tonedial 0.1.5 → 0.1.6

package/dist/cli.js

@@ -36,13 +36,14 @@ export const JSON_SCHEMA = 3;
  * run time is the one thing that breaks all three binary packagers at once. A test asserts this
  * equals the manifest, which is the cheap half of the trade.
  */
-export const VERSION = "0.1.5";
-const FLAG_NAMES = ["project", "check", "explain", "global", "here", "migrateLegacy", "auto", "dryRun", "fix", "rollback", "fromOperation", "fromPreset", "restorePreset", "preset", "slug", "acceptUsage", "lang", "commands", "tools"];
+export const VERSION = "0.1.6";
+const FLAG_NAMES = ["project", "check", "explain", "global", "here", "migrateLegacy", "auto", "dryRun", "fix", "rollback", "quarantineOperation", "fromOperation", "fromPreset", "restorePreset", "preset", "slug", "acceptUsage", "lang", "commands", "tools"];
 /** Command-line spelling for each flag, where it differs from the field name. */
 const FLAG_SPELLING = {
     project: "project", check: "check", explain: "explain",
     global: "global", auto: "auto", dryRun: "dry-run", fix: "fix", lang: "lang", commands: "commands",
     tools: "tools", rollback: "rollback", here: "here", migrateLegacy: "migrate-legacy",
+    quarantineOperation: "quarantine-operation",
     fromOperation: "from-operation", fromPreset: "from-preset", restorePreset: "restore-preset",
     preset: "preset", slug: "slug", acceptUsage: "accept-usage",
 };
@@ -68,7 +69,7 @@ const COMMANDS = {
     unwire: { run: runUnwire, flags: ["global", "here", "project", "auto", "dryRun"], max: 1 },
     init: { run: runInit, flags: ["global", "here", "project", "migrateLegacy", "auto", "dryRun", "lang", "commands", "tools"], max: 0, context: "setup" },
     // Doctor checks mutation permission after its recovery-first diagnosis, even with bad config.
-    doctor: { run: runDoctor, flags: ["global", "here", "project", "auto", "dryRun", "fix", "rollback", "fromOperation", "fromPreset", "restorePreset", "tools"], max: 0 },
+    doctor: { run: runDoctor, flags: ["global", "here", "project", "auto", "dryRun", "fix", "rollback", "quarantineOperation", "fromOperation", "fromPreset", "restorePreset", "tools"], max: 0 },
     eject: { run: runEject, flags: ["global", "here", "project", "auto", "dryRun"], max: 0 },
 };
 const CONNECTION_COMMANDS = ["init", "wire", "doctor", "unwire", "eject"];
@@ -130,7 +131,8 @@ const COMMAND_EXAMPLES = {
     wire: ["tonedial wire codex --here --dry-run"],
     unwire: ["tonedial unwire codex --here --dry-run"],
     init: ["tonedial init --tools none --global --auto", "tonedial init --tools codex --here"],
-    doctor: ["tonedial doctor", "tonedial doctor --fix --global --tools none --dry-run"],
+    doctor: ["tonedial doctor", "tonedial doctor --fix --global --tools none --dry-run",
+        "tonedial doctor --fix --quarantine-operation ID --global"],
     eject: ["tonedial eject --here --dry-run"],
 };
 const FLAG_SYNTAX = [
@@ -145,6 +147,7 @@ const FLAG_SYNTAX = [
     ["tools", "--tools=LIST"],
     ["fix", "--fix"],
     ["rollback", "--rollback=ID"],
+    ["quarantineOperation", "--quarantine-operation=ID"],
     ["fromOperation", "--from-operation=ID"],
     ["fromPreset", "--from-preset=SLUG"],
     ["restorePreset", "--restore-preset=SLUG"],
@@ -298,6 +301,7 @@ export async function run(argv, env = process.env, cwd = process.cwd(), isTTY =
         "dry-run": { type: "boolean", default: false },
         fix: { type: "boolean", default: false },
         rollback: { type: "string" },
+        "quarantine-operation": { type: "string" },
         "from-operation": { type: "string" },
         "from-preset": { type: "string" },
         "restore-preset": { type: "string" },
@@ -398,6 +402,7 @@ export async function run(argv, env = process.env, cwd = process.cwd(), isTTY =
         dryRun: parsed.values["dry-run"] === true,
         fix: parsed.values.fix === true,
         rollback: typeof parsed.values.rollback === "string" ? parsed.values.rollback : null,
+        quarantineOperation: typeof parsed.values["quarantine-operation"] === "string" ? parsed.values["quarantine-operation"] : null,
         fromOperation: typeof parsed.values["from-operation"] === "string" ? parsed.values["from-operation"] : null,
         fromPreset: typeof parsed.values["from-preset"] === "string" ? parsed.values["from-preset"] : null,
         restorePreset: typeof parsed.values["restore-preset"] === "string" ? parsed.values["restore-preset"] : null,
@@ -424,9 +429,9 @@ export async function run(argv, env = process.env, cwd = process.cwd(), isTTY =
     if (command.max !== null && rest.length > command.max) {
         return fail(asJson, say.errors.tooManyArguments(name, command.max, rest.length), 2, uiErr);
     }
-    if (name === "doctor" && ((!flags.fix && (flags.fromOperation !== null || flags.fromPreset !== null || flags.restorePreset !== null || flags.tools !== null)) ||
+    if (name === "doctor" && ((!flags.fix && (flags.quarantineOperation !== null || flags.fromOperation !== null || flags.fromPreset !== null || flags.restorePreset !== null || flags.tools !== null)) ||
         (flags.restorePreset !== null && flags.fromOperation === null) ||
-        (flags.rollback !== null && (flags.fromOperation !== null || flags.fromPreset !== null || flags.restorePreset !== null || flags.tools !== null)))) {
+        (flags.rollback !== null && (flags.quarantineOperation !== null || flags.fromOperation !== null || flags.fromPreset !== null || flags.restorePreset !== null || flags.tools !== null)))) {
         return fail(asJson, say.recovery.invalidOptions, 2, uiErr);
     }
     try {

