codex-overleaf-link 2.5.0 → 2.6.0

package/extension/src/page/treeOperations.js

@@ -1564,15 +1564,6 @@
       };
     }
 
-    function fileTreeMethodNames(type) {
-      return {
-        create: ['createDoc', 'createFile', 'addDoc', 'addFile'],
-        rename: ['renameEntity', 'renameFile', 'renameDoc'],
-        move: ['moveEntity', 'moveFile', 'moveDoc'],
-        delete: ['deleteEntity', 'deleteFile', 'deleteDoc', 'removeEntity']
-      }[type] || [];
-    }
-
     function resolveTimeoutMs(options = {}, fallback) {
       const value = Number(options.timeoutMs);
       return Number.isFinite(value) && value >= 0 ? value : fallback;
@@ -1615,5 +1606,11 @@
     return text;
   }
 
-  return { create };
+  function fileTreeMethodNames(type) {
+    return {
+      create: ['createDoc', 'createFile', 'addDoc', 'addFile'], rename: ['renameEntity', 'renameFile', 'renameDoc'],
+      move: ['moveEntity', 'moveFile', 'moveDoc'], delete: ['deleteEntity', 'deleteFile', 'deleteDoc', 'removeEntity']
+    }[type] || [];
+  }
+  return { create, fileTreeMethodNames };
 });

package/extension/src/page/updateSafetyProbe.js

@@ -0,0 +1,41 @@
+(function installUpdateSafetyProbe(root) {
+  'use strict';
+  if (root.CodexOverleafUpdateSafetyProbe?.revision === '1') return;
+  const identities = new WeakMap();
+  function identity(value) {
+    if (!identities.has(value)) identities.set(value, crypto.randomUUID());
+    return identities.get(value);
+  }
+  // The same full CodeMirror document sources used by pageBridge. No DOM
+  // viewport text is eligible for the quiet-save fallback.
+  function editorView() {
+    const store = root.overleaf?.unstable?.store || root.Overleaf?.unstable?.store;
+    const get = key => { try { return store?.get?.(key) || {}; } catch (_) { return {}; } };
+    return [get('editor.view'), get('editor.view.camel'), get('editor').view,
+      root.overleaf?.unstable?.editorView, root.Overleaf?.editorView, root._ide?.editorView]
+      .find(value => value && typeof value.dispatch === 'function' && value.state?.doc
+        && typeof value.state.doc.toString === 'function') || null;
+  }
+  function fileIdentity() {
+    const store = root.overleaf?.unstable?.store || root.Overleaf?.unstable?.store;
+    const get = key => { try { return store?.get?.(key); } catch (_) { return ''; } };
+    const selected = document.querySelector('[role="treeitem"][aria-selected="true"] [data-file-id]');
+    return [get('editor.open_doc_id'), get('editor.openDocId'), root._ide?.editor?.open_doc_id,
+      root._ide?.editor?.openDocId, selected?.getAttribute('data-file-id'),
+      get('editor.open_doc_name'), get('editor.openDocName')].find(value => typeof value === 'string' && value) || '';
+  }
+  async function probe(expectedUrl) {
+    const view = editorView(), doc = view?.state?.doc, file = fileIdentity();
+    if (location.href !== expectedUrl || !file || !root.CodexOverleafSaveState) return { ok: false, state: 'unavailable' };
+    const save = root.CodexOverleafSaveState.create({ window: root, document,
+      delay: ms => new Promise(resolve => setTimeout(resolve, ms)),
+      detectEditor: () => ({ ok: Boolean(view && editorView() === view && view.state.doc === doc) }),
+      getActiveFilePath: () => doc ? identity(doc) : '', readActiveEditorText: () => view?.state.doc.toString() || '' });
+    const result = await save.waitForSaveState({ deadlineMs: 1500, pollIntervalMs: 100,
+      requirePositiveSignal: true, allowQuietEditorFallback: Boolean(doc), quietFallbackMs: 1000 });
+    if (location.href !== expectedUrl || fileIdentity() !== file || editorView() !== view
+      || (view && view.state.doc !== doc)) return { ok: false, state: 'unavailable' };
+    return { ok: result.ok === true, state: result.state, identity: file + ':' + (doc ? identity(doc) : 'positive-save-signal') };
+  }
+  root.CodexOverleafUpdateSafetyProbe = Object.freeze({ revision: '1', probe });
+})(globalThis);

