feat(agent_tool): revalidate file identity before remove deletes

[bobzhang]

PR 1 of 2 of the unified FileState work (design note reviewed by the Codex CLI, then this implementation per-commit reviewed). Closes the "path rebound to a different file" residual that earlier reviews flagged in remove.

Problem

remove's gate was Created provenance keyed by path — which proves only that the agent once created a file at a path, not that the file there now is still that file. A permitted operation can rebind the path: git checkout -- x.mbt restoring a tracked file the agent recreated, or a mv. remove would then delete the wrong file.

Fix — content revalidation

remove gates on created_and_unchanged, pairing the provenance with a content digest (hex SHA-256) of what the agent last wrote, and re-checks it by reading + hashing the file at delete time.

Why a content digest, not mtime (the plan review + the first per-commit review pushed on this): the file-writing tools already hold the content in memory, so the digest is computed synchronously — no stat, no cancellation window — and, being a content version, cannot collide the way coarse-resolution or mv-preserved mtimes can. A byte-identical different file passes, which is harmless. Only remove reads the file, at delete time. This is simpler than mtime here, not heavier.

• FileStateMap reshape (public enum kept, richer record private): FileState { Created | Modified } stays as the projection returned by get; a private Entry stores the digest — no public break.
• record_created/record_modified (wholesale write) take the new content's digest; record_edited (targeted edit) also takes the digest of the content the tool read and keeps Created only if that still matches what the agent last wrote — so an edit of a rebound file is downgraded and cannot launder a rebind into a deletable Created (the serious hole the first review found).
• Tool wiring: write records the content it wrote; edit records (seen=old, result=new); multi_edit records each file's provenance + final on-disk content after the auto-revert guard, keyed for continuity on the pre-batch content; remove reads + hashes at delete, distinguishing "never created" from "content changed since".

Verification

moon check --deny-warn --target native clean; moon test 199/199 in the touched set (new FileStateMap continuity unit tests, an edit rebound-downgrade test, a remove rebind-refusal test, README doc-tests); moon info mbti additive; moon fmt clean.

Next: PR 2 — read tracking + the unread-modify policy (block unread write / flag unread edit), superseding #241.

🤖 Generated with Claude Code