dsh-hashline-edit 0.1.0 → 0.2.0

package/src/mutation-engine/types.ts

@@ -8,32 +8,49 @@
 import type { LineEnding } from "../edit-diff.js";
 import type { ResolvedRange } from "../served-session/serve-render.js";
 import type { HashStore } from "../hash-store.js";
-import type { EditDetails, RMetrics } from "../edit-response.js";
-import type { DomainErrorCode, RangeCause } from "../domain-errors.js";
-import type { ServedRow } from "../domain-errors.js";
 
 // WHY: Re-export pipeline-facing options — validated once at admission (edit.ts),
 // WHY: trusted inside the engine. No `any`.
 export interface PipelineOptions {
+  /** Workspace root used to re-assert lifecycle path boundaries at commit time. */
+  workspaceRoot?: string;
   accessMode?: number;
   signal?: AbortSignal;
   store?: HashStore;
   noPersist?: boolean;
   sessionKey?: string;
   /**
-   * TEST-ONLY fault-injection seam (ticket-04b §3): invoked inside a foreign-source cut transaction
-   * AFTER the target insert is durably committed and BEFORE the source retirement rename. A
-   * throw here lands inside the two-rename window, which is exactly the half-applied state the
-   * intent record and next-run repair must resolve.
+   * TEST-ONLY fault-injection seam (ticket-04b §3): invoked inside a correlated write transaction
+   * AFTER the first file's rename is durably committed and BEFORE the next file's rename. A throw
+   * here lands inside the rename window — the cut path's target-then-sources order, or a multi-file
+   * edit's plan order — which is exactly the half-applied state the intent record and next-run
+   * repair must resolve.
    */
   onCutBetweenWrites?: (committedAbsolutePath: string) => void | Promise<void>;
   /**
-   * TEST-ONLY observation seam (ticket-04b remediation-2 R2): invoked inside a foreign-source cut
-   * transaction BEFORE the first rename, while no byte of the transaction has landed. The rule
-   * under test is write-AHEAD: the intent record must already be durable at the moment of the
-   * first mutation — an existence check taken inside the window cannot show that.
+   * TEST-ONLY observation seam (ticket-04b remediation-2 R2): invoked inside a correlated write
+   * transaction (a foreign-source cut, or a multi-file edit) BEFORE the first rename, while no byte
+   * of the transaction has landed. The rule under test is write-AHEAD: the intent record must
+   * already be durable at the moment of the first mutation — an existence check taken inside the
+   * window cannot show that.
    */
   onBeforeFirstCutWrite?: () => void | Promise<void>;
+  /**
+   * TEST-ONLY mid-member fault seam: called after a move's rename is durable and before its
+   * destination content is rewritten, so the rollback of that in-flight member is exercised.
+   */
+  onAfterMoveRename?: (toAbsolutePath: string) => void | Promise<void>;
+}
+
+/**
+ * The honest outcome of a failed multi-member commit's rollback attempt. `restored` members are
+ * proven back at their pre-images; `remaining` members were not rolled back; `uncertain` members
+ * are those whose rollback attempt itself threw, so neither state can be claimed for them.
+ */
+export interface TransactionRecoveryReport {
+  restored: string[];
+  remaining: string[];
+  uncertain: string[];
 }
 