package/extension/src/page/writebackReceiptJournal.js

@@ -87,8 +87,10 @@
         return applyOperations(params.operations || [], {
           baseFiles: params.baseFiles || null,
           reviewingPolicy: params.reviewingPolicy || '',
+          ...(params.reviewOwnerToken ? { reviewOwnerToken: params.reviewOwnerToken } : {}),
           requireReviewing: params.requireReviewing === true,
           requireEditing: params.requireEditing === true,
+          retryCreates: params.retryCreates === true,
           runProjectId: projectId,
           ...(params.deadlineAt == null ? {} : { deadlineAt: params.deadlineAt }),
           onOperationResult

package/extension/src/page/writebackRouter.js

@@ -1,11 +1,12 @@
 (function initCodexOverleafWritebackRouter(root, factory) {
   if (typeof module === 'object' && module.exports) {
-    module.exports = factory();
+    module.exports = factory(require('./treeOperations'));
   } else {
-    root.CodexOverleafWritebackRouter = factory();
+    root.CodexOverleafWritebackRouter = factory(root.CodexOverleafTreeOperations);
   }
-})(typeof window !== 'undefined' ? window : globalThis, function writebackRouterFactory() {
+})(typeof window !== 'undefined' ? window : globalThis, function writebackRouterFactory(TreeOperations) {
   'use strict';
+  const { fileTreeMethodNames } = TreeOperations;
 
   function create(deps = {}) {
     const window = deps.window || (typeof globalThis !== 'undefined' ? globalThis : {});
@@ -358,18 +359,20 @@
 
   async function applyOperations(operations, options = {}) {
     if (options.reviewingPolicy === 'no-trace-undo') {
-      return applyOperationsWithNoTraceUndo(operations, options);
+      const Context = window.CodexOverleafReviewContext || (typeof module === 'object' && module.exports ? require('./reviewContext') : null);
+      return Context.create({ window, now, readWriteCancellationSequence, getProjectId: () => treeOperations.getProjectId?.() }, options).run(
+        (scoped, input) => applyOperationsWithNoTraceUndo(operations, { ...input, reviewGuard: scoped.reviewGuard, reviewAwait: scoped.reviewAwait }));
     }
     const hasOperations = (operations || []).length > 0;
     const trackReviewingChanges = options.requireReviewing === true && hasOperations;
     let reviewingPolicy = null;
     if (options.requireReviewing === true && hasOperations) {
-      const reviewing = await ensureReviewing({ waitMs: 1800 });
+      const reviewing = await ensureReviewing({ waitMs: 1800, runProjectId: options.runProjectId });
       if (!reviewing.ok) {
         return buildReviewingRequiredBlockedResult(operations, reviewing);
       }
     } else if (options.requireEditing === true && hasOperations) {
-      const editing = await ensureEditing({ waitMs: 1800 });
+      const editing = await ensureEditing({ waitMs: 1800, runProjectId: options.runProjectId });
       if (!editing.ok) {
         return buildEditingRequiredBlockedResult(operations, editing);
       }
@@ -388,6 +391,7 @@
     }
     const result = await applyOperationsCore(operations, {
       ...options,
+      noTraceUndo: false,
       trackReviewingChanges
     });
     return reviewingPolicy
@@ -398,10 +402,12 @@
       : result;
   }
 
-  async function confirmNoTraceUndoEditing() {
+  async function confirmNoTraceUndoEditing(options = {}) {
     let changed = false;
     let toggle = { ok: true, changed: false, enabled: false };
     for (let attempt = 0; attempt < 2; attempt++) {
+      const blocked = options.reviewGuard?.();
+      if (blocked) return blocked;
       if (!isEditingConfirmedForNoTraceUndo(getReviewingState({}))) {
         toggle = await setReviewingEnabled(false, { waitMs: 1800 });
         if (!toggle.ok && (!['editing_not_confirmed', 'reviewing_disable_failed'].includes(toggle.code)
@@ -418,8 +424,13 @@
       reason: 'Overleaf Editing mode did not remain confirmed before undo; no undo write was started.' };
   }
 
