@rig-c/review 0.8.1 → 0.10.0

package/src/rebuild.ts

@@ -10,7 +10,7 @@
  */
 import { createHash } from 'node:crypto';
 import { existsSync } from 'node:fs';
-import { copyFile, mkdir, readFile, readdir, realpath, rm, writeFile, lstat } from 'node:fs/promises';
+import { copyFile, mkdir, readFile, readdir, realpath, rename, rm, writeFile, lstat } from 'node:fs/promises';
 import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { object, packagePath, safeFile, type ReviewPackage } from './manifest.ts';
 import { compileArgs, firstRefusal, modelingProducerTooOld, REMESH_DELTA_SINCE, remeshArgs, remeshDeltaArgs, resolvePose, resolveProducer, runTool, versionAtLeast, type CompileRequest, type InstalledTool, type ProcessResult } from './producer.ts';
@@ -24,11 +24,14 @@ import { CHEST_REGIONS_MAX } from './chest-regions.ts';
 import { bustMeshEntry, deriveBust, parseBustSpec, BustSpecError, type BustSpec } from './chest-landmarks.ts';
 import { modelMeshTriangles, remeshCounts, type RemeshCounts } from './mesh-entry.ts';
 import { patchRoute } from './retune-route.ts';
-import { carriedCheck, RETUNE_CHECK_SINCE, RETUNE_FILE, retuneCheckSummary, revisionBinding } from './retune-check.ts';
+import { producerHint } from './baseline-reach.ts';
+import { carriedCheck, carriedCheckSummary, type CarryingOp, provenanceFile, REMESH_CHECK_SINCE, RETUNE_CHECK_SINCE, revisionBinding } from './retune-check.ts';
 import { absolutizeBuildFiles, buildLines, buildNamedFiles, buildReadout, MAX_BUILD_READOUT, needsBuild, newBuildFile, recompositeFigures, type RecompositeFigures } from './build-route.ts';
 import { jsonDiff } from './config-patch.ts';
 import { CLOTH_KEYPOINTS_UNDECLARED, CLOTH_PATCH_MIXED, CLOTH_SOURCE_UNAVAILABLE, CLOTH_WRITE_SINCE, clothLinks, clothPatchKind, readClothTargets, writtenDiff, type ClothTagView, type WrittenDiff } from './cloth-recipe.ts';
 import { CHECK_ENVIRONMENT_SINCE, parseSchedule, ScheduleError, scheduleText } from './environment-schedule.ts';
+import { availableParallelism } from 'node:os';
+import { candidateRow, DENSITY_STRIP_SCHEMA, DensityStripError, stripLabels, stripPatches, stripShape, type DensityField, type StripRow } from './density-strip.ts';
 import { samplesClock } from './frame-clock.ts';
 import { cleanArgs, mapText, motionSummary, parseRetargetRequest, retargetArgs, retargetLines, retargetRecord, retargetRecordText, RetargetError, type MotionSummary, type RetargetLine, type RetargetRecord } from './retarget.ts';
 
@@ -201,6 +204,25 @@ export function designationId(input: { sourceHash: string; configHash: string; p
 }
 export const rebuildRoot = (stateDir: string, sourceHash: string) => join(stateDir, 'rebuild', sourceHash);
 export const rebuildDir = (stateDir: string, sourceHash: string, id: string) => join(rebuildRoot(stateDir, sourceHash), id);
+/**
+ * #166: where the applied records' earlier builds wait for an undo — outside the scratch root, so the scratch root still
+ * holds only the build on the stage. At most `MAX_KEPT_BUILDS` builds are on disk per package (the stage's included);
+ * an older record's build is evicted, and undoing to it re-runs its producer step from the record.
+ */
+export const keptRoot = (stateDir: string, sourceHash: string) => join(stateDir, 'rebuild-kept', sourceHash);
+export const MAX_KEPT_BUILDS = 8;
+/** The undo refusal: the predecessor cannot be restored byte for byte, and review does not guess. */
+export const UNDO_PREDECESSOR_CHANGED = 'UNDO_PREDECESSOR_CHANGED';
+/** One applied record of the session's stack (#166): the request as sent (to re-run it), its inputs and its build by hash. */
+export interface AppliedEntry {
+  id: string; body: unknown; configHash: string;
+  producer: { package: string; version: string }; compiler: { package: string; version: string };
+  files: Record<string, string>; modelHash: string;
+  /** The job as it settled, served back on undo. */
+  job: RebuildJob | PatchJob | DeltaJob | RetargetJob;
+}
+/** `GET /api/rebuild/history`: the applied records in order, the last one on the stage; `kept`: its build is still on disk. */
+export interface AppliedHistory { schema: 'rig-review-applied-history/1'; depth: number; records: { id: string; kind: 'regions' | 'patch' | 'delta' | 'retarget'; op: string; what: string; modelHash: string; kept: boolean }[] }
 
 export type RebuildStatus = 'running' | 'built' | 'refused' | 'failed';
 export interface RebuildBuild { model: string; modelUrl: string; modelHash: string; files: Record<string, string> }
@@ -210,6 +232,8 @@ export interface RebuildJob {
   producer: { package: string; version: string }; compiler: { package: string; version: string };
   lines: string[]; producerLine: string | null; exitCode: number | null; wallMs: { remesh: number | null; compile: number | null };
   build: RebuildBuild | null;
+  /** #148: review's reading of a producer refusal it can explain (`producerHint`), beside the producer's line; absent otherwise. */
+  hint?: string;
 }
 /**
  * A patch Apply (#102): the config patch, its hash and the config bytes it was made against; the op's, the compile's
@@ -223,6 +247,8 @@ export interface PatchJob {
   request: { patch: ConfigPatch; patchSha256: string; configHash: string };
   producer: { package: string; version: string }; compiler: { package: string; version: string };
   lines: string[]; producerLine: string | null; exitCode: number | null; wallMs: { op: number | null; compile: number | null; check: number | null };
+  /** #148: as `RebuildJob.hint`. */
+  hint?: string;
   check: CheckSummary | null; diff: { count: number; paths: string[] } | null;
   /** #125: the per-file diff of every producer document (`src/producer-files.ts`) and the images by hash. */
   files: FilesDiff | null;
@@ -340,6 +366,8 @@ export interface DeltaJob {
   request: { part: string; delta: Record<string, unknown>; deltaSha256: string; configHash: string };
   producer: { package: string; version: string }; compiler: { package: string; version: string };
   lines: string[]; producerLine: string | null; exitCode: number | null; wallMs: { op: number | null; compile: number | null };
+  /** #148: as `RebuildJob.hint`. */
+  hint?: string;
   files: FilesDiff | null;
