dsh-git-worktree 0.3.2 → 0.6.0

package/lib/console-host/control-plane.js

@@ -16,23 +16,56 @@ function readyReview(record) {
     return record.delivery.review;
 }
 function previewReview(record) {
-    if (record.phase !== 'ready' || record.delivery.state !== 'preview_active') {
+    if (record.phase !== 'ready'
+        || (record.delivery.state !== 'preview_active' && record.delivery.state !== 'preview_detached')) {
         throw domainError('preview_not_active', '当前没有等待验收的 Local Preview');
     }
     return record.delivery.review;
 }
+function safeRecoveryRequestId(value) {
+    return value.length > 0 && value.length <= 500 && !/[\0\r\n]/u.test(value);
+}
+function safeConflictFile(file) {
+    if (!file || file.length > 1000 || /[\0-\x1f\x7f]/u.test(file))
+        return false;
+    if (/^(?:[A-Za-z]:[\\/]|[\\/])/u.test(file))
+        return false;
+    return !file.split(/[\\/]/u).some(segment => segment === '' || segment === '.' || segment === '..');
+}
+function applyConflictContinuation(result, reviewId) {
+    const checkoutId = result.target.checkout.id;
+    const revision = result.target.revision;
+    if (!/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/iu.test(result.localHeadOid)) {
+        throw domainError('git_error', '冲突恢复缺少有效的 Local HEAD 身份');
+    }
+    const localHeadOid = result.localHeadOid;
+    if (result.conflictingFiles.length > 500 || !result.conflictingFiles.every(safeConflictFile)) {
+        throw domainError('git_error', '冲突恢复包含不安全或越界的文件身份');
+    }
+    const conflictingFiles = [...result.conflictingFiles];
+    return {
+        kind: 'worktree_apply_conflict',
+        requestId: `apply-conflict:${checkoutId}:${reviewId}:${revision}:${localHeadOid}`,
+        checkoutId,
+        reviewId,
+        revision,
+        localHeadOid,
+        conflictingFiles,
+    };
+}
 function preflightFailure(view) {
     if (view === undefined)
         return failure('git_error', '当前 SessionCheckoutModule 不支持验收预检');
     if (view.status !== 'blocked')
         return undefined;
     const code = view.reason === 'stale_isolated' ? 'stale_isolated'
-        : view.reason === 'stale_target' ? 'stale_target'
-            : view.reason === 'project_acceptance_busy' ? 'project_acceptance_busy'
-                : view.reason === 'not_owner' ? 'not_owner'
-                    : view.reason === 'not_ready_for_review' ? 'operation_not_allowed'
-                        : view.reason === 'checkout_unavailable' ? 'checkout_mismatch'
-                            : 'git_error';
+        : view.reason === 'stale_local' ? 'stale_local'
+            : view.reason === 'stale_target' ? 'stale_target'
+                : view.reason === 'project_acceptance_busy' ? 'project_acceptance_busy'
+                    : view.reason === 'not_owner' ? 'not_owner'
+                        : view.reason === 'not_ready_for_review' ? 'operation_not_allowed'
+                            : view.reason === 'checkout_unavailable' ? 'checkout_mismatch'
+                                : 'git_error';
     return failure(code, view.message);
 }
 export function createWorktreeConsoleControlPlane(options) {
@@ -73,35 +106,38 @@ export function createWorktreeConsoleControlPlane(options) {
             throw error;
         }
     }
-    async function authorize(sessionId, checkoutId) {
-        const caller = await options.module.inspect(sessionId);
-        const record = recordOf(options.registry, checkoutId);
-        if (record.ownerSessionId !== sessionId && record.sourceSessionId !== sessionId) {
-            throw domainError('not_owner', '当前 Session 无权访问该 Worktree');
-        }
-        if (record.projectId !== caller.project.id) {
-            throw domainError('project_mismatch', 'Worktree 与当前 Session 项目不一致');
-        }
+    async function verifyCallerRoot(sessionId, record, expectedRoot) {
         const session = options.lookup.getSession(sessionId);
         const project = session?.projectId === undefined ? undefined : options.lookup.getProject(session.projectId);
         if (project === undefined) {
             throw domainError('project_mismatch', '当前 Session Workspace 无法证明属于该 Worktree 的原始项目');
         }
-        const expectedRoot = record.ownerSessionId === sessionId ? record.managedRoot : record.localRoot;
         const cleanedOwnerCwd = record.ownerSessionId === sessionId
             && record.phase === 'discarded'
             && record.delivery.state === 'delivered'
             && !options.files.exists(project.root)
             && sameLocalRoot(resolve(project.root), resolve(expectedRoot));
-        if (!cleanedOwnerCwd) {
