codex-overleaf-link 2.5.1 → 2.6.0

package/extension/src/shared/storageMigration.js

@@ -19,6 +19,7 @@
     'experimentalOtByProject',
     'customInstructionsByProject',
     'governanceRulesByProject',
+    'reviewingAvailabilityByProject',
     'selectedLocalSkillIdsByProject'
   ];
   var projectPreferenceLockTails = {};
@@ -130,7 +131,12 @@
         ? incoming[mapName]
         : {};
       if (Object.prototype.hasOwnProperty.call(incomingMap, projectId)) {
-        storedMap[scopedKey] = copyPreferenceValue(incomingMap[projectId]);
+        const previous = storedMap[scopedKey], observation = incomingMap[projectId];
+        if (mapName !== 'reviewingAvailabilityByProject'
+          || !(Number(previous?.observedAt) > Number(observation?.observedAt)
+            || (previous?.observedAt === observation?.observedAt && previous?.status === 'available'))) {
+          storedMap[scopedKey] = copyPreferenceValue(observation);
+        }
       }
       delete storedMap[projectId];
       next[mapName] = storedMap;

package/extension/src/shared/storageRunActions.js

@@ -1,10 +1,10 @@
 (function initStorageRunActions(root, factory) {
   if (typeof module === 'object' && module.exports) {
-    module.exports = factory(require('./selectionContext'), require('./writebackIntent'), require('./writingStyle'), require('./directoryCleanupProof'));
+    module.exports = factory(require('./selectionContext'), require('./writebackIntent'), require('./writingStyle'), require('./directoryCleanupProof'), require('./undoOperations'));
   } else {
-    root.CodexOverleafModuleRegistry.define('StorageRunActions', ['SelectionContext', 'WritebackIntent', 'WritingStyle', 'DirectoryCleanupProof'], factory);
+    root.CodexOverleafModuleRegistry.define('StorageRunActions', ['SelectionContext', 'WritebackIntent', 'WritingStyle', 'DirectoryCleanupProof', 'UndoOperations'], factory);
   }
-})(typeof globalThis !== 'undefined' ? globalThis : window, function storageRunActionsFactory(SelectionContext, WritebackIntent, WritingStyle, DirectoryCleanupProof) {
+})(typeof globalThis !== 'undefined' ? globalThis : window, function storageRunActionsFactory(SelectionContext, WritebackIntent, WritingStyle, DirectoryCleanupProof, UndoOperations) {
   'use strict';
 
   // Share a bounded budget across the retained history, rather than expiring
@@ -129,7 +129,7 @@
       && Array.isArray(run.undoExpectedFiles) && run.undoExpectedFiles.length > 0
       && Array.isArray(run.appliedOperations) && run.appliedOperations.length > 0;
     var legacyUndo = Array.isArray(run && run.undoOperations) && run.undoOperations.length > 0;
-    return trackedLifecycle || reviewingEditorUndo || legacyUndo;
+    return trackedLifecycle || reviewingEditorUndo || legacyUndo || UndoOperations.getUndoUnavailableFiles(run).length > 0;
   }
 
   function runDirectoryCleanup(run) {
@@ -186,7 +186,7 @@
   }
 
   function compactCoreActionPayload(run, keepActionPayload, options = {}) {
-    var empty = emptyActionPayload();
+    var empty = { ...emptyActionPayload(), appliedOperations: UndoOperations.compactUnavailableUndoOperations(run) };
     if (!keepActionPayload || !hasReloadableRunActionPayload(run)) {
       if (hasReloadableRunActionPayload(run)) empty.recoveryRetention = omitted('fallback');
       else if (run?.recoveryRetention?.state === 'omitted' && !run.forkSnapshot
@@ -308,11 +308,48 @@
     return out;
   }
 
