fix(editor): prevent concurrent str_replace_editor corruption

.grace/graph/main.xml

@@ -22,7 +22,7 @@
       <M-VVOC-PRESET-REGISTRY><Name>VvocPresetRegistry</Name><Type>UTILITY</Type><Status>implemented</Status><Purpose>Define canonical managed preset role and orchestration definitions for config seeding, sync refresh, and completion, shipped as vv-codex, vv-zai, vv-deepseek, vv-alibaba, vv-osovv-ds, vv-osovv-mimo, vv-osovv-zai, vv-osovv-qwen, vv-astra-solo, and vv-astra-workers with canonical provider/model#variant role values, with the former vv-osovv-sol/flash/kimi names retained only as preserved saved user presets.</Purpose><Paths>src/lib/vvoc-preset-registry.ts</Paths><Depends>M-ORCHESTRATION-PROFILES</Depends><Verification>V-M-VVOC-PRESET-REGISTRY</Verification></M-VVOC-PRESET-REGISTRY>
       <M-PLUGIN-GUARDIAN><Name>GuardianPlugin</Name><Type>INTEGRATION</Type><Status>implemented</Status><Purpose>Review native OpenCode 2.0.18 permission evaluations through ctx.permission.hook("evaluate") with a constrained, settings-bound Guardian auxiliary model whose policy denies both built-in and canonical web tools, or with an opt-in provider-neutral System One decision provider when guardian.decisionBackend selects it and the systemone section, toggle, and ${VAR} key resolve; systemone answers (a low-risk noul and a risk score) map onto the same bounded low-risk verdict, and any provider failure defers; mutating effect only to auto-approve a bounded low-risk verdict and otherwise leaving the user&#8217;s manual or denied decision intact; unbound or disabled families defer.</Purpose><Paths>src/plugins/guardian/index.ts, templates/agents/guardian.md</Paths><Depends>M-NATIVE-RUNTIME, M-CONFIG-LAYERS, M-CLI-CONFIG, M-MODEL-ROLES, M-SYSTEMONE-PROVIDER, M-PLUGIN-TOGGLE-CONFIG</Depends><Verification>V-M-PLUGIN-GUARDIAN</Verification></M-PLUGIN-GUARDIAN>
       <M-SYSTEMONE-PROVIDER><Name>SystemOneProvider</Name><Type>CORE_LOGIC</Type><Status>implemented</Status><Purpose>Provide a provider-neutral client for the de-facto System One decision protocol (POST /v1/systemone): shape state and typed noul, choice, and score questions, decode typed answers with probabilities and confidence while ignoring unknown fields, apply a bounded timeout and retry count, and raise credential-safe typed errors; any compliant endpoint is selected by baseUrl and model with no vendor-specific branch and no default endpoint.</Purpose><Paths>src/lib/systemone.ts</Paths><Depends>none</Depends><Verification>V-M-SYSTEMONE-PROVIDER</Verification></M-SYSTEMONE-PROVIDER>
-      <M-PLUGIN-HASHLINE-EDIT><Name>HashlineEditPlugin</Name><Type>INTEGRATION</Type><Status>implemented</Status><Purpose>Route per-model edit tooling by registering hashline_edit and dsh str_replace_editor as native OpenCode 2.0.18 tools; resolve the session edit mode from the family-settings-projected vvoc routing config (apply_patch | edit | str_replace_editor | hashline_edit); expose exactly one plugin edit tool per actual session model while never touching the host edit/apply_patch contracts; require a native resource permission before any write; transform native read results with true line/hash/context anchors and freshness tracking; apply valid payloads literally; honor an explicit host permission denial and restore plugin-owned versus captured host tool definitions by ownership; and report bounded post-edit diffs with apply warnings and editMode telemetry.</Purpose><Paths>src/plugins/hashline-edit/*.ts</Paths><Depends>M-NATIVE-RUNTIME, M-PLUGIN-TOGGLE-CONFIG, M-CONFIG-LAYERS, M-CLI-CONFIG, M-AGENT-TOOL-CONTRACT</Depends><Verification>V-M-PLUGIN-HASHLINE-EDIT</Verification></M-PLUGIN-HASHLINE-EDIT>
