dsh-vscode-mode 0.19.2 → 0.20.1

package/lib/index.js

@@ -1209,11 +1209,14 @@ function fileMaxBatch(records, path) {
 	for (const r of records.values()) if (r.path === path && Number.isInteger(r.batch) && r.batch > m) m = r.batch;
 	return m;
 }
-/** 记录桶裁剪：超出 MAX_RECORDS 时剔除最旧的。 */
+/** @public @author ddj 2026年10月26号 @param map Legacy records. @param max Cache target, never a pending retention limit. */
 function prune(map, max = 200) {
 	if (map.size <= max) return;
-	const sorted = [...map.values()].sort((a, b) => a.at < b.at ? -1 : 1);
-	for (let i = 0; i < sorted.length - max; i++) map.delete(sorted[i].callId);
+	const sorted = [...map.values()].filter((record) => record.archived && recordResolved(record)).sort((a, b) => a.at < b.at ? -1 : 1);
+	for (const record of sorted) {
+		if (map.size <= max) break;
+		map.delete(record.callId);
+	}
 }
 /**
 * 归档条目构造（一条批次一条）。
@@ -1926,7 +1929,7 @@ function dbFor(cwd) {
 		db.exec("CREATE TABLE IF NOT EXISTS metadata (name TEXT PRIMARY KEY, value TEXT NOT NULL)");
 		const version = db.prepare("SELECT value FROM metadata WHERE name='schema'").get();
 		const workspace = db.prepare("SELECT value FROM metadata WHERE name='cwd'").get();
-		if (version && version.value !== "2" && version.value !== "3" || workspace && workspace.value !== cwd) throw new Error("归档数据库 schema/工作区不匹配");
+		if (version && version.value !== "2" && version.value !== "3" && version.value !== "4" || workspace && workspace.value !== cwd) throw new Error("归档数据库 schema/工作区不匹配");
 		if (!!version !== !!workspace) throw new Error("归档数据库元数据不完整");
 		if (!version) {
 			if (db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%' AND name<>'metadata' LIMIT 1").get()) throw new Error("归档数据库缺失元数据且已有数据表");
@@ -1962,7 +1965,7 @@ function dbFor(cwd) {
 				throw error;
 			}
 		}
-		if (version?.value === "3") {
+		if (version && (version.value === "3" || version.value === "4")) {
 			const active = db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='active_records'").get();
 			const source = db.prepare("SELECT value FROM metadata WHERE name='active_source'").get();
 			if (!active || !source) throw new Error("活跃记录数据库元数据不完整");
@@ -1984,7 +1987,8 @@ function dbFor(cwd) {
 */
 async function migrateActive(cwd, source, confirm) {
 	const db = dbFor(cwd);
-	if (String(db.prepare("SELECT value FROM metadata WHERE name='schema'").get().value) === "3") return readActive(cwd);
+	const version = String(db.prepare("SELECT value FROM metadata WHERE name='schema'").get().value);
+	if (version === "3" || version === "4") return readActive(cwd);
 	const digest = source === null ? "absent" : createHash("sha256").update(source).digest("hex");
 	let recs = {};
 	if (source !== null) {
@@ -2026,7 +2030,7 @@ async function migrateActive(cwd, source, confirm) {
 * @returns 迁移完成返回 true
 */
 function activeReady(cwd) {
-	return dbFor(cwd).prepare("SELECT value FROM metadata WHERE name='schema'").get().value === "3";
+	return ["3", "4"].includes(String(dbFor(cwd).prepare("SELECT value FROM metadata WHERE name='schema'").get().value));
 }
 /**
 * 对旧文件原文核对迁移标记，旧 Host 若继续写旧 sidecar 则拒绝启用新活跃库。
@@ -2048,7 +2052,7 @@ function checkActiveSource(cwd, source) {
 */
 function readActive(cwd) {
 	const db = dbFor(cwd);
-	if (db.prepare("SELECT value FROM metadata WHERE name='schema'").get().value !== "3") throw new Error("工作区活跃记录未迁移");
+	if (!activeReady(cwd)) throw new Error("工作区活跃记录未迁移");
 	const recs = db.prepare("SELECT payload FROM active_records ORDER BY rowid").all().map((row) => JSON.parse(String(row.payload)));
 	return new Map(recs.map((rec) => [rec.callId, rec]));
 }
@@ -2062,7 +2066,7 @@ function readActive(cwd) {
 */
 function commitActive(cwd, changes, entries = []) {
 	const db = dbFor(cwd);
-	if (db.prepare("SELECT value FROM metadata WHERE name='schema'").get().value !== "3") throw new Error("工作区活跃记录未迁移");
+	if (!activeReady(cwd)) throw new Error("工作区活跃记录未迁移");
 	const upsert = db.prepare(`INSERT INTO active_records(call_id,payload,path,archived,pending,at) VALUES(?,?,?,?,?,?)
     ON CONFLICT(call_id) DO UPDATE SET payload=excluded.payload,path=excluded.path,
       archived=excluded.archived,pending=excluded.pending,at=excluded.at`);
@@ -2090,7 +2094,7 @@ function commitActive(cwd, changes, entries = []) {
 */
 function activeSummary(cwd) {
 	const db = dbFor(cwd);
-	if (db.prepare("SELECT value FROM metadata WHERE name='schema'").get().value !== "3") throw new Error("工作区活跃记录未迁移");
+	if (!activeReady(cwd)) throw new Error("工作区活跃记录未迁移");
 	return {
 		active: Number(db.prepare("SELECT count(*) AS n FROM active_records WHERE archived=0").get().n),
 		pendingByFile: db.prepare("SELECT path, sum(pending) AS pending FROM active_records WHERE archived=0 AND pending>0 GROUP BY path ORDER BY pending DESC").all().map((row) => ({
@@ -2534,10 +2538,16 @@ async function readForCache(ctx, session, cache, path) {
 */
 async function recordIsStale(ctx, session, cache, rec) {
 	if (rec.superseded === true) return true;
-	if (!Array.isArray(rec.hunks) || !rec.hunks.length) return true;
+	if (!Array.isArray(rec.hunks) || !rec.hunks.length) {
+		rec.conflict = true;
+		return false;
+	}
 	const state = await readForCache(ctx, session, cache, rec.path);
 	if (state.kind === "unavailable") return false;
-	if (state.kind === "missing") return true;
+	if (state.kind === "missing") {
+		rec.conflict = true;
+		return false;
+	}
 	if (rec.create === true) return false;
 	const pending = rec.hunks.map((_, idx) => ({
 		idx,
@@ -6968,7 +6978,7 @@ function buildLocalRecord(exec, args, result) {
 	if (typeof path !== "string" || !path) return null;
 	const before = value && typeof value.before === "string" ? value.before : null;
 	const after = value && typeof value.after === "string" ? value.after : typeof args.content === "string" ? args.content : null;
-	const create = exec.name === "write" && !!value && value.before === null;
+	const create = exec.name === "write" && value?.operation === "create";
 	const callHunk = exec.name === "edit" && typeof args.old_string === "string" && typeof args.new_string === "string" ? {
 		oldText: args.old_string,
 		newText: args.new_string
@@ -7170,6 +7180,756 @@ async function captureToolResult(ctx, registry, exec, result) {
 	}
 }
 //#endregion
+//#region src/shared/reviewRegions.ts
+/** @public @author ddj 2026年10月27号 @param diff Immutable official patch. @returns Contiguous change runs with stable source-coordinate identities. */
+function reviewBlocks(diff) {
+	if (diff.kind !== "text") return [];
+	const blocks = [];
+	for (const [hunkIndex, hunk] of diff.hunks.entries()) {
+		let oldLine = hunk.oldStart, newLine = hunk.newStart;
+		let before = [];
+		let current;
+		for (const line of hunk.lines) {
+			const marker = line[0], text = line.slice(1);
+			if (marker === " ") {
+				if (current) {
+					current.contextAfter.push(text);
+					current = void 0;
+				} else if (blocks.at(-1)?.hunkIndex === hunkIndex) blocks.at(-1).contextAfter.push(text);
+				before.push(text);
+				oldLine++;
+				newLine++;
+				continue;
