codex-overleaf-link 2.5.0 → 2.5.1

package/extension/src/backgroundSharedSessions.js

@@ -1,11 +1,13 @@
 (function (root, factory) {
-  const api = factory();
+  const api = factory(typeof module === 'object' && module.exports
+    ? require('./shared/sharedSessionTransfer') : root.CodexOverleafSharedSessionTransfer);
   if (typeof module === 'object' && module.exports) module.exports = api;
   if (root) root.CodexOverleafSharedSessionsBackground = api;
-})(typeof globalThis !== 'undefined' ? globalThis : this, function () {
+})(typeof globalThis !== 'undefined' ? globalThis : this, function (Transfer) {
   'use strict';
   const MESSAGE = 'codex-overleaf/shared-sessions-v1';
   const LOCK_PORT = 'codex-overleaf/shared-session-lock-v1';
+  const REVIEW_LEASE_PREFIX = 'codex-overleaf-review-lease-v1:';
   const CHANGE_KEY = 'codex-overleaf-shared-sessions-changed-v1';
   const HOSTS = ['overleaf.com', 'www.overleaf.com', 'cn.overleaf.com'];
   const META_PREFIX = 'codex-overleaf-scoped-persistence-v1:';
@@ -20,10 +22,11 @@
     return value;
   }
   function scope(input) {
-    return { accountScopeId: part(input?.accountScopeId), projectId: typeof input?.projectId === 'string' ? input.projectId : '' };
+    return { accountScopeId: part(input?.accountScopeId), projectId: typeof input?.projectId === 'string' ? input.projectId : '', ...(input?.runId ? { runId: part(input.runId) } : {}) };
   }
   function keyFor(kind, value) {
-    return kind === 'preferences' ? 'preferences'
+    return kind === 'review' ? 'review:' + JSON.stringify([value.accountScopeId, part(value.projectId), part(value.runId)])
+      : kind === 'preferences' ? 'preferences'
       : 'state:' + encodeURIComponent(value.accountScopeId);
   }
   function metaKey(value) {
@@ -137,7 +140,7 @@
           const stored = item.value;
           if (value.projectId && stored.projectId !== value.projectId) { item.continue(); return; }
           const record = { ...stored.record, sharedRevision: stored.revision };
-          const size = JSON.stringify(record).length * 2;
+          const size = Transfer.byteLength(JSON.stringify(record));
           if (result.length && (result.length >= 8 || bytes + size > MAX_BYTES)) {
             resolve({ records: result, next: last }); return;
           }
@@ -162,10 +165,9 @@
           appliedOperations: [], trackedChangeCaptures: [], undoStatus: '' })) };
     }
     async function writeMany(message, value, importing, origin, sender) {
-      const entries = (importing ? [{ record: message.record }] : message.entries || [])
-        .map(entry => ({ record: clone(entry.record), base: clone(entry.base) }));
-      if (JSON.stringify(entries).length * 2 > MAX_BYTES * 3)
-        throw failure('shared_session_too_large', 'The session batch exceeds the shared storage transfer limit.');
+      // Reject a lost owner before doing any bounded decompression work.
+      ensureLock(message, value, sender);
+      const entries = (await Transfer.decode(message)).map(entry => ({ record: clone(entry.record), base: clone(entry.base) }));
       for (const { record, base } of entries) {
         if (!record || record.accountScopeId !== value.accountScopeId || record.projectId !== value.projectId)
           throw failure('shared_store_scope_mismatch', 'The session does not belong to the captured account and project.');
@@ -197,6 +199,14 @@
             putAt(entry.record, entry.base);
           }
         };
+        function appendResult(record, revision) {
+          // Merge may grow beyond either input. Reject inside this transaction,
+          // before returning success or committing any sibling record.
