codex-overleaf-link 2.5.1 → 2.6.5

package/extension/src/shared/storageDb.js

@@ -1,7 +1,7 @@
 (function initStorageDb(root, factory) {
   if (typeof module === 'object' && module.exports) {
     module.exports = factory(require('./storageRunActions'), require('./runInputQueue'),
-      require('./settlementFacts'), require('./storageSessionClaims'), require('./sessionState'), require('./runActivityModel'), require('./sharedSessionBridge'), require('./subagentActivityModel'), require('./storageValuePruning'), require('./composerAttachmentDraft'), require('./sharedSessionTransfer'));
+      require('./settlementFacts'), require('./storageSessionClaims'), require('./sessionState'), require('./runActivityModel'), require('./sharedSessionBridge'), require('./subagentActivityModel'), require('./storageValuePruning'), require('./composerAttachmentDraft'), require('./sharedSessionTransfer'), require('./contextUsage'));
   } else {
     root.CodexOverleafModuleRegistry.define('StorageDb', [
       'StorageRunActions',
@@ -14,10 +14,11 @@
       'SubagentActivityModel',
       'StorageValuePruning',
       'ComposerAttachmentDraft',
-      'SharedSessionTransfer'
+      'SharedSessionTransfer',
+      'ContextUsage'
     ], factory);
   }
-})(typeof globalThis !== 'undefined' ? globalThis : window, function storageDbFactory(StorageRunActions, RunInputQueue, SettlementFacts, StorageSessionClaims, SessionState, RunActivityModel, SharedSessionBridge, SubagentActivityModel, StorageValuePruning, ComposerAttachmentDraft, SharedSessionTransfer) {
+})(typeof globalThis !== 'undefined' ? globalThis : window, function storageDbFactory(StorageRunActions, RunInputQueue, SettlementFacts, StorageSessionClaims, SessionState, RunActivityModel, SharedSessionBridge, SubagentActivityModel, StorageValuePruning, ComposerAttachmentDraft, SharedSessionTransfer, ContextUsage) {
   'use strict';
   const { removeEmptySummaryFields, removeEmptyFields } = StorageValuePruning;
   if (!StorageRunActions?.compactRunsForStorage || !StorageRunActions?.compactRunActionPayload || !StorageRunActions?.compactProviderSnapshot || !StorageRunActions?.compactRunExecutionSnapshot || !StorageRunActions?.compactStructuredEventValue || !StorageRunActions?.hashString || !RunInputQueue?.compactForStorage || !SettlementFacts?.compactSettlementFacts || !StorageSessionClaims?.createSessionClaimer) {
@@ -276,6 +277,7 @@
       title: normalizeSessionTitleForStorage(input.title, titleSource),
       titleSource: titleSource,
       codexThreadId: typeof input.codexThreadId === 'string' ? input.codexThreadId : '',
+      contextUsage: ContextUsage.normalize(input.contextUsage),
       forkedFromSessionId: normalizeTextField(input.forkedFromSessionId, 160),
       forkedFromRunId: normalizeTextField(input.forkedFromRunId, 160),
       status: typeof input.status === 'string' && input.status ? input.status : 'active',
@@ -303,6 +305,17 @@
       accountScopeUnavailable: accountScopeUnavailable,
       safeTaskSummary: safeTaskSummary
     };
+    // Optional provenance for the automatic clear of one captured submission.
+    // It is envelope metadata, not run/review authority; no schema migration is needed.
+    if (record.task === '' && typeof input.draftConsumption?.task === 'string'
+      && input.draftConsumption.task && typeof input.draftConsumption.runId === 'string'
+      && input.draftConsumption.runId && record.runs.some(run => run.id === input.draftConsumption.runId
+        && !run.forkSnapshot && run.runProjectId === record.projectId)) {
+      record.draftConsumption = {
+        runId: input.draftConsumption.runId,
+        task: normalizeDisplayTextForStorage(input.draftConsumption.task, SESSION_STORAGE_LIMITS.taskChars)
+      };
+    }
     if (options.preserveRunActionPayload === true) {
       // Count the real display record before allocating recovery space. Adding
       // older checkpoints must not make an otherwise valid history unwritable.
@@ -436,6 +449,8 @@
       turnId: typeof input.turnId === 'string' ? input.turnId : '',
       createdAt: typeof input.createdAt === 'string' ? input.createdAt : now,
       completedAt: typeof input.completedAt === 'string' ? input.completedAt : '',
+      requireReviewing: typeof input.requireReviewing === 'boolean' ? input.requireReviewing : undefined,
+      trackingDecision: ['continue', 'disable'].includes(input.trackingDecision) ? input.trackingDecision : '',
       mode: typeof input.mode === 'string' ? input.mode : '', ...StorageRunActions.compactProviderSnapshot(input),
       model: typeof input.model === 'string' ? input.model : '',
       reasoningEffort: typeof input.reasoningEffort === 'string' ? input.reasoningEffort : '',
@@ -708,7 +723,9 @@
       undoStatus: normalizeDisplayTextForStorage(run.undoStatus, SESSION_STORAGE_LIMITS.statusTextChars),
       ...(run.undoOwnerProtocol === 1 ? { undoOwnerProtocol: 1 } : {}),
       nativeRequestId: normalizeTextField(run.nativeRequestId, 160),
+      ...(run.operation === 'compact' ? { operation: 'compact' } : {}),
       codexThreadId: normalizeTextField(run.codexThreadId, 160), codexTurnId: normalizeTextField(run.codexTurnId, 160),
+      contextUsage: run.forkSnapshot === true ? null : ContextUsage.normalize(run.contextUsage),
       nativeEventSeq: Number.isFinite(Number(run.nativeEventSeq)) ? Number(run.nativeEventSeq) : 0,
       queueItemId: normalizeTextField(run.queueItemId, 160)
     };
@@ -775,6 +792,19 @@
         if (event.failure) {
           compact.failure = compactStructuredEventValueForStorage(event.failure, 0);
         }
+        if (Array.isArray(event.compileErrors) && event.compileErrors.length) {
+          compact.compileErrors = event.compileErrors.slice(0, 5)
+            .map(item => normalizeDisplayTextForStorage(String(item), SESSION_STORAGE_LIMITS.detailChars))
+            .filter(Boolean);
+        }
+        if (Array.isArray(event.rejectedHunks) && event.rejectedHunks.length) {
+          compact.rejectedHunks = event.rejectedHunks.slice(0, 10)
+            .map(item => ({
+              path: normalizeDisplayTextForStorage(String(item?.path || ''), SESSION_STORAGE_LIMITS.pathChars),
+              summary: normalizeDisplayTextForStorage(String(item?.summary || ''), SESSION_STORAGE_LIMITS.detailChars)
+            }))
+            .filter(item => item.path);
+        }
         return compact;
       });
   }
@@ -1343,6 +1373,8 @@
     projectRetentionWarnings: StorageRunActions.projectRetentionWarnings,
     projectRetentionUpdates: StorageRunActions.projectRetentionUpdates,
     mergeSessionReviewState: StorageRunActions.mergeSessionReviewState,
+    copyRunReviewState: StorageRunActions.copyRunReviewState,
+    reviewStateSnapshot: StorageRunActions.reviewStateSnapshot,
     buildTurnRecord: buildTurnRecord,
     buildEventRecord: buildEventRecord,
     buildArtifactRecord: buildArtifactRecord,

