@anionex/dsh-turn-rewind 0.2.3 → 0.3.1

package/src/engine.ts

@@ -4,13 +4,7 @@ import { join, resolve } from 'node:path'
 import { lstat, realpath } from 'node:fs/promises'
 import { createDeadline } from './deadline.js'
 import { ChangeLedgerError, errorMessage } from './errors.js'
-import {
-  discoverRepository,
-  discoverRepositoryRoot,
-  ensureGitWorktreeIdentity,
-  resolveGitWorktreeRoot,
-  sameRepositoryFence,
-} from './git.js'
+import { ensureGitWorktreeIdentity, resolveGitWorktreeRoot } from './git.js'
 import {
   captureGitTurnCheckpoint,
   deleteGitCheckpoint,
@@ -34,6 +28,7 @@ import {
 } from './path-utils.js'
 import { captureSnapshotEntry, captureStableTree, diffTrees, entriesEqual } from './snapshot.js'
 import { LedgerStore, type GitCheckpointJournal } from './store.js'
+import { discoverWorkspace, discoverWorkspaceIdentity, sameWorkspaceFence } from './workspace.js'
 import {
   LEDGER_FORMAT_VERSION,
   type ChangeLedgerConfig,
@@ -50,6 +45,7 @@ import {
   type SnapshotEntry,
   type WorkspaceChange,
   type WorkspaceOverview,
+  type WorkspaceState,
   type WorkspacePurgeReport,
 } from './types.js'
 
@@ -109,12 +105,24 @@ export class ChangeLedgerEngine {
     return restoredOperations + await this.reconcileGitCheckpointJournals()
   }
 
-  private async acquireWorkspace(workspace: string, signal?: AbortSignal): Promise<() => Promise<void>> {
-    const identity = await ensureGitWorktreeIdentity(workspace, signal)
-    if (identity.root !== workspace) {
-      throw new ChangeLedgerError('GIT_ROOT_INVALID', `workspace moved while acquiring its lock: ${JSON.stringify(workspace)}`)
+  /**
+   * Acquire the exclusive lock for one workspace.
+   *
+   * A Git worktree also binds the shared per-worktree lock derived from its Git
+   * identity; an ordinary directory owns only the durable directory lock.
+   */
+  private async acquireWorkspace(
+    workspace: Pick<WorkspaceState, 'type' | 'root'>,
+    signal?: AbortSignal,
+  ): Promise<() => Promise<void>> {
+    if (workspace.type === 'directory') {
+      return this.store.acquire(workspace.root, undefined, undefined, signal)
+    }
+    const identity = await ensureGitWorktreeIdentity(workspace.root, signal)
+    if (identity.root !== workspace.root) {
+      throw new ChangeLedgerError('GIT_ROOT_INVALID', `workspace moved while acquiring its lock: ${JSON.stringify(workspace.root)}`)
     }
-    return this.store.acquire(workspace, identity.lockPath, {
+    return this.store.acquire(workspace.root, identity.lockPath, {
       commonDir: identity.commonDir,
       gitDir: identity.gitDir,
       worktreeId: identity.worktreeId,
@@ -126,7 +134,7 @@ export class ChangeLedgerEngine {
     for (const journal of await this.store.listGitCheckpointJournals()) {
       const workspace = await resolveGitWorktreeRoot(journal.commonDir, journal.worktreeId, journal.workspace)
       const activeJournal = workspace === journal.workspace ? journal : { ...journal, workspace }
-      const release = await this.acquireWorkspace(workspace)
+      const release = await this.acquireWorkspace({ type: 'git', root: workspace })
       try {
         const manifest = await this.tryReadManifest(workspace, journal.restorePointId)
         if (journal.action === 'publish') {
@@ -223,9 +231,9 @@ export class ChangeLedgerEngine {
     readonly signal?: AbortSignal
   }): Promise<RestorePointSummary> {
     await this.ready
-    const source = await discoverRepository(options.cwd, options.signal)
+    const source = await discoverWorkspace(options.cwd, this.config, options.signal)
     await this.assertStorageSeparated(source.state.root)
-    const release = await this.acquireWorkspace(source.state.root, options.signal)
+    const release = await this.acquireWorkspace(source.state, options.signal)
     try {
       const label = normalizeLabel(options.label)
       const manifest = await this.createLocked({
@@ -267,9 +275,9 @@ export class ChangeLedgerEngine {
         throw new ChangeLedgerError('INVALID_ARGUMENTS', 'turnStartSeq must be a non-negative safe integer')
       }
       try {
-        const source = await discoverRepository(options.cwd, signal)
+        const source = await discoverWorkspace(options.cwd, this.config, signal)
         await this.assertStorageSeparated(source.state.root)
-        const release = await this.acquireWorkspace(source.state.root, signal)
+        const release = await this.acquireWorkspace(source.state, signal)
         try {
           const existing = await waitWithSignal(this.store.listManifests(source.state.root, signal), signal)
           const duplicate = existing.find(manifest => manifest.kind === 'turn'
@@ -289,7 +297,9 @@ export class ChangeLedgerEngine {
 
