@vellumai/assistant 0.12.1-dev.202609141913.5e16607 → 0.12.1-staging.2

package/src/runtime/routes/__tests__/conversation-query-routes.test.ts

@@ -51,12 +51,7 @@ mock.module("../../../persistence/embeddings/embedding-backend.js", () => ({
 }));
 
 import { BACKUP_PROFILE_KEYS } from "../../../config/default-profile-names.js";
-import {
-  getConfig,
-  loadConfig,
-  loadRawConfig,
-} from "../../../config/loader.js";
-import { AssistantConfigSchema } from "../../../config/schema.js";
+import { getConfig, loadRawConfig } from "../../../config/loader.js";
 import { LLMConfigBase } from "../../../config/schemas/llm.js";
 import type { ConversationCreateType } from "../../../persistence/conversation-types.js";
 import {
@@ -1945,105 +1940,3 @@ describe("ingress URL writes through the generic config routes", () => {
     expect(ingress.lastTunnel).toEqual(LAST_TUNNEL);
   });
 });
-
-describe("config writes to a per-agent acp entry", () => {
-  const patchRoute = ROUTES.find((r) => r.operationId === "config_patch")!;
-  const setRoute = ROUTES.find((r) => r.operationId === "config_set")!;
-
-  beforeEach(() => {
-    rawConfigFixture = {
-      acp: {
-        agents: {
-          claude: { command: "claude-agent-acp", args: [], model: "opus" },
-        },
-      },
-    };
-    seedRawConfig();
-  });
-
-  function agentEntry(
-    raw: Record<string, unknown>,
-    id = "claude",
-  ): Record<string, unknown> {
-    const acp = raw.acp as Record<string, unknown>;
-    const agents = acp.agents as Record<string, Record<string, unknown>>;
-    return agents[id]!;
-  }
-
-  test("a nulled per-agent model is dropped on both write paths", async () => {
-    await patchRoute.handler({
-      body: { acp: { agents: { claude: { model: null } } } },
-    });
-
-    const patched = agentEntry(loadRawConfig());
-    expect("model" in patched).toBe(false);
-    expect(patched.command).toBe("claude-agent-acp");
-    expect(AssistantConfigSchema.safeParse(loadRawConfig()).success).toBe(true);
-
-    seedRawConfig();
-    await setRoute.handler({
-      body: { path: "acp.agents.claude.model", value: null },
-    });
-
-    expect("model" in agentEntry(loadRawConfig())).toBe(false);
-    expect(AssistantConfigSchema.safeParse(loadRawConfig()).success).toBe(true);
-    expect(loadConfig().acp.agents.claude?.model).toBeUndefined();
-  });
-
-  test("a nulled per-agent command is dropped on both write paths", async () => {
-    await setRoute.handler({
-      body: { path: "acp.agents.claude.command", value: null },
-    });
-
-    expect("command" in agentEntry(loadRawConfig())).toBe(false);
-    expect(AssistantConfigSchema.safeParse(loadRawConfig()).success).toBe(true);
-    expect(loadConfig().acp.agents.claude?.command).toBeUndefined();
-
-    seedRawConfig();
-    await patchRoute.handler({
-      body: { acp: { agents: { claude: { command: null } } } },
-    });
-
-    const patched = agentEntry(loadRawConfig());
-    expect("command" in patched).toBe(false);
-    expect(patched.model).toBe("opus");
-    expect(AssistantConfigSchema.safeParse(loadRawConfig()).success).toBe(true);
-    expect(loadConfig().acp.agents.claude?.command).toBeUndefined();
-  });
-
-  test("a nulled command on an id with no bundled profile is dropped too", async () => {
-    rawConfigFixture = {
-      acp: { agents: { mine: { command: "my-acp", args: [] } } },
-    };
-    seedRawConfig();
-
-    await setRoute.handler({
-      body: { path: "acp.agents.mine.command", value: null },
-    });
-
-    expect("command" in agentEntry(loadRawConfig(), "mine")).toBe(false);
-    const result = AssistantConfigSchema.safeParse(loadRawConfig());
-    expect(result.success).toBe(false);
-    if (result.success) {
-      return;
-    }
-    expect(result.error.issues.map((issue) => issue.path)).toEqual([
-      ["acp", "agents", "mine", "command"],
-    ]);
-    expect(result.error.issues[0]?.message).toContain("acp.agents.mine");
-  });
-
-  test("a model set on a bare bundled entry survives the next load", async () => {
-    rawConfigFixture = {};
-    seedRawConfig();
-
-    await setRoute.handler({
-      body: { path: "acp.agents.claude.model", value: "sonnet" },
-    });
-
-    const entry = agentEntry(loadRawConfig());
-    expect("command" in entry).toBe(false);
-    expect(AssistantConfigSchema.safeParse(loadRawConfig()).success).toBe(true);
-    expect(loadConfig().acp.agents.claude?.model).toBe("sonnet");
-  });
-});