package/extension/src/shared/storageMigration.js

@@ -19,9 +19,105 @@
     'experimentalOtByProject',
     'customInstructionsByProject',
     'governanceRulesByProject',
+    'reviewingAvailabilityByProject',
     'selectedLocalSkillIdsByProject'
   ];
   var projectPreferenceLockTails = {};
+  var projectPreferenceBaselines = new Map();
+  var projectPreferenceIntents = new Map();
+  var projectPreferenceBaselineVersions = new WeakMap();
+
+  function getProjectPreferenceBaseline(accountScopeId, projectId) {
+    var key = buildScopedProjectPreferenceKey(accountScopeId, projectId);
+    var baseline = copyPreferenceValue(projectPreferenceBaselines.get(key));
+    var intents = projectPreferenceIntents.get(key);
+    if (baseline && intents) projectPreferenceBaselineVersions.set(baseline, {
+      owner: intents, versions: Object.assign({}, intents.acknowledged)
+    });
+    return baseline;
+  }
+
+  function adoptProjectPreferenceBaseline(prefs, accountScopeId, projectId) {
+    var key = buildScopedProjectPreferenceKey(accountScopeId, projectId);
+    if (key) {
+      projectPreferenceBaselines.set(key, copyPreferenceValue(prefs));
+      projectPreferenceIntents.set(key, { revision: 0, fields: {}, acknowledged: {} });
+    }
+  }
+
+  function captureProjectPreferenceWrite(input) {
+    var projectId = input.projectId;
+    var key = buildScopedProjectPreferenceKey(input.accountScopeId, projectId);
+    if (!key) return null;
+    var intents = projectPreferenceIntents.get(key);
+    if (!intents) {
+      intents = { revision: 0, fields: {}, acknowledged: {} };
+      projectPreferenceIntents.set(key, intents);
+    }
+    function values(prefs) {
+      return {
+        experimentalOtByProject: input.normalizeExperimentalOtByProject(prefs.experimentalOtByProject)[projectId] === true,
+        reviewingAvailabilityByProject: prefs.reviewingAvailabilityByProject?.[projectId],
+        governanceRulesByProject: input.normalizeGovernanceRulesByProject({
+          [projectId]: prefs.governanceRulesByProject?.[projectId] || {}
+        })[projectId],
+        customInstructionsByProject: input.normalizeCustomInstructionsByProject({
+          [projectId]: prefs.customInstructionsByProject?.[projectId] || ''
+        })[projectId]
+      };
+    }
+    var baseline = input.baseline || getProjectPreferenceBaseline(input.accountScopeId, projectId);
+    var captured = projectPreferenceBaselineVersions.get(baseline);
+    var versions = captured?.owner === intents ? captured.versions : {};
+    var previous = values(baseline || {});
+    var current = values(input.state);
+    var token = { key: key, owner: intents, projectId: projectId, fields: {}, versions: {}, written: [] };
+    for (var name of Object.keys(current)) {
+      var latest = intents.fields[name];
+      // A pending or later local intent supersedes the older captured read.
+      // Peer adoption alone does not turn an unchanged queued snapshot into an edit.
+      var reference = latest && latest.revision > (versions[name] || 0) ? latest.value : previous[name];
+      if (JSON.stringify(current[name]) !== JSON.stringify(reference)) {
+        latest = { revision: ++intents.revision, value: copyPreferenceValue(current[name]), dirty: true };
+        intents.fields[name] = latest;
+      }
+      token.fields[name] = latest && JSON.stringify(current[name]) === JSON.stringify(latest.value) ? latest : null;
+      token.versions[name] = latest?.revision || 0;
+    }
+    return token;
+  }
+
+  function projectPreferencePatch(token, accountScopeId, projectId) {
+    if (token.key !== buildScopedProjectPreferenceKey(accountScopeId, projectId)) {