+  async function awaitReview(options, work) {
+    try { return options.reviewAwait ? await options.reviewAwait(work) : await work(); }
+    catch (error) { if (error?.reviewFailure) return error.reviewFailure; throw error; }
+  }
+
   async function applyOperationsWithNoTraceUndo(operations, options = {}) {
-    const disabled = await confirmNoTraceUndoEditing();
+    const disabled = await awaitReview(options, () => confirmNoTraceUndoEditing(options));
     if (!disabled.ok) return buildNoTraceUndoBlockedResult(operations, disabled);
     const result = await applyOperationsCore(operations, {
       ...options, noTraceUndo: true, trackReviewingChanges: false
@@ -441,13 +452,7 @@
     const safeBaseFiles = normalizeBaseFilesForSafety(options.baseFiles);
     const baseFileLookup = window.CodexOverleafStaleGuard?.buildBaseFileLookup(safeBaseFiles);
     const baseBinaryFileLookup = buildBaseBinaryFileLookup(safeBaseFiles);
-    // Mid-run project-change guard. The pageBridge wrapper already ran the
-    // writeGuard once at entry, but each per-op step here can take 0.5-5s
-    // (openFileByPath, waitForActiveEditorText, save-state verification),
-    // so a multi-op write can span 10-30 seconds total. If the user SPA-
-    // navigates to a different project mid-flight, the remaining operations
-    // would land in the wrong project. Re-check the editor project before
-    // each op and short-circuit the rest of the queue when it diverges.
+    // Recheck project identity between awaited operations and before each write.
     const runProjectId = typeof options.runProjectId === 'string' ? options.runProjectId : '';
     const writeGuardSurface = window.CodexOverleafWriteGuard?.create({
       window,
@@ -478,13 +483,17 @@
       ? await deps.beginTextCreateBatch(createCandidates, { isCurrent: () =>
         treeOperations.getProjectId?.() === runProjectId && readWriteCancellationSequence() === cancelBaselineSequence }) : null;
     const deferredCreates = [];
+    let haltRemainingOperations = false;
+    const skipTail = (operation, result) => operations.slice(operations.indexOf(operation) + 1)
+      .forEach(tail => skipped.push({ operation: normalizeOperationPaths(tail), result }));
     const reopenQueue = [];
     const deadlineFailure = () => Number.isFinite(options.deadlineAt) && now() >= options.deadlineAt
       ? { ok: false, code: 'writeback_deadline_exceeded', changedDocument: false,
         reason: 'The undo time budget expired before this operation could start.' } : null;
-    const editOptions = () => ({ baseFileLookup, runProjectId,
+    const editOptions = () => ({ baseFileLookup, runProjectId, deadlineAt: options.deadlineAt,
+      reviewGuard: options.reviewGuard, reviewAwait: options.reviewAwait,
       recheckWriteProject: writeGuardSurface ? () => {
-        const expired = deadlineFailure();
+        const expired = options.reviewGuard?.() || deadlineFailure();
         return expired ? { applied: [], skipped: [{ operation: {}, result: expired }] }
           : writeGuardSurface.runWriteGuard({ runProjectId });
       } : null,
@@ -499,13 +508,15 @@
     };
 
     for (const rawOperation of operations) {
+      const reviewBlock = options.reviewGuard?.();
+      if (reviewBlock) {
+        skipped.push({ operation: normalizeOperationPaths(rawOperation), result: reviewBlock });
+        skipTail(rawOperation, reviewBlock); break;
+      }
       // Stop undispatched work when cancellation arrives during an awaited operation.
       if (readWriteCancellationSequence() !== cancelBaselineSequence) {
         skipped.push({ operation: normalizeOperationPaths(rawOperation), result: cancelledSkipResult });
-        const remainingForCancel = operations.slice(operations.indexOf(rawOperation) + 1);
-        for (const tailOperation of remainingForCancel) {
-          skipped.push({ operation: normalizeOperationPaths(tailOperation), result: cancelledSkipResult });
-        }
+        skipTail(rawOperation, cancelledSkipResult);
         break;
       }
       // Re-check project ownership before this operation and preserve every skipped tail entry.
@@ -515,10 +526,7 @@
           // Keep the current path and the remaining operations attributable.
           const guardFailure = guardBlock.skipped[0].result;
           skipped.push({ operation: normalizeOperationPaths(rawOperation), result: guardFailure });
-          const remaining = operations.slice(operations.indexOf(rawOperation) + 1);
-          for (const tailOperation of remaining) {
-            skipped.push({ operation: normalizeOperationPaths(tailOperation), result: guardFailure });
-          }
+          skipTail(rawOperation, guardFailure);
           break;
         }
       }
@@ -538,7 +546,7 @@
       } else if (['binary-create', 'overwrite-binary'].includes(operation.type)) {
         result = await applyBinaryAssetOperation(operation, { baseFileLookup, baseBinaryFileLookup });
       } else if (['create', 'rename', 'move', 'delete'].includes(operation.type)) {
-        result = await applyFileTreeOperation(operation, { baseFileLookup, runProjectId, deadlineAt: options.deadlineAt,
+        result = await applyFileTreeOperation(operation, { baseFileLookup, runProjectId, deadlineAt: options.deadlineAt, reviewGuard: options.reviewGuard, noTraceUndo: options.noTraceUndo === true,
           createBatch: createBatch?.targets.has(operation.path) ? createBatch : null,
           retryCreates: options.retryCreates === true });
       } else {
@@ -557,16 +565,21 @@
         continue;
       }
       record(operation, result);
+      if (operation.type === 'move' && operation.moveProof && !result.ok) {
+        haltRemainingOperations = true;
+        skipTail(rawOperation, { ok: false, code: 'file_plan_not_completed', changedDocument: false,
+          reason: 'The file move did not finish; the remaining file plan was not started.' }); break;
+      }
     }
 