   remesh: (RemeshCounts & { modelTriangles: number | null }) | null;
   build: RebuildBuild | null;
@@ -374,7 +402,24 @@ export function assertNamedFilesHeld(before: unknown, after: unknown): void {
 /** The value of a flag in the patch's args, or the producer's default. */
 const flagValue = (args: readonly string[], flag: string, fallback: string) => { const i = args.indexOf(flag); return i >= 0 ? args[i + 1]! : fallback; };
 
-export interface RebuildOptions { stateDir: string; starts: readonly string[]; unchanged: () => Promise<void>; bones: readonly string[] | null }
+export interface RebuildOptions {
+  stateDir: string; starts: readonly string[]; unchanged: () => Promise<void>; bones: readonly string[] | null;
+  /** #173: how many strip candidates run at once (default max(1, floor(cores / 2))). */
+  stripConcurrency?: number;
+}
+/** #173: a density strip's scratch — one folder per package, holding at most the one strip on screen. */
+export const stripRoot = (stateDir: string, sourceHash: string) => join(stateDir, 'density-strip', sourceHash);
+export const defaultStripConcurrency = () => Math.max(1, Math.floor(availableParallelism() / 2));
+/** Deterministic: the package, the config bytes, every candidate's patch bytes in order and both tool versions. */
+export function stripId(input: { sourceHash: string; configHash: string; patches: readonly ConfigPatch[]; producer: string; compiler: string }): string {
+  return sha256(JSON.stringify([DENSITY_STRIP_SCHEMA, input.sourceHash, input.configHash, input.patches.map(patchText), input.producer, input.compiler]));
+}
+/** `GET /api/density-strip/<id>`: the strip, one row per candidate in the request's order, and the two labels. */
+export interface DensityStripView {
+  schema: typeof DENSITY_STRIP_SCHEMA; id: string; status: 'running' | 'done'; part: string; field: DensityField;
+  concurrency: number; configHash: string; producer: { package: string; version: string }; compiler: { package: string; version: string };
+  wallMs: number | null; rows: StripRow[]; labels: { fewest: number | null; widest: number | null };
+}
 export const baselineDir = (stateDir: string, key: string) => join(stateDir, 'baseline', key);
 
 const tool = (t: InstalledTool) => ({ package: t.package, version: t.version });
@@ -405,7 +450,7 @@ interface ApplySteps {
   /** #102: check the scratch rig after the compile. */
   check?: (summary: CheckSummary, wallMs: number | null) => void;
   /**
-   * #139: the check the producer op already ran on the spec it wrote, read instead of running check again: a summary
+   * #139 / #174: the check the producer op (retune, remesh) already ran on the spec it wrote, read instead of running check again: a summary
    * (recorded through `check`, no wall clock), a refusal line (nothing recorded, the build refused), or null — the op
    * carries none, so check runs as for any other Apply.
    */
@@ -414,24 +459,31 @@ interface ApplySteps {
   hashed?: () => Promise<void>;
   /** #112: the schedule check reads (`--environment environment.json`, written into the scratch directory first). */
   world?: ApplyWorld | null;
+  /**
+   * #173: a density strip's candidate — built and hashed and its result.json written exactly as an Apply's, but it does
+   * not land: no applied record, no stage, no scratch-root arrangement. Its build waits in the strip's own folder.
+   */
+  candidate?: boolean;
 }
 
 /**
- * #139: the check `rig-parts retune` ran on the revision it wrote into `spec`, as review's check summary, bound to the
- * revision's files by `retune.json`'s hash rows (`RETUNE_CHECK_STALE` refuses the Apply). Null — check runs as before —
- * when the Apply checks under an exported world (retune's check read the default one) or `retune.json` carries no
- * `line` / `status` (a producer before `RETUNE_CHECK_SINCE`).
+ * #139 / #174: the check `rig-parts retune` (or `remesh`) ran on the revision it wrote into `spec`, as review's check
+ * summary, bound to the revision's files by the provenance's hash rows (`RETUNE_CHECK_STALE` / `REMESH_CHECK_STALE`
+ * refuses the Apply). Null — check runs as before — when the Apply checks under an exported world (the op's check read
+ * the default one) or the provenance carries no `line` / `status` (a producer before `RETUNE_CHECK_SINCE` /
+ * `REMESH_CHECK_SINCE`, both 1.49.0).
  */
-async function retuneCarried(spec: string, world: ApplyWorld | null, push: (line: string) => void): Promise<{ summary: CheckSummary } | { refused: string } | null> {
-  if (world) { push('review: retune\'s own check read the default world and this Apply checks under the exported schedule, so check runs on the revision'); return null; }
-  const retune = JSON.parse(await readFile(join(spec, RETUNE_FILE), 'utf8')) as unknown;
-  const carried = carriedCheck(retune);
-  if (!carried) { push(`review: ${RETUNE_FILE} carries no check line or block statuses (@rig-c/parts before ${RETUNE_CHECK_SINCE}), so check runs on the revision`); return null; }
-  const stale = await revisionBinding(spec, retune);
+async function opCarried(op: CarryingOp, spec: string, world: ApplyWorld | null, push: (line: string) => void): Promise<{ summary: CheckSummary } | { refused: string } | null> {
+  const file = provenanceFile(op);
+  if (world) { push(`review: ${op}'s own check read the default world and this Apply checks under the exported schedule, so check runs on the revision`); return null; }
+  const provenance = JSON.parse(await readFile(join(spec, file), 'utf8')) as unknown;
+  const carried = carriedCheck(provenance, op);
+  if (!carried) { push(`review: ${file} carries no check line or block statuses (@rig-c/parts before ${op === 'retune' ? RETUNE_CHECK_SINCE : REMESH_CHECK_SINCE}), so check runs on the revision`); return null; }
+  const stale = await revisionBinding(spec, provenance, op);
   if (stale) return { refused: stale };
-  const rows = (retune as { revision: unknown[] }).revision.length;
-  push(`review: check not run again — ${RETUNE_FILE} carries retune's check of this revision, bound to it by ${rows} revision hash row(s): ${carried.line}`);
-  return { summary: retuneCheckSummary(carried) };
+  const rows = (provenance as { revision: unknown[] }).revision.length;
