codex-overleaf-link 2.5.0 → 2.6.0

package/extension/src/shared/undoOperations.js

@@ -1,13 +1,48 @@
 (function initUndoOperations(root, factory) {
   if (typeof module === 'object' && module.exports) {
-    module.exports = factory();
+    module.exports = factory(require('./staleGuard'));
   } else {
-    root.CodexOverleafUndoOperations = factory();
+    root.CodexOverleafUndoOperations = factory(root.CodexOverleafStaleGuard);
   }
-})(typeof globalThis !== 'undefined' ? globalThis : window, function undoOperationsFactory() {
+})(typeof globalThis !== 'undefined' ? globalThis : window, function undoOperationsFactory(StaleGuard) {
   'use strict';
 
   function buildUndoOperations(project, appliedOperations) {
+    return buildUndoPlan(project, appliedOperations).undoOperations;
+  }
+
+  function getUndoUnavailableFiles(run = {}) {
+    const payload = run.recoveryPayload || run;
+    const files = new Map();
+    for (const operation of payload.appliedOperations || []) {
+      const reason = operation?.undoUnavailable;
+      if (typeof reason?.path === 'string' && reason.path === operation?.path
+        && ['stale_source_changed', 'snapshot_undo_unavailable'].includes(reason.code)) {
+        files.set(reason.path, { path: reason.path, code: reason.code });
+      }
+    }
+    return [...files.values()];
+  }
+
+  function withAvailableUndo(run = {}) {
+    const unavailable = new Set(getUndoUnavailableFiles(run).map(item => item.path));
+    if (!unavailable.size) return run;
+    const result = { ...run };
+    for (const field of ['undoOperations', 'undoBaseFiles', 'undoExpectedFiles', 'undoTrackedChanges', 'trackedChangeCaptures']) {
+      result[field] = (run[field] || []).filter(item => !unavailable.has(item?.path) && !unavailable.has(item?.to));
+    }
+    return result;
+  }
+
+  // Fallback history keeps only bounded reasons, never document bytes or
+  // authority to reconstruct a withheld checkpoint.
+  function compactUnavailableUndoOperations(run = {}) {
+    if (run.forkSnapshot || run.undoStatus === 'applied' || ['accepted', 'rejected'].includes(run.trackedChangeStatus)) return [];
+    return getUndoUnavailableFiles(run).filter(item => item.path.length <= 1024).slice(0, 100)
+      .map(item => ({ type: 'edit', path: item.path, undoUnavailable: item }));
+  }
+
+  function buildUndoPlan(project, appliedOperations) {
     const workingFilesByPath = new Map();
     for (const file of project?.files || []) {
       if (typeof file?.path === 'string' && typeof file.content === 'string') {
@@ -15,7 +50,12 @@
       }
     }
 
+    const sourceFilesByPath = new Map(workingFilesByPath);
     const undo = [];
+    const inverseBases = new Map();
+    const mappedPaths = new Set((appliedOperations || []).filter(operation => Array.isArray(operation?.appliedPatches))
+      .map(operation => operation.path));
+    const unavailable = new Map(getUndoUnavailableFiles({ appliedOperations }).map(item => [item.path, item.code]));
     const fullRestoreEditPaths = new Set();
 
