declare function removeWorkspaceFileIfMatches(args: {
@@ -74,11 +143,14 @@ export declare function removeWorkspaceFileIfMatches(args: {
     /** @internal lower deterministic CAS-helper deadline for tests. */
     helperTimeoutMs?: number;
     /** @internal deterministic CAS-helper target-filesystem stall seam. */
-    testHangHelperStage?: 'root' | 'parent' | 'target';
+    testHangHelperStage?: 'root' | 'parent' | 'target' | 'prepared';
     /** @internal deterministic helper death after COMMIT/mutation. */
     testCrashHelperStage?: CasHelperCrashStage;
     /** Re-drive deterministic recovery names owned by an existing durable journal. */
     allowPostImageRecovery?: boolean;
     /** Exact terminal image that authorizes cleanup-only replay for same-path chains. */
     acceptedAlternate?: AcceptedAlternateImage;
+    /** F-CAS-BATCH: run in this session's helper. */
+    session?: AnchoredCasSession;
 }): Promise<boolean>;
+export {};

package/dist/local-executor/anchored-fs.d.ts

@@ -114,6 +114,38 @@ export declare function anchoredHashFileWithinRoot(root: string, relativePath: s
     testHangStage?: 'open' | 'read' | 'close';
     signal?: AbortSignal;
 }): Promise<AnchoredHashedFile | null>;
+/**
+ * P63 Slice 2 (§9.4) — copy one file, anchored exactly as `anchoredHashFileWithinRoot` reads it, into `outFd` (an open
+ * writable descriptor the caller owns) in 1 MiB chunks, returning its hash, size and identity. The bytes never cross
+ * the helper protocol and are never held whole. The caller must treat what it finds in `outFd` as unverified until it
+ * has re-hashed it against the returned `sha256` and `size` (`putBlobFromAnchoredCopy` does).
+ */
+export declare function anchoredCopyFileWithinRoot(root: string, relativePath: string, opts: {
+    maxBytes: number;
+    outFd: number;
+    expectedRoot?: AnchoredFsIdentity | WorkspaceRootAuthority;
+    helperTimeoutMs?: number;
+    signal?: AbortSignal;
+}): Promise<AnchoredHashedFile | null>;
+/** F-CAS-BATCH: bytes returned with a session read's hash, when the file is at most this size. */
+export declare const READ_SESSION_CONTENT_MAX_BYTES: number;
+/**
+ * F-CAS-BATCH — one read helper for a whole pass over a change, instead of one process launch per file: the same
+ * `readFile` with the same root, chain, publication-marker and identity checks as `anchoredHashFileWithinRoot`, whose
+ * errors it reports in the same words. Calls run one at a time. `close()` belongs in a `finally`.
+ */
+export interface AnchoredReadSession {
+    hashFile(root: string, relativePath: string, opts: {
+        maxBytes: number;
+        expectedRoot: AnchoredFsIdentity | WorkspaceRootAuthority;
+        contentMaxBytes?: number;
+        helperTimeoutMs?: number;
+    }): Promise<(AnchoredHashedFile & {
+        bytes?: Buffer;
+    }) | null>;
+    close(): Promise<void>;
+}
+export declare function createAnchoredReadSession(): AnchoredReadSession;
 export type AnchoredWritePrecondition = {
     kind: 'absent';
 } | {

package/dist/local-executor/blob-store.d.ts

@@ -0,0 +1,95 @@
+import * as fs from 'node:fs/promises';
+import type { BlobRef } from './change-manifest';
+import { type StoreAnchor } from './store-dir-anchor';
+export declare const BLOB_CHUNK_BYTES: number;
+/** One instance's blob namespace in a task state directory. */
+export interface BlobStore {
+    dir: string;
+    prefix: string;
+}
+export declare function blobName(store: BlobStore, sha256: string): string;
+/**
+ * R2-F3 (Stage 2 R2): run `fn` with the content-store directory held (`store-dir-anchor.ts`), creating it (0700, its
+ * parent's entry fsynced) on first use. A store path that is anything but a real directory is refused, never followed.
+ */
+export declare function withStoreAnchor<T>(dir: string, fn: (anchor: StoreAnchor) => Promise<T>): Promise<T>;
+/**
+ * F-S2-4 / S2-C5 / R2-F3: create an exclusive temp file in the HELD store directory. On Linux the name is created
+ * through the held descriptor, so it cannot land anywhere else; on macOS a symlink anywhere in the path refuses the
+ * open. Either way the file must then be in the same directory, still named by the store path — otherwise it is
+ * removed (through the held directory) and refused.