package/dist/commands/doctor.js

@@ -472,6 +472,20 @@ export async function runDoctor(ctx, _args) {
     if (!ctx.flags.fix)
         return doctorReport(ctx);
     const app = await runAppRebuild(ctx);
+    if (app.quarantineOnly) {
+        const rollbackLines = app.json.applied === true ? recoveryRollbackLines(ctx.t, app.json.operationId, null) : [];
+        const remaining = Array.isArray(app.json.remainingInvalidOperations)
+            ? app.json.remainingInvalidOperations.filter((id) => typeof id === "string") : [];
+        const next = typeof app.json.next === "string" ? app.json.next : null;
+        return {
+            ...app,
+            lines: [...app.lines, ...rollbackLines, ...(next === null ? [] : [
+                    `  ${ctx.t.recovery.quarantineRemaining(remaining.length)}`, "", `  ${next}`,
+                ])],
+            json: { ...app.json, root: ctx.agent.root, stateRoot: ctx.paths.root, agentRoot: ctx.agent.root,
+                live: ctx.agent.live, fixed: app.json.applied === true, appHealthy: false },
+        };
+    }
     if (ctx.flags.dryRun) {
         const native = await runRebuildNative(ctx, app.legacy, app.proposedConfig);
         return {
@@ -517,10 +531,14 @@ async function doctorReport(ctx, showRollbackCommands = true, showCodexAction =
     if (inspected.lock.state !== "none" || inspected.journals.some(({ state }) => state === "pending" || state === "invalid")) {
         const owner = inspected.lock.owner;
         const blocking = inspected.journals.filter(({ state }) => state === "pending" || state === "invalid");
+        const invalid = blocking.filter(({ state }) => state === "invalid");
+        const quarantineable = inspected.lock.state === "none" && blocking.length === invalid.length && invalid.length > 0;
+        const singleQuarantine = quarantineable && invalid.length === 1;
         const shown = ctx.flags.verbose ? inspected.journals : inspected.journals.filter(({ operationId, state }) => state === "pending" || state === "invalid" || operationId === owner?.operationId);
         const lines = [
-            ...wrap(ctx.t.doctor.recoveryPending, ctx.ui.width - 2).map(line => `  ${ctx.ui.warn(line)}`),
-            ...shown.map(({ operationId, state }) => `  ${operationId}  ${ctx.t.doctor.operationState[state]}`),
+            ...wrap(quarantineable ? ctx.t.doctor.invalidRecoveryPending : ctx.t.doctor.recoveryPending, ctx.ui.width - 2).map(line => `  ${ctx.ui.warn(line)}`),
+            ...shown.filter(({ operationId }) => !singleQuarantine || operationId !== invalid[0].operationId)
+                .map(({ operationId, state }) => `  ${operationId}  ${ctx.t.doctor.operationState[state]}`),
         ];
         if (owner !== null && !shown.some(({ operationId }) => operationId === owner.operationId))
             lines.push(`  ${owner.operationId}`);
@@ -540,7 +558,14 @@ async function doctorReport(ctx, showRollbackCommands = true, showCodexAction =
                 }
             }
         }
-        lines.push(...nextStep(`${repairCommand(ctx, "doctor")} --json`, ctx.ui));
+        if (quarantineable) {
+            lines.push("", ...(singleQuarantine
+                ? wrap(ctx.t.recovery.quarantineCandidate(invalid[0].operationId), ctx.ui.width - 2)
+                : wrap(ctx.t.recovery.quarantineRemaining(invalid.length), ctx.ui.width - 2)).map(line => `  ${line}`), ...nextStep(repairCommand(ctx, `doctor --fix --quarantine-operation ${invalid[0].operationId}`), ctx.ui).slice(1));
+        }
+        else {
+            lines.push(...nextStep(`${repairCommand(ctx, "doctor")} --json`, ctx.ui));
+        }
         return {
             lines,
             // The damaged config is deliberately not parsed here. `operation` is the only safe context

package/dist/commands/init.js

@@ -297,6 +297,9 @@ async function rebuildExisting(entry) {
     const resultHeading = ctx.canPrompt && !ctx.flags.auto && !ctx.flags.dryRun
         ? section(copy.init.resultHeading, ctx.ui) : [];
     const app = await runAppRebuild(ctx);
+    if (app.quarantineOnly) {
+        return { ...app, lines: [...(ctx.canPrompt ? [] : introduction), ...resultHeading, ...app.lines] };
+    }
     if (ctx.flags.dryRun) {
         const answers = await ask(ctx, copy, false, selection);
         const tools = selection ?? answers.tools;