+			}
+			if (marker !== "+" && marker !== "-") continue;
+			if (!current) {
+				current = {
+					id: `${hunkIndex}:${oldLine}:${newLine}`,
+					hunkIndex,
+					oldStart: oldLine,
+					newStart: newLine,
+					oldLines: [],
+					newLines: [],
+					contextBefore: before.slice(-3),
+					contextAfter: []
+				};
+				blocks.push(current);
+				before = [];
+			}
+			if (marker === "-") {
+				current.oldLines.push(text);
+				oldLine++;
+			} else {
+				current.newLines.push(text);
+				newLine++;
+			}
+		}
+	}
+	return blocks;
+}
+//#endregion
+//#region src/reviewDb.ts
+/** Official history shares the archive connection, but never the legacy callId namespace. @author ddj 2026年10月26号 */
+/** @public @author ddj 2026年10月26号 @param cwd Migrated workspace. @returns Schema4 connection; DDL and version change roll back together. */
+function reviewDb(cwd) {
+	if (!activeReady(cwd)) throw new Error("官方审查要求先完成活跃库迁移");
+	const db = dbFor(cwd);
+	if (db.prepare("SELECT value FROM metadata WHERE name='schema'").get().value === "4") {
+		migrateBlocks(cwd, db);
+		return db;
+	}
+	db.exec("BEGIN IMMEDIATE");
+	try {
+		db.exec(`CREATE TABLE review_snapshots (
+      session_id TEXT NOT NULL, turn INTEGER NOT NULL, seq INTEGER NOT NULL,
+      payload TEXT NOT NULL, digest TEXT NOT NULL, current INTEGER NOT NULL DEFAULT 1,
+      PRIMARY KEY(session_id,turn,seq));
+      CREATE TABLE review_files (
+      id TEXT PRIMARY KEY, session_id TEXT NOT NULL, turn INTEGER NOT NULL, seq INTEGER NOT NULL,
+      identity TEXT NOT NULL, summary TEXT NOT NULL, diff TEXT NOT NULL,
+      decision TEXT NOT NULL DEFAULT 'pending', revision INTEGER NOT NULL DEFAULT 0,
+      current INTEGER NOT NULL DEFAULT 1);
+      CREATE INDEX review_pending ON review_files(current,decision,id);
+      CREATE INDEX review_turn ON review_files(session_id,turn,seq);
+      CREATE TABLE review_capture (
+      session_id TEXT NOT NULL, turn INTEGER NOT NULL, seq INTEGER NOT NULL,
+      state TEXT NOT NULL, error TEXT, PRIMARY KEY(session_id,turn,seq));
+      CREATE TABLE review_ops (
+      operation_id TEXT PRIMARY KEY, request TEXT NOT NULL, state TEXT NOT NULL, result TEXT,
+      evidence TEXT);
+      UPDATE metadata SET value='4' WHERE name='schema';`);
+		db.exec("COMMIT");
+	} catch (error) {
+		if (db.isTransaction) db.exec("ROLLBACK");
+		throw error;
+	}
+	migrateBlocks(cwd, db);
+	return db;
+}
+/** @private @author ddj 2026年10月27号 @param cwd Workspace backup identity. @param db Open schema4 database. Extends the official-review sub-schema without changing legacy archive schema. @throws Migration failure, leaving prior decisions intact. */
+function migrateBlocks(cwd, db) {
+	if (db.prepare("SELECT value FROM metadata WHERE name='review_schema'").get()) return;
+	const backup = archiveDbFile(cwd) + ".before-review-blocks.bak";
+	if (!existsSync(backup)) db.exec(`VACUUM INTO '${backup.replace(/'/g, "''")}'`);
+	db.exec("BEGIN IMMEDIATE");
+	try {
+		db.exec(`CREATE TABLE review_blocks (file_id TEXT NOT NULL, block_id TEXT NOT NULL,
+      decision TEXT NOT NULL, PRIMARY KEY(file_id,block_id));
+      CREATE TABLE review_evidence (file_id TEXT PRIMARY KEY, payload TEXT NOT NULL);
+      INSERT INTO metadata(name,value) VALUES('review_schema','2');`);
+		const files = db.prepare("SELECT id,diff,decision FROM review_files").all();
+		for (const file of files) seedBlocks(db, String(file.id), JSON.parse(String(file.diff)), String(file.decision));
+		db.exec("COMMIT");
+	} catch (error) {
+		if (db.isTransaction) db.exec("ROLLBACK");
+		throw error;
+	}
+}
+/** @private @author ddj 2026年10月27号 @param db Transaction connection. @param id File record. @param diff Immutable official source. @param decision Prior file decision. Seeds deterministic blocks without changing source facts. */
+function seedBlocks(db, id, diff, decision) {
+	const insert = db.prepare("INSERT INTO review_blocks VALUES(?,?,?)");
+	for (const block of reviewBlocks(diff)) insert.run(id, block.id, decision);
+}
+/** @private @author ddj 2026年10月26号 @param text Canonical serialized input. @returns Collision-resistant identity. */
+function digest(text) {
+	return createHash("sha256").update(text).digest("hex");
+}
+/** @public @author ddj 2026年10月26号 @param cwd Workspace. @param snapshot Complete staged event. @returns False for late versions; commits facts, pointers and capture state atomically. */
+function saveSnapshot(cwd, snapshot) {
+	const db = reviewDb(cwd);
+	const { sessionId, turn, seq } = snapshot;
+	if (snapshot.summary.cwd !== cwd || snapshot.summary.turn !== turn || snapshot.files.length !== snapshot.summary.files.length) throw new Error("官方采集不完整");
+	if (new Set(snapshot.files.map((file) => file.identity)).size !== snapshot.files.length) throw new Error("官方文件身份重复");
+	const hash = digest(JSON.stringify({
+		...snapshot,
+		capturedAt: ""
+	}));
+	db.exec("BEGIN IMMEDIATE");
+	try {
+		const prior = db.prepare("SELECT digest FROM review_snapshots WHERE session_id=? AND turn=? AND seq=?").get(sessionId, turn, seq);
+		if (prior && prior.digest !== hash) throw new Error("同一官方事件的内容发生变化");
+		const latest = db.prepare("SELECT MAX(seq) AS seq FROM review_snapshots WHERE session_id=? AND turn=?").get(sessionId, turn);
+		if (prior || typeof latest.seq === "number" && latest.seq > seq) {
+			db.exec("COMMIT");
+			return false;
+		}
+		insertSnapshot(db, snapshot, hash);
+		db.prepare("INSERT INTO review_capture VALUES(?,?,?,'complete',NULL) ON CONFLICT(session_id,turn,seq) DO UPDATE SET state='complete',error=NULL").run(sessionId, turn, seq);
+		db.exec("COMMIT");
+		return true;
+	} catch (error) {
+		if (db.isTransaction) db.exec("ROLLBACK");
+		throw error;
+	}
+}
+/** @public @author ddj 2026年10月27号 @param cwd Workspace. @param resolvePath Backend path adapter. @returns Repairs only historical object-string identities; preserves IDs, decisions and immutable official facts. @throws Resolution or concurrent payload changes. */
+async function repairPaths(cwd, resolvePath) {
+	const db = reviewDb(cwd);
+	const broken = db.prepare(`SELECT DISTINCT s.* FROM review_snapshots s JOIN review_files f
+    USING(session_id,turn,seq) WHERE f.identity='[object Object]'`).all();
+	for (const row of broken) {
+		const snapshot = JSON.parse(String(row.payload));
+		for (const file of snapshot.files) {
+			if (file.identity !== "[object Object]") continue;
+			file.identity = await resolvePath(snapshot.summary.cwd, file.diff.path);
+			if (!file.identity || file.identity === "[object Object]") throw new Error("官方文件路径修复失败");
+		}
+		if (new Set(snapshot.files.map((file) => file.identity)).size !== snapshot.files.length) throw new Error("官方文件身份重复");
+		db.exec("BEGIN IMMEDIATE");
+		try {
+			if (db.prepare("SELECT payload FROM review_snapshots WHERE session_id=? AND turn=? AND seq=?").get(snapshot.sessionId, snapshot.turn, snapshot.seq)?.payload === row.payload) {
+				for (const file of snapshot.files) db.prepare(`UPDATE review_files SET identity=? WHERE session_id=? AND turn=? AND seq=?