-  // Review terminal states are monotonic even when a later session snapshot is stale.
-  function mergeSessionReviewState(incoming, existing, reviewRunIds) {
+  const REVIEW_FIELDS = ['trackedChangeStatus', 'undoStatus', 'undoOwnerProtocol', 'undoTrackedChanges', 'undoExpectedFiles',
+    'undoOperations', 'undoBaseFiles', 'appliedOperations', 'trackedChangeCaptures', 'recoveryRetention',
+    'interruptedDraft', 'retryWriteback', 'saveCheck'];
+  const REVIEW_FACT_FIELDS = ['documentEffect', 'fileSettlements', 'failures', 'recoveryAvailability', 'recoveryDisposition'];
+  const terminalReview = run => ['accepted', 'rejected'].includes(run?.trackedChangeStatus) || run?.undoStatus === 'applied';
+  const factsOf = run => run?.settlement || run?.settlementFacts || {};
+
+  function copyRunReviewState(target, source) {
+    const merged = { ...target };
+    const copyFields = (into, from, fields) => {
+      for (const field of fields) {
+        if (Object.hasOwn(from, field)) into[field] = JSON.parse(JSON.stringify(from[field]));
+        else delete into[field];
+      }
+    };
+    copyFields(merged, source, REVIEW_FIELDS);
+    const sourceFacts = factsOf(source), targetFacts = factsOf(target);
+    const facts = { ...targetFacts };
+    copyFields(facts, sourceFacts, REVIEW_FACT_FIELDS);
+    const sourceEvidence = sourceFacts.evidence || {};
+    const evidence = { ...(targetFacts.evidence || {}) };
+    copyFields(evidence, sourceEvidence, [...new Set([...Object.keys(evidence), ...Object.keys(sourceEvidence)])]
+      .filter(key => !['mirrored', 'compiled'].includes(key)));
+    if (Object.keys(evidence).length) facts.evidence = evidence; else delete facts.evidence;
+    delete merged.settlementFacts;
+    if (Object.keys(facts).length) merged.settlement = facts; else delete merged.settlement;
+    return merged;
+  }
+
+  function reviewStateSnapshot(run) {
+    const facts = factsOf(run);
+    return JSON.stringify([REVIEW_FIELDS.map(key => run?.[key]), REVIEW_FACT_FIELDS.map(key => facts[key]),
+      Object.entries(facts.evidence || {}).filter(([key]) => !['mirrored', 'compiled'].includes(key))
+        .sort(([a], [b]) => a.localeCompare(b))]);
+  }
+
+  // Shared submissions retain the caller's envelope and private baseline. The
+  // legacy site-local path explicitly keeps its historical timestamp merge.
+  function mergeSessionReviewState(incoming, existing, reviewRunIds, options = {}) {
     if (!existing || incoming.id !== existing.id || incoming.projectId !== existing.projectId
       || !incoming.accountScopeId || incoming.accountScopeId !== existing.accountScopeId) return incoming;
-    var terminal = run => ['accepted', 'rejected'].includes(run?.trackedChangeStatus) || run?.undoStatus === 'applied';
+    var terminal = terminalReview;
     var incomingRuns = new Map((incoming.runs || []).map(run => [run.id, run]));
     var existingRuns = new Map((existing.runs || []).map(run => [run.id, run]));
     var requestedIds = new Set(reviewRunIds || []);
@@ -321,6 +358,21 @@
       return ['accepted', 'rejected', 'needs_review'].includes(run?.trackedChangeStatus)
         || ['applied', 'partial'].includes(run?.undoStatus);
     });
+    if (options.shared !== false) {
+      const runs = (incoming.runs || []).map(run => {
+        const previous = existingRuns.get(run.id);
+        const source = terminal(previous) ? previous : null;
+        if (!source || (source.runProjectId && source.runProjectId !== incoming.projectId)) return run;
+        // The same decision can still gain save/recovery evidence. Let the
+        // three-way merge retain those edits and reject genuine collisions.
+        if (run.trackedChangeStatus === source.trackedChangeStatus && run.undoStatus === source.undoStatus) return run;
+        // An absent local settlement has no edits to its metadata or auxiliary
+        // evidence. Retain the stored container as well as the terminal fields.
+        const target = !run.settlement && !run.settlementFacts ? { ...run, settlement: factsOf(source) } : run;
+        return copyRunReviewState(target, source);
+      });
+      return { ...incoming, runs };
+    }
     var newer = (Date.parse(incoming.updatedAt) || 0) >= (Date.parse(existing.updatedAt) || 0);
     if (!newer && !explicitReview) return incoming;
     var base = newer ? incoming : existing;
@@ -404,6 +456,8 @@
     compactSessionBatchActions: compactSessionBatchActions,
     compactStructuredEventValue: compactStructuredEventValue,
     mergeSessionReviewState: mergeSessionReviewState,
+    copyRunReviewState: copyRunReviewState,
+    reviewStateSnapshot: reviewStateSnapshot,
     compactRunsForStorage: compactRunsForStorage,
     compactRunActionPayload: compactRunActionPayload,
     compactProviderSnapshot: compactProviderSnapshot,