           throwIfAborted(signal)
           let manifest: RestorePointManifest
-          if (this.config.turnCheckpointMode === 'legacy') {
+          // Git-native checkpoints live in the repository object database, so an
+          // ordinary directory always uses the ledger's own content-addressed store.
+          if (this.config.turnCheckpointMode === 'legacy' || source.state.type === 'directory') {
             manifest = await this.createLocked({
               cwd: source.state.root,
               kind: 'turn',
@@ -352,21 +362,21 @@ export class ChangeLedgerEngine {
     readonly signal?: AbortSignal
   }): Promise<void> {
     await waitWithSignal(this.ready, options.signal)
-    const workspace = await discoverRepositoryRoot(options.cwd, options.signal)
-    await this.assertStorageSeparated(workspace)
+    const workspace = await discoverWorkspaceIdentity(options.cwd, options.signal)
+    await this.assertStorageSeparated(workspace.root)
     const release = await this.acquireWorkspace(workspace, options.signal)
     try {
       throwIfAborted(options.signal)
-      const existing = (await this.store.listManifests(workspace, options.signal)).some(manifest =>
+      const existing = (await this.store.listManifests(workspace.root, options.signal)).some(manifest =>
         manifest.kind === 'turn'
         && manifest.sessionId === options.sessionId
         && manifest.turn === options.turn
         && manifest.turnStartSeq === options.turnStartSeq)
       if (existing) {
-        await this.store.deleteTurnCheckpointSkip(workspace, options.sessionId, options.turn, options.turnStartSeq)
+        await this.store.deleteTurnCheckpointSkip(workspace.root, options.sessionId, options.turn, options.turnStartSeq)
         return
       }
-      await this.store.writeTurnCheckpointSkip(workspace, {
+      await this.store.writeTurnCheckpointSkip(workspace.root, {
         version: 1,
         sessionId: options.sessionId,
         turn: options.turn,
@@ -388,12 +398,12 @@ export class ChangeLedgerEngine {
     readonly signal?: AbortSignal
   }): Promise<{ readonly reason: string } | undefined> {
     await this.ready
-    const workspace = await discoverRepositoryRoot(options.cwd, options.signal)
-    await this.assertStorageSeparated(workspace)
+    const workspace = await discoverWorkspaceIdentity(options.cwd, options.signal)
+    await this.assertStorageSeparated(workspace.root)
     const release = await this.acquireWorkspace(workspace, options.signal)
     try {
       const skip = await this.store.readTurnCheckpointSkip(
-        workspace,
+        workspace.root,
         options.sessionId,
         options.turn,
         options.turnStartSeq,
@@ -412,9 +422,9 @@ export class ChangeLedgerEngine {
     readonly signal?: AbortSignal
   }): Promise<RestorePointSummary | undefined> {
     await this.ready
-    const source = await discoverRepository(options.cwd, options.signal)
+    const source = await discoverWorkspace(options.cwd, this.config, options.signal)
     await this.assertStorageSeparated(source.state.root)
-    const release = await this.acquireWorkspace(source.state.root, options.signal)
+    const release = await this.acquireWorkspace(source.state, options.signal)
     try {
       const manifest = (await this.store.listManifests(source.state.root)).find(point =>
         point.kind === 'turn'
@@ -436,9 +446,9 @@ export class ChangeLedgerEngine {
     readonly signal?: AbortSignal
   }): Promise<RestorePointSummary[]> {
     await this.ready
-    const source = await discoverRepository(options.cwd, options.signal)
+    const source = await discoverWorkspace(options.cwd, this.config, options.signal)
     await this.assertStorageSeparated(source.state.root)
-    const release = await this.acquireWorkspace(source.state.root, options.signal)
+    const release = await this.acquireWorkspace(source.state, options.signal)
     try {
       const manifests = await this.store.listManifests(source.state.root)
       return manifests
@@ -458,9 +468,9 @@ export class ChangeLedgerEngine {
     readonly signal?: AbortSignal
   }): Promise<RestorePointInspection> {
     await this.ready
-    const source = await discoverRepository(options.cwd, options.signal)
+    const source = await discoverWorkspace(options.cwd, this.config, options.signal)
     await this.assertStorageSeparated(source.state.root)
-    const release = await this.acquireWorkspace(source.state.root, options.signal)
+    const release = await this.acquireWorkspace(source.state, options.signal)
     try {
       const manifest = await this.store.readManifest(source.state.root, options.restorePointId)
       if (manifest.version === 2) await verifyGitCheckpoint(manifest, options.signal)
@@ -472,15 +482,17 @@ export class ChangeLedgerEngine {
       })
       const currentEntries = manifest.version === 2 ? current.gitEntries : current.entries
       if (currentEntries === undefined) throw new ChangeLedgerError('STATE_CORRUPT', 'Git comparison entries are unavailable')
+      const currentState = current.source.state
+      assertWorkspaceIdentityCompatible(manifest.repository, currentState)
       return {
         restorePoint: summarize(manifest),
         currentTreeHash: current.treeHash,
-        currentRepository: current.source.state,
-        ...(current.source.state.head === undefined ? {} : { currentHead: current.source.state.head }),
-        ...(current.source.state.branch === undefined ? {} : { currentBranch: current.source.state.branch }),
-        ...(current.source.state.operation === undefined ? {} : { currentOperation: current.source.state.operation }),
-        headChanged: repositoryHeadChanged(manifest.repository, current.source.state),
-        operationChanged: manifest.repository.operation !== current.source.state.operation,
+        currentRepository: currentState,
+        ...(currentState.type === 'git' && currentState.head !== undefined ? { currentHead: currentState.head } : {}),
+        ...(currentState.type === 'git' && currentState.branch !== undefined ? { currentBranch: currentState.branch } : {}),
+        ...(currentState.type === 'git' && currentState.operation !== undefined ? { currentOperation: currentState.operation } : {}),
+        headChanged: repositoryHeadChanged(manifest.repository, currentState),
+        operationChanged: workspaceOperationChanged(manifest.repository, currentState),
         changes: diffTrees(manifest.entries, current.entries, manifest.entries, currentEntries),
       }
     } finally {
@@ -501,9 +513,9 @@ export class ChangeLedgerEngine {
   }): Promise<RestorePlan> {
     await this.ready
     this.expirePlans()
-    const source = await discoverRepository(options.cwd, options.signal)
+    const source = await discoverWorkspace(options.cwd, this.config, options.signal)
     await this.assertStorageSeparated(source.state.root)
-    const release = await this.acquireWorkspace(source.state.root, options.signal)
+    const release = await this.acquireWorkspace(source.state, options.signal)
     try {
       const manifest = await this.store.readManifest(source.state.root, options.restorePointId)
       if (manifest.version === 2) await verifyGitCheckpoint(manifest, options.signal)
@@ -518,8 +530,8 @@ export class ChangeLedgerEngine {
       if (options.expectedCurrentTreeHash !== undefined && options.expectedCurrentTreeHash !== current.treeHash) {
         throw new ChangeLedgerError('PLAN_STALE', 'workspace changed after inspection; inspect and plan again')
       }
-      if (options.expectedRepository !== undefined && !sameRepositoryFence(options.expectedRepository, current.source.state)) {
-        throw new ChangeLedgerError('PLAN_STALE_REPOSITORY', 'Git repository state changed after inspection; inspect and plan again')
+      if (options.expectedRepository !== undefined && !sameWorkspaceFence(options.expectedRepository, current.source.state)) {
+        throw workspaceStaleError(options.expectedRepository, current.source.state, 'inspection')
       }
       assertRepositoryCompatible(manifest, current.source.state, options.allowHeadChange === true)
       const changes = diffTrees(manifest.entries, current.entries, manifest.entries, currentEntries)
@@ -581,7 +593,7 @@ export class ChangeLedgerEngine {
 