 /**
@@ -49,6 +66,24 @@ export interface ForeignCutRecord {
   spanTo: string;
 }
 
+/**
+ * The file-lifecycle action one transaction member carries.
+ *
+ * This is the engine-local vocabulary: apply_patch's plan IR maps onto it in
+ * `src/apply-patch/commit.ts` so the mutation engine never imports the apply-patch layer.
+ * Absent is an ordinary in-place edit.
+ */
+export type MemberLifecycle =
+  | { kind: "keep" }
+  | { kind: "add"; createdDirs: readonly string[] }
+  | { kind: "delete" }
+  | {
+      kind: "move";
+      fromAbsolutePath: string;
+      toAbsolutePath: string;
+      createdDirs: readonly string[];
+    };
+
 // WHY: Internal: the engine's view of one file's mutation outcome.
 // WHY: Mirrors `ProcessedEditFile` from the old pipeline — kept here as the engine's owned fact.
 export interface ProcessedEditFile {
@@ -94,60 +129,9 @@ export interface ProcessedEditFile {
    * correlated two-file transaction; the in-memory buffer itself never touches these files.
    */
   foreignCuts: ForeignCutRecord[];
-}
-
-// WHY: Discriminated success/failure for the deep seam.
-// WHY: Callers use exhaustive switch on `ok` — no `isError` flag checks,
-// WHY: no `any` threading.
-export interface MutationSuccess {
-  ok: true;
-  /** SAFETY: Normalized result content (LF). */
-  result: string;
-  /** SAFETY: Unified diff (hash-anchored) for model consumption. */
-  diff: string;
-  /** SAFETY: User-facing drift notice, if any (details only, not model content). */
-  drift: string | undefined;
-  /** SAFETY: Metrics for telemetry. */
-  metrics: RMetrics;
-  raw: ProcessedEditFile;
-  /** SAFETY: Full tool result (content + details) for pi's tool_result hook. */
-  toolResult: {
-    content: Array<{ type: "text"; text: string }>;
-    details: EditDetails;
-  };
-}
-
-export interface MutationFailure {
-  ok: false;
-  /**
-   * SAFETY: Machine code — a registry member (`DomainErrorCode`). `toFailure` validates every
-   * caught code through the envelope reader (`src/error-envelope.ts`): non-registry strings
-   * (errno pass-through included) route to `E_UNKNOWN`, so the union is honest.
-   */
-  code: DomainErrorCode;
-  /** SAFETY: Human message — model-facing signal when applicable. */
-  message: string;
-  /** SAFETY: Fresh served block for retry when available (reject-and-serve). */
-  servedBlock?: string;
-  servedRows?: ServedRow[];
   /**
-   * SAFETY: the RAW `E_BAD_PAYLOAD` message behind a rendered refusal, when the route is one, so
-   * SAFETY: the tool seam can name the invoking tool instead of falling back to the neutral
-   * SAFETY: wording. Present only for `code: "E_BAD_PAYLOAD"`.
+   * apply_patch lifecycle action for this member; absent is an ordinary edit. The correlated
+   * transaction reads it for pre-image capture, commit ordering, rollback and undo-row shape.
    */
-  payloadMessage?: string;
-  /** SAFETY: User-facing diagnosis, never a model remedy — a GLOSSARY.md glossary term. */
-  cause?: RangeCause;
-  details?: { code: DomainErrorCode; cause: RangeCause };
-}
-
-export type MutationResult = MutationSuccess | MutationFailure;
-
-// WHY: Narrowing helpers — keep call sites exhaustive.
-export function isMutationSuccess(r: MutationResult): r is MutationSuccess {
-  return r.ok === true;
-}
-
-export function isMutationFailure(r: MutationResult): r is MutationFailure {
-  return r.ok === false;
+  lifecycle?: MemberLifecycle;
 }

package/src/mutation-queue.ts

@@ -1,4 +1,4 @@
-import { withFileMutationQueue } from "@earendil-works/pi-coding-agent";
+import { withFileMutationQueue } from "./host-utils.js";
 
 /**
  * Enter pi's per-path mutation queues for SEVERAL paths in one deterministic, sorted nesting.

package/src/prompts.ts

@@ -1,25 +1,6 @@
 import { readFileSync } from "node:fs";
-import { EDIT_DESCRIPTION, EDIT_SNIPPET, EDIT_GUIDELINES } from "./payload-contract.js";
-
-const EDIT_PROMPT_FILES = new Set([
-  "../prompts/edit.md",
-  "prompts/edit.md",
-  "../prompts/edit-snippet.md",
-  "prompts/edit-snippet.md",
-]);
-
-const EDIT_GUIDE_FILES = new Set(["../prompts/edit-guidelines.md", "prompts/edit-guidelines.md"]);
 
 export function loadP(relativePath: string, replacements?: Record<string, string>): string {
-  if (EDIT_PROMPT_FILES.has(relativePath)) {
-    let content = relativePath.includes("snippet") ? EDIT_SNIPPET : EDIT_DESCRIPTION;
-    if (replacements) {
-      for (const [key, value] of Object.entries(replacements)) {
-        content = content.split(`{{${key}}}`).join(value);
-      }
-    }
-    return content;
-  }
   let content = readFileSync(new URL(relativePath, import.meta.url), "utf-8").trim();
   if (replacements) {
     for (const [key, value] of Object.entries(replacements)) {
@@ -30,15 +11,6 @@ export function loadP(relativePath: string, replacements?: Record<string, string
 }
 