+  push(`review: check not run again — ${file} carries ${op}'s check of this revision, bound to it by ${rows} revision hash row(s): ${carried.line}`);
+  return { summary: carriedCheckSummary(carried, op) };
 }
 
 /** #115: what a build-routed patch runs with — the handoff's painting and runs, absolute; never from the client. */
@@ -485,6 +537,16 @@ async function hashBuild(build: string, id: string): Promise<RebuildBuild> {
 export function createRebuilds(p: ReviewPackage, options: RebuildOptions) {
   const jobs = new Map<string, RebuildJob | PatchJob | DeltaJob | RetargetJob>();
   let running: string | null = null;
+  /** #173: the density strip on screen (at most one per review): its candidates run beside each other, none of them applied. */
+  interface StripCandidate { value: number; id: string; entry: JsonValue; dir: string; job: PatchJob; applied: boolean }
+  let strip: { id: string; status: 'running' | 'done'; part: string; field: DensityField; concurrency: number; configHash: string; producer: { package: string; version: string }; compiler: { package: string; version: string }; started: number; wallMs: number | null; candidates: StripCandidate[] } | null = null;
+  /** One producer workload at a time per review: an Apply (or undo's re-run) or a strip; the line refusing the other. */
+  const busy = (): string | null => (running ? `REBUILD_BUSY: rebuild ${running} is still running` : strip?.status === 'running' ? `REBUILD_BUSY: density strip ${strip.id} is still running` : null);
+  /** #166: the session's applied records, in order; the last is on the stage. The request bodies by job id. */
+  const stack: AppliedEntry[] = [];
+  const bodies = new Map<string, unknown>();
+  /** #166: an undo re-running an evicted predecessor: its id and the build files it must reproduce. */
+  let restoring: { id: string; files: Record<string, string> } | null = null;
   const snapshot = <J extends RebuildJob | PatchJob | DeltaJob | RetargetJob>(job: J): J => ({ ...job, lines: [...job.lines] });
 
   /** The state directory may not sit inside the package or the handoff's root (the parent of an opened out/). */
@@ -503,7 +565,7 @@ export function createRebuilds(p: ReviewPackage, options: RebuildOptions) {
     try { assertStateOutside(); } catch { return null; }
     const handoff = p.handoff, key = baselineKey(p.sourceHash, handoff, resolved.producer, resolved.compiler), rig = handoff.rig ?? p.root;
     const show = (rel: string) => relative(p.root, join(rig, rel)).split(sep).join('/');
-    baseline = { schema: 'rig-review-baseline/1', key, status: 'running', producer: tool(resolved.producer), firstDifference: null, hashes: null, line: `baseline: running ${resolved.producer.package} ${resolved.producer.version} rig into scratch…`, exitCode: null, wallMs: null };
+    baseline = { schema: 'rig-review-baseline/1', key, status: 'running', producer: tool(resolved.producer), firstDifference: null, hashes: null, reach: null, line: `baseline: running ${resolved.producer.package} ${resolved.producer.version} rig into scratch…`, exitCode: null, wallMs: null };
     const started = baseline;
     baselineRun = runBaseline(baselineDir(options.stateDir, key), key, handoff, resolved.producer, show)
       .catch((error): BaselineResult => ({ ...started, status: 'failed', line: `baseline: failed — ${error instanceof Error ? error.message : String(error)}` }))
@@ -584,6 +646,121 @@ export function createRebuilds(p: ReviewPackage, options: RebuildOptions) {
     const dir = job ? rebuildDir(options.stateDir, p.sourceHash, job.id) : '';
     return job && job.status === 'built' && job.build ? { id: job.id, build: join(dir, 'build'), modelHash: job.build.modelHash, spec: join(dir, !('kind' in job) ? 'revision' : job.op === 'build' || (job.kind === 'patch' && job.cloth?.route === 'build') ? 'out/rig' : 'rig') } : null;
   }
+  /**
+   * #166: the line refusing an undo's re-run whose build is not the one its record names (the first differing file by
+   * hash), or null — also null for any job that is not an undo's re-run.
+   */
+  function restoredDifference(id: string, files: Record<string, string>): string | null {
+    if (restoring?.id !== id) return null;
+    const names = [...new Set([...Object.keys(restoring.files), ...Object.keys(files)])].sort();
+    const file = names.find(n => restoring!.files[n] !== files[n]);
+    if (!file) return null;
+    const side = (h: string | undefined) => (h ? `${h.slice(0, 12)}…` : 'absent'), recorded = restoring.files[file];
+    restoring = null;
+    return `${UNDO_PREDECESSOR_CHANGED}: ${file} — the record's build has sha256 ${side(recorded)}, the re-run wrote ${side(files[file])}; the predecessor cannot be restored byte for byte, so the stage stays on the last Apply`;
+  }
+  /** #166: an undo's re-run computed another build id than its record's — some input it hashes is not what it was. */
+  function guardRestore(id: string): void {
+    if (!restoring || restoring.id === id) return;
+    const was = restoring.id; restoring = null;
+    throw new RebuildError(UNDO_PREDECESSOR_CHANGED, `build id ${was.slice(0, 12)}… → ${id.slice(0, 12)}… — an input the record's build id hashes (the package, the handoff config, the build's painting, runs or named files, the keypoints, the producer or the compiler) is not what it was; the stage stays on the last Apply`);
+  }
+  /** #166: a kept build asked for again moves back into the scratch root (where reuse reads it). */
+  async function unkeep(id: string): Promise<void> {
+    const from = join(keptRoot(options.stateDir, p.sourceHash), id), to = rebuildDir(options.stateDir, p.sourceHash, id);
+    if (!(await exists(from))) return;
+    if (await exists(to)) { await rm(from, { recursive: true, force: true }); return; }
+    await mkdir(rebuildRoot(options.stateDir, p.sourceHash), { recursive: true, mode: 0o700 });
+    await rename(from, to);
+  }
+  /**
+   * #166: a built (or reused) Apply lands on the stack — or, for an undo's re-run or reuse of the predecessor, the undone
+   * record leaves it — and the scratch tree is arranged: the stage's build in the scratch root, the other records' most
+   * recent `MAX_KEPT_BUILDS - 1` builds in keptRoot, every other build removed.
