- Clarified that reordering imports, re-indenting, and other mechanical restyling must be handled by the project formatter, not hand-edited through the patch tool.
- Updated each package's test script to run `bun test` with the `--parallel` flag.
- Updated the tui package test command to preserve its `test/*.test.ts` file filter while enabling parallel execution.
- Added `replace block N:` syntax in grammar/parser/tokenizer/types, emitting `kind: "block"` edits with empty-body checks.
- Added block-resolution in hashline apply/recovery, wiring `BlockResolver` to resolve edits with throw/drop unresolved behavior.
- Added native `blockRangeAt` support and exported block range/options types through pi-ast, pi-natives, and JS bindings.
- Added coding-agent resolver wiring plus internal visibility/exports updates and new parser, patcher, and setup-wizard tests.
- Clarified that replace/delete ranges must cover only lines that actually change, never widening to include unchanged surrounding code.
- Explained blast-radius rationale: a stale single-line replace corrupts one line vs. a stale block replace shredding the whole structure.
- Introduced a shared missingSnapshotTagMessage helper and reused it from both hashline patcher and preview validation.
- Required snapshot tags in preview hashline sections for all edits, including head/tail inserts, so preview failures now match apply-time rejections.
- Updated TUI width calculation to strip ANSI escapes before grapheme splitting, preserving styled ZWJ emoji width behavior.
- Made `#TAG` required on every file section; removed the hashless-header grammar form.
- Head/tail inserts with a stale tag now apply and emit `HEADTAIL_DRIFT_WARNING` instead of hard-failing.
- Anchored edits and missing files now surface write-tool guidance in error messages.
- Updated prompt docs to document no-hashless-form rule and stale-tag recovery guidance.
- Replaced snapshot internals with full-file records and removed contiguous/sparse snapshot APIs.
- Added file-hash normalization, computed `computeFileHash`, and updated grammar/messages to 4-hex tags.
- Simplified recovery by checking whole-file hashes first, then applying merge-replay fallback after mismatches.
- Updated coding-agent tools to use `record`/`recordFileSnapshot` and skip hash headers for unsnapshotted large files.
- Expanded patcher and snapshot tests to verify 4-hex anchors, hash deduplication, and cache-capped behavior.
- Replaced bare `A B` range headers with `replace N..M:`, `delete N..M`, `insert before N:`, `insert after N:`, `insert head:`, and `insert tail:`.
- Removed `&A..B` repeat rows; insert-before/after ops now express the same intent explicitly.
- Empty replace bodies now error instead of deleting; `delete` is the canonical deletion op.
- Updated grammar, prompt, docs, tests, and all call sites to the new syntax.
- Replacement hunks now drop duplicated closing delimiters restated in the payload but surviving just outside the range.
- Ranges that swallow a structural closer the payload omits now spare that closer instead of deleting it.
- Each repair surfaces a `delimiter-balance` warning through `ApplyResult.warnings`.
- Brackets inside strings, template literals, and comments are skipped to avoid false positives.
- Coalesced overlapping and abutting same-path reads in InMemorySnapshotStore into one existing tag.
- Folded disjoint but consistent reads into a single SparseSnapshot tag when their shared lines matched.
- Minted a new InMemorySnapshotStore tag when shared lines disagreed, treating the view as a changed file.
- Added a `hashRecognized` field to `MismatchDetails` and `MismatchError`, defaulting it to `true` for compatibility.
- Updated stale mismatch rejection messaging to distinguish drifted hashes from session-absent hashes with explicit guidance.
- Propagated `hashRecognized: snapshot !== null` in `Patcher` and added tests for both mismatch branches.
- Rejected bare `A` anchors; single-line ranges must now be spelled `A A`.
- Added a descriptive error for single-number headers to guide model output.
- Updated grammar, tokenizer, prompt docs, and tests to reflect the change.
- Redesigned hashline patch syntax from anchor-based (`A-B:`) to hunk-header format (`@@ A..B @@`) with unified-diff compatibility.
- Removed `autoDropPureInsertDuplicates` option and simplified apply behavior to preserve duplicated boundary and context lines.
- Changed repeat operator from `^A-B` to `&A..B` and range separator from `-` to `..` for consistency with hunk-header syntax.
- Added image resizing and dimension notes to eval tool output; improved write tool hashline header sanitation for legacy formats.