package/src/runtime/routes/__tests__/default-provider-routes.test.ts

@@ -377,7 +377,7 @@ describe("GET config/llm/default-provider", () => {
     expect(availability(result).message).toContain("Vellum-managed");
   });
 
-  test("service_account connection with invalid credential → missing_credential", async () => {
+  test("service_account connection → unsupported_auth even with a stored credential", async () => {
     seedConnection({
       name: "gemini-personal",
       provider: "gemini",
@@ -390,7 +390,7 @@ describe("GET config/llm/default-provider", () => {
     setConfig("llm", { defaultProvider: { provider: "gemini" } });
 
     const result = await get();
-    expect(availability(result).status).toBe("missing_credential");
+    expect(availability(result).status).toBe("unsupported_auth");
     expect(availability(result).message).toContain("service-account");
   });
 

package/src/runtime/routes/__tests__/mcp-add-default-risk.test.ts

@@ -1,24 +1,19 @@
 /**
- * `internal_mcp_add` writes only the transport into workspace mcp.json.
- * Policy fields (enabled, risk, tool caps, allow/block lists) are not
- * persisted.
+ * `internal_mcp_add` writes only the transport. Policy fields (enabled,
+ * risk, tool caps, allow/block lists) are not persisted.
  */
 
 import { beforeEach, describe, expect, mock, test } from "bun:test";
 
-let stored: { servers: Record<string, { transport: Record<string, unknown> }> } =
-  { servers: {} };
-let saved:
-  | { servers: Record<string, { transport: Record<string, unknown> }> }
-  | undefined;
+let raw: Record<string, unknown> = {};
+let saved: Record<string, unknown> | undefined;
 
-mock.module("../../../mcp/workspace-mcp-config.js", () => ({
-  loadWorkspaceMcpConfig: () => stored,
-  saveWorkspaceMcpConfig: (next: {
-    servers: Record<string, { transport: Record<string, unknown> }>;
-  }) => {
+const actualLoader = await import("../../../config/loader.js");
+mock.module("../../../config/loader.js", () => ({
+  ...actualLoader,
+  loadRawConfig: () => raw,
+  saveRawConfig: (next: Record<string, unknown>) => {
     saved = next;
-    stored = next;
   },
 }));
 
@@ -31,12 +26,13 @@ const { ROUTES } = await import("../mcp-auth-routes.js");
 const addRoute = ROUTES.find((r) => r.operationId === "internal_mcp_add")!;
 
 function addedEntry(): Record<string, unknown> {
-  return saved!.servers["srv"] as Record<string, unknown>;
+  const mcp = saved?.mcp as { servers: Record<string, unknown> };
+  return mcp.servers["srv"] as Record<string, unknown>;
 }
 
 describe("internal_mcp_add persisted shape", () => {
   beforeEach(() => {
-    stored = { servers: {} };
+    raw = {};
     saved = undefined;
   });
 

package/src/runtime/routes/acp-routes.test.ts

@@ -262,21 +262,6 @@ describe("POST /v1/acp/spawn", () => {
     // Guard runs before the approval gate — no prompt is surfaced.
     expect(confirmationRequests).toHaveLength(0);
   });
-
-  test("rejects a non-string model before the approval gate", async () => {
-    const handler = getSpawnHandler();
-    await expect(
-      handler({
-        body: {
-          agent: "claude",
-          task: "do a thing",
-          conversationId: "conv-1",
-          model: 42,
-        },
-      }),
-    ).rejects.toThrow("model must be a string when provided");
-    expect(confirmationRequests).toHaveLength(0);
-  });
 });
 