     for (const operation of appliedOperations || []) {
@@ -29,22 +69,33 @@
         }
         const currentBeforeEdit = workingFilesByPath.get(operation.path);
         if (!fullRestoreEditPaths.has(operation.path)) {
-          const inversePatches = buildInverseTextPatches(currentBeforeEdit, operation.patches);
+          const hasAppliedPatches = Array.isArray(operation.appliedPatches) && typeof operation.verifiedContent === 'string';
+          const inversePatches = hasAppliedPatches
+            ? buildVerifiedInversePatches(operation.appliedPatches, operation.verifiedContent)
+            : buildInverseTextPatches(sourceFilesByPath.get(operation.path), operation.patches,
+              operation.verifiedContent, operation.path);
+          let inverse;
           if (inversePatches.length) {
-            undo.push(normalizeUndoOperation({
+            inverse = normalizeUndoOperation({
               type: 'edit',
               path: operation.path,
               patches: inversePatches,
               reason: 'Undo edit'
-            }));
-          } else {
+            });
+          } else if (!hasAppliedPatches) {
             fullRestoreEditPaths.add(operation.path);
-            undo.push(normalizeUndoOperation({
+            inverse = normalizeUndoOperation({
               type: 'edit',
               path: operation.path,
               replaceAll: currentBeforeEdit,
               reason: 'Undo edit'
-            }));
+            });
+          } else {
+            unavailable.set(operation.path, 'snapshot_undo_unavailable');
+          }
+          if (inverse) {
+            undo.push(inverse);
+            if (typeof operation.verifiedContent === 'string') inverseBases.set(inverse, operation.verifiedContent);
           }
         }
       } else if (operation.type === 'create') {
@@ -70,10 +121,13 @@
         if (!operation.path || !operation.to) {
           continue;
         }
+        if (operation.moveProof && !operation.moveProof.targetEntityId) continue;
         undo.push(normalizeUndoOperation({
           type: 'move',
           path: operation.to,
           to: operation.path,
+          ...(operation.moveProof ? { moveProof: { ...operation.moveProof,
+            sourceEntityId: operation.moveProof.targetEntityId, targetEntityId: operation.moveProof.sourceEntityId } } : {}),
           reason: 'Undo move'
         }));
       } else if (operation.type === 'delete') {
@@ -89,12 +143,57 @@
       }
 
       applyOperationToFiles(workingFilesByPath, operation);
+      applyOperationToFiles(sourceFilesByPath, { ...operation, verifiedContent: undefined });
     }
 
-    return undo.reverse();
+    // Each inverse was measured in its own verified post-image. Compose in
+    // reverse order against the latest image, preserving changes between
+    // entries. Empty inverse insertions must never reuse an older offset.
+    const composed = [];
+    for (const inverse of undo.reverse()) {
+      let operation = inverse;
+      if (mappedPaths.has(inverse.path) && inverseBases.has(inverse)) {
+        const current = workingFilesByPath.get(inverse.path);
+        const base = StaleGuard.buildBaseFileLookup([{ path: inverse.path, content: inverseBases.get(inverse) }]);
+        const fresh = StaleGuard.checkOperationFreshness(inverse, current, base);
+        const prepared = fresh.ok && inverse.patches
+          ? fresh.preparedPatches || StaleGuard.prepareOperationPatches(inverse, current, base) : fresh;
+        if (typeof current !== 'string' || !prepared.ok) {
+          unavailable.set(inverse.path, 'stale_source_changed');
+          continue;
+        }
+        if (inverse.patches) operation = { ...inverse, patches: prepared.patches };
+      }
+      composed.push(operation);
+      applyOperationToFiles(workingFilesByPath, operation);
+    }
+    return { undoOperations: composed.filter(operation => !unavailable.has(operation.path)),
+      undoUnavailable: [...unavailable].map(([path, code]) => ({ path, code })) };
   }
 
-  function buildInverseTextPatches(textBeforeEdit, patches) {
+  // Invert the ranges actually dispatched to C, not the original Native
+  // coordinates in B. Verify against the observed post-image before storing
+  // recovery; invalid evidence must not fall back to overwriting C with B.
+  function buildVerifiedInversePatches(patches, postImage) {
+    const beforeLength = patches.reduce((length, patch) =>
+      length + Number(patch?.to) - Number(patch?.from) - String(patch?.insert ?? '').length, postImage.length);
+    if (!Number.isSafeInteger(beforeLength) || beforeLength < 0) return [];
+    const normalized = normalizeTextPatches(patches, beforeLength);
+    if (!normalized.ok || normalized.patches.some(patch => patch.expected.length !== patch.to - patch.from)) return [];
+    const inverse = invertPatches(normalized.patches);
+    return applyTextPatches(postImage, inverse).ok ? inverse : [];
+  }
+
+  function invertPatches(patches) {
+    let offset = 0;
+    return patches.map(patch => {
+      const from = patch.from + offset;
+      offset += patch.insert.length - (patch.to - patch.from);
+      return { from, to: from + patch.insert.length, expected: patch.insert, insert: patch.expected };
+    });
+  }
+
+  function buildInverseTextPatches(textBeforeEdit, patches, verifiedContent, path) {
     if (!Array.isArray(patches) || !patches.length) {
       return [];
     }
@@ -107,26 +206,57 @@
       return [];
     }
 