+            AND identity='[object Object]' AND json_extract(diff,'$.path')=?`).run(file.identity, snapshot.sessionId, snapshot.turn, snapshot.seq, file.diff.path);
+				db.prepare("UPDATE review_snapshots SET payload=?,digest=? WHERE session_id=? AND turn=? AND seq=?").run(JSON.stringify(snapshot), digest(JSON.stringify({
+					...snapshot,
+					capturedAt: ""
+				})), snapshot.sessionId, snapshot.turn, snapshot.seq);
+			}
+			db.exec("COMMIT");
+		} catch (error) {
+			if (db.isTransaction) db.exec("ROLLBACK");
+			throw error;
+		}
+	}
+}
+/** @private @author ddj 2026年10月26号 @param db Transaction. @param snapshot Source payload. @param hash Source digest. */
+function insertSnapshot(db, snapshot, hash) {
+	const { sessionId, turn, seq } = snapshot;
+	const previous = db.prepare("SELECT id,identity,diff,decision FROM review_files WHERE session_id=? AND turn=? AND current=1").all(sessionId, turn);
+	db.prepare("UPDATE review_snapshots SET current=0 WHERE session_id=? AND turn=?").run(sessionId, turn);
+	db.prepare("UPDATE review_files SET current=0 WHERE session_id=? AND turn=?").run(sessionId, turn);
+	db.prepare("INSERT INTO review_snapshots VALUES(?,?,?,?,?,1)").run(sessionId, turn, seq, JSON.stringify(snapshot), hash);
+	const insert = db.prepare("INSERT INTO review_files VALUES(?,?,?,?,?,?,?,?,0,1)");
+	for (const [index, file] of snapshot.files.entries()) {
+		const encoded = JSON.stringify(file.diff);
+		const unchanged = previous.find((item) => item.identity === file.identity && item.diff === encoded);
+		const id = digest(JSON.stringify([
+			sessionId,
+			turn,
+			seq,
+			file.identity
+		]));
+		const decision = String(unchanged?.decision ?? "pending");
+		insert.run(id, sessionId, turn, seq, file.identity, JSON.stringify(snapshot.summary.files[index]), encoded, decision);
+		seedBlocks(db, id, file.diff, decision);
+		if (unchanged) {
+			db.prepare(`UPDATE review_blocks SET decision=(SELECT p.decision FROM review_blocks p
+        WHERE p.file_id=? AND p.block_id=review_blocks.block_id)
+        WHERE file_id=? AND EXISTS(SELECT 1 FROM review_blocks p WHERE p.file_id=? AND p.block_id=review_blocks.block_id)`).run(unchanged.id, id, unchanged.id);
+			db.prepare("INSERT INTO review_evidence SELECT ?,payload FROM review_evidence WHERE file_id=?").run(id, unchanged.id);
+		}
+	}
+}
+/** @public @author ddj 2026年10月26号 @param cwd Workspace. @param gap Announced event identity. @param state Durable inbox or explicit failure. */
+function captureState(cwd, gap, state) {
+	reviewDb(cwd).prepare(`INSERT INTO review_capture VALUES(?,?,?,?,?) ON CONFLICT(session_id,turn,seq)
+    DO UPDATE SET state=excluded.state,error=excluded.error WHERE review_capture.state<>'complete'`).run(gap.sessionId, gap.turn, gap.seq, state, gap.error);
+}
+/** @private @author ddj 2026年10月26号 @param row File and state. @returns Wire-safe summary without hunks. */
+function itemOf(row) {
+	const summary = JSON.parse(String(row.summary));
+	const kind = row.kind ?? JSON.parse(String(row.diff)).kind;
+	return {
+		id: String(row.id),
+		sessionId: String(row.session_id),
+		turn: Number(row.turn),
+		seq: Number(row.seq),
+		...summary,
+		currentPath: String(row.identity),
+		kind,
+		decision: row.decision,
+		revision: Number(row.revision),
+		current: row.current === 1
+	};
+}
+/** @public @author ddj 2026年10月26号 @param cwd Workspace. @param cursor Page offset. @param history Include withdrawn/decided history. @returns Bounded metadata page; pending across all source sessions/turns. */
+function reviewPage(cwd, cursor = 0, history = false, path) {
+	const db = reviewDb(cwd);
+	const offset = Number.isSafeInteger(cursor) && cursor >= 0 ? cursor : 0;
+	const conditions = history ? [] : ["current=1 AND decision='pending'"];
+	if (path !== void 0) conditions.push("identity=?");
+	const clause = conditions.length ? `WHERE ${conditions.join(" AND ")}` : "";
+	const parameters = path === void 0 ? [offset] : [path, offset];
+	const rows = db.prepare(`SELECT id,session_id,turn,seq,identity,summary,decision,revision,current,
+    json_extract(diff,'$.kind') AS kind FROM review_files ${clause} ORDER BY rowid DESC LIMIT 51 OFFSET ?`).all(...parameters);
+	const count = db.prepare("SELECT COUNT(*) AS n FROM review_files WHERE current=1 AND decision='pending'").get();
+	const gaps = db.prepare("SELECT * FROM review_capture WHERE state<>'complete' ORDER BY seq DESC LIMIT 50").all();
+	const capped = db.prepare(`SELECT session_id,turn,seq,json_extract(payload,'$.summary.total') AS total,
+    json_array_length(payload,'$.summary.files') AS listed FROM review_snapshots WHERE current=1
+    AND json_extract(payload,'$.summary.total')>json_array_length(payload,'$.summary.files') LIMIT 50`).all();
+	const files = db.prepare(`SELECT identity,MIN(json_extract(summary,'$.display')) AS label,COUNT(*) AS n
+    FROM review_files WHERE current=1 AND decision='pending' GROUP BY identity ORDER BY identity`).all();
+	const covered = db.prepare("SELECT DISTINCT identity FROM review_files").all();
+	return {
+		overview: {
+			files: files.map((row) => ({
+				sourceKind: "official",
+				path: String(row.identity),
+				label: String(row.label),
+				pending: Number(row.n)
+			})),
+			coveredPaths: covered.map((row) => String(row.identity))
+		},
+		items: rows.slice(0, 50).map(itemOf),
+		pending: Number(count.n),
+		nextCursor: rows.length > 50 ? offset + 50 : null,
+		gaps: [...gaps.map((row) => ({
+			sessionId: String(row.session_id),
+			turn: Number(row.turn),
+			seq: Number(row.seq),
+			error: String(row.error || "采集中或上次采集被中断")
+		})), ...capped.map((row) => ({
+			sessionId: String(row.session_id),
+			turn: Number(row.turn),
+			seq: Number(row.seq),
+			error: `官方列表已截断：总计 ${row.total} 个文件，仅提供 ${row.listed} 个`
+		}))]
+	};
+}
+/** @public @author ddj 2026年10月26号 @param cwd Migrated workspace. @param path Legacy write target. @returns Whether any official version owns the file, including decided history. */
+function hasOfficial(cwd, path) {
+	const db = dbFor(cwd);
+	if (!db.prepare("SELECT 1 FROM sqlite_master WHERE name='review_files' AND type='table'").get()) return false;
+	if (/^[A-Za-z]:[\\/]/.test(path)) return !!db.prepare("SELECT 1 FROM review_files WHERE lower(replace(identity,char(92),'/'))=? LIMIT 1").get(path.replace(/\\/g, "/").toLowerCase());
+	return !!db.prepare("SELECT 1 FROM review_files WHERE identity=? LIMIT 1").get(path);
+}
+/** @public @author ddj 2026年10月26号 @param cwd Workspace. @param id Immutable file identity. @returns Historical patch, not a reconstruction from disk. */
+function reviewDetail(cwd, id) {
+	const db = reviewDb(cwd);
+	const row = db.prepare(`SELECT f.*,json_extract(s.payload,'$.capturedAt') AS captured_at FROM review_files f JOIN review_snapshots s