+   */
+  async function landed(job: RebuildJob | PatchJob | DeltaJob | RetargetJob): Promise<void> {
+    if (restoring?.id === job.id) { stack.pop(); restoring = null; }
+    else if (stack.at(-1)?.id !== job.id && job.build) stack.push({ id: job.id, body: bodies.get(job.id) ?? null, configHash: job.request.configHash, producer: { ...job.producer }, compiler: { ...job.compiler }, files: { ...job.build.files }, modelHash: job.build.modelHash, job: snapshot(job) });
+    latestId = stack.at(-1)?.id ?? null;
+    await arrange();
+  }
+  async function arrange(): Promise<void> {
+    const root = rebuildRoot(options.stateDir, p.sourceHash), kept = keptRoot(options.stateDir, p.sourceHash);
+    const top = stack.at(-1)?.id ?? null, order: string[] = [];
+    for (let i = stack.length - 2; i >= 0; i--) { const id = stack[i]!.id; if (id !== top && !order.includes(id)) order.push(id); }
+    const keep = new Set(order.slice(0, MAX_KEPT_BUILDS - 1));
+    const list = async (dir: string) => { try { return (await readdir(dir)).filter(n => /^[a-f0-9]{64}$/.test(n)); } catch (e) { if ((e as NodeJS.ErrnoException).code === 'ENOENT') return []; throw e; } };
+    if (top) await unkeep(top);
+    for (const id of await list(root)) {
+      if (id === top) continue;
+      if (keep.has(id) && !(await exists(join(kept, id)))) { await mkdir(kept, { recursive: true, mode: 0o700 }); await rename(join(root, id), join(kept, id)); }
+      else await rm(join(root, id), { recursive: true, force: true });
+      jobs.delete(id);
+    }
+    for (const id of await list(kept)) if (!keep.has(id)) await rm(join(kept, id), { recursive: true, force: true });
+  }
+  /** `GET /api/rebuild/history` (#166). */
+  async function history(): Promise<AppliedHistory> {
+    const records: AppliedHistory['records'] = [];
+    for (const [i, e] of stack.entries()) {
+      const job = e.job, last = i === stack.length - 1;
+      const kind = !('kind' in job) ? 'regions' as const : job.kind;
+      const what = !('kind' in job) ? `${job.request.bust ? 'contour.bust landmarks' : `${job.request.regions.length} region(s)`} on ${job.request.part}`
+        : job.kind === 'patch' ? job.request.patch.ops.map(o => `${o.op} ${o.path}`).slice(0, 3).join(', ') + (job.request.patch.ops.length > 3 ? `, +${job.request.patch.ops.length - 3}` : '')
+        : job.kind === 'delta' ? `mesh edit on ${job.request.part}` : `retarget "${job.request.record.flags.animation}"`;
+      const kept = await exists(join(last ? rebuildRoot(options.stateDir, p.sourceHash) : keptRoot(options.stateDir, p.sourceHash), e.id));
+      records.push({ id: e.id, kind, op: 'op' in job ? job.op : 'remesh', what, modelHash: e.modelHash, kept });
+    }
+    return { schema: 'rig-review-applied-history/1', depth: stack.length, records };
+  }
+  /**
+   * `POST /api/rebuild/undo` with `{from}` (#166): the last applied record leaves the stack and the stage returns to its
+   * predecessor's build, or to the inspected build when none is left. `from` is the record the page shows on the stage
+   * (`UNDO_STALE` otherwise). A kept predecessor is restored from disk after its files are re-hashed against its record;
+   * an evicted one re-runs its recorded request through the same runner, refused before anything runs when the handoff
+   * config or a tool version is not the record's, and refused after when the build is not byte-identical — either way
+   * `UNDO_PREDECESSOR_CHANGED: <what>`, the stage left on the last Apply. Undo writes nothing into the package.
+   */
+  async function undo(input: unknown): Promise<{ status: number; body: unknown }> {
+    const v = object(input, 'undo');
+    if (Object.keys(v).join(',') !== 'from' || typeof v.from !== 'string' || !/^[a-f0-9]{64}$/.test(v.from)) bad('expected exactly {from: <the build id on the stage>}');
+    assertStateOutside();
+    if (busy()) return { status: 200, body: { status: 'refused', error: busy(), producerLine: null } };
+    const top = stack.at(-1);
+    if (!top) throw new RebuildError('UNDO_NOTHING_APPLIED', 'no Apply is on the stage; the inspected build is');
+    if (top.id !== v.from) throw new RebuildError('UNDO_STALE', `the stage's last Apply is ${top.id.slice(0, 12)}…, not ${String(v.from).slice(0, 12)}…; reload`);
+    const pred = stack.at(-2);
+    if (!pred) { stack.pop(); latestId = null; await arrange(); return { status: 200, body: { status: 'inspected', undone: top.id, history: await history() } }; }
+    // (i) the kept build: back into the scratch root, re-hashed against result.json and against the record.
+    await unkeep(pred.id);
+    const dir = rebuildDir(options.stateDir, p.sourceHash, pred.id);
+    const kept = await reuse<RebuildJob | PatchJob | DeltaJob | RetargetJob>(dir, pred.id);
+    if (kept && JSON.stringify(kept.build!.files) === JSON.stringify(pred.files)) {
+      jobs.set(pred.id, kept); stack.pop(); latestId = pred.id; await arrange();
+      return { status: 200, body: { status: 'built', undone: top.id, job: snapshot(kept), history: await history() } };
+    }
+    await rm(dir, { recursive: true, force: true });
+    // (ii) evicted (or not its record's bytes): re-run the record's request, only on the inputs it was built from.
+    if (pred.body === null) throw new RebuildError(UNDO_PREDECESSOR_CHANGED, `${pred.id.slice(0, 12)}… — the record carries no request to re-run and its build is gone`);
+    const handoff = p.handoff;
+    if (handoff) {
+      let now = 'unreadable';
+      try { now = sha256(await readFile(handoff.config)); } catch { /* named below */ }
+      if (now !== pred.configHash) throw new RebuildError(UNDO_PREDECESSOR_CHANGED, `${handoff.record.config.path} sha256 ${pred.configHash.slice(0, 12)}… → ${now === 'unreadable' ? now : `${now.slice(0, 12)}…`}; the evicted build was made from the config as it was`);
+    }
+    const retargeting = 'kind' in pred.job && pred.job.kind === 'retarget';
+    const resolved = retargeting ? resolvePose(options.starts) : resolveProducer(options.starts);
+    if (!resolved.ok) throw new RebuildError(UNDO_PREDECESSOR_CHANGED, `${pred.producer.package} ${pred.producer.version} → ${resolved.error}`);
+    for (const [was, now] of [[pred.producer, resolved.producer], [pred.compiler, resolved.compiler]] as const) {
+      if (was.package !== now.package || was.version !== now.version) throw new RebuildError(UNDO_PREDECESSOR_CHANGED, `${was.package} ${was.version} → ${now.package} ${now.version}; the evicted build was made with the version its record names`);
+    }
+    restoring = { id: pred.id, files: { ...pred.files } };
+    let started: { status: number; body: unknown };
+    try { started = await start(pred.body); } catch (e) { restoring = null; throw e; }
+    const body = started.body as { id?: string; status?: string };
+    if (body.id !== pred.id) { restoring = null; return started; }
+    return { status: started.status, body: { status: body.status === 'running' ? 'running' : body.status, undone: top.id, job: body, ...(body.status === 'running' ? {} : { history: await history() }) } };
+  }
   /** The baseline once it settles (tests, and the whole-rig ops of #102/#103 through assertWholeRigBaseline). */
   async function settledBaseline(): Promise<BaselineResult | null> { if (!baselineRun) ensureBaseline(resolveProducer(options.starts)); return baselineRun ? await baselineRun : baseline; }
 
@@ -609,7 +786,8 @@ export function createRebuilds(p: ReviewPackage, options: RebuildOptions) {
   /**
    * The tail every Apply shares (#121), once its producer op has written a rig spec into `<dir>/<op.spec>`: the per-file
    * diff when asked (#125), the compile with the revision's own pack flags, check when asked (#102), the build hashed,
-   * result.json written, the package's other scratch builds replaced; anything but a built job leaves nothing behind.
+   * result.json written, the package's other scratch builds replaced (#166: the applied records' earlier builds kept
+   * beside the scratch root for undo); anything but a built job leaves nothing behind.
    * Each runner passes only its producer op and the optional steps it records.