+          Transfer.validateRecord(record);
+          const result = { ...record, sharedRevision: revision };
+          Transfer.validateResponse([...results, result]);
+          results.push(result);
+        }
         function putAt(candidate, base, copy = false) {
           const key = [value.accountScopeId, candidate.id];
           const tombstone = deleted.get(key);
@@ -214,7 +224,7 @@
                 let next = candidate;
                 if (importing && existing) {
                   if (equal(existing.record, candidate) || copy) {
-                    results.push({ ...existing.record, sharedRevision: existing.revision }); return;
+                    appendResult(existing.record, existing.revision); return;
                   }
                   putAt(recoveryCopy(candidate, origin), null, true); return;
                 }
@@ -227,9 +237,9 @@
                   throw failure('shared_session_deleted', 'The session no longer exists.');
                 }
                 const revision = (existing?.revision || 0) + 1;
+                appendResult(next, revision);
                 store.put({ accountScopeId: value.accountScopeId, projectId: value.projectId,
                   id: next.id, record: next, revision });
-                results.push({ ...next, sharedRevision: revision });
               } catch (error) { abort(error); }
             };
           };
@@ -264,9 +274,41 @@
       }
       await done;
     }
+    const reviewLeaseKey = (key, token) => REVIEW_LEASE_PREFIX + key + ':' + token;
+    async function activeReviewLease(key) {
+      const prefix = REVIEW_LEASE_PREFIX + key + ':', records = await chromeApi.storage.local.get(null);
+      const active = [], expired = [];
+      for (const [id, lease] of Object.entries(records)) {
+        if (!id.startsWith(prefix)) continue;
+        const valid = lease && typeof lease.token === 'string' && lease.token.length > 0 && lease.token.length <= 256
+          && id === reviewLeaseKey(key, lease.token) && Number.isSafeInteger(lease.deadlineAt) && lease.deadlineAt > 0;
+        if (!valid) throw failure('review_lease_invalid', 'Undo ownership storage could not be verified.');
+        if (lease.deadlineAt > Date.now()) active.push(lease); else expired.push(id);
+      }
+      // Immutable token rows can only be removed by their exact expired key.
+      await Promise.all(expired.map(id => chromeApi.storage.local.remove(id).catch(() => {})));
+      return active.sort((a, b) => b.deadlineAt - a.deadlineAt)[0];
+    }
     async function handle(message, sender) {
       const origin = senderOrigin(sender), value = scope(message.scope);
       const method = message.method;
+      if (method === 'review-dispatched') {
+        const key = keyFor('review', { ...value, runId: part(message.runId) }), held = locks.get(key);
+        if (!held || held.disconnected || held.token !== message.reviewToken || held.tabId !== sender.tab.id)
+          throw failure('storage_lock_lost', 'The shared Undo owner was lost before dispatch.');
+        const deadlineAt = held.deadlineAt || (held.deadlineAt = Date.now() + 120000);
+        held.inFlight += 1;
+        try {
+          await chromeApi.storage.local.set({ [reviewLeaseKey(key, held.token)]: { token: held.token, deadlineAt } });
+          if (held.disconnected) throw failure('storage_lock_lost', 'The shared Undo owner disconnected before dispatch.');
+          return { deadlineAt };
+        } finally { held.inFlight -= 1; if (held.disconnected && !held.inFlight) held.release(); }
+      }
+      if (method === 'review-owner') {
+        const key = keyFor('review', { ...value, runId: part(message.runId) });
+        const lease = await activeReviewLease(key);
+        return { busy: locks.has(key) || lease?.deadlineAt > Date.now(), deadlineAt: lease?.deadlineAt || 0 };
+      }
       if (method === 'list') return list(value, typeof message.after === 'string' ? message.after : '');
       if (method === 'get') {
         const record = await readOne('sessions', [value.accountScopeId, part(message.id)]);
@@ -284,7 +326,7 @@
         tx.objectStore('migrations').put({ ...value, origin, complete: true, at: Date.now() });
         await done; return { complete: true };
       }
-      if (method === 'put' || method === 'import') {
+      if (method === 'put' || method === 'put-compressed' || method === 'import') {
         const result = await writeMany(message, value, method === 'import', origin, sender);
         if (result.length) await notify(value, message.clientId);
         return result;
@@ -327,12 +369,30 @@
         queues.delete(key);
       }
       port.onMessage.addListener(message => {
+        if (message?.type === 'release-review') {
+          const held = locks.get(heldKey);
+          if (held?.port !== port || held.token !== message.token || !heldKey.startsWith('review:')) return;
+          held.inFlight += 1;
+          void chromeApi.storage.local.remove(reviewLeaseKey(heldKey, held.token)).then(() => {
+            held.inFlight -= 1; held.release(); if (!closed) port.postMessage({ type: 'released' });
+          }, () => { held.inFlight -= 1; port.disconnect(); if (held.disconnected && !held.inFlight) held.release(); });
+          return;
+        }
         if (message?.type === 'ping') { port.postMessage({ type: 'pong' }); return; }
         if (message?.type !== 'acquire' || job) return;