     try {
       await this.assertStorageSeparated(plan.workspace)
-      const release = await this.acquireWorkspace(plan.workspace, options.signal)
+      const release = await this.acquireWorkspace(plan.repository, options.signal)
       try {
         const manifest = await this.store.readManifest(plan.workspace, plan.restorePointId)
         if (manifest.version === 2) await verifyGitCheckpoint(manifest, options.signal)
@@ -721,9 +733,9 @@ export class ChangeLedgerEngine {
     if (options.confirmation !== `DELETE ${options.restorePointId}`) {
       throw new ChangeLedgerError('CONFIRMATION_MISMATCH', `confirmation must exactly equal "DELETE ${options.restorePointId}"`)
     }
-    const source = await discoverRepository(options.cwd, options.signal)
+    const source = await discoverWorkspace(options.cwd, this.config, options.signal)
     await this.assertStorageSeparated(source.state.root)
-    const release = await this.acquireWorkspace(source.state.root, options.signal)
+    const release = await this.acquireWorkspace(source.state, options.signal)
     try {
       const manifest = await this.store.readManifest(source.state.root, options.restorePointId)
       if (await this.store.isReferencedByRecovery(source.state.root, options.restorePointId)) {
@@ -740,9 +752,9 @@ export class ChangeLedgerEngine {
   /** List restore operations that were interrupted or require manual recovery. */
   async listRecovery(options: { readonly cwd: string; readonly signal?: AbortSignal }): Promise<RecoverySummary[]> {
     await this.ready
-    const source = await discoverRepository(options.cwd, options.signal)
+    const source = await discoverWorkspace(options.cwd, this.config, options.signal)
     await this.assertStorageSeparated(source.state.root)
-    const release = await this.acquireWorkspace(source.state.root, options.signal)
+    const release = await this.acquireWorkspace(source.state, options.signal)
     try {
       return (await this.store.listOperations(source.state.root))
         .filter((operation): operation is RestoreOperation & { state: 'interrupted' | 'recovery-required' } =>
@@ -842,10 +854,10 @@ export class ChangeLedgerEngine {
     let liveRepository = false
     let release: () => Promise<void>
     try {
-      const root = await discoverRepositoryRoot(workspace, signal)
-      if (root === workspace) {
-        await this.assertStorageSeparated(root)
-        release = await this.acquireWorkspace(root, signal)
+      const identity = await discoverWorkspaceIdentity(workspace, signal)
+      if (identity.root === workspace) {
+        await this.assertStorageSeparated(identity.root)
+        release = await this.acquireWorkspace(identity, signal)
         liveRepository = true
       } else {
         release = await this.store.acquireWorkspaceDir(workspaceDir, workspace, signal)
@@ -1129,11 +1141,13 @@ export function resolveConfig(config: ChangeLedgerConfig): ResolvedChangeLedgerC
 }
 
