[easonLiangWorldedtech]

This PR routes the apply_patch tool through the guard, so a patch hunk can no longer "write" a file the model never fully read: an unobserved overwrite and a stale version token are refused with the standard remediation. A move carries the source's completeness to its destination instead of claiming completeness for lines the model never read, and a partial-source move onto an already-observed destination is rejected before any state changes. It also fixes a resource leak: when the guard refuses a publish, saveDirectly now rolls back the parent directories it created.

It is the sixth of nine PRs for epic #1375 (chain tracked on #1991).

Related GitHub Issue

Closes: #2021 (this unit's tracking issue).
Refs: #1991 (chain tracking), #1375 (epic).

Description

What this PR changes:

1. apply_patch publishes via guardedWrite, so an unobserved overwrite and a stale version token are rejected with the read-first / re-read-then-retry remediation instead of clobbering the file.
2. A move re-targets the source's observation onto the destination: the destination inherits the source's complete flag, so a slice, range, truncated, or indentation-block source never authorizes a full-file replacement at the new path.
3. A partial-source move onto a destination that was already observed completely is rejected before any file or registry state is touched.
4. saveDirectly captures the list createDirectoriesForFile returns and, if the guard rejects, removes those directories innermost-first with rmdir (which refuses a directory another writer populated, so the loop stops at the first failure) and rethrows the original write error.
5. Ancestor-identity pinning at publish: the confined write records the identities of the directories it created and re-checks them before the commit rename, refusing with AncestorReplacedError if an ancestor was swapped underneath it.

Why the diff looks bigger than the change: the chain is non-cumulative - this branch is based on main and carries its own copy of the earlier units' content, which the GitHub diff shows as context.

Review focus: src/core/tools/ApplyPatchTool.ts, the guard wiring in src/core/tools/guardedWrite.ts, the rollback path in src/integrations/editor/DiffViewProvider.ts, and the specs named below.

Test Procedure

From the repository root, with dependencies installed:

pnpm --dir src exec vitest run --globals core/tools/__tests__/applyPatchTool.guardedWrite.spec.ts
pnpm --dir src exec vitest run --globals integrations/editor/__tests__/DiffViewProvider.spec.ts
pnpm --dir src exec tsc --noEmit
pnpm --dir src exec eslint --max-warnings=0 core/tools/ApplyPatchTool.ts core/tools/guardedWrite.ts integrations/editor/DiffViewProvider.ts

Environment: Node 22+, Linux/macOS/Windows CI runners (the guard's platform-specific branches are exercised through the injected platform option, not a real Windows host).

Pre-Submission Checklist

• Scope is one gate scope and matches the unit.
• No .changeset or CHANGELOG changes (AGENTS.md).
• src/eslint-suppressions.json unchanged - no suppression count increased.
• New code lints clean (--max-warnings=0) rather than relying on suppressions.
• Tests added at the lowest layer that would have caught each finding.
• Visual Snapshot item considered: not applicable (no rendered surface).

Visual Snapshots

Not applicable - no UI change.

Videos (interaction / animation only)

Not applicable.

Documentation Updates

None. No user-facing setting, command, or documented behavior string changes; the guard's remediation text is already introduced in earlier units. No .changeset and no CHANGELOG edit (AGENTS.md).

Additional Notes

• Budget: 691 a+d / 105 changed executable lines - inside both caps.
• mutation-diff is red on the changed-line budget only: the gate counts the GitHub diff, which carries the unlanded predecessors (1205 changed executable lines against the 500 cap; this unit's own delta is 105). The row clears when the predecessors land and this branch is rebased.
• The directory-rollback test is a real pin: with the DiffViewProvider.ts change stashed it fails.
• Content source of record: the superseded umbrella PR feat(tools): track read completeness and guard the diff-view save path (S4b, #1375) #1833 (closed), replayed onto the current main tip. Split plan of record: comments 5993969784 / 5994039786 / 5994053776 on [Tracking] guarded-write chain (epic 1375): rules, port sources, chain-level rows #1991.
• Merge order for the chain: U1 -> U2 -> U3 -> U4 -> U5 -> U8 -> U6 -> U7 -> U9. This unit's merge-order predecessor is U8 (feat(editor): route the diff-view save through the guard (U8, #1375) #1916).

Verification at this head

• Local lanes at this head: integrations + core/tools + activate - 1340 passed / 17 skipped across 60 files; tsc --noEmit clean; eslint clean on the changed files with no suppression-count increase.
• CI at this head: all required checks green; mutation-diff red on the budget-cap count described above (no surviving mutants in this unit's own lines).

Updated this round

• Rewrote the description for human reviewers (maintainer feedback on feat(file-safety): atomic text publish primitive (U1, #1375) #1910) and linked this unit's tracking issue Tracking fws U6: apply_patch publishes through the guard #2021, so the PR now has a linked issue.