- Removed 521 lines of boundary-duplicate absorption code and simplified parser to auto-convert bare body rows and unified-diff contamination.
- Replaced 4-hex content-derived file hashes with 3-hex opaque tags minted by InMemorySnapshotStore, making tags session-bound pointers rather than content fingerprints.
- Removed lru-cache dependency; replaced LRU-bounded per-path rings with a flat 4096-slot global ring using a scrambled permutation to prevent LLM tag extrapolation.
- Made SnapshotStore required in Patcher (was optional); tag resolution now drives stale-anchor detection instead of recomputing hashes at apply time.
- Changed literal payload sigil from `|` to `+` and accepted `^A` shorthand for `^A-A`; added lenient recovery for bare bodies, lone `-` rows, and overlapping bare/concrete block pairs.
- Replaced anchor shorthand syntax with explicit range format (1: -> 1-1:) and removed ^/v sigils in favor of ^A-B repeat and A-B:- delete operations.
- Added repeat edit kind to support ^A-B syntax for copying lines A through B, and inline delete syntax A-B:- for range deletions.
- Removed after_anchor cursor kind and standalone delete rows; empty anchor blocks now produce blank-line replacements instead of deletions.
- Updated parser, tokenizer, and type system to discriminate literal and repeat payloads, and refactored apply/recovery logic to expand repeat edits into individual inserts.
- Updated coding-agent test fixtures and settings documentation to reflect new hashline syntax and behavior.
getEditAnchors was a 6-line copy in both apply.ts and recovery.ts, with an unguarded 'return []' fallthrough on the cursor union. Adding a new anchor-bearing Cursor or Edit kind would silently route through 'return []' in the recovery copy, skip verifyAnchorContent's check, and reopen the corruption window PR #1422 closed. Rewrite both copies as a switch with a 'never'-assertion default so a new kind fails the typecheck.
Also bring the Recovery class docstring and the tryRecover call-site comment in line with the new contract. Both previously described strategy 2 only in terms of line-count equality ('the edits' line numbers still resolve to the right rows'), which is the framing the replay gate now refuses; updated text mentions both guards and points at replaySessionChainOnCurrent for the full rationale.
Anchor configs placed rewrittenLine at floor(size/2) while anchors sat 8-1875 lines away. With Diff.structuredPatch using context=3, no hunk's context overlapped the rewrite, so applyEditsToSnapshot's 3-way merge succeeded on the first try and replaySessionChainOnCurrent (the path the bench claims to pin) was never invoked for the 6 accept cases. The sanity probe only checked probe !== null, which both branches satisfy, so the misalignment was silent.
Move rewrittenLine to anchors[0]-1 for accept cases so the first hunk's context actually spans the rewrite, forcing applyPatch failure and replay invocation. Strengthen the sanity check to require RECOVERY_SESSION_REPLAY_WARNING (only emitted past verifyAnchorContent) on every accept case so a future regression fails loudly instead of silently measuring the wrong path.
Pins the hot path PR #1422 hardened: Recovery.tryRecover → applyEditsToSnapshot (3-way merge fails) → replaySessionChainOnCurrent → verifyAnchorContent. Two regimes (accept/reject) × three file sizes (50/500/5000 lines) × two anchor counts (1/8). Sanity-probes each case once before timing so the numbers measure the right branch.
Surfaces the four-split-per-replay cost in the gated path; dedup is an obvious follow-up at large file sizes but out of scope here.
Codex review (P2) on PR #1422: the anchor-content guard significantly narrows the corruption window for session-chain replay, but doesn't eliminate it. A coincidental insert+delete pair earlier in the chain can leave a stale-anchored edit landing on a duplicated row even with both line-count and anchor-content guards satisfied — line counts still match, the line at the shifted index happens to carry identical text, but the logical row the model anchored against is gone.
Reinstate RECOVERY_SESSION_REPLAY_WARNING and emit it from the replay success path. The dedicated warning is the only cue that replay is the less-certain recovery mode and the diff warrants verification. The chain warning stays for the snapshot 3-way merge path where context lines provide stronger evidence. Comment near replaySessionChainOnCurrent updated to spell out the residual uncertainty.
Test in packages/hashline/test/recovery-session-chain.test.ts now asserts the replay warning on the safe-replay positive case (was asserting RECOVERY_SESSION_CHAIN_WARNING).