-    let offset = 0;
-    return normalized.patches.map(patch => {
-      const from = patch.from + offset;
-      const to = from + patch.insert.length;
-      offset += patch.insert.length - (patch.to - patch.from);
-      return {
-        from,
-        to,
-        expected: patch.insert,
-        insert: patch.expected
-      };
-    });
+    const inverse = invertPatches(normalized.patches);
+    if (typeof verifiedContent !== 'string' || verifiedContent === applied.text) return inverse;
+    // The stored checkpoint uses the verified editor post-image. Its inverse
+    // must use those same offsets, while Native patches retain their source
+    // representation for later operations in the batch.
+    const prepared = StaleGuard.prepareStoredInversePatches({ type: 'edit', path, patches: inverse }, verifiedContent,
+      StaleGuard.buildBaseFileLookup([{ path, content: applied.text }]));
+    return prepared.ok && applyTextPatches(verifiedContent, prepared.patches).ok ? prepared.patches : [];
+  }
+
+  function selectExpectedFilesForTrackedUndo(project, operations = [], trackedChanges = [], previousExpectedFiles = []) {
+    const checkpoint = buildUndoCheckpoint(project, operations);
+    const unavailable = new Set(checkpoint.undoUnavailable.map(item => item.path));
+    const mappedPaths = new Set(operations.filter(operation => Array.isArray(operation?.appliedPatches)).map(operation => operation.path));
+    const paths = new Set();
+    for (const change of trackedChanges || []) if (change?.path) paths.add(change.path);
+    for (const operation of operations || []) {
+      if (operation?.path) paths.add(operation.path);
+      if (operation?.to) paths.add(operation.to);
+    }
+    const expectedByPath = new Map();
+    for (const file of previousExpectedFiles || []) {
+      if (paths.has(file?.path) && !unavailable.has(file.path) && !mappedPaths.has(file.path)
+        && typeof file?.content === 'string' && !expectedByPath.has(file.path)) {
+        expectedByPath.set(file.path, { path: file.path, content: file.content });
+      }
+    }
+    // Reconstruct the pre-image with the same inverse patches as plain Undo.
+    // This preserves the editor's unchanged line endings and collaborator
+    // content, including when the ZIP baseline used a different representation.
+    const hasVerifiedPatches = operations.some(operation => typeof operation?.verifiedContent === 'string'
+      && Array.isArray(operation.patches) && operation.patches.length);
+    const restored = hasVerifiedPatches ? buildExpectedFilesAfterOperations({ files: checkpoint.undoBaseFiles }, checkpoint.undoOperations) : new Map();
+    for (const file of project?.files || []) {
+      if (paths.has(file?.path) && !unavailable.has(file.path) && typeof file?.content === 'string' && !expectedByPath.has(file.path)) {
+        expectedByPath.set(file.path, { path: file.path, content: restored.get(file.path) ?? file.content });
+      }
+    }
+    return Array.from(expectedByPath.values());
   }
 
   function buildUndoCheckpoint(project, appliedOperations) {
-    const undoOperations = buildUndoOperations(project, appliedOperations);
+    const { undoOperations, undoUnavailable } = buildUndoPlan(project, appliedOperations);
+    const unavailable = new Map(undoUnavailable.map(item => [item.path, item]));
     const expectedFiles = buildExpectedFilesAfterOperations(project, appliedOperations);
     return {
       undoOperations,
-      undoBaseFiles: filesMapToList(selectUndoBaseFiles(expectedFiles, undoOperations))
+      undoBaseFiles: filesMapToList(selectUndoBaseFiles(expectedFiles, undoOperations)),
+      undoUnavailable,
+      appliedOperations: (appliedOperations || []).map(operation => unavailable.has(operation?.path)
+        ? { ...operation, undoUnavailable: unavailable.get(operation.path) } : operation)
     };
   }
 