package/extension/src/shared/undoOperations.js

@@ -8,6 +8,41 @@
   'use strict';
 
   function buildUndoOperations(project, appliedOperations) {
+    return buildUndoPlan(project, appliedOperations).undoOperations;
+  }
+
+  function getUndoUnavailableFiles(run = {}) {
+    const payload = run.recoveryPayload || run;
+    const files = new Map();
+    for (const operation of payload.appliedOperations || []) {
+      const reason = operation?.undoUnavailable;
+      if (typeof reason?.path === 'string' && reason.path === operation?.path
+        && ['stale_source_changed', 'snapshot_undo_unavailable'].includes(reason.code)) {
+        files.set(reason.path, { path: reason.path, code: reason.code });
+      }
+    }
+    return [...files.values()];
+  }
+
+  function withAvailableUndo(run = {}) {
+    const unavailable = new Set(getUndoUnavailableFiles(run).map(item => item.path));
+    if (!unavailable.size) return run;
+    const result = { ...run };
+    for (const field of ['undoOperations', 'undoBaseFiles', 'undoExpectedFiles', 'undoTrackedChanges', 'trackedChangeCaptures']) {
+      result[field] = (run[field] || []).filter(item => !unavailable.has(item?.path) && !unavailable.has(item?.to));
+    }
+    return result;
+  }
+
+  // Fallback history keeps only bounded reasons, never document bytes or
+  // authority to reconstruct a withheld checkpoint.
+  function compactUnavailableUndoOperations(run = {}) {
+    if (run.forkSnapshot || run.undoStatus === 'applied' || ['accepted', 'rejected'].includes(run.trackedChangeStatus)) return [];
+    return getUndoUnavailableFiles(run).filter(item => item.path.length <= 1024).slice(0, 100)
+      .map(item => ({ type: 'edit', path: item.path, undoUnavailable: item }));
+  }
+
+  function buildUndoPlan(project, appliedOperations) {
     const workingFilesByPath = new Map();
     for (const file of project?.files || []) {
       if (typeof file?.path === 'string' && typeof file.content === 'string') {
@@ -17,6 +52,10 @@
 
     const sourceFilesByPath = new Map(workingFilesByPath);
     const undo = [];
+    const inverseBases = new Map();
+    const mappedPaths = new Set((appliedOperations || []).filter(operation => Array.isArray(operation?.appliedPatches))
+      .map(operation => operation.path));
+    const unavailable = new Map(getUndoUnavailableFiles({ appliedOperations }).map(item => [item.path, item.code]));
     const fullRestoreEditPaths = new Set();
 
