codex-overleaf-link 2.4.1 → 2.5.1

package/extension/src/content/contentRuntime.js

@@ -56,7 +56,12 @@
     'codex.history.clearPlugin',
     'skills.list',
     'skills.install',
-    'skills.remove'
+    'skills.remove',
+    'writing-style.get',
+    'writing-style.set',
+    'codex.thread.fork',
+    'asset.readChunk',
+    'asset.release'
   ]);
   const PageRpcContract = Modules.PageRpcContract;
   const PANEL_DEFAULT_WIDTH = 380;
@@ -64,7 +69,9 @@
   const PANEL_MAX_WIDTH = 760;
   const PAGE_MIN_WIDTH = 520;
   const CodexOverleafCompatibility = Modules.Compatibility;
-  const INSTALL_COMMAND = CodexOverleafCompatibility?.buildInstallCommand?.(
+  const MANAGED_INSTALLATION = chrome.runtime.getManifest?.()?.background?.service_worker === 'bootstrap/background.js'
+    || root.__CODEX_OVERLEAF_RUNTIME_PREFIX__ === 'runtime/';
+  const INSTALL_COMMAND = MANAGED_INSTALLATION ? '' : CodexOverleafCompatibility?.buildInstallCommand?.(
     undefined,
     undefined,
     getCurrentExtensionId()
@@ -99,6 +106,7 @@
   const {
     buildExpectedFilesAfterOperations,
     buildSnapshotRestoreUndo,
+    buildCreatedFileUndoCheckpoint,
     buildUndoCheckpoint
   } = Modules.UndoOperations;
   const { buildHumanCompletionReport, mapAgentEventToActivity, stripEmptyHtmlCommentPlaceholders,
@@ -206,6 +214,8 @@
     closeSlashMenu: () => closeSlashMenu(),
     getCurrentProjectId: () => getCurrentProjectId(),
     getLocalSkillsPanel: () => localSkillsPanel,
+    getCodexLocalSkills: () => getCodexLocalSkillsCatalog(),
+    onSkillsChange: () => updateSlashMenuForTaskInput(),
     getLocale: () => getLocale(),
     getPanel: () => panel,
     getPanelRendererInstance: () => panelRendererInstance,
@@ -215,7 +225,7 @@
     refreshStorageUsageSummary: () => refreshStorageUsageSummary(),
     renderAuditHistoryPanel: () => renderAuditHistoryPanel(),
     renderRecentProjectsVariant: (...args) => renderRecentProjectsVariant(...args),
-    saveStateSoon: () => saveStateSoon(),
+    saveStateSoon: delay => saveStateSoon(delay),
     updateGlobalPreferences: patch => getGlobalPreferences().update(patch),
     setState: next => { state = next; },
     tr,
@@ -228,6 +238,9 @@
     closeCustomInstructionsSettings,
     closeSkillsView,
     getCodexOverleafSkillEnabled,
+    getCodexLocalSkillEnabled,
+    isCodexLocalSkillEnabled,
+    setCodexLocalSkillEnabled,
     getCustomInstructionsForCurrentProject,
     getGovernanceRulesForCurrentProject,
     getSkillLoadingSettings,
@@ -334,6 +347,7 @@
     otWarmMirrorController,
     getActiveFocusFiles,
     getCurrentProjectId,
+    getScope: () => ({ accountScopeId: cachedAccountScopeId, projectId: getCurrentProjectId(), generation: spaRouteGeneration }),
     isExperimentalOtEnabled,
     readOtBridgeStatus,
     formatOtStatusLabel,
@@ -365,6 +379,9 @@
   // whose deps reference the recovery handlers.
   const panelMaintenance = Modules.PanelMaintenance.create({
     StorageDb: Modules.StorageDb,
+    ChangeHistoryView: Modules.ChangeHistoryView,
+    getAccountScopeId: () => cachedAccountScopeId || '',
+    sanitizeText: sanitizeAssistantVisibleText,
     tx,
     showPluginToast: (...args) => showPluginToast(...args),
     showPluginConfirm: (...args) => showPluginConfirm(...args),
@@ -379,12 +396,17 @@
     openCustomInstructionsSettings: () => openCustomInstructionsSettings(),
     onHistoryRowJump: record => jumpToHistoryRun(record),
     resetProjectNameCache: () => recentProjects.resetProjectNameCache(),
+    clearHistoryComposer: () => {
+      pendingRetryReplacement = null;
+      clearTaskComposer();
+      persistComposerAttachmentsToState();
+    },
     getPanel: () => panel,
     getState: () => state,
     setState: next => { state = next; },
     getCurrentRunView: () => currentRunView,
     getSettingsPanelInstance: () => settingsPanelInstance,
-    prepareRetryReplacement: run => prepareRetryReplacement(run)
+    prepareRetryReplacement: (run, task) => prepareRetryReplacement(run, task)
   });
   const {
     showUndoFileSelection,
@@ -403,8 +425,15 @@
     SessionState: Modules.SessionState,
     getState: () => state,
     setState: next => { state = next; },
-    sendBackgroundNative,
-    saveState,
+    getScope: () => ({ accountScopeId: cachedAccountScopeId, projectId: getCurrentProjectId(), generation: spaRouteGeneration }),
+    sendBackgroundNative, saveState,
+    getEnabledCodexLocalSkillIds: () => getEnabledCodexLocalSkillIds(),
+    captureLocalSkillIdsForFork: async preferences => {
+      if (preferences.loadCodexLocalSkills === false) return [];
+      const choices = { ...preferences.codexLocalSkillEnabled };
+      const skills = await primeCodexLocalSkillsCatalog({ required: true });
+      return skills.filter(skill => Object.hasOwn(choices, skill.id) ? choices[skill.id] !== false : skill.enabled !== false).map(skill => skill.id);
+    },
     applyStateToPanel,
     showPluginToast,
     tr
@@ -415,10 +444,22 @@
     forkRunFromNode: sessionForkController.forkRunFromNode
   });
   const runTimelineView = Modules.RunTimelineView.create({
+    RunActivitySummary: Modules.RunActivitySummary,
+    RunPresence: Modules.RunPresence,
+    // recentProjects is composed below; the empty state only reads it after startup.
+    getProjectName: () => { try { return recentProjects.readCurrentProjectNameFromDom(); } catch { return ''; } },
+    getCurrentProjectId: () => getCurrentProjectId(),
+    RunActivityModel: Modules.RunActivityModel,
+    SubagentActivityView: Modules.SubagentActivityView,
     RunGuidanceView: Modules.RunGuidanceView,
+    getPendingGuidance: run => runGuidanceController.getPending(run),
     RunResultActions: runResultActions,
     RunScrollLayout: Modules.RunScrollLayout,
     RunFailureNotice: Modules.RunFailureNotice,
+    I18n: i18n,
+    FailureReasons,
+    localizeVisibleReason: value => localizeVisibleReason(value),
+    localizeCompileReason: value => Modules.CompileAdapter.localizeCompileReason(value, getLocale()),
     tr,
     tx,
     getLocale,
@@ -428,6 +469,7 @@
     formatEventDetail,
     formatEventTime,
     renderAttachmentPreviewList,
+    renderSentSelection: Modules.SelectionContextView.renderSent,
     formatModeLabel,
     undoRun,
     acceptRun,
@@ -443,6 +485,10 @@
     getState: () => state,
     getCurrentRunView: () => currentRunView,
     refillComposerForRetry,
+    canEditRun: run => runController.isRetryReplacementEligible(run, WritebackSettlement.projectRunSettlement(run)),
+    retryWriteback: retryRunWriteback,
+    getCurrentProjectId,
+    getAccountScopeId: () => cachedAccountScopeId,
     showNativeSetupGuidance: () => showNativeUpdateGuidanceModal({}),
     openProjectFileForFailure,
     openStorageSettings,
@@ -465,6 +511,8 @@
     upsertStreamEvent,
     renderCompletionReport,
     isTrackedChangeLifecycleRun,
+    configureEditButton,
+    configureWritebackButton,
     configureUndoButton,
     configureAcceptButton
   } = runTimelineView;
@@ -536,7 +584,88 @@
   // lives in writebackOrchestrator.js. Every dep below is either a hoisted
   // function declaration, an already-initialized const above, or a lazy
   // accessor thunk — safe in the top-of-init() wiring zone.
+  const selectionContextView = Modules.SelectionContextView.create({
+    getPanel: () => panel,
+    getState: () => state,
+    getProjectId: getCurrentProjectId,
+    openComposer: () => ensurePanelOpen(),
+    setSelection: (value, options = {}) => {
+      if (options.edit && panel?.querySelector('[data-task]')) readPanelInputs();
+      state = updateActiveSession(state, {
+        selectionContext: value,
+        ...(options.edit ? { mode: 'auto' } : {})
+      });
+      if (options.edit && panel) {
+        const modeInput = panel.querySelector('[data-mode]');
+        if (modeInput) modeInput.value = 'auto';
+        syncModeControls();
+      }
+      saveStateSoon();
+    },
+    callPageBridge, tx, toast: showPluginToast
+  });
+  selectionContextView.start();
+  const writingStyleSettings = Modules.WritingStyleSettings.create({
+    tx,
+    getScope: () => {
+      const projectId = getCurrentProjectId();
+      return cachedAccountScopeId && projectId ? { accountScopeId: cachedAccountScopeId, projectId } : null;
+    },
+    request: sendBackgroundNative,
+    getReferenceSnapshot: async (projectId, requestId) => {
+      const result = await callPageBridge('getReferenceProjectSnapshot', { projectId, requestId });
+      if (!result?.ok) throw Object.assign(new Error(result?.error || result?.reason || tx(
+        'The reference project could not be read.', '参考项目未能读取。')), { code: result?.code });
+      return result;
+    },
+    cancelReferenceRead: async requestId => {
+      const result = await callPageBridge('cancelReferenceRead', { requestId });
+      if (!result?.ok) throw new Error(result?.error || tx('The reference read could not be cancelled.', '参考资料读取未能取消。'));
+      return result;
+    },
+    isRunning: () => Boolean(currentRunView),
+    listProjects: async () => {
+      const result = await callPageBridge('listReferenceProjects', {});
+      if (!result?.ok) throw new Error(result?.error || tx(
+        'The Overleaf project directory could not be loaded.', 'Overleaf 项目目录未能加载。'));
+      return result.projects;
+    },
+    getModelSettings: async () => {
+      await providerSettingsCoordinator.ensureLoaded();
+      if (panel?.querySelector('[data-task]')) readPanelInputs();
+      return {
+        model: state.model,
+        reasoningEffort: state.reasoningEffort,
+        speedTier: state.speedTier,
+        providerSelection: providerSettingsCoordinator.getRunSelection(state.providerId || 'builtin'),
+        locale: getLocale()
+      };
+    },
+    preflightProjectReferences: ({ project, assertCurrent }) => {
+      assertCurrent();
+      return Modules.SensitivePreflight.create({
+        SensitiveScan, normalizeGovernanceRules, isTextSnapshotFile, getCurrentProjectId,
+        appendRunEvent: () => {}, appendCompletionReport: () => {},
+        showPluginConfirm, tr, tx
+      }).run({ task: '', project, rules: getGovernanceRulesForCurrentProject(), assertCurrent });
+    },
+    startBuild: async params => {
+      const gate = await nativeCompatibilityController.ensureForMethod('codex.run');
+      if (!gate.ok) throw new Error(gate.response?.error?.message || 'Native host update required.');
+      const id = crypto.randomUUID();
+      const promise = nativeChannel.sendBackgroundNative(nativeCompatibilityController.attachEvidence({
+        id, method: 'codex.run', params
+      }, gate.compatibility));
+      return { id, promise };
+    }
+  });
   const assetTransferBroker = Modules.AssetTransferBroker.create({ callPageBridge, sendBackgroundNative });
+  const { partitionUnsafeProjectPathOperations, normalizeOperationProjectPaths, getInvalidOperationProjectPath,
+    evaluateGovernedOperations, buildGovernanceSkippedApplyResult, filterSyncChangesByOperations, mergeApplyResultSkipped,
+    confirmBinaryOperations, buildAuditSummaryFromApply, summarizeOperationForAudit } = Modules.WritebackPlan.create({
+    tx, tr, normalizeSafeProjectPath, GovernanceRules, getGovernanceRulesForCurrentProject,
+    showPluginConfirm, formatOperationFiles, getAppliedEntries, getSkippedEntries
+  });
   const writebackOrchestrator = Modules.WritebackOrchestrator.create({
     tr,
     tx,
@@ -577,6 +706,8 @@
     filterSyncChangesByOperations,
     writebackController,
     assetTransferBroker,
+    stageWritebackRecovery,
+    settleWritebackRecovery,
     writebackSettlement: WritebackSettlement,
     compileAdapter: Modules.CompileAdapter,
     RUN_SNAPSHOT_ZIP_TIMEOUT_MS,
@@ -674,8 +805,10 @@
     window,
     getSettingsPanelInstance: () => settingsPanelInstance,
     getSelectedModel: () => state?.model || '', getSelectedProviderId: () => state?.providerId || 'builtin',
+    getSelectedProviderRevision: () => state?.providerRevision,
     setSelectedProviderId: projectProviderSelection.commit,
     confirmProviderSwitch: projectProviderSelection.confirmSwitch,
+    assertProviderSwitchAllowed: projectProviderSelection.assertSwitchAllowed,
     refreshModelOptions: loadModelOptions, persistInputs: persistPanelInputs
   });
   // v1.8.1 D3: the dashboard was a one-shot render — another tab finishing a
@@ -757,6 +890,7 @@
     tr,
     tx,
     appendPlainLog,
+    onChange: () => getComposerDraftPersistence().changed(),
     limits: {
       maxAttachmentBytes: MAX_COMPOSER_ATTACHMENT_BYTES,
       maxAttachmentTotalBytes: MAX_COMPOSER_ATTACHMENT_TOTAL_BYTES,
@@ -774,6 +908,7 @@
     getRunEvents: () => currentRunView?.events,
     appendRunEvent,
     scrollLogToBottom,
+    renderWrittenChanges: changes => Modules.WrittenChangesView.render(changes, { document, tx }),
     onRejectedHunks: summaries => {
       if (currentRunView && Array.isArray(summaries) && summaries.length) {
         currentRunView.rejectedHunks = summaries;
@@ -813,9 +948,15 @@
     saveState,
     sendBackgroundNative,
     getCurrentProjectId,
+    getScope: () => getCodexLocalSkillsCatalogScope(),
     getSkillLoadingSettings,
     isCodexOverleafSkillEnabled,
     setCodexOverleafSkillEnabled,
+    isCodexLocalSkillEnabled,
+    setCodexLocalSkillEnabled,
+    getCodexLocalSkills: () => getCodexLocalSkillsCatalog(),
+    getCodexLocalSkillWarnings: () => getCodexLocalSkillWarnings(),
+    refreshCodexLocalSkills: options => primeCodexLocalSkillsCatalog(options),
     setProjectSettingsStatus,
     tr,
     tx,
@@ -848,6 +989,7 @@
   let storageKey = LEGACY_STORAGE_KEY;
   let globalPreferencesController = null;
   let currentRunView = null;
+  let runSubmissionPending = false;
   let pendingRetryReplacement = null;
   let runQueueScheduler = null;
   let runInputCoordinator = null;
@@ -868,6 +1010,7 @@
   let pendingStreamRenderEvents = new Map();
   let storageNoticeKeys = new Set();
   let composerSkillInvocation = null;
+  let composerDraftRevision = 0;
   let slashCodexOverleafSkills = [];
   let slashCodexOverleafSkillsLoaded = false;
   let slashCodexOverleafSkillsLoading = false;
@@ -922,6 +1065,16 @@
       rolled_back: tx('The update failed its health check, so the previous version was restored.', '更新未通过健康检查，已自动恢复上一版本。')
     }[state] || '')
   });
+  const diagnosticsExporter = Modules.DiagnosticsExport.create({
+    root, window, document, Blob, URL, TextEncoder, AuditRecords, StorageDb: Modules.StorageDb,
+    CodexOverleafCompatibility, getState: () => state, getCurrentRunView: () => currentRunView,
+    getAccountScopeId: () => cachedAccountScopeId || '',
+    getCurrentProjectId, findRunRecord, getMirrorFreshness, getExtensionCompatibilityMetadata,
+    getModelDiscovery, getGovernanceRulesForCurrentProject, sendBackgroundNative,
+    fallbackNativeCompatibility, isNativeCompatibilityCompatible, getNativeCompatibilityClassification,
+    callPageBridge, showPluginToast, tr, RUN_SNAPSHOT_ZIP_TIMEOUT_MS
+  });
+
   root[RUNTIME_INSTALLED_FLAG] = true;
   root[RUNTIME_STATE_KEY] = { ok: true, alreadyInstalled: false };
 
@@ -948,7 +1101,6 @@
     if (message?.type === 'codex-overleaf/toggle-launcher') {
       const visible = !PanelRenderer.isLauncherVisible(panelRendererInstance);
       PanelRenderer.setLauncherVisible(panelRendererInstance, visible, { persist: true });
-      if (!visible) closePanel();
       sendResponse?.(getPanelStateResponse());
       return;
     }
@@ -969,7 +1121,7 @@
     }
   });
 
-  exposeSmokeHelper();
+  diagnosticsExporter.exposeSmokeHelper();
   init().catch(error => {
     root[RUNTIME_STATE_KEY] = {
       ok: false,
@@ -981,11 +1133,20 @@
     throw error;
   });
 
+  function normalizeLoadedPanelState(input) {
+    // Shared history may belong to a live run in another tab. Loading it is
+    // read-only; only an owner-lost journal may mark that run interrupted.
+    return normalizePanelState(getGlobalPreferences().overlay(input), {
+      restoreRunningRuns: Modules.StorageDb.sharedSessionsEnabled?.() !== true, recoverSettledRuns: true
+    });
+  }
+
   async function init() {
     await getGlobalPreferences().initialize();
     await refreshAccountScopeId();
     storageKey = getProjectStorageKey(LEGACY_STORAGE_KEY, window.location.href);
-    state = normalizePanelState(getGlobalPreferences().overlay(await loadStoredState()), { restoreRunningRuns: true });
+    state = normalizeLoadedPanelState(await loadStoredState());
+    await getRunReviewController().recoverInterruptedUndoStatuses();
     initializeRunQueueScheduler();
     recoverInterruptedRunJournals()
       .then(() => applyStateToPanel())
@@ -1057,7 +1218,8 @@
       version: CodexOverleafCompatibility?.BUILD_TARGET_VERSION ||
         chrome.runtime.getManifest?.().version ||
         '',
-      extensionId: getCurrentExtensionId()
+      extensionId: getCurrentExtensionId(),
+      installIdentity: { managed: MANAGED_INSTALLATION }
     };
   }
 
@@ -1067,129 +1229,9 @@
       : '';
   }
 
-  function exposeSmokeHelper() {
-    const helper = Object.freeze({
-      probeNative: smokeProbeNative,
-      probeProject: smokeProbeProject,
-      getProjectSnapshotMetrics: smokeProbeProject
-    });
-    try {
-      Object.defineProperty(globalThis, 'CodexOverleafSmoke', {
-        configurable: true,
-        enumerable: false,
-        value: helper
-      });
-    } catch (_error) {
-      globalThis.CodexOverleafSmoke = helper;
-    }
-  }
-
-  async function smokeProbeNative() {
-    try {
-      const params = CodexOverleafCompatibility?.buildBridgePingParams
-        ? CodexOverleafCompatibility.buildBridgePingParams(getExtensionCompatibilityMetadata())
-        : {};
-      const response = await sendBackgroundNative({ method: 'bridge.ping', params });
-      const compatibility = CodexOverleafCompatibility?.evaluateNativeCompatibility
-        ? CodexOverleafCompatibility.evaluateNativeCompatibility(response, getExtensionCompatibilityMetadata())
-        : fallbackNativeCompatibility(response);
-      return {
-        supported: true,
-        ok: response?.ok === true && isNativeCompatibilityCompatible(compatibility),
-        status: compatibility?.status || (response?.ok ? 'ok' : 'native_missing'),
-        classification: getNativeCompatibilityClassification(compatibility),
-        errorCode: response?.error?.code || compatibility?.status || '',
-        nativeCompatibility: summarizeSmokeNativeCompatibility(compatibility, response)
-      };
-    } catch (_error) {
-      return {
-        supported: true,
-        ok: false,
-        status: 'native_probe_failed',
-        errorCode: 'native_probe_failed'
-      };
-    }
-  }
 
