@orion-agents/orion-code 0.3.24 → 0.3.26

package/CHANGELOG.md

@@ -22,11 +22,67 @@ which is **not** a pass.
 
 ## [Unreleased]
 
-## [0.3.24]
+## [0.3.26] — UNRELEASED
 
-> **Status: candidate.** Implementation on `codex/v0.3.24`, based on `main@6ed47fd`.
-> Plan: `docs/plan/v0.3.24-plan.md`. Registry and release status must be
-> verified from their own immutable receipts, not inferred from this changelog.
+> **Status: candidate.** Open. Structured-diff integrity and Session lifecycle: body
+> rows that look like file headers stay body rows (#274), a hunk split across
+> pagination keeps its rows, line numbers and identity (#275), permanent Session
+> deletion removes the v2 Thread records (#276), and exiting a cutover Session no
+> longer rewrites its summary from the frozen legacy JSONL (#277). Plan:
+> `docs/plan/v0.3.26-plan.md`. Not merged, tagged or published.
+
+### Fixed
+
+- #274: a deletion row whose text starts with `-- ` (`--- old comment`) is no longer
+  mistaken for the old-file header; the hunk stays open and the remaining body is
+  no longer demoted to document metadata.
+- #275: the structured diff continuation contract carries the split hunk's state
+  (header, index, running line cursors) in the cursor, so every page of a large
+  hunk keeps its rows with correct line numbers and the stable hunk identity, and
+  the last page reports the true completeness.
+- #276: permanently deleting a cutover Session removes its v2 records — cutover
+  index entry, event log, head, projection, compact state and checkpoints,
+  session-index manifest, transcript pages and import receipt — under the same
+  file-lock and atomic-write discipline as the cutover itself.
+- #277: `/exit` (and the shutdown path) no longer rewrites a cutover Session's
+  `messageCount`/`historySizeBytes` from the frozen legacy JSONL; the summary comes
+  from the authoritative v2 Thread.
+
+## [0.3.25] — 2026-10-13
+
+> **Status: published.** Released as `@orion-agents/orion-code@0.3.25` from
+> `refs/tags/v0.3.25`, and merged to `main` as `c356323` (#273). Four open-issue fixes
+> for the Git conflict view (#269), file-history revisions (#270), the model-switch
+> compact preflight (#271) and the stable project navigation order (#272). Plan:
+> `docs/plan/v0.3.25-plan.md`. GitHub Release:
+> https://github.com/orion-agents/orion-code/releases/tag/v0.3.25
+
+### Fixed
+
+- #269: `GET /git/conflict` no longer fails with `git cat-file: could not get object
+  info` after editing a conflicted file before staging — the `worktree` version is read
+  from the filesystem (contained within the repository root) instead of an object
+  `hash-object` never wrote.
+- #270: `GET /git/file-history` with a `rev` now walks that revision; previously the
+  validated revision never reached the `git log` command and every query walked HEAD.
+- #271: switching to a model with the same or larger raw context window but a smaller
+  effective input budget (larger output reserve) now reports `compactRequired` and runs
+  the compact preflight instead of silently persisting a model the history cannot fit.
+
+### Changed
+
+- #272: the left project navigation keeps a stable registration order for unpinned
+  projects (`registeredAt`, persisted by the workspace registry and exposed additively
+  on `WebWorkspaceSummaryV1`); activating sessions no longer reshuffles the tree.
+  Pinned projects keep `pinnedOrder` first.
+
+## [0.3.24] — 2026-10-13
+
+> **Status: published.** Released as `@orion-agents/orion-code@0.3.24` from
+> `refs/tags/v0.3.24`, and merged to `main` as `85fadb4` (#268). Session
+> navigation & responsiveness for the Web Workbench. Plan:
+> `docs/plan/v0.3.24-plan.md`. GitHub Release:
+> https://github.com/orion-agents/orion-code/releases/tag/v0.3.24
 
 ### Fixed
 

package/README.md

@@ -2,9 +2,12 @@
 
 Local-first, goal-driven coding agent for the terminal and browser.
 
