codex-overleaf-link 2.5.1 → 2.6.5

package/extension/src/page/writebackRouter.js

@@ -115,7 +115,7 @@
     }
 
     function readActiveEditorText() {
-      return deps.readActiveEditorText?.() || '';
+      return deps.readActiveEditorText?.();
     }
 
     function waitForActiveEditorText(filePath, timeoutMs, options = {}) {
@@ -152,12 +152,12 @@
       };
     }
 
-    function replaceActiveEditorText(text) {
-      return deps.replaceActiveEditorText?.(text) || { ok: false, reason: 'Editor adapter is unavailable' };
+    function replaceActiveEditorText(text, options) {
+      return deps.replaceActiveEditorText?.(text, options) || { ok: false, reason: 'Editor adapter is unavailable' };
     }
 
-    function replaceActiveEditorPatches(patches, nextContent) {
-      return deps.replaceActiveEditorPatches?.(patches, nextContent) || { ok: false, reason: 'Editor adapter is unavailable' };
+    function replaceActiveEditorPatches(patches, nextContent, options) {
+      return deps.replaceActiveEditorPatches?.(patches, nextContent, options) || { ok: false, reason: 'Editor adapter is unavailable' };
     }
 
     function collectElements(selector, limit) {
@@ -266,6 +266,11 @@
         fallbackUserMessage: 'The file changed while Codex was working.',
         fallbackNextAction: 'Review the current file, then rerun the task.'
       },
+      document_identity_mismatch: {
+        stage: 'preflight', severity: 'blocked', defaultRetryable: true,
+        fallbackUserMessage: 'Codex could not confirm that the editor content belongs to the target file, so it was not used.',
+        fallbackNextAction: 'Wait for the target file to open and settle, then retry. Reload Overleaf if this continues.'
+      },
       patch_anchor_not_found: {
         stage: 'preflight', severity: 'blocked', defaultRetryable: true,
         fallbackUserMessage: 'The edit anchor no longer matches current Overleaf content.',
@@ -367,12 +372,12 @@
     const trackReviewingChanges = options.requireReviewing === true && hasOperations;
     let reviewingPolicy = null;
     if (options.requireReviewing === true && hasOperations) {
-      const reviewing = await ensureReviewing({ waitMs: 1800 });
+      const reviewing = await ensureReviewing({ waitMs: 1800, runProjectId: options.runProjectId });
       if (!reviewing.ok) {
         return buildReviewingRequiredBlockedResult(operations, reviewing);
       }
     } else if (options.requireEditing === true && hasOperations) {
-      const editing = await ensureEditing({ waitMs: 1800 });
+      const editing = await ensureEditing({ waitMs: 1800, runProjectId: options.runProjectId });
       if (!editing.ok) {
         return buildEditingRequiredBlockedResult(operations, editing);
       }
@@ -451,6 +456,10 @@
     const trackedChangeCaptures = [];
     const safeBaseFiles = normalizeBaseFilesForSafety(options.baseFiles);
     const baseFileLookup = window.CodexOverleafStaleGuard?.buildBaseFileLookup(safeBaseFiles);
+    // Binary and unread entries are not independent empty-text references.
+    const provenanceReferences = new Map((Array.isArray(safeBaseFiles) ? safeBaseFiles : [])
+      .filter(file => file.kind !== 'binary' && typeof file.content === 'string')
+      .map(file => [file.path, file.content]));
     const baseBinaryFileLookup = buildBaseBinaryFileLookup(safeBaseFiles);
     // Recheck project identity between awaited operations and before each write.
     const runProjectId = typeof options.runProjectId === 'string' ? options.runProjectId : '';
@@ -490,8 +499,16 @@
     const deadlineFailure = () => Number.isFinite(options.deadlineAt) && now() >= options.deadlineAt
       ? { ok: false, code: 'writeback_deadline_exceeded', changedDocument: false,
         reason: 'The undo time budget expired before this operation could start.' } : null;
-    const editOptions = () => ({ baseFileLookup, runProjectId, deadlineAt: options.deadlineAt,
+    const editOptions = () => ({ baseFileLookup, provenanceReferences, runProjectId, deadlineAt: options.deadlineAt,
       reviewGuard: options.reviewGuard, reviewAwait: options.reviewAwait,
+      recheckEditDispatch: () => {
+        if (readWriteCancellationSequence() !== cancelBaselineSequence) return cancelledSkipResult;
+        if (!writeGuardSurface) return { ok: false, code: 'editor_project_id_unavailable', changedDocument: false };
+        const editorProjectId = writeGuardSurface.getEditorProjectIdPageSide(runProjectId);
+        const code = !runProjectId || !editorProjectId ? 'editor_project_id_unavailable'
+          : editorProjectId !== runProjectId ? 'aborted_project_changed' : '';
+        return code ? writeGuardSurface.abortDispatchResult(code, runProjectId || null, editorProjectId).skipped[0].result : null;
+      },
       recheckWriteProject: writeGuardSurface ? () => {
         const expired = options.reviewGuard?.() || deadlineFailure();
         return expired ? { applied: [], skipped: [{ operation: {}, result: expired }] }
@@ -611,11 +628,54 @@
   const isUntouchedOpenFailure = result => result?.ok === false && result.failure?.code === 'target_file_open_failed'
     && result.failure.changedDocument === false;
 