+    USING(session_id,turn,seq) WHERE f.id=?`).get(id);
+	if (!row) return null;
+	const blocks = db.prepare("SELECT block_id AS id,decision FROM review_blocks WHERE file_id=? ORDER BY rowid").all(id);
+	const diff = JSON.parse(String(row.diff));
+	const evidence = db.prepare("SELECT 1 FROM review_evidence WHERE file_id=?").get(id);
+	const pending = row.current === 1 && row.decision === "pending";
+	const undo = pending && !!evidence && diff.kind === "text" && diff.before && diff.after && !diff.coarse;
+	return {
+		item: itemOf(row),
+		diff,
+		capturedAt: String(row.captured_at),
+		blocks,
+		capability: {
+			keep: pending,
+			undo,
+			reason: undo ? "Undo 将校验原始字节、当前文件版本及已处理差异块；文件变化会安全拒绝。" : "该记录缺少可验证的原始字节或受控写回能力；仍可显示差异和 Keep，不能猜测历史全文执行 Undo。"
+		}
+	};
+}
+/** @public @author ddj 2026年10月27号 @param db Active decision transaction. @param request File or block action. Updates aggregate without losing mixed decisions. @throws Invalid or already-decided block. */
+function changeBlocks(db, request) {
+	if (request.scope === "hunk") {
+		if (db.prepare("UPDATE review_blocks SET decision=? WHERE file_id=? AND block_id=? AND decision='pending'").run(request.decision, request.id, request.blockId ?? "").changes !== 1) throw new Error("差异块不存在或已处理");
+	} else db.prepare("UPDATE review_blocks SET decision=? WHERE file_id=? AND decision='pending'").run(request.decision, request.id);
+	const decisions = db.prepare("SELECT DISTINCT decision FROM review_blocks WHERE file_id=?").all(request.id).map((row) => String(row.decision));
+	let aggregate = request.decision;
+	if (decisions.includes("pending")) aggregate = "pending";
+	else if (decisions.length > 1) aggregate = "mixed";
+	else if (decisions.length === 1) aggregate = decisions[0];
+	db.prepare("UPDATE review_files SET decision=? WHERE id=?").run(aggregate, request.id);
+}
+/** @public @author ddj 2026年10月26号 @param cwd Workspace. @param request Frozen identity/revision. @returns Idempotent decision; rejection never guesses a target. */
+function decideReview(cwd, request) {
+	const db = reviewDb(cwd);
+	const encoded = JSON.stringify(request);
+	if (!request.operationId || request.operationId.length > 128) throw new Error("operationId 无效");
+	db.exec("BEGIN IMMEDIATE");
+	try {
+		const previous = db.prepare("SELECT request,result FROM review_ops WHERE operation_id=?").get(request.operationId);
+		if (previous) {
+			if (previous.request !== encoded) throw new Error("operationId 已用于其他请求");
+			if (!previous.result) throw new Error("Undo 尚待写后核对，请重试原操作");
+			db.exec("COMMIT");
+			return JSON.parse(String(previous.result));
+		}
+		if (db.prepare("SELECT 1 FROM review_ops WHERE state='prepared' AND json_extract(request,'$.id')=?").get(request.id)) throw new Error("该文件有尚待核对的 Undo，暂不能 Keep");
+		if (request.decision !== "accepted") throw new Error("缺少可信全文证据，禁止拒绝写回");
+		if (db.prepare(`UPDATE review_files SET decision='accepted',revision=revision+1
+      WHERE id=? AND seq=? AND revision=? AND current=1 AND decision='pending'`).run(request.id, request.seq, request.revision).changes !== 1) throw new Error("审查版本冲突，请刷新后重试");
+		changeBlocks(db, request);
+		const result = { revision: request.revision + 1 };
+		db.prepare("INSERT INTO review_ops VALUES(?,?,'committed',?,NULL)").run(request.operationId, encoded, JSON.stringify(result));
+		db.exec("COMMIT");
+		return result;
+	} catch (error) {
+		if (db.isTransaction) db.exec("ROLLBACK");
+		throw error;
+	}
+}
+//#endregion
+//#region src/officialCapture.ts
+/** Deferred official-event collection; no private snapshot access. @author ddj 2026年10月26号 */
+/** @public @author ddj 2026年10月26号 @param deps Official source and workspace adapters. @returns Bounded collector with cancellation and deferred event reads. */
+function createCollector(deps) {
+	const waiting = [];
+	const pending = /* @__PURE__ */ new Set();
+	const controller = new AbortController();
+	let active = 0;
+	let stopped = false;
+	const running = /* @__PURE__ */ new Set();
+	const tasks = /* @__PURE__ */ new Set();
+	/** @private @author ddj 2026年10月26号 @param ms Delay; aborted on unload. @returns Deferred completion, not synchronous observer work. */
+	function pause(ms) {
+		return new Promise((resolve) => {
+			/** @private @author ddj 2026年10月26号 Release both timer and listener. */
+			function finish() {
+				clearTimeout(timer);
+				controller.signal.removeEventListener("abort", finish);
+				resolve();
+			}
+			const timer = setTimeout(finish, ms);
+			controller.signal.addEventListener("abort", finish, { once: true });
+			if (stopped) finish();
+		});
+	}
+	/** @private @author ddj 2026年10月26号 @param task Source identity. @returns Complete payload staged before one database transaction. */
+	async function collect(task) {
+		await pause(0);
+		if (stopped) return;
+		const source = deps.source();
+		if (!source) throw new Error("官方 workspaceChanges 服务不可用");
+		let summary;
+		for (let attempt = 0; attempt < 4 && !stopped; attempt++) {
+			summary = source.summary(task.sessionId, task.seq);
+			if (summary) break;
+			await pause(deps.retryMs ?? 100);
+		}
+		if (!summary || stopped) throw new Error("官方事件已公告，但 summary 已失效或尚不可用");
+		summary = structuredClone(summary);
+		if (summary.turn !== task.turn) throw new Error("官方 summary 轮次与事件不一致");
+		task.cwd = summary.cwd;
+		await deps.prepare(summary.cwd);
+		if (stopped) return;
+		deps.state(summary.cwd, {
+			...task,
+			error: ""
+		}, "queued");
+		try {
+			const files = [];
+			for (const [index, file] of summary.files.entries()) {
+				if (stopped) return;
+				const diff = await readDiff(source, task, index, AbortSignal.any([controller.signal, AbortSignal.timeout(deps.timeoutMs ?? 1e4)]));
+				if (!diff || diff.path !== file.path || diff.display !== file.display) throw new Error("官方文件差异缺失或身份不一致");
+				const identity = await deps.identity(summary.cwd, file.path);
+				files.push({
+					identity,
+					diff: structuredClone(diff)
+				});
+			}
+			if (!stopped) deps.persist(summary.cwd, {
+				...task,
+				sourceKind: "official",
+				capturedAt: (/* @__PURE__ */ new Date()).toISOString(),
+				summary,
+				files
+			});
+		} catch (error) {
+			if (!stopped) deps.state(summary.cwd, {
+				...task,
+				error: String(error)
+			}, "gap");
+			throw error;
+		}
+	}
+	/** @private @author ddj 2026年10月26号 Starts at most two independent event reads, with each event's file reads serial. */
+	function drain() {
+		while (!stopped && active < 2 && waiting.length) {
+			const index = waiting.findIndex((task) => !running.has(JSON.stringify([task.sessionId, task.turn])));
+			if (index < 0) break;
+			const task = waiting.splice(index, 1)[0];