package/dist/commands/rebuild.js

@@ -11,7 +11,7 @@ import { recoverLegacyTone } from "../core/legacy-tone.js";
 import { connectionScopeFlag, exportAliasesState, stateOverlapsInstructions } from "../core/paths.js";
 import { applyPreset, matchesPreset, assertPresetSelection, BUNDLED, customPresetDir, inspectPresetLibrary, parsePreset, PRESET_MAX_BYTES, resolvePreset, serializePreset, SLUG_PATTERN, } from "../core/presets.js";
 import { contextArtifactTargets, generatedSeedSelection, planGeneratedSeedRebuild, seedFiles, SEED_VERSION, } from "../core/seeds.js";
-import { inspectOperations, readJournal, retireOperationForAppRebuild, } from "../core/operations.js";
+import { inspectOperations, readJournal, retireOperationForAppRebuild, serializeOperationQuarantine, } from "../core/operations.js";
 import { assertFresh, captureRawEntry, gate, planEntryRebuild, rawReadCheck, validateFileAction, } from "../wiring/apply.js";
 import { confirm } from "../ui/prompt.js";
 import { wrap } from "../ui/width.js";
@@ -218,13 +218,83 @@ function privateCapture(capture) {
         boundary: capture.boundary, boundaryIdentity: capture.boundaryIdentity,
         parents: capture.parents.map(parent => ({ ...parent })) };
 }
+function planOperationQuarantine(ctx, entry) {
+    const capture = captureRawEntry(entry.path, ctx.t, { within: ctx.paths.root });
+    if (capture.type !== "regular" || capture.bytes === null)
+        throw new ConfigError(ctx.t.recovery.quarantineUnavailable(entry.operationId));
+    return planEntryRebuild(capture, serializeOperationQuarantine(ctx.paths, entry.operationId, capture.bytes), ctx.t, { reason: "quarantine-operation", mode: capture.mode ?? 0o600 }).action;
+}
+async function quarantineOneOperation(ctx, entry, remaining) {
+    const action = planOperationQuarantine(ctx, entry);
+    const presentation = [ctx.t.recovery.quarantine(entry.operationId)]
+        .flatMap(line => wrap(line, ctx.ui.width - 2).map(part => `  ${part}`));
+    const result = await gate([], {
+        paths: ctx.paths, operationActions: [action], retention: { kind: "migration", reason: "app-rebuild" },
+        auto: ctx.flags.auto, dryRun: ctx.flags.dryRun, verbose: ctx.flags.verbose, ui: ctx.ui, t: ctx.t,
+        heading: ctx.t.recovery.heading, interactive: () => ctx.canPrompt, ...(ctx.canPrompt ? {} : { out: () => { } }),
+        recoveryPresentation: { lines: presentation,
+            failureMessage: (id, phase, path, code) => `${ctx.t.recovery.failure(id, phase, path, code)}\ntonedial doctor ${connectionScopeFlag(ctx.agent)} --json` },
+        verify: () => {
+            const state = inspectOperations(ctx.paths).journals.find(({ operationId }) => operationId === entry.operationId)?.state;
+            if (state !== "quarantined")
+                throw new ConfigError(ctx.t.recovery.sourceInvalid);
+        },
+    });
+    const lines = [...result.lines];
+    if (result.reason === "written") {
+        lines.push(`  ${ctx.t.recovery.quarantineComplete(entry.operationId)}`);
+    }
+    else {
+        lines.push(`  ${result.reason === "dry-run" ? ctx.t.wiring.dryRun : ctx.t.wiring.declined}`);
+    }
+    return {
+        lines,
+        json: {
+            appRebuilt: false, applied: result.applied, reason: result.reason, operationId: result.operationId ?? null,
+            root: ctx.paths.root, quarantinedOperation: entry.operationId, remainingInvalidOperations: [...remaining],
+            next: result.applied && remaining.length > 0
+                ? `tonedial doctor --fix --quarantine-operation ${remaining[0]} ${connectionScopeFlag(ctx.agent)}` : null,
+            nativeAttention: false, activationVerified: false, diff: result.diff,
+        },
+        rebuiltConfig: null,
+        proposedConfig: null,
+        legacy: null,
+        quarantineOnly: true,
+    };
+}
 export async function runAppRebuild(ctx) {
     const t = ctx.t;
     const operations = inspectOperations(ctx.paths);
-    const pending = operations.journals.filter(entry => entry.state === "pending" || entry.state === "invalid");
-    const blocked = operations.lock.state !== "none" || pending.length > 0;
-    if (blocked && (operations.lock.state === "live" || operations.lock.state === "unknown" ||
-        pending.some(entry => entry.journal === null) || (!ctx.flags.fromOperation && (ctx.flags.auto || !ctx.canPrompt)))) {
+    const pending = operations.journals.filter(entry => entry.state === "pending");
+    const invalid = operations.journals.filter(entry => entry.state === "invalid");
+    let quarantined = invalid.find(entry => entry.operationId === ctx.flags.quarantineOperation) ?? null;
+    if (ctx.flags.quarantineOperation && quarantined === null)
+        throw new ConfigError(t.recovery.quarantineUnavailable(ctx.flags.quarantineOperation));
+    if (invalid.length > 0 && quarantined === null && operations.lock.state === "none" && pending.length === 0 && invalid.length === 1 &&
+        !ctx.flags.auto && ctx.canPrompt) {
+        const candidate = invalid[0];
+        const input = createInterface({ input: process.stdin, output: process.stdout });
+        try {
+            const notice = t.recovery.quarantineCandidate(candidate.operationId).split("\n").flatMap(line => line === candidate.operationId ? [line] : wrap(line, ctx.ui.width - 2));
+            process.stdout.write(`${notice.map(line => `  ${line}`).join("\n")}\n`);
+            const question = wrap(t.recovery.quarantineQuestion, ctx.ui.width - 3).map(line => `  ${line}`).join("\n");
+            const answer = (await input.question(`${question} `)).trim();
+            if (answer === "")
+                throw new ConfigError(t.recovery.cancelled);
+            if (answer !== candidate.operationId)
+                throw new ConfigError(t.recovery.operationMismatch);
+            quarantined = candidate;
+        }
+        finally {