+      throw Object.assign(new Error('Scoped project preferences require account and project identity.'), {
+        code: 'account_scope_unavailable'
+      });
+    }
+    var current = projectPreferenceIntents.get(token.key) === token.owner;
+    var patch = {};
+    token.written = [];
+    for (var name of Object.keys(token.fields)) {
+      var intent = token.fields[name];
+      var changed = current && intent?.dirty && token.owner.fields[name] === intent;
+      patch[name] = changed ? { [token.projectId]: copyPreferenceValue(intent.value) } : {};
+      if (changed) token.written.push(name);
+    }
+    return patch;
+  }
+
+  function completeProjectPreferenceWrite(token, prefs) {
+    if (projectPreferenceIntents.get(token.key) !== token.owner) return [];
+    for (var name of token.written) {
+      var intent = token.fields[name];
+      intent.dirty = false;
+      token.owner.acknowledged[name] = Math.max(token.owner.acknowledged[name] || 0, intent.revision);
+    }
+    projectPreferenceBaselines.set(token.key, copyPreferenceValue(prefs));
+    return Object.keys(token.fields).filter(function (name) {
+      var latest = token.owner.fields[name];
+      return (latest?.revision || 0) === token.versions[name] && !latest?.dirty;
+    });
+  }
 
   function buildScopedProjectPreferenceKey(accountScopeId, projectId) {
     var account = compactScopePart(accountScopeId);
@@ -130,7 +226,12 @@
         ? incoming[mapName]
         : {};
       if (Object.prototype.hasOwnProperty.call(incomingMap, projectId)) {
-        storedMap[scopedKey] = copyPreferenceValue(incomingMap[projectId]);
+        const previous = storedMap[scopedKey], observation = incomingMap[projectId];
+        if (mapName !== 'reviewingAvailabilityByProject'
+          || !(Number(previous?.observedAt) > Number(observation?.observedAt)
+            || (previous?.observedAt === observation?.observedAt && previous?.status === 'available'))) {
+          storedMap[scopedKey] = copyPreferenceValue(observation);
+        }
       }
       delete storedMap[projectId];
       next[mapName] = storedMap;
@@ -164,6 +265,7 @@
       var visible = await StorageDb.claimSessionsForAccount(projectId, account, deleted);
       function result(currentPrefs, sessions, migrated) {
         var wanted = currentPrefs.activeSessionByProject?.[projectId] || '';
+        adoptProjectPreferenceBaseline(currentPrefs, account, projectId);
         return { prefs: currentPrefs, sessions: sessions,
           activeSessionId: sessions.some(session => session.id === wanted) ? wanted : sessions.at(-1)?.id || '',
           migrated: migrated };
@@ -254,7 +356,9 @@
       return chrome.storage.local.get([PREFS_KEY]).then(function (stored) {
         var claimed = claimLegacyProjectPreferences(stored[PREFS_KEY] || {}, account, project);
         var next = mergeScopedProjectPreferences(claimed.prefs, prefs, account, project);
-        return chrome.storage.local.set({ [PREFS_KEY]: next });
+        return chrome.storage.local.set({ [PREFS_KEY]: next }).then(function () {
+          return buildProjectPreferenceView(next, account, project);
+        });
       });
     });
   }
@@ -458,6 +562,11 @@
     runMigrationIfNeeded: runMigrationIfNeeded,
     savePrefs: savePrefs,
     loadPrefs: loadPrefs,
+    getProjectPreferenceBaseline: getProjectPreferenceBaseline,
+    adoptProjectPreferenceBaseline: adoptProjectPreferenceBaseline,
+    captureProjectPreferenceWrite: captureProjectPreferenceWrite,
+    projectPreferencePatch: projectPreferencePatch,
+    completeProjectPreferenceWrite: completeProjectPreferenceWrite,
     loadSessionTombstones: loadSessionTombstones,
     addSessionTombstones: addSessionTombstones,
     getDeletedSessionIds: getDeletedSessionIds,