         try {
-          const value = scope(message.scope), kind = message.kind === 'preferences' ? 'preferences' : 'state';
+          const value = scope(message.scope), kind = message.kind === 'review' ? 'review' : message.kind === 'preferences' ? 'preferences' : 'state';
           heldKey = keyFor(kind, value);
-          job = { port, tabId: port.sender.tab.id, closed: () => closed, grant: token => port.postMessage({ type: 'granted', token }) };
+          if (kind === 'review' && locks.has(heldKey)) { port.postMessage({ type: 'busy' }); return; }
+          job = { port, tabId: port.sender.tab.id, closed: () => closed, grant: token => {
+            if (kind !== 'review') { port.postMessage({ type: 'granted', token }); return; }
+            const held = locks.get(heldKey); held.inFlight += 1;
+            void (async () => {
+              const existing = await activeReviewLease(heldKey);
+              if (existing?.deadlineAt > Date.now()) { locks.get(heldKey)?.release(); if (!closed) port.postMessage({ type: 'busy' }); return; }
+              if (!closed) port.postMessage({ type: 'granted', token });
+            })().catch(() => port.disconnect()).finally(() => { held.inFlight -= 1; if (held.disconnected && !held.inFlight) held.release(); });
+          } };
           if (!queues.has(heldKey)) queues.set(heldKey, []);
           queues.get(heldKey).push(job);
           pump(heldKey);

package/extension/src/backgroundUpdateCoordinator.js

@@ -98,6 +98,7 @@
   }
 
   async function startup() {
+    if (!await waitForBootstrapOwnership()) return;
     chrome.alarms?.create?.(CHECK_ALARM, {
       delayInMinutes: 0.5,
       periodInMinutes: CHECK_INTERVAL_MINUTES
@@ -170,15 +171,14 @@
       operation.phase = 'checking';
       await setUpdateState({ ...currentState, state: 'checking', operationId: operation.id,
         cancelRequested: false, initiatedBy: manual ? 'manual' : 'automatic',
-        code: '', message: '', blocker: '', blockers: [], postponeUntil: LEGACY_GUARD }, { operation });
+        code: '', message: '', blocker: '', blockers: [], cooldownUntil: 0, postponeUntil: LEGACY_GUARD }, { operation });
       try {
         const result = await withTimeout(requestNative('update.check', {
           operationId: operation.id, currentVersion: currentVersion(), etag: currentState.etag || ''
         }), CHECK_REQUEST_TIMEOUT_MS, codedError('update_check_timeout', 'The managed update check did not complete in time.'));
         assertOperation(operation);
         const checkedAt = Date.now();
-        if (result.available || (result.reason === 'not_modified'
-          && policy.compareStableVersions(currentState.latestVersion, currentVersion()) > 0)) {
+        if (result.available) {
           const latestVersion = result.latestVersion || currentState.latestVersion;
           await setConsentState({ ...consent,
             ...(latestVersion !== consent.snoozedVersion ? { snoozedVersion: '', snoozedUntil: 0 } : {}),
@@ -188,22 +188,30 @@
           await setUpdateState({ ...currentState, state: 'update_available', operationId: operation.id,
             currentVersion: result.currentVersion || currentVersion(), latestVersion,
             managed: true, etag: result.etag || currentState.etag || '', lastCheckedAt: checkedAt,
-            postponeUntil: LEGACY_GUARD, code: '', message: '', cancelRequested: false
+            postponeUntil: LEGACY_GUARD, code: '', message: '', cooldownUntil: 0, manualReason: {}, cancelRequested: false
           }, { operation });
-        } else if (result.reason === 'manual_install_required'
-          && policy.compareStableVersions(result.latestVersion, currentVersion()) > 0) {
+        } else if ((result.reason === 'manual_install_required'
+          && policy.compareStableVersions(result.latestVersion, currentVersion()) > 0)
+          || (result.reason === 'prerelease_promotion_requires_manual_update'
+            && result.latestVersion === (result.currentVersion || currentVersion()))) {
           await setUpdateState({ ...currentState, state: 'manual_install_required', operationId: operation.id,
             currentVersion: result.currentVersion || currentVersion(), latestVersion: result.latestVersion,
             managed: true, etag: result.etag || currentState.etag || '', lastCheckedAt: checkedAt,
-            postponeUntil: LEGACY_GUARD, code: 'update_bootstrap_upgrade_required', message: '',
+            postponeUntil: LEGACY_GUARD, code: result.reason === 'prerelease_promotion_requires_manual_update'
+              ? result.reason : 'update_bootstrap_upgrade_required', message: '', cooldownUntil: 0,
             manualReason: result.manualInstall?.reason || {}, cancelRequested: false
           }, { operation });
         } else {
           await setUpdateState({ ...currentState, state: 'idle', operationId: operation.id,
             currentVersion: result.currentVersion || currentVersion(),
             latestVersion: result.latestVersion || result.currentVersion || currentVersion(),
-            etag: result.etag || currentState.etag || '', lastCheckedAt: checkedAt,
-            postponeUntil: LEGACY_GUARD, transactionId: '', code: '', message: '', cancelRequested: false
+            // A 304 without a verified Native candidate is a cache miss. Drop
+            // its validator so the next normal check can obtain fresh bytes.