     for (const operation of appliedOperations || []) {
@@ -30,23 +69,33 @@
         }
         const currentBeforeEdit = workingFilesByPath.get(operation.path);
         if (!fullRestoreEditPaths.has(operation.path)) {
-          const inversePatches = buildInverseTextPatches(sourceFilesByPath.get(operation.path), operation.patches,
-            operation.verifiedContent, operation.path);
+          const hasAppliedPatches = Array.isArray(operation.appliedPatches) && typeof operation.verifiedContent === 'string';
+          const inversePatches = hasAppliedPatches
+            ? buildVerifiedInversePatches(operation.appliedPatches, operation.verifiedContent)
+            : buildInverseTextPatches(sourceFilesByPath.get(operation.path), operation.patches,
+              operation.verifiedContent, operation.path);
+          let inverse;
           if (inversePatches.length) {
-            undo.push(normalizeUndoOperation({
+            inverse = normalizeUndoOperation({
               type: 'edit',
               path: operation.path,
               patches: inversePatches,
               reason: 'Undo edit'
-            }));
-          } else {
+            });
+          } else if (!hasAppliedPatches) {
             fullRestoreEditPaths.add(operation.path);
-            undo.push(normalizeUndoOperation({
+            inverse = normalizeUndoOperation({
               type: 'edit',
               path: operation.path,
               replaceAll: currentBeforeEdit,
               reason: 'Undo edit'
-            }));
+            });
+          } else {
+            unavailable.set(operation.path, 'snapshot_undo_unavailable');
+          }
+          if (inverse) {
+            undo.push(inverse);
+            if (typeof operation.verifiedContent === 'string') inverseBases.set(inverse, operation.verifiedContent);
           }
         }
       } else if (operation.type === 'create') {
@@ -97,7 +146,51 @@
       applyOperationToFiles(sourceFilesByPath, { ...operation, verifiedContent: undefined });
     }
 
-    return undo.reverse();
+    // Each inverse was measured in its own verified post-image. Compose in
+    // reverse order against the latest image, preserving changes between
+    // entries. Empty inverse insertions must never reuse an older offset.
+    const composed = [];
+    for (const inverse of undo.reverse()) {
+      let operation = inverse;
+      if (mappedPaths.has(inverse.path) && inverseBases.has(inverse)) {
+        const current = workingFilesByPath.get(inverse.path);
+        const base = StaleGuard.buildBaseFileLookup([{ path: inverse.path, content: inverseBases.get(inverse) }]);
+        const fresh = StaleGuard.checkOperationFreshness(inverse, current, base);
+        const prepared = fresh.ok && inverse.patches
+          ? fresh.preparedPatches || StaleGuard.prepareOperationPatches(inverse, current, base) : fresh;
+        if (typeof current !== 'string' || !prepared.ok) {
+          unavailable.set(inverse.path, 'stale_source_changed');
+          continue;
+        }
+        if (inverse.patches) operation = { ...inverse, patches: prepared.patches };
+      }
+      composed.push(operation);
+      applyOperationToFiles(workingFilesByPath, operation);
+    }
+    return { undoOperations: composed.filter(operation => !unavailable.has(operation.path)),
+      undoUnavailable: [...unavailable].map(([path, code]) => ({ path, code })) };
+  }
+
+  // Invert the ranges actually dispatched to C, not the original Native
+  // coordinates in B. Verify against the observed post-image before storing
+  // recovery; invalid evidence must not fall back to overwriting C with B.
+  function buildVerifiedInversePatches(patches, postImage) {
+    const beforeLength = patches.reduce((length, patch) =>
+      length + Number(patch?.to) - Number(patch?.from) - String(patch?.insert ?? '').length, postImage.length);
+    if (!Number.isSafeInteger(beforeLength) || beforeLength < 0) return [];
+    const normalized = normalizeTextPatches(patches, beforeLength);
+    if (!normalized.ok || normalized.patches.some(patch => patch.expected.length !== patch.to - patch.from)) return [];
+    const inverse = invertPatches(normalized.patches);
+    return applyTextPatches(postImage, inverse).ok ? inverse : [];
+  }
+
+  function invertPatches(patches) {
+    let offset = 0;
+    return patches.map(patch => {
+      const from = patch.from + offset;
+      offset += patch.insert.length - (patch.to - patch.from);
+      return { from, to: from + patch.insert.length, expected: patch.insert, insert: patch.expected };
+    });
   }
 
   function buildInverseTextPatches(textBeforeEdit, patches, verifiedContent, path) {
@@ -113,28 +206,20 @@
       return [];
     }
 