+  function documentIdentityContext(filePath, projectId = treeOperations.getProjectId?.()) {
+    const target = (deps.resolveTargetDocument || treeOperations.resolveTargetDocument)?.(filePath, { projectId });
+    return { projectId, targetDocumentId: target?.status === 'known' ? target.documentId : '' };
+  }
+
+  function documentProvenance(filePath, text, references, context = documentIdentityContext(filePath)) {
+    const capture = (deps.captureEditorDocument || treeOperations.captureEditorDocument)?.({ path: filePath, projectId: context.projectId });
+    const target = (deps.resolveTargetDocument || treeOperations.resolveTargetDocument)?.(filePath, { projectId: context.projectId });
+    if ((target?.status === 'known' && context.targetDocumentId && target.documentId !== context.targetDocumentId)
+      || (context.projectId && treeOperations.getProjectId?.() !== context.projectId))
+      return { ok: false, code: 'document_identity_mismatch', identityState: 'mismatch' };
+    if (capture?.identityState === 'mismatch' || capture?.reason === 'navigation_conflict') return capture;
+    if (capture?.ok) {
+      const id = capture.documentIdentity.documentId;
+      if (context.targetDocumentId && context.targetDocumentId !== id)
+        return { ok: false, code: 'document_identity_mismatch', identityState: 'mismatch' };
+      context.targetDocumentId = id;
+      return { ok: true, identityState: 'match', capture };
+    }
+    if (typeof text !== 'string') return { ok: false, code: 'document_identity_mismatch', identityState: 'fallback' };
+    return window.CodexOverleafStaleGuard?.assessDocumentProvenance?.({ path: filePath, text, references })
+      || { ok: true, identityState: 'fallback' };
+  }
+
+  async function settleDocumentProvenance(filePath, references, context, deadlineAt = Infinity) {
+    const deadline = Math.min(deadlineAt, Date.now() + TreeOperations.ACTIVE_EDITOR_STABILITY_MS);
+    let result;
+    do {
+      result = documentProvenance(filePath, readActiveEditorText(), references, context);
+      if (result.identityState === 'match' || result.identityState === 'mismatch' || Date.now() >= deadline) return result;
+      await delay(Math.min(50, deadline - Date.now()));
+    } while (Date.now() <= deadline);
+    return result;
+  }
+
+  function documentMismatchResult(filePath, provenance) {
+    const failure = buildPageFailure('document_identity_mismatch', { file: filePath,
+      operationType: 'edit', changedDocument: false,
+      evidence: { matchedPath: provenance.matchedPath, writeStarted: false } });
+    return { ...provenance, reason: failure.userMessage, failure };
+  }
+
   async function applyEditOperation(operation, options = {}) {
     const reviewBlock = options.reviewGuard?.();
     if (reviewBlock) return reviewBlock;
     const currentPath = getActiveFilePath();
-    const editorReady = await awaitReview(options, () => ensureEditorReadyForOperation(operation, options.baseFileLookup, currentPath));
+    const identityContext = documentIdentityContext(operation.path, options.runProjectId);
+    const editorReady = await awaitReview(options, () => ensureEditorReadyForOperation(operation, options.baseFileLookup, currentPath, options.provenanceReferences, identityContext, options.deadlineAt));
     if (!editorReady.ok) {
       return editorReady;
     }
@@ -639,7 +699,7 @@
       options.baseFileLookup
     ) || { ok: true };
     if (!freshness.ok) {
-      const ready = await awaitReview(options, () => waitForFreshEditorTextForOperation(operation, options.baseFileLookup, 1500));
+      const ready = await awaitReview(options, () => waitForFreshEditorTextForOperation(operation, options.baseFileLookup, 1500, identityContext, options.provenanceReferences));
       if (options.reviewGuard?.()) return options.reviewGuard();
       if (!ready.ok) {
         const decorated = attachWritebackDebug(freshness, 'stale_guard', operation, options.baseFileLookup, current, {
@@ -676,13 +736,13 @@
         return decorated;
       }
       current = ready.text;
-      freshness = { ok: true };
+      freshness = ready.freshness;
     }
 