-> v0.3.24 development focus — Web session responsiveness: Session-scoped request admission,
-> cached foreground switching, retained live views, and bounded Git probes during creation.
-> Built on the merged v0.3.23 source (`6ed47fd`, #266).
+> v0.3.26 candidate — open. Structured-diff integrity and Session lifecycle: header-lookalike
+> body rows stay body rows (#274), hunks split across pagination keep their rows and line
+> numbers (#275), permanent Session deletion removes the v2 Thread records (#276), and
+> exiting a cutover Session no longer regresses its summary from the legacy JSONL (#277).
+> The previous release 0.3.25 is on npm (registry `latest`), tagged `v0.3.25` (`c356323`,
+> #273) and released on GitHub.
 
 [中文说明](README.zh-CN.md) ·
 [v0.3.24 plan](docs/plan/v0.3.24-plan.md) ·
@@ -167,10 +170,10 @@ user extension boundaries.
 Node.js 22.12+, 24, and 26 are supported. Use Node 24 LTS for production or Node 26 Current for
 current development environments. Node 20 is upstream EOL and is no longer a v0.3 runtime.
 
-To install the pinned v0.3.24 package when it is available on npm:
+To install the pinned v0.3.26 package when it is available on npm:
 
 ```bash
-npm install -g @orion-agents/orion-code@0.3.24
+npm install -g @orion-agents/orion-code@0.3.26
 orion --version
 orion doctor
 ```

package/README.zh-CN.md

@@ -2,8 +2,10 @@
 
 面向终端与浏览器、本地优先的目标驱动 Coding Agent。
 
-> v0.3.24 开发重点：Web 会话响应性。发送按会话等待、有效缓存即时切换、保留实时显示内容，
-> 新建使用有界 Git 探测。基于已合并的 v0.3.23 源码（`6ed47fd`，#266）。
+> v0.3.26 候选版本：进行中。结构化 diff 完整性与会话生命周期：形似文件头的 body 行保持为
+> body 行（#274）、跨页拆分的 hunk 保留行与行号（#275）、永久删除会话同时清除 v2 Thread
+> 记录（#276）、退出已切换会话不再从旧 JSONL 回退 summary（#277）。上一版 0.3.25 已发布
+> npm（registry `latest`）、打 tag `v0.3.25`（`c356323`，#273）并发布 GitHub Release。
 
 [English](README.md) ·
 [v0.3.24 方案](docs/plan/v0.3.24-plan.md) ·
@@ -98,10 +100,10 @@ MCP 仍是用户可见的扩展边界。
 支持 Node.js 22.12+、24 和 26。生产环境建议使用 Node 24 LTS，当前开发环境也支持 Node 26
 Current。Node 20 已结束上游维护，不再属于 v0.3 Runtime 合同。
 
-v0.3.24 在 npm 可用后，可安装固定版本：
+v0.3.26 在 npm 可用后，可安装固定版本：
 
 ```bash
-npm install -g @orion-agents/orion-code@0.3.24
+npm install -g @orion-agents/orion-code@0.3.26
 orion --version
 orion doctor
 ```

package/dist/runtime/legacy-thread-materializer.d.ts

@@ -102,4 +102,17 @@ export declare function openSessionCheckpointStorageV1(projectPathInput: string,
  */
 export declare function openSessionStorageV1(projectPathInput: string, sessionId: string): OpenedSessionStorageV1;
 export declare function loadThreadCutoverIndexV1(projectPath: string): ThreadCutoverIndexV1;
+/**
+ * v0.3.26 #276 — permanently removes one Session's durable v2 records: the
+ * cutover index entry plus every thread file the materializer and the event
+ * store publish (event log, projection, head, compact state and checkpoints,
+ * session-index manifest, transcript pages, import receipt). Returns the
+ * removed thread id, or null when the Session was never cut over.
+ *
+ * The index write takes the same file lock and atomic-write discipline as the
+ * cutover itself, with the generation bumped; an emptied index keeps its file
+ * with an empty session map so readers stay on the atomic authority instead of
+ * treating a missing file as "no v2 Sessions at all".
+ */
+export declare function deleteSessionThreadRecordsV1(projectPathInput: string, sessionId: string): string | null;
 //# sourceMappingURL=legacy-thread-materializer.d.ts.map