-  async function smokeProbeProject(options = {}) {
-    try {
-      const project = await callPageBridge('getProjectSnapshot', {
-        force: Boolean(options.force),
-        preferLightweight: true,
-        allowZipFallback: true,
-        allowEditorNavigation: false,
-        requireFullProject: false,
-        includeBinaryFiles: true,
-        includeContent: false,
-        zipTimeoutMs: RUN_SNAPSHOT_ZIP_TIMEOUT_MS
-      });
-      const files = Array.isArray(project?.files) ? project.files : [];
-      const skipped = Array.isArray(project?.capabilities?.skipped) ? project.capabilities.skipped : [];
-      const bytes = summarizeSmokeProjectBytes(files);
-      const ok = project?.ok !== false && files.length > 0;
-      return {
-        supported: true,
-        ok,
-        status: ok ? 'ok' : 'project_snapshot_unavailable',
-        errorCode: ok ? '' : project?.code || 'project_snapshot_unavailable',
-        counts: {
-          files: files.length,
-          skipped: skipped.length
-        },
-        bytes,
-        method: project?.capabilities?.method || ''
-      };
-    } catch (_error) {
-      return {
-        supported: true,
-        ok: false,
-        status: 'project_probe_failed',
-        errorCode: 'project_probe_failed',
-        counts: {
-          files: 0,
-          skipped: 0
-        },
-        bytes: {
-          text: 0,
-          binary: 0
-        }
-      };
-    }
-  }
 
-  function summarizeSmokeNativeCompatibility(compatibility = {}, response = {}) {
-    const native = compatibility?.native || response?.result || {};
-    return {
-      status: compatibility?.status || (response?.ok ? 'ok' : 'native_missing'),
-      classification: getNativeCompatibilityClassification(compatibility),
-      nativeVersion: compatibility?.nativeVersion || native.version || '',
-      version: compatibility?.version || native.version || '',
-      minimumNativeVersion: compatibility?.minimumNativeVersion || compatibility?.minNativeVersion || '',
-      protocolVersion: compatibility?.protocolVersion || native.protocolVersion || '',
-      supportedProtocol: compatibility?.supportedProtocol || native.supportedProtocol || ''
-    };
-  }
 
-  function summarizeSmokeProjectBytes(files = []) {
-    return files.reduce((bytes, file) => {
-      let size = Number(file?.size || file?.byteLength || 0);
-      if ((!Number.isFinite(size) || size <= 0) && typeof file?.content === 'string') {
-        size = new TextEncoder().encode(file.content).byteLength;
-      }
-      if (!Number.isFinite(size) || size <= 0) {
-        return bytes;
-      }
-      if (file?.kind === 'binary') {
-        bytes.binary += size;
-      } else {
-        bytes.text += size;
-      }
-      return bytes;
-    }, {
-      text: 0,
-      binary: 0
-    });
-  }
 
   function listSeparator() {
     return getLocale() === 'zh' ? '、' : ', ';
@@ -1209,7 +1251,6 @@
         callbacks: {
           onLauncherToggle: () => ensurePanelOpen(),
           onClosePanel: () => closePanel(),
-          onLauncherVisibilityChange: visible => { if (!visible) closePanel(); },
           onRefresh: () => refreshProbe({ userInitiated: true }),
           onNewSession: () => startNewSession(),
           onChangeHistory: () => openChangeHistory(),
@@ -1285,6 +1326,7 @@
           onOtToggleClick: handleExperimentalOtToggleClick
         }
       });
+      writingStyleSettings.mount(panel);
       providerSettingsCoordinator.refreshSummary().catch(() => {});
 
       sessionPanelInstance = SessionPanel.create({
@@ -1321,6 +1363,7 @@
           onTaskKeydown: handleTaskInputKeydown,
           onTaskInput: handleTaskInput,
           onSlashMenuClick: handleSlashMenuClick,
+          onMenuLayoutChange: updateSlashMenuLayout,
           onClearSkillInvocation: clearComposerSkillInvocation,
           onAddContext: toggleContextTray,
           onAttachClick: () => panel.querySelector('[data-attach-input]')?.click(),
@@ -1347,34 +1390,87 @@
       renderContextSelection();
       scheduleMirrorPrefetch({ reason: 'cold-start', delayMs: 2500 });
       primeCodexOverleafSkillsCatalog().catch(() => { /* non-blocking */ });
+      primeCodexLocalSkillsCatalog().catch(() => { /* retry through settings, slash, or submission */ });
     }
 
     PanelRenderer.setVisible(panel, true);
   }
 
-  // One-shot catalog prime: the parallel-subagents broker gate reads
-  // state.codexOverleafSkills at run time. The catalog persists once filled
-  // (v1.6.1), but states saved by older builds have it stripped — without
-  // this prime, the gate stays silently off until the user happens to open
-  // the Skills page. Fire-and-forget on panel open; only fetches when the
-  // catalog is empty.
-  async function primeCodexOverleafSkillsCatalog() {
+  // Panel prefetch and first submission share the same official catalog read.
+  // A required read fails through the existing task-start error presentation.
+  let codexOverleafSkillsCatalogPromise = null;
+  async function primeCodexOverleafSkillsCatalog({ required = false } = {}) {
     if (Array.isArray(state?.codexOverleafSkills) && state.codexOverleafSkills.length) {
-      return;
-    }
-    if (getSkillLoadingSettings().loadCodexOverleafSkills === false) {
-      return;
-    }
-    const response = await sendBackgroundNative({
-      method: 'skills.list',
-      params: { scope: 'codex-overleaf' }
+      return state.codexOverleafSkills;
+    }
+    if (!required && getSkillLoadingSettings().loadCodexOverleafSkills === false) return [];
+    if (!codexOverleafSkillsCatalogPromise) {
+      codexOverleafSkillsCatalogPromise = sendBackgroundNative({
+        method: 'skills.list', params: { scope: 'codex-overleaf' }
+      }).then(response => {
+        const skills = Array.isArray(response?.result?.skills) ? response.result.skills : [];
+        if (!response?.ok || !skills.length) throw new Error(tx(
+          'Could not load Codex Overleaf skills. Try again.', '无法加载 Codex Overleaf 技能，请重试。'));
+        state = { ...state, codexOverleafSkills: skills };
+        saveStateSoon();
+        return skills;
+      }).finally(() => { codexOverleafSkillsCatalogPromise = null; });
+    }
+    return codexOverleafSkillsCatalogPromise;
+  }
+
+  // Local metadata stays in memory. A stale page/account read cannot become the
+  // next page's selected catalog, and an empty successful directory is valid.
+  let codexLocalSkillsCatalog = null;
+  let codexLocalSkillsWarnings = [];
+  let codexLocalSkillsCatalogScope = '';
+  let codexLocalSkillsCatalogRequest = null;
+  function getCodexLocalSkillsCatalogScope() {
+    return [cachedAccountScopeId, getCurrentProjectId(), spaRouteGeneration].join(':');
+  }
+
+  function getCodexLocalSkillsCatalog() {
+    return codexLocalSkillsCatalogScope === getCodexLocalSkillsCatalogScope() ? codexLocalSkillsCatalog : null;
+  }
+
+  function getCodexLocalSkillWarnings() {
+    return codexLocalSkillsCatalogScope === getCodexLocalSkillsCatalogScope() ? codexLocalSkillsWarnings : [];
+  }
+
+  async function primeCodexLocalSkillsCatalog({ required = false, force = false } = {}) {
+    const scope = getCodexLocalSkillsCatalogScope();
+    if (!required && !force && getSkillLoadingSettings().loadCodexLocalSkills === false) return [];
+    if (!force && codexLocalSkillsCatalogScope === scope && Array.isArray(codexLocalSkillsCatalog)) return codexLocalSkillsCatalog;
+    if (codexLocalSkillsCatalogRequest?.scope === scope) return codexLocalSkillsCatalogRequest.promise;
+    const request = { scope, promise: null };
+    request.promise = sendBackgroundNative({ method: 'skills.list', params: { scope: 'codex-local' } }).then(response => {
+      if (!response?.ok || !Array.isArray(response.result?.skills)) throw new Error(tx(
+        'Could not load local Codex skills. Try again.', '无法加载 Codex 本地技能，请重试。'));
+      if (scope !== getCodexLocalSkillsCatalogScope()) throw new Error(tx(
+        'The active project changed while loading skills. Try again.', '加载技能时活动项目已改变，请重试。'));
+      const seen = new Set();
+      const skills = response.result.skills.filter(skill => {
+        const id = String(skill?.id || '');
+        if (!isSafeSkillId(id) || seen.has(id)) return false;
+        seen.add(id); return true;
+      });
+      codexLocalSkillsCatalog = skills;
+      codexLocalSkillsWarnings = (Array.isArray(response.result.discoveryWarnings) ? response.result.discoveryWarnings : [])
+        .filter(warning => warning?.code === 'codex_local_skills_skipped' && Number.isSafeInteger(warning.count) && warning.count > 0)
+        .map(warning => ({ code: warning.code, count: warning.count }));
+      codexLocalSkillsCatalogScope = scope;
+      updateSkillsEntrySummary();
+      updateSlashMenuForTaskInput();
+      return skills;
+    }).catch(() => {
+      if (scope !== getCodexLocalSkillsCatalogScope()) throw new Error(tx(
+        'The active project changed while loading skills. Try again.', '加载技能时活动项目已改变，请重试。'));
+      throw new Error(tx('Could not load local Codex skills. Try again.', '无法加载 Codex 本地技能，请重试。'));
+    }).finally(() => {
+      if (codexLocalSkillsCatalogRequest === request) codexLocalSkillsCatalogRequest = null;
     });
-    const skills = Array.isArray(response?.result?.skills) ? response.result.skills : [];
-    if (!response?.ok || !skills.length) {
-      return;
-    }
-    state = { ...state, codexOverleafSkills: skills };
-    saveStateSoon();
+    codexLocalSkillsCatalogRequest = request;
+    return request.promise;
   }
 
   function closePanel() {
@@ -1457,6 +1553,10 @@
     panel.querySelectorAll('[data-i18n]').forEach(element => {
       element.textContent = tr(element.dataset.i18n);
     });
+    panel.querySelectorAll('[data-i18n-aria-label]').forEach(element => {
+      element.setAttribute('aria-label', tr(element.dataset.i18nAriaLabel));
+    });
+    panelRendererInstance?.setLocale?.({ launcher: tx('Show or hide Codex panel', '显示或隐藏 Codex 边栏'), close: tx('Close Codex panel', '关闭 Codex 边栏') });
 
     setElementTitleAndAria('[data-panel-resize-handle]', tr('resizePanel'), tr('resizePanel'));
     setElementTitleAndAria('[data-refresh]', tr('refreshProbe'), tr('refreshProbe'));
@@ -1476,7 +1576,7 @@
     setElementTitleAndAria('[data-context-refresh]', tr('refreshFileList'), tr('refreshFileList'));
     setElementTitleAndAria('[data-reasoning]', tr('reasoningLabel'), tr('reasoningLabel'));
     setElementTitleAndAria('[data-speed]', tr('speedLabel'), tr('speedLabel'));
-    setElementTitleAndAria('[data-run]', currentRunView ? tr('queueNextInput') : tr('send'), currentRunView ? tr('queueNextInput') : tr('send'));
+    syncComposerSendAvailability();
     setElementTitleAndAria('[data-stop-run]', tr('cancelRun'), tr('cancelRun'));
 
     const actions = panel.querySelector('.codex-vscode-head-actions');
@@ -1525,10 +1625,8 @@
     if (contextStatus && !contextStatus.dataset.customStatus) {
       contextStatus.textContent = tr('contextStatus');
     }
-    const emptyRunLabel = panel.querySelector('.empty-runs div');
-    if (emptyRunLabel) {
-      emptyRunLabel.textContent = tr('emptyRunLabel');
-    }
+    // Re-render rather than patch text: the first div is the animated mark.
+    if (arguments[0]?.reprojectDynamic !== false) runTimelineView.refreshLocale?.();
 
     syncModeControls();
     updateOtStatusDisplay();
@@ -1537,16 +1635,19 @@
     updateModelDisplay();
     renderSessionList();
     renderContextSelection();
-    const probeStatus = panel.querySelector('[data-probe-status]');
-    if (probeStatus?.dataset.refreshing === 'true') probeStatus.textContent = tr('refreshProbeLoading');
-    else if (probeStatus && probeStatusSnapshot?.projectId === getCurrentProjectId()) {
-      const { failed, probe, userInitiated } = probeStatusSnapshot;
-      const text = failed ? tr('refreshProbeFailed') : formatProbeStatusBar(probe);
-      probeStatus.textContent = userInitiated && !failed ? tr('refreshProbeDone', { status: text }) : text;
-      if (!failed) updateExistingProbeNotice(probe);
-    }
+    renderContextSummary();
+    renderPendingInputs();
+    renderComposerAttachments();
+    renderComposerSkillInvocation();
+    writingStyleSettings.sync();
     updateSkillsEntrySummary();
+    localSkillsPanel.refreshLocale?.();
     providerSettingsCoordinator.renderSummary();
+    providerSettingsCoordinator.refreshLocale?.();
+    settingsPanelInstance?.refreshLocale?.();
+    Modules.UpdateNotice?.refreshLocale?.();
+    DiagnosticsPanel.refreshLocale?.(diagnosticsPanelInstance, diagnosticsController.refreshLocale?.());
+    if (!panel.querySelector('[data-context-tray]')?.hidden) renderContextFiles();
     if (settingsPanelInstance?.container?.querySelector('[data-storage-card]')?.open) refreshStorageUsageSummary();
   }
 
@@ -1603,88 +1704,14 @@
   }
 
 
-  async function exportDiagnosticsBundle() {
-    if (!AuditRecords?.buildDiagnosticBundle) {
-      throw new Error('Audit diagnostics helper is unavailable');
-    }
-    const [auditLogs, mirror, nativeDiagnostics] = await Promise.all([
-      getRecentAuditLogsForCurrentProject(),
-      getMirrorFreshness().catch(error => ({ status: 'unavailable', errorCode: error.message })),
-      getNativeDiagnosticsSummaryForBundle()
-    ]);
-    const bundle = AuditRecords.buildDiagnosticBundle({
-      excludeContent: true,
-      compatibility: {
-        extension: getExtensionCompatibilityMetadata(),
-        modelDiscovery: getModelDiscovery()
-      },
-      platform: nativeDiagnostics.platform,
-      nativeEnvironment: nativeDiagnostics.nativeEnvironment,
-      mirror,
-      auditLogs,
-      run: currentRunView ? {
-        id: currentRunView.recordId || '',
-        status: 'running'
-      } : {},
-      governance: getGovernanceRulesForCurrentProject(),
-      projectId: getCurrentProjectId()
-    });
-    const blob = new Blob([JSON.stringify(bundle, null, 2)], { type: 'application/json' });
-    const url = URL.createObjectURL(blob);
-    const link = document.createElement('a');
-    link.href = url;
-    link.download = `codex-overleaf-diagnostics-${new Date().toISOString().replace(/[:.]/g, '-')}.json`;
-    document.body.append(link);
-    link.click();
-    link.remove();
-    window.setTimeout(() => URL.revokeObjectURL(url), 1000);
-    showPluginToast(tr('diagnosticsExportDone'), { status: 'completed' });
-  }
-
-  async function getNativeDiagnosticsSummaryForBundle() {
-    try {
-      const params = CodexOverleafCompatibility?.buildBridgePingParams
-        ? CodexOverleafCompatibility.buildBridgePingParams(getExtensionCompatibilityMetadata())
-        : {};
-      const response = await sendBackgroundNative({ method: 'bridge.ping', params });
-      if (!response?.ok) {
-        const errorCode = response?.error?.code || 'native_unavailable';
-        return {
-          platform: { status: 'unavailable', errorCode },
-          nativeEnvironment: { status: 'unavailable', errorCode }
-        };
-      }
-      return {
-        platform: {
-          host: response.result?.host || '',
-          platform: response.result?.platform || '',
-          version: response.result?.version || '',
-          protocolVersion: response.result?.protocolVersion || ''
-        },
-        nativeEnvironment: response.result?.environment || {}
-      };
-    } catch (error) {
-      const errorCode = error?.message || 'native_unavailable';
-      return {
-        platform: { status: 'unavailable', errorCode },
-        nativeEnvironment: { status: 'unavailable', errorCode }
-      };
-    }
-  }
 
-  async function getRecentAuditLogsForCurrentProject(limit = 12) {
-    const StorageDb = Modules.StorageDb;
-    if (!StorageDb?.getAllByIndex) {
-      return [];
-    }
-    const records = await StorageDb.getAllByIndex('auditLogs', 'projectId', getCurrentProjectId());
-    return (records || [])
-      .slice()
-      .sort((left, right) => String(right.createdAt || '').localeCompare(String(left.createdAt || '')))
-      .slice(0, limit);
-  }
 
 
+
+  function exportDiagnosticsBundle() {
+    return diagnosticsExporter.exportDiagnosticsBundle();
+  }
+
   function isContextTrayClickTarget(target) {
     return contextTrayController.isContextTrayClickTarget(target);
   }
@@ -1780,15 +1807,7 @@
   function resetContextProject() { return contextTrayController.resetContextProject(); }
 
   async function runTask(options = {}) {
-    // Barrier on a still-flying background mirror refresh from the previous
-    // turn (v1.7.5) BEFORE startRunView creates the new run view: the mirror's
-    // wrap-up events must land in the run that produced them, not the new
-    // one, and mirror.sync landing mid-run would swap the local baseline
-    // under Codex.
-    const pendingMirror = getPendingMirrorRefresh?.();
-    if (pendingMirror) {
-      await pendingMirror.catch(() => {});
-    }
+    // Capture the click before any preparation can yield to another draft/session.
     readPanelInputs();
     const queuedInput = options.queuedInput || null;
     const task = String(queuedInput?.text || state.task || '').trim();
@@ -1796,6 +1815,12 @@
       appendLog(tx('Enter a task first.', '请先输入任务。'));
       return;
     }
+    const submittedSessionId = state.activeSessionId;
+    const submittedSession = runController.captureSessionContext(state);
+    const submittedThreadId = getActiveSession(state)?.codexThreadId || '';
+    const submittedDraft = state.task;
+    const submittedRetryReplacement = pendingRetryReplacement;
+    const submittedWritingStyleScope = { accountScopeId: cachedAccountScopeId, projectId: getCurrentProjectId() };
     const submittedPanelState = {
       mode: state.mode,
       providerId: state.providerId,
@@ -1804,13 +1829,50 @@
       speedTier: state.speedTier,
       autoRecompile: state.autoRecompile !== false,
       requireReviewing: state.requireReviewing === true,
-      focusFiles: getActiveFocusFiles()
+      focusFiles: getActiveFocusFiles(),
+      selectionContext: selectionContextView.capture()
     };
-    const submittedCustomInstructions = getCustomInstructionsForCurrentProject();
-    const submittedSkillLoadingSettings = getSkillLoadingSettings();
-    const submittedAttachments = getComposerAttachmentsForRun();
-    const submittedSkillInvocation = getComposerSkillInvocationForRun();
+    const queuedContext = queuedInput
+      ? RunInputQueue.normalizeSubmissionContext(queuedInput.payload?.submissionContext) : null;
+    const submittedCustomInstructions = queuedContext ? queuedContext.customInstructions : getCustomInstructionsForCurrentProject();
+    const submittedSkillLoadingSettings = queuedContext ? queuedContext.skillLoadingSettings : getSkillLoadingSettings();
+    const submittedAttachments = queuedInput ? [] : getComposerAttachmentsForRun();
+    const submittedSkillInvocation = queuedContext ? queuedContext.skillInvocation : getComposerSkillInvocationForRun();
+    let submittedEnabledSkillIds = queuedContext ? queuedContext.enabledCodexOverleafSkillIds : getEnabledCodexOverleafSkillIds();
+    const submittedSkillEnabled = { ...state.codexOverleafSkillEnabled };
+    const submittedLocalSkillEnabled = { ...state.codexLocalSkillEnabled };
+    const submittedSelectionRevision = selectionContextView.getRevision?.();
+    let submittedEnabledLocalSkillIds = queuedContext ? queuedContext.enabledCodexLocalSkillIds : [];
+    if (!queuedInput && submittedSkillLoadingSettings.loadCodexLocalSkills !== false) {
+      const localSkills = await primeCodexLocalSkillsCatalog({ required: true, force: submittedSkillInvocation?.scope === 'codex-local' });
+      submittedEnabledLocalSkillIds = localSkills.filter(skill => Object.hasOwn(submittedLocalSkillEnabled, skill.id)
+        ? submittedLocalSkillEnabled[skill.id] !== false : skill.enabled !== false).map(skill => skill.id);
+    }
+    if (!queuedInput && submittedSkillInvocation?.scope === 'codex-local'
+      && (submittedSkillLoadingSettings.loadCodexLocalSkills === false || !submittedEnabledLocalSkillIds.includes(submittedSkillInvocation.id))) {
+      throw new Error(tx('The selected local Codex skill is unavailable or disabled. Select an enabled skill and try again.',
+        '所选 Codex 本地技能不可用或已关闭，请选择已启用的技能后重试。'));
+    }
+    if (!queuedInput && submittedSkillLoadingSettings.loadCodexOverleafSkills !== false) {
+      const skills = await primeCodexOverleafSkillsCatalog({ required: true });
+      submittedEnabledSkillIds = skills.map(skill => String(skill?.id || '').trim())
+        .filter(id => id && submittedSkillEnabled[id] !== false);
+    }
+    // Keep the previous mirror's completion events on its own run.
+    const pendingMirror = getPendingMirrorRefresh?.();
+    if (pendingMirror) await pendingMirror.catch(() => {});
     await providerSettingsCoordinator.ensureLoaded();
+    if (!queuedInput) await writingStyleSettings.ensureLoaded(true);
+    if (submittedWritingStyleScope.accountScopeId !== cachedAccountScopeId
+      || submittedWritingStyleScope.projectId !== getCurrentProjectId()) {
+      throw new Error(tx('The active project changed before submission. Submit the task again.',
+        '提交前活动项目已改变，请重新提交任务。'));
+    }
+    if (!findSessionById(submittedSessionId) || currentRunView) {
+      throw new Error(tx('The submitted session changed before submission. Submit the task again.',
+        '提交所属会话已改变，请重新提交任务。'));
+    }
+    submittedPanelState.writingStyle = queuedInput ? null : writingStyleSettings.capture();
     const executionSnapshot = queuedInput
       ? RunExecutionSnapshot.resolveForExecution(
         RunExecutionSnapshot.fromQueuePayload(queuedInput.payload),
@@ -1821,9 +1883,9 @@
     const submittedMode = executionSnapshot.mode;
     const submittedRequireReviewing = executionSnapshot.requireReviewing === true;
     const replaceRunId = queuedInput ? '' : runController.resolveRetryReplacement({
-      candidate: pendingRetryReplacement,
-      activeSessionId: state.activeSessionId,
-      runs: state.runs,
+      candidate: submittedRetryReplacement,
+      activeSessionId: submittedSessionId,
+      runs: findSessionById(submittedSessionId)?.runs,
       projectRunSettlement: run => WritebackSettlement.projectRunSettlement(run)
     });
 