 function summarize(manifest: RestorePointManifest): RestorePointSummary {
+  const workspace = manifest.repository
   return {
     format: manifest.version,
     id: manifest.id,
     kind: manifest.kind,
     workspace: manifest.workspace,
+    workspaceType: workspace.type,
     ...(manifest.sessionId === undefined ? {} : { sessionId: manifest.sessionId }),
     ...(manifest.label === undefined ? {} : { label: manifest.label }),
     ...(manifest.parentRestorePoint === undefined ? {} : { parentRestorePoint: manifest.parentRestorePoint }),
@@ -1146,22 +1160,34 @@ function summarize(manifest: RestorePointManifest): RestorePointSummary {
     totalBytes: manifest.totalBytes,
     restoreCount: manifest.restoreCount,
     ...(manifest.lastRestoredAt === undefined ? {} : { lastRestoredAt: manifest.lastRestoredAt }),
-    ...(manifest.repository.head === undefined ? {} : { head: manifest.repository.head }),
-    ...(manifest.repository.branch === undefined ? {} : { branch: manifest.repository.branch }),
-    ...(manifest.repository.operation === undefined ? {} : { operation: manifest.repository.operation }),
-    stagedPathCount: manifest.repository.stagedPaths.length,
+    ...(workspace.type === 'git' && workspace.head !== undefined ? { head: workspace.head } : {}),
+    ...(workspace.type === 'git' && workspace.branch !== undefined ? { branch: workspace.branch } : {}),
+    ...(workspace.type === 'git' && workspace.operation !== undefined ? { operation: workspace.operation } : {}),
+    stagedPathCount: workspace.type === 'git' ? workspace.stagedPaths.length : 0,
     ...(manifest.version === 2 ? { trust: manifest.git.trust } : {}),
   }
 }
 