-            if (!options.files.exists(project.root)) {
-                throw domainError('project_mismatch', '当前 Session Workspace 无法证明属于该 Worktree 的原始项目');
-            }
-            const workspaceRoot = await options.files.canonicalize(project.root);
-            if (!sameLocalRoot(workspaceRoot, expectedRoot)) {
-                throw domainError('project_mismatch', '当前 Session cwd 与 Worktree 授权边界不一致');
-            }
+        if (cleanedOwnerCwd)
+            return;
+        if (!options.files.exists(project.root)) {
+            throw domainError('project_mismatch', '当前 Session Workspace 无法证明属于该 Worktree 的原始项目');
+        }
+        const workspaceRoot = await options.files.canonicalize(project.root);
+        if (!sameLocalRoot(workspaceRoot, expectedRoot)) {
+            throw domainError('project_mismatch', '当前 Session cwd 与 Worktree 授权边界不一致');
+        }
+    }
+    async function authorize(sessionId, checkoutId) {
+        const caller = await options.module.inspect(sessionId);
+        const record = recordOf(options.registry, checkoutId);
+        if (record.ownerSessionId !== sessionId && record.sourceSessionId !== sessionId) {
+            throw domainError('not_owner', '当前 Session 无权访问该 Worktree');
+        }
+        if (record.projectId !== caller.project.id) {
+            throw domainError('project_mismatch', 'Worktree 与当前 Session 项目不一致');
         }
+        const expectedRoot = record.ownerSessionId === sessionId ? record.managedRoot : record.localRoot;
+        await verifyCallerRoot(sessionId, record, expectedRoot);
         if (record.phase !== 'discarded') {
             const visible = await options.module.listManagedWorktreesForSession(sessionId, { checkoutId });
             if (!visible.some(item => item.checkoutId === checkoutId)) {
@@ -110,6 +146,56 @@ export function createWorktreeConsoleControlPlane(options) {
         }
         return record;
     }
+    async function linkedReadAccess(sessionId, checkoutId) {
+        const requested = recordOf(options.registry, checkoutId);
+        if (requested.ownerSessionId === sessionId || requested.sourceSessionId === sessionId) {
+            return { record: await authorize(sessionId, checkoutId), linkedRead: false };
+        }
+        const caller = await callerTarget(sessionId);
+        if (caller.checkout.kind !== 'isolated') {
+            throw domainError('not_owner', '当前 Session 无权访问该 Worktree');
+        }
+        const anchor = await authorize(sessionId, caller.checkout.id);
+        const sourceSessionId = anchor.sourceSessionId ?? anchor.ownerSessionId;
+        const requestedSourceSessionId = requested.sourceSessionId ?? requested.ownerSessionId;
+        const sameLinkedGroup = requested.projectId === anchor.projectId
+            && requestedSourceSessionId === sourceSessionId
+            && sameLocalRoot(requested.localRoot, anchor.localRoot);
+        const holder = anchor.ownerSessionId === sessionId
+            && anchor.phase === 'ready'
+            && anchor.delivery.state === 'ready_for_review'
+            ? acceptanceHolder(anchor)
+            : undefined;
+        const exactAcceptanceHolder = holder?.checkoutId === requested.checkoutId
+            && requested.projectId === anchor.projectId
+            && sameLocalRoot(requested.localRoot, anchor.localRoot);
+        if (!sameLinkedGroup && !exactAcceptanceHolder) {
+            throw domainError('not_owner', '当前 Session 无权访问该 Worktree');
+        }
+        if (!ownerSessionAvailable(requested)) {
+            throw domainError('checkout_missing', '关联 Worktree 的 owner Session 不可用');
+        }
+        await verifyCallerRoot(requested.ownerSessionId, requested, requested.managedRoot);
+        if (exactAcceptanceHolder) {
+            const currentAnchor = recordOf(options.registry, anchor.checkoutId);
+            const currentRequested = recordOf(options.registry, requested.checkoutId);
+            const currentHolder = currentAnchor.ownerSessionId === sessionId
+                && currentAnchor.phase === 'ready'
+                && currentAnchor.delivery.state === 'ready_for_review'
+                ? acceptanceHolder(currentAnchor)
+                : undefined;
+            if (currentHolder?.checkoutId !== currentRequested.checkoutId
+                || currentRequested.ownerSessionId !== requested.ownerSessionId
+                || !sameLocalRoot(currentRequested.localRoot, currentAnchor.localRoot))
+                throw domainError('not_owner', '验收槽位占用者已变化，请重新检查');
+            return {
+                record: currentRequested,
+                linkedRead: true,