@@ -1831,6 +1893,9 @@
     runCancellationController = new AbortController();
     setRunning(true);
     currentRunView = startRunView({
+      sessionId: submittedSessionId,
+      sessionContext: submittedSession,
+      codexThreadId: submittedThreadId,
       task,
       mode: submittedMode,
       model: executionSnapshot.model,
@@ -1842,9 +1907,10 @@
       queueItemId: queuedInput?.id || '',
       replaceRunId
     });
-    if (!queuedInput) pendingRetryReplacement = null;
+    if (!queuedInput && pendingRetryReplacement === submittedRetryReplacement) pendingRetryReplacement = null;
     const runSessionId = currentRunView.sessionId;
     let runAuditDraft = null;
+    let localSkillRestorePoint = null;
     try {
       if (queuedInput?.id) {
         await runQueueScheduler?.markExecuting(runSessionId, queuedInput.id, currentRunView.recordId);
@@ -1856,14 +1922,32 @@
         focusFiles: executionSnapshot.focusFiles,
         executionSnapshot
       }));
+      if (submittedWritingStyleScope.accountScopeId !== cachedAccountScopeId
+        || submittedWritingStyleScope.projectId !== getCurrentProjectId()) {
+        throw Object.assign(createRunCancellationError(), {
+          message: 'The active project or account changed before dispatch.'
+        });
+      }
       announceCrossTabRunStart();
       // Binary attachments belong to this submitted turn. The run record has
       // already captured their snapshots, so clear them from the composer
       // together with the submitted text. Persistent @context remains intact.
-      clearTaskComposer({ keepAttachments: false });
+      const submittedComposerCleared = !queuedInput && clearTaskComposer({ keepAttachments: false, submission: {
+        ...submittedWritingStyleScope,
+        sessionId: submittedSessionId, task: submittedDraft, attachments: submittedAttachments,
+        skillInvocation: submittedSkillInvocation, selectionContext: submittedPanelState.selectionContext,
+        selectionRevision: submittedSelectionRevision
+      } });
+      if (submittedComposerCleared && submittedSkillInvocation?.scope === 'codex-local'
+        && state.activeSessionId === submittedSessionId && !panel?.querySelector('[data-task]')?.value
+        && !getComposerAttachmentsForRun().length && !composerAttachmentController.getAttachmentByteUsage?.().pending
+        && !getComposerSkillInvocationForRun() && !selectionContextView.capture()) {
+        localSkillRestorePoint = { draftRevision: composerDraftRevision,
+          attachmentRevision: composerAttachmentController.getRevision?.(), selectionRevision: selectionContextView.getRevision?.() };
+      }
       syncComposerSendAvailability(true);
       appendRunEvent({
-        title: submittedSkillInvocation?.id === 'skill-installer'
+        title: submittedSkillInvocation?.id === 'skill-installer' && !submittedSkillInvocation.scope
           ? tx('I will use the Codex skill installer for this request.', '我会用 Codex skill installer 处理这个请求。')
           : tx('I will first understand your request, then inspect the relevant Overleaf files.', '我会先理解你的请求，再检查相关 Overleaf 文件。'),
         status: 'running',
@@ -1878,7 +1962,7 @@
           '@context': formatContextItems(executionSnapshot.focusFiles)
         }
       });
-      if (submittedSkillInvocation?.id === 'skill-installer') {
+      if (submittedSkillInvocation?.id === 'skill-installer' && !submittedSkillInvocation.scope) {
         await awaitRunStep(runSkillInstallerTask({
           task,
           runSessionId,
@@ -1886,6 +1970,8 @@
           submittedMode,
           submittedCustomInstructions,
           submittedSkillLoadingSettings,
+          submittedEnabledLocalSkillIds,
+          submittedEnabledSkillIds,
           submittedAttachments,
           submittedSkillInvocation,
           executionSnapshot
@@ -1946,6 +2032,7 @@
         project,
         snapshotWarnings,
         focusFiles,
+        focusFilesAreLiteral: true,
         isUsableProjectFileContent: Modules.ProjectFiles.isUsableProjectFileContent
       });
       let restrictToFocusFiles = runController.shouldRestrictWritebackToFocus({ focusFiles, focusedPartialSnapshot });
@@ -2014,8 +2101,7 @@
         }
       }
 
-      const activeSession = findSessionById(runSessionId) || getActiveSession(state);
-      const codexThreadId = activeSession?.codexThreadId || '';
+      const codexThreadId = submittedThreadId;
 
       // Resolve @compile-log if mentioned in task
       let compileLogContext = null;
@@ -2043,14 +2129,14 @@
             }
           });
           appendRunEvent({
-            title: tx(`Compile log unavailable: ${compileLogContext.reason}`, `编译日志不可用：${compileLogContext.reason}`),
+            title: tx(`Compile log unavailable: ${Modules.CompileAdapter.localizeCompileReason(compileLogContext.reason, getLocale())}`, `编译日志不可用：${Modules.CompileAdapter.localizeCompileReason(compileLogContext.reason, getLocale())}`),
             status: 'failed',
             failure: contextFailure
           });
         }
       }
 
-      const sensitiveFindings = await awaitRunStep(runSensitivePreflight({
+      let sensitiveFindings = await awaitRunStep(runSensitivePreflight({
         task,
         project,
         rules: getGovernanceRulesForCurrentProject(),
@@ -2087,6 +2173,8 @@
           compileLogContext,
           customInstructions: submittedCustomInstructions,
           skillLoadingSettings: submittedSkillLoadingSettings,
+          enabledCodexOverleafSkillIds: submittedEnabledSkillIds,
+          enabledCodexLocalSkillIds: submittedEnabledLocalSkillIds,
           attachments: submittedAttachments,
           skillInvocation: submittedSkillInvocation,
           submittedMode
@@ -2108,6 +2196,25 @@
         fileOverlays = null;
         otWarmStart = false;
         restrictToFocusFiles = staleRetry.restrictToFocusFiles;
+        const retryFindings = await awaitRunStep(runSensitivePreflight({
+          task, project, rules: getGovernanceRulesForCurrentProject(), useExistingMirror: false
+        }));
+        if (retryFindings.blocked) {
+          await finalizeAuditRecord(runAuditDraft, {
+            resultStatus: 'blocked_sensitive', sensitiveFindings: retryFindings.findings,
+            blockedFiles: retryFindings.findings.map(finding => ({
+              path: finding.path || finding.source || 'task', reason: finding.detectorId || 'sensitive'
+            }))
+          });
+          await finishRunView(tx('Blocked: sensitive content review required', '已阻止：需要处理敏感内容'), 'failed');
+          return;
+        }
+        if (retryFindings.findings.length) {
+          sensitiveFindings = {
+            blocked: false, findings: [...sensitiveFindings.findings, ...retryFindings.findings]
+          };
+          runAuditDraft = await updateAuditSensitiveFindings(runAuditDraft, sensitiveFindings.findings);
+        }
         response = await awaitRunStep(sendTrackedCodexRun(buildCodexRunParams({
             task,
             project,
@@ -2120,6 +2227,8 @@
             compileLogContext,
             customInstructions: submittedCustomInstructions,
             skillLoadingSettings: submittedSkillLoadingSettings,
+            enabledCodexOverleafSkillIds: submittedEnabledSkillIds,
+            enabledCodexLocalSkillIds: submittedEnabledLocalSkillIds,
             attachments: submittedAttachments,
             skillInvocation: submittedSkillInvocation,
             submittedMode
@@ -2151,14 +2260,17 @@
               compileLogContext,
               customInstructions: submittedCustomInstructions,
               skillLoadingSettings: submittedSkillLoadingSettings,
+              enabledCodexOverleafSkillIds: submittedEnabledSkillIds,
+              enabledCodexLocalSkillIds: submittedEnabledLocalSkillIds,
               attachments: submittedAttachments,
               skillInvocation: submittedSkillInvocation,
               submittedMode
             }));
         } else {
-          appendRunEvent({ title: tx('Cancelled: user chose not to create a new thread.', '已取消：用户选择不新建线程。'), status: 'rejected' });
-          await finalizeAuditRecord(runAuditDraft, { resultStatus: 'rejected' });
-          await finishRunView(tx('Cancelled', '已取消'), 'rejected');
+          appendRunEvent({ title: tx('Cancelled: user chose not to create a new thread.', '已取消：用户选择不新建线程。'), status: 'info',
+            activity: { v: 1, kind: 'lifecycle', state: 'cancelled', target: 'cancelled' } });
+          await finalizeAuditRecord(runAuditDraft, { resultStatus: 'cancelled' });
+          await finishRunView(tx('Cancelled', '已取消'), 'cancelled');
           return;
         }
       }
@@ -2166,11 +2278,16 @@
       if (!response.ok) {
         if (runCancellationRequested || isRunCancellationError(response.error)) {
           appendRunCancelledReport();
-          await finishRunView(tx('Cancelled', '已中断'), 'rejected');
+          await finishRunView(tx('Cancelled', '已取消'), 'cancelled');
           void finalizeAuditRecord(runAuditDraft, { resultStatus: 'cancelled' });
           return;
         }
-        const translated = translateRawError(response.error.message, { mode: submittedMode, locale: getLocale() });
+        if (response.error?.code === 'codex_local_skill_unavailable' && localSkillRestorePoint) {
+          restoreRejectedLocalSkillSubmission({ ...submittedWritingStyleScope, sessionId: submittedSessionId,
+            task: submittedDraft, attachments: submittedAttachments, skillInvocation: submittedSkillInvocation,
+            selectionContext: submittedPanelState.selectionContext }, localSkillRestorePoint);
+        }
+        const translated = translateRawError(response.error.message, { mode: submittedMode, locale: getLocale(), code: response.error?.code });
         // Structured FailureReason (§9.7): split bridge-availability from
         // Codex-side errors. `native_connection_failed` / `native_unavailable`
         // / `native_update_required` indicate the bridge itself is missing,
@@ -2182,7 +2299,11 @@
         // steps) existed but were never emitted, so everything collapsed into
         // "no usable result" and pointed users at the wrong recovery.
         const runErrorMessage = String(response.error?.message || '');
-        const codexRunFailure = response.error?.code === 'native_execution_interrupted'
+        const codexRunFailure = response.error?.code === 'codex_local_skill_unavailable'
+          ? buildContentFailure('codex_local_skill_unavailable', { path: 'codex.run' }, { technicalMessage: runErrorMessage })
+          : translated.failureCode === 'codex_local_skills_failed'
+            ? buildContentFailure('codex_local_skills_failed', { path: 'codex.run' }, { technicalMessage: runErrorMessage })
+          : response.error?.code === 'native_execution_interrupted'
           ? buildContentFailure('native_request_failed', { path: 'codex.run' }, {
             // The host IS installed — the request was interrupted mid-flight.
             // Telling this user to reinstall would be a misdiagnosis.
@@ -2420,7 +2541,7 @@
     } catch (error) {
       if (runCancellationRequested || isRunCancellationError(error)) {
         appendRunCancelledReport();
-        await finishRunView(tx('Cancelled', '已中断'), 'rejected');
+        await finishRunView(tx('Cancelled', '已取消'), 'cancelled');
         void finalizeAuditRecord(runAuditDraft, { resultStatus: 'cancelled' });
         return;
       }
@@ -2507,6 +2628,8 @@
     submittedMode,
     submittedCustomInstructions,
     submittedSkillLoadingSettings,
+    submittedEnabledLocalSkillIds,
+    submittedEnabledSkillIds,
     submittedAttachments,
     submittedSkillInvocation,
     executionSnapshot
@@ -2515,8 +2638,7 @@
       title: tx('Starting the Codex skill installer.', '正在启动 Codex skill installer。'),
       status: 'running'
     });
-    const activeSession = findSessionById(runSessionId) || getActiveSession(state);
-    const codexThreadId = activeSession?.codexThreadId || '';
+    const codexThreadId = currentRunView?.codexThreadId || '';
     const params = {
       projectId: getCurrentProjectId(),
       mode: submittedMode,
@@ -2524,27 +2646,29 @@
       model: executionSnapshot.model,
       reasoningEffort: executionSnapshot.reasoningEffort,
       speedTier: executionSnapshot.speedTier,
-      session: state.session,
+      session: currentRunView?.sessionContext,
+      clientRunId: currentRunView?.recordId || '',
+      clientSessionId: runSessionId,
+      accountScopeId: currentRunView?.runAccountScopeId || '',
       threadId: codexThreadId || undefined,
       customInstructions: submittedCustomInstructions || undefined,
       loadCodexLocalSkills: submittedSkillLoadingSettings?.loadCodexLocalSkills !== false,
       loadCodexOverleafSkills: submittedSkillLoadingSettings?.loadCodexOverleafSkills !== false,
+      enabledCodexLocalSkillIds: submittedEnabledLocalSkillIds,
+      enabledCodexOverleafSkillIds: submittedEnabledSkillIds,
       attachments: submittedAttachments.length ? submittedAttachments : undefined,
       skillInvocation: submittedSkillInvocation,
       focusFiles: [],
       skipMirrorSync: true
     };
 
-    const response = await sendNative({
-      method: 'codex.run',
-      params
-    });
+    const response = await sendTrackedCodexRun(params);
 
     if (!response.ok) {
       if (runCancellationRequested || isRunCancellationError(response.error)) {
         appendRunCancelledReport();
         await finalizeAuditRecord(runAuditDraft, { resultStatus: 'cancelled' });
-        await finishRunView(tx('Cancelled', '已中断'), 'rejected');
+        await finishRunView(tx('Cancelled', '已取消'), 'cancelled');
         return;
       }
       const translated = translateRawError(response.error.message, { mode: submittedMode, locale: getLocale() });
@@ -2738,19 +2862,31 @@
     if (currentRunView) {
       return queueComposerInput();
     }
+    if (runSubmissionPending) return;
+    runSubmissionPending = true;
     runTask().catch(error => {
-      setRunning(false);
-      nativeChannel.clearActiveRequest();
-      stopRunElapsedTick();
-      currentRunView = null;
-      runCancellationController = null;
+      if (!currentRunView) {
+        setRunning(false);
+        nativeChannel.clearActiveRequest();
+        stopRunElapsedTick();
+        runCancellationController = null;
+      }
       console.error('[codex-overleaf] failed to start task', error);
-      appendPlainLog(tx(`Could not start Codex task: ${error.message}`, `无法启动 Codex 任务：${error.message}`));
-    });
+      appendPlainLog(tx(`Could not start Codex task: ${localizeVisibleReason(error.message)}`, `无法启动 Codex 任务：${localizeVisibleReason(error.message)}`));
+    }).finally(() => { runSubmissionPending = false; });
   }
 
   const runGuidanceController = Modules.RunGuidanceController.create({
-    findRunRecord, appendRunEvent, getCurrentRunView: () => currentRunView,
+    findRunRecord, getCurrentRunView: () => getCurrentRunViewForRender(),
+    getActiveSessionId: () => state?.activeSessionId,
+    getScope: () => ({ accountScopeId: cachedAccountScopeId, projectId: getCurrentProjectId(), generation: spaRouteGeneration }),
+    getSessionCreatedAt: sessionId => findSessionById(sessionId)?.createdAt,
+    getRunRoot: target => target.sessionId === state?.activeSessionId
+      ? panel?.querySelector(`[data-run-id="${cssEscape(target.recordId)}"]`) : null,
+    onRecordChanged: target => updateSessionById(target.sessionId, {}),
+    onPresentationError: error => console.warn('[codex-overleaf] guidance presentation failed', error),
+    RunGuidanceView: Modules.RunGuidanceView, tx, maxRunEvents: MAX_RUN_EVENTS,
+    revealGuidance: row => runTimelineView.revealGuidance(row),
     renderRunEvent, cssEscape, bumpUnreadIfDetached
   });
 
@@ -2764,13 +2900,23 @@
       readInputs: readPanelInputs,
       getTask: () => panel?.querySelector('[data-task]')?.value || '',
       hasAttachments: () => getComposerAttachmentsForRun().length > 0,
-      capturePayload: () => RunExecutionSnapshot.toQueuePayload(captureCurrentExecutionSnapshot()),
+      capturePayload: () => ({
+        ...RunExecutionSnapshot.toQueuePayload(captureCurrentExecutionSnapshot()),
+        submissionContext: RunInputQueue.normalizeSubmissionContext({
+          customInstructions: getCustomInstructionsForCurrentProject(),
+          skillLoadingSettings: getSkillLoadingSettings(),
+          skillInvocation: getComposerSkillInvocationForRun(),
+          enabledCodexOverleafSkillIds: getEnabledCodexOverleafSkillIds(),
+          enabledCodexLocalSkillIds: getEnabledCodexLocalSkillIds()
+        })
+      }),
       prepareClaim: () => providerSettingsCoordinator.ensureLoaded(),
       resolveExecutionSnapshot: snapshot => RunExecutionSnapshot.resolveForExecution(snapshot, {
         catalog: providerSettingsCoordinator.getCatalog()
       }),
       clearTask: () => {
         panel.querySelector('[data-task]').value = '';
+        selectionContextView.clear();
         updateSessionById(state.activeSessionId, { task: '' });
         autosizeTaskTextarea();
         syncComposerSendAvailability();
@@ -2782,10 +2928,18 @@
         );
       },
       run: item => runTask({ queuedInput: item }),
-      sendSteer: params => sendBackgroundNative({ method: 'codex.steer', params }),
+      getGuideScope: () => ({ projectId: getCurrentProjectId(), accountScopeId: cachedAccountScopeId, generation: spaRouteGeneration }),
+      isGuideCancelled: () => runCancellationRequested || runCancellationController?.signal?.aborted === true,
+      preflightGuide: ({ task, assertCurrent }) => runSensitivePreflight({
+        task, project: { files: [] }, rules: getGovernanceRulesForCurrentProject(),
+        guidance: true, useExistingMirror: false, assertCurrent
+      }),
+      sendSteer: (params, context) => nativeCompatibilityController.sendBackgroundNative({ method: 'codex.steer', params }, context),
       getContainer: () => panel?.querySelector('[data-pending-inputs]'),
       createView: options => PendingInputView.create(options),
       appendEvent: (title, status) => appendRunEvent({ title, status }),
+      previewGuidance: runGuidanceController.preview,
+      clearGuidancePreview: runGuidanceController.clearPreview,
       appendGuidance: runGuidanceController.upsert,
       removeGuidance: runGuidanceController.remove,
       toast: (message, status) => showPluginToast(message, { status }),
@@ -2801,6 +2955,9 @@
     const requestedProviderId = submitted.providerId || state?.providerId || 'builtin';
     const selection = providerSettingsCoordinator.getRunSelection(requestedProviderId);
     const providerId = selection?.providerId || requestedProviderId;
+    const selectedContext = Object.prototype.hasOwnProperty.call(submitted, 'selectionContext')
+      ? submitted.selectionContext : selectionContextView.capture();
+    const selectedPaths = submitted.focusFiles ?? getActiveFocusFiles();
     return RunExecutionSnapshot.capture({
       mode: submitted.mode ?? state?.mode,
       providerId,
@@ -2810,7 +2967,11 @@
       speedTier: submitted.speedTier ?? state?.speedTier,
       autoRecompile: submitted.autoRecompile ?? state?.autoRecompile !== false,
       requireReviewing: submitted.requireReviewing ?? state?.requireReviewing === true,
-      focusFiles: submitted.focusFiles ?? getActiveFocusFiles()
+      focusFiles: selectedContext?.mode === 'edit' && selectedPaths.length
+        ? [...new Set([...selectedPaths, selectedContext.path])] : selectedPaths,
+      selectionContext: selectedContext,
+      writingStyle: Object.prototype.hasOwnProperty.call(submitted, 'writingStyle')
+        ? submitted.writingStyle : writingStyleSettings.capture()
     }, {
       source: 'submitted',
       requireProviderRevision: providerId !== 'builtin'
@@ -2818,6 +2979,18 @@
   }
 
   function queueComposerInput() {
+    if (getSkillLoadingSettings().loadCodexLocalSkills !== false && !Array.isArray(getCodexLocalSkillsCatalog())) {
+      primeCodexLocalSkillsCatalog({ required: true }).catch(() => {});
+      showPluginToast(tx('Local Codex skills are still loading. Try submitting again when loading finishes.',
+        'Codex 本地技能仍在加载，请在加载完成后重新提交。'), { status: 'info' });
+      return;
+    }
+    const invocation = getComposerSkillInvocationForRun();
+    if (invocation?.scope === 'codex-local' && !getEnabledCodexLocalSkillIds()?.includes(invocation.id)) {
+      showPluginToast(tx('The selected local Codex skill is unavailable or disabled. Select an enabled skill and try again.',
+        '所选 Codex 本地技能不可用或已关闭，请选择已启用的技能后重试。'), { status: 'failed' });
+      return;
+    }
     return runInputCoordinator?.queueComposerInput();
   }
 