package/extension/src/shared/storageRunActions.js

@@ -1,10 +1,10 @@
 (function initStorageRunActions(root, factory) {
   if (typeof module === 'object' && module.exports) {
-    module.exports = factory(require('./selectionContext'), require('./writebackIntent'), require('./writingStyle'), require('./directoryCleanupProof'));
+    module.exports = factory(require('./selectionContext'), require('./writebackIntent'), require('./writingStyle'), require('./directoryCleanupProof'), require('./undoOperations'));
   } else {
-    root.CodexOverleafModuleRegistry.define('StorageRunActions', ['SelectionContext', 'WritebackIntent', 'WritingStyle', 'DirectoryCleanupProof'], factory);
+    root.CodexOverleafModuleRegistry.define('StorageRunActions', ['SelectionContext', 'WritebackIntent', 'WritingStyle', 'DirectoryCleanupProof', 'UndoOperations'], factory);
   }
-})(typeof globalThis !== 'undefined' ? globalThis : window, function storageRunActionsFactory(SelectionContext, WritebackIntent, WritingStyle, DirectoryCleanupProof) {
+})(typeof globalThis !== 'undefined' ? globalThis : window, function storageRunActionsFactory(SelectionContext, WritebackIntent, WritingStyle, DirectoryCleanupProof, UndoOperations) {
   'use strict';
 
   // Share a bounded budget across the retained history, rather than expiring
@@ -129,7 +129,7 @@
       && Array.isArray(run.undoExpectedFiles) && run.undoExpectedFiles.length > 0
       && Array.isArray(run.appliedOperations) && run.appliedOperations.length > 0;
     var legacyUndo = Array.isArray(run && run.undoOperations) && run.undoOperations.length > 0;
-    return trackedLifecycle || reviewingEditorUndo || legacyUndo;
+    return trackedLifecycle || reviewingEditorUndo || legacyUndo || UndoOperations.getUndoUnavailableFiles(run).length > 0;
   }
 
   function runDirectoryCleanup(run) {
@@ -186,7 +186,7 @@
   }
 
   function compactCoreActionPayload(run, keepActionPayload, options = {}) {
-    var empty = emptyActionPayload();
+    var empty = { ...emptyActionPayload(), appliedOperations: UndoOperations.compactUnavailableUndoOperations(run) };
     if (!keepActionPayload || !hasReloadableRunActionPayload(run)) {
       if (hasReloadableRunActionPayload(run)) empty.recoveryRetention = omitted('fallback');
       else if (run?.recoveryRetention?.state === 'omitted' && !run.forkSnapshot
@@ -308,11 +308,48 @@
     return out;
   }
 