     let nextContent = null;
     let preparedPatches;
     if (Array.isArray(operation.patches) && operation.patches.length) {
-      preparedPatches = window.CodexOverleafStaleGuard?.prepareOperationPatches(operation, current, options.baseFileLookup)
+      preparedPatches = freshness.preparedPatches || window.CodexOverleafStaleGuard?.prepareOperationPatches(operation, current, options.baseFileLookup)
         || { ok: true, patches: operation.patches };
       const patched = preparedPatches.ok ? applyTextPatches(current, preparedPatches.patches) : preparedPatches;
       if (!patched.ok) {
@@ -728,6 +788,7 @@
       };
     }
 
+    await awaitReview(options, () => settleDocumentProvenance(operation.path, options.provenanceReferences, identityContext, options.deadlineAt));
     if (options.noTraceUndo === true) {
       const blocked = typeof options.recheckWriteProject === 'function'
         ? await options.recheckWriteProject()
@@ -736,12 +797,6 @@
             operationType: 'undo', changedDocument: false,
             userMessage: 'The project identity guard is unavailable; the undo write was not applied.' }) };
       if (blocked) return blocked.skipped?.[0]?.result || blocked;
-      if (getActiveFilePath() !== operation.path || readActiveEditorText() !== current) {
-        const reason = 'The editor changed while confirming Editing mode; the undo write was not applied.';
-        return { ok: false, code: 'stale_source_changed', reason,
-          failure: buildPageFailure('stale_source_changed', { file: operation.path,
-            operationType: 'undo', changedDocument: false, userMessage: reason }) };
-      }
       if (!isEditingConfirmedForNoTraceUndo(getReviewingState({})))
         return buildNoTraceUndoBlockedResult([operation], { ok: false, code: 'editing_not_confirmed',
           reason: 'Overleaf left Editing mode before the undo write.' }).skipped[0].result;
@@ -749,16 +804,40 @@
 
     const finalReviewBlock = options.reviewGuard?.();
     if (finalReviewBlock) return finalReviewBlock;
+    if (Number.isFinite(options.deadlineAt) && now() >= options.deadlineAt)
+      return { ok: false, code: 'writeback_deadline_exceeded', changedDocument: false };
+    if (options.noTraceUndo !== true) {
+      const dispatchBlock = options.recheckEditDispatch?.();
+      if (dispatchBlock) return dispatchBlock;
+      const reviewing = getReviewingState({});
+      if (trackReviewingChanges && !isReviewingConfirmedForWrite(reviewing))
+        return buildReviewingRequiredBlockedResult([operation], reviewing).skipped[0].result;
+      if (!trackReviewingChanges && !isEditingConfirmedForNoTraceUndo(reviewing))
+        return buildEditingRequiredBlockedResult([operation], reviewing).skipped[0].result;
+    }
+    // Read and dispatch synchronously against the same document. Navigation,
+    // freshness polling and Undo mode/project checks can all have awaited.
+    const observedText = readActiveEditorText();
+    const provenance = documentProvenance(operation.path, observedText, options.provenanceReferences, identityContext);
+    const dispatchText = provenance.capture?.text ?? observedText;
+    if (!provenance.ok) return documentMismatchResult(operation.path, provenance);
+    if (getActiveFilePath() !== operation.path || dispatchText !== current) {
+      const reason = 'The editor changed before the edit could be applied; the document was not overwritten.';
+      return { ok: false, code: 'stale_source_changed', reason,
+        failure: buildPageFailure('stale_source_changed', { file: operation.path,
+          operationType: options.noTraceUndo ? 'undo' : 'edit', changedDocument: false, userMessage: reason }) };
+    }
     const result = Array.isArray(operation.patches) && operation.patches.length
-      ? replaceActiveEditorPatches(preparedPatches.patches, nextContent)
-      : replaceActiveEditorText(nextContent);
+      ? replaceActiveEditorPatches(preparedPatches.patches, nextContent, { expectedCapture: provenance.capture })
+      : replaceActiveEditorText(nextContent, { expectedCapture: provenance.capture });
     if (!result.ok) {
       return result;
     }
 