@@ -2867,7 +3040,7 @@
       const nativeResult = results[0];
       const nativeResponse = nativeResult?.status === 'fulfilled' ? nativeResult.value : null;
       if (nativeResponse && !nativeResponse.ok) {
-        const message = nativeResponse?.error?.message || tx('native host did not respond', 'native host 没有响应');
+        const message = localizeVisibleReason(nativeResponse?.error?.message || tx('native host did not respond', 'native host 没有响应'));
         appendRunEvent({
           title: tx(`Cancel request was not delivered: ${message}`, `中断请求没有送达：${message}`),
           status: 'failed'
@@ -2909,25 +3082,8 @@
         force: true
       }
     });
-    if (response?.ok) {
-      const result = response.result || response;
-      const released = result.lockReleased === true || result.cancelled === true;
-      appendPlainLog(released
-        ? tx(
-          `Force-released the stuck Codex run for project ${projectKey}. You can retry now.`,
-          `已强制释放项目 ${projectKey} 的 Codex 占用，可以重试了。`
-        )
-        : tx(
-          `No stuck run was found for project ${projectKey}.`,
-          `没有发现项目 ${projectKey} 上的卡住任务。`
-        ));
-      return response;
-    }
-    const message = response?.error?.message || tx('native host did not respond', 'native host 没有响应');
-    appendPlainLog(tx(
-      `Force-release request was not delivered: ${message}`,
-      `强制释放请求没有送达：${message}`
-    ));
+    appendPlainLog(Modules.RunRecoveryActions.formatForceCancelOutcome(response, tx));
+    if (response?.ok !== true && response?.error?.message) appendPlainLog(localizeVisibleReason(response.error.message));
     return response;
   }
 
@@ -3031,6 +3187,12 @@
       .filter(id => id && isCodexOverleafSkillEnabled(id));
   }
 
+  function getEnabledCodexLocalSkillIds() {
+    if (getSkillLoadingSettings().loadCodexLocalSkills === false) return [];
+    const skills = getCodexLocalSkillsCatalog();
+    return Array.isArray(skills) ? skills.filter(skill => isCodexLocalSkillEnabled(skill.id, skill)).map(skill => skill.id) : undefined;
+  }
+
   function buildCodexRunParams({
     task,
     project,
@@ -3043,12 +3205,16 @@
     compileLogContext,
     customInstructions,
     skillLoadingSettings,
+    enabledCodexOverleafSkillIds,
+    enabledCodexLocalSkillIds,
     attachments,
     skillInvocation,
     submittedMode
   } = {}) {
     const executionSnapshot = currentRunView?.executionSnapshot || captureCurrentExecutionSnapshot();
-    const submittedState = RunExecutionSnapshot.applyToState(state, executionSnapshot);
+    const submittedState = RunExecutionSnapshot.applyToState({
+      ...state, session: currentRunView?.sessionContext || state.session
+    }, executionSnapshot);
     const params = runController.buildCodexRunParams({
       currentProjectId: getCurrentProjectId(),
       state: submittedState,
@@ -3068,7 +3234,9 @@
           ? getSkillLoadingSettings()
           : { loadCodexLocalSkills: true, loadCodexOverleafSkills: true })
         : skillLoadingSettings,
-      enabledCodexOverleafSkillIds: getEnabledCodexOverleafSkillIds(),
+      enabledCodexOverleafSkillIds: enabledCodexOverleafSkillIds === undefined
+        ? getEnabledCodexOverleafSkillIds() : enabledCodexOverleafSkillIds,
+      enabledCodexLocalSkillIds,
       attachments,
       skillInvocation,
       compileLogContext,
@@ -3078,16 +3246,31 @@
       ...params,
       clientRunId: currentRunView?.recordId || '',
       clientSessionId: currentRunView?.sessionId || '',
-      providerSelection: RunExecutionSnapshot.toProviderSelection(executionSnapshot)
+      providerSelection: RunExecutionSnapshot.toProviderSelection(executionSnapshot),
+      selectionContext: executionSnapshot.selectionContext || null,
+      accountScopeId: currentRunView?.runAccountScopeId || cachedAccountScopeId || '',
+      writingStyle: executionSnapshot.writingStyle || null
     };
   }
 
   async function sendTrackedCodexRun(params) {
-    const compatibilityGate = await nativeCompatibilityController.ensureForMethod('codex.run');
+    const owner = currentRunView;
+    const signal = runCancellationController?.signal;
+    const assertCurrent = () => {
+      if (signal?.aborted || (owner && owner !== currentRunView)) throw createRunCancellationError();
+      throwIfRunCancellationRequested();
+      if (owner && (owner.runProjectId !== getCurrentProjectId()
+        || owner.runAccountScopeId !== cachedAccountScopeId)) {
+        throw Object.assign(createRunCancellationError(), {
+          message: 'The active project or account changed before dispatch.'
+        });
+      }
+    };
+    const compatibilityGate = await nativeCompatibilityController.ensureForMethod('codex.run', { assertCurrent });
+    assertCurrent();
     if (!compatibilityGate.ok) {
       return compatibilityGate.response;
     }
-    throwIfRunCancellationRequested();
     const tracked = nativeChannel.sendNativeTracked(nativeCompatibilityController.attachEvidence({
       method: 'codex.run',
       params
@@ -3118,6 +3301,12 @@
     const projectKey = getCurrentProjectId();
     const recovery = await activeTurnControl.recoverJournals({
       projectKey,
+      accountScopeId: cachedAccountScopeId,
+      requireOwnerLost: Modules.StorageDb.sharedSessionsEnabled?.() === true,
+      normalizeInterruptedRun: record => Object.assign(record, Modules.SessionState.normalizeRuns([record], {
+        restoreRunningRuns: true,
+        locale: getLocale()
+      })[0]),
       findSession: findSessionById,
       getActiveSession: () => getActiveSession(state),
       createInterruptedRun: journal => ({
@@ -3160,7 +3349,7 @@
       maxEvents: MAX_RUN_EVENTS
     });
     if (recovery.changed) {
-      await saveState();
+      if (await saveState({ recoveryRuns: recovery.recoveredRuns }) !== true) return;
       for (const requestId of recovery.acknowledgeIds) {
         await activeTurnControl.acknowledge(requestId).catch(() => false);
       }
@@ -3172,11 +3361,17 @@
     if (!StorageDb || !AuditRecords) {
       return null;
     }
+    // Audit follows the captured run owner even if the visible page changes.
+    // Missing owner identity must never be filled with a later account.
+    const accountScopeId = currentRunView ? currentRunView.runAccountScopeId : cachedAccountScopeId;
+    const projectId = currentRunView ? currentRunView.runProjectId : getCurrentProjectId();
+    if (!accountScopeId || !projectId) return null;
     const executionSnapshot = input.executionSnapshot
       || currentRunView?.executionSnapshot
       || captureCurrentExecutionSnapshot();
     const draft = AuditRecords.buildAuditDraftRecord({
-      projectId: getCurrentProjectId(),
+      accountScopeId,
+      projectId,
       sessionId: input.sessionId || '',
       turnId: currentRunView?.recordId || '',
       mode: input.mode || executionSnapshot.mode,
@@ -3211,8 +3406,10 @@
       return draft;
     }
     const record = StorageDb.buildAuditLogRecord
-      ? StorageDb.buildAuditLogRecord({ ...draft, ...updates, id: draft.id, completedAt: updates.completedAt || draft.completedAt || '' })
-      : { ...draft, ...updates };
+      ? StorageDb.buildAuditLogRecord({ ...draft, ...updates, id: draft.id,
+        accountScopeId: draft.accountScopeId, projectId: draft.projectId,
+        completedAt: updates.completedAt || draft.completedAt || '' })
+      : { ...draft, ...updates, id: draft.id, accountScopeId: draft.accountScopeId, projectId: draft.projectId };
     return StorageDb.putRecord('auditLogs', record).then(() => record).catch(() => draft);
   }
 
@@ -3242,121 +3439,10 @@
   }
 
   async function runSensitivePreflight(options) {
-    options = options || {};
-    const { task, project, rules, useExistingMirror = false } = options;
-    const normalizedRules = normalizeGovernanceRules(rules);
-    if (normalizedRules.sensitiveCheckEnabled === false) {
-      return { blocked: false, findings: [] };
-    }
-    if (!SensitiveScan?.scanSensitiveInputs && !useExistingMirror) {
-      return { blocked: false, findings: [] };
-    }
-    let findings = SensitiveScan?.scanSensitiveInputs
-      ? SensitiveScan.scanSensitiveInputs({
-        task,
-        files: (project?.files || []).filter(isTextSnapshotFile)
-      })
-      : [];
-    if (useExistingMirror) {
-      findings = dedupeSensitiveFindings([
-        ...findings,
-        ...await scanNativeMirrorSensitiveFindings()
-      ]);
-    }
-    if (!findings.length) {
-      return { blocked: false, findings: [] };
-    }
-    appendRunEvent({
-      title: tx(
-        `Sensitive content check found ${findings.length} item(s).`,
-        `敏感内容检查发现 ${findings.length} 项。`
-      ),
-      status: 'failed',
-      detail: findings.slice(0, 8).map(finding => ({
-        [tr('detailFile')]: finding.path || finding.source || 'task',
-        [tr('detailReason')]: finding.detectorId,
-        [tx('Preview', '预览')]: finding.preview || '[REDACTED]'
-      }))
-    });
-    if (normalizedRules.sensitiveConfirmAllowed === true) {
-      const approved = await showPluginConfirm({
-        title: tr('sensitiveConfirmTitle'),
-        message: formatSensitiveConfirmMessage(findings),
-        confirmLabel: tr('sensitiveConfirmRun'),
-        cancelLabel: tr('confirmDefaultCancel'),
-        destructive: true
-      });
-      return { blocked: !approved, findings };
-    }
-    appendCompletionReport({
-      conclusion: tx(
-        'This run was blocked before Codex received project context because sensitive content was detected.',
-        '检测到敏感内容，本轮已在向 Codex 发送项目上下文前阻止。'
-      ),
-      status: 'blocked',
-      operations: [],
-      applyResults: [],
-      nextStep: tx(
-        'Remove the sensitive content, narrow @context, or enable explicit sensitive confirmation in Project Settings.',
-        '请移除敏感内容、缩小 @context，或在项目设置里允许敏感内容显式确认。'
-      )
-    });
-    return { blocked: true, findings };
-  }
-
-  function formatSensitiveConfirmMessage(findings = []) {
-    const visible = findings.slice(0, 8).map(finding => {
-      const path = finding.path || finding.source || 'task';
-      return `${path}: ${finding.detectorId || 'sensitive'} (${finding.preview || '[REDACTED]'})`;
-    });
-    return [
-      tr('sensitiveConfirmMessage'),
-      '',
-      ...visible,
-      findings.length > visible.length ? tx(`${findings.length - visible.length} more finding(s).`, `另有 ${findings.length - visible.length} 项。`) : ''
-    ].filter(Boolean).join('\n');
-  }
-
-  async function scanNativeMirrorSensitiveFindings() {
-    try {
-      const response = await sendBackgroundNative({
-        method: 'mirror.scanSensitive',
-        params: { projectId: getCurrentProjectId() }
-      });
-      if (response?.ok) {
-        return Array.isArray(response.result?.findings) ? response.result.findings : [];
-      }
-      return [{
-        detectorId: 'mirror-sensitive-scan-unavailable',
-        source: 'local-mirror',
-        preview: response?.error?.message || 'Could not scan the local mirror before Codex runs.'
-      }];
-    } catch (error) {
-      return [{
-        detectorId: 'mirror-sensitive-scan-unavailable',
-        source: 'local-mirror',
-        preview: error?.message || 'Could not scan the local mirror before Codex runs.'
-      }];
-    }
-  }
-
-  function dedupeSensitiveFindings(findings = []) {
-    const seen = new Set();
-    const deduped = [];
-    for (const finding of findings || []) {
-      const key = [
-        finding?.detectorId || '',
-        finding?.source || '',
-        finding?.path || '',
-        finding?.preview || ''
-      ].join('\u0000');
-      if (seen.has(key)) {
-        continue;
-      }
-      seen.add(key);
-      deduped.push(finding);
-    }
-    return deduped;
+    return Modules.SensitivePreflight.create({
+      SensitiveScan, normalizeGovernanceRules, isTextSnapshotFile, sendBackgroundNative,
+      getCurrentProjectId, appendRunEvent, appendCompletionReport, showPluginConfirm, tr, tx
+    }).run(options);
   }
 
   function appendRunCancelledReport() {
@@ -3364,11 +3450,12 @@
       .some(item => item?.status === 'queued');
     appendRunEvent({
       title: tx('Current Codex task was cancelled.', '已中断当前 Codex 任务。'),
-      status: 'failed'
+      status: 'info',
+      activity: { v: 1, kind: 'lifecycle', state: 'cancelled', target: 'cancelled' }
     });
     appendCompletionReport({
       conclusion: tx('This run was cancelled. It did not continue syncing or writing to Overleaf.', '这轮已中断，没有继续同步或写入 Overleaf。'),
-      status: 'rejected',
+      status: 'cancelled',
       operations: [],
       applyResults: [],
       nextStep: hasQueuedFollowUp
@@ -3407,6 +3494,7 @@
       : !hasInput;
     runButton.title = label;
     runButton.setAttribute('aria-label', label);
+    if (currentRunView?.writebackRetry && hasInput) runButton.disabled = true;
   }
 
   function handleTaskInputKeydown(event) {
@@ -3421,6 +3509,7 @@
   }
 
   function handleTaskInput() {
+    composerDraftRevision += 1;
     autosizeTaskTextarea();
     syncComposerSendAvailability();
     renderPendingInputs();
@@ -3443,10 +3532,8 @@
         subtitle: tr('slashInstallSkillSubtitle')
       }
     ];
-    if (getSkillLoadingSettings().loadCodexOverleafSkills === false) {
-      return commands;
-    }
-    for (const skill of slashCodexOverleafSkills) {
+    const settings = getSkillLoadingSettings();
+    for (const skill of settings.loadCodexOverleafSkills === false ? [] : slashCodexOverleafSkills) {
       const id = String(skill?.id || '').trim();
       if (!isSafeSkillId(id)) {
         continue;
@@ -3462,13 +3549,28 @@
         scope: 'codex-overleaf',
         skillId: id,
         title,
-        subtitle: tr('slashUseSkillSubtitle')
+        subtitle: tr('slashUseOverleafSkillSubtitle')
       });
     }
+    const localSkills = settings.loadCodexLocalSkills === false ? [] : (getCodexLocalSkillsCatalog() || []);
+    for (const skill of localSkills) {
+      if (!isSafeSkillId(skill.id) || !isCodexLocalSkillEnabled(skill.id, skill)) continue;
+      const sameName = localSkills.filter(other => String(other.title || other.name || other.id) === String(skill.title || skill.name || skill.id)).length > 1;
+      commands.push({ id: `local-skill:${skill.id}`, kind: 'codex-local-skill', scope: 'codex-local', skillId: skill.id,
+        title: String(skill.title || skill.name || skill.id).trim().slice(0, 80),
+        searchName: String(skill.name || ''),
+        subtitle: tr('slashUseLocalSkillSubtitle') + (skill.sourceKind === 'plugin' && skill.sourceLabel ? ' · ' + skill.sourceLabel : '')
+          + (sameName ? ' · ' + (skill.sourceHint || skill.id.slice(-8)) : '') });
+    }
     return commands;
   }
 
   async function refreshCodexOverleafSkillsForSlashMenu() {
+    if (getSlashTrigger() && getSkillLoadingSettings().loadCodexLocalSkills !== false) {
+      primeCodexLocalSkillsCatalog().catch(() => {
+        showPluginToast(tx('Could not load local Codex skills. Try again.', '无法加载 Codex 本地技能，请重试。'), { status: 'failed' });
+      });
+    }
     if (slashCodexOverleafSkillsLoaded || slashCodexOverleafSkillsLoading) {
       return;
     }
@@ -3502,7 +3604,8 @@
       const commands = getSlashCommands().filter(command => {
         return !query
           || command.title.toLowerCase().includes(query)
-          || command.id.toLowerCase().includes(query);
+          || command.id.toLowerCase().includes(query)
+          || String(command.searchName || '').toLowerCase().includes(query);
       });
       renderSlashMenu(commands);
       return;
@@ -3717,6 +3820,17 @@
     renderedSlashCommands = new Map(commands.map(command => [command.id, command]));
     menu.dataset.activeIndex = '0';
     menu.hidden = false;
+    menu.scrollTop = 0;
+    updateSlashMenuLayout();
+  }
+
+  function updateSlashMenuLayout() {
+    const menu = panel?.querySelector('[data-slash-menu]');
+    const composer = panel?.querySelector('[data-composer-form]');
+    if (!menu || menu.hidden || !composer) return;
+    const visibleTop = Math.max(0, root.visualViewport?.offsetTop || 0, panel.getBoundingClientRect().top);
+    const available = Math.max(0, Math.floor(composer.getBoundingClientRect().top - visibleTop - 12));
+    menu.style.setProperty('--codex-slash-menu-space', `${available}px`);
   }
 
   function handleSlashMenuClick(event) {
@@ -3775,6 +3889,18 @@
     buttons.forEach((button, buttonIndex) => {
       button.dataset.active = buttonIndex === index ? 'true' : 'false';
     });
+    const active = buttons[index];
+    if (!active || !menu.clientHeight) return;
+    const viewport = menu.getBoundingClientRect();
+    const item = active.getBoundingClientRect();
+    const top = viewport.top + menu.clientTop;
+    const bottom = top + menu.clientHeight;
+    // Scroll only this popup; scrollIntoView may move the chat or editor too.
+    if (item.height > menu.clientHeight || item.top < top) {
+      menu.scrollTop += item.top - top;
+    } else if (item.bottom > bottom) {
+      menu.scrollTop += item.bottom - bottom;
+    }
   }
 
   function selectSlashCommand(commandId) {
@@ -3796,7 +3922,7 @@
       activateSkillInstallerComposerContext();
       return;
     }
-    if (command.kind === 'codex-overleaf-skill') {
+    if (command.kind === 'codex-overleaf-skill' || command.kind === 'codex-local-skill') {
       activateCodexOverleafSkillComposerContext(command);
     }
   }
@@ -3823,6 +3949,7 @@
   }
 
   function activateSkillInstallerComposerContext() {
+    composerDraftRevision += 1;
     composerSkillInvocation = {
       id: 'skill-installer',
       title: tr('skillInstallerComposerLabel')
@@ -3833,6 +3960,7 @@
   }
 
   function activateCodexOverleafSkillComposerContext(command) {
+    composerDraftRevision += 1;
     const id = String(command?.skillId || '').trim();
     if (!isSafeSkillId(id)) {
       return;
@@ -3840,7 +3968,7 @@
     composerSkillInvocation = {
       id,
       title: String(command?.title || id).trim().slice(0, 80) || id,
-      scope: 'codex-overleaf'
+      scope: command.scope === 'codex-local' ? 'codex-local' : 'codex-overleaf'
     };
     renderComposerSkillInvocation();
     const input = panel?.querySelector('[data-task]');
@@ -3848,6 +3976,7 @@
   }
 
   function clearComposerSkillInvocation() {
+    composerDraftRevision += 1;
     composerSkillInvocation = null;
     renderComposerSkillInvocation();
     panel?.querySelector('[data-task]')?.focus?.();
@@ -3858,7 +3987,7 @@
     if (!normalized) {
       return null;
     }
-    if (normalized.id === 'skill-installer') {
+    if (normalized.id === 'skill-installer' && !normalized.scope) {
       return {
         id: 'skill-installer',
         title: tr('skillInstallerComposerLabel')
@@ -3873,13 +4002,9 @@
       return null;
     }
     const title = String(value?.title || id).trim().slice(0, 80) || id;
-    if (id === 'skill-installer') {
-      return { id, title };
-    }
-    if (value?.scope !== 'codex-overleaf') {
-      return null;
-    }
-    return { id, title, scope: 'codex-overleaf' };
+    if (id === 'skill-installer' && (!value?.scope || value.scope === 'builtin')) return { id, title };
+    if (!['codex-overleaf', 'codex-local'].includes(value?.scope)) return null;
+    return { id, title, scope: value.scope };
   }
 
   function isSafeSkillId(id) {
@@ -3900,7 +4025,7 @@
     }
     const clear = context.querySelector('[data-composer-skill-clear]');
     if (clear) {
-      const clearLabel = active?.id === 'skill-installer'
+      const clearLabel = active?.id === 'skill-installer' && !active.scope
         ? tr('skillInstallerComposerClear')
         : tr('composerSkillClear');
       clear.title = clearLabel;
@@ -3941,72 +4066,6 @@
     return writebackController.buildSyncApplyOperations(syncChanges, project);
   }
 