-  // Review terminal states are monotonic even when a later session snapshot is stale.
-  function mergeSessionReviewState(incoming, existing, reviewRunIds) {
+  const REVIEW_FIELDS = ['trackedChangeStatus', 'undoStatus', 'undoOwnerProtocol', 'undoTrackedChanges', 'undoExpectedFiles',
+    'undoOperations', 'undoBaseFiles', 'appliedOperations', 'trackedChangeCaptures', 'recoveryRetention',
+    'interruptedDraft', 'retryWriteback', 'saveCheck'];
+  const REVIEW_FACT_FIELDS = ['documentEffect', 'fileSettlements', 'failures', 'recoveryAvailability', 'recoveryDisposition'];
+  const terminalReview = run => ['accepted', 'rejected'].includes(run?.trackedChangeStatus) || run?.undoStatus === 'applied';
+  const factsOf = run => run?.settlement || run?.settlementFacts || {};
+
+  function copyRunReviewState(target, source) {
+    const merged = { ...target };
+    const copyFields = (into, from, fields) => {
+      for (const field of fields) {
+        if (Object.hasOwn(from, field)) into[field] = JSON.parse(JSON.stringify(from[field]));
+        else delete into[field];
+      }
+    };
+    copyFields(merged, source, REVIEW_FIELDS);
+    const sourceFacts = factsOf(source), targetFacts = factsOf(target);
+    const facts = { ...targetFacts };
+    copyFields(facts, sourceFacts, REVIEW_FACT_FIELDS);
+    const sourceEvidence = sourceFacts.evidence || {};
+    const evidence = { ...(targetFacts.evidence || {}) };
+    copyFields(evidence, sourceEvidence, [...new Set([...Object.keys(evidence), ...Object.keys(sourceEvidence)])]
+      .filter(key => !['mirrored', 'compiled'].includes(key)));
+    if (Object.keys(evidence).length) facts.evidence = evidence; else delete facts.evidence;
+    delete merged.settlementFacts;
+    if (Object.keys(facts).length) merged.settlement = facts; else delete merged.settlement;
+    return merged;
+  }
+
+  function reviewStateSnapshot(run) {
+    const facts = factsOf(run);
+    return JSON.stringify([REVIEW_FIELDS.map(key => run?.[key]), REVIEW_FACT_FIELDS.map(key => facts[key]),
+      Object.entries(facts.evidence || {}).filter(([key]) => !['mirrored', 'compiled'].includes(key))
+        .sort(([a], [b]) => a.localeCompare(b))]);
+  }
+
+  // Shared submissions retain the caller's envelope and private baseline. The
+  // legacy site-local path explicitly keeps its historical timestamp merge.
+  function mergeSessionReviewState(incoming, existing, reviewRunIds, options = {}) {
     if (!existing || incoming.id !== existing.id || incoming.projectId !== existing.projectId
       || !incoming.accountScopeId || incoming.accountScopeId !== existing.accountScopeId) return incoming;
-    var terminal = run => ['accepted', 'rejected'].includes(run?.trackedChangeStatus) || run?.undoStatus === 'applied';
+    var terminal = terminalReview;
     var incomingRuns = new Map((incoming.runs || []).map(run => [run.id, run]));
     var existingRuns = new Map((existing.runs || []).map(run => [run.id, run]));
     var requestedIds = new Set(reviewRunIds || []);
@@ -321,6 +358,21 @@
       return ['accepted', 'rejected', 'needs_review'].includes(run?.trackedChangeStatus)
         || ['applied', 'partial'].includes(run?.undoStatus);
     });
+    if (options.shared !== false) {
+      const runs = (incoming.runs || []).map(run => {
+        const previous = existingRuns.get(run.id);
+        const source = terminal(previous) ? previous : null;
+        if (!source || (source.runProjectId && source.runProjectId !== incoming.projectId)) return run;
+        // The same decision can still gain save/recovery evidence. Let the
+        // three-way merge retain those edits and reject genuine collisions.
+        if (run.trackedChangeStatus === source.trackedChangeStatus && run.undoStatus === source.undoStatus) return run;
+        // An absent local settlement has no edits to its metadata or auxiliary
+        // evidence. Retain the stored container as well as the terminal fields.
+        const target = !run.settlement && !run.settlementFacts ? { ...run, settlement: factsOf(source) } : run;
+        return copyRunReviewState(target, source);
+      });
+      return { ...incoming, runs };
+    }
     var newer = (Date.parse(incoming.updatedAt) || 0) >= (Date.parse(existing.updatedAt) || 0);
     if (!newer && !explicitReview) return incoming;
     var base = newer ? incoming : existing;
@@ -404,6 +456,8 @@
     compactSessionBatchActions: compactSessionBatchActions,
     compactStructuredEventValue: compactStructuredEventValue,
     mergeSessionReviewState: mergeSessionReviewState,
+    copyRunReviewState: copyRunReviewState,
+    reviewStateSnapshot: reviewStateSnapshot,
     compactRunsForStorage: compactRunsForStorage,
     compactRunActionPayload: compactRunActionPayload,
     compactProviderSnapshot: compactProviderSnapshot,

package/extension/src/shared/undoOperations.js

@@ -8,6 +8,41 @@
   'use strict';
 
   function buildUndoOperations(project, appliedOperations) {
+    return buildUndoPlan(project, appliedOperations).undoOperations;
+  }
+
+  function getUndoUnavailableFiles(run = {}) {
+    const payload = run.recoveryPayload || run;
+    const files = new Map();
+    for (const operation of payload.appliedOperations || []) {
+      const reason = operation?.undoUnavailable;
+      if (typeof reason?.path === 'string' && reason.path === operation?.path
+        && ['stale_source_changed', 'snapshot_undo_unavailable'].includes(reason.code)) {
+        files.set(reason.path, { path: reason.path, code: reason.code });
+      }
+    }
+    return [...files.values()];
+  }
+
+  function withAvailableUndo(run = {}) {
+    const unavailable = new Set(getUndoUnavailableFiles(run).map(item => item.path));
+    if (!unavailable.size) return run;
+    const result = { ...run };
+    for (const field of ['undoOperations', 'undoBaseFiles', 'undoExpectedFiles', 'undoTrackedChanges', 'trackedChangeCaptures']) {
+      result[field] = (run[field] || []).filter(item => !unavailable.has(item?.path) && !unavailable.has(item?.to));
+    }
+    return result;
+  }
+
+  // Fallback history keeps only bounded reasons, never document bytes or
+  // authority to reconstruct a withheld checkpoint.
+  function compactUnavailableUndoOperations(run = {}) {
+    if (run.forkSnapshot || run.undoStatus === 'applied' || ['accepted', 'rejected'].includes(run.trackedChangeStatus)) return [];
+    return getUndoUnavailableFiles(run).filter(item => item.path.length <= 1024).slice(0, 100)
+      .map(item => ({ type: 'edit', path: item.path, undoUnavailable: item }));
+  }
+
+  function buildUndoPlan(project, appliedOperations) {
     const workingFilesByPath = new Map();
     for (const file of project?.files || []) {
       if (typeof file?.path === 'string' && typeof file.content === 'string') {
@@ -17,6 +52,10 @@
 