+			const key = JSON.stringify([
+				task.sessionId,
+				task.turn,
+				task.seq
+			]);
+			const turnKey = JSON.stringify([task.sessionId, task.turn]);
+			active++;
+			running.add(turnKey);
+			const work = collect(task).catch(async (error) => {
+				deps.report(`官方差异采集 ${key}: ${String(error)}`);
+				if (!stopped && task.cwd) try {
+					await deps.prepare(task.cwd);
+					if (!stopped) deps.state(task.cwd, {
+						...task,
+						error: String(error)
+					}, "gap");
+				} catch (failure) {
+					deps.report(`官方缺口落盘失败: ${String(failure)}`);
+				}
+			}).finally(() => {
+				active--;
+				pending.delete(key);
+				running.delete(turnKey);
+				tasks.delete(work);
+				drain();
+			});
+			tasks.add(work);
+		}
+	}
+	/** @public @author ddj 2026年10月26号 @param session Source session. @param event Published event; inherited fork events are excluded. */
+	function enqueue(session, event) {
+		if (stopped || event.type !== "workspace/changes" || !Number.isSafeInteger(event.data?.turn) || !Number.isSafeInteger(event.seq) || event.seq < (session.inheritedEventCount ?? 0)) return;
+		const task = {
+			sessionId: session.id,
+			turn: event.data.turn,
+			seq: event.seq,
+			cwd: session.header?.cwd
+		};
+		const key = JSON.stringify([
+			task.sessionId,
+			task.turn,
+			task.seq
+		]);
+		if (pending.has(key)) return;
+		pending.add(key);
+		waiting.push(task);
+		drain();
+	}
+	/** @public @author ddj 2026年10月26号 @returns Bounded durability checkpoint including work queued while active tasks finish. */
+	async function flush() {
+		const deadline = Date.now() + (deps.timeoutMs ?? 1e4);
+		while (tasks.size && !stopped && Date.now() < deadline) {
+			let timer;
+			await Promise.race([Promise.all([...tasks]), new Promise((resolve) => {
+				timer = setTimeout(resolve, Math.max(1, deadline - Date.now()));
+			})]);
+			clearTimeout(timer);
+		}
+	}
+	/** @public @author ddj 2026年10月26号 @returns Bounded drain, then cancel timers and reads; incomplete staging cannot publish. */
+	async function dispose() {
+		await flush();
+		stopped = true;
+		controller.abort();
+		waiting.length = 0;
+		pending.clear();
+	}
+	return {
+		enqueue,
+		flush,
+		dispose
+	};
+}
+/** @private @author ddj 2026年10月26号 @param source Public service. @param task Event. @param index File position. @param signal Cancellation/deadline. @returns A read bounded even if an adapter ignores abort. */
+async function readDiff(source, task, index, signal) {
+	return new Promise((resolve, reject) => {
+		/** @private @author ddj 2026年10月26号 Propagate timeout or unload. */
+		function aborted() {
+			reject(signal.reason);
+		}
+		signal.addEventListener("abort", aborted, { once: true });
+		if (signal.aborted) {
+			aborted();
+			return;
+		}
+		Promise.resolve().then(() => source.diff(task.sessionId, task.seq, index, signal)).then(resolve, reject).finally(() => signal.removeEventListener("abort", aborted));
+	});
+}
+/** @public @author ddj 2026年10月26号 @param ctx Host lifecycle owner; services remain optional for older Hosts. */
+function installCapture(ctx, onSnapshot) {
+	const collector = createCollector({
+		source: () => ctx.get("workspaceChanges"),
+		prepare: async (cwd) => {
+			await loadBucket(ctx, cwd);
+			await repairPaths(cwd, resolvePath);
+		},
+		identity: resolvePath,
+		persist: (cwd, snapshot) => {
+			const saved = saveSnapshot(cwd, snapshot);
+			onSnapshot?.(cwd, snapshot);
+			return saved;
+		},
+		state: captureState,
+		report: (message) => log.warn(message)
+	});
+	ctx.on("session/event", collector.enqueue);
+	ctx.on("session/created", backfill);
+	ctx.on("session/flush", collector.flush);
+	for (const session of ctx.get("sessions").list()) backfill(session);
+	return collector.dispose;
+	/** @private @author ddj 2026年10月27号 @param cwd Source workspace. @param path Official relative path. @returns Backend-owned process path; never stringify opaque targets. @throws Invalid backend path. */
+	async function resolvePath(cwd, path) {
+		const fs = ctx.get("fs");
+		const target = await fs.resolve(path, { cwd });
+		const processPath = fs.processPath(target);
+		if (typeof processPath !== "string" || !processPath || processPath === "[object Object]") throw new Error("官方文件路径解析失败");
+		return processPath;
+	}
+	/** @private @author ddj 2026年10月26号 @param session Live session. Only public async reads, excluding inherited records. */
+	async function backfill(session) {
+		const query = ctx.get("sessionQuery");
+		if (!query?.listEvents || !query?.readEvent) {
+			log.warn("官方历史补采不可用：缺少 sessionQuery；后续实时事件仍会采集");
+			return;
+		}
+		try {
+			if (session.header?.cwd) {
+				await loadBucket(ctx, session.header.cwd);
+				await repairPaths(session.header.cwd, resolvePath);
+			}
+			const events = await query.listEvents(session.id);
+			for (const event of events) {
+				if (event.type !== "workspace/changes" || event.seq < (session.inheritedEventCount ?? 0)) continue;
+				const window = await query.readEvent({
+					sessionId: session.id,
+					seq: event.seq
+				});
+				collector.enqueue(session, window.target);
+			}
+		} catch (error) {
+			log.warn("官方历史补采失败：" + String(error));
+		}
+	}
+}
+//#endregion
+//#region src/reviewEvidence.ts
+/** Raw UTF-8 evidence and patch correspondence; never reconstructs a historical file from disk. @author ddj 2026年10月27号 */
+/** @public @author ddj 2026年10月27号 @param bytes File bytes, or null for confirmed absence. @returns Existence-sensitive immutable digest and base64. */
+function rawReviewFile(bytes) {
+	const payload = bytes === null ? Buffer.alloc(0) : Buffer.from(bytes);
+	return {
+		present: bytes !== null,
+		bytes: payload.toString("base64"),
+		hash: createHash("sha256").update(bytes === null ? "absent:" : "present:").update(payload).digest("hex")
+	};
+}
+/** @private @author ddj 2026年10月27号 @param file Persisted raw image. @returns UTF-8 storage text preserving BOM and terminators. @throws Binary, invalid encoding or corrupt hash. */
+function rawText(file) {
+	const bytes = Buffer.from(file.bytes, "base64");
+	if (bytes.length > 8388608 || bytes.includes(0)) throw new Error("回滚证据不是受支持的 UTF-8 文本");
+	if (rawReviewFile(file.present ? bytes : null).hash !== file.hash) throw new Error("回滚证据哈希不匹配");
+	const text = new TextDecoder("utf-8", {
+		fatal: true,
+		ignoreBOM: true
+	}).decode(bytes);
+	if (!Buffer.from(text, "utf8").equals(bytes)) throw new Error("回滚证据无法字节往返");
+	return text;
+}
+/** @private @author ddj 2026年10月27号 @param text Storage text. @returns Physical lines, retaining each original line ending and excluding BOM. */
+function rawLines(text) {
+	return text.replace(/^\uFEFF/, "").match(/[^\r\n]*(?:\r\n|\n|\r|$)/g)?.filter((line, index, lines) => line !== "" || index !== lines.length - 1) ?? [];