 // ---------------------------------------------------------------------------

package/src/runtime/routes/acp-routes.ts

@@ -24,11 +24,8 @@ import {
   AcpResumeError,
   AcpSessionNotFoundError,
 } from "../../acp/session-manager.js";
-import { type AcpSessionState, isLiveAcpStatus } from "../../acp/types.js";
-import {
-  AcpSessionModelUpdateEventSchema,
-  type AssistantEvent,
-} from "../../api/index.js";
+import type { AcpSessionState } from "../../acp/types.js";
+import type { AssistantEvent } from "../../api/index.js";
 import { getConfig } from "../../config/loader.js";
 import { createGuardianRequestForConfirmation } from "../../permissions/confirmation-guardian-request.js";
 import type { UserDecision } from "../../permissions/types.js";
@@ -56,10 +53,6 @@ const log = getLogger("acp-routes");
 const DEFAULT_SESSION_LIMIT = 50;
 const MAX_SESSION_LIMIT = 500;
 
-/** The option shape the `acp_session_model_update` event already publishes. */
-const acpModelOptionsSchema =
-  AcpSessionModelUpdateEventSchema.shape.availableModels;
-
 const sessionEntrySchema = z.object({
   id: z.string(),
   agentId: z.string(),
@@ -75,15 +68,6 @@ const sessionEntrySchema = z.object({
   /** Credential failure that ended the run, when one did. Drives the inline
    *  Connect card on reopen; cleared when a replacement token is stored. */
   authErrorCode: z.string().optional(),
-  /** Model a live session is running on. Absent for history rows, which have
-   *  no live process to ask. */
-  model: z.string().optional(),
-  /** Models a live session could run on. Absent for history rows. */
-  availableModels: acpModelOptionsSchema.optional(),
-  /** Scopes live model revisions to one assistant process. */
-  modelRevisionEpoch: z.string().uuid().optional(),
-  /** Orders live model state within `modelRevisionEpoch`. */
-  modelRevision: z.number().int().nonnegative().optional(),
   usedTokens: z.number().optional(),
   contextSize: z.number().optional(),
   costAmount: z.number().optional(),
@@ -230,26 +214,17 @@ async function spawnSession({ body, abortSignal }: RouteHandlerArgs) {
   const task = body?.task as string | undefined;
   const conversationId = body?.conversationId as string | undefined;
   const cwd = (body?.cwd as string | undefined) ?? process.cwd();
-  const model = body?.model ?? undefined;
 
   if (!agent || !task || !conversationId) {
     throw new BadRequestError("agent, task, and conversationId are required");
   }
-  if (model !== undefined && typeof model !== "string") {
-    throw new BadRequestError("model must be a string when provided");
-  }
 
   // High-risk approval gate. Block BEFORE any side effects — resolution can
   // trigger a `bun` global install (auto-install.ts) and `manager.spawn`
   // launches the host subprocess — so an unapproved request mutates nothing.
   const decision = await awaitRouteApproval({
     toolName: "acp_spawn",
-    input: {
-      agent,
-      task,
-      cwd,
-      ...(model !== undefined ? { model } : {}),
-    },
+    input: { agent, task, cwd },
     conversationId,
     signal: abortSignal,
   });
@@ -287,33 +262,17 @@ async function spawnSession({ body, abortSignal }: RouteHandlerArgs) {
   );
 
   const manager = getAcpSessionManager();
-  const {
-    acpSessionId,
-    protocolSessionId,
-    requestedModel,
-    effectiveModel,
-    modelWarning,
-  } = await manager.spawn(
+  const { acpSessionId, protocolSessionId } = await manager.spawn(
     agent,
     agentConfig,
     task,
     cwd,
     conversationId,
     broadcastMessage,
-    { model },
   );
 
   log.info({ acpSessionId, protocolSessionId, agent }, "ACP spawn succeeded");
-  // A refused model is a warning, not a failed spawn: the session is live on
-  // the agent's own model.
-  return {
-    acpSessionId,
-    protocolSessionId,
-    agent,
-    requestedModel: requestedModel ?? null,
-    effectiveModel: effectiveModel ?? null,
-    ...(modelWarning ? { modelWarning } : {}),
-  };
+  return { acpSessionId, protocolSessionId, agent };
 }
 
 async function steerSession({ pathParams, body }: RouteHandlerArgs) {
@@ -629,7 +588,10 @@ function deleteSession({ pathParams }: RouteHandlerArgs) {
 