+/** Reject a fence that now describes a different workspace or workspace mode. */
+function assertWorkspaceIdentityCompatible(before: WorkspaceState, after: WorkspaceState): void {
+  if (before.type !== after.type) {
+    throw new ChangeLedgerError('WORKSPACE_MODE_CHANGED', `workspace mode changed from ${before.type} to ${after.type}`)
+  }
+  if (before.root !== after.root) {
+    throw new ChangeLedgerError('WORKSPACE_CHANGED', 'restore point no longer belongs to this workspace root')
+  }
+  if (before.type === 'git' && after.type === 'git' && before.commonDir !== after.commonDir) {
+    throw new ChangeLedgerError('REPOSITORY_CHANGED', 'restore point no longer belongs to this Git worktree')
+  }
+}
+
 function assertRepositoryCompatible(
   manifest: RestorePointManifest,
   current: RestorePointManifest['repository'],
   allowHeadChange: boolean,
 ): void {
-  if (manifest.repository.root !== current.root || manifest.repository.commonDir !== current.commonDir) {
-    throw new ChangeLedgerError('REPOSITORY_CHANGED', 'restore point no longer belongs to this Git worktree')
-  }
+  assertWorkspaceIdentityCompatible(manifest.repository, current)
+  if (manifest.repository.type !== 'git' || current.type !== 'git') return
   if (manifest.repository.operation !== current.operation) {
     throw new ChangeLedgerError(
       'GIT_OPERATION_CHANGED',
@@ -1177,23 +1203,33 @@ function assertRepositoryCompatible(
 }
 
 function repositoryHeadChanged(
-  before: RestorePointManifest['repository'],
-  after: RestorePointManifest['repository'],
+  before: WorkspaceState,
+  after: WorkspaceState,
 ): boolean {
+  if (before.type !== 'git' || after.type !== 'git') return false
   return before.head !== after.head || before.branch !== after.branch
 }
 