-  function partitionUnsafeProjectPathOperations(operations = []) {
-    const safe = [];
-    const skipped = [];
-    for (const operation of operations || []) {
-      const normalized = normalizeOperationProjectPaths(operation);
-      const invalid = getInvalidOperationProjectPath(normalized);
-      if (invalid) {
-        skipped.push({
-          operation: normalized,
-          result: {
-            ok: false,
-            code: 'invalid_project_path',
-            reason: tx(`Invalid ${invalid}. Codex did not write this file.`, `路径无效：${invalid}。Codex 没有写入这个文件。`)
-          }
-        });
-        continue;
-      }
-      safe.push(normalized);
-    }
-    return { safe, skipped };
-  }
-
-  function normalizeOperationProjectPaths(operation = {}) {
-    if (!operation || typeof operation !== 'object') {
-      return operation;
-    }
-    const normalized = { ...operation };
-    if (typeof operation.path === 'string') {
-      normalized.path = normalizeSafeProjectPath(operation.path);
-      if (!normalized.path) {
-        normalized.invalidProjectPath = true;
-      }
-    }
-    if (typeof operation.to === 'string') {
-      normalized.to = normalizeSafeProjectPath(operation.to);
-      if (!normalized.to) {
-        normalized.invalidProjectDestinationPath = true;
-      }
-    }
-    if (typeof operation.destinationPath === 'string') {
-      normalized.destinationPath = normalizeSafeProjectPath(operation.destinationPath);
-      if (!normalized.destinationPath) {
-        normalized.invalidProjectDestinationPath = true;
-      }
-    }
-    return normalized;
-  }
-
-  function getInvalidOperationProjectPath(operation = {}) {
-    if (operation.invalidProjectPath || (requiresOperationPath(operation) && !operation.path)) {
-      return 'operation path';
-    }
-    if (operation.invalidProjectDestinationPath || (requiresOperationDestinationPath(operation) && !(operation.to || operation.destinationPath))) {
-      return 'operation destination path';
-    }
-    return '';
-  }
-
-  function requiresOperationPath(operation = {}) {
-    return ['edit', 'create', 'delete', 'rename', 'move', 'binary-create', 'overwrite-binary'].includes(operation.type);
-  }
-
-  function requiresOperationDestinationPath(operation = {}) {
-    return operation.type === 'rename' || operation.type === 'move';
-  }
-
   function normalizeSafeProjectPath(value) {
     if (Modules.ProjectFiles?.normalizeSafeProjectPath) {
       return Modules.ProjectFiles.normalizeSafeProjectPath(value);
@@ -4018,157 +4077,9 @@
       .replace(/^\/+/, '');
   }
 
-  function evaluateGovernedOperations(operations = []) {
-    if (!GovernanceRules?.evaluateGovernedOperations) {
-      return { allowed: operations || [], blocked: [], rules: getGovernanceRulesForCurrentProject() };
-    }
-    return GovernanceRules.evaluateGovernedOperations(operations, getGovernanceRulesForCurrentProject());
-  }
-
-  function buildGovernanceSkippedApplyResult(blockedItems = []) {
-    return {
-      ok: blockedItems.length === 0,
-      applied: [],
-      skipped: (blockedItems || []).map(item => ({
-        operation: item.operation,
-        result: {
-          ok: false,
-          code: 'governance_blocked',
-          reason: formatGovernanceBlockedReason(item),
-          reasonKey: item.reason || 'governance_blocked'
-        }
-      }))
-    };
-  }
-
-  function formatGovernanceBlockedReason(item = {}) {
-    if (item.reason === 'readonly') {
-      return tx(
-        'Project governance marked this path read-only, so Codex did not write it.',
-        '项目治理规则将此路径标记为只读，因此 Codex 没有写入。'
-      );
-    }
-    if (item.reason === 'writable_allowlist') {
-      return tx(
-        'Project governance allows writes only to configured writable patterns, and this path is outside that allowlist.',
-        '项目治理规则只允许写入配置的可写路径，此路径不在允许范围内。'
-      );
-    }
-    return tx('Project governance blocked this write.', '项目治理规则阻止了此写入。');
-  }
-
-  function filterSyncChangesByOperations(syncChanges = [], operations = []) {
-    const allowedPaths = new Set((operations || []).map(operation => operation.path).filter(Boolean));
-    return (syncChanges || []).filter(change => allowedPaths.has(change?.path));
-  }
-
-  function mergeApplyResultSkipped(result = {}, skipped = []) {
-    if (!skipped.length) {
-      return result;
-    }
-    return {
-      ...(result || {}),
-      ok: false,
-      applied: Array.isArray(result?.applied) ? result.applied : [],
-      skipped: [
-        ...getSkippedEntries(result),
-        ...skipped
-      ]
-    };
-  }
-
-  async function confirmBinaryOperations(operations = []) {
-    const binaryOperations = (operations || []).filter(operation => operation.type === 'binary-create' || operation.type === 'overwrite-binary');
-    if (!binaryOperations.length) {
-      return { operations, skipped: [] };
-    }
-    const approved = await showPluginConfirm({
-      title: tr('binaryAssetConfirmTitle'),
-      message: tr('binaryAssetConfirmMessage', { files: formatOperationFiles(binaryOperations) }),
-      confirmLabel: tr('binaryAssetConfirm'),
-      cancelLabel: tr('binaryAssetCancel'),
-      destructive: true
-    });
-    if (approved) {
-      return { operations, skipped: [] };
-    }
-    return {
-      operations: operations.filter(operation => operation.type !== 'binary-create' && operation.type !== 'overwrite-binary'),
-      skipped: binaryOperations.map(operation => ({
-        operation,
-        result: {
-          ok: false,
-          code: 'binary_confirmation_rejected',
-          reason: tx('Binary asset writeback requires explicit confirmation and was skipped.', '二进制资源写回需要显式确认，已跳过。')
-        }
-      }))
-    };
-  }
-
-  function buildAuditDiffSummary(operations = []) {
-    const changedFiles = new Set();
-    let binaryFilesChanged = 0;
-    for (const operation of operations || []) {
-      if (operation?.path) {
-        changedFiles.add(operation.path);
-      }
-      if (operation?.type === 'binary-create' || operation?.type === 'overwrite-binary') {
-        binaryFilesChanged++;
-      }
-    }
-    return {
-      filesChanged: changedFiles.size,
-      additions: 0,
-      deletions: 0,
-      binaryFilesChanged
-    };
-  }
-
-  function buildAuditSummaryFromApply({ operations = [], applyResults = [], blockedFiles = [], resultStatus = 'completed', saveVerification = null } = {}) {
-    const appliedFiles = [];
-    const skippedFiles = [];
-    for (const result of applyResults || []) {
-      for (const item of getAppliedEntries(result)) {
-        appliedFiles.push(summarizeOperationForAudit(item.operation, item.result, 'applied'));
-      }
-      for (const item of getSkippedEntries(result)) {
-        skippedFiles.push(summarizeOperationForAudit(item.operation, item.result, 'skipped'));
-      }
-    }
-    return {
-      changedFiles: (operations || []).map(operation => summarizeOperationForAudit(operation, {}, 'changed')),
-      ['diffSummary']: buildAuditDiffSummary(operations),
-      blockedFiles,
-      appliedFiles,
-      skippedFiles,
-      resultStatus,
-      saveVerification
-    };
-  }
-
-  // Tolerates `operation` and `result` being null in addition to undefined.
-  // Default-parameter values fire only for `undefined`, but the v1.3.8
-  // write-guard (pageBridge.runWriteGuard / writebackRouter.checkWritebackRunProjectId)
-  // emits batch-level skips with `operation: null` — there is no specific
-  // op to attribute the block to. Without this normalization the audit pass
-  // crashed with "Cannot read properties of null (reading 'path')", the
-  // outer-catch swallowed the partial-sync conclusion, and the user saw the
-  // misleading "local Codex returned no usable result" fallback.
-  function summarizeOperationForAudit(operation, result, status = '') {
-    const op = operation || {};
-    const res = result || {};
-    return {
-      path: op.path || op.from || op.to || '',
-      destinationPath: op.destinationPath || op.to || '',
-      type: op.type || '',
-      reason: res.reasonKey || res.code || res.reason || op.reasonKey || op.reason || '',
-      status,
-      size: op.size
-    };
-  }
-
-  function getSyncChangePatches(change = {}) {
-    return writebackController.getSyncChangePatches(change);
+
+  function getSyncChangePatches(change = {}) {
+    return writebackController.getSyncChangePatches(change);
   }
 
   function normalizeTextPatches(patches) {
@@ -4276,6 +4187,17 @@
   // saveState. Returning null puts the record in degraded mode and excludes
   // it from cross-project queries (spec §5.2 storage rules).
   window.codexOverleafDeriveAccountScopeId = () => cachedAccountScopeId;
+  var sharedSessionViewSync = Modules.SharedSessionViewSync.install({
+    Bridge: Modules.SharedSessionBridge, StorageDb: Modules.StorageDb,
+    getScope: () => ({ accountScopeId: cachedAccountScopeId, projectId: getCurrentProjectId(), generation: spaRouteGeneration }),
+    getState: () => state, setState: next => { state = next; },
+    isBusy: () => Boolean(readLiveRunViewForSaveStateGuard() || document.querySelector('dialog[open]')),
+    normalize: normalizePanelState, render: applyStateToPanel,
+    notice: error => appendStorageNoticeOnce('shared-history-refresh', tx(
+      `Could not refresh shared history: ${error.message}`,
+      `共享会话历史刷新失败：${error.message}`
+    ))
+  });
 
   // -----------------------------------------------------------------------
   // SPA route change lifecycle (spec §5.7).
@@ -4354,7 +4276,7 @@
       chromeApi: chrome, getState: () => state, setState: next => { state = next; }, getPanel: () => panel,
       applyTheme: applyPanelTheme, applyLocale: () => { applyLocaleToPanel(); refreshDashboardSoon(); },
       onPreloadChange: enabled => contextTrayController.scheduleContextPrefetch({ enabled }),
-      onSkillsChange: () => { renderLocalSkillList(); updateSkillsEntrySummary(); },
+      onSkillsChange: () => { renderLocalSkillList(); updateSkillsEntrySummary(); updateSlashMenuForTaskInput(); },
       onError: error => showPluginToast(tx(
         `Global settings could not be saved or loaded: ${error.message}. Please retry.`,
         `全局设置未能保存或读取：${error.message}。请重试。`), { status: 'failed', sticky: true })
@@ -4369,7 +4291,8 @@
     try {
       storageKey = getProjectStorageKey(LEGACY_STORAGE_KEY, window.location.href);
       const reloaded = await loadStoredState();
-      state = normalizePanelState(getGlobalPreferences().overlay(reloaded), { restoreRunningRuns: true });
+      state = normalizeLoadedPanelState(reloaded);
+      await getRunReviewController().recoverInterruptedUndoStatuses();
       applyStateToPanel();
     } catch (_error) {
       // Reload failures fall back to the in-memory state; the next saveState
@@ -4431,6 +4354,7 @@
   function leaveActiveProject(newId) {
     const prevId = activeProjectId;
     activeProjectId = newId; // null for non-project URLs (spec §5.7.1)
+    getComposerDraftPersistence().syncScope();
     if (!prevId || prevId === newId) {
       return;
     }
@@ -4471,6 +4395,7 @@
     // project derivation: account menu is global chrome and should be
     // readable on per-project URLs too).
     await refreshAccountScopeId();
+    getComposerDraftPersistence().syncScope();
     if (generation !== spaRouteGeneration || pathname !== window.location.pathname) {
       return;
     }
@@ -4699,7 +4624,7 @@
       const applied = await applyTaskOperations(project, operations);
       applyResults.push(applied);
       appendApplyResult(applied);
-      recordUndoFromApply(project, applied);
+      await recordUndoFromApply(project, applied);
       const approved = await showPluginConfirm({
         title: tx('Confirm delete plan?', '确认删除计划？'),
         message: formatDeletePlan(result.deletePlan || []),
@@ -4713,7 +4638,7 @@
         const deleteApplied = await applyTaskOperations(project, pendingOperations, { allowHighRisk: true });
         applyResults.push(deleteApplied);
         appendApplyResult(deleteApplied);
-        recordUndoFromApply(project, deleteApplied);
+        await recordUndoFromApply(project, deleteApplied);
         appendLog(tx('Deleted files after confirmation.', '已按确认删除文件。'));
         const summaryLine = appendChangeSummary({
           notes,
@@ -4766,7 +4691,7 @@
     appendOperationsPreview(operations, tx('Preparing to write', '准备写入'));
     const applied = await applyTaskOperations(project, operations);
     appendApplyResult(applied);
-    recordUndoFromApply(project, applied);
+    await recordUndoFromApply(project, applied);
     appendLog(mode === 'auto' ? tx('Auto write task completed.', '自动写入任务完成。') : tx('Task completed.', '任务完成。'));
     const summaryLine = appendChangeSummary({
       notes,
@@ -4791,6 +4716,7 @@
   }
 
   async function applyTaskOperations(project, operations, options = {}) {
+    const target = currentRunView;
     const runRequireReviewing = typeof options.requireReviewing === 'boolean'
       ? options.requireReviewing
       : state.requireReviewing === true;
@@ -4800,7 +4726,13 @@
         title: tr('undoNoWritesTitle'),
         status: 'completed'
       });
-    } else {
+    }
+    const reviewing = await ensureReviewingBeforeWrite(partitioned.safe, { requireReviewing: runRequireReviewing });
+    if (!reviewing.ok) {
+      return buildReviewingBlockedApplyResult(partitioned.safe, reviewing, partitioned.skipped);
+    }
+    if (partitioned.safe.length) await stageWritebackRecovery(partitioned.safe, target, runRequireReviewing, project);
+    if (partitioned.safe.length) {
       appendRunEvent({
         title: tx('Saved a recoverable version before this run writes.', '已保存本轮写入前的可恢复版本。'),
         status: 'completed',
@@ -4809,10 +4741,7 @@
         }
       });
     }
-    const reviewing = await ensureReviewingBeforeWrite(partitioned.safe, { requireReviewing: runRequireReviewing });
-    if (!reviewing.ok) {
-      return buildReviewingBlockedApplyResult(partitioned.safe, reviewing, partitioned.skipped);
-    }
+
     const applied = partitioned.safe.length
       ? await callPageBridge('applyOperations', {
         operations: partitioned.safe,
@@ -4820,7 +4749,7 @@
         requireReviewing: runRequireReviewing,
         requireEditing: !runRequireReviewing,
         // Welcome-panel + write-guard:
-        runProjectId: currentRunView?.runProjectId || ''
+        runProjectId: target?.runProjectId || ''
       })
       : { ok: true, applied: [], skipped: [] };
 
@@ -5018,18 +4947,33 @@
     button.setAttribute('aria-busy', loading ? 'true' : 'false');
   }
 
-  function formatProbeStatusBar(probe) {
+  function syncProbeStatus(mode = state?.mode) {
+    const status = panel?.querySelector('[data-probe-status]');
+    if (!status) return;
+    if (status.dataset.refreshing === 'true') {
+      status.textContent = tr('refreshProbeLoading');
+      return;
+    }
+    if (probeStatusSnapshot?.projectId !== getCurrentProjectId()) return;
+    const { failed, probe, userInitiated } = probeStatusSnapshot;
+    const text = failed ? tr('refreshProbeFailed') : formatProbeStatusBar(probe, mode);
+    status.textContent = userInitiated && !failed ? tr('refreshProbeDone', { status: text }) : text;
+    status.dataset.ok = !failed && isProbeReadyForCurrentMode(probe, mode) ? 'true' : 'false';
+    if (!failed) updateExistingProbeNotice(probe, mode);
+  }
+
+  function formatProbeStatusBar(probe, mode = state?.mode) {
     const readiness = getProbeRunReadiness(probe);
     const reviewingOk = readiness.reviewingOk;
     const editorWritable = readiness.editorWritable;
 
-    if (state?.mode === 'ask') {
+    if (mode === 'ask') {
       return appendOtStatusToProbeStatus(`${formatModeLabel('ask')} · ${readiness.contextLabel}`);
     }
     if (reviewingOk) {
       const status = editorWritable
         ? `${tr('canRun')} · ${readiness.contextLabel}`
-        : `${formatModeLabel(state?.mode)} · ${tr('validatingEditor')}`;
+        : `${formatModeLabel(mode)} · ${tr('validatingEditor')}`;
       return appendOtStatusToProbeStatus(status);
     }
     if (readiness.contextReady) {
@@ -5059,9 +5003,9 @@
     status.textContent = appendOtStatusToProbeStatus(base);
   }
 
-  function isProbeReadyForCurrentMode(probe) {
+  function isProbeReadyForCurrentMode(probe, mode = state?.mode) {
     const readiness = getProbeRunReadiness(probe);
-    return state?.mode === 'ask' || readiness.reviewingOk;
+    return mode === 'ask' || readiness.reviewingOk;
   }
 
   function getProbeRunReadiness(probe) {
@@ -5126,22 +5070,22 @@
     appendLog(message);
   }
 
-  function updateExistingProbeNotice(probe) {
+  function updateExistingProbeNotice(probe, mode = state?.mode) {
     if (currentRunView || !panel?.querySelector('[data-probe-notice]')) {
       return;
     }
-    const { ready, message } = formatProbeUserNotice(probe);
+    const { ready, message } = formatProbeUserNotice(probe, mode);
     updateProbeNotice(ready ? '' : message);
   }
 
-  function formatProbeUserNotice(probe) {
+  function formatProbeUserNotice(probe, mode = state?.mode) {
     const readiness = getProbeRunReadiness(probe);
     const reviewingOk = readiness.reviewingOk;
     const editorOk = readiness.editorOk;
     const manualOverride = probe.reviewing?.status === 'manual-override';
     const editorWriteBlocked = probe.capabilities?.editor?.write === false;
 