   try {
     const state = manager.getStatus(id);
-    if (!Array.isArray(state) && isLiveAcpStatus(state.status)) {
+    if (
+      !Array.isArray(state) &&
+      (state.status === "running" || state.status === "initializing")
+    ) {
       throw new ConflictError(
         `ACP session "${id}" is still ${state.status}. Cancel or close it before deleting.`,
       );
@@ -678,32 +640,11 @@ export const ROUTES: RouteDefinition[] = [
       task: z.string().describe("Task description"),
       conversationId: z.string(),
       cwd: z.string().describe("Working directory").optional(),
-      model: z
-        .string()
-        .optional()
-        .describe("Optional model id or alias to request for the session."),
     }),
     responseBody: z.object({
       acpSessionId: z.string(),
       protocolSessionId: z.string(),
       agent: z.string(),
-      requestedModel: z
-        .string()
-        .nullable()
-        .describe("The model explicitly requested for this spawn, if any."),
-      effectiveModel: z
-        .string()
-        .nullable()
-        .describe(
-          "The top-level session model reported by the ACP adapter, if any.",
-        ),
-      modelWarning: z
-        .string()
-        .optional()
-        .describe(
-          "Why the requested model was not applied. The session is running " +
-            "on the agent's own model.",
-        ),
     }),
   },
   {
@@ -911,10 +852,6 @@ function listMergedSessions(opts: { limit: number; conversationId?: string }): {
       parentToolUseId: s.parentToolUseId,
       authErrorCode: s.authErrorCode,
       authErrorCredential: s.authErrorCredential,
-      model: s.model,
-      availableModels: s.availableModels,
-      modelRevisionEpoch: s.modelRevisionEpoch,
-      modelRevision: s.modelRevision,
       usedTokens: s.latestUsage?.usedTokens,
       contextSize: s.latestUsage?.contextSize,
       costAmount: s.latestUsage?.costAmount,

package/src/runtime/routes/app-management-routes.ts

@@ -51,7 +51,6 @@ import { compileApp, runCompile } from "../../bundler/app-compiler.js";
 import { scanBundle } from "../../bundler/bundle-scanner.js";
 import type { SignatureJson } from "../../bundler/bundle-signer.js";
 import { verifyBundleSignature } from "../../bundler/signature-verifier.js";
-import { notifyAppSurfacesChanged } from "../../daemon/app-change-notify.js";
 import { compareSemver } from "../../daemon/handlers/shared.js";
 import { computeContentId } from "../../util/content-id.js";
 import { getLogger } from "../../util/logger.js";
@@ -129,17 +128,6 @@ const appListItemSchema = z.object({
 
 type AppListItem = z.infer<typeof appListItemSchema>;
 
-const compileDiagnosticSchema = z.object({
-  text: z.string(),
-  location: z
-    .object({
-      file: z.string(),
-      line: z.number(),
-      column: z.number(),
-    })
-    .optional(),
-});
-
 /**
  * The pin route's body. `RouteDefinition.requestBody` is a codegen signal and
  * does not validate, so the handler parses against this too; declaring it once
@@ -908,44 +896,6 @@ async function handleOpenApp({ pathParams }: RouteHandlerArgs) {
   return { ...result, html };
 }
 