+            etag: result.reason === 'not_modified' ? '' : result.etag || currentState.etag || '', lastCheckedAt: checkedAt,
+            postponeUntil: LEGACY_GUARD, transactionId: '',
+            code: result.reason === 'cooldown' ? 'update_cooldown' : '',
+            cooldownUntil: result.reason === 'cooldown' ? Number(result.cooldownUntil || 0) : 0,
+            manualReason: {}, message: '', cancelRequested: false
           }, { operation });
         }
         return getView();
@@ -557,6 +565,7 @@
   function reconcileRecoveryState() {
     if (recoveryPromise) return recoveryPromise;
     recoveryPromise = (async () => {
+      if (!await waitForBootstrapOwnership()) return getUpdateState();
       const state = await getUpdateState();
       if (state.recoveryPending) return reconcileExpiredPhase();
       if (state.cancelRequested) return postponeUpdate();
@@ -584,7 +593,9 @@
 
 
   async function reconcileExpiredPhase() {
-    const state = await getUpdateState();
+    const recoveryOwner = await captureRecoveryOwner();
+    const state = recoveryOwner.state;
+    const recoveryOptions = { observed: true, recoveryOwner };
     if (!state.recoveryPending && (!state.deadlineAt || Date.now() <= state.deadlineAt
       || policy.isTerminalState(state.state))) return state;
     if (['checking', 'downloading'].includes(state.state)) {
@@ -597,32 +608,38 @@
       try {
         let status = await withTimeout(requestNative('update.status'), 10000,
           codedError('update_status_timeout', 'Update recovery status is unavailable.'));
+        await assertRecoveryOwner(recoveryOwner);
         let transaction = status.transaction;
         if (state.transactionId && transaction?.id !== state.transactionId) {
           throw codedError('update_transaction_mismatch', 'The update recovery transaction could not be matched.');
         }
+        if (transaction?.state === 'superseded') {
+          return settleSupersededTransaction(status, recoveryOwner);
+        }
         if (transaction?.state === 'staged' || (!transaction && status.installedAligned
           && status.activeVersion === state.currentVersion)) {
           if (state.operationId) await requestNative('update.cancel', { operationId: state.operationId });
+          await assertRecoveryOwner(recoveryOwner);
           const consent = await getConsentState();
           const authorizationId = consent.authorizationId || consent.revokingAuthorizationId;
           const targetVersion = consent.authorizedVersion || consent.revokingVersion || state.latestVersion;
+          await assertRecoveryOwner(recoveryOwner);
           if (authorizationId) await requestNative('update.revoke', { authorizationId, targetVersion });
-          await setConsentState(revocation.clear({ ...consent,
-            authorizedVersion: '', authorizationId: '', authorizedAt: 0
-          }));
-          return setUpdateState({ state: 'failed', recoveryPending: false, cancelRequested: false,
+          const completed = await setUpdateAndConsentState({ state: 'failed', recoveryPending: false, cancelRequested: false,
             operationId: '', code: 'update_not_applied', message: 'The update was stopped before installation. Retry when ready.'
-          }, { observed: true });
+          }, revocation.clear({ ...consent, authorizedVersion: '', authorizationId: '', authorizedAt: 0 }), recoveryOptions);
+          return completed.updateState;
         }
         if (transaction?.state === 'awaiting_health') {
           const rolledBack = await requestNative('update.rollback', {
             transactionId: transaction.id, expectedState: 'awaiting_health', reasonCode: 'update_health_timeout'
           });
+          await assertRecoveryOwner(recoveryOwner);
           if (rolledBack.state !== 'rolled_back' || rolledBack.version !== transaction.sourceVersion) {
             throw codedError('update_rollback_unconfirmed', 'Rollback returned incomplete evidence.');
           }
           status = await requestNative('update.status');
+          await assertRecoveryOwner(recoveryOwner);
           transaction = status.transaction;
         }
         if (transaction?.state === 'committed' && status.installedAligned
@@ -630,7 +647,7 @@
           return setUpdateState({ state: 'committed', currentVersion: transaction.targetVersion,
             latestVersion: transaction.targetVersion, transactionId: transaction.id,
             recoveryPending: false, cancelRequested: false, code: '', message: ''
-          }, { observed: true });
+          }, recoveryOptions);
         }
         if (transaction?.state === 'rolled_back' && status.installedAligned
           && status.activeVersion === transaction.sourceVersion
@@ -638,22 +655,88 @@
           const restored = await setUpdateState({ state: 'rolled_back', currentVersion: transaction.sourceVersion,
             transactionId: transaction.id, recoveryPending: false, cancelRequested: false,
             code: transaction.reasonCode || 'update_rolled_back', message: 'The previous version has been restored.'