-    if (state?.mode === 'ask') {
+    if (mode === 'ask') {
       return {
         ready: true,
         message: tx(
@@ -5155,8 +5099,8 @@
       return {
         ready: true,
         message: tx(
-          `Ready: ${formatModeLabel(state?.mode)} is selected. This page has not exposed a writable editor yet; Codex will reopen and verify the target file when writing. If writeback fails, reload Overleaf and retry.`,
-          `可以运行：已选择“${formatModeLabel(state?.mode)}”。当前页面暂时没有暴露可写编辑器，写入时会重新打开目标文件并验证；如果写回失败，再刷新 Overleaf 页面后重试。`
+          `Ready: ${formatModeLabel(mode)} is selected. This page has not exposed a writable editor yet; Codex will reopen and verify the target file when writing. If writeback fails, reload Overleaf and retry.`,
+          `可以运行：已选择“${formatModeLabel(mode)}”。当前页面暂时没有暴露可写编辑器，写入时会重新打开目标文件并验证；如果写回失败，再刷新 Overleaf 页面后重试。`
         )
       };
     }
@@ -5209,7 +5153,7 @@
       focusFiles: getActiveFocusFiles()
     });
     const sanitizedProject = sanitizeRunProjectSnapshot(project);
-    if (sanitizedProject?.capabilities?.fullProjectSnapshot) {
+    if (sanitizedProject?.capabilities?.fullProjectSnapshot || sanitizedProject?.capabilities?.pathIdentityComplete === false) {
       return sanitizedProject;
     }
     const pageStateProject = await callPageBridge('getProjectSnapshot', {
@@ -5230,25 +5174,37 @@
   }
 
   function sanitizeRunProjectSnapshot(project) {
-    if (!project || typeof project !== 'object') {
-      return project;
-    }
-    const activePath = normalizeSnapshotPath(project.activePath || '');
+    if (!project || typeof project !== 'object') return project;
+    const normalize = Modules.ProjectFiles.normalizeSafeProjectPath;
     const files = Array.isArray(project.files) ? project.files : [];
-    const filePathSet = new Set(files.map(file => normalizeSnapshotPath(file?.path || '')).filter(Boolean));
-    const activePathKnown = activePath && filePathSet.has(activePath);
-    if (!activePath || activePathKnown) {
-      return project;
+    const counts = new Map();
+    for (const file of files) {
+      const path = normalize(file?.path);
+      if (path) counts.set(path, (counts.get(path) || 0) + 1);
     }
+    const skipped = [];
+    const safeFiles = files.filter(file => {
+      const path = normalize(file?.path);
+      if (path && counts.get(path) === 1) return true;
+      skipped.push({ path: typeof file?.path === 'string' ? file.path : '',
+        reason: path ? 'snapshot_path_duplicate' : 'snapshot_path_invalid' });
+      return false;
+    });
+    const activePath = normalize(project.activePath || '');
+    const activePathKnown = activePath && safeFiles.some(file => file.path === activePath);
+    const rejectActive = Boolean(project.activePath && !activePathKnown);
+    if (!skipped.length && !rejectActive) return project;
     return {
       ...project,
-      activePath: '',
-      files: files.map(file => file?.active ? { ...file, active: false } : file),
+      activePath: rejectActive ? '' : project.activePath,
+      files: safeFiles.map(file => rejectActive && file?.active ? { ...file, active: false } : file),
       capabilities: {
         ...(project.capabilities || {}),
+        ...(skipped.length ? { fullProjectSnapshot: false, contentComplete: false, pathIdentityComplete: false,
+          skipped: [...(project.capabilities?.skipped || []), ...skipped] } : {}),
         diagnostics: {
           ...(project.capabilities?.diagnostics || {}),
-          rejectedActivePath: project.activePath
+          ...(rejectActive ? { rejectedActivePath: project.activePath } : {})
         }
       }
     };
@@ -5334,11 +5290,8 @@
   }
 
   function normalizeSnapshotPath(path) {
-    return String(path || '')
-      .replace(/^@file:/i, '')
-      .replace(/\\/g, '/')
-      .trim()
-      .replace(/^\/+/, '');
+    // Snapshot/overlay/focus arrays already carry canonical names from file chips.
+    return Modules.ProjectFiles.normalizeSafeProjectPath(path);
   }
 
   function mergeProjectWithSyncChangeBaseFiles(project = {}, syncChanges = []) {
@@ -5489,6 +5442,9 @@
   }
 
   async function callPageBridge(method, params) {
+    if (method === 'applyOperations' && params?.reviewingPolicy === 'no-trace-undo') {
+      return Modules.AssetTransferBroker.create({ callPageBridge: (name, input) => pageBridgeClient.call(name, input), sendBackgroundNative }).applyOperations(params);
+    }
     return pageBridgeClient.call(method, params);
   }
 
@@ -5547,8 +5503,10 @@
         legacyKey,
         accountScopeId
       );
+      const composerAttachments = await loadComposerAttachmentsForProject(accountScopeId, projectId);
 
       return {
+        composerAttachments,
         model: prefs.model || '', providerId: prefs.providerId || 'builtin',
         reasoningEffort: prefs.reasoningEffort || '',
         speedTier: prefs.speedTier || '',
@@ -5560,6 +5518,7 @@
         loadCodexLocalSkills: prefs.loadCodexLocalSkills !== false,
         loadCodexOverleafSkills: prefs.loadCodexOverleafSkills !== false,
         codexOverleafSkillEnabled: prefs.codexOverleafSkillEnabled || {},
+        codexLocalSkillEnabled: prefs.codexLocalSkillEnabled || {},
         experimentalOtByProject: prefs.experimentalOtByProject || {},
         customInstructionsByProject: prefs.customInstructionsByProject || {},
         governanceRulesByProject: normalizeGovernanceRulesByProject(prefs.governanceRulesByProject),
@@ -5569,9 +5528,11 @@
           accountScopeId: session.accountScopeId || accountScopeId,
           title: session.title || '',
           titleSource: session.titleSource || 'auto',
-          focusFiles: session.focusFiles || [],
+          focusFiles: session.focusFiles || [], selectionContext: session.selectionContext?.projectId === projectId ? session.selectionContext : null,
           projectReferenceFiles: session.projectReferenceFiles || [],
           codexThreadId: session.codexThreadId || '',
+          forkedFromSessionId: session.forkedFromSessionId || '',
+          forkedFromRunId: session.forkedFromRunId || '',
           createdAt: session.createdAt,
           updatedAt: session.updatedAt,
           runs: Array.isArray(session.runs) ? session.runs : [],
@@ -5612,6 +5573,7 @@
           loadCodexLocalSkills: fallback.loadCodexLocalSkills !== false,
           loadCodexOverleafSkills: fallback.loadCodexOverleafSkills !== false,
           codexOverleafSkillEnabled: fallback.codexOverleafSkillEnabled || {},
+          codexLocalSkillEnabled: fallback.codexLocalSkillEnabled || {},
           experimentalOtByProject: fallback.experimentalOtByProject || {},
           customInstructionsByProject: fallback.customInstructionsByProject || {},
           governanceRulesByProject: normalizeGovernanceRulesByProject(fallback.governanceRulesByProject),
@@ -5640,33 +5602,21 @@
   }
 
   async function saveState(options) {
+    const endSharedSave = typeof sharedSessionViewSync !== 'undefined'
+      ? sharedSessionViewSync?.beginSave() : null;
     try {
       const StorageDb = Modules.StorageDb;
       const Migration = Modules.StorageMigration;
-      // Welcome-panel + write-guard:
-      // post-navigation persistence gate. The normal URL-derived projectId
-      // belongs to the route the user is *currently looking at*. When a run
-      // is in flight on a different project (mid-run SPA navigation), saving
-      // under that URL-derived id would pollute another project's Recent-
-      // projects entry and surface bogus disabled rows. Two safety lanes:
-      //   1. `options.projectIdOverride` lets a caller that legitimately
-      //      needs to persist to a non-active project supply the projectId
-      //      explicitly (the only such caller today is the post-navigation
-      //      settlement path in `persistPostNavigationRunStatus`, which goes
-      //      directly through StorageDb — but the override is in place so
-      //      future callers do not have to monkey-patch around saveState).
-      //   2. When no override is set AND a navigation-divergent run is in
-      //      flight (currentRunView.runProjectId !== URL-derived id), log a
-      //      warning and skip persistence. The settlement path owns that
-      //      run's persistence; routing through saveState would write to the
-      //      WRONG projectId record.
+      // Settlement owns a run after navigation away from its project. Ordinary
+      // view saves must not write that run into the current route's project.
+      // An explicit override is reserved for callers that own a detached scope.
       const projectIdOverride = options && typeof options.projectIdOverride === 'string'
         ? options.projectIdOverride
         : '';
       const urlProjectId = getCurrentProjectId();
       const projectId = projectIdOverride || urlProjectId;
       if (!projectId) {
-        if (options?.reviewRunIds?.length) throw new Error('Review persistence lost its project.'); return;
+        if (options?.requireDurable || options?.reviewRunIds?.length) throw new Error('Persistence lost its project.'); return;
       }
       // Read currentRunView through a defensive accessor so historical test
       // harnesses that inline `saveState` without re-declaring the module-
@@ -5678,13 +5628,14 @@
           'Skipped saveState: run is in flight on a different project than the current URL; settlement owns persistence.',
           '已跳过 saveState：本次运行所属项目与当前 URL 不一致，写回由 settlement 负责。'
         ));
-        if (options?.reviewRunIds?.length) throw new Error('Review persistence project changed.'); return;
+        if (options?.requireDurable || options?.reviewRunIds?.length) throw new Error('Persistence project changed.'); return;
       }
       const compactState = prepareStateForStorage(state, { onAggressive: notifyAggressiveCompactionOnce });
       compactState.autoRecompile = state.autoRecompile;
       compactState.loadCodexLocalSkills = state.loadCodexLocalSkills !== false;
       compactState.loadCodexOverleafSkills = state.loadCodexOverleafSkills !== false;
       compactState.codexOverleafSkillEnabled = getCodexOverleafSkillEnabled();
+      compactState.codexLocalSkillEnabled = getCodexLocalSkillEnabled();
       compactState.experimentalOtByProject = state.experimentalOtByProject;
       compactState.customInstructionsByProject = state.customInstructionsByProject;
       compactState.governanceRulesByProject = state.governanceRulesByProject;
@@ -5695,11 +5646,14 @@
         ? structuredClone(compactState)
         : JSON.parse(JSON.stringify(compactState));
 
-      const persistScopedState = persistenceContext => Modules.ScopedPersistenceCoordinator.persistPanelState({
+      const retentionScope = { accountScopeId: typeof cachedAccountScopeId === 'string' ? cachedAccountScopeId : '', projectId, generation: typeof spaRouteGeneration === 'number' ? spaRouteGeneration : null };
+      let written;
+      const persistScopedState = async persistenceContext => {
+        written = await Modules.ScopedPersistenceCoordinator.persistPanelState({
         state: stateSnapshot,
         compactState: compactStateSnapshot,
         projectId,
-        deletedSessionIds: options?.deletedSessionIds, reviewRunIds: options?.reviewRunIds,
+        deletedSessionIds: options?.deletedSessionIds, reviewRunIds: options?.reviewRunIds, recoveryRuns: options?.recoveryRuns,
         Migration,
         StorageDb,
         SessionPersistence: Modules.SessionPersistence,
@@ -5707,7 +5661,9 @@
         normalizeGovernanceRulesByProject,
         normalizeCustomInstructionsByProject,
         persistenceContext
-      });
+        });
+        await getComposerDraftPersistence().save({ accountScopeId: persistenceContext.scope.accountScopeId, projectId });
+      };
 
       const persistenceCoordinator = getScopedPersistenceCoordinator();
       if (!persistenceCoordinator) {
@@ -5727,7 +5683,7 @@
           persistScopedState
         );
         if (!committed.ok && (
-          options?.reviewRunIds?.length || options?.queueMutation
+          options?.requireDurable || options?.reviewRunIds?.length || options?.recoveryRuns?.length || options?.queueMutation
           || options?.queueMutations?.length
           || committed.reason !== 'stale_view'
         )) {
@@ -5735,8 +5691,23 @@
             code: committed.reason
           });
         }
+        if (committed.ok) {
+          const retentionUpdates = StorageDb.projectRetentionUpdates?.({ liveState: state, capturedState: stateSnapshot, written,
+            capturedScope: retentionScope, currentScope: { accountScopeId: typeof cachedAccountScopeId === 'string' ? cachedAccountScopeId : '',
+              projectId: getCurrentProjectId(), generation: typeof spaRouteGeneration === 'number' ? spaRouteGeneration : null } }) || [];
+          for (const update of retentionUpdates) for (const run of [...(state.runs || []), ...(state.sessions || []).flatMap(session => session.runs || [])]) {
+            if (run.id !== update.runId) continue;
+            if (update.retention) run.recoveryRetention = update.retention; else delete run.recoveryRetention;
+          }
+          if (retentionUpdates.some(update => update.retention)) appendStorageNoticeOnce('undo-retention', tx(
+            'Some recovery evidence was not retained durably. After reloading, check Overleaf history or Review.',
+            '部分恢复材料未持久保留；刷新后请核对 Overleaf 历史或审阅。'));
+        }
+        if (options?.requireDurable || options?.recoveryRuns?.length) return true;
       }
     } catch (error) {
+      if (options?.requireDurable) throw error;
+      if (error?.code === 'recovery_scope_changed') return;
       if (
         error?.code === 'account_scope_unavailable' &&
         !options?.reviewRunIds?.length && !options?.queueMutation &&
@@ -5764,19 +5735,21 @@
         emitStorageQuotaFailure(error, fallbackError);
       }
       if (typeof appendStorageNoticeOnce === 'function') {
-        appendStorageNoticeOnce('save-failed', tx(`Failed to save session state: ${error.message}`, `保存会话状态失败：${error.message}`));
+        appendStorageNoticeOnce('save-failed', tx(`Failed to save session state: ${localizeVisibleReason(error.message)}`, `保存会话状态失败：${localizeVisibleReason(error.message)}`));
       } else {
         throw error;
       }
+    } finally {
+      endSharedSave?.();
     }
   }
 
-
   function prepareCompactFallbackState(inputState) {
     const compact = prepareStateForStorage(inputState);
     return {
       ...compact,
       __codexOverleafCompactFallback: true,
+      composerAttachments: [],
       task: '',
       session: null,
       sessions: [],
@@ -5869,7 +5842,7 @@
           // here (e.g. fallback chrome.storage.local.set rethrew).
           emitStorageQuotaFailure(error, null);
         }
-        if (persistenceOptions?.reviewRunIds?.length) throw error;
+        if (persistenceOptions?.requireDurable || persistenceOptions?.reviewRunIds?.length) throw error;
         appendPlainLog(tx(`Failed to save session state: ${formatStateSaveError(error)}`, `保存会话状态失败：${formatStateSaveError(error)}`));
       })
       .finally(() => {
@@ -5945,7 +5918,7 @@
     if (isStorageQuotaError(error)) {
       return tx('Local session history is too large. Delete some old tasks and retry.', '本地会话记录太大，请删除一些旧任务后重试。');
     }
-    return error?.message || String(error);
+    return localizeVisibleReason(error?.message || String(error));
   }
 
   async function persistPanelInputs(event) {
@@ -6004,6 +5977,7 @@
       button.dataset.active = active ? 'true' : 'false';
       button.setAttribute('aria-pressed', active ? 'true' : 'false');
     });
+    syncProbeStatus(currentMode);
   }
 
   function readPanelInputs() {
@@ -6056,18 +6030,59 @@
     return speedSelect?.value || state?.speedTier || 'standard';
   }
 
-
-  let composerAttachmentsRestoredOnce = false;
+  let composerDraftPersistence = null;
   let lastRunActivityBumpMs = 0;
 
+  function getComposerDraftPersistence() {
+    if (!composerDraftPersistence) composerDraftPersistence = Modules.ComposerAttachmentDraft.createController({
+      getScope: () => ({ accountScopeId: cachedAccountScopeId, projectId: getCurrentProjectId() }),
+      getAttachments: () => composerAttachmentController.serializePersistableAttachments(),
+      setAttachments: value => { state.composerAttachments = value; },
+      clear: () => composerAttachmentController.clear({ notify: false }),
+      restore: value => composerAttachmentController.restorePersistedAttachments(value),
+      read: scope => Modules.StorageDb.readComposerAttachmentDraft(scope),
+      write: (scope, value) => Modules.StorageDb.writeComposerAttachmentDraft(scope, value),
+      scheduleSave: () => saveStateSoon()
+    });
+    return composerDraftPersistence;
+  }
+
+  async function loadComposerAttachmentsForProject(accountScopeId, projectId) {
+    if (!accountScopeId || !projectId) return [];
+    try {
+      return await getComposerDraftPersistence().load({ accountScopeId, projectId });
+    } catch (error) {
+      if (error?.code === 'stale_hydration' || error?.code === 'account_scope_unavailable') throw error;
+      appendPlainLog(tx('Saved attachments could not be restored. Reattach the files before sending.',
+        '已保存的附件无法恢复，请在发送前重新添加文件。'));
+      return [];
+    }
+  }
+
   function persistComposerAttachmentsToState() {
     if (typeof composerAttachmentController?.serializePersistableAttachments === 'function') {
       state.composerAttachments = composerAttachmentController.serializePersistableAttachments();
     }
   }
 
-  function clearTaskComposer({ keepAttachments = false } = {}) {
+  function clearTaskComposer({ keepAttachments = false, submission = null } = {}) {
     const taskInput = panel?.querySelector('[data-task]');
+    if (submission) {
+      if (submission.projectId !== getCurrentProjectId()
+        || submission.accountScopeId !== cachedAccountScopeId) return false;
+      if (findSessionById(submission.sessionId)?.task !== submission.task) return false;
+      if (state.activeSessionId !== submission.sessionId) {
+        updateSessionById(submission.sessionId, { task: '' });
+        saveStateSoon();
+        return false;
+      }
+      if (composerAttachmentController.getAttachmentByteUsage?.().pending > 0
+        || selectionContextView.getRevision?.() !== submission.selectionRevision) return false;
+      if (!runController.isSubmittedComposerUnchanged(submission, {
+        task: taskInput?.value, attachments: getComposerAttachmentsForRun(),
+        skillInvocation: getComposerSkillInvocationForRun(), selectionContext: selectionContextView.capture()
+      })) return false;
+    }
     if (taskInput) {
       taskInput.value = '';
     }
@@ -6077,11 +6092,38 @@
     }
     composerSkillInvocation = null;
     renderComposerSkillInvocation();
+    selectionContextView.clear();
     state = updateActiveSession(state, { task: '' });
     saveStateSoon();
+    return true;
+  }
+
+  function restoreRejectedLocalSkillSubmission(submission, checkpoint) {
+    const input = panel?.querySelector('[data-task]');
+    if (!checkpoint || !input || submission.accountScopeId !== cachedAccountScopeId
+      || submission.projectId !== getCurrentProjectId() || submission.sessionId !== state.activeSessionId
+      || !findSessionById(submission.sessionId) || input.value || state.task
+      || composerDraftRevision !== checkpoint.draftRevision
+      || getComposerAttachmentsForRun().length || composerAttachmentController.getAttachmentByteUsage?.().pending
+      || composerAttachmentController.getRevision?.() !== checkpoint.attachmentRevision
+      || selectionContextView.getRevision?.() !== checkpoint.selectionRevision
+      || selectionContextView.capture() || getComposerSkillInvocationForRun()) return false;
+    if (!composerAttachmentController.restoreSubmittedAttachments?.(submission.attachments, checkpoint.attachmentRevision)) return false;
+    composerDraftRevision += 1;
+    composerSkillInvocation = submission.skillInvocation;
+    input.value = submission.task;
+    state = updateActiveSession(state, { task: submission.task, selectionContext: submission.selectionContext });
+    renderComposerSkillInvocation();
+    selectionContextView.render();
+    autosizeTaskTextarea();
+    syncComposerSendAvailability();
+    saveStateSoon();
+    return true;
   }
 
   function applyStateToPanel(options = {}) {
+    selectionContextView.render();
+    writingStyleSettings.sync();
     applyPanelTheme(getThemePreference());
     if ((state.providerId || 'builtin') === 'builtin' && !modelSelectHasOption(state.model)) {
       renderModelOptions(getModelCatalog().FALLBACK_MODELS, state.model);
@@ -6118,23 +6160,14 @@
     applySessionLabel();
     renderSessionList();
     renderRunHistory(options);
+    renderPendingInputs();
     getTrackedChangeCaptureController().schedule();
     renderContextSelection();
     renderContextSummary();
-    // v1.8.0 C4: refresh recovery — small attachments persisted in state are
-    // restored into the (empty) tray ONCE per page load, before the render
-    // below. Re-running the gate on later renders would resurrect files the
-    // user explicitly removed (fleet P2).
-    if (!composerAttachmentsRestoredOnce
-      && Array.isArray(state.composerAttachments) && state.composerAttachments.length
-      && !composerAttachmentController.getAttachmentsForRun?.().length
-      && typeof composerAttachmentController.restorePersistedAttachments === 'function') {
-      composerAttachmentController.restorePersistedAttachments(state.composerAttachments);
-    }
-    composerAttachmentsRestoredOnce = true;
+    getComposerDraftPersistence().hydrate(state.composerAttachments);
     renderComposerAttachments();
     renderComposerSkillInvocation();
-    applyLocaleToPanel();
+    applyLocaleToPanel({ reprojectDynamic: false });
     if (!panel.querySelector('[data-context-tray]')?.hidden) {
       renderContextFiles();
     }
@@ -6159,21 +6192,45 @@
     }
     panel.dataset.running = running ? 'true' : 'false';
     panel.dataset.cancelling = running && runCancellationRequested ? 'true' : 'false';
+    panel.querySelectorAll('[data-run-id]').forEach(root => {
+      const record = findRunRecord(root.dataset.runId);
+      if (record) configureEditButton(root, record, { running });
+      if (record) configureWritebackButton(root, record, { running });
+    });
     renderPendingInputs();
   }
 