+ */
+export declare function createStoreTemp(anchor: StoreAnchor, name: string, 
+/** Test-only: runs between the directory being held and the open (the replacement race). */
+testBeforeOpen?: () => Promise<void>): Promise<fs.FileHandle>;
+/**
+ * Publish a written, fsynced temp file under `finalName` in the held directory by `link()` (never replacing a name).
+ * `'exists'` when the name was already there — the caller must verify it holds the same bytes. The temp name is
+ * always removed.
+ */
+export declare function publishStoreTemp(anchor: StoreAnchor, tmp: string, finalName: string): Promise<'published' | 'exists'>;
+/** Remove a temp name from the held directory (a failed write). */
+export declare function dropStoreTemp(anchor: StoreAnchor, tmp: string): Promise<void>;
+/**
+ * Store the bytes produced by `chunks` and return their reference. Streaming: at most one chunk is held. When a blob
+ * with the same hash already exists it is verified (size and hash) and kept; the new copy is dropped.
+ */
+export declare function putBlob(store: BlobStore, chunks: AsyncIterable<Buffer | Uint8Array>, 
+/**
+ * P63 Slice 2 (§9.4 capture at scale): skip the per-blob directory fsync — the caller MUST call
+ * {@link syncBlobStore} once before any record references the blobs it published (the file itself is still fsynced).
+ */
+opts?: {
+    deferDirSync?: boolean;
+}): Promise<BlobRef>;
+/** P63 Slice 2: the one directory fsync owed by blobs published with `deferDirSync`. */
+export declare function syncBlobStore(store: BlobStore): Promise<void>;
+/** Store an in-memory buffer or string. */
+export declare function putBlobBytes(store: BlobStore, data: Buffer | string, opts?: {
+    deferDirSync?: boolean;
+}): Promise<BlobRef>;
+/**
+ * Store a file copied by an anchored helper (`anchoredCopyFileWithinRoot`): `copy` receives an exclusive temp file's
+ * descriptor and returns the hash and size the helper read, or null when the file is absent. The temp file is
+ * fsynced and re-hashed here before it is published, so a blob name never holds bytes other than the ones the anchored
+ * read hashed. Returns null (and leaves nothing behind) when `copy` does.
+ */
+export declare function putBlobFromAnchoredCopy<T extends {
+    sha256: string;
+    size: number;
+}>(store: BlobStore, copy: (fd: number) => Promise<T | null>): Promise<{
+    ref: BlobRef;
+    read: T;
+} | null>;
+/** Store a file's bytes by streaming it (opened no-follow; the caller owns the path's authority). */
+/**
+ * §9.4 — copy one verified blob into another store (a team track's capture into its group's content store, a merge
+ * plan's result into the integration copy's store): streamed in 1 MiB chunks, hashed while written, published by link
+ * (never replacing a name). A source that does not match its reference throws before anything is published; a
+ * destination that already holds the name is verified, never overwritten.
+ */
+export declare function copyBlob(src: BlobStore, dst: BlobStore, ref: BlobRef): Promise<BlobRef>;
+export declare function putBlobFromFile(store: BlobStore, file: string): Promise<BlobRef>;
+/**
+ * Stream a blob in chunks of at most 1 MiB. The size is checked before the first byte and the hash after the last;
+ * a mismatch throws from the iterator, so a consumer that finishes the loop has read exactly the referenced bytes.
+ */
+export declare function readBlobChunks(store: BlobStore, ref: BlobRef): AsyncGenerator<Buffer>;
+/**
+ * Open a blob for a consumer that streams and verifies it itself (the CAS helper hashes while it copies and refuses a
+ * mismatch before anything is published). Opened no-follow; must be a regular file of exactly `ref.size` bytes.
+ */
+export declare function openBlobForStreaming(store: BlobStore, ref: BlobRef): Promise<fs.FileHandle>;
+/**
+ * P63 Slice 2 (§9.4) — the strict-text rule of `decodeStrictUtf8` (valid UTF-8, no NUL byte) checked while streaming,
+ * for a file too large to decode whole. Throws the same "binary file changes are not supported safely" refusal.