     const verifyWaitMs = Math.min(deps.writeVerifyWaitMs ?? 2500, Number.isFinite(options.deadlineAt)
       ? Math.max(0, options.deadlineAt - now()) : Infinity);
-    const verified = await verifyActiveEditorText(nextContent, operation.path, verifyWaitMs, current);
+    const verified = await verifyActiveEditorText(nextContent, operation.path, verifyWaitMs, current,
+      { ...identityContext, requireIdentity: provenance.identityState === 'match', references: options.provenanceReferences });
     if (!verified.ok) {
       const decorated = attachWritebackDebug(verified, 'write_verification', operation, options.baseFileLookup, readActiveEditorText(), {
         initialActivePath: currentPath,
@@ -827,6 +906,7 @@
           }),
           verified: true,
           verifiedContent: nextContent,
+          ...(preparedPatches ? { appliedPatches: preparedPatches.patches } : {}),
           trackedChanges: mergeTrackedChangeRefs(trackedChanges)
         };
       }
@@ -840,22 +920,25 @@
       ...result,
       verified: true,
       verifiedContent: nextContent,
+      ...(preparedPatches ? { appliedPatches: preparedPatches.patches } : {}),
       trackedChangeCapture,
       trackedChanges: mergeTrackedChangeRefs(trackedChanges)
     };
   }
 
-  async function verifyActiveEditorText(expected, filePath, waitMs = 1000, before) {
+  async function verifyActiveEditorText(expected, filePath, waitMs = 1000, before, identityContext = documentIdentityContext(filePath)) {
     const deadline = Date.now() + waitMs;
-    let actual = readActiveEditorText();
-    while (actual !== expected && Date.now() < deadline) {
-      await delay(50);
+    const fallbackAt = Math.min(deadline, Date.now() + TreeOperations.ACTIVE_EDITOR_STABILITY_MS);
+    let actual, provenance, identityConfirmed = false;
+    while (true) {
       actual = readActiveEditorText();
-    }
-    if (actual === expected) {
-      return {
-        ok: true
-      };
+      provenance = documentProvenance(filePath, actual, identityContext.references, identityContext);
+      actual = provenance.capture?.text ?? actual;
+      identityConfirmed = provenance.ok && getActiveFilePath() === filePath
+        && (provenance.identityState === 'match' || (!identityContext.requireIdentity && Date.now() >= fallbackAt));
+      if (identityConfirmed && actual === expected) return { ok: true };
+      if (Date.now() >= deadline) break;
+      await delay(Math.min(50, deadline - Date.now()));
     }
     return {
       ok: false,
@@ -863,7 +946,8 @@
       reason: `${filePath || '当前文件'} 写入后读回内容和 Codex 预期不一致，已停止把这次操作标记为成功。请刷新 Overleaf 后重试。`,
       expectedLength: String(expected || '').length,
       actualLength: String(actual || '').length,
-      evidence: describeReadbackMismatch(expected, actual, before, filePath)
+      evidence: { ...describeReadbackMismatch(expected, actual, before, filePath),
+        activeMatchesTarget: identityConfirmed, identityState: provenance.identityState }
     };
   }
 
@@ -893,7 +977,8 @@
     return hash.toString(16).padStart(8, '0');
   }
 
-  async function ensureEditorReadyForOperation(operation, baseFileLookup, initialActivePath) {
+  async function ensureEditorReadyForOperation(operation, baseFileLookup, initialActivePath, provenanceReferences,
+    identityContext = documentIdentityContext(operation.path), deadlineAt = Infinity) {
     if (!operation?.path) {
       return {
         ok: true,
@@ -908,6 +993,7 @@
     const currentText = readActiveEditorText();
     const previousEditorIdentity = getActiveEditorIdentity();
     const previousSignature = contentSignature(currentText);
+    const initialProvenance = documentProvenance(filePath, currentText, provenanceReferences, identityContext);
 
