codex-overleaf-link 2.5.0 → 2.5.1

package/extension/src/shared/storageMigration.js

@@ -8,6 +8,7 @@
   'use strict';
 
   var PREFS_KEY = 'codexOverleafPrefs';
+  var LEGACY_MIGRATION_PREFIX = 'codexOverleafLegacyPanelMigration:';
   var SESSION_TOMBSTONES_KEY = 'codexOverleafSessionTombstones';
   var SESSION_TOMBSTONE_ENTRY_PREFIX = 'codexOverleafSessionTombstone:v2:';
   var MAX_DELETED_SESSION_IDS_PER_PROJECT = 100;
@@ -139,118 +140,77 @@
 
   function runMigrationIfNeeded(projectId, legacyStorageKey, accountScopeId) {
     projectId = normalizeProjectPrefKey(projectId);
-    var normalizedAccountScopeId = normalizeTextField(accountScopeId, PROJECT_PREF_KEY_MAX_CHARS);
-    if (!normalizedAccountScopeId || !projectId) {
-      return Promise.resolve({
-        prefs: normalizePrefs({}),
-        sessions: [],
-        activeSessionId: '',
-        migrated: false,
-        reason: 'account_scope_unavailable'
-      });
-    }
-    return withProjectPreferenceLock(projectId, function () {
-      return chrome.storage.local.get(null).then(function (stored) {
-        var claimed = claimLegacyProjectPreferences(
-          stored[PREFS_KEY] || {},
-          normalizedAccountScopeId,
-          projectId
-        );
-        var storedPrefs = claimed.prefs;
-        var persistClaim = claimed.changed
-          ? chrome.storage.local.set({ [PREFS_KEY]: storedPrefs })
-          : Promise.resolve();
-        return persistClaim.then(function () {
-          var prefs = buildProjectPreferenceView(
-            storedPrefs,
-            normalizedAccountScopeId,
-            projectId
-          );
-          var tombstones = collectSessionTombstones(stored);
-          var deletedSessionIds = getDeletedSessionIds(tombstones, projectId);
-          var schemaVersion = prefs.storageSchemaVersion || 0;
-
-          if (schemaVersion >= StorageDb.TARGET_SCHEMA_VERSION) {
-            var activeSessionByProject = prefs.activeSessionByProject || {};
-            var activeSessionId = activeSessionByProject[projectId] || '';
-            if (typeof StorageDb.claimSessionsForAccount !== 'function') {
-              return Promise.reject(Object.assign(
-                new Error('Atomic legacy-session claiming is unavailable.'),
-                { code: 'scoped_claim_unavailable' }
-              ));
-            }
-            return StorageDb.claimSessionsForAccount(
-              projectId,
-              normalizedAccountScopeId,
-              deletedSessionIds
-            ).then(function (visibleSessions) {
-              var visibleActiveSessionId = visibleSessions.some(function (session) {
-                return session && session.id === activeSessionId;
-              })
-                ? activeSessionId
-                : visibleSessions.length
-                  ? visibleSessions[visibleSessions.length - 1].id
-                  : '';
-              return {
-                prefs: prefs,
-                sessions: visibleSessions,
-                activeSessionId: visibleActiveSessionId,
-                migrated: false
-              };
-            });
-          }
-
-          // Migration v0 → v1
-          var legacyBlob = stored[legacyStorageKey] || {};
-          var legacySessions = Array.isArray(legacyBlob.sessions) ? legacyBlob.sessions : [];
-          var migratedSessions = [];
-
-          for (var i = 0; i < legacySessions.length; i++) {
-            var legacy = legacySessions[i];
-            if (!legacy || !legacy.id) { continue; }
-            if (deletedSessionIds.indexOf(legacy.id) !== -1) { continue; }
-            var record = StorageDb.buildSessionRecord(
-              buildLegacySessionRecordInput(projectId, legacyBlob, legacy, normalizedAccountScopeId)
-            );
-            migratedSessions.push(record);
-          }
-
-          var putPromise = migratedSessions.length
-            ? StorageDb.putRecords('sessions', migratedSessions)
-            : Promise.resolve([]);
-
-          return putPromise.then(function () {