+ */
+export declare function assertBlobStrictUtf8(store: BlobStore, ref: BlobRef, rel: string): Promise<void>;
+/** Verify a blob end to end without keeping its bytes. */
+export declare function verifyBlob(store: BlobStore, ref: BlobRef): Promise<void>;
+/** Read a blob whole (only for references at most `maxBytes`), verified. */
+export declare function readBlobBytes(store: BlobStore, ref: BlobRef, maxBytes: number): Promise<Buffer>;
+/** The first `maxBytes` of a blob (not hash-verified: a partial read cannot be). For display excerpts only. */
+export declare function readBlobHead(store: BlobStore, ref: BlobRef, maxBytes: number): Promise<Buffer>;
+/** This instance's blob names (and stray temp files). */
+export declare function listBlobFiles(store: BlobStore): Promise<string[]>;

package/dist/local-executor/change-manifest-store.d.ts

@@ -0,0 +1,32 @@
+import { CHANGE_MANIFEST_VERSION, type ChangeManifest, type ChangeManifestEntry } from './change-manifest';
+/** What a marker records for a reviewed change: the ordered shard hashes and the root (§9.4). */
+export interface ChangeManifestRecord {
+    changeManifest: typeof CHANGE_MANIFEST_VERSION;
+    entries: number;
+    shards: Array<{
+        sha256: string;
+        entries: number;
+    }>;
+    rootHash: string;
+}
+/** One instance's manifest namespace in a task state directory. */
+export interface ManifestStore {
+    dir: string;
+    prefix: string;
+}
+/** A shard holds at most 10,000 entries of a few hundred bytes each; anything far larger is not a shard. */
+export declare const MAX_MANIFEST_SHARD_BYTES: number;
+export declare function manifestShardName(store: ManifestStore, sha256: string): string;
+/**
+ * Write every shard of `manifest` (each once; an existing name must already hold exactly those bytes) and return the
+ * record a marker stores. The directory is fsynced before returning, so a marker written afterwards never names a
+ * shard that a crash could lose.
+ */
+export declare function writeChangeManifest(store: ManifestStore, manifest: ChangeManifest): Promise<ChangeManifestRecord>;
+/** Validate a record's shape and root hash (no file access). */
+export declare function assertChangeManifestRecord(value: unknown): asserts value is ChangeManifestRecord;
+/**
+ * Read every entry a record names, verifying each shard's bytes and count, the record's root hash, and that the
+ * entries are in strictly increasing byte order of path across shards (so no path appears twice).
+ */
+export declare function readChangeManifest(store: ManifestStore, record: unknown): Promise<ChangeManifestEntry[]>;

package/dist/local-executor/change-manifest.d.ts

@@ -0,0 +1,50 @@
+import type { ShadowChangeKind } from './shadow-protocol';
+export declare const CHANGE_MANIFEST_VERSION = 1;
+export declare const CHANGE_MANIFEST_SHARD_ENTRIES = 10000;
+/** A content-addressed blob in the task's store (§9.4). Never on the engine wire. */
+export interface BlobRef {
+    blob: string;
+    size: number;
+}
+export interface ChangeManifestEntry {
+    path: string;
+    change_kind: ShadowChangeKind;
+    /** POSIX mode of the reviewed post-image; null for a deletion. */
+    mode: number | null;
+    /** SHA-256 of the pre-task file, or null when the path was absent. */
+    base_hash: string | null;
+    /** The reviewed post-image; null for a deletion. */
+    content: BlobRef | null;
+    /**
+     * The pre-task file's POSIX mode (null when absent). Optional: a team track bundle records it (a merge needs every
+     * track's declared base mode); a single task's manifest omits it and its lines are unchanged.
+     */
+    base_mode?: number | null;
+}
+export interface ChangeManifestShard {
+    /** SHA-256 (hex) of `bytes`; the shard's name in the store. */
+    sha256: string;
+    entries: number;
+    bytes: Buffer;
+}
+export interface ChangeManifest {
+    changeManifest: typeof CHANGE_MANIFEST_VERSION;
+    entries: number;
+    shards: ChangeManifestShard[];
+    /** SHA-256 of the ordered shard hashes, one per line. */
+    rootHash: string;
+}
+export declare function manifestRootHash(shardHashes: readonly string[]): string;
+/**
+ * Build the manifest for a change. Entries are sorted by path (byte order) and must be unique; shards hold at most
+ * `entriesPerShard` entries. Pure — the caller writes the shards (§9.4: each written once, named by its SHA-256).