-    let offset = 0;
-    const inverse = normalized.patches.map(patch => {
-      const from = patch.from + offset;
-      const to = from + patch.insert.length;
-      offset += patch.insert.length - (patch.to - patch.from);
-      return {
-        from,
-        to,
-        expected: patch.insert,
-        insert: patch.expected
-      };
-    });
+    const inverse = invertPatches(normalized.patches);
     if (typeof verifiedContent !== 'string' || verifiedContent === applied.text) return inverse;
     // The stored checkpoint uses the verified editor post-image. Its inverse
     // must use those same offsets, while Native patches retain their source
     // representation for later operations in the batch.
-    const prepared = StaleGuard.prepareOperationPatches({ type: 'edit', path, patches: inverse }, verifiedContent,
+    const prepared = StaleGuard.prepareStoredInversePatches({ type: 'edit', path, patches: inverse }, verifiedContent,
       StaleGuard.buildBaseFileLookup([{ path, content: applied.text }]));
     return prepared.ok && applyTextPatches(verifiedContent, prepared.patches).ok ? prepared.patches : [];
   }
 
   function selectExpectedFilesForTrackedUndo(project, operations = [], trackedChanges = [], previousExpectedFiles = []) {
+    const checkpoint = buildUndoCheckpoint(project, operations);
+    const unavailable = new Set(checkpoint.undoUnavailable.map(item => item.path));
+    const mappedPaths = new Set(operations.filter(operation => Array.isArray(operation?.appliedPatches)).map(operation => operation.path));
     const paths = new Set();
     for (const change of trackedChanges || []) if (change?.path) paths.add(change.path);
     for (const operation of operations || []) {
@@ -143,7 +228,8 @@
     }
     const expectedByPath = new Map();
     for (const file of previousExpectedFiles || []) {
-      if (paths.has(file?.path) && typeof file?.content === 'string' && !expectedByPath.has(file.path)) {
+      if (paths.has(file?.path) && !unavailable.has(file.path) && !mappedPaths.has(file.path)
+        && typeof file?.content === 'string' && !expectedByPath.has(file.path)) {
         expectedByPath.set(file.path, { path: file.path, content: file.content });
       }
     }
@@ -152,10 +238,9 @@
     // content, including when the ZIP baseline used a different representation.
     const hasVerifiedPatches = operations.some(operation => typeof operation?.verifiedContent === 'string'
       && Array.isArray(operation.patches) && operation.patches.length);
-    const checkpoint = hasVerifiedPatches ? buildUndoCheckpoint(project, operations) : null;
-    const restored = checkpoint ? buildExpectedFilesAfterOperations({ files: checkpoint.undoBaseFiles }, checkpoint.undoOperations) : new Map();
+    const restored = hasVerifiedPatches ? buildExpectedFilesAfterOperations({ files: checkpoint.undoBaseFiles }, checkpoint.undoOperations) : new Map();
     for (const file of project?.files || []) {
-      if (paths.has(file?.path) && typeof file?.content === 'string' && !expectedByPath.has(file.path)) {
+      if (paths.has(file?.path) && !unavailable.has(file.path) && typeof file?.content === 'string' && !expectedByPath.has(file.path)) {
         expectedByPath.set(file.path, { path: file.path, content: restored.get(file.path) ?? file.content });
       }
     }
@@ -163,11 +248,15 @@
   }
 
   function buildUndoCheckpoint(project, appliedOperations) {
-    const undoOperations = buildUndoOperations(project, appliedOperations);
+    const { undoOperations, undoUnavailable } = buildUndoPlan(project, appliedOperations);
+    const unavailable = new Map(undoUnavailable.map(item => [item.path, item]));
     const expectedFiles = buildExpectedFilesAfterOperations(project, appliedOperations);
     return {
       undoOperations,
-      undoBaseFiles: filesMapToList(selectUndoBaseFiles(expectedFiles, undoOperations))
+      undoBaseFiles: filesMapToList(selectUndoBaseFiles(expectedFiles, undoOperations)),
+      undoUnavailable,
+      appliedOperations: (appliedOperations || []).map(operation => unavailable.has(operation?.path)
+        ? { ...operation, undoUnavailable: unavailable.get(operation.path) } : operation)
     };
   }
 