Also: cargo fmt on crates/pi-ast/src/summary.rs and crates/pi-natives/src/summary.rs — pre-existing rustfmt drift on upstream/main was breaking 'check:rs' on Linux CI for every PR (commit 3b37ffe22 'chore: reformat' was incomplete). Local rustfmt 1.9.0-nightly produces the exact diff CI demanded; running it across the workspace closes the gap. No behavior change in those crates.
The recovery fallback that replays edits onto current text when the structured-patch 3-way merge refuses guarded only on line-count equality. If a prior in-session edit rewrote the very line a later stale-hash edit re-targets, replay overwrote the new content with the stale-anchored payload and emitted a 'Verify the diff matches your intent' warning that does not block the write.
Concrete window: v0 line 5 = 'L5', v1 = 'L5-CHANGED' (same line count). Edit E2 authored against H0 anchored at line 5 lands on v1 because the line-count gate passes, silently replacing L5-CHANGED with the model's L5-MODEL.
Add a verifyAnchorContent gate: walk every edit's anchors and require previousText[line] === currentText[line]. Any mismatch returns null so the caller raises MismatchError and the model re-reads. The success path now emits the standard RECOVERY_SESSION_CHAIN_WARNING (the hedged REPLAY_WARNING text was only sensible when content was partially aligned; that case is now unreachable, and the constant is removed).
Tests: packages/hashline/test/recovery-session-chain.test.ts pins both the corruption refusal and the safe-replay positive case (anchor on an unchanged line, 3-way merge fails on neighbouring rewritten context, replay succeeds with the standard chain warning). packages/coding-agent/test/core/hashline.test.ts adds an end-to-end through executeHashlineSingle so the production patcher path is covered too.
- Replaced `LINE↑`/`LINE↓`/`A-B:` op sigils with unified `A-B:` anchor + `|`/`↑`/`↓` payload sigils.
- Added `mode: "replacement"` tag to insert edits so the applier distinguishes replace-bucket from insert-bucket lines.
- Removed lenient fallbacks (implicit continuation, inline payload acceptance, escaped delimiter stripping).
- Updated grammar, prompt, tokenizer, parser, applier, and messages to match the new format.
- Removed `path` field from hashline input parameters and function signatures across diff, execute, and params modules.
- Updated HashlinePatch.parse() calls to omit the path option, relying on the ¶PATH#HASH header in input instead.
- Removed unused warning tracking for escaped payload delimiters in hashline parser.
- Added detection and stripping of extra backslashes before indented payload rows, which models often emit when JSON-escaping the delimiter.
- Added `_input` field alias support in hashlineEditParamsSchema to accept provider-emitted variants.
- Added warning message for escaped payload delimiter acceptance to guide users toward canonical syntax.
- Modified scanInlineBody to strip the payload prefix when present at the start of inline content.
- Added test cases covering backslash-delimited payloads in insert, delete, and replace operations.
- Added `parsePatchStreaming` and `Executor.endStreaming` to handle in-flight ops gracefully during incremental parsing, dropping pending ops with no payload to avoid phantom edits.
- Introduced `PatchSection.applyPartialTo` as a streaming-aware counterpart to `applyTo`, using the new streaming parser for diff preview generation.
- Removed the custom `buildHashlineNaturalOrderPreviews` function and replaced it with calls to `applyPartialTo`, centralizing streaming logic in the parser layer.
- Changed output format to group results under `# /` headers to reduce token usage for shared path prefixes.
- Clamped the `limit` parameter to 1-200 (default 200) instead of the previous 1000.
- Updated tests to assert against raw file lists instead of parsed text output.
- Deleted the detectReplaceOnBlankTarget function and its invocation in applyEdits. Updated documentation to reflect that the applier now normalizes common model boundary mistakes rather than rejecting blank-line replacements.
- Updated the payload continuation syntax to use backslash (`\`) instead of plus (`+`) as the explicit prefix for multi-line payloads and blank lines.
- Modified grammar, format constants, parser comments, and all documentation and test cases to reflect the new syntax.
- This is a breaking change for existing hashline patches using the `+` prefix.
- Removed the `!` delete sigil and all associated parsing, validation, and tokenization logic. The delete operation is no longer a supported edit kind.
- Updated grammar, format constants, and error messages to reference only insert and replace operations.
- Simplified the executor's overlap validation to handle only replace operations.
can1357