 export function loadGuide(relativePath: string, replacements?: Record<string, string>): string[] {
-  if (EDIT_GUIDE_FILES.has(relativePath)) {
-    let guidelines = [...EDIT_GUIDELINES];
-    if (replacements) {
-      for (const [key, value] of Object.entries(replacements)) {
-        guidelines = guidelines.map((line) => line.split(`{{${key}}}`).join(value));
-      }
-    }
-    return guidelines;
-  }
   let content = readFileSync(new URL(relativePath, import.meta.url), "utf-8");
   if (replacements) {
     for (const [key, value] of Object.entries(replacements)) {

package/src/read-expansion/ast-provider.ts

@@ -24,6 +24,8 @@ import { TYPESCRIPT_DECORATION } from "./typescript-decoration.js";
 import { PYTHON_DECORATION } from "./python-decoration.js";
 import { GO_DECORATION } from "./go-decoration.js";
 import { RUST_DECORATION } from "./rust-decoration.js";
+import { JAVA_DECORATION } from "./java-decoration.js";
+import { VUE_DECORATION } from "./vue-decoration.js";
 
 interface LanguageScope {
   readonly decorate: ScopeDecorator;
@@ -45,6 +47,8 @@ export const LANGUAGES: Readonly<Record<string, LanguageScope>> = {
   },
   go: { decorate: createScopeDecorator(GO_DECORATION), kinds: GO_DECORATION.kinds },
   rust: { decorate: createScopeDecorator(RUST_DECORATION), kinds: RUST_DECORATION.kinds },
+  java: { decorate: createScopeDecorator(JAVA_DECORATION), kinds: JAVA_DECORATION.kinds },
+  vue: { decorate: createScopeDecorator(VUE_DECORATION), kinds: VUE_DECORATION.kinds },
 };
 
 export interface AstSpanProviderOptions extends GrammarCacheOptions {

package/src/read-expansion/grammar-manifest.ts

@@ -19,8 +19,10 @@ export interface GrammarManifestEntry {
 export type GrammarManifest = Readonly<Record<string, GrammarManifestEntry>>;
 
 /**
- * TypeScript/TSX grammars from the pinned tree-sitter-typescript release. Both are fetched from a
- * versioned URL and verified against the committed digest before they reach the parser.
+ * Pinned grammars: TypeScript/TSX from the tree-sitter-typescript release, Python/Go/Rust from their
+ * own releases, Java from the tree-sitter-java release and Vue from the tree-sitter-vue-wasm npm
+ * package. Every entry is fetched from a versioned URL and verified against the committed digest
+ * before it reaches the parser.
  */
 export const GRAMMAR_MANIFEST: GrammarManifest = {
   typescript: {
@@ -53,6 +55,18 @@ export const GRAMMAR_MANIFEST: GrammarManifest = {
     url: "https://github.com/tree-sitter/tree-sitter-rust/releases/download/v0.24.2/tree-sitter-rust.wasm",
     sha256: "24c89bd9252255e4aebbcbd7d2d308bd92c86dd95a130fdc80efa49577b8d738",
   },
+  java: {
+    language: "java",
+    version: "0.23.5",
+    url: "https://github.com/tree-sitter/tree-sitter-java/releases/download/v0.23.5/tree-sitter-java.wasm",
+    sha256: "4fdeac4ca6ca089f06c6f7e562abcac1733cd465728cc7031ebb73c2019122c4",
+  },
+  vue: {
+    language: "vue",
+    version: "0.1.0",
+    url: "https://unpkg.com/tree-sitter-vue-wasm@0.1.0/tree-sitter-vue.wasm",
+    sha256: "193c01119229352f1a772952e590b2ad59a75ee21eb7244433abdafdaacaea71",
+  },
 };
 
 const LANGUAGE_BY_EXTENSION = new Map([
@@ -63,6 +77,11 @@ const LANGUAGE_BY_EXTENSION = new Map([
   [".py", "python"],
   [".go", "go"],
   [".rs", "rust"],
+  [".java", "java"],
+  [".vue", "vue"],
+  // WHY: no .sh/.bash here — bash-provider.ts already serves shell functions through the existing
+  // WHY: `unbash` dependency (ADR-0008 decision 10); mapping them here would prefetch a second,
+  // WHY: unused parser and contradict the no-new-download decision.
 ]);
 