+            input.close();
+        }
+    }
+    if (invalid.length > 0 && quarantined === null) {
+        const candidate = invalid[0];
+        const command = `tonedial doctor --fix --quarantine-operation ${candidate.operationId} ${connectionScopeFlag(ctx.agent)}`;
+        throw new ConfigError(t.recovery.quarantineRequired(candidate.operationId, command));
+    }
+    if (quarantined !== null && (operations.lock.state !== "none" || pending.length > 0)) {
         throw new ConfigError(t.doctor.recoveryPending);
     }
     const scopeExplicit = ctx.scopeExplicit ?? (ctx.flags.global || ctx.flags.here === true || ctx.flags.project !== null);
@@ -232,6 +302,14 @@ export async function runAppRebuild(ctx) {
         throw new ConfigError(t.errors.scopeRequired);
     if (ctx.flags.tools !== null)
         parseToolSelection(ctx.flags.tools, true, t);
+    if (quarantined !== null && invalid.length > 1) {
+        return quarantineOneOperation(ctx, quarantined, invalid.filter(entry => entry !== quarantined).map(entry => entry.operationId));
+    }
+    const blocked = operations.lock.state !== "none" || pending.length > 0;
+    if (blocked && (operations.lock.state === "live" || operations.lock.state === "unknown" ||
+        pending.some(entry => entry.journal === null) || (!ctx.flags.fromOperation && (ctx.flags.auto || !ctx.canPrompt)))) {
+        throw new ConfigError(t.doctor.recoveryPending);
+    }
     const configCapture = captureRawEntry(ctx.paths.config, t, { within: ctx.paths.root, maxBytes: CONFIG_MAX_BYTES });
     const selected = ctx.flags.fromOperation ? selectedJournal(ctx, ctx.flags.fromOperation) : null;
     let retirementId = null;
@@ -405,7 +483,11 @@ export async function runAppRebuild(ctx) {
     config.managedSeeds = seeds.records;
     config.seedVersion = SEED_VERSION;
     const artifact = compile(toCompileInput(config));
-    const operationActions = [...seeds.operationActions];
+    let quarantinePlan = null;
+    if (quarantined !== null) {
+        quarantinePlan = planOperationQuarantine(ctx, quarantined);
+    }
+    const operationActions = [...(quarantinePlan ? [quarantinePlan] : []), ...seeds.operationActions];
     for (const target of artifacts) {
         const capture = target.capture ?? captureRawEntry(target.path, t, { within: ctx.paths.root, allowLink: true });
         const plan = planEntryRebuild(capture, artifact, t, { reason: "generated" });
@@ -457,6 +539,7 @@ export async function runAppRebuild(ctx) {
         ...(missingFields.length ? [`  ${t.recovery.missing(missingFields)}`] : []),
         ...(copies.length ? [`  ${t.recovery.copies(copies)}`] : []),
         ...(nativeAttention ? [`  ${t.recovery.nativePending}`] : []),
+        ...(quarantined ? [`  ${t.recovery.quarantine(quarantined.operationId)}`] : []),
         ...(retirementId ? [`  ${t.recovery.retire(retirementId)}`] : []),
     ].flatMap(line => wrap(line.trimStart(), ctx.ui.width - 2).map(part => `  ${part}`));
     const options = {
@@ -484,6 +567,12 @@ export async function runAppRebuild(ctx) {
                     if (capturedText(captureRawEntry(target.path, t, { within: ctx.paths.root })) !== artifact)
                         throw mismatch();
                 }
+                if (quarantined !== null) {
+                    verificationPath = quarantined.path;
+                    const entry = inspectOperations(ctx.paths).journals.find(({ operationId }) => operationId === quarantined.operationId);
+                    if (entry?.state !== "quarantined")
+                        throw mismatch();
+                }
                 verificationPath = ctx.paths.tone;
                 if (capturedText(captureRawEntry(ctx.paths.tone, t, { within: ctx.paths.root })) !== artifact)
                     throw mismatch();
@@ -521,7 +610,7 @@ export async function runAppRebuild(ctx) {
         if (!ctx.flags.auto) {
             process.stdout.write(`${(preview.reason === "nothing" ? [...preview.lines, ...presentation] : preview.lines).join("\n")}\n`);
             if (await confirm(`  ${t.wiring.applyQuestion(preview.diff.length)}`) === "no") {
-                return { lines: [`  ${t.wiring.declined}`], json: { appRebuilt: false, applied: false, reason: "declined", diff: preview.diff }, rebuiltConfig: null, proposedConfig: config, legacy };
+                return { lines: [`  ${t.wiring.declined}`], json: { appRebuilt: false, applied: false, reason: "declined", diff: preview.diff }, rebuiltConfig: null, proposedConfig: config, legacy, quarantineOnly: false };
             }
         }
         const snapshots = [configCapture, ...seeds.reads, ...artifacts.flatMap(target => target.capture === null ? [] : [target.capture]),
@@ -551,12 +640,13 @@ export async function runAppRebuild(ctx) {
         lines.push(...presentation);
     lines.push(`  ${applied ? result.reason === "nothing" ? t.recovery.unchanged : t.recovery.rebuilt : result.reason === "dry-run" ? t.wiring.dryRun : t.wiring.declined}`);
     return {
-        lines, rebuiltConfig: applied ? config : null, proposedConfig: config, legacy,
+        lines, rebuiltConfig: applied ? config : null, proposedConfig: config, legacy, quarantineOnly: false,
         json: {
             appRebuilt: applied, applied: result.applied, reason: result.reason, operationId: result.operationId ?? null,
             root: ctx.paths.root, source, recovered: [...kept], defaulted: [...defaulted], invalid: damagedFields,
             seeded: seeds.labels, chars: [...artifact].length, riskAxes: riskyAxes(config.axes),
             recoveredPresets: copies, restoredPreset: restoredPreset?.slug ?? null, retiredOperation: retirementId,
+            quarantinedOperation: quarantined?.operationId ?? null,
             retiredExternalActions,
             nativeAttention, activationVerified: false, diff: result.diff,
         },