-            var newPrefs = StorageDb.extractLightweightPrefs(legacyBlob, projectId);
-            newPrefs.activeSessionByProject = StorageDb.buildActiveSessionByProject(
-              {},
-              projectId,
-              legacyBlob.activeSessionId || (migratedSessions.length ? migratedSessions[migratedSessions.length - 1].id : '')
-            );
-            var mergedPrefs = mergeScopedProjectPreferences(
-              storedPrefs,
-              newPrefs,
-              normalizedAccountScopeId,
-              projectId
-            );
-            var prefsView = buildProjectPreferenceView(
-              mergedPrefs,
-              normalizedAccountScopeId,
-              projectId
-            );
-
-            return chrome.storage.local.set({ [PREFS_KEY]: mergedPrefs }).then(function () {
-              return chrome.storage.local.remove(legacyStorageKey).catch(function () {});
-            }).then(function () {
-              return {
-                prefs: prefsView,
-                sessions: migratedSessions,
-                activeSessionId: prefsView.activeSessionByProject[projectId] || '',
-                migrated: true
-              };
-            });
-          });
+    var account = normalizeTextField(accountScopeId, PROJECT_PREF_KEY_MAX_CHARS);
+    if (!account || !projectId) return Promise.resolve({ prefs: normalizePrefs({}), sessions: [],
+      activeSessionId: '', migrated: false, reason: 'account_scope_unavailable' });
+    return withProjectPreferenceLock(projectId, async function () {
+      var stored = await chrome.storage.local.get(null);
+      var claimed = claimLegacyProjectPreferences(stored[PREFS_KEY] || {}, account, projectId);
+      var storedPrefs = claimed.prefs;
+      if (claimed.changed) await chrome.storage.local.set({ [PREFS_KEY]: storedPrefs });
+      var prefs = buildProjectPreferenceView(storedPrefs, account, projectId);
+      var deleted = getDeletedSessionIds(collectSessionTombstones(stored), projectId);
+      var markerKey = LEGACY_MIGRATION_PREFIX + encodeURIComponent(String(legacyStorageKey || ''));
+      var marker = stored[markerKey];
+      var legacyBlob = stored[legacyStorageKey];
+      var hasLegacy = Boolean(legacyBlob && typeof legacyBlob === 'object' && !Array.isArray(legacyBlob));
+      var schemaCurrent = (prefs.storageSchemaVersion || 0) >= StorageDb.TARGET_SCHEMA_VERSION;
+      if (marker && (marker.projectId !== projectId || marker.sourceKey !== legacyStorageKey || !marker.accountScopeId)) {
+        throw Object.assign(new Error('The legacy history source has a conflicting migration identity.'), { code: 'legacy_migration_scope_conflict' });
+      }
+      if (typeof StorageDb.claimSessionsForAccount !== 'function') {
+        throw Object.assign(new Error('Atomic legacy-session claiming is unavailable.'), { code: 'scoped_claim_unavailable' });
+      }
+      var visible = await StorageDb.claimSessionsForAccount(projectId, account, deleted);
+      function result(currentPrefs, sessions, migrated) {
+        var wanted = currentPrefs.activeSessionByProject?.[projectId] || '';
+        return { prefs: currentPrefs, sessions: sessions,
+          activeSessionId: sessions.some(session => session.id === wanted) ? wanted : sessions.at(-1)?.id || '',
+          migrated: migrated };
+      }
+      if ((schemaCurrent && !hasLegacy) || marker?.complete || (marker && marker.accountScopeId !== account)) {
+        return result(prefs, visible, false);
+      }
+      legacyBlob = hasLegacy ? legacyBlob : {};
+      var legacySessions = Array.isArray(legacyBlob.sessions) ? legacyBlob.sessions : [];
+      var owners = new Set([legacyBlob.accountScopeId, legacyBlob.__codexOverleafFallbackAccountScopeId,
+        ...legacySessions.map(session => session?.accountScopeId)].filter(value => typeof value === 'string' && value));
+      if ([...owners].some(owner => owner !== account)) return result(prefs, visible, false);
+      // The shared preferences lock serializes this source claim across accounts.