 /** The manifest entry for a source path, or undefined when no grammar is supported yet. */

package/src/read-expansion/java-decoration.ts

@@ -0,0 +1,34 @@
+/** Java vocabulary for the shared scope-decoration walk. */
+import type { DecorationSpec } from "./scope-decoration.js";
+import type { SpanKindTable } from "./span-kind.js";
+
+/**
+ * Java declaration nodes and their note kinds. A record is a class-like declaration, so it shares
+ * the `class` label; a constructor is its own protocol kind and is never relabelled as a method.
+ */
+export const JAVA_SPAN_KINDS = {
+  class_declaration: "class",
+  record_declaration: "class",
+  interface_declaration: "interface",
+  enum_declaration: "enum",
+  method_declaration: "method",
+  constructor_declaration: "constructor",
+  compact_constructor_declaration: "constructor",
+} as const satisfies SpanKindTable;
+
+/**
+ * A Java declaration carries its modifiers (annotations included) inside its own node, so the
+ * span already starts at the first annotation. Only a directly preceding JavaDoc block needs the
+ * leading-sibling walk; ordinary `//` and `/*` comments are not documentation and stay outside.
+ */
+export const JAVA_DECORATION: DecorationSpec = {
+  kinds: JAVA_SPAN_KINDS,
+  docCommentTypes: new Set(["block_comment"]),
+  isDocComment: (node) => node.text?.trimStart().startsWith("/**") ?? false,
+  wrapperTypes: new Set(),
+  assignmentNodeTypes: new Set(),
+  assignmentWrapperTypes: new Set(),
+  transparentTypes: new Set(),
+  decorationTypes: new Set(),
+  nameField: "name",
+};

package/src/read-expansion/span-expansion.ts

@@ -62,9 +62,13 @@ export interface SpanProvider {
 
 /**
  * Only a folded requested span at or below this size triggers expansion. Folding happens first, so
- * sixteen adjacent 24-line windows are one 384-line span and refuse the trigger.
+ * sixteen adjacent windows are one span and refuse the trigger.
+ *
+ * WHY 61: measured against the working corpus — 25-40 line reads occurred 66 times, 41-60 38 times,
+ * 61-100 38 times and >200 once, with a median refused read of 61 lines. At the previous 24-line
+ * trigger expansion engaged on only 9.6% of reads; the cap, not this trigger, still bounds the cost.
  */
-export const TRIGGER_MAX = 24;
+export const TRIGGER_MAX = 61;
 
 /** Code scopes may widen to a function or method; this ceiling is refused, never clamped. */
 export const SPAN_CAP_CODE = 80;

package/src/read-expansion/span-kind.ts

@@ -5,7 +5,8 @@
  * `SPAN_KIND_TO_LSP` carries the canonical PascalCase name next to it. Six extensions cover
  * concepts the protocol cannot express honestly: `arrow` (an anonymous function assigned to a
  * name), `typeAlias`, `impl` and `trait` (Rust items; mapping them to `Object` would be a lie),
- * and the non-AST prose units `section` and `paragraph`.
+ * and the non-symbol document units `section` (Markdown sections and Vue SFC blocks) and
+ * `paragraph` (plain-text paragraphs).
  *
  * Display stays lowercase because the note is model-facing prose, not a protocol symbol. The two
  * camel-case members `enumMember` and `typeParameter` are rendered as `enum member` and
@@ -187,6 +188,7 @@ export const PRODUCED_KINDS = [
   "typeAlias",
   "section",
   "paragraph",
+  "constructor",
 ] as const satisfies readonly SpanKind[];
 