package/dist/core/i18n.js

@@ -112,7 +112,7 @@ const enMessages = {
         choosePreset: "Choose a preset for values with no valid saved source:",
         sourceRequired: "Saved values are incomplete. Run tonedial doctor --fix interactively, or select --from-preset SLUG or --from-operation ID before unattended recovery.",
         sourceInvalid: "The selected source cannot supply valid settings. The original was kept.",
-        invalidOptions: "Recovery source and tool options require doctor --fix. --restore-preset requires --from-operation; --rollback cannot be combined with source, preset, or tool choices.",
+        invalidOptions: "Recovery source, quarantine and tool options require doctor --fix. --restore-preset requires --from-operation; --rollback cannot be combined with quarantine, source, preset, or tool choices.",
         keptSettings: "Saved settings and custom presets kept.",
         obsoleteWidthDiscarded: "Discard invalid retired fixed_width input. Output follows terminal width.",
         obsoleteGuardsDiscarded: "Discard invalid retired guards input. ToneDial no longer adds guard requests.",
@@ -125,6 +125,13 @@ const enMessages = {
         rollback: (id) => `Restore the previous files:\ntonedial doctor --fix --rollback ${id}`,
         rollbackOrder: "Restore connections first, then application files:",
         noSnapshot: (id) => `${id}: no valid settings snapshot for this state root`,
+        quarantineCandidate: (id) => `Operation ID:\n${id}\nQuarantine it before rebuilding; the original bytes remain available through rollback.`,
+        quarantineQuestion: "Type the full operation ID above to quarantine it; Enter cancels:",
+        quarantineRequired: (id, command) => `${id}: this unreadable operation record needs explicit quarantine before recovery. No files were changed.\n${command}`,
+        quarantineUnavailable: (id) => `${id}: no matching unreadable operation record can be quarantined. No files were changed.`,
+        quarantine: (id) => `Quarantine unreadable operation ${id}; keep its original bytes in rollback history.`,
+        quarantineComplete: (id) => `Unreadable operation ${id} quarantined.`,
+        quarantineRemaining: (count) => `${count} unreadable operation ${count === 1 ? "record remains" : "records remain"}. Quarantine the next record before rebuilding.`,
         retire: (id) => `Retire stopped operation ${id} as history before a new application rebuild. Its external changes are not certified or undone.`,
         resumeOperation: (id) => `Stopped operation:\n${id}`,
         resumeQuestion: "Type the full operation ID above to continue; Enter cancels:",
@@ -280,6 +287,7 @@ const enMessages = {
         seedsNotRun: "no bundled files · init has not run here",
         seedsAttention: "bundled files need attention",
         recoveryPending: "An operation is active or needs recovery. No files were changed by this command.",
+        invalidRecoveryPending: "Unreadable operation history is blocking recovery. No files were changed by this command.",
         resumeOperation: "Continue application repair:",
         contextCurrent: "AGENTS.md and TONE.md layout is current.",
         contextRepair: "Managed context files need repair. Check the guide and tone-file diagnostics.",
@@ -302,7 +310,7 @@ const enMessages = {
             changed: "Reader or config changed during inspection. Retry after changes stop.",
             probe: "The controlled probe failed. Check Node and temporary-directory access, then rerun doctor.",
         },
-        operationState: { pending: "pending", complete: "complete", "rolled-back": "restored", "retired-for-app-rebuild": "retired for rebuild", invalid: "invalid record" },
+        operationState: { pending: "pending", complete: "complete", "rolled-back": "restored", "retired-for-app-rebuild": "retired for rebuild", quarantined: "quarantined", invalid: "invalid record" },
         rollbackStatus: {
             ready: "Approval will restore the selected operation.",
             busy: "Operation still active. Wait for its owner to finish.",
@@ -470,6 +478,7 @@ const enMessages = {
             tools: "agents to connect · init: none = state only",
             fix: "doctor: repair fixable findings",
             rollback: "doctor --fix: restore one operation",
+            quarantineOperation: "doctor --fix: quarantine one unreadable operation record",
             fromOperation: "doctor --fix: select saved settings from an operation",
             fromPreset: "doctor --fix: preset for unavailable settings",
             restorePreset: "doctor --fix: restore one missing or damaged user preset",
@@ -766,7 +775,7 @@ const koMessages = {
         choosePreset: "저장된 값이 없는 항목에 사용할 프리셋을 선택하세요:",
         sourceRequired: "저장된 값이 부족합니다. 터미널에서 tonedial doctor --fix를 실행하거나 자동 복구 전에 --from-preset SLUG 또는 --from-operation ID를 선택하세요.",
         sourceInvalid: "선택한 원본에서 올바른 설정을 읽지 못했습니다. 기존 파일은 유지했습니다.",
-        invalidOptions: "복구 원본과 도구 옵션은 doctor --fix에서 쓰세요. --restore-preset에는 --from-operation이 필요하며, --rollback은 원본·프리셋·도구 선택과 함께 쓸 수 없습니다.",
+        invalidOptions: "복구 원본·격리·도구 옵션은 doctor --fix에서 쓰세요. --restore-preset에는 --from-operation이 필요하며, --rollback은 격리·원본·프리셋·도구 선택과 함께 쓸 수 없습니다.",
         keptSettings: "저장된 설정·사용자 프리셋 유지",
         obsoleteWidthDiscarded: "더 이상 쓰지 않는 fixed_width의 잘못된 값을 버립니다. 출력은 터미널 폭에 맞춥니다.",
         obsoleteGuardsDiscarded: "더 이상 쓰지 않는 guards의 잘못된 값을 버립니다. ToneDial은 가드 요청을 넣지 않습니다.",
@@ -779,6 +788,13 @@ const koMessages = {
         rollback: (id) => `이전 파일로 돌아가기:\ntonedial doctor --fix --rollback ${id}`,
         rollbackOrder: "연결 파일을 먼저 되돌린 뒤 앱 파일을 되돌리세요:",
         noSnapshot: (id) => `${id}: 이 상태 경로에서 쓸 수 있는 설정 기록이 없습니다`,
+        quarantineCandidate: (id) => `작업 ID:\n${id}\n앱을 복구하려면 이 기록을 먼저 격리해야 합니다. 원본 바이트는 롤백 기록에 보존됩니다.`,
+        quarantineQuestion: "격리하려면 위 작업 ID 전체를 입력하세요. Enter를 누르면 취소합니다:",
+        quarantineRequired: (id, command) => `${id}: 복구 전에 읽을 수 없는 작업 기록을 명시적으로 격리해야 합니다. 파일은 바꾸지 않았습니다.\n${command}`,
+        quarantineUnavailable: (id) => `${id}: 격리할 수 있는 읽기 불가 작업 기록을 찾지 못했습니다. 파일은 바꾸지 않았습니다.`,
+        quarantine: (id) => `읽을 수 없는 작업 ${id}를 격리합니다. 원본 바이트는 롤백 기록에 보존합니다.`,
+        quarantineComplete: (id) => `읽을 수 없는 작업 ${id}를 격리했습니다.`,
+        quarantineRemaining: (count) => `읽을 수 없는 작업 기록 ${count}개가 남았습니다. 다음 기록을 격리한 뒤 복구를 계속하세요.`,
         retire: (id) => `중단된 작업 ${id}를 기록으로 보관한 뒤 새 앱 복구를 시작합니다. 그 작업의 외부 파일 변경은 확인하거나 되돌리지 않습니다.`,
         resumeOperation: (id) => `중단된 작업:\n${id}`,
         resumeQuestion: "계속하려면 위 작업 ID 전체를 입력하세요. Enter를 누르면 취소합니다:",
@@ -937,6 +953,7 @@ const koMessages = {
         seedsNotRun: "기본 파일 없음 · init으로 준비하세요",
         seedsAttention: "기본 파일 확인 필요",
         recoveryPending: "진행 중이거나 복구가 필요한 작업이 있습니다. 이번 실행에서는 파일을 바꾸지 않았습니다.",
+        invalidRecoveryPending: "읽을 수 없는 작업 기록 때문에 복구를 진행할 수 없습니다. 이번 실행에서는 파일을 바꾸지 않았습니다.",
         resumeOperation: "앱 복구를 이어가려면:",
         contextCurrent: "AGENTS.md와 TONE.md 구성이 최신입니다.",
         contextRepair: "관리 중인 컨텍스트 파일을 복구해야 합니다. 안내 파일과 톤 파일의 진단을 확인해 주세요.",
@@ -959,7 +976,7 @@ const koMessages = {
             changed: "검사 중 전달 스크립트나 설정이 바뀌었습니다. 변경이 끝난 뒤 다시 시도해 주세요.",
             probe: "제어된 검사에 실패했습니다. Node와 임시 디렉터리 접근 권한을 확인한 뒤 doctor를 다시 실행해 주세요.",
         },
-        operationState: { pending: "미완료", complete: "완료", "rolled-back": "복구됨", "retired-for-app-rebuild": "앱 복구를 위해 보관됨", invalid: "잘못된 기록" },
+        operationState: { pending: "미완료", complete: "완료", "rolled-back": "복구됨", "retired-for-app-rebuild": "앱 복구를 위해 보관됨", quarantined: "격리됨", invalid: "잘못된 기록" },
         rollbackStatus: {
             ready: "승인하면 선택한 작업을 복구합니다.",
             busy: "아직 진행 중인 작업입니다. 작업이 끝날 때까지 기다려 주세요.",
@@ -1127,6 +1144,7 @@ const koMessages = {
             tools: "연결할 에이전트 · init에서 none은 상태만 준비",
             fix: "doctor: 고칠 수 있는 문제 복구",
             rollback: "doctor --fix: 작업 하나 복구",
+            quarantineOperation: "doctor --fix: 읽을 수 없는 작업 기록 하나 격리",
             fromOperation: "doctor --fix: 작업 기록에서 설정 선택",
             fromPreset: "doctor --fix: 없는 설정에 사용할 프리셋",
             restorePreset: "doctor --fix: 없거나 손상된 사용자 프리셋 하나 복원",