+function workspaceOperationChanged(before: WorkspaceState, after: WorkspaceState): boolean {
+  if (before.type !== 'git' || after.type !== 'git') return false
+  return before.operation !== after.operation
+}
+
 function assertPlanRepositoryFresh(
-  planned: RestorePointManifest['repository'],
-  current: RestorePointManifest['repository'],
+  planned: WorkspaceState,
+  current: WorkspaceState,
 ): void {
-  if (planned.root !== current.root
-    || planned.commonDir !== current.commonDir
-    || planned.head !== current.head
-    || planned.branch !== current.branch
-    || planned.operation !== current.operation) {
-    throw new ChangeLedgerError('PLAN_STALE_REPOSITORY', 'Git repository state changed after restore planning; inspect and plan again')
+  if (!sameWorkspaceFence(planned, current)) {
+    throw workspaceStaleError(planned, current, 'restore planning')
+  }
+}
+
+/** Stable stale-plan error for the workspace mode that actually drifted. */
+function workspaceStaleError(before: WorkspaceState, after: WorkspaceState, phase: string): ChangeLedgerError {
+  if (before.type === 'git' && after.type === 'git') {
+    return new ChangeLedgerError('PLAN_STALE_REPOSITORY', `Git repository state changed after ${phase}; inspect and plan again`)
   }
+  return new ChangeLedgerError('PLAN_STALE_WORKSPACE', `workspace state changed after ${phase}; inspect and plan again`)
 }
 
 function assertJournalMatchesManifest(journal: GitCheckpointJournal, manifest: RestorePointManifest): asserts manifest is RestorePointManifestV2 {

package/src/git.ts

@@ -4,13 +4,13 @@ import { link, lstat, mkdir, open, readFile, realpath, unlink } from 'node:fs/pr
 import { dirname, isAbsolute, join, resolve } from 'node:path'
 import { ChangeLedgerError, errorMessage } from './errors.js'
 import { canonicalDirectory, isNodeError, syncDirectory, validateRelativePath } from './path-utils.js'
-import type { RepositoryState } from './types.js'
+import type { GitWorkspaceState } from './types.js'
 
 const GIT_MAX_BUFFER = 32 * 1024 * 1024
 
 /** Repository discovery result plus the eligible path inventory. */
 export interface RepositorySnapshotSource {
-  readonly state: RepositoryState
+  readonly state: GitWorkspaceState
   readonly paths: readonly string[]
 }
 
@@ -63,6 +63,7 @@ export async function discoverRepository(cwd: string, signal?: AbortSignal): Pro
 
   return {
     state: {
+      type: 'git',
       root,
       commonDir,
       ...(head === undefined ? {} : { head }),
@@ -74,6 +75,46 @@ export async function discoverRepository(cwd: string, signal?: AbortSignal): Pro
   }
 }
 
+/**
+ * Discover the owning Git worktree, or return undefined when `cwd` is not
+ * inside any repository. Every other discovery failure still throws, so a
+ * broken repository never silently degrades into an ordinary directory.
+ * @param cwd - candidate working directory.
+ * @param signal - optional caller cancellation.
+ * @returns the snapshot source, or undefined outside every repository.
+ */
+export async function discoverRepositoryOptional(cwd: string, signal?: AbortSignal): Promise<RepositorySnapshotSource | undefined> {
+  try {
+    return await discoverRepository(cwd, signal)
+  } catch (error) {
+    if (isNotRepositoryError(error)) return undefined
+    throw error
+  }
+}
+
+/** Resolve the Git worktree root, or undefined when `cwd` is outside every repository. */
+export async function discoverRepositoryRootOptional(cwd: string, signal?: AbortSignal): Promise<string | undefined> {
+  try {
+    return await discoverRepositoryRoot(cwd, signal)
+  } catch (error) {
+    if (isNotRepositoryError(error)) return undefined
+    throw error
+  }
+}
+
+/**
+ * Whether one discovery failure is Git's plain "not a git repository" verdict.
+ *
+ * `gitEnvironment` pins the C locale, so the message text is stable and this
+ * three-way check (code, exit status, message) cannot swallow a real failure.
+ */
+function isNotRepositoryError(error: unknown): boolean {
+  return error instanceof ChangeLedgerError
+    && error.code === 'GIT_COMMAND_FAILED'
+    && gitExitCode(error.cause) === 128
+    && error.message.includes('not a git repository')
+}
+
 /** Resolve the canonical Git worktree root owning `cwd` without inventorying its files. */
 export async function discoverRepositoryRoot(cwd: string, signal?: AbortSignal): Promise<string> {
   const canonicalCwd = await canonicalDirectory(cwd)
@@ -131,7 +172,7 @@ export async function resolveGitWorktreeRoot(
 }
 