     const opened = await openFileByPath(filePath, { force: initialActivePath === filePath });
     if (!opened.ok) {
@@ -952,7 +1038,11 @@
     }
 
     return waitForEditorContentForPath(filePath, previousEditorIdentity, baseFileLookup, 9000, {
+      identityContext,
+      deadlineAt,
       initialActivePath,
+      initialProvenance,
+      provenanceReferences,
       previousSignature,
       forceSettledOpen: true,
       openedMethod: opened.method || ''
@@ -960,52 +1050,43 @@
   }
 
   async function waitForEditorContentForPath(filePath, previousEditorIdentity, baseFileLookup, timeoutMs, options = {}) {
-    const deadline = Date.now() + timeoutMs;
+    const deadline = Math.min(options.deadlineAt ?? Infinity, Date.now() + timeoutMs);
     const startedAt = Date.now();
+    const identityDeadline = Math.min(deadline, startedAt + Math.min(1500, writebackOpenSettleMs || TreeOperations.ACTIVE_EDITOR_STABILITY_MS));
     const minSettleMs = options.forceSettledOpen ? writebackOpenSettleMs : 0;
     let lastText = readActiveEditorText();
     let lastActivePath = getActiveFilePath();
+    let mismatch = null;
     while (Date.now() < deadline) {
       lastActivePath = getActiveFilePath();
       lastText = readActiveEditorText();
       const activeFileMatches = lastActivePath === filePath;
       const identityChanged = Boolean(previousEditorIdentity) && activeEditorIdentityChanged(previousEditorIdentity);
-      const baseComparison = compareEditorTextToBase(filePath, lastText, baseFileLookup);
-      const baseMatches = baseComparison.matches;
       const settledLongEnough = Date.now() - startedAt >= minSettleMs;
       const contentChangedFromPrevious = !options.previousSignature
         || contentSignature(lastText) !== options.previousSignature;
-      // Switch confirmation must not depend on any single fragile signal
-      // (v1.6: identity comparison proved unreliable against newer Overleaf
-      // view lifecycles, which made every write to a non-active file time
-      // out as target_editor_not_ready). Acceptors, strongest first:
-      //   1. editor identity visibly changed (fast path when it works);
-      //   2. the editor shows EXACTLY the target file's expected base —
-      //      the strongest possible proof the right document is loaded;
-      //   3. same-file reopen settled with unchanged content;
-      //   4. base UNKNOWN only: the content moved off the previous document
-      //      and the settle window elapsed. When the base IS known, content
-      //      must match it (acceptor 2) — a weakly-anchored patch (e.g. an
-      //      insert into an empty file, expected:'') would otherwise anchor
-      //      trivially into a wrong-but-different document.
-      const switchConfirmed = identityChanged
-        || baseMatches
-        || (options.initialActivePath === filePath
-          && options.previousSignature
-          && contentSignature(lastText) === options.previousSignature
-          && settledLongEnough)
-        || (!baseComparison.known && contentChangedFromPrevious && settledLongEnough);
-      const contentNoLongerLooksLikePreviousDocument = contentChangedFromPrevious
-        || baseMatches
-        || options.initialActivePath === filePath;
-      if (activeFileMatches && switchConfirmed && settledLongEnough && contentNoLongerLooksLikePreviousDocument) {
+      const provenance = documentProvenance(filePath, lastText, options.provenanceReferences, options.identityContext);
+      lastText = provenance.capture?.text ?? lastText;
+      mismatch = provenance.ok ? null : provenance;
+      // Confirm navigation independently of source freshness. A stale target
+      // can be correctly open; identical baseline bytes alone cannot prove a
+      // switch. Content movement remains the fallback for editor lifecycles
+      // whose document identity cannot be observed reliably.
+      const switchConfirmed = provenance.identityState === 'match' || identityChanged
+        || (options.initialActivePath === filePath && Boolean(previousEditorIdentity)
+          && options.initialProvenance?.ok === true && provenance.ok)
+        || (contentChangedFromPrevious && settledLongEnough);
+      if (activeFileMatches && switchConfirmed && settledLongEnough && provenance.ok
+        && (provenance.identityState === 'match' || Date.now() >= identityDeadline)) {
         return {
           ok: true,
-          text: lastText
+          text: lastText,
+          capture: provenance.capture
         };
       }
-      await delay(100);
+      await delay(Math.max(0, Math.min(100, deadline - Date.now())));
     }
+    if (mismatch) return documentMismatchResult(filePath, mismatch);
     // §9.1: if the active file ended up on a different document, this is
     // target_file_not_active; if the file did become active but the editor
     // document never settled, this is target_editor_not_ready.
@@ -1050,21 +1131,30 @@
     const minSettleMs = options.forceSettledOpen ? writebackOpenSettleMs : 0;
     let lastText = readActiveEditorText();
     let lastActivePath = getActiveFilePath();
+    const identityContext = options.identityContext || documentIdentityContext(filePath);
+    let mismatch = null;
     while (Date.now() < deadline) {
       lastActivePath = getActiveFilePath();
       lastText = readActiveEditorText();
+      const provenance = documentProvenance(filePath, lastText, options.references, identityContext);
+      lastText = provenance.capture?.text ?? lastText;
+      mismatch = provenance.ok ? null : provenance;
       const activeFileMatches = lastActivePath === filePath;
       const identityChanged = Boolean(previousEditorIdentity) && activeEditorIdentityChanged(previousEditorIdentity);
       const settledLongEnough = Date.now() - startedAt >= minSettleMs;
       const sameFileReopenSettled = options.initialActivePath === filePath && settledLongEnough;
-      if (activeFileMatches && settledLongEnough && (identityChanged || sameFileReopenSettled)) {
+      if (activeFileMatches && settledLongEnough && provenance.ok
+        && (provenance.identityState === 'match' || Date.now() - startedAt >= TreeOperations.ACTIVE_EDITOR_STABILITY_MS)
+        && (provenance.identityState === 'match' || identityChanged || sameFileReopenSettled)) {
         return {
           ok: true,
-          text: lastText
+          text: lastText,
+          capture: provenance.capture
         };
       }
-      await delay(100);
+      await delay(Math.max(0, Math.min(100, deadline - Date.now())));
     }
+    if (mismatch) return documentMismatchResult(filePath, mismatch);
     return {
       ok: false,
       code: 'editor_document_not_switched',
@@ -1074,69 +1164,32 @@
     };
   }
 