+                acceptanceAnchorCheckoutId: currentAnchor.checkoutId,
+            };
+        }
+        return { record: requested, linkedRead: true };
+    }
     async function observe(record) {
         if (record.phase === 'discarded')
             return { managedRoot: null };
@@ -145,48 +231,111 @@ export function createWorktreeConsoleControlPlane(options) {
             reviewSlot: holder ? 'waiting' : 'available',
             ...(holder ? {
                 reviewSlotOwnerSessionId: holder.ownerSessionId,
-                capabilities: { ...target.capabilities, preflight: false, preview: false },
+                reviewSlotHolder: {
+                    checkoutId: holder.checkoutId,
+                    ownerSessionId: holder.ownerSessionId,
+                    revision: holder.revision,
+                    state: holder.delivery.state,
+                },
+                capabilities: { ...target.capabilities, preview: false, checkpoint: false, finalize: false },
             } : {}),
         };
     }
-    async function details(sessionId, checkoutId) {
-        const record = await authorize(sessionId, checkoutId);
-        const observed = await observe(record);
-        return projectReviewSlot(record, projectDetails(record, sessionId, observed.managedRoot, observed.snapshot, observed.dirty, ownerSessionAvailable(record)));
+    function deliveryProofFromTarget(target) {
+        const delivery = target.delivery;
+        if (!delivery || !('proof' in delivery) || !delivery.proof)
+            return undefined;
+        return {
+            ...delivery.proof,
+            changedFiles: [...delivery.proof.changedFiles],
+        };
     }
-    async function mutationResponse(sessionId, checkoutId) {
+    async function details(sessionId, checkoutId, observedDeliveryProof) {
+        const access = await linkedReadAccess(sessionId, checkoutId);
+        const observed = await observe(access.record);
+        let projectedRecord = access.record;
+        if (access.acceptanceAnchorCheckoutId !== undefined) {
+            const currentAnchor = recordOf(options.registry, access.acceptanceAnchorCheckoutId);
+            const currentRequested = recordOf(options.registry, checkoutId);
+            const currentHolder = currentAnchor.ownerSessionId === sessionId
+                && currentAnchor.phase === 'ready'
+                && currentAnchor.delivery.state === 'ready_for_review'
+                ? acceptanceHolder(currentAnchor)
+                : undefined;
+            if (currentHolder?.checkoutId !== currentRequested.checkoutId
+                || currentRequested.ownerSessionId !== access.record.ownerSessionId
+                || !sameLocalRoot(currentRequested.localRoot, currentAnchor.localRoot)
+                || observed.managedRoot === null
+                || !sameLocalRoot(observed.managedRoot, currentRequested.managedRoot))
+                throw domainError('not_owner', '验收槽位占用者已变化，请重新检查');
+            projectedRecord = currentRequested;
+        }
+        return projectReviewSlot(projectedRecord, projectDetails(projectedRecord, sessionId, observed.managedRoot, observed.snapshot, observed.dirty, ownerSessionAvailable(access.record), access.linkedRead, observedDeliveryProof));
+    }
+    async function mutationResponse(sessionId, checkoutId, observedDeliveryProof) {
         const record = recordOf(options.registry, checkoutId);
         if (record.phase === 'discarded') {
-            return { target: projectReviewSlot(record, projectRecord(record, sessionId, { ownerSessionAvailable: ownerSessionAvailable(record) })) };
+            return {
+                target: projectReviewSlot(record, projectRecord(record, sessionId, {
+                    ownerSessionAvailable: ownerSessionAvailable(record),
+                    deliveryProof: observedDeliveryProof,
+                })),
+            };
         }
         const observed = await observe(record);
-        return { target: projectReviewSlot(record, projectRecord(record, sessionId, { ...observed, ownerSessionAvailable: ownerSessionAvailable(record) })) };
+        return {
+            target: projectReviewSlot(record, projectRecord(record, sessionId, {
+                ...observed,
+                ownerSessionAvailable: ownerSessionAvailable(record),
+                deliveryProof: observedDeliveryProof,
+            })),
+        };
     }
     return {
         current: sessionId => outcome(async () => {
             const target = await callerTarget(sessionId);
             if (target.checkout.kind === 'local')
                 return { target: projectLocal(target, sessionId) };