-          }, { observed: true });
+          }, recoveryOptions);
           setTimeout(() => chrome.runtime.reload(), 0);
           return restored;
         }
         throw codedError('update_recovery_pending', 'The installed update result has not been confirmed.');
       } catch (error) {
+        if (error.code === 'update_recovery_superseded') return getUpdateState();
         return setUpdateState({ state: 'failed', recoveryPending: true, cancelRequested: false,
           code: safeCode(error), message: safeMessage(error)
-        }, { observed: true });
+        }, recoveryOptions).catch(writeError => {
+          if (writeError.code === 'update_recovery_superseded') return getUpdateState();
+          throw writeError;
+        });
       }
     }
     return state;
   }
 
+  async function captureRecoveryOwner() {
+    const generation = operationGeneration;
+    const [state, consent] = await Promise.all([getUpdateState(), getConsentState()]);
+    return { generation, state, consent };
+  }
+
+  function matchesRecoveryOwner(owner, state, consent) {
+    return owner && owner.generation === operationGeneration
+      && ['state', 'transactionId', 'operationId', 'currentVersion', 'latestVersion',
+        'recoveryPending', 'cancelRequested', 'lastCheckedAt', 'phaseStartedAt']
+        .every(key => state[key] === owner.state[key])
+      && ['authorizationId', 'authorizedVersion', 'revokingAuthorizationId', 'revokingVersion']
+        .every(key => consent[key] === owner.consent[key]);
+  }
+
+  async function assertRecoveryOwner(owner) {
+    const [state, consent] = await Promise.all([getUpdateState(), getConsentState()]);
+    assertRecoverySnapshot(owner, state, consent);
+  }
+
+  function assertRecoverySnapshot(owner, state, consent) {
+    if (owner && !matchesRecoveryOwner(owner, state, consent)) {
+      throw codedError('update_recovery_superseded', 'A newer update state replaced this recovery request.');
+    }
+  }
+
+  // Both startup recovery and the coordinator retire the same Native journal
+  // through this queue. The snapshot was captured before requesting status.
+  function settleSupersededTransaction(status, owner) {
+    return enqueueStateWrite(async () => {
+      const [previous, consent] = await Promise.all([getUpdateState(), getConsentState()]);
+      if (!matchesRecoveryOwner(owner, previous, consent)) return previous;
+      const transaction = status?.transaction;
+      const sameTargetReinstall = transaction?.reasonCode === 'update_reinstalled'
+        && status.activeVersion === transaction.targetVersion
+        && status.reinstalledPair?.extensionVersion === status.activeVersion
+        && status.reinstalledPair?.nativeVersion === status.activeVersion
+        && /^[0-9a-f]{64}$/.test(status.reinstalledPair.extensionSha256 || '')
+        && /^[0-9a-f]{64}$/.test(status.reinstalledPair.nativeSha256 || '');
+      if (activeOperation || transaction?.state !== 'superseded' || !transaction.id
+        || (previous.transactionId && previous.transactionId !== transaction.id)
+        || status.installedAligned !== true || status.activeVersion !== transaction.supersededByVersion
+        || (!sameTargetReinstall && policy.compareStableVersions(status.activeVersion, transaction.targetVersion) <= 0)
+        || policy.compareStableVersions(status.activeVersion, transaction.sourceVersion) <= 0
+        || ['authorized', 'bound'].includes(status.authorization?.state)
+        || (consent.authorizedVersion && consent.authorizedVersion !== transaction.targetVersion)
+        || (consent.revokingVersion && consent.revokingVersion !== transaction.targetVersion)) return previous;
+      const next = projectUpdateState(previous, { state: 'idle', currentVersion: status.activeVersion,
+        latestVersion: status.activeVersion, transactionId: '', operationId: '', recoveryPending: false,
+        cancelRequested: false, blocker: '', blockers: [], code: '', message: '', manualReason: {}, cooldownUntil: 0
+      }, { observed: true });
+      // Invalidate older awaits before yielding to storage, including recovery
+      // responses that describe this same retired transaction.