@@ -140,9 +270,9 @@
       const proof = operation?.undoCreatedFile;
       if (operation?.type !== 'delete' || proof?.v !== 1) continue;
       if (proof.kind === 'text' && priorFiles.has(operation.path)) {
-        created.set(operation.path, { kind: 'text', content: priorFiles.get(operation.path) });
+        created.set(operation.path, { kind: 'text', content: priorFiles.get(operation.path), createdDirectories: proof.createdDirectories });
       } else if (proof.kind === 'binary' && /^[a-f0-9]{64}$/i.test(proof.sha256 || '')) {
-        created.set(operation.path, { kind: 'binary', sha256: proof.sha256.toLowerCase() });
+        created.set(operation.path, { kind: 'binary', sha256: proof.sha256.toLowerCase(), createdDirectories: proof.createdDirectories });
       }
     }
     for (const operation of appliedOperations || []) {
@@ -152,17 +282,17 @@
         if (originalPaths.has(path) && !created.has(path)) continue;
         if (operation.type === 'create' && typeof operation.content === 'string') {
           created.set(path, { kind: 'text', content: typeof operation.verifiedContent === 'string'
-            ? operation.verifiedContent : operation.content });
+            ? operation.verifiedContent : operation.content, createdDirectories: operation.createdDirectories });
         } else {
           const hash = operation.sha256 || operation.assetRef?.sha256;
           if (operation.previousExists !== true && /^[a-f0-9]{64}$/i.test(hash || '')) {
-            created.set(path, { kind: 'binary', sha256: hash.toLowerCase() });
+            created.set(path, { kind: 'binary', sha256: hash.toLowerCase(), createdDirectories: operation.createdDirectories });
           }
         }
       } else if (operation.type === 'edit' && created.get(path)?.kind === 'text') {
         const files = new Map([[path, created.get(path).content]]);
         applyOperationToFiles(files, operation);
-        created.set(path, { kind: 'text', content: files.get(path) });
+        created.set(path, { ...created.get(path), kind: 'text', content: files.get(path) });
       } else if (['delete', 'rename', 'move', 'overwrite-binary'].includes(operation.type)) {
         // Existing rename/overwrite recovery retains ownership of these cases.
         created.delete(path);
@@ -173,17 +303,83 @@
     for (const [path, proof] of Array.from(created).reverse()) {
       const undoCreatedFile = proof.kind === 'binary'
         ? { v: 1, kind: 'binary', sha256: proof.sha256 } : { v: 1, kind: 'text' };
+      if (Array.isArray(proof.createdDirectories) && proof.createdDirectories.length) {
+        undoCreatedFile.createdDirectories = proof.createdDirectories.map(item => ({ ...item }));
+      }
       undoOperations.push({ ...normalizeUndoOperation({ type: 'delete', path, reason: 'Undo create' }), undoCreatedFile });
       if (proof.kind === 'text') undoBaseFiles.push({ path, content: proof.content });
     }
+    // Reviewing has no text insertion/deletion refs for a native metadata move.
+    // Keep its identity-bound inverse with the other file-level proofs.
+    undoOperations.push(...buildUndoOperations(project, appliedOperations).filter(operation => operation.type === 'move' && operation.moveProof));
     return { undoOperations, undoBaseFiles };
   }
 