    */
   async function apply(job: RebuildJob | PatchJob | DeltaJob | RetargetJob, dir: string, inputs: ProducerInputs, resolved: Resolved, op: ProducerOp, steps: ApplySteps = {}): Promise<void> {
@@ -620,7 +798,13 @@ export function createRebuilds(p: ReviewPackage, options: RebuildOptions) {
       await mkdir(dir, { recursive: true, mode: 0o700 });
       const run = await op.run(push);
       job.exitCode = run.exitCode; op.wallMs(run.wallMs);
-      if (run.exitCode !== 0) { job.producerLine = firstRefusal(run.lines) ?? `${op.tool ?? 'rig-parts'} ${op.cmd} exited ${run.exitCode} without a named refusal`; job.status = 'refused'; return; }
+      if (run.exitCode !== 0) {
+        job.producerLine = firstRefusal(run.lines) ?? `${op.tool ?? 'rig-parts'} ${op.cmd} exited ${run.exitCode} without a named refusal`;
+        // #148: the producer's line stays as printed; review adds what it means here, when it knows.
+        const hint = producerHint(job.producerLine);
+        if (hint && !('refusals' in job)) { (job as RebuildJob | PatchJob | DeltaJob).hint = hint; push(`review: ${hint}`); }
+        job.status = 'refused'; return;
+      }
       job.producerLine = run.stdout.filter(l => l.trim()).at(-1)?.trim() ?? null;
       const { pageEdges, packShape, note } = await op.flags(push);
       if (steps.diff) {
@@ -652,15 +836,20 @@ export function createRebuilds(p: ReviewPackage, options: RebuildOptions) {
       try { await options.unchanged(); } catch { throw new RebuildError('REBUILD_INPUTS_CHANGED', 'the package or its producer handoff changed during the rebuild'); }
       job.build = await hashBuild(join(dir, 'build'), job.id);
       if (steps.hashed) await steps.hashed();
-      latestId = job.id;
+      // #166: an undo's re-run must reproduce the build its record names, file for file; otherwise it is refused, not guessed.
+      const changed = steps.candidate ? null : restoredDifference(job.id, job.build.files);
+      if (changed) { job.producerLine = changed; job.status = 'refused'; push(`review: ${changed}`); return; }
+      if (!steps.candidate) latestId = job.id;
       await writeFile(join(dir, 'result.json'), JSON.stringify({ ...job, status: 'built', reused: false }, null, 1) + '\n', { mode: 0o600 });
-      // Each Apply replaces the previous scratch build of this package.
-      for (const sibling of await readdir(rebuildRoot(options.stateDir, p.sourceHash))) if (sibling !== job.id && /^[a-f0-9]{64}$/.test(sibling)) { await rm(join(rebuildRoot(options.stateDir, p.sourceHash), sibling), { recursive: true, force: true }); jobs.delete(sibling); }
+      // Each Apply replaces the previous scratch build of this package in the scratch root; #166 keeps the applied records'
+      // earlier builds beside it (keptRoot) for undo. #173: a strip candidate lands nowhere until its row is Applied.
+      if (!steps.candidate) await landed({ ...job, status: 'built' });
       // "built" is published last: a reader that sees it finds the scratch root already settled (no sibling mid-removal).
       job.status = 'built';
     } catch (error) {
       job.status = 'failed'; job.producerLine = error instanceof Error ? error.message : String(error); push(`review: ${job.producerLine}`);
     } finally {
+      if (restoring?.id === job.id && job.status !== 'built') restoring = null;
       // Only a built Apply keeps its scratch directory; a refusal or failure leaves nothing behind.
       if (job.status !== 'built') await rm(dir, { recursive: true, force: true }).catch(() => {});
     }
@@ -687,7 +876,7 @@ export function createRebuilds(p: ReviewPackage, options: RebuildOptions) {
    * #102: the patched config → `rig-parts rig` (whole rig), `retune` (#136: the constraints and the idle spliced onto the
    * inspected rig) or `remesh` (one part's patched entry) → `<dir>/rig`; the tail adds the diff and check.
    */
-  function executePatch(job: PatchJob, dir: string, inputs: ProducerInputs, resolved: Resolved, patched: JsonValue, part: string | null, plan: BuildPlan | null = null, world: ApplyWorld | null = null, cloth: ClothPlan | null = null): Promise<void> {
+  function executePatch(job: PatchJob, dir: string, inputs: ProducerInputs, resolved: Resolved, patched: JsonValue, part: string | null, plan: BuildPlan | null = null, world: ApplyWorld | null = null, cloth: ClothPlan | null = null, candidate = false): Promise<void> {
     const args = job.request.patch.op.args, producer = resolved.producer;
     let counts: RemeshCounts | null = null;
     let built: ProcessResult | null = null;
@@ -799,9 +988,12 @@ export function createRebuilds(p: ReviewPackage, options: RebuildOptions) {
       ...(building ? {} : { check: (summary: CheckSummary, wallMs: number | null) => { job.wallMs.check = wallMs; job.check = summary; } }),
       // #139: a retune Apply reads the check retune ran on its revision (retune.json, bound by its hash rows) unless the
       // Apply checks under an exported world (retune's check reads the default one) or the producer carries no line.
-      ...(job.op === 'retune' ? { carried: (push: (line: string) => void) => retuneCarried(join(dir, 'rig'), world, push) } : {}),
+      // #174: a remesh patch the same, from remesh.json — remesh checked the revision with the request's pack flags,
+      // the ones `flags` reads for review's own check, and the same `--parts`; a patch passes no `--requirements`.
+      ...(job.op === 'retune' || job.op === 'remesh' ? { carried: (push: (line: string) => void) => opCarried(job.op as CarryingOp, join(dir, 'rig'), world, push) } : {}),
       hashed: async () => { if (counts) job.remesh = { ...counts, modelTriangles: modelMeshTriangles(JSON.parse(await readFile(join(dir, 'build', 'skeleton.model.json'), 'utf8')), counts.part) }; },
       world,
+      ...(candidate ? { candidate: true } : {}),
     });
   }
 
@@ -811,7 +1003,7 @@ export function createRebuilds(p: ReviewPackage, options: RebuildOptions) {
    * on a producer that has it (#136, `src/retune-route.ts`); any other `rig` patch rebuilds the whole rig and first needs
    * the baseline to have reproduced the inspected rig (`EDIT_BASELINE_MISMATCH` naming the path). Refusals come before anything is run.