@@ -236,6 +325,7 @@
   // file creation, backed by both the forward delete and the captured original.
   // This also recovers older Track-on records that omitted that inverse.
   function getFileUndoOperations(run = {}) {
+    run = withAvailableUndo(run);
     const operations = (run.undoOperations || []).filter(isFileUndoOperation);
     const before = filesListToMap(run.undoExpectedFiles);
     const after = buildExpectedFilesAfterOperations({ files: run.undoExpectedFiles }, run.appliedOperations);
@@ -246,6 +336,8 @@
   }
 
   function prepareRunUndo(run = {}) {
+    const original = run;
+    run = withAvailableUndo(run);
     const files = getFileUndoOperations(run);
     const restored = new Set(files.filter(operation => operation.type === 'create').map(operation => operation.path));
     const pending = [...files], operations = [];
@@ -255,10 +347,12 @@
         if (index >= 0) operations.push(...pending.splice(index, 1));
       } else if (!restored.has(operation.path)) operations.push(operation);
     }
-    return { ...run, undoOperations: [...operations, ...pending] };
+    return { ...original, undoOperations: [...operations, ...pending],
+      ...(run !== original ? { undoBaseFiles: run.undoBaseFiles, undoExpectedFiles: run.undoExpectedFiles } : {}) };
   }
 
   function textUndoRun(run = {}) {
+    run = withAvailableUndo(run);
     const restored = new Set(getFileUndoOperations(run).flatMap(operation => operation.type === 'create' ? [operation.path]
       : operation.type === 'move' ? [operation.path, operation.to] : []));
     return { ...run,
@@ -332,6 +426,7 @@
   }
 
   function buildSnapshotRestoreUndo(run = {}) {
+    run = withAvailableUndo(run);
     const undoOperations = Array.isArray(run.undoOperations) ? run.undoOperations : [];
     const originalByPath = buildOriginalFilesForSnapshotUndo(run, undoOperations);
     if (!originalByPath.size) {
@@ -571,6 +666,9 @@
   }
 
   return {
+    getUndoUnavailableFiles,
+    withAvailableUndo,
+    compactUnavailableUndoOperations,
     isFileUndoOperation,
     getFileUndoOperations,
     prepareRunUndo,

package/extension/src/shared/updateRuntimeIdentity.js

@@ -12,6 +12,18 @@
     return a[0] - b[0] || a[1] - b[1] || a[2] - b[2];
   }
 
+  function verifiedRollback(status = {}) {
+    const transaction = status.transaction;
+    const pair = status.restoredPair;
+    const digest = value => typeof value === 'string' && /^[0-9a-f]{64}$/.test(value);
+    return Boolean(transaction?.id && transaction.state === 'rolled_back'
+      && version(transaction.sourceVersion) && version(transaction.targetVersion)
+      && status.installedAligned === true && status.activeVersion === transaction.sourceVersion
+      && pair?.extensionVersion === transaction.sourceVersion && pair.nativeVersion === transaction.sourceVersion
+      && digest(pair.extensionSha256) && digest(pair.nativeSha256)
+      && (!transaction.bootstrapRevision || digest(pair.bootstrapSha256)));
+  }
+
   function inspectInstalledRuntime(status = {}, options = {}) {
     const result = { installedVersion: version(status.activeVersion), nativeVersion: version(status.runtimeVersion),
       extensionVersion: version(options.extensionVersion), runtimeVersion: version(options.runtimeVersion), state: 'unknown' };
@@ -24,9 +36,11 @@
     if (status.installedAligned !== true) return { ...result, state: 'repair_required' };
     const loaded = [result.nativeVersion, result.extensionVersion, result.runtimeVersion];
     if (loaded.every(value => value === result.installedVersion)) return { ...result, state: 'aligned' };
-    return { ...result, state: loaded.every(value => compare(result.installedVersion, value) >= 0)
+    const rollbackReload = verifiedRollback(status) && loaded.every(value =>
+      value === status.transaction.sourceVersion || value === status.transaction.targetVersion);
+    return { ...result, state: rollbackReload || loaded.every(value => compare(result.installedVersion, value) >= 0)
       ? 'reload_required' : 'repair_required' };
   }
 