+      operationGeneration += 1;
+      await chrome.storage.local.set({ [UPDATE_STATE_KEY]: next,
+        [CONSENT_STATE_KEY]: policy.normalizeConsentState({}), [UPDATE_RELOAD_TABS_KEY]: [] });
+      runtimeStatus = null;
+      return next;
+    });
+  }
+
 
   async function handleObservedStateChange() {
+    if (!await waitForBootstrapOwnership()) return;
     await settleTerminalConsent();
     const [state, consent] = await Promise.all([getUpdateState(), getConsentState()]);
     if (!consent.authorizationId && !policy.isExecutionState(state.state)) {
@@ -784,9 +867,11 @@
   function setUpdateState(value, options = {}) {
     return enqueueStateWrite(async () => {
       assertWriteOwner(options);
-      const stored = await chrome.storage.local.get(UPDATE_STATE_KEY);
+      const stored = await chrome.storage.local.get(options.recoveryOwner
+        ? [UPDATE_STATE_KEY, CONSENT_STATE_KEY] : UPDATE_STATE_KEY);
       assertWriteOwner(options);
       const previous = policy.normalizeUpdateState(stored?.[UPDATE_STATE_KEY], currentVersion());
+      assertRecoverySnapshot(options.recoveryOwner, previous, policy.normalizeConsentState(stored?.[CONSENT_STATE_KEY]));
       const next = projectUpdateState(previous, value, options);
       await chrome.storage.local.set({ [UPDATE_STATE_KEY]: next });
       return next;
@@ -844,6 +929,7 @@
       const stored = await chrome.storage.local.get([UPDATE_STATE_KEY, CONSENT_STATE_KEY]);
       assertWriteOwner(options);
       const previous = policy.normalizeUpdateState(stored?.[UPDATE_STATE_KEY], currentVersion());
+      assertRecoverySnapshot(options.recoveryOwner, previous, policy.normalizeConsentState(stored?.[CONSENT_STATE_KEY]));
       const updateState = projectUpdateState(previous, updateValue, options);
       const consentState = policy.normalizeConsentState(consentValue);
       await chrome.storage.local.set({ [UPDATE_STATE_KEY]: updateState, [CONSENT_STATE_KEY]: consentState });
@@ -869,12 +955,20 @@
 
   function enqueuePolicyAction(action) {
     const generation = operationGeneration;
-    const guarded = () => generation !== operationGeneration || cancellationPromise ? getView() : action();
+    const guarded = async () => !await waitForBootstrapOwnership()
+      || generation !== operationGeneration || cancellationPromise ? getView() : action();
     const result = policyTail.then(guarded, guarded);
     policyTail = result.catch(() => {});
     return result;
   }
 
+  async function waitForBootstrapOwnership() {
+    const migration = await root.CodexOverleafBootstrapMigration?.ready?.();
+    if (migration?.continueInitialization === false) return false;
+    await root.__CODEX_OVERLEAF_BOOTSTRAP_READY__;
+    return true;
+  }
+
   function beginOperation(id) {
     const operation = { id: id || crypto.randomUUID(), generation: ++operationGeneration, phase: 'checking' };
     activeOperation = operation;
@@ -894,6 +988,9 @@
   }
 
   function assertWriteOwner(options) {
+    if (options.recoveryOwner && options.recoveryOwner.generation !== operationGeneration) {
+      throw codedError('update_recovery_superseded', 'A newer update state replaced this recovery request.');
+    }
     if (options.operation) assertOperation(options.operation);
     if (options.generation !== undefined && options.generation !== operationGeneration) {
       throw codedError('update_network_cancelled', 'The update request was superseded.');
@@ -970,5 +1067,5 @@
       .slice(0, 300);
   }
 
-  root.CodexOverleafUpdateCoordinator = Object.freeze({ init });
+  root.CodexOverleafUpdateCoordinator = Object.freeze({ init, captureRecoveryOwner, settleSupersededTransaction });
 })(globalThis);

package/extension/src/backgroundUpdateSafety.js

@@ -0,0 +1,173 @@
+(function installBackgroundUpdateSafety(root) {
+  'use strict';
+  const blocked = () => ({ idle: false, saved: false, blockers: ['tab_probe_unavailable'] });
+  // Chrome storage serializes object keys independently of insertion order.
+  // Preserve every key/value and array position when comparing readback.