 /** Return true when two repository fences refer to the same checkout state. */
-export function sameRepositoryFence(left: RepositoryState, right: RepositoryState): boolean {
+export function sameRepositoryFence(left: GitWorkspaceState, right: GitWorkspaceState): boolean {
   return left.root === right.root
     && left.commonDir === right.commonDir
     && left.head === right.head
@@ -302,6 +343,10 @@ function gitEnvironment(extra: NodeJS.ProcessEnv | undefined): NodeJS.ProcessEnv
     ...extra,
     GIT_OPTIONAL_LOCKS: '0',
     GIT_TERMINAL_PROMPT: '0',
+    // Git's diagnostics are matched for the "not a git repository" verdict that
+    // selects ordinary-directory mode; pin the C locale so that stays stable.
+    LC_ALL: 'C',
+    LANG: 'C',
   }
 }
 
@@ -495,6 +540,6 @@ async function publishIdentityFile(path: string, value: string, repairMalformed:
 }
 
 /** Return the Git metadata directory for diagnostics. */
-export function gitMetadataParent(state: RepositoryState): string {
+export function gitMetadataParent(state: GitWorkspaceState): string {
   return dirname(state.commonDir)
 }

package/src/rewind-host.ts

@@ -3,7 +3,7 @@ import type { Context } from '@deepseek-ai/cordis'
 import { createDeadline } from './deadline.js'
 import { ChangeLedgerError, errorMessage } from './errors.js'
 import type { ChangeLedgerEngine } from './engine.js'
-import { discoverRepositoryRoot } from './git.js'
+import { discoverWorkspaceRoot } from './workspace.js'
 
 interface SessionEventLike {
   readonly type: string
@@ -14,12 +14,23 @@ interface SessionEventLike {
 interface SessionHeaderLike {
   readonly cwd?: string
   readonly parentSession?: string
+  /**
+   * Fork-inherited prefix length on DSH releases before 0.1.5. 0.1.5 deleted the
+   * field — a stored header that still carries it is rejected outright — and moved
+   * the same quantity to {@link SessionLike.inheritedEventCount}.
+   */
   readonly seedLength?: number
 }
 
 interface SessionLike {
   readonly id: string
   readonly header: SessionHeaderLike
+  /**
+   * Exact number of leading events inherited from the fork parent, as reported by
+   * DSH 0.1.5+ on the live session and on the stored session-log snapshot. `0` —
+   * never `undefined` — for a session with no inherited prefix.
+   */
+  readonly inheritedEventCount?: number
   readonly events?: readonly SessionEventLike[]
   snapshotEvents?(fromSeq?: number, toSeqExclusive?: number): readonly SessionEventLike[]
 }
@@ -45,7 +56,11 @@ interface SessionsLike {
 }
 
 interface SessionQueryLike {
-  readSession(id: string): Promise<{ readonly session: SessionHeaderLike; readonly events: readonly SessionEventLike[] }>
+  readSession(id: string): Promise<{
+    readonly session: SessionHeaderLike
+    readonly events: readonly SessionEventLike[]
+    readonly inheritedEventCount?: number
+  }>
 }
 