+ */
+export declare function buildChangeManifest(entries: readonly ChangeManifestEntry[], entriesPerShard?: number): ChangeManifest;
+/**
+ * Parse one shard read back from the store, verifying it against its recorded hash and entry count. A shard whose
+ * bytes, count or any entry does not match is refused — the manifest is authority for what promotion writes.
+ */
+export declare function parseChangeManifestShard(bytes: Buffer, expected: {
+    sha256: string;
+    entries: number;
+}): ChangeManifestEntry[];

package/dist/local-executor/durable-store.d.ts

@@ -1,4 +1,6 @@
 import { type ReviewedShadowDiffFile, type ShadowChangeKind, type ShadowDiffFile } from './workspace-shadow';
+import { type BlobStore } from './blob-store';
+import type { BlobRef } from './change-manifest';
 import { type SnapshotBundlesView, type SnapshotTrackBundle } from './snapshot-merge';
 import type { ImageAttachment } from '../orchestration-shell/types';
 import { type WorkspaceRootAuthority } from './workspace-authority';
@@ -52,12 +54,15 @@ export interface RevertManifestEntry {
     /** How the promote changed the file. */
     changeKind: ShadowChangeKind;
     /**
-     * Where the pre-image CONTENT lives — a `preimages/<sha>.blob` relative ref, OR
-     * the {@link ABSENT_PREIMAGE} marker for a `created` file (nothing to restore).
+     * Where the pre-image CONTENT lives — `content/<blob name>` in the group's content store (§9.4, streamed), a
+     * `preimages/<sha>.blob` relative ref (a record written before Slice 2), OR the {@link ABSENT_PREIMAGE} marker for a
+     * `created` file (nothing to restore).
      */
     preImageRef: string;
     /** SHA-256 of the pre-image content; `null` for an absent (created) file. */
     preImageHash: string | null;
+    /** §9.4 — the pre-image's byte size, for a `content/` reference (its blob reference is `{ preImageHash, size }`). */
+    preImageSize?: number;
     /** POSIX permission bits of the pre-image; `null` when absent. */
     preImageMode: number | null;
     /** SHA-256 of the applied content; `null` for a `deleted` file. */
@@ -201,9 +206,15 @@ export interface PromoteManifestInput {
     promoteOrder: number;
     path: string;
     changeKind: ShadowChangeKind;
-    /** The pre-image content (the file currently on disk); `null` = absent (created). */
-    preImageContent: string | null;
-    /** SHA-256 of `preImageContent`; `null` when absent. */
+    /**
+     * §9.4 — the pre-image (the file currently on disk) as a verified blob in the promoting instance's store; `null` =
+     * absent (created). The store stream-copies it into the group's content store — never as text in memory.
+     */
+    preImage: {
+        store: BlobStore;
+        ref: BlobRef;
+    } | null;
+    /** SHA-256 of the pre-image; `null` when absent. */
     preImageHash: string | null;
     preImageMode: number | null;
     /** SHA-256 of the applied content; `null` for a deleted file. */
@@ -237,8 +248,9 @@ export interface TrackTipsView {
 export declare class RevertManifestStore {
     private readonly rootDir;
     private readonly maxStoreJsonBytes;
-    private readonly maxPreImageAggregateBytes;
     private readonly maxMetadataEntries;
+    /** §9.4 — the bound on a sharded per-path list (bundle file occurrences); the change-set ceiling by default. */
+    private readonly maxChangeSetEntries;
     private readonly maxMetadataPathBytes;
     private readonly beforePreImageOpen?;
     private readonly afterPreImageStat?;
@@ -251,11 +263,9 @@ export declare class RevertManifestStore {
     private readonly failRootDirectorySyncStage;
     private readonly helperTimeoutMs;
     private readonly testHangStoreHelperBeforeReady;
-    private readonly testHangPreImageEnumerationStat;
     private readonly testHangPreImageReadStage;
     private readonly afterAnchoredWriteValidation?;
     private readonly afterJsonAuthorityRead?;
-    private readonly afterPreImageAbsentRead?;
     private readonly beforeMergeFenceAcquire?;
     private anchoredWriteCount;
     /**
@@ -277,10 +287,9 @@ export declare class RevertManifestStore {
         rootDir?: string;
         /** @internal lower deterministic limit for serialized-authority boundary tests. */
         maxStoreJsonBytes?: number;