     // A file that could not be opened mid-batch usually opens once the
     // previous document has settled: give untouched open failures one pass.
-    if (reopenQueue.length && readWriteCancellationSequence() === cancelBaselineSequence
+    if (!haltRemainingOperations && reopenQueue.length && readWriteCancellationSequence() === cancelBaselineSequence
       && !skipped.some(entry => entry.result?.code === 'aborted_project_changed')) {
       await delay(deps.reopenRetryDelayMs ?? 1200);
     }
     for (const entry of reopenQueue) {
-      const blocked = readWriteCancellationSequence() !== cancelBaselineSequence
+      const blocked = options.reviewGuard?.() || haltRemainingOperations || readWriteCancellationSequence() !== cancelBaselineSequence
         || skipped.some(item => item.result?.code === 'aborted_project_changed')
         || Boolean(runProjectId && writeGuardSurface && await writeGuardSurface.runWriteGuard({ runProjectId }));
       const result = blocked ? entry.result : await applyEditOperation(entry.operation, editOptions());
@@ -589,25 +602,26 @@
       ok: skipped.length === 0,
       applied,
       skipped,
+      ...(haltRemainingOperations ? { haltRemainingOperations: true } : {}),
       trackedChanges: trackedChangeCaptures.some(capture => capture.state !== 'observed') ? [] : mergeTrackedChangeRefs(trackedChanges),
       trackedChangeCaptures
     };
   }
 
-  function isUntouchedOpenFailure(result) {
-    return result?.ok === false && result.failure?.code === 'target_file_open_failed'
-      && result.failure.changedDocument === false;
-  }
+  const isUntouchedOpenFailure = result => result?.ok === false && result.failure?.code === 'target_file_open_failed'
+    && result.failure.changedDocument === false;
 
   async function applyEditOperation(operation, options = {}) {
+    const reviewBlock = options.reviewGuard?.();
+    if (reviewBlock) return reviewBlock;
     const currentPath = getActiveFilePath();
-    const editorReady = await ensureEditorReadyForOperation(operation, options.baseFileLookup, currentPath);
+    const editorReady = await awaitReview(options, () => ensureEditorReadyForOperation(operation, options.baseFileLookup, currentPath));
     if (!editorReady.ok) {
       return editorReady;
     }
 
     if (options.noTraceUndo === true) {
-      const editing = await confirmNoTraceUndoEditing();
+      const editing = await awaitReview(options, () => confirmNoTraceUndoEditing(options));
       if (!editing.ok) return buildNoTraceUndoBlockedResult([operation], editing).skipped[0].result;
     }
     const trackReviewingChanges = options.trackReviewingChanges === true;
@@ -625,7 +639,8 @@
       options.baseFileLookup
     ) || { ok: true };
     if (!freshness.ok) {
-      const ready = await waitForFreshEditorTextForOperation(operation, options.baseFileLookup, 1500);
+      const ready = await awaitReview(options, () => waitForFreshEditorTextForOperation(operation, options.baseFileLookup, 1500));
+      if (options.reviewGuard?.()) return options.reviewGuard();
       if (!ready.ok) {
         const decorated = attachWritebackDebug(freshness, 'stale_guard', operation, options.baseFileLookup, current, {
           initialActivePath: currentPath,
@@ -661,12 +676,15 @@
         return decorated;
       }
       current = ready.text;
-      freshness = { ok: true };
+      freshness = ready.freshness;
     }
 