+      // Keep it after a write failure; only its owner can finish the import.
+      if (hasLegacy && !marker) {
+        marker = { sourceKey: legacyStorageKey, projectId: projectId, accountScopeId: account, complete: false };
+        await chrome.storage.local.set({ [markerKey]: marker });
+      }
+      var existingIds = new Set(visible.map(session => session.id));
+      var incoming = legacySessions.filter(session => session?.id && !deleted.includes(session.id) && !existingIds.has(session.id))
+        .map(session => StorageDb.buildSessionRecord(buildLegacySessionRecordInput(projectId, legacyBlob, session, account)));
+      var written = incoming.length ? await StorageDb.putRecords('sessions', incoming) : [];
+      if (incoming.length && (!Array.isArray(written) || incoming.some(session => !written.some(record =>
+        record.id === session.id && record.accountScopeId === account && record.projectId === projectId)))) {
+        throw Object.assign(new Error('Legacy history was not confirmed in the main session store.'), { code: 'legacy_migration_not_persisted' });
+      }
+      var sessions = [...visible, ...written];
+      var newPrefs = StorageDb.extractLightweightPrefs(legacyBlob, projectId);
+      if (schemaCurrent) {
+        // A later project's import must not reset current global preferences.
+        var legacyPrefs = newPrefs;
+        newPrefs = Object.assign({}, legacyPrefs, prefs);
+        PROJECT_SCOPED_PREF_MAPS.forEach(function (name) {
+          newPrefs[name] = Object.assign({}, legacyPrefs[name] || {}, prefs[name] || {});
         });
-      });
+      }
+      var currentActive = prefs.activeSessionByProject?.[projectId];
+      var activeId = sessions.some(session => session.id === currentActive) ? currentActive
+        : legacyBlob.activeSessionId || sessions.at(-1)?.id || '';
+      newPrefs.activeSessionByProject = StorageDb.buildActiveSessionByProject({}, projectId, activeId);
+      var mergedPrefs = mergeScopedProjectPreferences(storedPrefs, newPrefs, account, projectId);
+      await chrome.storage.local.set({ [PREFS_KEY]: mergedPrefs });
+      // Completion is per source and owner, independent of the global schema.
+      // A failed cleanup cannot replay old content or transfer it to another account.
+      if (hasLegacy) await chrome.storage.local.set({ [markerKey]: { ...marker, complete: true } });
+      await chrome.storage.local.remove(legacyStorageKey).catch(function () {});
+      return result(buildProjectPreferenceView(mergedPrefs, account, projectId), sessions, true);
     });
   }
 

package/extension/src/shared/storageRunActions.js

@@ -1,18 +1,16 @@
 (function initStorageRunActions(root, factory) {
   if (typeof module === 'object' && module.exports) {
-    module.exports = factory(require('./selectionContext'), require('./writebackIntent'), require('./writingStyle'));
+    module.exports = factory(require('./selectionContext'), require('./writebackIntent'), require('./writingStyle'), require('./directoryCleanupProof'));
   } else {
-    root.CodexOverleafModuleRegistry.define('StorageRunActions', ['SelectionContext', 'WritebackIntent', 'WritingStyle'], factory);
+    root.CodexOverleafModuleRegistry.define('StorageRunActions', ['SelectionContext', 'WritebackIntent', 'WritingStyle', 'DirectoryCleanupProof'], factory);
   }
-})(typeof globalThis !== 'undefined' ? globalThis : window, function storageRunActionsFactory(SelectionContext, WritebackIntent, WritingStyle) {
+})(typeof globalThis !== 'undefined' ? globalThis : window, function storageRunActionsFactory(SelectionContext, WritebackIntent, WritingStyle, DirectoryCleanupProof) {
   'use strict';
 
-  var MAX_PERSISTED_ACTION_RUNS_PER_SESSION = 2;
-  // Undo/Accept need whole pre- and post-images of every written file, so one
-  // run that edits a 120 KB roadmap and creates a 100 KB chapter already needs
-  // ~560 KB. The old 320 KB cap silently dropped the whole payload and the
-  // buttons vanished after a reload. Two runs per session keep this bounded.