-/**
- * Compile an app's source into dist/ and refresh open surfaces.
- * Runs in the assistant process so open surfaces, client broadcasts, and
- * published-app redeploy see the new build. Workspace and plugin apps both
- * compile in place so local plugin edits can be rebuilt without waiting for
- * the plugin source watcher.
- */
-async function handleRefreshApp({ pathParams }: RouteHandlerArgs) {
-  const appId = pathParams?.id;
-  if (!appId) {
-    throw new BadRequestError("App id is required.");
-  }
-
-  const source = resolveAppSource(appId);
-  if (!source) {
-    throw new NotFoundError(
-      `App "${appId}" not found. Run 'assistant apps list' to see available apps.`,
-    );
-  }
-
-  const compileResult = await compileApp(source.sourceDir);
-  notifyAppSurfacesChanged(source.id, { fileChange: true });
-
-  return {
-    ok: true as const,
-    appId: source.id,
-    name: source.name,
-    compiled: compileResult.ok,
-    compile_duration_ms: compileResult.durationMs,
-    ...(compileResult.ok
-      ? {}
-      : {
-          compile_errors: compileResult.errors,
-          compile_warnings: compileResult.warnings,
-        }),
-  };
-}
-
 /**
  * Reject a mutation targeting a plugin-bundled app. Plugin apps are owned by
  * their plugin and are read-only over this surface — their source is not
@@ -1303,29 +1253,6 @@ export const ROUTES: RouteDefinition[] = [
       origin: z.string(),
     }),
   },
-  {
-    operationId: "apps_refresh",
-    endpoint: "apps/:id/refresh",
-    method: "POST",
-    policy: {
-      requiredScopes: ["settings.write"],
-      allowedPrincipalTypes: ACTOR_PRINCIPALS,
-    },
-    handler: handleRefreshApp,
-    summary: "Compile an app",
-    description:
-      "Compile workspace or plugin app source into dist/ and refresh open surfaces.",
-    tags: ["apps"],
-    responseBody: z.object({
-      ok: z.literal(true),
-      appId: z.string(),
-      name: z.string(),
-      compiled: z.boolean(),
-      compile_duration_ms: z.number(),
-      compile_errors: z.array(compileDiagnosticSchema).optional(),
-      compile_warnings: z.array(compileDiagnosticSchema).optional(),
-    }),
-  },
   {
     operationId: "apps_delete",
     endpoint: "apps/:id/delete",

package/src/runtime/routes/app-routes.ts

@@ -92,7 +92,7 @@ function serveCompiledApp(
     );
     const body = isLegacySingleFileDir(appDir)
       ? UNSUPPORTED_LEGACY_APP_HTML
-      : `<p>App has not been compiled yet. Run <code>assistant apps refresh</code> to build.</p>`;
+      : `<p>App has not been compiled yet. Edit a source file to trigger a build.</p>`;
     return (
       `<!DOCTYPE html><html><head><title>${escapedName}</title></head>` +
       `<body>${body}</body></html>`

package/src/runtime/routes/conversation-list-routes.ts

@@ -14,7 +14,6 @@ import { z } from "zod";
 
 import { CHANNEL_IDS } from "../../channels/types.js";
 import { isAssistantInitiatedThreadsEnabled } from "../../config/assistant-initiated-threads-gate.js";
-import { localeFromAcceptLanguage } from "../../i18n/index.js";
 import { channelBindingSchema } from "../../messaging/channel-binding-schema.js";
 import {
   type Confidence,
@@ -245,10 +244,7 @@ function parseEnumQueryParam<const T extends readonly string[]>(
   );
 }
 
-function handleListConversations({
-  queryParams = {},
-  headers,
-}: RouteHandlerArgs) {
+function handleListConversations({ queryParams = {} }: RouteHandlerArgs) {
   const limit = Number(queryParams.limit ?? 50);
   const offset = Number(queryParams.offset ?? 0);
   // "background" is the back-compat umbrella (background + scheduled); newer
@@ -369,7 +365,6 @@ function handleListConversations({
         // Checks in-memory flag first (hot path), falls back to the
         // persisted `processing_started_at` column for cold conversations.
         isProcessing: isConversationProcessing(conversation.id),
-        locale: localeFromAcceptLanguage(headers?.["accept-language"]),
       }),
     ),
     nextOffset,
@@ -584,14 +579,8 @@ function handleMarkUnread({ body = {}, headers }: RouteHandlerArgs) {
   }
 }
 
-function handleGetConversation({
-  pathParams = {},
-  headers,
-}: RouteHandlerArgs) {
-  const detail = buildConversationDetailResponse(
-    pathParams.id!,
-    localeFromAcceptLanguage(headers?.["accept-language"]),
-  );
+function handleGetConversation({ pathParams = {} }: RouteHandlerArgs) {
+  const detail = buildConversationDetailResponse(pathParams.id!);
   if (!detail) {
     throw new NotFoundError(`Conversation ${pathParams.id} not found`);
   }

package/src/runtime/routes/conversation-query-routes.ts

@@ -29,7 +29,6 @@ import {
   LatencyBreakdownSchema,
   LLMRequestLogEntrySchema,
 } from "../../api/responses/llm-request-log-entry.js";
-import { scrubNulledAcpAgentLeaves } from "../../config/acp-agent-write.js";
 import {
   catalogEntryFor,
   type InputModalities,
@@ -93,7 +92,6 @@ import {
   log,
 } from "../../daemon/handlers/shared.js";
 import { rescheduleHeartbeatIfTimezoneChanged } from "../../heartbeat/heartbeat-service.js";
-import { overlayWorkspaceMcpForConfigRead } from "../../mcp/workspace-mcp-config.js";
 import {
   getAssistantMessageIdsInTurn,
   getConversation,
@@ -689,38 +687,6 @@ function rejectMcpTransportHeaderWrite(patch: unknown): void {
   );
 }
 