     const sourceFilesByPath = new Map(workingFilesByPath);
     const undo = [];
+    const inverseBases = new Map();
+    const mappedPaths = new Set((appliedOperations || []).filter(operation => Array.isArray(operation?.appliedPatches))
+      .map(operation => operation.path));
+    const unavailable = new Map(getUndoUnavailableFiles({ appliedOperations }).map(item => [item.path, item.code]));
     const fullRestoreEditPaths = new Set();
 
     for (const operation of appliedOperations || []) {
@@ -30,23 +69,33 @@
         }
         const currentBeforeEdit = workingFilesByPath.get(operation.path);
         if (!fullRestoreEditPaths.has(operation.path)) {
-          const inversePatches = buildInverseTextPatches(sourceFilesByPath.get(operation.path), operation.patches,
-            operation.verifiedContent, operation.path);
+          const hasAppliedPatches = Array.isArray(operation.appliedPatches) && typeof operation.verifiedContent === 'string';
+          const inversePatches = hasAppliedPatches
+            ? buildVerifiedInversePatches(operation.appliedPatches, operation.verifiedContent)
+            : buildInverseTextPatches(sourceFilesByPath.get(operation.path), operation.patches,
+              operation.verifiedContent, operation.path);
+          let inverse;
           if (inversePatches.length) {
-            undo.push(normalizeUndoOperation({
+            inverse = normalizeUndoOperation({
               type: 'edit',
               path: operation.path,
               patches: inversePatches,
               reason: 'Undo edit'
-            }));
-          } else {
+            });
+          } else if (!hasAppliedPatches) {
             fullRestoreEditPaths.add(operation.path);
-            undo.push(normalizeUndoOperation({
+            inverse = normalizeUndoOperation({
               type: 'edit',
               path: operation.path,
               replaceAll: currentBeforeEdit,
               reason: 'Undo edit'
-            }));
+            });
+          } else {
+            unavailable.set(operation.path, 'snapshot_undo_unavailable');
+          }
+          if (inverse) {
+            undo.push(inverse);
+            if (typeof operation.verifiedContent === 'string') inverseBases.set(inverse, operation.verifiedContent);
           }
         }
       } else if (operation.type === 'create') {
@@ -97,7 +146,51 @@
       applyOperationToFiles(sourceFilesByPath, { ...operation, verifiedContent: undefined });
     }
 
-    return undo.reverse();
+    // Each inverse was measured in its own verified post-image. Compose in
+    // reverse order against the latest image, preserving changes between
+    // entries. Empty inverse insertions must never reuse an older offset.
+    const composed = [];
+    for (const inverse of undo.reverse()) {
+      let operation = inverse;
+      if (mappedPaths.has(inverse.path) && inverseBases.has(inverse)) {
+        const current = workingFilesByPath.get(inverse.path);
+        const base = StaleGuard.buildBaseFileLookup([{ path: inverse.path, content: inverseBases.get(inverse) }]);
+        const fresh = StaleGuard.checkOperationFreshness(inverse, current, base);
+        const prepared = fresh.ok && inverse.patches
+          ? fresh.preparedPatches || StaleGuard.prepareOperationPatches(inverse, current, base) : fresh;
+        if (typeof current !== 'string' || !prepared.ok) {
+          unavailable.set(inverse.path, 'stale_source_changed');
+          continue;
+        }
+        if (inverse.patches) operation = { ...inverse, patches: prepared.patches };
+      }
+      composed.push(operation);
+      applyOperationToFiles(workingFilesByPath, operation);
+    }
+    return { undoOperations: composed.filter(operation => !unavailable.has(operation.path)),
+      undoUnavailable: [...unavailable].map(([path, code]) => ({ path, code })) };
+  }
+
+  // Invert the ranges actually dispatched to C, not the original Native
+  // coordinates in B. Verify against the observed post-image before storing
+  // recovery; invalid evidence must not fall back to overwriting C with B.
+  function buildVerifiedInversePatches(patches, postImage) {
+    const beforeLength = patches.reduce((length, patch) =>
+      length + Number(patch?.to) - Number(patch?.from) - String(patch?.insert ?? '').length, postImage.length);
+    if (!Number.isSafeInteger(beforeLength) || beforeLength < 0) return [];
+    const normalized = normalizeTextPatches(patches, beforeLength);
+    if (!normalized.ok || normalized.patches.some(patch => patch.expected.length !== patch.to - patch.from)) return [];
+    const inverse = invertPatches(normalized.patches);
+    return applyTextPatches(postImage, inverse).ok ? inverse : [];
+  }
+
+  function invertPatches(patches) {
+    let offset = 0;
+    return patches.map(patch => {
+      const from = patch.from + offset;
+      offset += patch.insert.length - (patch.to - patch.from);
+      return { from, to: from + patch.insert.length, expected: patch.insert, insert: patch.expected };
+    });
   }
 