-            return { target: await details(sessionId, target.checkout.id) };
+            return {
+                target: await details(sessionId, target.checkout.id, deliveryProofFromTarget(target)),
+            };
         }),
         list: request => outcome(async () => {
             const caller = await callerTarget(request.sessionId);
-            const active = await options.module.listManagedWorktreesForSession(request.sessionId, {
+            let sourceSessionId = request.sessionId;
+            let localRoot;
+            if (caller.checkout.kind === 'isolated') {
+                const anchor = await authorize(request.sessionId, caller.checkout.id);
+                sourceSessionId = anchor.sourceSessionId ?? anchor.ownerSessionId;
+                localRoot = anchor.localRoot;
+            }
+            else {
+                const session = options.lookup.getSession(request.sessionId);
+                const project = session?.projectId === undefined ? undefined : options.lookup.getProject(session.projectId);
+                if (project === undefined || project.id !== caller.project.id || !options.files.exists(project.root)) {
+                    throw domainError('project_mismatch', '当前 Session Workspace 无法证明关联 Worktree 项目');
+                }
+                localRoot = await options.files.canonicalize(project.root);
+            }
+            const active = await options.module.listManagedWorktreesForSession(sourceSessionId, {
                 needsAttention: request.needsAttention,
             });
             const activeById = new Map(active.map(summary => [summary.checkoutId, summary]));
             const records = Object.values(options.registry.read().managedCheckouts)
                 .filter(record => record.projectId === caller.project.id)
-                .filter(record => record.ownerSessionId === request.sessionId || record.sourceSessionId === request.sessionId)
+                .filter(record => (record.sourceSessionId ?? record.ownerSessionId) === sourceSessionId)
+                .filter(record => localRoot === undefined || sameLocalRoot(record.localRoot, localRoot))
                 .filter(record => request.includeDelivered === true || record.phase !== 'discarded')
                 .filter(record => record.phase === 'discarded' || activeById.has(record.checkoutId));
             const worktrees = [];
             for (const record of records) {
                 const observed = record.phase === 'discarded' ? undefined : await observe(record);
+                const linkedRead = record.ownerSessionId !== request.sessionId && record.sourceSessionId !== request.sessionId;
                 const projected = projectReviewSlot(record, projectRecord(record, request.sessionId, {
                     ...observed,
                     summary: activeById.get(record.checkoutId),
                     ownerSessionAvailable: ownerSessionAvailable(record),
+                    linkedRead,
                 }));
                 if (request.needsAttention !== true || projected.state === 'cleanup_pending' || projected.state === 'recovery_required') {
                     worktrees.push(projected);
@@ -268,6 +417,110 @@ export function createWorktreeConsoleControlPlane(options) {
                 throw domainError('git_error', '当前 SessionCheckoutModule 不支持验收预检');
             return { preflight };
         }),
+        previewRecoveryPreflight: request => outcome(async () => {
+            const record = await authorize(request.sessionId, request.checkoutId);
+            if (record.ownerSessionId !== request.sessionId)
+                throw domainError('not_owner', '只有 owner Isolated Session 可以检查 Preview 恢复');
+            if (record.revision !== request.expectedRevision)
+                throw domainError('stale_target', 'Session Target 已变化，请刷新');
+            if (record.phase !== 'ready'
+                || record.delivery.state !== 'preview_detached'
+                || record.delivery.review.reviewId !== request.expectedReviewId
+                || record.delivery.preview.previewId !== request.expectedPreviewId)
+                throw domainError('stale_target', 'Detached Preview 身份已变化，请刷新');
+            const preflight = await options.module.preflightPreviewRecovery?.(request.sessionId, request.expectedRevision, request.expectedReviewId, request.expectedPreviewId);
+            if (preflight === undefined)
+                throw domainError('git_error', '当前 SessionCheckoutModule 不支持 Preview Recovery 预检');
+            return { preflight };
+        }),
+        preparePreviewRecoveryAnalysis: request => outcome(async () => {