package/dist/runtime/legacy-thread-materializer.js

@@ -7,6 +7,7 @@ exports.resolveSessionStorageV1 = resolveSessionStorageV1;
 exports.openSessionCheckpointStorageV1 = openSessionCheckpointStorageV1;
 exports.openSessionStorageV1 = openSessionStorageV1;
 exports.loadThreadCutoverIndexV1 = loadThreadCutoverIndexV1;
+exports.deleteSessionThreadRecordsV1 = deleteSessionThreadRecordsV1;
 const fs_1 = require("fs");
 const path_1 = require("path");
 const atomic_write_1 = require("../services/atomic-write");
@@ -205,6 +206,77 @@ function openSessionStorageV1(projectPathInput, sessionId) {
 function loadThreadCutoverIndexV1(projectPath) {
     return readThreadCutoverIndex((0, paths_1.getProjectThreadsV2IndexPath)((0, path_1.resolve)(projectPath)));
 }
+/**
+ * v0.3.26 #276 — permanently removes one Session's durable v2 records: the
+ * cutover index entry plus every thread file the materializer and the event
+ * store publish (event log, projection, head, compact state and checkpoints,
+ * session-index manifest, transcript pages, import receipt). Returns the
+ * removed thread id, or null when the Session was never cut over.
+ *
+ * The index write takes the same file lock and atomic-write discipline as the
+ * cutover itself, with the generation bumped; an emptied index keeps its file
+ * with an empty session map so readers stay on the atomic authority instead of
+ * treating a missing file as "no v2 Sessions at all".
+ */
+function deleteSessionThreadRecordsV1(projectPathInput, sessionId) {
+    const projectPath = (0, path_1.resolve)(projectPathInput);
+    const indexPath = (0, paths_1.getProjectThreadsV2IndexPath)(projectPath);
+    // A project that never cut a Session over has no index and no threads-v2
+    // directory; taking the lock would create one on a pure legacy deletion.
+    if (!(0, fs_1.existsSync)(indexPath))
+        return null;
+    const threadsDir = (0, paths_1.getProjectThreadsV2Dir)(projectPath);
+    return (0, file_lock_1.withFileLockSync)(indexPath, () => {
+        const current = readThreadCutoverIndex(indexPath);
+        const entry = current.sessions[sessionId];
+        if (!entry)
+            return null;
+        const sessions = { ...current.sessions };
+        delete sessions[sessionId];
+        const content = { version: 1, generation: current.generation + 1, sessions };
+        const next = deepFreeze({ ...content, digest: (0, canonical_1.digestRuntimeValue)(content) });
+        (0, atomic_write_1.atomicWriteFileSync)(indexPath, `${(0, canonical_1.canonicalRuntimeJson)(next)}\n`, {
+            mode: 0o600,
+            fsync: true,
+        });
+        removeThreadFiles(threadsDir, projectPath, entry.threadId);
+        return entry.threadId;
+    });
+}
+/** v0.3.26 #276 — removes every durable file of one thread. Best effort per
+ *  file: a missing artifact is already deleted, and an unlink failure must not
+ *  resurrect the cutover entry that was just removed. */
+function removeThreadFiles(threadsDir, projectPath, threadId) {
+    const files = [
+        (0, path_1.join)(threadsDir, `${threadId}.events.v1.jsonl`),
+        (0, path_1.join)(threadsDir, `${threadId}.projection.v1.json`),
+        (0, path_1.join)(threadsDir, `${threadId}.head.v1.json`),
+        (0, path_1.join)(threadsDir, `${threadId}.compact-state.v1.json`),
+        (0, path_1.join)(threadsDir, `${threadId}.session-index.v1.json`),
+        (0, paths_1.getProjectThreadV2ImportReceiptPath)(projectPath, threadId),
+    ];
+    for (const file of files) {
+        try {
+            if ((0, fs_1.existsSync)(file))
+                (0, fs_1.unlinkSync)(file);
+        }
+        catch {
+            // Durable leftovers are reported by the integrity checks, never by
+            // throwing here: the cutover entry removal is already committed.
+        }
+    }
+    for (const dir of [
+        (0, path_1.join)(threadsDir, `${threadId}.compact-checkpoints.v1`),
+        (0, path_1.join)(threadsDir, `${threadId}.transcript-pages.v1`),
+    ]) {
+        try {
+            (0, fs_1.rmSync)(dir, { recursive: true, force: true });
+        }
+        catch {
+            // See above.
+        }
+    }
+}
 function buildMaterializedEvents(snapshot) {
     const receipt = snapshot.receipt;
     const pending = [

package/dist/runtime/model-coordinator.d.ts

@@ -94,4 +94,5 @@ export declare class ModelCoordinator extends EventEmitter {
     private validateTargetClient;
     private commitResolvedTarget;
 }
+export declare function resolveProfileSafeInputBudget(profile: ResolvedModelProfile): number;
 //# sourceMappingURL=model-coordinator.d.ts.map