 /** One language's grammar-node-type to note-kind data table. */

package/src/read-expansion/vue-decoration.ts

@@ -0,0 +1,43 @@
+/** Vue single-file-component vocabulary for the shared scope-decoration walk. */
+import type { SyntaxNodeLike } from "./ast-span.js";
+import type { DecorationSpec } from "./scope-decoration.js";
+import type { SpanKindTable } from "./span-kind.js";
+
+/**
+ * A `.vue` file is one component made of top-level document sections. The note vocabulary has no
+ * template/style symbol and `component` is the file root (never a widening target), so the three
+ * SFC block nodes share the existing `section` extension and are distinguished by their names.
+ * Embedded JavaScript/TypeScript is raw text in this grammar, so a script section is never parsed
+ * or widened beyond its own block.
+ */
+export const VUE_SPAN_KINDS = {
+  template_element: "section",
+  script_element: "section",
+  style_element: "section",
+} as const satisfies SpanKindTable;
+
+/** The block name a reader sees after the `section` label: template, script or style. */
+function vueSectionName(node: SyntaxNodeLike): string | undefined {
+  switch (node.type) {
+    case "template_element":
+      return "template";
+    case "script_element":
+      return "script";
+    case "style_element":
+      return "style";
+    default:
+      return undefined;
+  }
+}
+
+export const VUE_DECORATION: DecorationSpec = {
+  kinds: VUE_SPAN_KINDS,
+  docCommentTypes: new Set(),
+  wrapperTypes: new Set(),
+  assignmentNodeTypes: new Set(),
+  assignmentWrapperTypes: new Set(),
+  transparentTypes: new Set(),
+  decorationTypes: new Set(),
+  nameField: "name",
+  nameOf: vueSectionName,
+};

package/src/served-session/serve-render.ts

@@ -90,7 +90,7 @@ export function fmtServedRows(rows: ServedRow[], fileLines: string[]): string {
 
 // WHY: the one continuation a rejected edit offers (read-chrome): the `windows` offset, not a bare
 // WHY: `offset`, because `offset` alone no longer continues anything a page footer used to name.
-function paginationHint(nextOffset: number, more: number): string {
+export function paginationHint(nextOffset: number, more: number): string {
   return `[... ${more} more — use windows: [{ offset: ${nextOffset} }]]`;
 }
 
@@ -107,7 +107,7 @@ export function servedPositionsOf(served: (string | null)[], hash: string): numb
 // WHY: ---------------------------------------------------------------------------
 
 /** Builds the reject-and-serve served rows + rendered block for a current on-disk range. */
-function buildRangeServeBlock(
+export function buildRangeServeBlock(
   startLine: number,
   endLine: number,
   fileHashes: string[],
@@ -221,9 +221,9 @@ export function makeServedRejection(opts: {
 
 /**
  * Builds the `[E_STALE_ANCHOR]` reject-and-serve rejection for a boundary anchor the session holds
- * no lease for. It serves the rows under `Current range:` with the retry hint (spec §5.3): the
- * served rows are themselves serves, so the retry needs no `read`. Distinct from the range-family
- * codes, which serve a fresh read with no mandate (issue #149).
+ * no lease for. It serves the rows under `Current range:` as evidence with no retry mandate: the
+ * served rows are themselves serves, so deciding from them needs no `read` (same fresh-read rule as
+ * the range-family codes, issue #149). The registry renders the block at most once.
  */
 export function makeStaleAnchorRejection(opts: {
   headline: string;

package/src/undo-store.ts

@@ -29,8 +29,25 @@ export interface UndoRecord {
    * `null` is a row from before this column, or an ordinary single-file edit.
    */
   rawPre?: string | null;
+  /**
+   * The lifecycle action this row reverses. Absent/null is an ordinary edit (back-compatible).
+   * add = the file did not exist before; delete = the file does not exist after; move = a pure
+   * rename with an optional content edit.
+   */
+  lifecycle?: UndoLifecycle | null;
+  /** Move: the absolute path the file had before the transaction. */
+  fromPath?: string | null;
+  /** Move: the absolute path the file has after the transaction. */
+  toPath?: string | null;
+  /** The RAW post-transaction text when the commit wrote non-canonical bytes (pure move). */
+  rawPost?: string | null;
+  /** Add: the directories the add created, outermost first, JSON-encoded in the column. */
+  createdDirs?: readonly string[] | null;
 }
 