+}
+/** @private @author ddj 2026年10月27号 @param lines Physical storage lines. @returns Official logical-line comparison basis. */
+function logical(lines) {
+	return lines.map((line) => line.replace(/(?:\r\n|\r|\n)$/, ""));
+}
+/** @public @author ddj 2026年10月27号 @param diff Official source. @param evidence Independent raw captures. @returns Exact raw segments only when every official hunk reproduces the entire captured result. @throws Incomplete chain, coarse patch or mismatched context/content. */
+function evidenceBlocks(diff, evidence) {
+	if (diff.kind !== "text" || diff.coarse) throw new Error("该官方差异没有可靠文本基线");
+	if (diff.before !== evidence.before.present || diff.after !== evidence.after.present) throw new Error("文件存在性证据不一致");
+	const beforeText = rawText(evidence.before), afterText = rawText(evidence.after);
+	const before = rawLines(beforeText), after = rawLines(afterText);
+	const expected = logical(before);
+	let delta = 0;
+	for (const hunk of diff.hunks) {
+		const old = hunk.lines.filter((line) => line[0] === " " || line[0] === "-").map((line) => line.slice(1));
+		const next = hunk.lines.filter((line) => line[0] === " " || line[0] === "+").map((line) => line.slice(1));
+		if (old.length !== hunk.oldLines || next.length !== hunk.newLines) throw new Error("官方差异行数不一致");
+		const position = Math.max(0, hunk.oldStart - 1) + delta;
+		if (JSON.stringify(expected.slice(position, position + old.length)) !== JSON.stringify(old)) throw new Error("原始基线与官方上下文不一致");
+		expected.splice(position, old.length, ...next);
+		delta += next.length - old.length;
+	}
+	if (JSON.stringify(expected) !== JSON.stringify(logical(after))) throw new Error("采集链未覆盖全部官方变更");
+	if (!diff.hunks.length && beforeText !== afterText) throw new Error("官方没有提供可撤销的变更块");
+	const segments = reviewBlocks(diff).map((block) => ({
+		id: block.id,
+		before: before.slice(block.oldStart - 1, block.oldStart - 1 + block.oldLines.length).join(""),
+		after: after.slice(block.newStart - 1, block.newStart - 1 + block.newLines.length).join(""),
+		offset: (afterText.startsWith("") ? 1 : 0) + after.slice(0, block.newStart - 1).join("").length
+	}));
+	let reversed = afterText;
+	for (const segment of [...segments].reverse()) reversed = reversed.slice(0, segment.offset) + segment.before + reversed.slice(segment.offset + segment.after.length);
+	if (reversed !== beforeText) throw new Error("官方变更外的 BOM、行尾或末尾换行发生变化，证据不足");
+	return segments;
+}
+/** @public @author ddj 2026年10月27号 @param evidence Raw original images. @returns Exact before and after UTF-8 storage text for guarded writes. */
+function evidenceText(evidence) {
+	return {
+		before: rawText(evidence.before),
+		after: rawText(evidence.after)
+	};
+}
+//#endregion
+//#region src/reviewCapture.ts
+/** Independent byte evidence; official diff remains the only display authority. @author ddj 2026年10月27号 */
+/** @public @author ddj 2026年10月27号 @param ctx Host lifecycle owner. @returns Scoped byte recorder; failures disable undo evidence only, never tool execution. */
+function installEvidence(ctx) {
+	const chains = /* @__PURE__ */ new Map();
+	const staged = /* @__PURE__ */ new Map();
+	let stopped = false;
+	ctx.on("tools/execute", aroundTool);
+	ctx.on("session/event", onEvent);
+	ctx.on("session/disposed", onDisposed);
+	/** @private @author ddj 2026年10月27号 @param session Disposed owner. Drops optional in-memory evidence, never persisted official facts. */
+	function onDisposed(session) {
+		chains.delete(session.id);
+	}
+	/** @private @author ddj 2026年10月27号 @returns Current bounded capture footprint, excluding transient filesystem reads. */
+	function footprint() {
+		let bytes = 0;
+		for (const group of [chains, staged]) for (const files of group.values()) for (const chain of files.values()) bytes += chain.before.bytes.length + chain.after.bytes.length;
+		return bytes;
+	}
+	/** @private @author ddj 2026年10月27号 @param exec Allowed tool dispatch. @param next Original dispatch. @returns Original result unchanged, regardless of capture failure. */
+	async function aroundTool(exec, next) {
+		const session = exec.agent?.session;
+		const path = exec.arguments?.file_path;
+		if (stopped || !session?.id || !["edit", "write"].includes(exec.name) || typeof path !== "string") return next();
+		let fs;
+		let chain;
+		let target;
+		try {
+			if (chains.size >= 16 && !chains.has(session.id) || footprint() >= 33554432) return next();
+			fs = ctx.get("fs");
+			target = await resolveTarget(ctx, session, path);
+			const identity = fs.processPath(target);
+			const before = await readRaw(fs, target, exec.signal);
+			let files = chains.get(session.id);
+			if (!files) {
+				files = /* @__PURE__ */ new Map();
+				chains.set(session.id, files);
+			}
+			if (files.size >= 64 && !files.has(identity)) return next();
+			chain = files.get(identity);
+			if (!chain) {
+				chain = {
+					before,
+					after: before,
+					busy: false,
+					invalid: false
+				};
+				files.set(identity, chain);
+			}
+			if (chain.busy || chain.after.hash !== before.hash) chain.invalid = true;
+			chain.busy = true;
+		} catch {}
+		try {
+			return await next();
+		} finally {
+			if (chain) {
+				try {
+					chain.after = await readRaw(fs, target, exec.signal);
+				} catch {
+					chain.invalid = true;
+				}
+				chain.busy = false;
+			}
+		}
+	}
+	/** @private @author ddj 2026年10月27号 @param session Source session. @param event Published official turn. Freezes the chain before the next turn can mutate it. */
+	function onEvent(session, event) {
+		if (stopped || event.type !== "workspace/changes") return;
+		const files = chains.get(session.id);
+		chains.delete(session.id);
+		if (!files || staged.size >= 128) return;
+		staged.set(JSON.stringify([session.id, event.seq]), structuredClone(files));
+	}
+	/** @public @author ddj 2026年10月27号 @param cwd Official workspace. @param snapshot Committed official facts. Persists only independently validated, exact-correspondence byte chains. */
+	function persist(cwd, snapshot) {
+		const key = JSON.stringify([snapshot.sessionId, snapshot.seq]);
+		const files = staged.get(key);
+		staged.delete(key);
+		if (!files || stopped) return;
+		const db = reviewDb(cwd);
+		for (const file of snapshot.files) {
+			const chain = files.get(file.identity);
+			if (!chain || chain.invalid || chain.busy) continue;
+			try {
+				const evidence = {
+					before: chain.before,
+					after: chain.after
+				};
+				evidenceBlocks(file.diff, evidence);
+				db.prepare(`INSERT OR IGNORE INTO review_evidence(file_id,payload)
+          SELECT id,? FROM review_files WHERE session_id=? AND turn=? AND seq=? AND identity=?`).run(JSON.stringify(evidence), snapshot.sessionId, snapshot.turn, snapshot.seq, file.identity);