   function buildInverseTextPatches(textBeforeEdit, patches, verifiedContent, path) {
@@ -113,28 +206,20 @@
       return [];
     }
 
-    let offset = 0;
-    const inverse = normalized.patches.map(patch => {
-      const from = patch.from + offset;
-      const to = from + patch.insert.length;
-      offset += patch.insert.length - (patch.to - patch.from);
-      return {
-        from,
-        to,
-        expected: patch.insert,
-        insert: patch.expected
-      };
-    });
+    const inverse = invertPatches(normalized.patches);
     if (typeof verifiedContent !== 'string' || verifiedContent === applied.text) return inverse;
     // The stored checkpoint uses the verified editor post-image. Its inverse
     // must use those same offsets, while Native patches retain their source
     // representation for later operations in the batch.
-    const prepared = StaleGuard.prepareOperationPatches({ type: 'edit', path, patches: inverse }, verifiedContent,
+    const prepared = StaleGuard.prepareStoredInversePatches({ type: 'edit', path, patches: inverse }, verifiedContent,
       StaleGuard.buildBaseFileLookup([{ path, content: applied.text }]));
     return prepared.ok && applyTextPatches(verifiedContent, prepared.patches).ok ? prepared.patches : [];
   }
 
   function selectExpectedFilesForTrackedUndo(project, operations = [], trackedChanges = [], previousExpectedFiles = []) {
+    const checkpoint = buildUndoCheckpoint(project, operations);
+    const unavailable = new Set(checkpoint.undoUnavailable.map(item => item.path));
+    const mappedPaths = new Set(operations.filter(operation => Array.isArray(operation?.appliedPatches)).map(operation => operation.path));
     const paths = new Set();
     for (const change of trackedChanges || []) if (change?.path) paths.add(change.path);
     for (const operation of operations || []) {
@@ -143,7 +228,8 @@
     }
     const expectedByPath = new Map();
     for (const file of previousExpectedFiles || []) {
-      if (paths.has(file?.path) && typeof file?.content === 'string' && !expectedByPath.has(file.path)) {
+      if (paths.has(file?.path) && !unavailable.has(file.path) && !mappedPaths.has(file.path)
+        && typeof file?.content === 'string' && !expectedByPath.has(file.path)) {
         expectedByPath.set(file.path, { path: file.path, content: file.content });
       }
     }
@@ -152,10 +238,9 @@
     // content, including when the ZIP baseline used a different representation.
     const hasVerifiedPatches = operations.some(operation => typeof operation?.verifiedContent === 'string'
       && Array.isArray(operation.patches) && operation.patches.length);
-    const checkpoint = hasVerifiedPatches ? buildUndoCheckpoint(project, operations) : null;
-    const restored = checkpoint ? buildExpectedFilesAfterOperations({ files: checkpoint.undoBaseFiles }, checkpoint.undoOperations) : new Map();
+    const restored = hasVerifiedPatches ? buildExpectedFilesAfterOperations({ files: checkpoint.undoBaseFiles }, checkpoint.undoOperations) : new Map();
     for (const file of project?.files || []) {
-      if (paths.has(file?.path) && typeof file?.content === 'string' && !expectedByPath.has(file.path)) {
+      if (paths.has(file?.path) && !unavailable.has(file.path) && typeof file?.content === 'string' && !expectedByPath.has(file.path)) {
         expectedByPath.set(file.path, { path: file.path, content: restored.get(file.path) ?? file.content });
       }
     }
@@ -163,11 +248,15 @@
   }
 
   function buildUndoCheckpoint(project, appliedOperations) {
-    const undoOperations = buildUndoOperations(project, appliedOperations);
+    const { undoOperations, undoUnavailable } = buildUndoPlan(project, appliedOperations);
+    const unavailable = new Map(undoUnavailable.map(item => [item.path, item]));
     const expectedFiles = buildExpectedFilesAfterOperations(project, appliedOperations);
     return {
       undoOperations,
-      undoBaseFiles: filesMapToList(selectUndoBaseFiles(expectedFiles, undoOperations))
+      undoBaseFiles: filesMapToList(selectUndoBaseFiles(expectedFiles, undoOperations)),
+      undoUnavailable,
+      appliedOperations: (appliedOperations || []).map(operation => unavailable.has(operation?.path)
+        ? { ...operation, undoUnavailable: unavailable.get(operation.path) } : operation)
     };
   }
 