Get in Touch

Reviewer and maintainer questions are welcome as comments on this PR or on #1991.

Stryker directive removal (equivalence notes)

Per AGENTS.md the two Stryker suppression comments in the guarded save
path were removed instead of kept; their equivalence claims:

• writeKind default StringLiteral ("update" -> ""): an empty kind
  dispatches exactly like "update" inside guardedWrite - only "edit"
  and "create" branch distinctly - and the default-parameter line is
  not part of this unit's changed-line selector, so the mutant is
  equivalent / out of scope.
• saveTask operand of the adoption-probe guard (LogicalOperator):
  GuardRejectedError is only thrown by guardedWrite, which is reached
  only after the !saveTask check above has already thrown. Whenever
  the operand is evaluated saveTask is provably non-null, so dropping
  the operand cannot change which branch is taken.

mutation-diff remains advisory for stacked units; maintainers decide any
narrow gate-config exclusion.

Re-review round (1e8b458)

• Committed gh device ID removed (.local/state/gh/device-id, gitignored,
  swept in by an add -A during a refresh). No other .local/ strays on any
  unit branch or main.
• Changed-block as any cleanup in DiffViewProvider.spec.ts: bracket
  access for private members + documented unknown-based structural casts for
  VS Code doubles; suppression 310 -> 285.
• Cleanup-safety-net test asserts content, not just count: the single
  console.error must carry [Original Error Caught] with the commit-failure
  object as its second argument, and no call may carry the cleanup-error text.

Re-review responses (error-fix re-review wave)

• ApplyPatchTool move, durability-error branch (Minor Functional): first
  answered by completing the source unlink and reporting unlink failures as
  PartialMoveError - since SUPERSEDED by the crash-availability reversal
  below; see the next section for the shipped semantics.

Crash-availability reversal (durability-error move)

A follow-up review (Major Data-Integrity) reversed the previous round's
guidance for the same branch, and the new semantics shipped: when the
destination's commit rename landed but its directory entry is not known to
be durable (PostCommitDurabilityError), the source is KEPT and the
durability error propagates - unlinking it could leave NEITHER path
available after a crash. The duplicate is visible to the model and
recoverable; a file lost to the crash is neither, so crash availability
outranks not leaving the content at both paths. The try/catch is gone (the
error propagates naturally) and the durability test now asserts the source
unlink was NOT called; the unlink-failure test from the superseded round was
removed with its unreachable scenario. Negative control: restoring the
unlink reddens exactly the kept-source test.

Move deletion bound to the recorded observation (440dca4)

The Persistence Integrity row demanded the source deletion prove the
source is still the file the observation authorized. The move now
deletes under the shared advisory lock (withFileLock on the canonical
lock key): the source must still be present in the observation registry
and its recorded version must equal a fresh bigint stat of the source,
otherwise the move raises PartialMoveError before any unlink. A stat
failure is likewise a PartialMoveError - an unreadable source is not a
deletable source. Tests: the never-observed case now asserts no unlink
and no destination tracking; three new tests pin the changed-source
rejection, the vanished-source rejection, and that the deletion runs
under the source's lock key. 26/26 green; negative controls (faithful
mutants of each check) each redden exactly one test.

Durability note: on the durability-error path the source is kept
outright - PostCommitDurabilityError propagates before the deletion is
reached - the strongest form of the protected-deletion contract this
unit's issue asks for.

Security Boundaries disposition (warn-only DACL). The row asks for
the DaCl restore failure to fail closed. That change belongs to the
publish-primitive owner (PR 1916, fixed there in 3624e4f), which
merges before this unit in the declared order; this unit carries the
same carrier copy and reconciles at rebase (record 6106959976 on issue
1408; tracking 1991). Implementing it twice here would fork the fix.

Walkthrough carry-over evidence (04:34 walkthrough vs head 440dca4)

The 04:34 walkthrough still carries the Persistence Integrity and
Security Boundaries ERROR rows whose claims predate this head (pushed
2026-10-16T03:55Z). The PI row's raw-unlink line numbers belong to the
superseded head 993fc6f; at this head the deletion is lock-serialized
and observation-bound exactly as the Resolution demands (missing,
changed, vanished, or unobserved sources are kept; PartialMoveError
names the committed destination and remaining source; the durability
path keeps the source outright; tests and negative controls above). The
SB row re-flags the carrier copy's warn-only DACL restore, whose
fail-closed fix lands at the publish-primitive owner (PR 1916,
3624e4fea) that merges before this unit; copies reconcile at rebase
(record 6106959976 on issue 1408). Evidence comment posted on the pull
request; no code change this round.