+			} catch (error) {
+				log.warn("官方回滚证据不可用：" + String(error));
+			}
+		}
+	}
+	/** @public @author ddj 2026年10月27号 Release bounded in-memory images after capture has drained. */
+	function dispose() {
+		stopped = true;
+		chains.clear();
+		staged.clear();
+	}
+	return {
+		persist,
+		dispose
+	};
+}
+/** @private @author ddj 2026年10月27号 @param fs Public filesystem. @param target Backend identity. @returns Raw bounded file or confirmed missing. @throws Any non-missing read error. */
+async function readRaw(fs, target, signal) {
+	try {
+		return rawReviewFile(await fs.readBytes(target, signal, 1048576));
+	} catch (error) {
+		const code = error.code;
+		if (code === "ENOENT" || code === "FS_NOT_FOUND") return rawReviewFile(null);
+		throw error;
+	}
+}
+//#endregion
 //#region src/search/query.ts
 /**
 * 规范化用户搜索文本。
@@ -12111,6 +12871,142 @@ function decodePage(bytes, info, offset, pendingCR, args, identity, signCursor)
 	};
 }
 //#endregion
+//#region src/reviewUndo.ts
+/** Guarded official undo with a durable write-intent journal. @author ddj 2026年10月27号 */
+const writes = /* @__PURE__ */ new Map();
+/** @public @author ddj 2026年10月27号 @param ctx Host capability. @param session Authenticated caller. @param cwd Workspace. @param request Frozen file/block version. @returns Durable decision; retries reconcile disk hashes and never blindly repeat a write. @throws Missing evidence, stale state, policy or uncertain write failure. */
+async function undoReview(ctx, session, cwd, request) {
+	const detail = reviewDetail(cwd, request.id);
+	const key = JSON.stringify([cwd, detail?.item.currentPath ?? request.id]);
+	const operation = (writes.get(key) ?? Promise.resolve()).catch(() => void 0).then(() => runUndo(ctx, session, cwd, request));
+	writes.set(key, operation);
+	try {
+		return await operation;
+	} finally {
+		if (writes.get(key) === operation) writes.delete(key);
+	}
+}
+/** @private @author ddj 2026年10月27号 @param ctx Host. @param session Caller. @param cwd Workspace. @param request Frozen decision. @returns Serialized guarded mutation and journal reconciliation. @throws Conflicting bytes or decisions. */
+async function runUndo(ctx, session, cwd, request) {
+	const db = reviewDb(cwd);
+	const encoded = JSON.stringify(request);
+	if (!request.operationId || request.operationId.length > 128) throw new Error("operationId 无效");
+	const prior = db.prepare("SELECT * FROM review_ops WHERE operation_id=?").get(request.operationId);
+	if (prior && prior.request !== encoded) throw new Error("operationId 已用于其他请求");
+	if (prior?.state === "committed") return JSON.parse(prior.result);
+	const detail = reviewDetail(cwd, request.id);
+	if (!detail || !detail.item.current || detail.item.seq !== request.seq || detail.item.revision !== request.revision || detail.item.decision !== "pending") throw new Error("审查版本冲突，请刷新后重试");
+	const fs = ctx.get("fs");
+	if (!fs?.readBytes || !fs?.writeText || !fs?.stat) throw new Error("后端缺少受控回滚能力");
+	const target = await resolveTarget(ctx, session, detail.item.currentPath);
+	const info = await fs.stat(target);
+	if (!info || info.type !== "file" || !info.version) throw new Error("文件不存在或缺少版本守卫，不能安全 Undo");
+	const current = rawReviewFile(await fs.readBytes(target, void 0, 8388608));
+	if ((await fs.stat(target))?.version !== info.version) throw new Error("文件在回滚读取期间变化，未修改文件");
+	if (prior) {
+		const journal = JSON.parse(prior.evidence);
+		if (current.hash === journal.after) return finishUndo(cwd, request);
+		if (current.hash !== journal.before) throw new Error("上次 Undo 状态不确定：磁盘既非写前也非写后，禁止重复执行");
+	}
+	if (db.prepare("SELECT operation_id FROM review_ops WHERE state='prepared' AND json_extract(request,'$.id')=? AND operation_id<>?").get(request.id, request.operationId)) throw new Error("存在未核对的 Undo，请使用原操作重试，不能创建另一项写入");
+	const row = db.prepare("SELECT payload FROM review_evidence WHERE file_id=?").get(request.id);
+	if (!row) throw new Error("该历史记录缺少可信原始字节证据，不能 Undo；差异仍可展示和 Keep");
+	const evidence = JSON.parse(row.payload);
+	const segments = evidenceBlocks(detail.diff, evidence);
+	const texts = evidenceText(evidence);
+	if (!evidence.before.present || !evidence.after.present) throw new Error("当前后端未提供受控原子删除/重建能力");
+	const selected = detail.blocks.filter((block) => block.decision === "pending" && (request.scope !== "hunk" || block.id === request.blockId));
+	if (!selected.length) throw new Error("差异块不存在或已处理");
+	const rejected = new Set(detail.blocks.filter((block) => block.decision === "rejected").map((block) => block.id));
+	const expected = reverseBlocks(texts.after, segments, rejected);
+	if (rawReviewFile(Buffer.from(expected)).hash !== current.hash) throw new Error("当前文件已被后续编辑，版本与回滚证据冲突，未修改文件");
+	const undo = /* @__PURE__ */ new Set([...rejected, ...selected.map((block) => block.id)]);
+	const next = reverseBlocks(texts.after, segments, undo);
+	const journal = {
+		before: current.hash,
+		after: rawReviewFile(Buffer.from(next)).hash
+	};
+	const latest = reviewDetail(cwd, request.id);
+	if (!latest?.item.current || latest.item.revision !== request.revision || latest.item.decision !== "pending") throw new Error("审查版本在回滚校验期间变化，未修改文件");
+	db.prepare("INSERT INTO review_ops VALUES(?,?,'prepared',NULL,?) ON CONFLICT(operation_id) DO NOTHING").run(request.operationId, encoded, JSON.stringify(journal));
+	await fs.writeText(target, next, {
+		kind: "replaceIfVersion",
+		version: info.version
+	}, void 0, policyOf(ctx, session));
+	if (rawReviewFile(await fs.readBytes(target, void 0, 8388608)).hash !== journal.after) throw new Error("Undo 写后内容不确定，请保留原操作重试核对");
+	return finishUndo(cwd, request);
+}
+/** @private @author ddj 2026年10月27号 @param text Captured result. @param segments Validated raw ranges. @param rejected Blocks to reverse. @returns Raw storage text preserving unselected blocks. */
+function reverseBlocks(text, segments, rejected) {
+	let result = text;
+	for (const segment of [...segments].reverse()) {
+		if (!rejected.has(segment.id)) continue;
+		result = result.slice(0, segment.offset) + segment.before + result.slice(segment.offset + segment.after.length);
+	}
+	return result;
+}
+/** @private @author ddj 2026年10月27号 @param cwd Workspace. @param request Frozen action. @returns Transactionally committed status, or a retryable prepared journal if the database fails. */
+function finishUndo(cwd, request) {
+	const db = reviewDb(cwd);
+	db.exec("BEGIN IMMEDIATE");
+	try {
+		if (db.prepare("UPDATE review_files SET revision=revision+1 WHERE id=? AND seq=? AND revision=? AND current=1 AND decision='pending'").run(request.id, request.seq, request.revision).changes !== 1) throw new Error("审查版本冲突，请核对已执行 Undo");