package/dist/core/locales/es.js

@@ -101,7 +101,7 @@ const messages = {
         choosePreset: "Elige un preajuste para los valores sin un origen guardado válido:",
         sourceRequired: "Los valores guardados están incompletos. Ejecuta tonedial doctor --fix de forma interactiva o selecciona --from-preset SLUG o --from-operation ID antes de recuperar sin interacción.",
         sourceInvalid: "El origen elegido no proporciona ajustes válidos. Se conservó el original.",
-        invalidOptions: "El origen de recuperación y las herramientas requieren doctor --fix. --restore-preset requiere --from-operation; --rollback no se combina con origen, preajuste ni herramientas.",
+        invalidOptions: "El origen, la cuarentena y las herramientas requieren doctor --fix. --restore-preset requiere --from-operation; --rollback no se combina con cuarentena, origen, preajuste ni herramientas.",
         keptSettings: "Se conservaron los ajustes y preajustes personalizados.",
         obsoleteWidthDiscarded: "Se descarta el valor no válido del antiguo fixed_width. La salida se adapta al ancho del terminal.",
         obsoleteGuardsDiscarded: "Se descarta el valor no válido del antiguo guards. ToneDial ya no añade solicitudes de protección.",
@@ -114,6 +114,13 @@ const messages = {
         rollback: (id) => `Restaura los archivos anteriores:\ntonedial doctor --fix --rollback ${id}`,
         rollbackOrder: "Restaura primero las conexiones y después los archivos de la aplicación:",
         noSnapshot: (id) => `${id}: no hay una instantánea válida para este directorio de estado`,
+        quarantineCandidate: (id) => `ID de operación:\n${id}\nPara reconstruir, primero debes poner este registro en cuarentena; los bytes originales quedarán en el historial de reversión.`,
+        quarantineQuestion: "Escribe el ID completo de arriba para ponerlo en cuarentena; Enter cancela:",
+        quarantineRequired: (id, command) => `${id}: debes poner en cuarentena este registro ilegible antes de recuperar. No se cambió ningún archivo.\n${command}`,
+        quarantineUnavailable: (id) => `${id}: no hay un registro de operación ilegible que se pueda poner en cuarentena. No se cambió ningún archivo.`,
+        quarantine: (id) => `Pon en cuarentena la operación ilegible ${id}; conserva sus bytes originales en el historial de reversión.`,
+        quarantineComplete: (id) => `La operación ilegible ${id} quedó en cuarentena.`,
+        quarantineRemaining: (count) => `${count === 1 ? "Queda 1 registro de operación ilegible" : `Quedan ${count} registros de operación ilegibles`}. Pon el siguiente en cuarentena antes de continuar la recuperación.`,
         retire: (id) => `Archiva la operación detenida ${id} antes de reconstruir. Sus cambios externos no se certifican ni se deshacen.`,
         resumeOperation: (id) => `Operación detenida:\n${id}`,
         resumeQuestion: "Para continuar, escribe el ID completo de arriba; Enter cancela:",
@@ -269,6 +276,7 @@ const messages = {
         seedsNotRun: "sin archivos incluidos · aquí no se ha ejecutado init",
         seedsAttention: "los archivos incluidos requieren atención",
         recoveryPending: "Hay una operación en curso o que necesita recuperación. Esta ejecución no cambió archivos.",
+        invalidRecoveryPending: "Un historial de operaciones ilegible está bloqueando la recuperación. Esta ejecución no cambió archivos.",
         resumeOperation: "Continuar la reparación de la aplicación:",
         contextCurrent: "La estructura de AGENTS.md y TONE.md está al día.",
         contextRepair: "Los archivos de contexto gestionados necesitan reparación. Revisa el diagnóstico de la guía y del tono.",
@@ -291,7 +299,7 @@ const messages = {
             changed: "El lector o los ajustes cambiaron durante la inspección. Reintenta cuando terminen los cambios.",
             probe: "Falló la comprobación controlada. Revisa Node y el acceso al directorio temporal; después repite doctor.",
         },
-        operationState: { pending: "pendiente", complete: "completa", "rolled-back": "restaurada", "retired-for-app-rebuild": "archivada para reconstruir", invalid: "registro no válido" },
+        operationState: { pending: "pendiente", complete: "completa", "rolled-back": "restaurada", "retired-for-app-rebuild": "archivada para reconstruir", quarantined: "en cuarentena", invalid: "registro no válido" },
         rollbackStatus: {
             ready: "La aprobación restaurará la operación elegida.",
             busy: "La operación sigue activa. Espera a que termine su propietario.",
@@ -455,6 +463,7 @@ const messages = {
             tools: "agentes que conectar · init: none solo crea el estado",
             fix: "doctor: reparar los problemas que se puedan",
             rollback: "doctor --fix: restaurar una operación",
+            quarantineOperation: "doctor --fix: poner en cuarentena un registro ilegible",
             fromOperation: "doctor --fix: elegir ajustes guardados de una operación",
             fromPreset: "doctor --fix: preajuste para ajustes no disponibles",
             restorePreset: "doctor --fix: restaurar un preajuste ausente o dañado",