+      <M-PLUGIN-HASHLINE-EDIT><Name>HashlineEditPlugin</Name><Type>INTEGRATION</Type><Status>implemented</Status><Purpose>Route per-model edit tooling by registering hashline_edit and dsh str_replace_editor as native OpenCode 2.0.18 tools; resolve the session edit mode from the family-settings-projected vvoc routing config (apply_patch | edit | str_replace_editor | hashline_edit); expose exactly one plugin edit tool per actual session model while never touching the host edit/apply_patch contracts; require a native resource permission before any write; serialize native str_replace_editor read/check/write/cache cycles per canonical target across sessions in one process and publish byte-verified staged UTF-8 writes atomically; transform native read results with true line/hash/context anchors and freshness tracking; apply valid payloads literally; honor an explicit host permission denial and restore plugin-owned versus captured host tool definitions by ownership; and report bounded post-edit diffs with apply warnings and editMode telemetry.</Purpose><Paths>src/plugins/hashline-edit/*.ts</Paths><Depends>M-NATIVE-RUNTIME, M-PLUGIN-TOGGLE-CONFIG, M-CONFIG-LAYERS, M-CLI-CONFIG, M-AGENT-TOOL-CONTRACT</Depends><Verification>V-M-PLUGIN-HASHLINE-EDIT</Verification></M-PLUGIN-HASHLINE-EDIT>
        <M-PLUGIN-SYSTEM-CONTEXT-INJECTION><Name>SystemContextInjectionPlugin</Name><Type>INTEGRATION</Type><Status>implemented</Status><Purpose>Load the bundled canonical controller template locally at startup and deliver its seven sections exactly once through exact-text deduplication against host-supplied system parts. Other eligible primary agents receive shared project, repository-memory, evidence and working-cycle sections plus authority and delivery fragments without controller-only task, dispatch/recovery or full communication policy. Preserve native-registry subagent exclusions, the explore-specific exception, disabled/unknown no-op and user-owned system content. Resolve the active controller orchestration policy from session family settings and append it only to the last user message; workflow protocols and native skill discovery retain their existing owners.</Purpose><Paths>src/plugins/system-context-injection/index.ts, src/plugins/system-context-injection/guidance.ts</Paths><Depends>M-NATIVE-RUNTIME, M-CONFIG-LAYERS, M-ORCHESTRATION-PROFILES, M-CLI-MANAGED-AGENTS, M-PLUGIN-TOGGLE-CONFIG</Depends><Verification>V-M-PLUGIN-SYSTEM-CONTEXT-INJECTION</Verification></M-PLUGIN-SYSTEM-CONTEXT-INJECTION>
       <M-PLUGIN-SECRETS-REDACTION><Name>SecretsRedactionPlugin</Name><Type>INTEGRATION</Type><Status>implemented</Status><Purpose>Redact secrets including placeholder-resolved configured web apiKey values in native provider-bound request hooks (context/generate/compaction/title) under the family's resolved settings, then restore placeholders with copy-on-write semantics for frozen native tool inputs, SSE and non-SSE http.response bodies, and WebSocket frames — carrying placeholders split across SSE and WebSocket TEXT deltas with bounded carry while preserving opaque frames.</Purpose><Paths>src/plugins/secrets-redaction.ts, src/plugins/secrets-redaction/*.ts</Paths><Depends>M-NATIVE-RUNTIME, M-CONFIG-LAYERS, M-CLI-CONFIG, M-PLUGIN-TOGGLE-CONFIG, M-ENV-SUBSTITUTION</Depends><Verification>V-M-PLUGIN-SECRETS-REDACTION</Verification></M-PLUGIN-SECRETS-REDACTION>
       <M-SPEC-LINT><Name>SpecLint</Name><Type>CORE_LOGIC</Type><Status>implemented</Status><Purpose>Strictly lint .vvoc spec-package XML artifacts through a content-addressed cache under XDG_CACHE_HOME keyed on every input hash plus a lint version: validate well-formedness over the htmlparser2 xmlMode tokenizer event stream, enforce attribute-free template contracts per artifact kind, component/task/wave/checkpoint identity patterns and uniqueness, bare-slug and task references, lifecycle-aware severity where draft incompleteness never blocks, the plan-components-subset-of-spec-components cross-file rule, the optional execution section with inline/classic/delegated modes, review_checkpoints with reviewer sets, scope paths, wave barriers, final coverage of tasks and write scopes, per-task write_scope requirements, and package layout checks; extractDelegatedPlanDefinition returns the typed obligations runtime registration reuses; the shared declared-path normalization and delegated obligation vocabulary are re-exported from M-WORKFLOW-CONTRACT.</Purpose><Paths>src/lib/spec-lint.ts, src/lib/spec-lint/parser.ts, src/lib/spec-lint/spec-rules.ts, src/lib/spec-lint/plan-rules.ts, src/lib/spec-lint/cross-file-rules.ts, src/lib/spec-lint/delegated-extraction.ts, src/lib/spec-lint/lint.ts, src/lib/spec-lint-cache.ts</Paths><Depends>htmlparser2, M-CONFIG-LAYERS</Depends><Verification>V-M-SPEC-LINT</Verification></M-SPEC-LINT>