-        /** @internal lower deterministic aggregate pre-image quota for tests. */
-        maxPreImageAggregateBytes?: number;
         /** @internal lower deterministic shared metadata ceilings for tests. */
         maxMetadataEntries?: number;
+        maxChangeSetEntries?: number;
         maxMetadataPathBytes?: number;
         /** @internal deterministic read-race seam. */
         beforePreImageOpen?: (blobPath: string) => Promise<void> | void;
@@ -306,15 +315,12 @@ export declare class RevertManifestStore {
         helperTimeoutMs?: number;
         /** @internal deterministic blocked store-helper seam. */
         testHangStoreHelperBeforeReady?: boolean;
-        /** @internal deterministic bounded pre-image enumeration/read seams. */
-        testHangPreImageEnumerationStat?: boolean;
+        /** @internal deterministic bounded legacy pre-image read seam. */
         testHangPreImageReadStage?: 'open' | 'read' | 'close';
         /** @internal deterministic prepared-inode replacement seam. */
         afterAnchoredWriteValidation?: (filePath: string) => Promise<void> | void;
         /** @internal deterministic independent-store RMW seam. */
         afterJsonAuthorityRead?: (filePath: string) => Promise<void> | void;
-        /** @internal deterministic content-addressed create race seam. */
-        afterPreImageAbsentRead?: (blobPath: string) => Promise<void> | void;
         /** @internal causal cross-process fence test seam. */
         beforeMergeFenceAcquire?: (taskGroupId: string) => Promise<void> | void;
     });
@@ -325,6 +331,13 @@ export declare class RevertManifestStore {
     listSessionOwnedGroups(): string[];
     /** The per-group directory `<root>/<taskGroupId>/`. */
     private groupDir;
+    /**
+     * P63 Slice 2 (F-S2-5, SB-31) — the group's private state directory for a revert on a no-link volume: the §9.3
+     * journal, the probed apply capabilities and the pre-images as blobs live here so a crashed revert resumes from them.
+     * Created through the same secure, identity-checked mkdir as the group directory and removed with it (GC removes the
+     * whole group tree); `revertGroup` retires its contents once nothing is open.
+     */
+    noLinkRevertStateDir(taskGroupId: string): Promise<string>;
     /**
      * Validate `taskGroupId` is a safe SINGLE path segment so a malicious id can't
      * escape `<root>/` (defense-in-depth; ids are ULIDs server-side, but never
@@ -365,6 +378,19 @@ export declare class RevertManifestStore {
      * NEVER logs file content.
      */
     appendPromote(taskGroupId: string, _trackIndex: number, entries: PromoteManifestInput[]): Promise<void>;
+    /** P63 Slice 2 (§9.4) — the group's blob namespace in its content store. */
+    groupBlobStore(taskGroupId: string): BlobStore;
+    private groupListStore;
+    /**
+     * §9.4 — the record as written: each per-path list (revert promotes, promotion files, reviewed snapshot) replaced by
+     * its sharded-list record, the shards written (and fsynced) first. Validation always runs on the full lists.
+     */
+    private shardRecordLists;
+    /** §9.4 — a record read back: each sharded-list record replaced by its verified list (legacy inline lists as-is). */
+    private expandRecordLists;
+    /** §9.4 — track bundles as written: each bundle's files as a sharded list. */
+    private shardBundleLists;
+    private expandBundleLists;
     private writeRecord;
     /** Read the full unified record, or `null` if none exists. */
     readRecord(taskGroupId: string): Promise<RevertRecordV1 | null>;
@@ -390,7 +416,13 @@ export declare class RevertManifestStore {
      * record is idempotent on `trackIndex`, serialized against sibling tracks,
      * atomic, and removed with the group lifecycle.
      */
-    appendTrackBundle(taskGroupId: string, bundle: SnapshotTrackBundle): Promise<void>;
+    appendTrackBundle(taskGroupId: string, bundle: SnapshotTrackBundle, 
+    /**
+     * §9.4 — the track instance's blob store holding the bundle's reference post-images. Each is stream-copied into the
+     * group's content store BEFORE the bundle record names it, so the merge gate never depends on the track's own copy
+     * (retired with the track). Required when the bundle has reference files.