package/dist/core/locales/ja.js

@@ -101,7 +101,7 @@ const messages = {
         choosePreset: "有効な保存元がない値の復元用プリセットを選んでください：",
         sourceRequired: "保存値が不完全です。tonedial doctor --fix を対話的に実行するか、無人復旧の前に --from-preset SLUG または --from-operation ID を選んでください。",
         sourceInvalid: "選択元から有効な設定を取得できません。元のファイルは保持しました。",
-        invalidOptions: "復旧元とツールの指定には doctor --fix が必要です。--restore-preset には --from-operation が必要です。--rollback は復旧元、プリセット、ツール指定と併用できません。",
+        invalidOptions: "復旧元、隔離、ツールの指定には doctor --fix が必要です。--restore-preset には --from-operation が必要です。--rollback は隔離、復旧元、プリセット、ツール指定と併用できません。",
         keptSettings: "保存済み設定とカスタムプリセットを保持しました。",
         obsoleteWidthDiscarded: "廃止済み fixed_width の無効な値を破棄します。出力はターミナル幅に従います。",
         obsoleteGuardsDiscarded: "廃止済み guards の無効な値を破棄します。ToneDialはガード要求を追加しません。",
@@ -114,6 +114,13 @@ const messages = {
         rollback: (id) => `以前のファイルに戻す：\ntonedial doctor --fix --rollback ${id}`,
         rollbackOrder: "先に接続を復元し、その後アプリケーションのファイルを復元してください：",
         noSnapshot: (id) => `${id}: この状態ルート用の有効な設定スナップショットがありません`,
+        quarantineCandidate: (id) => `操作ID：\n${id}\n再構築するには、先にこの記録を隔離する必要があります。元のバイト列はロールバック履歴に保持されます。`,
+        quarantineQuestion: "隔離するには上の操作ID全体を入力してください。Enterで中止：",
+        quarantineRequired: (id, command) => `${id}: 復旧前に、読み取れない操作記録を明示的に隔離する必要があります。ファイルは変更していません。\n${command}`,
+        quarantineUnavailable: (id) => `${id}: 隔離できる読み取り不能な操作記録が見つかりません。ファイルは変更していません。`,
+        quarantine: (id) => `読み取れない操作 ${id} を隔離し、元のバイト列をロールバック履歴に保持します。`,
+        quarantineComplete: (id) => `読み取れない操作 ${id} を隔離しました。`,
+        quarantineRemaining: (count) => `読み取れない操作記録が ${count} 件残っています。次の記録を隔離してから復旧を続けてください。`,
         retire: (id) => `停止した操作 ${id} を履歴に移してから再構築してください。外部への変更は検証も取り消しもされません。`,
         resumeOperation: (id) => `停止した操作:\n${id}`,
         resumeQuestion: "続行するには上の操作ID全体を入力してください。Enterで中止:",
@@ -269,6 +276,7 @@ const messages = {
         seedsNotRun: "同梱ファイルなし · ここでは init 未実行",
         seedsAttention: "同梱ファイルの確認が必要",
         recoveryPending: "実行中または復旧が必要な操作があります。この実行ではファイルを変更していません。",
+        invalidRecoveryPending: "読み取れない操作履歴が復旧を妨げています。この実行ではファイルを変更していません。",
         resumeOperation: "アプリ復旧を続けるには:",
         contextCurrent: "AGENTS.md と TONE.md の構成は最新です。",
         contextRepair: "管理対象のコンテキストファイルに修復が必要です。ガイドと口調ファイルの診断を確認してください。",
@@ -291,7 +299,7 @@ const messages = {
             changed: "確認中にリーダーか設定が変更されました。変更が終わってから再試行してください。",
             probe: "制御下の確認に失敗しました。Nodeと一時ディレクトリへのアクセスを確認し、doctor を再実行してください。",
         },
-        operationState: { pending: "保留中", complete: "完了", "rolled-back": "復元済み", "retired-for-app-rebuild": "再構築用に履歴へ移行", invalid: "無効な記録" },
+        operationState: { pending: "保留中", complete: "完了", "rolled-back": "復元済み", "retired-for-app-rebuild": "再構築用に履歴へ移行", quarantined: "隔離済み", invalid: "無効な記録" },
         rollbackStatus: {
             ready: "承認すると選択した操作を復元します。",
             busy: "まだ実行中です。所有者の完了を待ってください。",
@@ -455,6 +463,7 @@ const messages = {
             tools: "接続するエージェント · init: none は状態のみ",
             fix: "doctor: 修復可能な問題を修復",
             rollback: "doctor --fix: 操作を1つ復元",
+            quarantineOperation: "doctor --fix: 読み取れない操作記録を1つ隔離",
             fromOperation: "doctor --fix: 操作から保存済み設定を選択",
             fromPreset: "doctor --fix: 不足した設定用のプリセット",
             restorePreset: "doctor --fix: 不足・破損したユーザープリセットを復元",

package/dist/core/locales/zh.js

@@ -101,7 +101,7 @@ const messages = {
         choosePreset: "请为缺少有效保存来源的值选择预设：",
         sourceRequired: "保存值不完整。请交互运行 tonedial doctor --fix，或在无人值守恢复前选择 --from-preset SLUG 或 --from-operation ID。",
         sourceInvalid: "所选来源无法提供有效设置，已保留原文件。",
-        invalidOptions: "恢复来源和工具选项需要 doctor --fix。--restore-preset 需要 --from-operation；--rollback 不能与来源、预设或工具选项同时使用。",
+        invalidOptions: "恢复来源、隔离和工具选项需要 doctor --fix。--restore-preset 需要 --from-operation；--rollback 不能与隔离、来源、预设或工具选项同时使用。",
         keptSettings: "已保留保存的设置和自定义预设。",
         obsoleteWidthDiscarded: "丢弃已停用的无效 fixed_width 值。输出将跟随终端宽度。",
         obsoleteGuardsDiscarded: "丢弃已停用的无效 guards 值。ToneDial 不再添加防护请求。",
@@ -114,6 +114,13 @@ const messages = {
         rollback: (id) => `恢复之前的文件：\ntonedial doctor --fix --rollback ${id}`,
         rollbackOrder: "请先恢复连接，再恢复应用文件：",
         noSnapshot: (id) => `${id}：没有此状态根目录的有效设置快照`,
+        quarantineCandidate: (id) => `操作 ID：\n${id}\n要重建应用，必须先隔离这条记录；原始字节仍保存在回滚历史中。`,
+        quarantineQuestion: "请输入上方完整的操作 ID 以隔离该记录；按 Enter 取消：",
+        quarantineRequired: (id, command) => `${id}：恢复前必须明确隔离这条无法读取的操作记录。未更改文件。\n${command}`,
+        quarantineUnavailable: (id) => `${id}：找不到可隔离的无法读取操作记录。未更改文件。`,
+        quarantine: (id) => `隔离无法读取的操作 ${id}；原始字节保留在回滚历史中。`,
+        quarantineComplete: (id) => `已隔离无法读取的操作 ${id}。`,
+        quarantineRemaining: (count) => `仍有 ${count} 条无法读取的操作记录。请隔离下一条记录后继续恢复。`,
         retire: (id) => `重建应用前，请将已停止的操作 ${id} 归档为历史。其外部变更不会被认证或撤销。`,
         resumeOperation: (id) => `已停止的操作：\n${id}`,
         resumeQuestion: "要继续，请输入上方完整的操作 ID；按 Enter 取消：",
@@ -269,6 +276,7 @@ const messages = {
         seedsNotRun: "无内置文件 · 尚未在此运行 init",
         seedsAttention: "内置文件需要处理",
         recoveryPending: "有操作正在运行或需要恢复。本次执行未更改文件。",
+        invalidRecoveryPending: "无法读取的操作历史阻止了恢复。本次执行未更改文件。",
         resumeOperation: "继续应用恢复：",
         contextCurrent: "AGENTS.md 与 TONE.md 布局已是最新。",
         contextRepair: "受管理的上下文文件需要修复，请检查指南和语气文件诊断。",
@@ -291,7 +299,7 @@ const messages = {
             changed: "检查时读取程序或设置发生变化，请等修改结束后重试。",
             probe: "受控探测失败。请检查 Node 和临时目录访问权限，再运行 doctor。",
         },
-        operationState: { pending: "待处理", complete: "已完成", "rolled-back": "已恢复", "retired-for-app-rebuild": "已归档以供重建", invalid: "无效记录" },
+        operationState: { pending: "待处理", complete: "已完成", "rolled-back": "已恢复", "retired-for-app-rebuild": "已归档以供重建", quarantined: "已隔离", invalid: "无效记录" },
         rollbackStatus: {
             ready: "批准后将恢复所选操作。",
             busy: "操作仍在运行，请等待其所有者完成。",
@@ -455,6 +463,7 @@ const messages = {
             tools: "要连接的代理 · init：none 仅初始化状态",
             fix: "doctor：修复可处理的问题",
             rollback: "doctor --fix：恢复一次操作",
+            quarantineOperation: "doctor --fix：隔离一条无法读取的操作记录",
             fromOperation: "doctor --fix：从操作中选择保存设置",
             fromPreset: "doctor --fix：为不可用设置选择预设",
             restorePreset: "doctor --fix：恢复一个缺失或损坏的用户预设",