+  function sameStored(left, right) {
+    if (left === right) return true;
+    if (!left || !right || typeof left !== 'object' || typeof right !== 'object') return false;
+    if (Array.isArray(left) || Array.isArray(right)) {
+      return Array.isArray(left) && Array.isArray(right) && left.length === right.length
+        && left.every((value, index) => sameStored(value, right[index]));
+    }
+    const leftKeys = Object.keys(left), rightKeys = Object.keys(right);
+    return leftKeys.length === rightKeys.length
+      && leftKeys.every(key => Object.prototype.hasOwnProperty.call(right, key) && sameStored(left[key], right[key]));
+  }
+  function create(options) {
+    const bindings = new Map();
+    const tabsKey = 'codex-overleaf-managed-update-tabs-v1';
+    const guardKey = 'codex-overleaf-managed-update-guarded-tabs-v1';
+    async function ownerMatches(binding) {
+      if (!options.isExecutionLocked()) return false;
+      const response = await options.request({ id: crypto.randomUUID(), method: 'update.status',
+        params: { bootstrapRevision: String(root.__CODEX_OVERLEAF_BOOTSTRAP_REVISION__ || '') } });
+      const tx = response?.ok && response.result?.transaction;
+      return tx?.id === binding.transactionId && tx.targetVersion === binding.targetVersion
+        && tx.sourceVersion === binding.sourceVersion && tx.state === binding.expectedState;
+    }
+    async function snapshot(tabId, documentId) {
+      const results = await chrome.scripting.executeScript({ target: documentId ? { tabId, documentIds: [documentId] }
+        : { tabId, frameIds: [0] }, world: 'ISOLATED', func: () => ({ url: location.href }) });
+      const item = results?.length === 1 && results[0];
+      return item?.frameId === 0 && item.documentId && typeof item.result?.url === 'string'
+        ? { documentId: item.documentId, url: item.result.url } : null;
+    }
+    async function saveProbe(message, sender) {
+      const binding = bindings.get(sender?.tab?.id);
+      if (!binding || sender.id !== chrome.runtime.id || sender.frameId !== 0 || sender.documentId !== binding.documentId
+        || sender.url !== binding.url || message.token !== binding.token || message.transactionId !== binding.transactionId
+        || message.nonce !== binding.nonce || !await ownerMatches(binding)) return { ok: false };
+      const before = await snapshot(binding.tabId, binding.documentId);
+      if (before?.url !== binding.url) return { ok: false };
+      const results = await chrome.scripting.executeScript({ target: { tabId: binding.tabId, documentIds: [binding.documentId] },
+        world: 'MAIN', func: url => globalThis.CodexOverleafUpdateSafetyProbe?.probe(url), args: [binding.url] });
+      const after = await snapshot(binding.tabId, binding.documentId);
+      if (after?.url !== binding.url || message.nonce !== binding.nonce || !await ownerMatches(binding)
+        || results?.length !== 1 || results[0].documentId !== binding.documentId || results[0].frameId !== 0) return { ok: false };
+      return { ok: true, nonce: message.nonce, result: results[0].result };
+    }
+    chrome.runtime.onMessage.addListener((message, sender, respond) => {
+      if (message?.type !== 'codex-overleaf/migration-save-probe') return undefined;
+      saveProbe(message, sender).then(respond).catch(() => respond({ ok: false }));
+      return true;
+    });
+    async function probe(tab, owner) {
+      try {
+        const current = await snapshot(tab.id);
+        if (!current || current.url !== tab.url) return blocked();
+        let binding = bindings.get(tab.id);
+        if (binding && (binding.documentId !== current.documentId || binding.url !== current.url
+          || binding.transactionId !== owner.transactionId)) return blocked();
+        if (!binding) {
+          binding = { ...owner, ...current, tabId: tab.id, token: crypto.randomUUID(), nonce: '' };
+          if (!await ownerMatches(binding)) return blocked();
+          bindings.set(tab.id, binding);
+        }
+        binding.expectedState = owner.expectedState;
+        if (!binding.installed) {
+          const target = { tabId: tab.id, documentIds: [binding.documentId] };
+          await chrome.scripting.executeScript({ target, world: 'MAIN',
+            files: ['runtime/src/page/saveState.js', 'runtime/src/page/updateSafetyProbe.js'] });
+          await chrome.scripting.executeScript({ target, world: 'ISOLATED',
+            files: ['runtime/src/shared/pageRpcContract.js', 'runtime/src/content/updateIdle.js', 'runtime/src/content/updateSafetyReceiver.js'] });
+          const installed = await chrome.scripting.executeScript({ target, world: 'ISOLATED',
+            func: value => globalThis.CodexOverleafUpdateSafetyReceiver?.install(value, {
+              UpdateIdle: globalThis.CodexOverleafUpdateIdle, PageRpcContract: globalThis.CodexOverleafPageRpcContract
+            }), args: [binding] });
+          if (installed?.length !== 1 || installed[0].documentId !== binding.documentId
+            || installed[0].result?.ok !== true || installed[0].result.url !== binding.url) return blocked();
+          binding.installed = true;
+        }
+        if (!await ownerMatches(binding)) return blocked();
+        binding.nonce = crypto.randomUUID();
+        const nonce = binding.nonce;
+        let timer;
+        const response = await Promise.race([