-  var MAX_PERSISTED_ACTION_BYTES_PER_RUN = 2 * 1024 * 1024;
+  // Share a bounded budget across the retained history, rather than expiring
+  // otherwise valid recovery data after two edits. The session builder also
+  // reserves room for display metadata within the shared transport limit.
+  var MAX_PERSISTED_ACTION_BYTES_PER_SESSION = 16 * 1024 * 1024;
 
   function compactRunsForStorage(runs, options, maxRuns, compactRun) {
     if (typeof compactRun !== 'function') {
@@ -21,22 +19,100 @@
     var selectedRuns = (Array.isArray(runs) ? runs : [])
       .filter(function (run) { return run && typeof run.id === 'string'; })
       .slice(-Math.max(0, Number(maxRuns) || 0));
-    var actionRunIds = new Set();
+    var payloads = new Map();
+    var remaining = Math.min(MAX_PERSISTED_ACTION_BYTES_PER_SESSION,
+      Number.isFinite(options?.maxActionPayloadBytes) ? Math.max(0, options.maxActionPayloadBytes) : Infinity);
+    var usedBytes = 0, usedChars = 0;
+    var fits = (bytes, chars) => bytes <= remaining && (typeof options?.canRetainActionPayload !== 'function'
+      || options.canRetainActionPayload(usedBytes + bytes, usedChars + chars));
     if (options && options.preserveRunActionPayload === true) {
-      for (var index = selectedRuns.length - 1;
-        index >= 0 && actionRunIds.size < MAX_PERSISTED_ACTION_RUNS_PER_SESSION;
-        index -= 1) {
-        if (hasReloadableRunActionPayload(selectedRuns[index])) {
-          actionRunIds.add(selectedRuns[index].id);
+      for (var index = selectedRuns.length - 1; index >= 0; index -= 1) {
+        var run = selectedRuns[index];
+        if (!hasReloadableRunActionPayload(withoutDirectoryFacts(run))) continue;
+        var payload = compactRunActionPayload(run, true, { includeCaptures: false, includeDirectoryCleanup: false });
+        if (payload.recoveryRetention?.state === 'omitted') { payloads.set(run.id, payload); continue; }
+        var serialized = JSON.stringify(payload);
+        var bytes = getUtf8ByteLength(serialized);
+        if (!fits(bytes, serialized.length)) {
+          payloads.set(run.id, { ...emptyActionPayload(), recoveryRetention: omitted('session-budget', bytes) });
+          continue;
+        }
+        remaining -= bytes;
+        usedBytes += bytes; usedChars += serialized.length;
+        payloads.set(run.id, payload);
+      }
+      // Captures are optional. They must not crowd out any retained core data.
+      for (var run of selectedRuns.slice().reverse()) {
+        var payload = payloads.get(run.id);
+        if (!payload || payload.recoveryRetention?.state === 'omitted'
+          || run.undoStatus === 'applied' || ['accepted', 'rejected'].includes(run.trackedChangeStatus)) continue;
+        var captures = cloneSerializableArray(run.trackedChangeCaptures);
+        var extraText = captures.length ? JSON.stringify({ trackedChangeCaptures: captures }) : '';
+        var extraBytes = getUtf8ByteLength(extraText);
+        if (extraBytes && fits(extraBytes, extraText.length)) {
+          payload.trackedChangeCaptures = captures;
+          remaining -= extraBytes;
+          usedBytes += extraBytes; usedChars += extraText.length;
         }
       }
     }
+    // Passive directory history uses only the space left after all original
+    // recovery payloads and optional captures have been selected.