+     */
+    sourceStore?: BlobStore): Promise<void>;
     readTrackBundles(taskGroupId: string): Promise<SnapshotBundlesView>;
     /**
      * Serialize the complete merge-gate body (including hosted verdict submit)
@@ -421,6 +453,21 @@ export declare class RevertManifestStore {
      * manifest hash and the content-addressed filename must agree before any
      * reverse CAS is allowed to consume these bytes.
      */
+    /**
+     * §9.4 — a revert entry's pre-image as a stream source for the CAS: a `content/` reference resolves to the group's
+     * content store and its verified blob reference (never read whole here; every reader verifies size and hash); a
+     * pre-Slice 2 `preimages/` reference is read through the bounded anchored path as before.
+     */
+    preImageSource(taskGroupId: string, entry: Pick<RevertManifestEntry, 'preImageRef' | 'preImageHash' | 'preImageSize'>): Promise<string | {
+        blob: BlobRef;
+        store: BlobStore;
+    }>;
+    /**
+     * §9.4 — a `content/` pre-image read whole (a legacy caller of `readPreImage`; the revert runner streams through
+     * `preImageSource`): opened no-follow, size and SHA-256 verified before the text is returned, so a replaced, swapped,
+     * grown or symlinked blob is refused.
+     */
+    private readStreamedPreImage;
     readPreImage(taskGroupId: string, preImageRef: string, expectedHash: string): Promise<string>;
     private setLifecycle;
     /** Group accepted/kept → terminal lifecycle `accepted` (GC-eligible). */
@@ -481,6 +528,11 @@ export declare class RevertManifestStore {
      * cannot skip a reverse CAS. Idempotent on the entry key; atomic + append-only.
      */
     recordReverted(taskGroupId: string, relPath: string, promoteOrder: number): Promise<void>;
+    /** {@link recordReverted} for several entries in one journal write (F-CAS-BATCH: a large revert's checkpoint). */
+    recordRevertedMany(taskGroupId: string, entries: ReadonlyArray<{
+        path: string;
+        promoteOrder: number;
+    }>): Promise<void>;
     /** Mark the journal complete (the revert finished this pass). */
     endRevert(taskGroupId: string): Promise<void>;
     /** List every group id with a durable record under `<root>/`. */
@@ -494,6 +546,11 @@ export declare class RevertManifestStore {
      * Returns the ids it removed.
      */
     gc(now?: number, ttlMs?: number, protectedTaskGroupIds?: ReadonlySet<string>): Promise<string[]>;
+    /**
+     * g3paths3: a removal that failed part-way leaves its exact tombstone "for retry", and this is the retry. The orphan
+     * limit is far longer than any helper's deadline, so a tombstone this old has no live removal behind it.
+     */
+    private gcTreeTombstones;
     private gcOneGroup;
     /**
      * Same-session terminal reclamation for one group. This is intentionally

package/dist/local-executor/implementor-argv.d.ts

@@ -175,7 +175,12 @@ export declare function buildImplementorArgv(agent: AgentKind, mode: Implementor
  * summary is an audit-only nicety; the captured diff, not the summary, is the
  * round's contract).
  */
-export declare function readImplementorLastMessage(capturePath: string, workdir?: string): string;
+export declare function readImplementorLastMessage(capturePath: string, workdir?: string, 
+/**
+ * P63 Slice 2 (§8.2) — the host path of the spawn's capture-dir file (`<capture dir>/last-message.txt`) when the
+ * spawn ran with a read-only view; read FIRST. After it is read, its (task-owned, now empty) capture dir is removed.
+ */
+captureHostPath?: string): string;
 /**
  * Positive runtime evidence that this process is ACTUALLY inside a container —
  * the confinement boundary that `CODEVIBE_TRUSTED_CONTAINER` asserts. Docker
@@ -206,6 +211,23 @@ export declare function isInsideContainer(): boolean;
  * container check is injectable for tests.
