| 1 | # Read evidence repair and verification |
| 2 | |
| 3 | This completes the execution wiring of the existing single-PR read redesign. |
| 4 | The coordinator owns continuation and final-answer decisions in the default |
| 5 | pipeline; the legacy incomplete-read machine is used only for rollback. |
| 6 | |
| 7 | The actual reader produces output and source identity from the same captured |
| 8 | bytes or overlay buffer. Disk inspect/range calls capture identity only up to 256 KiB; |
| 9 | larger local reads remain bounded streaming reads. Explicit full reads and |
| 10 | their host continuations capture at most 64 MiB. Unversioned windows cannot be stitched into a full-file |
| 11 | claim; an incomplete full requirement becomes `needs_scope`. These are internal |
| 12 | resource bounds, not new user settings. Read tokens are clipped to live context |
| 13 | headroom for full reads and automatic continuation, including an ordered batch |
| 14 | finalization check; ordinary previews retain normal context compaction. |
| 15 | |
| 16 | Continuation must match the complete last-issued cursor. Reader-owned path |
| 17 | resolution preserves relative paths and aliases. The executed source must still |
| 18 | match the cursor snapshot. Page and measured active-time bounds stop dispatch; |
| 19 | no-progress advice changes the requested strategy, and repeated stalls pause. |
| 20 | |
| 21 | Writers declare original ranges through their real preview/validation path. |
| 22 | `multi_edit` computes all changes against the original source for preflight. |
| 23 | An overwrite requires full evidence for the current raw version, including an |
| 24 | unsaved new buffer. The writer verifies the preflight source again at execution. |
| 25 | Same-batch reads never supply write evidence. Historical evidence failures are |
| 26 | re-evaluated against the frozen provider-round boundary and can be cleared. |
| 27 | Rebuild waivers require an exact path in the same affirmative rewrite clause. |
| 28 | Moves preserve content and reject existing destinations, so they require no |
| 29 | full-text evidence; anchored deletion retains its existing owner. |
| 30 | |
| 31 | Desktop and CLI display disjoint one-based coverage and recovery guidance. |
| 32 | Generation and sequence fence stale frames; independent reads retain their |
| 33 | own entries and completion clears live status. |
| 34 | |
| 35 | Regression coverage lives in `internal/agent/read_pipeline_regression_test.go`, |
| 36 | `internal/tool/builtin/read_evidence_regression_test.go`, |
| 37 | `internal/cli/read_status_test.go`, and the frontend read-status tests. Legacy |
| 38 | protocol and dependent-edit tests explicitly select rollback mode. The golden |
| 39 | provider request is updated for the intent/cursor schema already added by this |
| 40 | PR. This intentional schema change may rebuild the prompt cache on first use; |
| 41 | host envelopes and write-source checks remain outside provider-visible bytes. |
| 42 | There is no session-store migration. Old cursors must be re-read after a new run. |
| 43 | |
| 44 | Local deterministic tests are distinct from native WebView2/WKWebView checks, |
| 45 | real-provider success/token measurements, exact-head remote CI, and release |
| 46 | availability. Those results must be reported separately. |
| 47 | |
| 48 | ## Completed-read reuse and terminal receipts |
| 49 | |
| 50 | The follow-up separates historical requirement completion from original text |
| 51 | available in the frozen model request. The ordered tool finalizer associates |
| 52 | captures by workspace, canonical path, source kind, raw identity and snapshot. |
| 53 | A satisfied requirement stays satisfied on a verified repeat; expansion keeps |
| 54 | coverage and accounting and asks only for missing ranges. New runs own new |
| 55 | registries and cursor bindings. |
| 56 | |
| 57 | Structured readers bypass generic string deduplication. A reference is allowed |
| 58 | only to identical original text in the actual sampled request, and only for |
| 59 | already covered ranges. References deliver no new source lines and cannot |
| 60 | reference other references. Projection removal or extension rewriting causes |
| 61 | bounded text delivery; it does not revoke an earlier completed requirement. |
| 62 | Extension changes that remove parseable source text also invalidate identity. |
| 63 | |
| 64 | `incomplete_read` is a terminal pause outcome, not success or a transport retry. |
| 65 | The optional `read_pause` LocalOnly receipt preserves up to 32 affected files |
| 66 | and 64 ranges per field, without content or executable cursors. Desktop live |
| 67 | and history views use the same idempotent notice. Old sessions omit the field; |
| 68 | older readers ignore the sentinel through the existing LocalOnly tool identity. |
| 69 | No migration or user setting is required. Existing write preconditions remain |
| 70 | independent of this receipt. The follow-up changes no tool schemas or system |
| 71 | prefixes; re-delivering text removed by compaction can increase an individual |
| 72 | request's input usage. |
| 73 | |
| 74 | The paid matrix retains the original 64 cases and adds 32 targeted cases plus |
| 75 | 12 exact-write cases. Its HTTP relay caps all upstream attempts at 600, reserves |
| 76 | 128,000 tokens before each request, retains reservations when usage is unknown, |
| 77 | and stops at 3 million tokens or four hours. The relay enforces a 2,048-token |
| 78 | output cap, including adapters that otherwise omit it, and credits known usage |
| 79 | even when a downstream client closes before the final SSE sentinel. It stores no credentials or request |
| 80 | bodies. Model task failures and host invariant failures remain separate results. |
| 81 | |
| 82 | Native verification found that informational pause receipts were folded into |
| 83 | completed process material. Read pauses now remain outside the process fold, |
| 84 | after the preserved candidate response, without an implicit continuation action. |
| 85 | Pause outcomes also remain distinct from provider errors in desktop metrics and |
| 86 | telemetry. The same rendering regression covers the live/history notice shape. |
| 87 | The paginated TranscriptStore uses that same conversion, including empty-body |
| 88 | LocalOnly receipts; cold backend slices and repeated frontend page loads are |
| 89 | tested independently from the legacy full-history converter. |
| 90 | Read-status event ranges stay zero-based and half-open, matching envelopes and |
| 91 | pause receipts; CLI and desktop perform the one-based conversion only when |
| 92 | displaying them. The emitter regression prevents a double shift of the first |
| 93 | visible line found during native pagination verification. |
| 94 |