+  function isFileUndoOperation(operation) {
+    return operation?.undoCreatedFile?.v === 1
+      || (operation?.type === 'move' && operation.moveProof?.v === 1)
+      || (operation?.type === 'create' && typeof operation.content === 'string');
+  }
+
+  // A deleted original has no editor post-image. Its inverse is a guarded
+  // file creation, backed by both the forward delete and the captured original.
+  // This also recovers older Track-on records that omitted that inverse.
+  function getFileUndoOperations(run = {}) {
+    run = withAvailableUndo(run);
+    const operations = (run.undoOperations || []).filter(isFileUndoOperation);
+    const before = filesListToMap(run.undoExpectedFiles);
+    const after = buildExpectedFilesAfterOperations({ files: run.undoExpectedFiles }, run.appliedOperations);
+    const deleted = new Set((run.appliedOperations || []).filter(operation => operation?.type === 'delete'
+      && before.has(operation.path) && !after.has(operation.path)).map(operation => operation.path));
+    return [...operations.filter(operation => !deleted.has(operation.path)), ...Array.from(deleted, path =>
+      normalizeUndoOperation({ type: 'create', path, content: before.get(path), reason: 'Undo delete' }))];
+  }
+
+  function prepareRunUndo(run = {}) {
+    const original = run;
+    run = withAvailableUndo(run);
+    const files = getFileUndoOperations(run);
+    const restored = new Set(files.filter(operation => operation.type === 'create').map(operation => operation.path));
+    const pending = [...files], operations = [];
+    for (const operation of run.undoOperations || []) {
+      if (isFileUndoOperation(operation)) {
+        const index = pending.findIndex(file => file.path === operation.path && file.type === operation.type);
+        if (index >= 0) operations.push(...pending.splice(index, 1));
+      } else if (!restored.has(operation.path)) operations.push(operation);
+    }
+    return { ...original, undoOperations: [...operations, ...pending],
+      ...(run !== original ? { undoBaseFiles: run.undoBaseFiles, undoExpectedFiles: run.undoExpectedFiles } : {}) };
+  }
+
+  function textUndoRun(run = {}) {
+    run = withAvailableUndo(run);
+    const restored = new Set(getFileUndoOperations(run).flatMap(operation => operation.type === 'create' ? [operation.path]
+      : operation.type === 'move' ? [operation.path, operation.to] : []));
+    return { ...run,
+      undoExpectedFiles: (run.undoExpectedFiles || []).filter(file => !restored.has(file.path)),
+      undoTrackedChanges: (run.undoTrackedChanges || []).filter(ref => !restored.has(ref.path))
+    };
+  }
+
+  function mergeFileUndoResult(textResult, fileResult, operations) {
+    const applied = [...(textResult.applied || []), ...(fileResult.applied || [])];
+    const skipped = [...(textResult.skipped || []), ...(fileResult.skipped || [])];
+    for (const operation of operations) {
+      if (!(fileResult.applied || []).some(entry => entry.operation?.path === operation.path
+        && entry.operation?.type === operation.type && entry.result?.ok === true && entry.result?.verified === true
+        && entry.result.verification === 'overleaf-zip')
+        && !(fileResult.skipped || []).some(entry => entry.operation?.path === operation.path)) {
+        skipped.push({ operation, result: { ok: false, code: 'undo_operation_failed',
+          reason: 'The file restoration has no verified server receipt.' } });
+      }
+    }
+    return { ...textResult, ok: textResult.ok !== false && fileResult.ok !== false && !skipped.length, applied, skipped };
+  }
+
   // Consume only independently verified rollback receipts. Forward writes
   // remain audit evidence; recovery arrays describe only unfinished work.
   function advanceUndoCheckpoint(run = {}, result = {}, verifyText = () => false) {
     const operations = Array.isArray(run?.undoOperations) ? run.undoOperations : [];
-    if (!operations.some(operation => operation?.undoCreatedFile?.v === 1)) return run;
     const applied = Array.isArray(result.applied) ? result.applied : [];
     const skipped = Array.isArray(result.skipped) ? result.skipped : [];
     const failed = path => skipped.some(entry => {
@@ -201,8 +397,22 @@
         && JSON.stringify(entry.operation.undoCreatedFile) === JSON.stringify(operation.undoCreatedFile)
         && entry.result?.ok === true && entry.result.verified === true
         && entry.result.verification === 'overleaf-zip')).map(operation => operation.path));
+    const restoredPaths = new Set(operations.filter(operation => operation?.type === 'create'
+      && !failed(operation.path) && applied.some(entry => entry?.operation?.type === 'create'
+        && entry.operation.path === operation.path && entry.operation.content === operation.content
+        && entry.result?.ok === true && entry.result.verified === true
+        && entry.result.verification === 'overleaf-zip')).map(operation => operation.path));
+    const movedPaths = new Set(operations.filter(operation => operation?.type === 'move' && operation.moveProof?.v === 1
+      && !failed(operation.path) && applied.some(entry => entry?.operation?.type === 'move'
+        && entry.operation.path === operation.path && entry.operation.to === operation.to
+        && JSON.stringify(entry.operation.moveProof) === JSON.stringify(operation.moveProof)
+        && entry.result?.ok === true && entry.result.verified === true && entry.result.verification === 'overleaf-zip'))
+      .flatMap(operation => [operation.path, operation.to]));
+    for (const path of restoredPaths) textPaths.add(path);
+    for (const path of movedPaths) textPaths.add(path);
     if (!textPaths.size && !deletedPaths.size) return run;
-    const pending = operations.filter(operation => !(operation?.type === 'edit' && textPaths.has(operation.path))
+    const pending = operations.filter(operation => !restoredPaths.has(operation.path) && !(operation?.type === 'edit' && textPaths.has(operation.path))
+      && !(operation?.type === 'move' && movedPaths.has(operation.path))
       && !(operation?.type === 'delete' && operation.undoCreatedFile?.v === 1 && deletedPaths.has(operation.path)));
     const needed = new Set(pending.flatMap(operation => [operation?.path, operation?.to]).filter(Boolean));
     return { ...run,
@@ -216,6 +426,7 @@
   }
 
   function buildSnapshotRestoreUndo(run = {}) {
+    run = withAvailableUndo(run);
     const undoOperations = Array.isArray(run.undoOperations) ? run.undoOperations : [];
     const originalByPath = buildOriginalFilesForSnapshotUndo(run, undoOperations);
     if (!originalByPath.size) {
@@ -396,6 +607,7 @@
         insert: String(patch.insert ?? '')
       }));
     }
+    if (operation.type === 'move' && operation.moveProof?.v === 1) normalized.moveProof = JSON.parse(JSON.stringify(operation.moveProof));
     return normalized;
   }
 