     let nextContent = null;
+    let preparedPatches;
     if (Array.isArray(operation.patches) && operation.patches.length) {
-      const patched = applyTextPatches(current, operation.patches);
+      preparedPatches = freshness.preparedPatches || window.CodexOverleafStaleGuard?.prepareOperationPatches(operation, current, options.baseFileLookup)
+        || { ok: true, patches: operation.patches };
+      const patched = preparedPatches.ok ? applyTextPatches(current, preparedPatches.patches) : preparedPatches;
       if (!patched.ok) {
         const decorated = attachWritebackDebug(patched, 'apply_text_patches', operation, options.baseFileLookup, current, {
           initialActivePath: currentPath,
@@ -718,25 +736,31 @@
             operationType: 'undo', changedDocument: false,
             userMessage: 'The project identity guard is unavailable; the undo write was not applied.' }) };
       if (blocked) return blocked.skipped?.[0]?.result || blocked;
-      if (getActiveFilePath() !== operation.path || readActiveEditorText() !== current) {
-        const reason = 'The editor changed while confirming Editing mode; the undo write was not applied.';
-        return { ok: false, code: 'stale_source_changed', reason,
-          failure: buildPageFailure('stale_source_changed', { file: operation.path,
-            operationType: 'undo', changedDocument: false, userMessage: reason }) };
-      }
       if (!isEditingConfirmedForNoTraceUndo(getReviewingState({})))
         return buildNoTraceUndoBlockedResult([operation], { ok: false, code: 'editing_not_confirmed',
           reason: 'Overleaf left Editing mode before the undo write.' }).skipped[0].result;
     }
 
+    const finalReviewBlock = options.reviewGuard?.();
+    if (finalReviewBlock) return finalReviewBlock;
+    // Read and dispatch synchronously against the same document. Navigation,
+    // freshness polling and Undo mode/project checks can all have awaited.
+    if (getActiveFilePath() !== operation.path || readActiveEditorText() !== current) {
+      const reason = 'The editor changed before the edit could be applied; the document was not overwritten.';
+      return { ok: false, code: 'stale_source_changed', reason,
+        failure: buildPageFailure('stale_source_changed', { file: operation.path,
+          operationType: options.noTraceUndo ? 'undo' : 'edit', changedDocument: false, userMessage: reason }) };
+    }
     const result = Array.isArray(operation.patches) && operation.patches.length
-      ? replaceActiveEditorPatches(operation.patches, nextContent)
+      ? replaceActiveEditorPatches(preparedPatches.patches, nextContent)
       : replaceActiveEditorText(nextContent);
     if (!result.ok) {
       return result;
     }
 
-    const verified = await verifyActiveEditorText(nextContent, operation.path, deps.writeVerifyWaitMs ?? 2500, current);
+    const verifyWaitMs = Math.min(deps.writeVerifyWaitMs ?? 2500, Number.isFinite(options.deadlineAt)
+      ? Math.max(0, options.deadlineAt - now()) : Infinity);
+    const verified = await verifyActiveEditorText(nextContent, operation.path, verifyWaitMs, current);
     if (!verified.ok) {
       const decorated = attachWritebackDebug(verified, 'write_verification', operation, options.baseFileLookup, readActiveEditorText(), {
         initialActivePath: currentPath,
@@ -776,7 +800,7 @@
       // Slow batches are covered by request receipts; Accept replay retains
       // its independent safety window proving that no new tracking was added.
       const trackedDiff = trackReviewingChanges
-        ? await captureTrackedWrite({ trackedBefore, captureBaseline, operation, beforeContent: current,
+        ? await captureTrackedWrite({ trackedBefore, captureBaseline, operation: { ...operation, patches: preparedPatches?.patches }, beforeContent: current,
           postContent: nextContent, runProjectId: options.runProjectId, waitMs: deps.trackCaptureWaitMs ?? 35000 })
         : await waitForTrackedChangeDiff(trackedBefore, operationPaths, {
           waitMs: 3600, intervalMs: 180, stopOnFirst: true
@@ -805,6 +829,7 @@
           }),
           verified: true,
           verifiedContent: nextContent,
+          ...(preparedPatches ? { appliedPatches: preparedPatches.patches } : {}),
           trackedChanges: mergeTrackedChangeRefs(trackedChanges)
         };
       }
@@ -812,18 +837,18 @@
     window.CodexOverleafStaleGuard?.updateExpectedFileContent(
       options.baseFileLookup,
       operation.path,
-      nextContent
+      preparedPatches?.sourceContent ?? nextContent
     );
     return {
       ...result,
       verified: true,
       verifiedContent: nextContent,
+      ...(preparedPatches ? { appliedPatches: preparedPatches.patches } : {}),
       trackedChangeCapture,
       trackedChanges: mergeTrackedChangeRefs(trackedChanges)
     };
   }
 