+/** The lifecycle action one undo row reverses. */
+export type UndoLifecycle = "edit" | "add" | "delete" | "move";
+
 export type CutIntentDirection = "revert" | null;
 
 export interface CutIntent {
@@ -50,6 +67,11 @@ export interface UndoStmts {
     snapshotHash: string | null,
     transactionId: string | null,
     rawPre: string | null,
+    lifecycle: string | null,
+    fromPath: string | null,
+    toPath: string | null,
+    rawPost: string | null,
+    createdDirs: string | null,
     anchorGeneration: number,
     updatedAt: number,
   ) => void;
@@ -75,15 +97,15 @@ export function undoStmts(db: DatabaseSync): UndoStmts {
 
 function buildStmts(db: DatabaseSync): UndoStmts {
   const undoUpsertStmt = db.prepare(
-    "INSERT INTO file_undo (path, content, bom, ending, hashes, result_content, snapshot_hash, transaction_id, raw_pre, anchor_generation, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) " +
-      "ON CONFLICT(path) DO UPDATE SET content = excluded.content, bom = excluded.bom, ending = excluded.ending, hashes = excluded.hashes, result_content = excluded.result_content, snapshot_hash = excluded.snapshot_hash, transaction_id = excluded.transaction_id, raw_pre = excluded.raw_pre, anchor_generation = excluded.anchor_generation, updated_at = excluded.updated_at",
+    "INSERT INTO file_undo (path, content, bom, ending, hashes, result_content, snapshot_hash, transaction_id, raw_pre, lifecycle, from_path, to_path, raw_post, created_dirs, anchor_generation, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) " +
+      "ON CONFLICT(path) DO UPDATE SET content = excluded.content, bom = excluded.bom, ending = excluded.ending, hashes = excluded.hashes, result_content = excluded.result_content, snapshot_hash = excluded.snapshot_hash, transaction_id = excluded.transaction_id, raw_pre = excluded.raw_pre, lifecycle = excluded.lifecycle, from_path = excluded.from_path, to_path = excluded.to_path, raw_post = excluded.raw_post, created_dirs = excluded.created_dirs, anchor_generation = excluded.anchor_generation, updated_at = excluded.updated_at",
   );
   const undoGetStmt = db.prepare(
-    "SELECT content, bom, ending, hashes, result_content, snapshot_hash, transaction_id, raw_pre, anchor_generation FROM file_undo WHERE path = ?",
+    "SELECT content, bom, ending, hashes, result_content, snapshot_hash, transaction_id, raw_pre, lifecycle, from_path, to_path, raw_post, created_dirs, anchor_generation FROM file_undo WHERE path = ?",
   );
   const undoDelStmt = db.prepare("DELETE FROM file_undo WHERE path = ?");
   const undoGetTransactionStmt = db.prepare(
-    "SELECT path, content, bom, ending, hashes, result_content, snapshot_hash, transaction_id, raw_pre, anchor_generation FROM file_undo WHERE transaction_id = ? ORDER BY path",
+    "SELECT path, content, bom, ending, hashes, result_content, snapshot_hash, transaction_id, raw_pre, lifecycle, from_path, to_path, raw_post, created_dirs, anchor_generation FROM file_undo WHERE transaction_id = ? ORDER BY path",
   );
   const undoDelTransactionStmt = db.prepare("DELETE FROM file_undo WHERE transaction_id = ?");
   const intentUpsertStmt = db.prepare(
@@ -105,6 +127,11 @@ function buildStmts(db: DatabaseSync): UndoStmts {
       snapshotHash,
       transactionId,
       rawPre,
+      lifecycle,
+      fromPath,
+      toPath,
+      rawPost,
+      createdDirs,
       anchorGeneration,
       updatedAt,
     ) => {
@@ -119,6 +146,11 @@ function buildStmts(db: DatabaseSync): UndoStmts {
           snapshotHash,
           transactionId,
           rawPre,
+          lifecycle,
+          fromPath,
+          toPath,
+          rawPost,
+          createdDirs,
           anchorGeneration,
           updatedAt,
         );
@@ -164,12 +196,25 @@ onStoreOpen((db) => {
   ensureFileUndoSchema(db);
 });
 