@@ -454,11 +666,20 @@
   }
 
   return {
+    getUndoUnavailableFiles,
+    withAvailableUndo,
+    compactUnavailableUndoOperations,
+    isFileUndoOperation,
+    getFileUndoOperations,
+    prepareRunUndo,
+    textUndoRun,
+    mergeFileUndoResult,
     buildUndoCheckpoint,
     buildCreatedFileUndoCheckpoint,
     advanceUndoCheckpoint,
     buildExpectedFilesAfterOperations,
     buildUndoOperations,
+    selectExpectedFilesForTrackedUndo,
     buildSnapshotRestoreUndo
   };
 });

package/extension/src/shared/updateConsent.js

@@ -78,6 +78,7 @@
       deadlineAt: finiteNumber(value.deadlineAt),
       heartbeatAt: finiteNumber(value.heartbeatAt),
       postponeUntil: finiteNumber(value.postponeUntil),
+      cooldownUntil: finiteNumber(value.cooldownUntil),
       code: safeToken(value.code),
       message: String(value.message || '').replace(/\s+/g, ' ').trim().slice(0, 300),
       manualReason: normalizeManualReason(value.manualReason)
@@ -118,9 +119,6 @@
     const state = normalizeUpdateState(updateValue, options.currentVersion);
     const consent = normalizeConsentState(consentValue);
     const newer = compareStableVersions(state.latestVersion, state.currentVersion) > 0;
-    const snoozed = newer &&
-      consent.snoozedVersion === state.latestVersion &&
-      consent.snoozedUntil > now;
     const execution = EXECUTION_STATES.has(state.state);
     const available = state.state === 'update_available' && newer;
     // A newer release that only a reinstall can apply. It is shown even after
@@ -129,7 +127,11 @@
     // still names the old one, and the notice must clear by itself.
     const runningVersion = safeVersion(options.currentVersion) || state.currentVersion;
     const manualInstall = state.state === 'manual_install_required'
-      && compareStableVersions(state.latestVersion, runningVersion) > 0;
+      && (compareStableVersions(state.latestVersion, runningVersion) > 0
+        || (state.code === 'prerelease_promotion_requires_manual_update'
+          && state.latestVersion === runningVersion));
+    const snoozed = (newer || manualInstall) &&
+      consent.snoozedVersion === state.latestVersion && consent.snoozedUntil > now;
     const progress = getProgressModel(state);
     const quietFailure = state.state === 'failed' &&
       state.initiatedBy !== 'manual' &&