-
   async function verifyActiveEditorText(expected, filePath, waitMs = 1000, before) {
     const deadline = Date.now() + waitMs;
     let actual = readActiveEditorText();
@@ -949,35 +974,17 @@
       lastText = readActiveEditorText();
       const activeFileMatches = lastActivePath === filePath;
       const identityChanged = Boolean(previousEditorIdentity) && activeEditorIdentityChanged(previousEditorIdentity);
-      const baseComparison = compareEditorTextToBase(filePath, lastText, baseFileLookup);
-      const baseMatches = baseComparison.matches;
       const settledLongEnough = Date.now() - startedAt >= minSettleMs;
       const contentChangedFromPrevious = !options.previousSignature
         || contentSignature(lastText) !== options.previousSignature;
-      // Switch confirmation must not depend on any single fragile signal
-      // (v1.6: identity comparison proved unreliable against newer Overleaf
-      // view lifecycles, which made every write to a non-active file time
-      // out as target_editor_not_ready). Acceptors, strongest first:
-      //   1. editor identity visibly changed (fast path when it works);
-      //   2. the editor shows EXACTLY the target file's expected base —
-      //      the strongest possible proof the right document is loaded;
-      //   3. same-file reopen settled with unchanged content;
-      //   4. base UNKNOWN only: the content moved off the previous document
-      //      and the settle window elapsed. When the base IS known, content
-      //      must match it (acceptor 2) — a weakly-anchored patch (e.g. an
-      //      insert into an empty file, expected:'') would otherwise anchor
-      //      trivially into a wrong-but-different document.
+      // Confirm navigation independently of source freshness. A stale target
+      // can be correctly open; identical baseline bytes alone cannot prove a
+      // switch. Content movement remains the fallback for editor lifecycles
+      // whose document identity cannot be observed reliably.
       const switchConfirmed = identityChanged
-        || baseMatches
-        || (options.initialActivePath === filePath
-          && options.previousSignature
-          && contentSignature(lastText) === options.previousSignature
-          && settledLongEnough)
-        || (!baseComparison.known && contentChangedFromPrevious && settledLongEnough);
-      const contentNoLongerLooksLikePreviousDocument = contentChangedFromPrevious
-        || baseMatches
-        || options.initialActivePath === filePath;
-      if (activeFileMatches && switchConfirmed && settledLongEnough && contentNoLongerLooksLikePreviousDocument) {
+        || options.initialActivePath === filePath
+        || (contentChangedFromPrevious && settledLongEnough);
+      if (activeFileMatches && switchConfirmed && settledLongEnough) {
         return {
           ok: true,
           text: lastText
@@ -1053,47 +1060,6 @@
     };
   }
 
-  function editorContentMatchesBase(filePath, content, baseFileLookup) {
-    return compareEditorTextToBase(filePath, content, baseFileLookup).matches;
-  }
-
-  function compareEditorTextToBase(filePath, content, baseFileLookup) {
-    const normalizedPath = normalizeSafeProjectPath(filePath);
-    const current = normalizeEditorTextForComparison(content);
-    if (!baseFileLookup || !normalizedPath || !baseFileLookup.has(normalizedPath)) {
-      return {
-        known: false,
-        hasContent: false,
-        matches: false,
-        baseLength: null,
-        currentLength: current.length
-      };
-    }
-    const base = normalizeEditorTextForComparison(baseFileLookup.get(normalizedPath));
-    const matches = current === base;
-    if (!matches && base.trim().length > 0) {
-      console.warn('[codex-overleaf] editorContentMatchesBase MISMATCH', filePath,
-        'base.length:', base.length, 'current.length:', current.length,
-        'base[0..80]:', JSON.stringify(base.slice(0, 80)),
-        'current[0..80]:', JSON.stringify(current.slice(0, 80)));
-    }
-    return {
-      known: true,
-      hasContent: base.trim().length > 0,
-      matches,
-      baseLength: base.length,
-      currentLength: current.length
-    };
-  }
-
-  function hasBaseFileContent(filePath, baseFileLookup) {
-    if (!baseFileLookup || !filePath || !baseFileLookup.has(filePath)) {
-      return false;
-    }
-    const content = baseFileLookup.get(filePath);
-    return typeof content === 'string' && content.trim().length > 0;
-  }
-
   function normalizeEditorTextForComparison(value) {
     const normalized = String(value ?? '').replace(/\r\n/g, '\n');
     return normalized.trim().length === 0 ? '' : normalized;
@@ -1115,7 +1081,8 @@
       if (freshness.ok) {
         return {
           ok: true,
-          text
+          text,
+          freshness
         };
       }
       await delay(60);
@@ -1149,7 +1116,6 @@
     };
   }
 