+/** Parse the JSON-encoded created-directory list; a corrupt value degrades to an empty list. */
+function parseCreatedDirs(value: unknown): string[] | null {
+  if (typeof value !== "string" || value.length === 0) return null;
+  try {
+    const parsed: unknown = JSON.parse(value);
+    return Array.isArray(parsed) && parsed.every((entry) => typeof entry === "string")
+      ? (parsed as string[])
+      : null;
+  } catch {
+    return null;
+  }
+}
+
 function parseUndoRow(row: Record<string, unknown> | undefined): UndoRecord | undefined {
   if (!row) return undefined;
   try {
     const parsed = JSON.parse(row.hashes as string);
     if (!isValidHashList(parsed)) return undefined;
-    return {
+    const record: UndoRecord = {
       content: row.content as string,
       bom: row.bom as string,
       ending: row.ending as string,
@@ -180,6 +225,23 @@ function parseUndoRow(row: Record<string, unknown> | undefined): UndoRecord | un
       rawPre: (row.raw_pre as string | null) ?? null,
       anchorGeneration: (row.anchor_generation as number | null) ?? 0,
     };
+    // WHY: the lifecycle fields are additive; an ordinary row omits them entirely so its
+    // WHY: pre-extension shape stays byte-for-byte what existing consumers assert.
+    if (row.lifecycle !== null && row.lifecycle !== undefined) {
+      record.lifecycle = row.lifecycle as UndoLifecycle;
+    }
+    if (row.from_path !== null && row.from_path !== undefined) {
+      record.fromPath = row.from_path as string;
+    }
+    if (row.to_path !== null && row.to_path !== undefined) {
+      record.toPath = row.to_path as string;
+    }
+    if (row.raw_post !== null && row.raw_post !== undefined) {
+      record.rawPost = row.raw_post as string;
+    }
+    const createdDirs = parseCreatedDirs(row.created_dirs);
+    if (createdDirs !== null) record.createdDirs = createdDirs;
+    return record;
   } catch {
     return undefined;
   }
@@ -196,6 +258,13 @@ export function upsertUndo(store: HashStore, path: string, entry: UndoRecord): v
     entry.snapshotHash ?? null,
     entry.transactionId ?? null,
     entry.rawPre ?? null,
+    entry.lifecycle ?? null,
+    entry.fromPath ?? null,
+    entry.toPath ?? null,
+    entry.rawPost ?? null,
+    entry.createdDirs === null || entry.createdDirs === undefined
+      ? null
+      : JSON.stringify(entry.createdDirs),
     // WHY: ADR-0031 §4 (refuse, do not launder) — the stamp comes from the payload, never
     // WHY: hard-coded: a replay of a pre-generation row preserves its generation so the
     // WHY: restore gate re-derives, while a fresh write (absent generation) defaults current.

package/lib/types/dsh/encoding-bridge.d.ts

@@ -1,25 +0,0 @@
-import type { FileIO } from "./contracts.js";
-import { type EncodingState } from "./encoding.js";
-/** One staged UTF-8 bridge: the bytes to restore on failure, the state to invert on success. */
-export interface EncodingBridge {
-    readonly absolutePath: string;
-    readonly rawBytes: Uint8Array;
-    readonly state: EncodingState;
-}
-/**
- * Capture every member of one mutation (a correlated cut's target and source
- * files), staging each recorded legacy/UTF-16 member as UTF-8. Members without a
- * recorded state or with a UTF-8-native state are skipped, so they keep the
- * core's UTF-8 behavior. Staging is all-or-nothing: a mid-list failure restores
- * the members already staged before rethrowing.
- * @param files - the mutation's member paths, in commit order.
- * @param label - operation name for diagnostics and rollback messages.
- */
-export declare function captureEncodingBridges(io: FileIO, files: readonly string[], cwd: string, signal: AbortSignal | undefined, label: string): Promise<EncodingBridge[]>;
-/**
- * Invert the recorded encoding over each member's core-written UTF-8 result and
- * collect the model-facing warning of every lossy degradation.
- */
-export declare function finishEncodingBridges(io: FileIO, bridges: readonly EncodingBridge[], label: string): Promise<string[]>;
-/** Restore every captured member's pre-mutation bytes after a refusal (best-effort). */
-export declare function restoreEncodingBridges(io: FileIO, bridges: readonly EncodingBridge[], label: string): Promise<void>;