@@ -236,6 +325,7 @@
   // file creation, backed by both the forward delete and the captured original.
   // This also recovers older Track-on records that omitted that inverse.
   function getFileUndoOperations(run = {}) {
+    run = withAvailableUndo(run);
     const operations = (run.undoOperations || []).filter(isFileUndoOperation);
     const before = filesListToMap(run.undoExpectedFiles);
     const after = buildExpectedFilesAfterOperations({ files: run.undoExpectedFiles }, run.appliedOperations);
@@ -246,6 +336,8 @@
   }
 
   function prepareRunUndo(run = {}) {
+    const original = run;
+    run = withAvailableUndo(run);
     const files = getFileUndoOperations(run);
     const restored = new Set(files.filter(operation => operation.type === 'create').map(operation => operation.path));
     const pending = [...files], operations = [];
@@ -255,10 +347,12 @@
         if (index >= 0) operations.push(...pending.splice(index, 1));
       } else if (!restored.has(operation.path)) operations.push(operation);
     }
-    return { ...run, undoOperations: [...operations, ...pending] };
+    return { ...original, undoOperations: [...operations, ...pending],
+      ...(run !== original ? { undoBaseFiles: run.undoBaseFiles, undoExpectedFiles: run.undoExpectedFiles } : {}) };
   }
 
   function textUndoRun(run = {}) {
+    run = withAvailableUndo(run);
     const restored = new Set(getFileUndoOperations(run).flatMap(operation => operation.type === 'create' ? [operation.path]
       : operation.type === 'move' ? [operation.path, operation.to] : []));
     return { ...run,
@@ -332,6 +426,7 @@
   }
 
   function buildSnapshotRestoreUndo(run = {}) {
+    run = withAvailableUndo(run);
     const undoOperations = Array.isArray(run.undoOperations) ? run.undoOperations : [];
     const originalByPath = buildOriginalFilesForSnapshotUndo(run, undoOperations);
     if (!originalByPath.size) {
@@ -571,6 +666,9 @@
   }
 
   return {
+    getUndoUnavailableFiles,
+    withAvailableUndo,
+    compactUnavailableUndoOperations,
     isFileUndoOperation,
     getFileUndoOperations,
     prepareRunUndo,

package/extension/src/shared/updateRuntimeIdentity.js

@@ -12,6 +12,18 @@
     return a[0] - b[0] || a[1] - b[1] || a[2] - b[2];
   }
 
+  function verifiedRollback(status = {}) {
+    const transaction = status.transaction;
+    const pair = status.restoredPair;
+    const digest = value => typeof value === 'string' && /^[0-9a-f]{64}$/.test(value);
+    return Boolean(transaction?.id && transaction.state === 'rolled_back'
+      && version(transaction.sourceVersion) && version(transaction.targetVersion)
+      && status.installedAligned === true && status.activeVersion === transaction.sourceVersion
+      && pair?.extensionVersion === transaction.sourceVersion && pair.nativeVersion === transaction.sourceVersion
+      && digest(pair.extensionSha256) && digest(pair.nativeSha256)
+      && (!transaction.bootstrapRevision || digest(pair.bootstrapSha256)));
+  }
+
   function inspectInstalledRuntime(status = {}, options = {}) {
     const result = { installedVersion: version(status.activeVersion), nativeVersion: version(status.runtimeVersion),
       extensionVersion: version(options.extensionVersion), runtimeVersion: version(options.runtimeVersion), state: 'unknown' };
@@ -24,9 +36,11 @@
     if (status.installedAligned !== true) return { ...result, state: 'repair_required' };
     const loaded = [result.nativeVersion, result.extensionVersion, result.runtimeVersion];
     if (loaded.every(value => value === result.installedVersion)) return { ...result, state: 'aligned' };
-    return { ...result, state: loaded.every(value => compare(result.installedVersion, value) >= 0)
+    const rollbackReload = verifiedRollback(status) && loaded.every(value =>
+      value === status.transaction.sourceVersion || value === status.transaction.targetVersion);
+    return { ...result, state: rollbackReload || loaded.every(value => compare(result.installedVersion, value) >= 0)
       ? 'reload_required' : 'repair_required' };
   }
 
-  return Object.freeze({ inspectInstalledRuntime });
+  return Object.freeze({ inspectInstalledRuntime, verifiedRollback });
 });