    */
-  async function startPatch(input: unknown, world: ApplyWorld | null = null): Promise<{ status: number; body: unknown }> {
+  async function startPatch(input: unknown, world: ApplyWorld | null = null, body: unknown = { patch: input }): Promise<{ status: number; body: unknown }> {
     let patch: ConfigPatch;
     try { patch = parseConfigPatch(input); } catch (e) { if (e instanceof ConfigPatchError) throw new RebuildError(e.code, e.message.slice(e.code.length + 2)); throw e; }
     assertStateOutside();
@@ -866,19 +1058,130 @@ export function createRebuilds(p: ReviewPackage, options: RebuildOptions) {
     const id = patchId({ sourceHash: p.sourceHash, configHash: inputs.configHash, patch, producer: `${resolved.producer.package}@${resolved.producer.version}`, compiler: `${resolved.compiler.package}@${resolved.compiler.version}`, op, ...(plan ? { buildInputs: plan.inputsHash } : {}), ...(world ? { environment: world.record.sha256 } : {}), ...(clothPlan ? { cloth: p.handoff!.record.keypoints!.sha256 } : {}) });
     const current = jobs.get(id);
     if (current?.status === 'running') return { status: 202, body: snapshot(current) };
-    if (running) return { status: 200, body: { status: 'refused', error: `REBUILD_BUSY: rebuild ${running} is still running`, producerLine: null } };
+    if (busy()) return { status: 200, body: { status: 'refused', error: busy(), producerLine: null } };
+    guardRestore(id);
     const dir = rebuildDir(options.stateDir, p.sourceHash, id);
+    await adopt(id);
+    await unkeep(id);
     const reused = await reuse<PatchJob>(dir, id);
-    if (reused) { jobs.set(id, reused); latestId = id; return { status: 200, body: snapshot(reused) }; }
+    if (reused) { jobs.set(id, reused); latestId = id; bodies.set(id, body); await landed(reused); return { status: 200, body: snapshot(reused) }; }
     const job: PatchJob = { schema: REBUILD_SCHEMA, kind: 'patch', id, status: 'running', reused: false, op, request: { patch, patchSha256: patchSha256(patch), configHash: inputs.configHash }, producer: tool(resolved.producer), compiler: tool(resolved.compiler), lines: [], producerLine: null, exitCode: null, wallMs: { op: null, compile: null, check: null }, check: null, diff: null, files: null, remesh: null, build: null,
       ...(plan ? { assembled: { inputs: plan.inputs, refusals: [], checkFails: [], lines: [], seam: [], seamPairs: [], recomposite: { line: null, before: null, after: null, errorMap: null }, parts: null } } : {}),
       ...(world ? { environment: world.record } : {}),
       ...(clothPlan ? { cloth: { route: building ? 'build' as const : 'rig' as const, inputs: { source: p.handoff!.record.source?.path ?? '', keypoints: { ...p.handoff!.record.keypoints! } }, refusals: [], line: null, written: null, links: [], wallMs: { propose: null, build: null } } } : {}) };
-    jobs.set(id, job); running = id;
+    jobs.set(id, job); running = id; bodies.set(id, body);
     void executePatch(job, dir, inputs, resolved, patched, part, plan, world, clothPlan).finally(() => { if (running === id) running = null; });
     return { status: 202, body: snapshot(job) };
   }
 
+  /**
+   * #173 · `POST /api/density-strip` with `{patches}`: 2–5 Mesh-panel patches for one part that differ only at its density
+   * field (`src/density-strip.ts`). Each is checked as an Apply checks it (fresh config bytes, names, held files, the
+   * installed producer) and runs through the same patch runner — remesh, the compile, #174's carried check — into its own
+   * folder under `stripRoot`, at most `concurrency` at once. Nothing lands: no applied record, no stage, no undo entry.
+   * A new strip replaces the folder of the one before it; refused while an Apply runs (and an Apply is refused while a
+   * strip runs: `REBUILD_BUSY`).
+   */
+  async function startStrip(input: unknown): Promise<{ status: number; body: unknown }> {
+    let patches: ConfigPatch[];
+    try { patches = stripPatches(input).map(parseConfigPatch); }
+    catch (e) { if (e instanceof ConfigPatchError || e instanceof DensityStripError) throw new RebuildError(e.code, e.message.slice(e.code.length + 2)); throw e; }
+    let shape: ReturnType<typeof stripShape>;
+    try { shape = stripShape(patches); } catch (e) { if (e instanceof DensityStripError) throw new RebuildError(e.code, e.message.slice(e.code.length + 2)); throw e; }
+    assertStateOutside();
+    await options.unchanged();
+    const inputs = await producerInputs(p.handoff, p.handoffReason);
+    const original = JSON.parse(inputs.configText) as JsonValue;
+    const planned: { patch: ConfigPatch; patched: JsonValue }[] = [];
+    for (const patch of patches) {
+      let patched: JsonValue;
+      try { assertPatchFresh(patch, inputs.configHash); assertOpNames(original, patch.ops); patched = applyConfigPatch(original, patch.ops); remeshPart(patch); }
+      catch (e) { if (e instanceof ConfigPatchError) throw new RebuildError(e.code, e.message.slice(e.code.length + 2)); throw e; }
+      assertNamedFilesHeld(original, patched);
+      planned.push({ patch, patched });
+    }
+    const resolved = resolveProducer(options.starts);
+    if (!resolved.ok) return { status: 200, body: { status: 'refused', error: resolved.error, producerLine: resolved.error } };
+    const first = patches[0]!;
+    if (first.producer.name !== resolved.producer.package || first.producer.version !== resolved.producer.version) throw new RebuildError('EDIT_PRODUCER_MISMATCH', `the patch was made for ${first.producer.name} ${first.producer.version}; the installed producer is ${resolved.producer.package} ${resolved.producer.version}`);
+    const producer = `${resolved.producer.package}@${resolved.producer.version}`, compiler = `${resolved.compiler.package}@${resolved.compiler.version}`;
+    const id = stripId({ sourceHash: p.sourceHash, configHash: inputs.configHash, patches, producer, compiler });
+    if (strip?.id === id) return { status: strip.status === 'running' ? 202 : 200, body: stripView() };
+    const refusal = busy();
+    if (refusal) return { status: 200, body: { status: 'refused', error: refusal, producerLine: null } };
+    // Bounded disk: the strip on screen is the only one this package keeps; its predecessor's folder goes first.
+    const root = stripRoot(options.stateDir, p.sourceHash);
+    await rm(root, { recursive: true, force: true });
+    const concurrency = Math.max(1, Math.floor(options.stripConcurrency ?? defaultStripConcurrency()));
+    const candidates: StripCandidate[] = planned.map(({ patch }, i) => {
+      const cid = patchId({ sourceHash: p.sourceHash, configHash: inputs.configHash, patch, producer, compiler, op: 'remesh' });
+      const job: PatchJob = { schema: REBUILD_SCHEMA, kind: 'patch', id: cid, status: 'running', reused: false, op: 'remesh', request: { patch, patchSha256: patchSha256(patch), configHash: inputs.configHash }, producer: tool(resolved.producer), compiler: tool(resolved.compiler), lines: [], producerLine: null, exitCode: null, wallMs: { op: null, compile: null, check: null }, check: null, diff: null, files: null, remesh: null, build: null };
+      return { value: shape.values[i]!, id: cid, entry: shape.entries[i]!, dir: join(root, id, cid), job, applied: false };
+    });
+    const current = { id, status: 'running' as const, part: shape.part, field: shape.field, concurrency, configHash: inputs.configHash, producer: tool(resolved.producer), compiler: tool(resolved.compiler), started: performance.now(), wallMs: null, candidates };
+    strip = current;
+    // A bounded pool: each worker takes the next candidate in order; the strip is done when every candidate settled.