+		changeBlocks(db, request);
+		const result = { revision: request.revision + 1 };
+		db.prepare("UPDATE review_ops SET state='committed',result=? WHERE operation_id=?").run(JSON.stringify(result), request.operationId);
+		db.exec("COMMIT");
+		return result;
+	} catch (error) {
+		if (db.isTransaction) db.exec("ROLLBACK");
+		throw error;
+	}
+}
+//#endregion
+//#region src/reviewRpc.ts
+/** @public @author ddj 2026年10月26号 @param ctx Host. @param registry Workspace cache. @returns Handlers resolving workspace from the live authenticated session, never caller cwd. */
+function reviewHandlers(ctx, registry) {
+	/** @private @author ddj 2026年10月26号 @param sessionId Request scope. @returns Migrated workspace, or explicit failure without fallback. */
+	async function workspace(sessionId) {
+		const session = sessionOf(ctx, sessionId);
+		const cwd = cwdOfSession(ctx, session);
+		if (!session || !cwd) throw new Error("会话不存在或没有工作区");
+		await bucketOf(registry, ctx, cwd);
+		return cwd;
+	}
+	return {
+		"edrv.review.list": async (args) => {
+			return {
+				ok: true,
+				page: reviewPage(await workspace(args.sessionId), args.cursor, args.history, args.path)
+			};
+		},
+		"edrv.review.detail": async (args) => {
+			const detail = reviewDetail(await workspace(args.sessionId), args.id);
+			return detail ? {
+				ok: true,
+				detail
+			} : {
+				ok: false,
+				error: "官方审查记录不存在"
+			};
+		},
+		"edrv.review.decide": async (args) => {
+			const cwd = await workspace(args.sessionId);
+			try {
+				return {
+					ok: true,
+					...args.decision === "rejected" ? await undoReview(ctx, sessionOf(ctx, args.sessionId), cwd, args) : decideReview(cwd, args)
+				};
+			} catch (error) {
+				return {
+					ok: false,
+					error: error instanceof Error ? error.message : String(error)
+				};
+			}
+		}
+	};
+}
+//#endregion
 //#region src/rpc.ts
 /** Process-local cursor signer; reads must stay on the Host filesystem capability. */
 const readTextPage = createTextPages();
@@ -12264,22 +13160,6 @@ function isStaleVersion(error) {
 */
 async function afterManualSave(ctx, registry, sc, path) {
 	invalidateIndex(ctx, sc.cwd, path);
-	const bucket = await bucketOf(registry, ctx, sc.cwd);
-	let changed = false;
-	for (const rec of bucket.values()) if (rec.path === path && rec.superseded !== true) {
-		rec.superseded = true;
-		rec.at = (/* @__PURE__ */ new Date()).toISOString();
-		changed = true;
-	}
-	if (changed) {
-		const done = [];
-		for (const rec of bucket.values()) if (rec.path === path && rec.superseded) done.push(rec);
-		if (done.length) await archiveRecords(ctx, sc.session, sc.cwd, bucket, done, "被手动编辑覆盖");
-		else await saveBucket(ctx, sc.cwd, bucket, sc.session, {
-			upserts: [...bucket.values()].filter((rec) => rec.path === path),
-			removed: []
-		});
-	}
 }
 /**
 * 批量决策核心：一次会话/桶解析 + 逐项处理 + 统一落盘（accept/reject 单条与 decideBatch 共用）。
@@ -12313,6 +13193,14 @@ async function applyDecisions(ctx, session, cwd, bucket, items) {
 			});
 			continue;
 		}
+		if (hasOfficial(cwd, record.path)) {
+			results.push({
+				callId: item.callId,
+				ok: false,
+				error: "该文件已有官方审查记录；旧工具记录禁止决策或回滚，请使用官方审查入口"
+			});
+			continue;
+		}
 		if (record.archived) {
 			results.push({
 				callId: item.callId,
@@ -12333,7 +13221,6 @@ async function applyDecisions(ctx, session, cwd, bucket, items) {
 			});
 			continue;
 		}
-		let revertedStale = false;
 		if (item.decision === "rejected" && !alreadyDone) {
 			const scope = item.scope ?? "call";
 			const hunkIndex = scope === "hunk" ? item.hunkIndex ?? -1 : -1;
@@ -12397,8 +13284,8 @@ async function applyDecisions(ctx, session, cwd, bucket, items) {
 			if (traceId && !grouped.has(index)) revertMs += performance.now() - revertStart;
 			grouped.delete(index);
 			try {
-				if (outcome.ok || outcome.stale === true) setRevertState(cwd, record.callId, scope, hunkIndex, "applied");
-				else if (outcome.error === "找不到该差异块" || outcome.error === "回滚失败：文件不存在" || outcome.error === "回滚失败：文件过大，无法安全定位") clearRevertState(cwd, record.callId, scope, hunkIndex);
+				if (outcome.ok) setRevertState(cwd, record.callId, scope, hunkIndex, "applied");
+				else if (outcome.stale === true || outcome.error === "找不到该差异块" || outcome.error === "回滚失败：文件不存在" || outcome.error === "回滚失败：文件过大，无法安全定位") clearRevertState(cwd, record.callId, scope, hunkIndex);
 			} catch (error) {
 				results.push({
 					callId: item.callId,
@@ -12408,15 +13295,12 @@ async function applyDecisions(ctx, session, cwd, bucket, items) {
 				continue;
 			}
 			if (!outcome.ok) {
-				if (scope !== "hunk" || outcome.stale !== true) {
-					results.push({
-						callId: item.callId,
-						ok: false,
-						error: outcome.error
-					});
-					continue;
-				}
-				revertedStale = true;
+				results.push({
+					callId: item.callId,
+					ok: false,
+					error: outcome.error || "差异已偏移，未修改文件，保留待处理"
+				});
+				continue;
 			}
 		}
 		const wasResolved = recordResolved(record);
@@ -12429,7 +13313,6 @@ async function applyDecisions(ctx, session, cwd, bucket, items) {
 			ok: true,
 			record: recView(record, ws)
 		};
-		if (revertedStale) result.stale = true;
 		results.push(result);
 	}
 	const decisionMs = traceId ? performance.now() - started : 0;
@@ -12616,6 +13499,7 @@ function buildHandlers(ctx, registry, searcher = newSearcher(ctx), contentSearch
 		...aiHandlers ?? {},
 		...svnHandlers ?? {},
 		...dapHandlers ?? {},
+		...reviewHandlers(ctx, registry),
 		"edrv.list": async (args) => {
 			const start = performance.now();
 			let staleMs = 0;
@@ -13195,6 +14079,10 @@ function buildHandlers(ctx, registry, searcher = newSearcher(ctx), contentSearch
 			};
 			const batch = args.batch;
 			const bucket = await bucketOf(registry, ctx, sc.cwd);
+			if (hasOfficial(sc.cwd, args.path)) return {
+				ok: false,
+				error: "该文件已有官方审查记录，禁止使用旧版批次回滚覆盖当前文件"
+			};
 			try {
 				let affected = [];
 				let beforeRec = null;
@@ -24758,6 +25646,11 @@ function createRuntime(ctx, config) {
 * @param runtime Managers created by this instance.
 */
 function attachRuntime(ctx, runtime) {
+	const evidence = installEvidence(ctx);
+	const stopCapture = installCapture(ctx, (cwd, snapshot) => {
+		evidence.persist(cwd, snapshot);
+		return true;
+	});
 	/** @author ddj 2026年09月28号 @param exec Tool execution. @param result Tool result. */
 	function onResult(exec, result) {
 		captureToolResult(ctx, runtime.registry, exec, result);
@@ -24775,6 +25668,8 @@ function attachRuntime(ctx, runtime) {
 	}
 	/** @author ddj 2026年09月28号 Release every manager even if another cleanup rejects. */
 	async function cleanup() {
+		await stopCapture();
+		evidence.dispose();
 		runtime.fileVersions.dispose();
 		closeArchiveDbs();
 		disposeAllServers();