+            const record = await authorize(request.sessionId, request.checkoutId);
+            if (record.ownerSessionId !== request.sessionId
+                || request.recoveryProof.sessionId !== request.sessionId
+                || request.recoveryProof.checkoutId !== request.checkoutId
+                || request.recoveryProof.revision !== request.expectedRevision
+                || request.recoveryProof.reviewId !== request.expectedReviewId
+                || request.recoveryProof.previewId !== request.expectedPreviewId)
+                throw domainError('stale_target', 'Preview Recovery 分析身份不匹配');
+            const prepared = await options.module.preparePreviewRecoveryAnalysis(request.sessionId, request.recoveryProof, `preview-recovery-analysis:${randomUUID()}`);
+            const response = await mutationResponse(request.sessionId, request.checkoutId);
+            return {
+                ...response,
+                recoveryContinuation: {
+                    kind: prepared.kind,
+                    requestId: prepared.requestId,
+                    checkoutId: request.checkoutId,
+                    reviewId: prepared.reviewId,
+                    previewId: prepared.previewId,
+                    revision: prepared.revision,
+                    generation: prepared.generation,
+                },
+            };
+        }),
+        createPreviewRecoveryHandoff: request => outcome(async () => {
+            const record = await authorize(request.sessionId, request.checkoutId);
+            if (record.ownerSessionId !== request.sessionId
+                || request.recoveryProof.sessionId !== request.sessionId
+                || request.recoveryProof.checkoutId !== request.checkoutId
+                || request.recoveryProof.revision !== request.expectedRevision
+                || request.recoveryProof.reviewId !== request.expectedReviewId
+                || request.recoveryProof.previewId !== request.expectedPreviewId)
+                throw domainError('stale_target', 'Preview Recovery handoff 身份不匹配');
+            const targetSessionId = createTargetSessionId();
+            const launch = await options.module.createPreviewRecoveryHandoff(request.sessionId, request.recoveryProof, targetSessionId, `preview-recovery-handoff:${randomUUID()}`);
+            const created = recordOf(options.registry, launch.target.checkout.id);
+            const observed = await observe(created);
+            if (created.ownerSessionId !== targetSessionId
+                || created.recoveryContinuation?.kind !== 'worktree_preview_recovery_handoff'
+                || created.recoveryContinuation.requestId !== launch.continuation.requestId
+                || observed.managedRoot !== launch.managedRoot)
+                throw domainError('checkout_mismatch', 'Recovery handoff Worktree 的 Host 身份校验失败');
+            return {
+                target: projectDetails(created, targetSessionId, observed.managedRoot, observed.snapshot, observed.dirty, false),
+                targetSessionId,
+                managedRoot: launch.managedRoot,
+                recoveryContinuation: {
+                    kind: launch.continuation.kind,
+                    requestId: launch.continuation.requestId,
+                    checkoutId: created.checkoutId,
+                    sourceCheckoutId: launch.continuation.sourceCheckoutId,
+                    reviewId: launch.continuation.reviewId,
+                    previewId: launch.continuation.previewId,
+                    revision: launch.continuation.sourceRevision,
+                    generation: launch.continuation.generation,
+                },
+            };
+        }),
+        checkpoint: request => outcome(async () => {
+            const record = await authorize(request.sessionId, request.checkoutId);
+            if (record.ownerSessionId !== request.sessionId)
+                throw domainError('not_owner', '只有 owner Isolated Session 可以保存阶段');
+            const commitMessage = request.commitMessage.trim();
+            if (!commitMessage || commitMessage.length > 500 || !safeRecoveryRequestId(request.requestId)) {
+                throw domainError('invalid_input', 'Checkpoint Commit Message 或 requestId 无效');
+            }
+            const result = await options.module.operate({
+                action: 'checkpoint',
+                sessionId: request.sessionId,
+                expectedRevision: request.expectedRevision,
+                expectedReviewId: request.expectedReviewId,
+                expectedGeneration: request.expectedGeneration,