+    var directoryRemaining = Number.isFinite(options?.maxOptionalDirectoryBytes)
+      ? Math.max(0, options.maxOptionalDirectoryBytes) : Infinity;
     return selectedRuns.map(function (run) {
-      return compactRun(run, actionRunIds.has(run.id));
+      var payload = payloads.get(run.id) || compactRunActionPayload(run, false, { includeDirectoryCleanup: false });
+      if (options?.deferDirectoryCleanup !== true) payload = appendDirectoryFacts(payload, run,
+        options?.preserveRunActionPayload === true, function (bytes, chars) {
+          if (bytes > directoryRemaining || !fits(bytes, chars)) return false;
+          directoryRemaining -= bytes; remaining -= bytes;
+          usedBytes += bytes; usedChars += chars;
+          return true;
+        }, 'session-budget');
+      return compactRun(run, payloads.has(run.id) && !coreWasOmitted(payload), payload);
     });
   }
 
+  // Keep the complete display history while allocating finite recovery space
+  // across the current project. A record plus its previous merge baseline is
+  // transported together; a readable batch must also fit the response bound.
+  function compactSessionBatchActions(records, options = {}, buildSessionRecord, SharedSessionTransfer) {
+    var budget = SharedSessionTransfer.MAX_RESPONSE_BYTES - 64 * 1024;
+    if (SharedSessionTransfer.byteLength(JSON.stringify(records)) <= budget) return records;
+    var summaries = records.map(record => buildSessionRecord(record, { preserveRunActionPayload: false, deferDirectoryCleanup: true }));
+    var remaining = Math.max(0, budget - SharedSessionTransfer.byteLength(JSON.stringify(summaries)));
+    var allocated = new Map();
+    var ordered = records.slice().sort((a, b) => Number(b.id === options.activeSessionId) - Number(a.id === options.activeSessionId)
+      || (Date.parse(b.updatedAt) || 0) - (Date.parse(a.updatedAt) || 0));
+    for (var record of ordered) {
+      var summary = summaries.find(item => item.id === record.id);
+      var next = buildSessionRecord(record, { preserveRunActionPayload: true, maxActionPayloadBytes: remaining, deferDirectoryCleanup: true });
+      remaining -= Math.max(0, SharedSessionTransfer.byteLength(JSON.stringify(next)) - SharedSessionTransfer.byteLength(JSON.stringify(summary)));
+      allocated.set(record.id, next);
+    }
+    // Do not let an active session's optional directory facts evict another
+    // session's existing Undo core under the shared response bound.
+    for (var record of ordered) {
+      var core = allocated.get(record.id);
+      var sourceRuns = new Map((record.runs || []).map(run => [run.id, run]));
+      var withFacts = { ...core, runs: core.runs.map(run => {
+        var source = sourceRuns.get(run.id), next = { ...run };
+        if (source?.pendingDirectoryCleanup) next.pendingDirectoryCleanup = source.pendingDirectoryCleanup;
+        if (source?.recoveryRetention?.directoryCleanup === true) next.recoveryRetention = {
+          ...(next.recoveryRetention || { ...source.recoveryRetention, coreRetained: true }), directoryCleanup: true };
+        return next;
+      }) };
+      var enriched = buildSessionRecord(withFacts, { preserveRunActionPayload: true, maxOptionalDirectoryBytes: remaining });
+      remaining -= Math.max(0, SharedSessionTransfer.byteLength(JSON.stringify(enriched)) - SharedSessionTransfer.byteLength(JSON.stringify(core)));
+      allocated.set(record.id, enriched);
+    }
+    return records.map(record => allocated.get(record.id));
+  }
+
   function hasReloadableRunActionPayload(run) {
+    if (!run || run.forkSnapshot === true) return false;
+    if (runDirectoryCleanup(run)) return true;
+    if (run.undoStatus === 'applied' || ['accepted', 'rejected'].includes(run.trackedChangeStatus)) return false;
     var trackedStatus = run && run.trackedChangeStatus;