-  function prepareRetryReplacement(run) {
+  function prepareRetryReplacement(run, task) {
     const sessionId = state?.activeSessionId || '';
     const source = findRunRecord(run?.id, sessionId);
-    const eligible = source && runController.isRetryReplacementEligible(
+    const eligible = source && !source.forkSnapshot
+      && (!source.runProjectId || source.runProjectId === getCurrentProjectId())
+      && runController.isRetryReplacementEligible(
       source,
       WritebackSettlement.projectRunSettlement(source)
     );
-    pendingRetryReplacement = eligible ? { sessionId, runId: source.id } : null;
+    const returnToDraft = eligible && !currentRunView
+      && ['cancelled', 'rejected'].includes(source.status);
+    const draft = { task: typeof task === 'string' ? task : String(run?.task || '') };
+    if (returnToDraft) {
+      const snapshot = source.executionSnapshot || {};
+      const mode = snapshot.mode || source.mode;
+      draft.runs = (state.runs || []).filter(item => item.id !== source.id);
+      draft.mode = ['ask', 'auto'].includes(mode) ? mode : state.mode;
+      draft.focusFiles = Array.isArray(snapshot.focusFiles) ? snapshot.focusFiles : state.focusFiles;
+      draft.selectionContext = snapshot.selectionContext || null;
+    }
+    // Persist the composer through its session owner, not only the top-level alias.
+    state = updateActiveSession(state, draft);
+    pendingRetryReplacement = eligible && !returnToDraft ? { sessionId, runId: source.id } : null;
+    if (returnToDraft) applyStateToPanel({ preserveScroll: true });
     return Boolean(eligible);
   }
 
   function startRunView({
+    sessionId = state.activeSessionId,
+    sessionContext = runController.captureSessionContext(state),
+    codexThreadId = '',
     task,
     mode,
     model,
@@ -6214,41 +6271,39 @@
       executionSnapshot: executionSnapshot
         ? RunExecutionSnapshot.cloneSnapshot(executionSnapshot)
         : undefined,
-      // Welcome-panel + write-guard:
-      // Immutable per-run capture of the project this run was submitted
-      // against. Every writeback / accept / undo dispatch attaches this id
-      // to its page-bridge params so the page-side guard can verify the run
-      // is still acting on the same project before mutating the editor. No
-      // language-level enforcement — the field is treated as immutable by
-      // convention and never reassigned anywhere downstream.
+      // Writeback/Accept/Undo carry this immutable project identity to Page.
       runProjectId: getCurrentProjectId() || '',
       runAccountScopeId: cachedAccountScopeId || ''
     };
-    const active = getActiveSession(state);
+    const active = findSessionById(sessionId);
     const titlePatch = active?.titleSource !== 'manual'
       ? {
         title: deriveSessionTitle([], task),
         titleSource: 'auto'
       }
       : {};
-    state = updateActiveSession(state, {
-      runs: runController.replaceRunForRetry(state.runs, replaceRunId, record),
+    updateSessionById(sessionId, {
+      runs: runController.replaceRunForRetry(active?.runs, replaceRunId, record),
       ...titlePatch
     });
     saveStateSoon(replaceRunId ? 0 : 120);
 
     const log = panel.querySelector('[data-log]');
-    removeEmptyRunsMessage(log);
-    if (replaceRunId) log.querySelector(`[data-run-id="${cssEscape(replaceRunId)}"]`)?.remove();
     const root = renderRunCard(record);
-    log.append(root);
-    scrollLogToBottom({ force: true });
+    if (state.activeSessionId === sessionId) {
+      removeEmptyRunsMessage(log);
+      if (replaceRunId) log.querySelector(`[data-run-id="${cssEscape(replaceRunId)}"]`)?.remove();
+      log.append(root);
+      scrollLogToBottom({ force: true });
+    }
     startRunElapsedTick();
     renderSessionList();
     applySessionLabel();
 
     return {
-      sessionId: state.activeSessionId,
+      sessionId,
+      sessionContext,
+      codexThreadId,
       recordId: record.id,
       // Mirror the immutable runProjectId on the view so writeback /
       // accept / undo dispatches don't need to re-look up the record.
@@ -6346,6 +6401,17 @@
       return;
     }
 
+    const owner = currentRunView && findRunRecord(currentRunView.recordId, currentRunView.sessionId);
+    if (owner && Modules.SubagentActivityModel.ingest(owner, event, {
+      locale: getLocale(), sanitize: sanitizeAssistantVisibleText, nativeEventSeq: journalSeq
+    })) {
+      owner.nativeEventSeq = Math.max(Number(owner.nativeEventSeq || 0), Number(journalSeq || 0));
+      scheduleRunStateSave('stream');
+      const visible = getCurrentRunViewForRender();
+      if (visible) runTimelineView.refreshActivitySummary?.(visible);
+      return;
+    }
+
     const activity = mapAgentEventToActivity(event, { locale: getLocale() });
     if (!activity?.visible || activity.kind === 'technical') {
       return;
@@ -6415,9 +6481,11 @@
       kind: input.kind || 'activity',
       subagent: input.subagent === true ? true : undefined,
       technicalDetail: sanitizeAssistantVisibleValue(input.technicalDetail),
+      activity: Modules.RunActivityModel.capture(input, sanitizeAssistantVisibleText),
       guidanceId: sanitizeAssistantVisibleText(input.guidanceId),
       streamKey: sanitizeAssistantVisibleText(input.streamKey),
       streamRole: sanitizeAssistantVisibleText(input.streamRole),
+      streamPhase: sanitizeAssistantVisibleText(input.streamPhase),
       appendText: typeof input.appendText === 'string' ? sanitizeAssistantVisibleText(input.appendText) : input.appendText,
       replaceText: input.replaceText,
       // Structured FailureReason (§7) attached to the event when the caller
@@ -6531,6 +6599,7 @@
   }
 
   function appendRunEventToView(view, event) {
+    const projected = event.kind !== 'stream' && runTimelineView.refreshActivitySummary?.(view, event);
     if (event.kind === 'report') {
       view.report.hidden = false;
       const record = view?.recordId ? findRunRecord(view.recordId, view.sessionId) : null;
@@ -6541,6 +6610,7 @@
     if (event.kind === 'technical') {
       return;
     }
+    if (projected) { bumpUnreadIfDetached(); return; }
     if (runGuidanceController.appendToView(event, view)) return;
     if (event.kind === 'stream') {
       // Stream deltas update an existing line in place — they must not inflate
@@ -6548,7 +6618,7 @@
       upsertStreamEvent(view, event);
       return;
     }
-    view.events.append(renderRunEvent(event));
+    runTimelineView.appendActivityDetail(view, renderRunEvent(event), event);
     bumpUnreadIfDetached();
   }
 
@@ -6559,6 +6629,7 @@
     if (existing) {
       const nextTitle = sanitizeAssistantVisibleText(event.title);
       const nextRole = sanitizeAssistantVisibleText(event.streamRole) || existing.streamRole;
+      if (event.streamPhase) existing.streamPhase = event.streamPhase;
       const combinedTitle = event.replaceText
         ? nextTitle
         : sanitizeAssistantVisibleText(appendStreamText(existing.title, nextTitle));
@@ -6618,10 +6689,6 @@
   }
 
 
-
-
-
-
   function applyPanelWidth(width, options = {}) {
     const nextWidth = PanelRenderer.setWidth(panelRendererInstance, width, { notify: false });
     if (state) {
@@ -6633,10 +6700,6 @@
     return nextWidth;
   }
 
-
-
-
-
   function getCurrentProjectMathSources() {
     const sources = [];
     const seen = new Set();
@@ -6799,277 +6862,34 @@
     );
   }
 
-  async function undoRun(runId) {
-    const run = findRunRecord(runId);
-    if (!getRunUndoCount(run) || run.undoStatus === 'applied') {
-      return;
-    }
-    // Wait out any background mirror refresh before undoing (v1.7.5): a
-    // mirror.sync finishing after the undo would push the pre-undo snapshot
-    // as the local baseline and resurrect the undone content next run.
-    const pendingMirror = getPendingMirrorRefresh?.();
-    if (pendingMirror) {
-      await pendingMirror.catch(() => {});
-    }
-
-    if ((Array.isArray(run.undoTrackedChanges) && run.undoTrackedChanges.length) || hasTrackedEditorUndo(run)) {
-      await undoRunTrackedChanges(runId, run);
-      return;
-    }
-
-    const undoRestore = buildNoTraceUndoRestore(run);
-    const undoOperations = undoRestore.operations;
-    const unsafeFullFileUndo = findUnsafeFullFileUndoOperation(undoOperations, {
-      allowSnapshotRestore: undoRestore.snapshotRestore
-    });
-    if (unsafeFullFileUndo) {
-      appendRunRecordEvent(runId, {
-        title: tr('undoUnsafeFullFileTitle'),
-        status: 'failed',
-        detail: {
-          [tr('detailFile')]: unsafeFullFileUndo.path,
-          [tr('detailReason')]: tr('undoUnsafeFullFileReason')
-        }
-      });
-      return;
-    }
-
-    // v1.8.0 C3: multi-file undos confirm through a per-file selection —
-    // undoing a subset leaves undoStatus 'partial' and the button usable;
-    // re-undoing an already-restored file is skipped by the base check.
-    const undoPaths = Array.from(new Set(undoOperations.map(operation => operation?.path).filter(Boolean)));
-    let selectedOperations = undoOperations;
-    if (undoPaths.length > 1 && typeof showUndoFileSelection === 'function') {
-      const selectedPaths = await showUndoFileSelection({
-        title: tr('undoFileSelectTitle'),
-        task: truncateRunTitle(run.task),
-        confirmLabel: tr('undoFileSelectConfirm'),
-        cancelLabel: tr('confirmDefaultCancel'),
-        selectAllLabel: tr('undoFileSelectAll'),
-        paths: undoPaths
-      });
-      if (!selectedPaths) {
-        return;
-      }
-      const selectedSet = new Set(selectedPaths);
-      selectedOperations = undoOperations.filter(operation => selectedSet.has(operation?.path));
-    } else {
-      const approved = await showPluginConfirm({
-        title: tr('undoNoTraceTitle'),
-        message: [
-          truncateRunTitle(run.task),
-          '',
-          tr('undoNoTraceMessage', { files: formatOperationFiles(undoOperations) })
-        ].join('\n'),
-        confirmLabel: tr('undoConfirm'),
-        cancelLabel: tr('confirmDefaultCancel'),
-        destructive: true
-      });
-      if (!approved) {
-        return;
-      }
-    }
-
-    setRunUndoStatus(runId, 'running');
-    appendRunRecordEvent(runId, {
-      title: tr('undoNoTraceStarted'),
-      status: 'running',
-      detail: { [tr('detailWillUndo')]: formatOperationFiles(selectedOperations) }
+  let runReviewController = null;
+  function getRunReviewController() {
+    if (!runReviewController) runReviewController = Modules.RunReviewController.create({
+      Modules, WritebackSettlement, trackedChangeInFlight, findRunRecord,
+      getRunUndoCount, isTrackedChangeLifecycleRun, getPendingMirrorRefresh, hasTrackedEditorUndo, buildNoTraceUndoRestore,
+      findUnsafeFullFileUndoOperation, showUndoFileSelection, showPluginConfirm, tr,
+      truncateRunTitle, formatOperationFiles, formatTrackedChangeFiles, formatTrackedUndoFiles,
+      getPageBridgeTimeoutMs, callPageBridge, setRunUndoStatus, appendRunRecordEvent, getRunProjectIdForWriteback,
+      isUndoResultEffectivelyApplied, writebackOrchestrator, appendUndoReviewingPolicyEvent, formatOperationType,
+      formatApplyResultReason, buildTrackedUndoPostFiles, getTrackedChangeCaptureController, buildContentFailure,
+      applyTrackedChangeSettlement, refreshRunCardControls, formatBridgeResultReason, advanceRunUndoProgress,
+      saveStateSoon, flushQueuedSaveState,
+      getState: () => state, getCurrentProjectId, getAccountScopeId: () => cachedAccountScopeId,
+      getRouteGeneration: () => spaRouteGeneration, tx, notify: message => showPluginToast(message, { status: 'warning', sticky: true })
     });
+    return runReviewController;
+  }
 
-      const result = await callPageBridge('applyOperations', {
-        operations: selectedOperations,
-        baseFiles: run.undoBaseFiles || [],
-        reviewingPolicy: 'no-trace-undo',
-        // Welcome-panel + write-guard:
-        // route the undo through the same project-ID guard. The undo is
-        // bound to the run's original project, not the editor's active one.
-        runProjectId: getRunProjectIdForWriteback(run)
-      });
-      const undoApplied = isUndoResultEffectivelyApplied(run, result);
-      writebackOrchestrator.invalidateMirrorAfterUndo(runId, getRunProjectIdForWriteback(run), result);
-      appendUndoReviewingPolicyEvent(runId, result.reviewingPolicy);
-      appendRunRecordEvent(runId, {
-        title: tr('undoResult', { applied: result.applied?.length || 0, skipped: result.skipped?.length || 0 }),
-        status: undoApplied ? 'completed' : result.skipped?.length ? 'failed' : 'completed',
-        detail: {
-          [tr('detailUndone')]: (result.applied || []).map(item => ({
-            [tr('detailAction')]: formatOperationType(item.operation?.type),
-            [tr('detailFile')]: item.operation?.path
-        })),
-        [tr('detailSkipped')]: (result.skipped || []).map(item => ({
-          [tr('detailAction')]: formatOperationType(item.operation?.type),
-          [tr('detailFile')]: item.operation?.path,
-            [tr('detailReason')]: formatApplyResultReason(item)
-          }))
-        }
-      });
-      // A subset undo never closes the ledger: unselected files can still
-      // be undone later, so the run stays 'partial' and the button usable.
-      const fullSelection = selectedOperations.length === undoOperations.length;
-      applyLegacyUndoSettlement(
-        runId,
-        undoApplied && fullSelection ? 'applied' : 'partial',
-        result
-      );
+  async function undoRun(runId) {
+    return getRunReviewController().undoRun(runId);
   }
 
   async function undoRunTrackedChanges(runId, run) {
-    const trackedUndo = Array.isArray(run.undoTrackedChanges) && run.undoTrackedChanges.length > 0;
-    const approved = await showPluginConfirm({
-      title: trackedUndo ? tr('undoTrackedTitle') : tr('undoNativeTitle'),
-      message: [
-        truncateRunTitle(run.task),
-        '',
-        trackedUndo
-          ? tr('undoTrackedMessage', { files: formatTrackedChangeFiles(run.undoTrackedChanges) })
-          : tr('undoNativeMessage', { files: formatTrackedUndoFiles(run) })
-      ].join('\n'),
-      confirmLabel: trackedUndo ? tr('undoTrackedConfirm') : tr('undoConfirm'),
-      cancelLabel: tr('confirmDefaultCancel'),
-      destructive: true
-    });
-    if (!approved) {
-      return;
-    }
-
-    // Tracked-change-lifecycle runs (those holding tracked-change refs) reach a
-    // decisive terminal `rejected` once the reject returns. The UI-local
-    // in-flight lock disables the button; it is never persisted.
-    const lifecycleReject = trackedUndo && isTrackedChangeLifecycleRun(run);
-    if (lifecycleReject) {
-      trackedChangeInFlight.set(runId, 'reject');
-      refreshRunCardControls(runId);
-    } else {
-      setRunUndoStatus(runId, 'running');
-    }
-    appendRunRecordEvent(runId, {
-      title: trackedUndo ? tr('undoTrackedStarted') : tr('undoNativeStarted'),
-      status: 'running',
-      detail: { [tr('detailWillUndo')]: trackedUndo ? formatTrackedChangeFiles(run.undoTrackedChanges) : formatTrackedUndoFiles(run) }
-    });
-
-    try {
-      const trackedUndoPostFilesAtDispatch = buildTrackedUndoPostFiles(run);
-      const result = await callPageBridge('rejectTrackedChanges', {
-        trackedChanges: run.undoTrackedChanges || [],
-        expectedFiles: run.undoExpectedFiles || [],
-        postFiles: trackedUndoPostFilesAtDispatch,
-        untrackedUndo: run.executionSnapshot
-          ? run.executionSnapshot.requireReviewing === false && ['submitted', 'legacy-captured'].includes(run.executionSnapshot.source)
-          : getTrackedChangeCaptureController().hasLegacyUntrackedCheckpoint(run),
-        // Welcome-panel + write-guard:
-        // bind the reject to the run's original project. If the user has
-        // navigated away the page-side guard refuses with
-        // `aborted_project_changed` and the document is left untouched.
-        runProjectId: getRunProjectIdForWriteback(run)
-      });
-      writebackOrchestrator.invalidateMirrorAfterUndo(runId, getRunProjectIdForWriteback(run), result);
-      appendRunRecordEvent(runId, {
-        title: trackedUndo
-          ? tr('undoTrackedResult', { applied: result.applied?.length || 0, skipped: result.skipped?.length || 0 })
-          : tr('undoNativeResult', { applied: result.applied?.length || 0, skipped: result.skipped?.length || 0 }),
-        status: result.skipped?.length ? 'failed' : 'completed',
-        detail: {
-          [trackedUndo ? tr('detailRejected') : tr('detailUndone')]: (result.applied || []).map(item => ({
-            [tr('detailFile')]: item.trackedChange?.path || tr('unknownFile'),
-            [tr('detailRecord')]: item.trackedChange?.label || item.trackedChange?.id || item.trackedChange?.key
-          })),
-          [tr('detailSkipped')]: (result.skipped || []).map(item => ({
-            [tr('detailFile')]: item.trackedChange?.path || tr('unknownFile'),
-            [tr('detailRecord')]: item.trackedChange?.label || item.trackedChange?.id || item.trackedChange?.key || '',
-            [tr('detailReason')]: formatBridgeResultReason(item.result, item.trackedChange?.path)
-          }))
-        }
-      });
-      if (lifecycleReject) {
-        WritebackSettlement.attachUndoNotVerifiedFailure(run, result, {
-          buildFailure: buildContentFailure,
-          postFiles: trackedUndoPostFilesAtDispatch
-        });
-        await applyTrackedChangeSettlement(runId, 'reject', result);
-        return;
-      }
-      applyLegacyUndoSettlement(runId, result.skipped?.length ? 'partial' : 'applied', result);
-    } finally {
-      if (lifecycleReject) {
-        trackedChangeInFlight.delete(runId);
-        refreshRunCardControls(runId);
-      }
-    }
+    return getRunReviewController().undoRunTrackedChanges(runId, run);
   }
 
   async function acceptRun(runId) {
-    const run = findRunRecord(runId);
-    if (!run || !isTrackedChangeLifecycleRun(run)) {
-      return;
-    }
-    const status = run.trackedChangeStatus || '';
-    // pending and needs_review are both actionable per §7: needs_review means
-    // the prior attempt could not prove a clean post-action state, and the
-    // user is supposed to be able to retry after inspecting Overleaf.
-    if (status !== 'pending' && status !== 'needs_review') {
-      return;
-    }
-    if (!Array.isArray(run.undoTrackedChanges) || !run.undoTrackedChanges.length) {
-      return;
-    }
-    if (trackedChangeInFlight.get(runId)) {
-      return;
-    }
-
-    trackedChangeInFlight.set(runId, 'accept');
-    refreshRunCardControls(runId);
-    appendRunRecordEvent(runId, {
-      title: tr('runAcceptTrackedStarted'),
-      status: 'running',
-      detail: { [tr('detailAccepted')]: formatTrackedChangeFiles(run.undoTrackedChanges) }
-    });
-
-    try {
-      const result = await callPageBridge('acceptTrackedChanges', {
-        trackedChanges: run.undoTrackedChanges || [],
-        expectedFiles: run.undoExpectedFiles || [],
-        postFiles: buildTrackedUndoPostFiles(run),
-        appliedOperations: Array.isArray(run.appliedOperations) ? run.appliedOperations : [],
-        runProjectId: getRunProjectIdForWriteback(run)
-      });
-      appendAcceptDiagnosticEvents(runId, Array.isArray(result.diagnostics) ? result.diagnostics : []);
-      appendRunRecordEvent(runId, {
-        title: tr('runAcceptTrackedResult', { applied: result.applied?.length || 0, skipped: result.skipped?.length || 0 }),
-        status: result.skipped?.length ? 'failed' : 'completed',
-        detail: {
-          [tr('detailAccepted')]: (result.applied || []).map(item => ({
-            [tr('detailFile')]: item.trackedChange?.path || tr('unknownFile'),
-            [tr('detailRecord')]: item.trackedChange?.label || item.trackedChange?.id || item.trackedChange?.key
-          })),
-          [tr('detailSkipped')]: (result.skipped || []).map(item => ({
-            [tr('detailFile')]: item.trackedChange?.path || tr('unknownFile'),
-            [tr('detailRecord')]: item.trackedChange?.label || item.trackedChange?.id || item.trackedChange?.key || '',
-            [tr('detailReason')]: formatBridgeResultReason(item.result, item.trackedChange?.path)
-          }))
-        }
-      });
-      if (result.ok === false) {
-        appendRunRecordEvent(runId, {
-          title: tr('runAcceptTrackedFailed'),
-          status: 'failed',
-          detail: {
-            [tr('detailReason')]: tr('runAcceptTrackedFailedReason')
-          }
-        });
-        if (!WritebackSettlement.isSuccessfulTrackedChangeSettlement(result)) {
-          refreshRunCardControls(runId);
-        }
-      }
-      WritebackSettlement.attachAcceptNotVerifiedFailure(run, result, {
-        buildFailure: buildContentFailure
-      });
-      await applyTrackedChangeSettlement(runId, 'accept', result);
-    } finally {
-      trackedChangeInFlight.delete(runId);
-      refreshRunCardControls(runId);
-    }
+    return getRunReviewController().acceptRun(runId);
   }
 
   function getRunProjectIdForWriteback(run) {
@@ -7078,32 +6898,6 @@
       : '';
   }
 