+    let next = 0;
+    const worker = async () => {
+      for (let i = next++; i < candidates.length; i = next++) {
+        const c = candidates[i]!;
+        await executePatch(c.job, c.dir, inputs, resolved, planned[i]!.patched, shape.part, null, null, null, true).catch(() => {});
+      }
+    };
+    void Promise.all(Array.from({ length: Math.min(concurrency, candidates.length) }, worker)).finally(() => {
+      if (strip === current) { (current as { status: 'running' | 'done' }).status = 'done'; (current as { wallMs: number | null }).wallMs = Math.round(performance.now() - current.started); }
+    });
+    return { status: 202, body: stripView() };
+  }
+  function stripView(): DensityStripView | null {
+    if (!strip) return null;
+    const s = strip;
+    const rows = s.candidates.map(c => candidateRow({ value: c.value, id: c.id, entry: c.entry, job: c.job, part: s.part, modelUrl: c.job.build ? `/density-strip/${s.id}/${c.id}/${c.job.build.model}` : null, applied: c.applied }));
+    return { schema: DENSITY_STRIP_SCHEMA, id: s.id, status: s.status, part: s.part, field: s.field, concurrency: s.concurrency, configHash: s.configHash, producer: s.producer, compiler: s.compiler, wallMs: s.wallMs, rows, labels: s.status === 'done' ? stripLabels(rows) : { fewest: null, widest: null } };
+  }
+  /** `GET /api/density-strip/<id>` (and `GET /api/density-strip`: the strip on screen, or null). */
+  function readStrip(id?: string): DensityStripView | null {
+    if (id !== undefined && strip?.id !== id) throw new RebuildError('DENSITY_STRIP_NOT_FOUND', id);
+    return stripView();
+  }
+  /** A candidate's job as it settled (its lines in full), for the row's log. */
+  function stripJob(id: string, cid: string): PatchJob {
+    const c = strip?.id === id ? strip.candidates.find(x => x.id === cid) : undefined;
+    if (!c) throw new RebuildError('DENSITY_STRIP_NOT_FOUND', `${id}/${cid}`);
+    return snapshot(c.job);
+  }
+  /** `POST /api/density-strip/close` with `{id}`: the strip's folder is removed; refused while its candidates run. */
+  async function closeStrip(input: unknown): Promise<{ status: number; body: unknown }> {
+    const v = object(input, 'density strip close');
+    if (Object.keys(v).join(',') !== 'id' || typeof v.id !== 'string' || !/^[a-f0-9]{64}$/.test(v.id)) throw new RebuildError('REBUILD_REQUEST_INVALID', 'expected exactly {id: <the strip id>}');
+    if (strip?.id !== v.id) throw new RebuildError('DENSITY_STRIP_NOT_FOUND', `${v.id.slice(0, 12)}… is not the strip on screen`);
+    if (strip.status === 'running') return { status: 200, body: { status: 'refused', error: `DENSITY_STRIP_BUSY: strip ${strip.id} is still running; close it when its candidates settle`, producerLine: null } };
+    const applied = strip.candidates.filter(c => c.applied).length;
+    strip = null;
+    await rm(stripRoot(options.stateDir, p.sourceHash), { recursive: true, force: true });
+    return { status: 200, body: { status: 'closed', id: v.id, applied } };
+  }
+  /** A served candidate file: only a built, not-applied candidate's hashed model and pages, read-only. */
+  async function stripFile(id: string, cid: string, name: string): Promise<string> {
+    const c = strip?.id === id ? strip.candidates.find(x => x.id === cid) : undefined;
+    if (!c || c.applied || c.job.status !== 'built' || !c.job.build || !Object.hasOwn(c.job.build.files, name)) throw new RebuildError('DENSITY_STRIP_NOT_FOUND', `${id}/${cid}/${name}`);
+    return safeFile(await realpath(join(c.dir, 'build')), packagePath(name));
+  }
+  /**
+   * #173: an Apply whose build id is a settled strip candidate's takes that candidate's build: the folder moves into the
+   * scratch root, where the ordinary reuse reads and re-hashes it and lands it as any Apply lands. The row then reads
+   * "applied" and is no longer served from the strip.
+   */
+  async function adopt(id: string): Promise<void> {
+    const c = strip && strip.status === 'done' ? strip.candidates.find(x => x.id === id && !x.applied && x.job.status === 'built') : undefined;
+    if (!c) return;
+    const to = rebuildDir(options.stateDir, p.sourceHash, id);
+    if (await exists(to)) return;
+    await mkdir(rebuildRoot(options.stateDir, p.sourceHash), { recursive: true, mode: 0o700 });
+    await rename(c.dir, to);
+    c.applied = true;
+  }
+
   /** #135: the delta → `rig-parts remesh --delta mesh-edit.json --part <part>` → `<dir>/rig`; the tail adds the per-file diff. */
   function executeDelta(job: DeltaJob, dir: string, inputs: ProducerInputs, resolved: Resolved, text: string): Promise<void> {
     const producer = resolved.producer, part = job.request.part;
@@ -926,12 +1229,15 @@ export function createRebuilds(p: ReviewPackage, options: RebuildOptions) {
     const id = deltaId({ sourceHash: p.sourceHash, configHash: inputs.configHash, part: request.part, deltaText: text, producer: `${resolved.producer.package}@${resolved.producer.version}`, compiler: `${resolved.compiler.package}@${resolved.compiler.version}` });
     const current = jobs.get(id);
     if (current?.status === 'running') return { status: 202, body: snapshot(current) };
-    if (running) return { status: 200, body: { status: 'refused', error: `REBUILD_BUSY: rebuild ${running} is still running`, producerLine: null } };
+    if (busy()) return { status: 200, body: { status: 'refused', error: busy(), producerLine: null } };
+    guardRestore(id);
     const dir = rebuildDir(options.stateDir, p.sourceHash, id);
+    await adopt(id);
+    await unkeep(id);
     const reused = await reuse<DeltaJob>(dir, id);
-    if (reused) { jobs.set(id, reused); latestId = id; return { status: 200, body: snapshot(reused) }; }
+    if (reused) { jobs.set(id, reused); latestId = id; bodies.set(id, input); await landed(reused); return { status: 200, body: snapshot(reused) }; }
     const job: DeltaJob = { schema: REBUILD_SCHEMA, kind: 'delta', id, status: 'running', reused: false, op: 'remesh', request: { part: request.part, delta: request.delta, deltaSha256: sha256(text), configHash: inputs.configHash }, producer: tool(resolved.producer), compiler: tool(resolved.compiler), lines: [], producerLine: null, exitCode: null, wallMs: { op: null, compile: null }, files: null, remesh: null, build: null };
-    jobs.set(id, job); running = id;
+    jobs.set(id, job); running = id; bodies.set(id, input);
     void executeDelta(job, dir, inputs, resolved, text).finally(() => { if (running === id) running = null; });
     return { status: 202, body: snapshot(job) };
   }
@@ -1018,7 +1324,7 @@ export function createRebuilds(p: ReviewPackage, options: RebuildOptions) {
    * still be the handoff's, the sequence a declared `rig-pose-sequence/1` reference, and `@rig-c/pose` installed. The
    * map's resolution against the rig, the flags' combinations and the pose are the producer's to judge, verbatim.