     var trackedLifecycle = (trackedStatus === 'pending' || trackedStatus === 'needs_review')
       && Array.isArray(run.undoTrackedChanges) && run.undoTrackedChanges.length > 0
@@ -56,29 +132,96 @@
     return trackedLifecycle || reviewingEditorUndo || legacyUndo;
   }
 
-  function compactRunActionPayload(run, keepActionPayload) {
+  function runDirectoryCleanup(run) {
+    var proof = DirectoryCleanupProof.normalize(run?.pendingDirectoryCleanup);
+    return proof && proof.runId === run.id && proof.projectId === run.runProjectId ? proof : null;
+  }
+
+  function omitted(reason, bytes = 0) {
+    return { state: 'omitted', reason, bytes };
+  }
+
+  function withoutDirectoryFacts(run) {
+    var core = { ...run };
+    delete core.pendingDirectoryCleanup;
+    if (core.recoveryRetention?.directoryCleanup === true) {
+      if (core.recoveryRetention.coreRetained === true) delete core.recoveryRetention;
+      else {
+        core.recoveryRetention = { ...core.recoveryRetention };
+        delete core.recoveryRetention.directoryCleanup;
+        delete core.recoveryRetention.coreRetained;
+      }
+    }
+    return core;
+  }
+
+  function coreWasOmitted(payload) {
+    return payload.recoveryRetention?.state === 'omitted' && payload.recoveryRetention.coreRetained !== true;
+  }
+
+  function appendDirectoryFacts(payload, run, keep, fits, reason) {
+    if (run?.forkSnapshot === true) return payload;
+    var directory = runDirectoryCleanup(run), previous = run?.recoveryRetention;
+    if (!directory && previous?.directoryCleanup !== true) return payload;
+    if (directory && keep) {
+      var extended = { ...payload, pendingDirectoryCleanup: directory };
+      var before = JSON.stringify(payload), after = JSON.stringify(extended);
+      if (fits(getUtf8ByteLength(after) - getUtf8ByteLength(before), after.length - before.length)) return extended;
+    }
+    // The existing omission marker distinguishes optional history from lost
+    // recovery authority. Never imply that a retained Undo core was discarded.
+    var retention = coreWasOmitted(payload) ? payload.recoveryRetention
+      : omitted(!keep ? 'fallback' : directory ? reason : previous.reason,
+        directory ? getUtf8ByteLength(JSON.stringify(directory)) : previous.bytes);
+    return { ...payload, recoveryRetention: { ...retention, directoryCleanup: true,
+      ...(!coreWasOmitted(payload) ? { coreRetained: true } : {}) } };
+  }
+
+  function compactRunActionPayload(run, keepActionPayload, options = {}) {
+    var payload = compactCoreActionPayload(withoutDirectoryFacts(run), keepActionPayload, options);
+    if (options.includeDirectoryCleanup === false) return payload;
+    var serialized = JSON.stringify(payload);
+    return appendDirectoryFacts(payload, run, keepActionPayload,
+      bytes => getUtf8ByteLength(serialized) + bytes <= MAX_PERSISTED_ACTION_BYTES_PER_SESSION, 'run-budget');
+  }
+
+  function compactCoreActionPayload(run, keepActionPayload, options = {}) {
     var empty = emptyActionPayload();
     if (!keepActionPayload || !hasReloadableRunActionPayload(run)) {
+      if (hasReloadableRunActionPayload(run)) empty.recoveryRetention = omitted('fallback');
+      else if (run?.recoveryRetention?.state === 'omitted' && !run.forkSnapshot
+        && run.undoStatus !== 'applied' && !['accepted', 'rejected'].includes(run.trackedChangeStatus)) {
+        empty.recoveryRetention = omitted(
+          ['run-budget', 'session-budget', 'fallback', 'invalid'].includes(run.recoveryRetention.reason)
+            ? run.recoveryRetention.reason : 'invalid', Math.max(0, Number(run.recoveryRetention.bytes) || 0));
+      }
       return empty;
     }
-    var payload = {
+    var terminal = run.undoStatus === 'applied' || ['accepted', 'rejected'].includes(run.trackedChangeStatus);
+    var payload = terminal ? emptyActionPayload() : {