-  function editorContentMatchesBase(filePath, content, baseFileLookup) {
-    return compareEditorTextToBase(filePath, content, baseFileLookup).matches;
-  }
-
-  function compareEditorTextToBase(filePath, content, baseFileLookup) {
-    const normalizedPath = normalizeSafeProjectPath(filePath);
-    const current = normalizeEditorTextForComparison(content);
-    if (!baseFileLookup || !normalizedPath || !baseFileLookup.has(normalizedPath)) {
-      return {
-        known: false,
-        hasContent: false,
-        matches: false,
-        baseLength: null,
-        currentLength: current.length
-      };
-    }
-    const base = normalizeEditorTextForComparison(baseFileLookup.get(normalizedPath));
-    const matches = current === base;
-    if (!matches && base.trim().length > 0) {
-      console.warn('[codex-overleaf] editorContentMatchesBase MISMATCH', filePath,
-        'base.length:', base.length, 'current.length:', current.length,
-        'base[0..80]:', JSON.stringify(base.slice(0, 80)),
-        'current[0..80]:', JSON.stringify(current.slice(0, 80)));
-    }
-    return {
-      known: true,
-      hasContent: base.trim().length > 0,
-      matches,
-      baseLength: base.length,
-      currentLength: current.length
-    };
-  }
-
-  function hasBaseFileContent(filePath, baseFileLookup) {
-    if (!baseFileLookup || !filePath || !baseFileLookup.has(filePath)) {
-      return false;
-    }
-    const content = baseFileLookup.get(filePath);
-    return typeof content === 'string' && content.trim().length > 0;
-  }
-
   function normalizeEditorTextForComparison(value) {
     const normalized = String(value ?? '').replace(/\r\n/g, '\n');
     return normalized.trim().length === 0 ? '' : normalized;
   }
 