 interface HttpRequestLike {
@@ -223,7 +238,7 @@ export class TurnCheckpointCoordinator {
       this.skips.delete(key)
       const capture = (async () => {
         try {
-          const workspace = await discoverRepositoryRoot(cwd, captureSignal)
+          const workspace = await discoverWorkspaceRoot(cwd, captureSignal)
           await this.serializeWorkspace(workspace, captureSignal, async () => {
             try {
               await this.engine.createTurnCheckpoint({
@@ -531,7 +546,29 @@ async function readSession(
   const live = ctx.sessions.get(sessionId)
   if (live !== undefined) return live
   const stored = await ctx.sessionQuery.readSession(sessionId)
-  return { id: sessionId, header: stored.session, events: stored.events }
+  return {
+    id: sessionId,
+    header: stored.session,
+    events: stored.events,
+    ...(stored.inheritedEventCount === undefined ? {} : { inheritedEventCount: stored.inheritedEventCount }),
+  }
+}
+
+/**
+ * Fork-inherited prefix length reported by the host, or `undefined` when the host
+ * exposes no such datum.
+ *
+ * DSH releases before 0.1.5 carried it as `header.seedLength`; 0.1.5 deleted that
+ * field (a stored header still carrying it is rejected) and publishes the same
+ * quantity as `inheritedEventCount` on the live session and on its stored snapshot.
+ * @param session - live or stored session to read the lineage boundary from.
+ * @returns the inherited prefix length in events.
+ */
+function lineageBoundary(session: SessionLike): number | undefined {
+  const legacy = session.header.seedLength
+  if (typeof legacy === 'number') return legacy
+  const current = session.inheritedEventCount
+  return typeof current === 'number' ? current : undefined
 }
 
 interface MessageTarget {
@@ -565,12 +602,16 @@ async function resolveMessageCheckpoint(
   const seen = new Set<string>([sessionId])
   while (true) {
     const parentId = current.header.parentSession
-    const seedLength = current.header.seedLength
-    if ((parentId === undefined) !== (seedLength === undefined)) {
+    // A session is lineage-bound exactly when it declares a parent, and only then is
+    // the inherited-prefix length meaningful. 0.1.5 reports `0` — not `undefined` —
+    // for a session with no inherited prefix, so the datum must never be consulted
+    // for a root session or this guard inverts and rejects every unforked session.
+    const boundary = parentId === undefined ? undefined : lineageBoundary(current)
+    if ((parentId === undefined) !== (boundary === undefined)) {
       throw new ChangeLedgerError('PLAN_STALE', 'session fork lineage has incomplete parent metadata')
     }
-    if (parentId === undefined || seedLength === undefined
-      || target.messageSeq >= seedLength || target.turnStartSeq >= seedLength) {
+    if (parentId === undefined || boundary === undefined
+      || target.messageSeq >= boundary || target.turnStartSeq >= boundary) {
       return { target }
     }
     if (seen.has(parentId)) {
@@ -733,16 +774,16 @@ async function sharedWorkspaceSessions(
 ): Promise<readonly string[]> {
   const listed = agents?.list() ?? []
   if (listed.length === 0) return []
-  const root = await discoverRepositoryRoot(cwd)
+  const root = await discoverWorkspaceRoot(cwd)
   const shared: string[] = []
   for (const agent of listed) {
     if (agent.status !== 'running') continue
     const session = agent.session
     if (session.header.cwd === undefined) continue
     try {
-      if (await discoverRepositoryRoot(session.header.cwd) === root) shared.push(session.id)
+      if (await discoverWorkspaceRoot(session.header.cwd) === root) shared.push(session.id)
     } catch {
-      // A live Session whose cwd is not a valid Git worktree cannot share this worktree.
+      // A live Session whose cwd cannot be resolved cannot share this workspace.
     }
   }
   return shared.sort()