-const MCP_CONFIG_WRITE_MESSAGE =
-  "MCP servers are stored in mcp.json. Use assistant mcp add or assistant mcp remove.";
-
-function stripMcpFromConfigWrite(patch: Record<string, unknown>): void {
-  if (Object.hasOwn(patch, "mcp")) {
-    delete patch.mcp;
-  }
-}
-
-function rejectMcpConfigSetPath(path: string, value: unknown): void {
-  if (path !== "mcp" && !path.startsWith("mcp.")) {
-    return;
-  }
-  const relative =
-    path === "mcp" ? value : nestPath(path.slice("mcp.".length), value);
-  if (patchContainsMcpTransportHeaders({ mcp: relative })) {
-    throw new BadRequestError(
-      "MCP authentication headers must be managed through MCP server add/update APIs, not generic config writes.",
-    );
-  }
-  throw new BadRequestError(MCP_CONFIG_WRITE_MESSAGE);
-}
-
-function nestPath(path: string, value: unknown): unknown {
-  const segments = path.split(".");
-  let current: unknown = value;
-  for (let i = segments.length - 1; i >= 0; i--) {
-    current = { [segments[i]!]: current };
-  }
-  return current;
-}
-
 const WireProfileEntry = ProfileEntry.extend({
   supportsVision: z.boolean().optional(),
   invariant: z.boolean().optional(),
@@ -927,7 +893,6 @@ const ConfigPatchRequestSchema = z
 function handleGetConfig() {
   try {
     const config = applyContextDefaultsToRawConfig(loadRawConfig());
-    overlayWorkspaceMcpForConfigRead(config);
     sanitizeMcpTransportHeadersForSettingsRead(config);
     overlayEffectiveProfilesForWire(config);
     enrichProfilesForWire(config);
@@ -1629,7 +1594,6 @@ async function handlePatchConfig({ body }: RouteHandlerArgs) {
   normalizeManagedProfileWrites(body);
   rejectManagedProfileDeletion(body as Record<string, unknown>);
   rejectMcpTransportHeaderWrite(body);
-  stripMcpFromConfigWrite(body as Record<string, unknown>);
 
   const raw = loadRawConfig();
   const patch = body as Record<string, unknown>;
@@ -1639,13 +1603,11 @@ async function handlePatchConfig({ body }: RouteHandlerArgs) {
   }
   deepMergeOverwrite(raw, patch);
   scrubRemovedServiceModes(raw);
-  scrubNulledAcpAgentLeaves(raw);
   seedSttProviderForSparseBlock(raw);
 
   await commitConfigWrite(raw, "patch");
 
   const merged = applyContextDefaultsToRawConfig(loadRawConfig());
-  overlayWorkspaceMcpForConfigRead(merged);
   sanitizeMcpTransportHeadersForSettingsRead(merged);
   overlayEffectiveProfilesForWire(merged);
   enrichProfilesForWire(merged);
@@ -1708,7 +1670,6 @@ async function handleSetConfig({ body }: RouteHandlerArgs) {
   stripWireOnlyProfileKeys(patchShape);
   normalizeManagedProfileWrites(patchShape);
   rejectManagedProfileDeletion(patchShape);
-  rejectMcpConfigSetPath(path, value);
   rejectMcpTransportHeaderWrite(patchShape);
 
   const raw = loadRawConfig();
@@ -1747,7 +1708,6 @@ async function handleSetConfig({ body }: RouteHandlerArgs) {
       written.source = "managed";
     }
   }
-  scrubNulledAcpAgentLeaves(raw);
   // A SET can create `services.stt` with a leaf like `language` and no
   // `provider`, which SttServiceSchema requires whenever the block exists;
   // the same seeding that guards PATCH keeps this write's persisted block