       appliedOperations: cloneSerializableArray(run.appliedOperations),
       undoOperations: cloneSerializableArray(run.undoOperations),
       undoBaseFiles: cloneSerializableArray(run.undoBaseFiles),
       undoTrackedChanges: cloneSerializableArray(run.undoTrackedChanges),
       undoExpectedFiles: cloneSerializableArray(run.undoExpectedFiles)
     };
+    if (!terminal && Object.keys(payload).some(key => run[key]?.length && !payload[key].length)) {
+      return { ...empty, recoveryRetention: omitted('invalid') };
+    }
     var serialized;
     try {
       serialized = JSON.stringify(payload);
     } catch (_error) {
-      return empty;
+      return { ...empty, recoveryRetention: omitted('invalid') };
     }
-    if (getUtf8ByteLength(serialized) > MAX_PERSISTED_ACTION_BYTES_PER_RUN) return empty;
+    var bytes = getUtf8ByteLength(serialized);
+    if (bytes > MAX_PERSISTED_ACTION_BYTES_PER_SESSION) return { ...empty,
+      recoveryRetention: omitted('run-budget', bytes) };
+    if (options.includeCaptures === false || terminal) return payload;
     const captures = cloneSerializableArray(run.trackedChangeCaptures);
     if (captures.length) {
       const extended = { ...payload, trackedChangeCaptures: captures };
-      if (getUtf8ByteLength(JSON.stringify(extended)) <= MAX_PERSISTED_ACTION_BYTES_PER_RUN) return extended;
+      if (getUtf8ByteLength(JSON.stringify(extended)) <= MAX_PERSISTED_ACTION_BYTES_PER_SESSION) return extended;
     }
     return payload; // Optional capture evidence must never evict a mature Undo payload.
   }
@@ -169,17 +312,20 @@
   function mergeSessionReviewState(incoming, existing, reviewRunIds) {
     if (!existing || incoming.id !== existing.id || incoming.projectId !== existing.projectId
       || !incoming.accountScopeId || incoming.accountScopeId !== existing.accountScopeId) return incoming;
-    var terminal = run => ['accepted', 'rejected'].includes(run?.trackedChangeStatus);
+    var terminal = run => ['accepted', 'rejected'].includes(run?.trackedChangeStatus) || run?.undoStatus === 'applied';
     var incomingRuns = new Map((incoming.runs || []).map(run => [run.id, run]));
     var existingRuns = new Map((existing.runs || []).map(run => [run.id, run]));
     var requestedIds = new Set(reviewRunIds || []);
-    var explicitReview = Array.from(requestedIds).some(id =>
-      ['accepted', 'rejected', 'needs_review'].includes(incomingRuns.get(id)?.trackedChangeStatus));
+    var explicitReview = Array.from(requestedIds).some(id => {
+      var run = incomingRuns.get(id);
+      return ['accepted', 'rejected', 'needs_review'].includes(run?.trackedChangeStatus)
+        || ['applied', 'partial'].includes(run?.undoStatus);
+    });
     var newer = (Date.parse(incoming.updatedAt) || 0) >= (Date.parse(existing.updatedAt) || 0);
     if (!newer && !explicitReview) return incoming;
     var base = newer ? incoming : existing;
-    var fields = ['trackedChangeStatus', 'undoStatus', 'undoTrackedChanges', 'undoExpectedFiles',
-      'undoOperations', 'undoBaseFiles', 'appliedOperations', 'trackedChangeCaptures', 'settlement', 'settlementFacts'];
+    var fields = ['trackedChangeStatus', 'undoStatus', 'undoOwnerProtocol', 'undoTrackedChanges', 'undoExpectedFiles',
+      'undoOperations', 'undoBaseFiles', 'appliedOperations', 'trackedChangeCaptures', 'recoveryRetention', 'settlement', 'settlementFacts'];
     var changed = false;
     var runs = (base.runs || []).map(function (run) {
       var previous = existingRuns.get(run.id), candidate = incomingRuns.get(run.id);
@@ -218,7 +364,44 @@
     return (hash >>> 0).toString(16).padStart(8, '0');
   }
 
+  // A successful durable write can omit an oversized checkpoint while the
+  // current tab still has it. Warn only the view and exact action revision
+  // that was saved; never mutate or remove its in-memory recovery material.