    */
-  async function startRetarget(input: unknown): Promise<{ status: number; body: unknown }> {
+  async function startRetarget(input: unknown, body: unknown = { retarget: input }): Promise<{ status: number; body: unknown }> {
     let request: ReturnType<typeof parseRetargetRequest>;
     try { request = parseRetargetRequest(input); } catch (e) { if (e instanceof RetargetError) throw new RebuildError(e.code, e.message.slice(e.code.length + 2)); throw e; }
     assertStateOutside();
@@ -1038,12 +1344,15 @@ export function createRebuilds(p: ReviewPackage, options: RebuildOptions) {
     const id = retargetId({ sourceHash: p.sourceHash, configHash: inputs.configHash, record, producer: `${resolved.producer.package}@${resolved.producer.version}`, compiler: `${resolved.compiler.package}@${resolved.compiler.version}` });
     const current = jobs.get(id);
     if (current?.status === 'running') return { status: 202, body: snapshot(current) };
-    if (running) return { status: 200, body: { status: 'refused', error: `REBUILD_BUSY: rebuild ${running} is still running`, producerLine: null } };
+    if (busy()) return { status: 200, body: { status: 'refused', error: busy(), producerLine: null } };
+    guardRestore(id);
     const dir = rebuildDir(options.stateDir, p.sourceHash, id);
+    await adopt(id);
+    await unkeep(id);
     const reused = await reuse<RetargetJob>(dir, id);
-    if (reused) { jobs.set(id, reused); latestId = id; return { status: 200, body: snapshot(reused) }; }
+    if (reused) { jobs.set(id, reused); latestId = id; bodies.set(id, body); await landed(reused); return { status: 200, body: snapshot(reused) }; }
     const job: RetargetJob = { schema: REBUILD_SCHEMA, kind: 'retarget', id, status: 'running', reused: false, op: 'retarget', request: { record, recordSha256: sha256(retargetRecordText(record)), configHash: inputs.configHash }, producer: tool(resolved.producer), compiler: tool(resolved.compiler), lines: [], producerLine: null, refusals: [], exitCode: null, wallMs: { clean: null, retarget: null, compile: null }, files: null, motion: null, readings: [], frameTimes: null, build: null };
-    jobs.set(id, job); running = id;
+    jobs.set(id, job); running = id; bodies.set(id, body);
     void executeRetarget(job, dir, inputs, resolved, sequence).finally(() => { if (running === id) running = null; });
     return { status: 202, body: snapshot(job) };
   }
@@ -1052,7 +1361,7 @@ export function createRebuilds(p: ReviewPackage, options: RebuildOptions) {
   async function start(input: unknown): Promise<{ status: number; body: unknown }> {
     if (input && typeof input === 'object' && !Array.isArray(input) && Object.hasOwn(input, 'retarget')) {
       if (Object.keys(input).length !== 1) bad('expected exactly {retarget}');
-      return startRetarget((input as { retarget: unknown }).retarget);
+      return startRetarget((input as { retarget: unknown }).retarget, input);
     }
     if (input && typeof input === 'object' && !Array.isArray(input) && Object.hasOwn(input, 'delta')) return startDelta(input);
     if (input && typeof input === 'object' && !Array.isArray(input) && Object.hasOwn(input, 'patch')) {
@@ -1060,7 +1369,7 @@ export function createRebuilds(p: ReviewPackage, options: RebuildOptions) {
       const keys = Object.keys(input).sort().join(',');
       if (keys !== 'patch' && keys !== 'environment,patch') bad('expected exactly {patch}, {patch, environment} or {part, regions, configHash}');
       const world = Object.hasOwn(input, 'environment') ? parseApplyWorld((input as { environment: unknown }).environment) : null;
-      return startPatch((input as { patch: unknown }).patch, world);
+      return startPatch((input as { patch: unknown }).patch, world, input);
     }
     const request = parseRebuildRequest(input, options.bones);
     assertStateOutside();
@@ -1073,12 +1382,15 @@ export function createRebuilds(p: ReviewPackage, options: RebuildOptions) {
     const id = designationId({ sourceHash: p.sourceHash, configHash: inputs.configHash, part: request.part, entry, producer: `${resolved.producer.package}@${resolved.producer.version}`, compiler: `${resolved.compiler.package}@${resolved.compiler.version}` });
     const current = jobs.get(id);
     if (current?.status === 'running') return { status: 202, body: snapshot(current) };
-    if (running) return { status: 200, body: { status: 'refused', error: `REBUILD_BUSY: rebuild ${running} is still running`, producerLine: null } };
+    if (busy()) return { status: 200, body: { status: 'refused', error: busy(), producerLine: null } };
+    guardRestore(id);
     const dir = rebuildDir(options.stateDir, p.sourceHash, id);
+    await adopt(id);
+    await unkeep(id);
     const reused = await reuse(dir, id);
-    if (reused) { jobs.set(id, reused); latestId = id; return { status: 200, body: snapshot(reused) }; }
+    if (reused) { jobs.set(id, reused); latestId = id; bodies.set(id, input); await landed(reused); return { status: 200, body: snapshot(reused) }; }
     const job: RebuildJob = { schema: REBUILD_SCHEMA, id, status: 'running', reused: false, request: { ...request, entrySha256: sha256(entry) }, producer: tool(resolved.producer), compiler: tool(resolved.compiler), lines: [], producerLine: null, exitCode: null, wallMs: { remesh: null, compile: null }, build: null };
-    jobs.set(id, job); running = id;
+    jobs.set(id, job); running = id; bodies.set(id, input);
     void execute(job, dir, inputs, resolved, entry).finally(() => { if (running === id) running = null; });
     return { status: 202, body: snapshot(job) };
   }
@@ -1098,5 +1410,5 @@ export function createRebuilds(p: ReviewPackage, options: RebuildOptions) {
     return safeFile(await realpath(join(rebuildDir(options.stateDir, p.sourceHash, id), 'build')), packagePath(name));
   }
 
-  return { describe, start, read, file, running: () => running, baseline: settledBaseline, inspectedCheck: settledInspectedCheck, latest };
+  return { describe, start, read, file, running: () => running, baseline: settledBaseline, inspectedCheck: settledInspectedCheck, latest, undo, history, startStrip, readStrip, stripJob, closeStrip, stripFile };
 }