-
   async function applyBinaryAssetOperation(operation, options = {}) {
     const freshness = await checkBinaryAssetFreshness(operation, options);
     if (!freshness.ok) {
@@ -1319,9 +1285,7 @@
     return baseFile.size == null || currentSize == null || baseFile.size === currentSize;
   }
 
-  function normalizeBase64(value) {
-    return String(value || '').replace(/\s+/g, '');
-  }
+  const normalizeBase64 = value => String(value || '').replace(/\s+/g, '');
 
   function decodeBase64Bytes(contentBase64) {
     try {
@@ -1372,6 +1336,17 @@
     }
     const initialProjectId = treeOperations.getProjectId?.();
     const initialCancellationSequence = readWriteCancellationSequence();
+    if (operation.type === 'move' && operation.moveProof) {
+      if (options.noTraceUndo !== true) return { ok: false, code: 'file_tree_controls_unavailable', changedDocument: false,
+        reason: 'Native file moves are available only to undo a previously recorded move.' };
+      if (typeof deps.moveFile !== 'function') return { ok: false, code: 'file_move_unavailable', changedDocument: false,
+        reason: 'Verified native file moves are unavailable. Reload the extension and Overleaf.' };
+      const result = await deps.moveFile(operation, { noTraceUndo: true, runProjectId: options.runProjectId, deadlineAt: options.deadlineAt,
+        isCurrent: () => treeOperations.getProjectId?.() === initialProjectId
+          && readWriteCancellationSequence() === initialCancellationSequence && !options.reviewGuard?.() });
+      if (result.ok) recordFileTreeOperationSuccess(operation, options.baseFileLookup);
+      return result;
+    }
     if (operation.type === 'create' && options.createBatch && typeof deps.createTextFile === 'function') {
       if (options.baseFileLookup?.has(operation.path) && options.retryCreates !== true) {
         return checkFileTreeOperationFreshness(operation, options.baseFileLookup);
@@ -1379,13 +1354,14 @@
       return deps.createTextFile(operation, { batch: options.createBatch,
         allowExistingMatches: options.retryCreates === true,
         isCurrent: () => treeOperations.getProjectId?.() === initialProjectId
-          && readWriteCancellationSequence() === initialCancellationSequence });
+          && readWriteCancellationSequence() === initialCancellationSequence && !options.reviewGuard?.() });
     }
     const freshness = await checkFileTreeOperationFreshness(operation, options.baseFileLookup);
     if (!freshness.ok) {
       return freshness;
     }
 
+    const ownerBlocked = options.reviewGuard?.(); if (ownerBlocked) return ownerBlocked;
     const manager = findFileTreeManager();
     const methodNames = fileTreeMethodNames(operation.type);
 
@@ -1432,7 +1408,7 @@
     const nativeOperation = { create: deps.createTextFile, delete: deps.deleteTextFile }[operation.type];
     if (typeof nativeOperation === 'function' && (operation.type === 'delete' || typeof operation.content === 'string')) {
       const isCurrent = () => Boolean(initialProjectId) && treeOperations.getProjectId?.() === initialProjectId
-        && readWriteCancellationSequence() === initialCancellationSequence;
+        && readWriteCancellationSequence() === initialCancellationSequence && !options.reviewGuard?.();
       const created = await nativeOperation(operation, { isCurrent, expectedContent: options.baseFileLookup?.get(operation.path) });
       if (!created.ok) return created;
       if (!isCurrent() || created.verified !== true || created.verification !== 'overleaf-zip') {
@@ -1456,7 +1432,7 @@
     const text = proof?.v === 1 && proof.kind === 'text' && typeof expected === 'string';
     const binary = proof?.v === 1 && proof.kind === 'binary' && /^[a-f0-9]{64}$/i.test(proof.sha256 || '');
     const isCurrent = () => Boolean(projectId) && projectId === options.runProjectId
-      && treeOperations.getProjectId?.() === projectId && readWriteCancellationSequence() === cancellation;
+      && treeOperations.getProjectId?.() === projectId && readWriteCancellationSequence() === cancellation && !options.reviewGuard?.();
     if (!isCurrent() || (!text && !binary) || typeof deps.deleteTextFile !== 'function') {
       return { ok: false, code: 'undo_operation_failed', changedDocument: false,
         reason: 'Verified created-file deletion is unavailable for this run.' };
@@ -1653,15 +1629,6 @@
     }
   }
 