package/extension/src/shared/updateRuntimeIdentity.js

@@ -12,21 +12,35 @@
     return a[0] - b[0] || a[1] - b[1] || a[2] - b[2];
   }
 
+  function verifiedRollback(status = {}) {
+    const transaction = status.transaction;
+    const pair = status.restoredPair;
+    const digest = value => typeof value === 'string' && /^[0-9a-f]{64}$/.test(value);
+    return Boolean(transaction?.id && transaction.state === 'rolled_back'
+      && version(transaction.sourceVersion) && version(transaction.targetVersion)
+      && status.installedAligned === true && status.activeVersion === transaction.sourceVersion
+      && pair?.extensionVersion === transaction.sourceVersion && pair.nativeVersion === transaction.sourceVersion
+      && digest(pair.extensionSha256) && digest(pair.nativeSha256)
+      && (!transaction.bootstrapRevision || digest(pair.bootstrapSha256)));
+  }
+
   function inspectInstalledRuntime(status = {}, options = {}) {
     const result = { installedVersion: version(status.activeVersion), nativeVersion: version(status.runtimeVersion),
       extensionVersion: version(options.extensionVersion), runtimeVersion: version(options.runtimeVersion), state: 'unknown' };
     if (!status.managed || !result.installedVersion || !result.nativeVersion ||
         !result.extensionVersion || !result.runtimeVersion) return result;
     if (['authorized', 'bound'].includes(status.authorization?.state) ||
-        ['staged', 'activation_pending', 'applying', 'awaiting_health'].includes(status.transaction?.state)) {
+        ['staged', 'activation_pending', 'applying', 'bootstrap_pending', 'bootstrap_rolling_back', 'awaiting_health', 'rolling_back'].includes(status.transaction?.state)) {
       return { ...result, state: 'transaction_active' };
     }
     if (status.installedAligned !== true) return { ...result, state: 'repair_required' };
     const loaded = [result.nativeVersion, result.extensionVersion, result.runtimeVersion];
     if (loaded.every(value => value === result.installedVersion)) return { ...result, state: 'aligned' };
-    return { ...result, state: loaded.every(value => compare(result.installedVersion, value) >= 0)
+    const rollbackReload = verifiedRollback(status) && loaded.every(value =>
+      value === status.transaction.sourceVersion || value === status.transaction.targetVersion);
+    return { ...result, state: rollbackReload || loaded.every(value => compare(result.installedVersion, value) >= 0)
       ? 'reload_required' : 'repair_required' };
   }
 
-  return Object.freeze({ inspectInstalledRuntime });
+  return Object.freeze({ inspectInstalledRuntime, verifiedRollback });
 });

package/extension/src/shared/writebackIntent.js

@@ -18,6 +18,22 @@
         if (typeof input[key] === 'string') op[key] = input[key];
       }
       if (Number.isSafeInteger(input.size)) op.size = input.size;
+      if (input.moveProof !== undefined) {
+        const proof = input.moveProof;
+        if (input.type !== 'move' || proof?.v !== 1 || !['text', 'binary'].includes(proof.kind)
+          || !/^[a-f0-9]{64}$/i.test(proof.sha256 || '')) return null;
+        op.moveProof = { v: 1, kind: proof.kind, sha256: proof.sha256.toLowerCase() };
+        if (proof.entityType !== undefined) {
+          if (!['doc', 'file'].includes(proof.entityType)) return null;
+          op.moveProof.entityType = proof.entityType;
+        }
+        for (const key of ['sourceEntityId', 'targetEntityId']) {
+          if (proof[key] !== undefined) {
+            if (typeof proof[key] !== 'string' || !proof[key] || proof[key].length > 160 || /[\0\r\n]/.test(proof[key])) return null;
+            op.moveProof[key] = proof[key];
+          }
+        }
+      }
       if (Array.isArray(input.patches)) {
         if (input.patches.length > 1000) return null;
         op.patches = input.patches.map(p => ({ from: p.from, to: p.to, expected: String(p.expected ?? ''), insert: String(p.insert ?? '') }));

package/extension/src/shared/writebackOperationEvidence.js

@@ -1,10 +1,10 @@
 (function initCodexOverleafWritebackOperationEvidence(root, factory) {
   if (typeof module === 'object' && module.exports) {
-    module.exports = factory();
+    module.exports = factory(require('./failureReasons'));
   } else {
-    root.CodexOverleafModuleRegistry.define('WritebackOperationEvidence', [], factory);
+    root.CodexOverleafModuleRegistry.define('WritebackOperationEvidence', ['FailureReasons'], factory);
   }
-})(typeof window !== 'undefined' ? window : globalThis, function writebackOperationEvidenceFactory() {
+})(typeof window !== 'undefined' ? window : globalThis, function writebackOperationEvidenceFactory(FailureReasons) {
   'use strict';
 
   function normalizeOperationEvidence(operations = [], applyResult = {}) {
@@ -99,18 +99,7 @@
   }
 
   function normalizeFailure(result, operation) {
-    if (result?.failure && typeof result.failure === 'object') return cloneValue(result.failure);
-    if (!result?.code) return null;
-    return {
-      code: result.code,
-      stage: result.stage || 'write',
-      severity: result.severity || 'error',
-      userMessage: result.reason || result.message || result.code,
-      retryable: result.retryable === true,
-      file: operation?.path || operation?.to || '',
-      changedDocument: result.changedDocument === true,
-      terminalState: result.terminalState || ''
-    };
+    return FailureReasons.normalizeWritebackFailure(result, operation);
   }
 
   function normalizeTrackedChanges(value) {