-  return Object.freeze({ inspectInstalledRuntime });
+  return Object.freeze({ inspectInstalledRuntime, verifiedRollback });
 });

package/extension/src/shared/writebackSettlement.js

@@ -28,7 +28,18 @@
   const SETTLEMENT_FACTS_MAX_BYTES = SettlementFacts.SETTLEMENT_FACTS_MAX_BYTES;
   const RECOVERY_FIELDS = SettlementFacts.RECOVERY_FIELDS;
   const compactSettlementFacts = SettlementFacts.compactSettlementFacts;
-  const projectRunSettlement = SettlementFacts.projectRunSettlement;
+  function projectRunSettlement(run = {}) {
+    const projection = SettlementFacts.projectRunSettlement(run);
+    const undoUnavailable = UndoOperations.getUndoUnavailableFiles(run);
+    if (!undoUnavailable.length) return projection;
+    const payload = UndoOperations.withAvailableUndo(run.recoveryPayload || run);
+    // Forward receipts remain audit evidence, not fallback Undo authority for
+    // a run whose inverse checkpoint could not be safely composed.
+    const available = SettlementFacts.projectRunSettlement({ ...run,
+      recoveryPayload: { ...payload, appliedOperations: [] } });
+    return { ...projection, canUndo: available.canUndo, undoUnavailable,
+      actions: { ...projection.actions, undo: available.canUndo } };
+  }
   const deriveLegacyProjection = SettlementFacts.deriveLegacyProjection;
   const aggregateFileSettlements = EvidenceProjection.aggregateFileSettlements;
   const deriveAppliedEvidence = EvidenceProjection.deriveAppliedEvidence;
@@ -297,7 +308,8 @@
     // Both actions cover every targeted file. Partial success must retain
     // the original recovery material for unresolved siblings.
     const incomplete = collectRunResultSkipped(input.result).length > 0
-      || input.result?.ok === false;
+      || input.result?.ok === false
+      || (kind === 'reject' && UndoOperations.getUndoUnavailableFiles(input.run).length > 0);
     const needsReview = incomplete || !successful || failures.some(failure =>
       failure.terminalState === 'needs_review' || reviewCodes.has(failure.code)
     );
@@ -340,6 +352,7 @@
 
   function settleLegacyUndo(input = {}) {
     const status = input.status === 'applied'
+      && !UndoOperations.getUndoUnavailableFiles(input.run).length
       && isUndoResultEffectivelyApplied(input.run, input.result, input.run?.undoOperations) ? 'applied' : 'partial';
     const recovery = preserveRecovery();
     return {
@@ -650,7 +663,12 @@
       ? { v: 1, kind: rawMove.kind, sha256: rawMove.sha256.toLowerCase(), sourceEntityId: rawMove.sourceEntityId,
         targetEntityId: rawMove.targetEntityId, ...(['doc', 'file'].includes(rawMove.entityType) ? { entityType: rawMove.entityType } : {}), ...(createdDirectories.length ? { createdDirectories } : {}) } : null;
     if (!(operation.type === 'edit' && typeof result?.verifiedContent === 'string') && !createdDirectories.length && !moveProof) return operation;
-    return { ...operation, ...(operation.type === 'edit' && typeof result?.verifiedContent === 'string' ? { verifiedContent: result.verifiedContent } : {}),
+    return { ...operation, ...(operation.type === 'edit' && typeof result?.verifiedContent === 'string' ? {
+      verifiedContent: result.verifiedContent,
+      ...(result.ok === true && result.verified === true && Array.isArray(result.appliedPatches)
+        ? { appliedPatches: result.appliedPatches.map(patch => ({ from: patch.from, to: patch.to,
+          expected: String(patch.expected ?? ''), insert: String(patch.insert ?? '') })) } : {})
+    } : {}),
       ...(createdDirectories.length ? { createdDirectories } : {}), ...(moveProof ? { moveProof } : {}) };
   }