-  async function waitForFreshEditorTextForOperation(operation, baseFileLookup, waitMs = 1500) {
+  async function waitForFreshEditorTextForOperation(operation, baseFileLookup, waitMs = 1500, identityContext, references) {
     const deadline = Date.now() + Math.max(0, Number(waitMs) || 0);
     while (Date.now() < deadline) {
       if (operation?.path && getActiveFilePath() !== operation.path) {
         await delay(60);
         continue;
       }
-      const text = readActiveEditorText();
+      const observed = readActiveEditorText();
+      const provenance = documentProvenance(operation.path, observed, references, identityContext);
+      const text = provenance.capture?.text ?? observed;
       const freshness = window.CodexOverleafStaleGuard?.checkOperationFreshness(
         operation,
         text,
         baseFileLookup
       ) || { ok: true };
-      if (freshness.ok) {
+      if (freshness.ok && provenance.ok) {
         return {
           ok: true,
-          text
+          text,
+          freshness,
+          capture: provenance.capture
         };
       }
       await delay(60);
@@ -1485,6 +1538,7 @@
     const expected = options.baseFileLookup?.get(operation.path);
     const text = proof?.v === 1 && proof.kind === 'text' && typeof expected === 'string';
     const binary = proof?.v === 1 && proof.kind === 'binary' && /^[a-f0-9]{64}$/i.test(proof.sha256 || '');
+    const identityContext = documentIdentityContext(operation.path, projectId);
     const isCurrent = () => Boolean(projectId) && projectId === options.runProjectId
       && treeOperations.getProjectId?.() === projectId && readWriteCancellationSequence() === cancellation && !options.reviewGuard?.();
     if (!isCurrent() || (!text && !binary) || typeof deps.deleteTextFile !== 'function') {
@@ -1492,7 +1546,7 @@
         reason: 'Verified created-file deletion is unavailable for this run.' };
     }
     if (text && projectPathExists(operation.path)) {
-      const current = await readCurrentTextFileForFreshness(operation.path);
+      const current = await readCurrentTextFileForFreshness(operation.path, options.baseFileLookup);
       if (!current.ok || current.text !== expected || !isCurrent()) {
         return { ok: false, code: 'undo_operation_failed', changedDocument: false,
           reason: 'The created file changed after this run and was left untouched.' };
@@ -1501,9 +1555,10 @@
     const result = await deps.deleteTextFile(operation, {
       isCurrent, undoCreatedFile: true, deadlineAt: options.deadlineAt,
       expectedContent: text ? expected : undefined,
-      prepareTextPreimage: text ? () => readCurrentTextFileForFreshness(operation.path) : undefined,
+      prepareTextPreimage: text ? () => readCurrentTextFileForFreshness(operation.path, options.baseFileLookup) : undefined,
       expectedSha256: binary ? proof.sha256.toLowerCase() : undefined,
       canDelete: () => isCurrent() && (binary || (treeOperations.getActiveFilePath?.() === operation.path
+        && documentProvenance(operation.path, readActiveEditorText(), options.baseFileLookup, identityContext).ok
         && readActiveEditorText() === expected))
     });
     if (!result.ok) return result;
@@ -1606,7 +1661,7 @@
       };
     }
 
-    const current = await readCurrentTextFileForFreshness(operation.path);
+    const current = await readCurrentTextFileForFreshness(operation.path, baseFileLookup);
     if (!current.ok) {
       return current;
     }
@@ -1633,13 +1688,14 @@
     return { ok: true };
   }
 
-  async function readCurrentTextFileForFreshness(filePath) {
+  async function readCurrentTextFileForFreshness(filePath, references) {
     const normalizedPath = normalizeSafeProjectPath(filePath);
     if (!normalizedPath) {
       return invalidProjectPathResult('freshness path');
     }
     const currentPath = getActiveFilePath();
     const previousEditorIdentity = getActiveEditorIdentity();
+    const identityContext = documentIdentityContext(normalizedPath);
     const opened = await openFileByPath(normalizedPath, { force: true });
     if (!opened.ok) {
       return {
@@ -1649,6 +1705,8 @@
       };
     }
     const ready = await waitForEditorDocumentForPath(normalizedPath, previousEditorIdentity, 9000, {
+      identityContext,
+      references,
       initialActivePath: currentPath,
       forceSettledOpen: true
     });
@@ -1895,6 +1953,7 @@
           ok: false,
           code: reviewing?.code || 'reviewing_not_enabled',
           reason: reviewing?.reason || 'Overleaf Reviewing/Track Changes was not confirmed before writing. Codex did not change this file.',
+          evidence: reviewing?.evidence, failure: reviewing?.failure,
           reviewing: reviewing?.reviewing || null
         }
       })),