package/dist/core/operations.js

@@ -387,6 +387,27 @@ export function readJournal(paths, operationIdValue) {
     const journal = readJson(path);
     return validJournal(journal, paths, operationIdValue) ? journal : null;
 }
+function readOperationQuarantine(paths, operationIdValue) {
+    if (!existingOperationsDirectory(paths))
+        return null;
+    const value = readJson(operationJournalPath(paths, operationIdValue));
+    return isPlainObject(value) && hasExactKeys(value, ["kind", "operationId", "originalSha256", "root", "schema"]) &&
+        value.schema === 1 && value.kind === "quarantined-operation" && value.operationId === operationIdValue &&
+        value.root === paths.root && /^[0-9a-f]{64}$/.test(value.originalSha256)
+        ? value : null;
+}
+/** Replace an unreadable journal with a nonblocking marker; the enclosing repair journal keeps its original bytes. */
+export function serializeOperationQuarantine(paths, operationIdValue, original) {
+    if (!validOperationId(operationIdValue))
+        throw new OperationError("invalid", "operation id is not valid");
+    return `${JSON.stringify({
+        schema: 1,
+        kind: "quarantined-operation",
+        operationId: operationIdValue,
+        root: paths.root,
+        originalSha256: createHash("sha256").update(original).digest("hex"),
+    }, null, 2)}\n`;
+}
 function journalTime(journal) {
     const updated = Date.parse(journal.updatedAt);
     if (Number.isFinite(updated))
@@ -889,12 +910,13 @@ export function inspectOperations(paths) {
             continue;
         const id = match.groups.id;
         const journal = readJournal(paths, id);
+        const quarantine = journal === null ? readOperationQuarantine(paths, id) : null;
         journals.push({
             path: join(paths.operations, entry.name),
             operationId: id,
-            state: journal?.state ?? "invalid",
+            state: journal?.state ?? (quarantine === null ? "invalid" : "quarantined"),
             journal,
-            ...(journal === null ? { message: "mutation journal is invalid" } : {}),
+            ...(journal === null ? { message: quarantine === null ? "mutation journal is invalid" : "invalid journal is quarantined in rollback history" } : {}),
         });
     }
     const ownerOnly = ownerOnlyInspection(paths, lock);

package/dist/core/seeds.js

@@ -11,7 +11,7 @@ import { captureRawEntry, caseRenameMatchesCurrent, isNoop, planChange, planEntr
 import { BUNDLED, builtinPresetDir, LEGACY_BUILTIN_SLUGS, RETIRED_PRESETS } from "./presets.js";
 import { SKILL_MD, SKILL_NAME, SKILL_TRAITS_MD } from "./skill.js";
 // Bump for changed generated content; freshness also checks each managed seed's bytes/provenance.
-export const SEED_VERSION = 21;
+export const SEED_VERSION = 23;
 /** The state-root operating boundaries. The compiler owns the current tone separately. */
 export const GUIDE_MD = `${GUIDE_FORMAT_MARKER}
 ToneDial changes manner only; it never expands task scope or permissions.

package/dist/core/skill.js

@@ -195,6 +195,12 @@ If repair fails, report its phase, affected path, safe error code and operation
 Some file changes may already be applied; a failure is not evidence that all files stayed unchanged.
 Preserve the operation record and follow the reported scoped read-only diagnosis.
 Default doctor output focuses on blockers; \`--verbose\` and JSON retain the operation history.
+If doctor reports an unreadable operation record, use its exact scoped
+\`doctor --fix --quarantine-operation <id>\` command. Preview or approve that replacement through
+the normal repair gate; never delete the record directly. The replacement stops the damaged
+record from blocking recovery, while the repair journal keeps its original bytes and mode for
+explicit rollback. If several records are unreadable, run the next exact command doctor reports;
+each invocation quarantines one record, and the last continues the application rebuild.
 For an explicitly selected stopped operation, \`doctor --fix --from-operation <id>\` continues
 application repair using valid current settings first; it does not undo the earlier changes.
 Preview that exact ID and scope with \`--dry-run\` before applying the approved repair.
@@ -452,7 +458,7 @@ selected by critique or persona. Bravado grades effort claims without replacing
  * command name stays `/tone` even though the tool is `tonedial`: it is what a person types
  * mid-sentence, and the two extra characters are paid every time.
  */
-export const TONE_COMMAND_VERSION = 13;
+export const TONE_COMMAND_VERSION = 15;
 export const TONE_COMMAND_MD = `---
 description: Check, change, or reload this agent's tone, preset, or ToneDial settings
 ---

package/dist/wiring/apply.js

@@ -832,7 +832,7 @@ function validateEntryRebuildAction(action, prepared = false) {
     const value = snapshotRecord(action.metadata ?? null);
     if (action.kind !== "entry-rebuild" || !normalizedPath(action.path) || action.realPath !== action.path || value === null ||
         Object.keys(value).sort().join(",") !== ["schema", "reason", "boundary", "boundaryIdentity", "parents", "stash", "stashIdentity", "archive", "prepared", "preparedIdentity", "createdParents", ...(Object.hasOwn(value, "recipes") ? ["recipes"] : [])].sort().join(",") ||
-        value.schema !== 1 || !["generated", "restore-config", "restore-preset"].includes(value.reason) ||
+        value.schema !== 1 || !["generated", "restore-config", "restore-preset", "quarantine-operation"].includes(value.reason) ||
         !normalizedPath(value.boundary) || !lexicallyInside(action.path, value.boundary) || !identityTextValue(value.boundaryIdentity) ||
         !Array.isArray(value.parents) || value.parents.length === 0 || !normalizedPath(value.stash) ||
         dirname(value.stash) !== dirname(action.path) || !new RegExp(`^\\.${basename(action.path).replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\.tonedial-rebuild-[0-9a-f]{32}$`).test(basename(value.stash)) ||

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tonedial",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "Set a coding agent's manner once and keep it across every project.",
   "license": "MIT",
   "type": "module",