@@ -83,7 +83,7 @@
       <DF-ROLE-MANAGEMENT>role list/set/unset loads selected vvoc config, validates role IDs, normalizes assignments, writes role map, or renders inventory.</DF-ROLE-MANAGEMENT>
       <DF-ROLE-RESOLUTION>The shared native runtime resolves vv-role:* assignments from the family's session-owned settings record (root-session metadata, with the live effective vvoc role map plus the vvoc plugins modelIntent envelope as the birth-time and fallback source), applies concrete provider/model#variant selections at creation through agent definitions and a one-shot child reconciliation, never rewrites an existing session's model, and fails loudly for unknown roles instead of falling back.</DF-ROLE-RESOLUTION>
       <DF-PRESET-SWITCH>Preset command reads presets, validates selected name, normalizes role and orchestration assignments, applies declared fields atomically, and leaves OpenCode config untouched.</DF-PRESET-SWITCH>
-       <DF-HASHLINE-EDIT>Hashline plugin publishes closed edit input contracts, requests a native resource permission before any write, rewrites read output to line/hash anchors, rejects unknown, conflicting, or malformed fields before touching a file, validates current anchors on edit, applies batches, and rejects stale or malformed anchors while preserving literal empty-content deletion, null/empty-array deletion, boundary insertion, and `view_range` ending at `-1`.</DF-HASHLINE-EDIT>
+       <DF-HASHLINE-EDIT>Hashline plugin publishes closed edit input contracts, requests a native resource permission before any write, rewrites read output to line/hash anchors, rejects unknown, conflicting, or malformed fields before touching a file, validates current anchors on edit, applies hashline batches, and rejects stale or malformed anchors while preserving literal empty-content deletion, null/empty-array deletion, boundary insertion, and `view_range` ending at `-1`. Native str_replace_editor calls serialize complete read/check/write/cache cycles per canonical target in one process and publish byte-verified staged UTF-8 content atomically; individual calls remain independent rather than a batch transaction, with no exclusion guarantee against other tools or external processes.</DF-HASHLINE-EDIT>
       <DF-GUARDIAN-REVIEW>Guardian evaluates native permission requests through ctx.permission.hook("evaluate"), builds bounded review input from the actual action, resources, source and host history, runs the settings-bound Guardian auxiliary generation, interprets the verdict, and mutates the effect to allow only when policy declares low risk, otherwise leaving the user&#8217;s ask or deny decision intact.</DF-GUARDIAN-REVIEW>
       <DF-SYSTEM-CONTEXT>The bundled controller template supplies canonical wording to managed installation and startup-local guidance projection. Native agent identity selects complete controller sections or shared-primary fragments; exact-text deduplication preserves the supplied system parts. Session family settings select the controller policy delivered at the request tail, with the existing explore exception and other subagent exclusions.</DF-SYSTEM-CONTEXT>
       <DF-SECRETS-REDACTION>SecretsRedactionPlugin resolves the family's settings before provider dispatch, redacts provider-bound payloads in the native request hooks, restores placeholders after completions, restores them copy-on-write for frozen native tool input before execution, and restores SSE plus WebSocket frames while preserving opaque frames.</DF-SECRETS-REDACTION>