+                requestId: request.requestId,
+                commitMessage,
+            });
+            if (result.status === 'error')
+                throw domainError(result.code, result.message);
+            if (result.status === 'preview_detached') {
+                return { ...(await mutationResponse(request.sessionId, request.checkoutId)), changedFiles: [...result.changedFiles] };
+            }
+            if (result.status !== 'checkpointed')
+                throw domainError('operation_not_allowed', 'Checkpoint 返回了非预期状态');
+            const response = await mutationResponse(request.sessionId, request.checkoutId);
+            if (response.target.state !== 'working' || response.target.revision !== result.target.revision) {
+                throw domainError('checkout_mismatch', 'Checkpoint 后 Worktree 状态未收敛到 Working');
+            }
+            return { ...response, checkpoint: result.checkpoint, changedFiles: [...result.changedFiles] };
+        }),
         preview: request => outcome(async () => {
             const record = await authorize(request.sessionId, request.checkoutId);
             if (record.ownerSessionId !== request.sessionId)
@@ -282,8 +535,9 @@ export function createWorktreeConsoleControlPlane(options) {
             });
             if (result.status === 'error')
                 throw domainError(result.code, result.message);
-            if (result.status === 'conflict')
-                throw domainError('apply_conflict', 'Local Preview 预检发现内容冲突');
+            if (result.status === 'conflict') {
+                throw domainError('apply_conflict', 'Local Preview 预检发现内容冲突', applyConflictContinuation(result, review.reviewId));
+            }
             if (result.status !== 'previewed')
                 throw domainError('operation_not_allowed', 'Preview 返回了非预期状态');
             return {
@@ -300,11 +554,73 @@ export function createWorktreeConsoleControlPlane(options) {
             const review = readyReview(record);
             if (review.reviewId !== request.expectedReviewId)
                 throw domainError('stale_target', 'Review 身份已变化，请刷新');
-            const target = await options.module.resumeRevision(request.sessionId, request.expectedRevision, request.expectedReviewId);
+            const requestedRecovery = request.conflictContinuation;
+            if (requestedRecovery && (requestedRecovery.kind !== 'worktree_apply_conflict'
+                || !safeRecoveryRequestId(requestedRecovery.requestId)
+                || requestedRecovery.checkoutId !== request.checkoutId
+                || requestedRecovery.reviewId !== request.expectedReviewId
+                || requestedRecovery.revision !== request.expectedRevision
+                || !/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/iu.test(requestedRecovery.localHeadOid)
+                || requestedRecovery.conflictingFiles.length > 500
+                || !requestedRecovery.conflictingFiles.every(safeConflictFile)))
+                throw domainError('invalid_input', '冲突恢复请求身份无效');
+            const recovery = requestedRecovery ? {
+                kind: 'worktree_apply_conflict',
+                requestId: `conflict-recovery:${randomUUID()}`,
+                reviewId: request.expectedReviewId,
+                readyRevision: request.expectedRevision,
+                localHeadOid: requestedRecovery.localHeadOid,
+                conflictingFiles: [...requestedRecovery.conflictingFiles],
+            } : undefined;
+            const target = recovery
+                ? await options.module.resumeRevision(request.sessionId, request.expectedRevision, request.expectedReviewId, recovery)
+                : await options.module.resumeRevision(request.sessionId, request.expectedRevision, request.expectedReviewId);
             if (target.checkout.id !== request.checkoutId || target.delivery?.state !== 'working') {
                 throw domainError('checkout_mismatch', '恢复编辑后 Worktree 身份或状态不一致');
             }
-            return mutationResponse(request.sessionId, request.checkoutId);
+            const response = await mutationResponse(request.sessionId, request.checkoutId);
+            if (!requestedRecovery)
+                return response;
+            const current = recordOf(options.registry, request.checkoutId).recoveryContinuation;
+            if (!current
+                || current.kind !== 'worktree_apply_conflict'
+                || current.requestId !== recovery.requestId
+                || current.workingRevision !== response.target.revision)
+                throw domainError('checkout_mismatch', 'Host 未能持久化精确冲突恢复凭证');