  */
 export declare function isTrustedContainerBoundary(env?: NodeJS.ProcessEnv, inContainer?: () => boolean): boolean;
+/**
+ * P63 Slice 2 (§8.2) — the outer boundary around one spawn, built from the engager's OWN result (never a
+ * caller-supplied handle): `seatbelt` / `docker` = the CP-7 tier that engaged; `trusted-container` = the marked
+ * dogfood container with no substrate; `bubblewrap` = the Linux tier (typed; the ladder does not select it yet);
+ * `none` = unconfined. `readOnlyView` = that substrate enforces a read-only view of the working directory.
+ */
+export type OuterBoundaryKind = 'none' | 'trusted-container' | 'seatbelt' | 'docker' | 'bubblewrap';
+export interface OuterBoundary {
+    kind: OuterBoundaryKind;
+    readOnlyView: boolean;
+}
+/**
+ * P63 Slice 2 (§8.2) — is this implementor argv a PLAN-mode (read-only) run? Read from the argv itself so a caller
+ * cannot get a writable view for a plan run by omitting the mode: Claude with no write tool in its tool lists, Codex
+ * `--sandbox read-only`, agy `--mode plan`.
+ */
+export declare function isPlanModeImplementorArgv(agent: AgentKind, argv: readonly string[]): boolean;
 /**
  * CP-7 substrate-aware Codex sandbox selection. When an OUTER confinement
  * boundary already isolates the implementor — the CP-7 substrate engaged (Docker
@@ -224,14 +246,21 @@ export declare function isTrustedContainerBoundary(env?: NodeJS.ProcessEnv, inCo
  *
  * NARROW BY DESIGN:
  *   - Only CODEX is affected (Claude + Antigravity have no bwrap inner sandbox).
- *   - Only `workspace-write` (the EXECUTE variant) is rewritten. `read-only`
- *     (PLAN mode) is left untouched — it is a DELIBERATE write restriction, and
- *     `danger-full-access` would let a plan-mode agent write, violating the plan
- *     contract.
+ *   - `workspace-write` (the EXECUTE variant) is rewritten for any boundary.
+ *     `read-only` (PLAN mode) is a DELIBERATE write restriction and is rewritten
+ *     ONLY when the outer boundary itself enforces a read-only view (P63 Slice 2
+ *     §8.2: Seatbelt trailing write deny / Docker `:ro`, kind `seatbelt` or
+ *     `docker` with `readOnlyView`) — there Codex's own read-only sandbox cannot
+ *     start, and the boundary keeps the plan contract instead.
  *   - No-op when `outerBoundaryConfines` is false.
  * Pure; returns a NEW array when it rewrites, the same array otherwise.
  */
-export declare function applyOuterBoundarySandbox(argv: readonly string[], agent: AgentKind, outerBoundaryConfines: boolean): string[];
+export declare function applyOuterBoundarySandbox(argv: readonly string[], agent: AgentKind, 
+/**
+ * P63 Slice 2 (§8.2) — the boundary KIND the engager itself reported. A boolean is the pre-Slice-2 form
+ * (`true` = some confining boundary, no read-only view) and keeps its shipped behaviour.
+ */
+boundary: boolean | OuterBoundary): string[];
 /**
  * A1b (Codex summary never-read fix, WRITE side) — substrate-aware relocation
  * of the Codex `--output-last-message` value. Mirrors the reviewer provider's
@@ -262,7 +291,14 @@ export declare function applyOuterBoundarySandbox(argv: readonly string[], agent
  *     rewritten argv still passes `enforceCommand` (drift-guard-tested).
  * Pure; returns a NEW array when it rewrites, a copy otherwise.
  */
-export declare function relocateCodexLastMessageForSubstrate(argv: readonly string[], agent: AgentKind, substrateEngaged: boolean): string[];
+export declare function relocateCodexLastMessageForSubstrate(argv: readonly string[], agent: AgentKind, substrateEngaged: boolean, 
+/**
+ * P63 Slice 2 (§8.2) — with a read-only view the workdir cannot take the file: the ABSOLUTE path codex should write
+ * instead, inside the spawn's capture dir as the sandbox sees it (Docker: `/codevibe-capture/last-message.txt`).
+ */
+captureTarget?: string): string[];
+/** P63 Slice 2 (§8.2) — the plan file's name inside a spawn's capture dir. */
+export declare const CAPTURE_LAST_MESSAGE_FILE = "last-message.txt";
 /**
  * Authority `commandAllowlist` entries covering EVERY (agent, mode) argv
  * `buildImplementorArgv` can produce. The single-impl + team LEs seed this