+  function projectRetentionUpdates({ liveState, capturedState, written, capturedScope, currentScope } = {}) {
+    if (!capturedScope?.accountScopeId || !capturedScope.projectId
+      || !Number.isSafeInteger(capturedScope.generation)
+      || ['accountScopeId', 'projectId', 'generation'].some(key => capturedScope[key] !== currentScope?.[key])) return [];
+    var fields = ['appliedOperations', 'undoOperations', 'undoBaseFiles', 'undoTrackedChanges',
+      'undoExpectedFiles', 'undoStatus', 'trackedChangeStatus', 'pendingDirectoryCleanup'];
+    var fingerprint = run => JSON.stringify(fields.map(field => run[field]));
+    var updates = [];
+    for (var record of written || []) {
+      if (record.accountScopeId !== capturedScope.accountScopeId || record.projectId !== capturedScope.projectId) continue;
+      var live = liveState?.sessions?.find(session => session.id === record.id);
+      var captured = capturedState?.sessions?.find(session => session.id === record.id);
+      for (var storedRun of record.runs || []) {
+        var run = live?.runs?.find(run => run.id === storedRun.id);
+        var original = captured?.runs?.find(run => run.id === storedRun.id);
+        if (!run || !original || run.runProjectId !== capturedScope.projectId
+          || original.runProjectId !== capturedScope.projectId || !hasReloadableRunActionPayload(run)) continue;
+        try {
+          if (fingerprint(run) !== fingerprint(original)) continue;
+          if (storedRun.recoveryRetention?.state === 'omitted') updates.push({ runId: run.id, retention: { ...storedRun.recoveryRetention } });
+          else if (fingerprint(storedRun) === fingerprint(original)) updates.push({ runId: run.id, retention: null });
+        } catch (_error) { /* Invalid data cannot establish a revision. */ }
+      }
+    }
+    return updates;
+  }
+
+  function projectRetentionWarnings(input) {
+    return projectRetentionUpdates(input).filter(update => update.retention).map(update => update.runId);
+  }
+
   return {
+    projectRetentionUpdates: projectRetentionUpdates,
+    projectRetentionWarnings: projectRetentionWarnings,
+    compactSessionBatchActions: compactSessionBatchActions,
     compactStructuredEventValue: compactStructuredEventValue,
     mergeSessionReviewState: mergeSessionReviewState,
     compactRunsForStorage: compactRunsForStorage,

package/extension/src/shared/subagentActivityModel.js

@@ -132,7 +132,7 @@
       if (typeof value === 'string' && value) agent[field] = clean(value, sanitize, field === 'task' ? 4096 : 160);
     }
     agent.clipped ||= detail.historyClipped === true;
-    agent.historyUnavailable ||= detail.historyUnavailable === true;
+    if (typeof detail.historyUnavailable === 'boolean') agent.historyUnavailable = detail.historyUnavailable;
     let next = type.endsWith('.queued') ? 'pending' : type.endsWith('.started') ? 'running'
       : type.endsWith('.completed') ? 'completed' : type.endsWith('.rejected') ? 'failed'
         : type.endsWith('.failed') ? (detail.status === 'cancelled' ? 'cancelled' : 'failed') : detail.status;