+            return {
+                ...response,
+                recoveryContinuation: {
+                    kind: current.kind,
+                    requestId: current.requestId,
+                    checkoutId: request.checkoutId,
+                    reviewId: current.reviewId,
+                    revision: current.workingRevision,
+                    localHeadOid: current.localHeadOid,
+                    conflictingFiles: [...current.conflictingFiles],
+                },
+            };
+        }),
+        prepareReviewRegeneration: request => outcome(async () => {
+            const record = await authorize(request.sessionId, request.checkoutId);
+            if (record.ownerSessionId !== request.sessionId)
+                throw domainError('not_owner', '只有 owner Isolated Session 可以请求重新生成验收结果');
+            if (record.revision !== request.expectedRevision)
+                throw domainError('stale_target', 'Session Target 已变化，请刷新');
+            const review = readyReview(record);
+            if (review.reviewId !== request.expectedReviewId)
+                throw domainError('stale_target', 'Review 身份已变化，请刷新');
+            const prepared = await options.module.prepareReviewRegeneration(request.sessionId, request.expectedRevision, request.expectedReviewId, `review-regeneration:${randomUUID()}`);
+            const response = await mutationResponse(request.sessionId, request.checkoutId);
+            return {
+                ...response,
+                recoveryContinuation: {
+                    kind: prepared.kind,
+                    requestId: prepared.requestId,
+                    checkoutId: request.checkoutId,
+                    reviewId: prepared.reviewId,
+                    revision: prepared.revision,
+                },
+            };
         }),
         rollbackPreview: request => outcome(async () => {
             const record = await authorize(request.sessionId, request.checkoutId);
@@ -315,6 +631,7 @@ export function createWorktreeConsoleControlPlane(options) {
                 sessionId: request.sessionId,
                 expectedRevision: request.expectedRevision,
                 ...(request.resumeRevision === undefined ? {} : { resumeRevision: request.resumeRevision }),
+                ...(request.recoveryProof === undefined ? {} : { recoveryProof: request.recoveryProof }),
             });
             if (result.status === 'error')
                 throw domainError(result.code, result.message);
@@ -380,14 +697,15 @@ export function createWorktreeConsoleControlPlane(options) {
                 });
                 if (result.status === 'error')
                     return failure(result.code, result.message);
-                if (result.status === 'conflict')
-                    return failure('apply_conflict', 'Local 应用发生冲突');
+                if (result.status === 'conflict') {
+                    return failure('apply_conflict', 'Local 应用发生冲突', undefined, applyConflictContinuation(result, review.reviewId));
+                }
                 if (result.status !== 'finished')
                     return failure('operation_not_allowed', 'Finalize 返回了非预期状态');
                 return {
                     ok: true,
                     value: {
-                        ...(await mutationResponse(request.sessionId, request.checkoutId)),
+                        ...(await mutationResponse(request.sessionId, request.checkoutId, deliveryProofFromTarget(result.target))),
                         changedFiles: [...result.changedFiles],
                         commitOid: result.commitOid,
                     },
@@ -416,6 +734,7 @@ export function createWorktreeConsoleControlPlane(options) {
                     expectedRevision: request.expectedRevision,
                     commitMessage,
                     retention: request.retention,
+                    ...(request.recoveryProof === undefined ? {} : { recoveryProof: request.recoveryProof }),
                 });
                 if (result.status === 'error')
                     return failure(result.code, result.message);
@@ -433,7 +752,7 @@ export function createWorktreeConsoleControlPlane(options) {
                 return {
                     ok: true,
                     value: {
-                        ...(await mutationResponse(request.sessionId, request.checkoutId)),
+                        ...(await mutationResponse(request.sessionId, request.checkoutId, deliveryProofFromTarget(result.target))),
                         changedFiles: [...result.changedFiles],
                         commitOid: result.commitOid,
                     },