-  function fileTreeMethodNames(type) {
-    return {
-      create: ['createDoc', 'createFile', 'addDoc', 'addFile'],
-      rename: ['renameEntity', 'renameFile', 'renameDoc'],
-      move: ['moveEntity', 'moveFile', 'moveDoc'],
-      delete: ['deleteEntity', 'deleteFile', 'deleteDoc', 'removeEntity']
-    }[type] || [];
-  }
-
   function normalizeOperationPaths(operation) {
     if (!operation || typeof operation !== 'object') {
       return operation;
@@ -1734,10 +1701,6 @@
   }
 
 
-
-
-
-
   function normalizeTrackedChangeRefs(refs = []) {
     const seen = new Set();
     const normalized = [];
@@ -1796,23 +1759,12 @@
 
     async function applyOperationsForBridge(operationsOrOptions, options = {}) {
       if (Array.isArray(operationsOrOptions)) {
-        // Welcome-panel + write-guard: defense-in-depth
-        // also runs on the array-shaped entry. T2 only guarded the
-        // payload-object branch; if any future caller goes straight to the
-        // array entry without `options.runProjectId`, the router would have
-        // silently dispatched. Mirror the same `editor_project_id_unavailable`
-        // failure shape the payload branch and the page-side guard already
-        // emit.
+        // Both public call shapes require the original project identity.
         const writeGuardBlock = checkWritebackRunProjectId(options);
         if (writeGuardBlock) return writeGuardBlock;
         return applyOperations(operationsOrOptions, options);
       }
       const payload = operationsOrOptions || {};
-      // Welcome-panel + write-guard: defense-in-depth.
-      // The pageBridge wrapper already runs the runProjectId guard, but a
-      // future caller could reach the router directly. A missing or empty
-      // `runProjectId` on the payload-shaped call blocks the write with the
-      // same `editor_project_id_unavailable` shape the page-side guard uses.
       const writeGuardBlock = checkWritebackRunProjectId(payload);
       if (writeGuardBlock) return writeGuardBlock;
       return applyOperations(payload.operations || [], payload);
@@ -1821,10 +1773,7 @@
     function checkWritebackRunProjectId(params) {
       const runProjectId = params && typeof params.runProjectId === 'string' ? params.runProjectId : '';
       if (runProjectId) return null;
-      // operation: {} (not null) — batch-level guard fired before any per-op
-      // dispatch; matches the abortDispatchResult shape in pageBridge.js and
-      // avoids crashing downstream audit / transcript code that reads
-      // operation.path without a null guard.
+      // Keep operation.path safe for downstream readers of batch-level failures.
       return {
         ok: false,
         applied: [],
@@ -1892,6 +1841,7 @@
           ok: false,
           code: reviewing?.code || 'reviewing_not_enabled',
           reason: reviewing?.reason || 'Overleaf Reviewing/Track Changes was not confirmed before writing. Codex did not change this file.',
+          evidence: reviewing?.evidence, failure: reviewing?.failure,
           reviewing: reviewing?.reviewing || null
         }
       })),
@@ -1916,9 +1866,7 @@
     };
   }
 
-    // Tracked-changes lifecycle — carved to trackedChangesLifecycle.js in
-    // v1.8.0 (structural-debt phase 7, #117). Loaded just before this file
-    // in the manifest's page-script list; the Node test path requires it.
+    // Tracked lifecycle is loaded by the Page script list or required by Node tests.
     const trackedChangesLifecycleModule = (typeof window !== 'undefined' && window.CodexOverleafTrackedChangesLifecycle)
       || (typeof module === 'object' && module.exports ? require('./trackedChangesLifecycle.js') : null)
       || (typeof globalThis !== 'undefined' ? globalThis.CodexOverleafTrackedChangesLifecycle : null);
@@ -1930,7 +1878,7 @@
       captureTrackedWrite, reconcileTrackedChangeCapture,
       waitForTrackedChangeDiff
     } = trackedChangesLifecycleModule.create({
-      window, confirmReviewWriteback: deps.confirmReviewWriteback,
+      window, now, readWriteCancellationSequence, confirmReviewWriteback: deps.confirmReviewWriteback,
       checkWritebackRunProjectId,
       buildNoTraceUndoBlockedResult,
       buildReviewingRequiredBlockedResult,