-  // Translates the page bridge's Accept All `diagnostics` array into one
-  // run-card event row per step. Each entry is `{ step, info }`; the step
-  // names map 1:1 to the runAcceptTrackedStep* i18n keys. We render `info`
-  // as the event detail so the user can copy-paste the full trace without
-  // any extra page-state query.
-  function appendAcceptDiagnosticEvents(runId, diagnostics) {
-    for (const entry of diagnostics || []) {
-      const step = entry && entry.step;
-      const info = (entry && entry.info) || {};
-      const titleKey = WritebackSettlement.ACCEPT_DIAGNOSTIC_TITLE_KEYS[step];
-      if (!titleKey) {
-        continue;
-      }
-      const title = titleKey === 'runAcceptTrackedStepReplayStart' || titleKey === 'runAcceptTrackedStepReplayDone'
-        ? tr(titleKey, { path: info.path || tr('unknownFile') })
-        : tr(titleKey);
-      const status = WritebackSettlement.acceptDiagnosticStatus(step, info);
-      appendRunRecordEvent(runId, {
-        title,
-        kind: 'activity',
-        status,
-        detail: info
-      });
-    }
-  }
-
   function buildContentFailure(code, operation, overrides) {
     return WritebackSettlement.buildContentFailure(
       code,
@@ -7113,35 +6907,206 @@
     );
   }
 
-  async function applyTrackedChangeSettlement(runId, kind, result) {
-    const run = findRunRecord(runId);
+  async function applyTrackedChangeSettlement(runId, kind, result, options = {}) {
+    const record = findRunRecord(runId);
+    const run = kind === 'reject' ? advanceRunUndoProgress(record, result) : record;
     const settlement = WritebackSettlement.settleTrackedChangeLifecycle({
       kind,
       run,
       result,
       failureReasons: FailureReasons
     });
-    if (settlement.decision === 'blocked') {
+    if (settlement.decision === 'blocked'
+      && !(kind === 'reject' && (run !== record || record?.undoOperations?.some(Modules.UndoOperations.isFileUndoOperation)))) {
       return;
     }
     await Modules.ScopedPersistenceCoordinator.applyReviewTransition({
       getState: () => state, runId, transition: WritebackSettlement.applySettlementTransition(run, settlement),
-      persist: flushQueuedSaveState
+      persist: flushQueuedSaveState, assertCurrent: options.assertCurrent
     });
   }
 
+
+  function advanceRunUndoProgress(run, result) {
+    getDirectoryCleanupRecovery().capture({ recordId: run.id, sessionId: state.activeSessionId,
+      runProjectId: run.runProjectId, runAccountScopeId: run.runAccountScopeId }, result);
+    const postFiles = buildTrackedUndoPostFiles(run);
+    return Modules.UndoOperations.advanceUndoCheckpoint(run, result, file =>
+      WritebackSettlement.isUndoVerifiedContentMatching({ undoExpectedFiles: [file] }, result, { postFiles })
+    );
+  }
   function getRunUndoCount(run) {
     if (!run) {
       return 0;
     }
     const trackedEditorUndoCount = hasTrackedEditorUndo(run) ? 1 : 0;
     if (trackedEditorUndoCount) {
-      return trackedEditorUndoCount;
+      return trackedEditorUndoCount + Modules.UndoOperations.getFileUndoOperations(run).length;
     }
-    return (run.undoOperations?.length || 0)
+    return Modules.UndoOperations.prepareRunUndo(run).undoOperations.length
       + (run.undoTrackedChanges?.length || 0);
   }
 
+  function recoveryOwner(target) {
+    if (!target.runProjectId || target.runProjectId !== getCurrentProjectId() || !cachedAccountScopeId) {
+      throw new Error('Writeback recovery lost its project or account identity.');
+    }
+    return { projectId: target.runProjectId, accountScopeId: cachedAccountScopeId,
+      sessionId: target.sessionId, runId: target.recordId, createdAt: new Date().toISOString() };
+  }
+
+  let directoryCleanupRecovery = null;
+  function getDirectoryCleanupRecovery() {
+    return directoryCleanupRecovery || (directoryCleanupRecovery = Modules.DirectoryCleanupRecovery.create({
+      getProjectId: getCurrentProjectId, getAccountScopeId: () => cachedAccountScopeId,
+      getRouteGeneration: () => spaRouteGeneration, findRunRecord, refresh: refreshRunCardControls,
+      onOmitted: (runId, code) => appendRunRecordEvent(runId, { kind: 'technical', status: 'warning',
+        title: tx('Some folder observations exceeded the storage limit; existing observations were kept.',
+          '部分文件夹观测记录超过存储上限，已有记录已保留。'), detail: { code } })
+    }));
+  }
+  async function stageWritebackRecovery(operations, target, requireReviewing) {
+    const owner = recoveryOwner(target), generation = spaRouteGeneration, view = currentRunView;
+    const assertCurrent = () => {
+      const record = findRunRecord(target.recordId, target.sessionId);
+      if (owner.projectId !== getCurrentProjectId() || owner.accountScopeId !== cachedAccountScopeId
+        || generation !== spaRouteGeneration || view !== currentRunView || !view
+        || view.recordId !== owner.runId || view.sessionId !== owner.sessionId
+        || (target.runAccountScopeId && target.runAccountScopeId !== owner.accountScopeId)
+        || !record || record.forkSnapshot || record.runProjectId !== owner.projectId) {
+        throw new Error('The project, account or writeback run changed before dispatch.');
+      }
+      return record;
+    };
+    const record = assertCurrent();
+    const creates = operations.filter(op => op.type === 'create' && typeof op.content === 'string');
+    record.retryRequireReviewing = requireReviewing === true;
+    if (!creates.length) return;
+    const candidate = Modules.WritebackIntent.normalize({ ...owner, id: crypto.randomUUID(),
+      operations: creates, baseFiles: [], requireReviewing });
+    const safe = Modules.SessionState.pickWritebackRecovery({ ...record, retryWriteback: candidate }).retryWriteback;
+    if (safe) record.retryWriteback = safe; else delete record.retryWriteback;
+    await flushQueuedSaveState();
+    assertCurrent();
+  }
+
+  async function settleWritebackRecovery(applied, project, verification, target) {
+    const record = findRunRecord(target.recordId, target.sessionId);
+    if (!record) return;
+    const owner = recoveryOwner(target);
+    const skippedPaths = new Set((applied.skipped || []).map(entry => entry.operation?.path));
+    const creates = (record.retryWriteback?.operations || []).filter(op => skippedPaths.has(op.path));
+    // Untouched edits (never opened / rejected) and deletes whose server check failed are safe to replay.
+    const edits = (applied.skipped || []).filter(({ operation: op, result }) => result?.failure?.changedDocument === false && ((op?.type === 'edit'
+      && (result.failure.stage === 'navigation' || result.failure.code === 'write_operation_failed')) || (op?.type === 'delete' && result.failure.code === 'source_zip_unavailable'))).map(entry => entry.operation);
+    const base = { ...(record.retryWriteback || { ...owner, id: crypto.randomUUID(), requireReviewing: record.retryRequireReviewing === true }),
+      baseFiles: project?.files || [], requestId: applied.receiptUnconfirmed ? applied.requestId || '' : '' };
+    // An oversized edit pre-image must not cost the create retries (the intent has a 300 KiB ceiling).
+    const safeRetry = [[...creates, ...edits], creates].filter(ops => ops.length).map(ops => Modules.SessionState
+      .pickWritebackRecovery({ ...record, retryWriteback: Modules.WritebackIntent.normalize({ ...base, operations: ops }) }).retryWriteback).find(Boolean);
+    if (safeRetry) record.retryWriteback = safeRetry; else delete record.retryWriteback;
+    delete record.retryRequireReviewing;
+    const next = await writebackController.buildSaveCheck(applied, project, owner);
+    const files = new Map((record.saveCheck?.files || []).map(file => [file.path, file]));
+    for (const file of next?.files || []) {
+      if (verification.state === 'verified_saved') files.delete(file.path);
+      else files.set(file.path, file);
+    }
+    if (files.size) record.saveCheck = Modules.WritebackIntent.normalizeSaveCheck({ ...owner, files: [...files.values()] });
+    else {
+      delete record.saveCheck;
+      if (verification.state === 'verified_saved') record.saveConfirmedAt = new Date().toISOString();
+    }
+    await flushQueuedSaveState();
+  }
+
+  async function retryRunWriteback(runId) {
+    if (currentRunView || trackedChangeInFlight.size) return;
+    const session = getActiveSession(state);
+    const record = (session?.runs || []).find(run => run.id === runId);
+    const intent = Modules.WritebackIntent.normalize(record?.retryWriteback);
+    const check = Modules.WritebackIntent.normalizeSaveCheck(record?.saveCheck);
+    const owner = intent || check;
+    if (!record || record.forkSnapshot || !owner || owner.projectId !== getCurrentProjectId()
+      || owner.accountScopeId !== cachedAccountScopeId || owner.sessionId !== session.id
+      || owner.runId !== record.id || record.undoStatus === 'applied' || record.trackedChangeStatus === 'rejected') return;
+    const originalStatus = record.status;
+    const retryAutoRecompile = typeof record.executionSnapshot?.autoRecompile === 'boolean'
+      ? record.executionSnapshot.autoRecompile : undefined;
+    // State is renormalized during the awaits below (probes, session sync), which
+    // replaces run objects; always write through the current copy.
+    const live = () => findRunRecord(runId, session.id) || record;
+    let finished = false;
+    runCancellationRequested = false;
+    runCancellationController = new AbortController();
+    record.status = 'running';
+    record.retryingWriteback = true;
+    renderRunHistory({ preserveScroll: true });
+    const root = panel.querySelector(`[data-run-id="${cssEscape(runId)}"]`);
+    currentRunView = { root, recordId: runId, sessionId: session.id, runProjectId: owner.projectId,
+      runAccountScopeId: owner.accountScopeId, executionSnapshot: record.executionSnapshot,
+      startedAt: Date.now(), writebackRetry: true, events: root?.querySelector('[data-run-events]'),
+      report: root?.querySelector('[data-run-report]'), status: root?.querySelector('[data-run-status]'),
+      runProcess: root?.querySelector('[data-run-process]'), processLabel: root?.querySelector('[data-run-process-summary]') };
+    setRunning(true);
+    const assertOwner = () => {
+      if (runCancellationRequested || currentRunView?.recordId !== runId) {
+        throw Object.assign(new Error('Save checking was cancelled.'), { code: 'codex_cancelled' });
+      }
+      if (owner.projectId !== getCurrentProjectId() || owner.accountScopeId !== cachedAccountScopeId) {
+        throw Object.assign(new Error('The project or account changed.'), { code: 'aborted_project_changed' });
+      }
+    };
+    try {
+      assertOwner();
+      if (intent?.requestId) {
+        const receipt = await callPageBridge('getWritebackReceipt', { requestId: intent.requestId, runProjectId: owner.projectId });
+        if (receipt?.state === 'running') throw new Error(tx('The previous upload is still finishing. Try again shortly.', '上一轮上传仍在收尾，请稍后再试。'));
+      }
+      if (intent?.operations.length) {
+        // Edits replay against the run's original base files, so the stale guard still refuses changed documents.
+        const result = await applySyncChangesToOverleaf(intent.operations.map(op => op.type === 'edit'
+          ? { type: 'write', path: op.path, patches: op.patches, content: op.replaceAll } : op.type === 'delete' ? { type: 'delete', path: op.path } : { ...op, type: 'create' }),
+          { id: owner.projectId, files: intent.baseFiles }, { mode: 'auto', requireReviewing: intent.requireReviewing,
+            autoRecompile: retryAutoRecompile,
+            retryCreates: true, assistantMessage: tx('Retried the remaining file transfers for this task.', '已重试本轮未完成的文件同步。') });
+        assertOwner();
+        if (result.settlement?.facts) live().settlement = WritebackSettlement.mergeRetrySettlement(live().settlement, result.settlement.facts); // Keep files outside the retry.
+        await finishRunView(result.hasSkippedOperations ? tx('Sync incomplete', '同步未完成') : tx('Synced', '已同步'),
+          result.hasSkippedOperations ? 'failed' : 'completed');
+        finished = true;
+      } else if (check) {
+        const result = await writebackController.confirmSaveCheck(check, { assertCurrent: assertOwner,
+          readSnapshot: params => callPageBridge('getProjectSnapshot', { ...params, runProjectId: owner.projectId }) });
+        assertOwner();
+        const current = live();
+        if (result.ok) {
+          delete current.saveCheck;
+          current.saveConfirmedAt = new Date().toISOString();
+          if (current.settlement) current.settlement.evidence = { ...current.settlement.evidence, saved: 'verified' };
+        }
+        showPluginToast(result.ok ? tx('Saved content confirmed.', '已确认文件保存。')
+          : tx('Saved content is still unconfirmed. No file was uploaded again.', '保存状态仍待确认，本次没有重复上传文件。'));
+      }
+      await flushQueuedSaveState();
+    } catch (error) {
+      showPluginToast(error.message || String(error));
+    } finally {
+      // Only finishRunView settles a new terminal status; every other exit
+      // returns the card to the status it had before the retry.
+      for (const copy of new Set([record, live()])) {
+        delete copy.retryingWriteback;
+        if (!finished && copy.status === 'running') copy.status = originalStatus;
+      }
+      if (currentRunView?.recordId === runId) currentRunView = null;
+      runCancellationRequested = false;
+      runCancellationController = null;
+      setRunning(false);
+      saveStateSoon();
+      renderRunHistory({ preserveScroll: true });
+    }
+  }
+
   function appendUndoReviewingPolicyEvent(runId, reviewingPolicy) {
     if (!reviewingPolicy || reviewingPolicy.policy !== 'no-trace-undo') {
       return;
@@ -7224,8 +7189,10 @@
     });
   }
 
-  function recordUndoFromApply(project, applyResult) {
-    const appliedEntries = getAppliedEntries(applyResult);
+  async function recordUndoFromApply(project, applyResult) {
+    const directoryRecovery = Modules.DirectoryCleanupRecovery ? getDirectoryCleanupRecovery() : null;
+    directoryRecovery?.capture(currentRunView, applyResult);
+    const appliedEntries = getAppliedEntries(applyResult).filter(entry => entry.result?.idempotent !== true);
     if (!currentRunView?.recordId || !appliedEntries.length) {
       return;
     }
@@ -7244,14 +7211,15 @@
       ...appliedOperations
     ];
     record.appliedOperations = combinedAppliedOperations;
+    const createdCheckpoint = buildCreatedFileUndoCheckpoint(project, combinedAppliedOperations, record);
 
     if ((currentRunView?.executionSnapshot?.requireReviewing ?? state.requireReviewing) === true) {
       const combinedTrackedChanges = normalizeApplyTrackedChanges([
         ...(Array.isArray(record.undoTrackedChanges) ? record.undoTrackedChanges : []),
         ...trackedChanges
       ]);
-      record.undoOperations = [];
-      record.undoBaseFiles = [];
+      record.undoOperations = createdCheckpoint.undoOperations;
+      record.undoBaseFiles = createdCheckpoint.undoBaseFiles;
       record.undoTrackedChanges = combinedTrackedChanges;
       record.undoExpectedFiles = selectExpectedFilesForTrackedUndo(
         project,
@@ -7259,6 +7227,7 @@
         combinedTrackedChanges,
         record.undoExpectedFiles
       );
+      record.undoOperations = Modules.UndoOperations.getFileUndoOperations(record);
       record.undoStatus = '';
       record.partialWriteback = skippedEntries.length > 0;
       // Recording tracked-change refs enters the run into the tracked-change
@@ -7286,6 +7255,11 @@
             [tr('detailMethod')]: tr('undoCheckpointNativeMethod')
           }
         });
+      } else if (record.undoOperations.length) {
+        appendRunEvent({
+          title: tr('undoCheckpointPlain', { count: record.undoOperations.length }),
+          status: 'completed'
+        });
       } else {
         appendRunEvent({
           title: tr('undoCheckpointMissing'),
@@ -7300,6 +7274,15 @@
     }
 
     const checkpoint = buildUndoCheckpoint(project, combinedAppliedOperations);
+    const createdPaths = new Set(createdCheckpoint.undoOperations.map(operation => operation.path));
+    checkpoint.undoOperations = [
+      ...checkpoint.undoOperations.filter(operation => !createdPaths.has(operation.path)),
+      ...createdCheckpoint.undoOperations
+    ];
+    checkpoint.undoBaseFiles = [
+      ...checkpoint.undoBaseFiles.filter(file => !createdPaths.has(file.path)),
+      ...createdCheckpoint.undoBaseFiles
+    ];
     if (!checkpoint.undoOperations.length) {
       return;
     }
@@ -7374,8 +7357,10 @@
       timestamp: event.timestamp || new Date().toISOString(),
       kind: event.kind || 'activity',
       technicalDetail: event.technicalDetail,
+      activity: Modules.RunActivityModel.capture(event, sanitizeAssistantVisibleText),
       guidanceId: sanitizeAssistantVisibleText(event.guidanceId)
     };
+    if (event.failure) normalized.failure = sanitizeAssistantVisibleValue(event.failure);
     record.events = [...(record.events || []), normalized].slice(-MAX_RUN_EVENTS);
     saveStateSoon();
 
@@ -7400,29 +7385,24 @@
     refreshRunCardControls(runId);
   }
 
-  function applyLegacyUndoSettlement(runId, undoStatus, result) {
-    const run = findRunRecord(runId);
-    if (!run) return;
-    Object.assign(run, WritebackSettlement.applySettlementTransition(
-      run,
-      WritebackSettlement.settleLegacyUndo({
-        run,
-        status: undoStatus,
-        result
-      })
-    ));
-    saveStateSoon();
-    refreshRunCardControls(runId);
+  async function applyLegacyUndoSettlement(runId, undoStatus, result) {
+    return getRunReviewController().applyLegacyUndoSettlement(runId, undoStatus, result);
   }
 
   function refreshRunCardControls(runId) {
-    const run = findRunRecord(runId);
-    const root = panel?.querySelector(`[data-run-id="${cssEscape(runId)}"]`);
+    const run = findRunRecord(runId), root = panel?.querySelector(`[data-run-id="${cssEscape(runId)}"]`);
     if (!run || !root) {
       return;
     }
+    if (runTimelineView.refreshResolvedUndo?.(runId)) return;
     configureAcceptButton(root, run);
     configureUndoButton(root, run);
+    const reportEvent = (run.events || []).filter(event => event.kind === 'report').pop();
+    const report = root.querySelector('[data-run-report]');
+    if (reportEvent && report) {
+      report.replaceChildren(renderCompletionReport(reportEvent, run));
+      report.hidden = false;
+    }
   }
 
   function findRunRecord(runId, sessionId = '') {
@@ -7543,6 +7523,11 @@
   // v1.8.0 C1: a change-history row jumps to the run it describes —
   // switch to its session if needed, then scroll + flash the run card.
   async function jumpToHistoryRun(record = {}) {
+    if (!cachedAccountScopeId || record.accountScopeId !== cachedAccountScopeId
+      || record.projectId !== getCurrentProjectId()) {
+      showPluginToast(tx('The project or account changed. Reopen file history and try again.', '项目或账号已变化，请重新打开文件修改记录。'));
+      return;
+    }
     closeCustomInstructionsSettings();
     if (record.sessionId && record.sessionId !== state.activeSessionId) {
       const target = (state.sessions || []).find(session => session.id === record.sessionId);
@@ -7621,7 +7606,7 @@
       if (primaryNext) return primaryNext;
       return tx('Expand the write result, review the skipped reasons, then retry after fixing them.', '请展开写入结果查看跳过原因，处理后可以重试。');
     }
-    if (input.status === 'rejected') {
+    if (input.status === 'cancelled' || input.status === 'rejected') {
       return tx('Adjust the task description and run again.', '可以调整任务描述后重新运行。');
     }
     if (input.status === 'blocked' || input.status === 'failed') {