+          chrome.tabs.sendMessage(tab.id, { type: 'codex-overleaf/migration-idle-probe', ...binding },
+            { documentId: binding.documentId }),
+          new Promise(resolve => { timer = setTimeout(() => resolve(null), 3500); })
+        ]).finally(() => clearTimeout(timer));
+        const after = await snapshot(tab.id, binding.documentId);
+        if (!response?.safetyOnly || response.token !== binding.token || response.transactionId !== binding.transactionId
+          || response.targetVersion !== binding.targetVersion || response.nonce !== nonce || response.url !== binding.url
+          || after?.url !== binding.url || !await ownerMatches(binding)) return blocked();
+        return response;
+      } catch (_) { return blocked(); }
+    }
+    async function protectReloadTabs(transaction) {
+      const owner = { transactionId: transaction.id, sourceVersion: transaction.sourceVersion,
+        targetVersion: transaction.targetVersion, expectedState: 'bootstrap_pending' };
+      if (!await ownerMatches(owner)) return false;
+      const stored = await chrome.storage.local.get([tabsKey, guardKey]);
+      if (stored[guardKey]?.transactionId === transaction.id && !stored[tabsKey]?.length) return true;
+      if (stored[guardKey]?.state === 'guarded' && stored[guardKey].transactionId !== transaction.id) {
+        const open = new Set((await chrome.tabs.query({})).map(tab => tab.id));
+        for (const entry of stored[guardKey].entries || []) {
+          if (!open.has(entry.tabId)) continue;
+          const current = await snapshot(entry.tabId).catch(() => null);
+          if (!entry.documentId || !current || current.documentId === entry.documentId) return false;
+        }
+      }
+      const entries = await Promise.all((stored[tabsKey] || []).map(async tabId => ({ tabId,
+        ...await snapshot(tabId).catch(() => null) })));
+      const guard = { transactionId: transaction.id, sourceVersion: transaction.sourceVersion,
+        targetVersion: transaction.targetVersion, state: 'guarded', entries };
+      const current = await chrome.storage.local.get([tabsKey, guardKey]);
+      if (!sameStored(current, stored) || !await ownerMatches(owner)) return false;
+      await chrome.storage.local.set({ [guardKey]: guard, [tabsKey]: [] });
+      const readback = await chrome.storage.local.get([tabsKey, guardKey]);
+      return sameStored(readback[guardKey], guard) && readback[tabsKey]?.length === 0;
+    }
+    async function releaseReloadTabs(transaction, expectedState = 'bootstrap_pending') {
+      const owner = { transactionId: transaction.id, sourceVersion: transaction.sourceVersion,
+        targetVersion: transaction.targetVersion, expectedState };
+      if (!await ownerMatches(owner)) return false;
+      const stored = await chrome.storage.local.get([tabsKey, guardKey]);
+      const guard = stored[guardKey];
+      if (guard?.transactionId !== transaction.id || guard.state !== 'guarded' || stored[tabsKey]?.length) return false;
+      const open = new Set((await chrome.tabs.query({})).map(tab => tab.id));
+      const ids = [];
+      for (const entry of guard.entries) {
+        if (!open.has(entry.tabId)) continue;
+        if (!entry.documentId || !entry.url) return false;
+        const current = await snapshot(entry.tabId, entry.documentId).catch(() => null);
+        if (current?.documentId !== entry.documentId || current?.url !== entry.url) return false;
+        ids.push(entry.tabId);
+      }
+      const again = await chrome.storage.local.get([tabsKey, guardKey]);
+      if (!sameStored(again[guardKey], guard) || again[tabsKey]?.length || !await ownerMatches(owner)) return false;
+      await chrome.storage.local.set({ [tabsKey]: ids, [guardKey]: { ...guard, state: 'ready' } });
+      return true;
+    }
+    async function revalidate(tabs, owner) {
+      if (!await ownerMatches(owner)) return false;
+      for (const tab of tabs) {
+        const binding = bindings.get(tab.id);
+        if (!binding || binding.transactionId !== owner.transactionId) continue;
+        if ((await probe(tab, owner)).idle !== true) return false;
+      }
+      return ownerMatches(owner);
+    }
+    async function hasReplacedReloadDocument(transaction) {
+      const owner = { transactionId: transaction.id, sourceVersion: transaction.sourceVersion,
+        targetVersion: transaction.targetVersion, expectedState: 'rolled_back' };
+      if (!await ownerMatches(owner)) return false;
+      const stored = await chrome.storage.local.get([tabsKey, guardKey]);
+      const guard = stored[guardKey];
+      if (guard?.transactionId !== transaction.id || guard.state !== 'guarded' || stored[tabsKey]?.length) return false;
+      const open = new Set((await chrome.tabs.query({})).map(tab => tab.id));
+      for (const entry of guard.entries) {
+        if (!open.has(entry.tabId) || !entry.documentId) continue;
+        const current = await snapshot(entry.tabId).catch(() => null);
+        if (current && current.documentId !== entry.documentId) {
+          const again = await chrome.storage.local.get([tabsKey, guardKey]);
+          return sameStored(again, stored) && await ownerMatches(owner);
+        }
+      }
+      return false;
+    }
+    return Object.freeze({ probe, protectReloadTabs, releaseReloadTabs, revalidate, hasReplacedReloadDocument });
+  }
+  root.CodexOverleafBackgroundUpdateSafety = Object.freeze({ create });
+})(globalThis);