package/dist/runtime/model-coordinator.js

@@ -11,6 +11,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ModelCoordinator = void 0;
 exports.validateModelSwitchCompactReceipt = validateModelSwitchCompactReceipt;
+exports.resolveProfileSafeInputBudget = resolveProfileSafeInputBudget;
 const events_1 = require("events");
 function validateModelSwitchCompactReceipt(receipt, targetTokens, safeInputBudget = targetTokens) {
     if (receipt.status === 'rejected')
@@ -114,7 +115,9 @@ class ModelCoordinator extends events_1.EventEmitter {
             if (clientError)
                 return { success: false, error: clientError };
             const prev = this.current;
-            if (!prev || target.resolvedContextWindow >= prev.resolvedContextWindow) {
+            // v0.3.25 #271 — same budget gate as commitSwitch: the effective input
+            // budgets decide, not raw context windows.
+            if (!prev || resolveProfileSafeInputBudget(target) >= resolveProfileSafeInputBudget(prev)) {
                 this.commitResolvedTarget(target, prev);
                 return {
                     success: true,
@@ -190,7 +193,11 @@ class ModelCoordinator extends events_1.EventEmitter {
         let compacted = false;
         let compactRequired = false;
         let compactPreflight = 'not_required';
-        if (prev && target.resolvedContextWindow < prev.resolvedContextWindow) {
+        // v0.3.25 #271 — gate the preflight on the effective input budgets, not raw
+        // context windows: a target with the same (or larger) window but a larger
+        // output reserve can still have a smaller safe input budget, and the
+        // unchanged history would exceed it without any compact.
+        if (prev && resolveProfileSafeInputBudget(target) < resolveProfileSafeInputBudget(prev)) {
             compactRequired = true;
             const safeInputBudget = resolveProfileSafeInputBudget(target);
             const targetTokens = Math.max(1, Math.floor(safeInputBudget * 0.65));

package/dist/runtime/session-composer-control.js

@@ -9,6 +9,7 @@ const effort_1 = require("../services/effort");
 const global_config_1 = require("../services/global-config");
 const session_storage_1 = require("../services/session-storage");
 const token_estimate_1 = require("../utils/token-estimate");
+const model_coordinator_1 = require("./model-coordinator");
 const canonical_1 = require("./protocol/canonical");
 class SessionComposerControlError extends Error {
     constructor(code, message) {
@@ -96,7 +97,10 @@ class SessionComposerControlServiceV1 {
                 toModelId: profile.id,
                 requestedEffort,
                 compacted: false,
-                compactRequired: profile.resolvedContextWindow < this.project(session, true).model.contextWindow,
+                // v0.3.25 #271 — same gate as the live path: the effective input
+                // budgets decide, not raw context windows.
+                compactRequired: (0, model_coordinator_1.resolveProfileSafeInputBudget)(profile) <
+                    (0, model_coordinator_1.resolveProfileSafeInputBudget)(this.resolveProfile(session.model)),
                 compactPreflight: 'deferred',
                 appliesFrom: 'next-logical-request',
                 sessionPreferencesDigest: (0, canonical_1.digestRuntimeValue)({

package/dist/services/session-storage.js

@@ -1858,6 +1858,21 @@ function updateSessionSummary(sessionId, _messages) {
     // Callers may hold a stale transcript snapshot. Re-read under the same lock
     // used by append/delete so reconciliation can never roll metadata backwards.
     withLockedSession(sessionId, session => {
+        // v0.3.26 #277 — a cutover Session's summary comes from the authoritative
+        // v2 Thread. Its legacy JSONL is frozen at cutover, so summarizing from it
+        // (as /exit and the shutdown path do) would move messageCount and
+        // historySizeBytes backwards while the Thread history is intact. Reopening
+        // the Session repairs the read model from v2; this makes the exit path
+        // agree instead of regressing it.
+        const threadView = (0, thread_session_view_1.loadThreadSessionViewV1)(session.projectPath, session.id);
+        if (threadView) {
+            session.messageCount = threadView.messageCount;
+            session.historySizeBytes = threadView.historySizeBytes;
+            session.updatedAt = threadView.updatedAt;
+            session.updatedAtIso = new Date(session.updatedAt).toISOString();
+            writeSessionMetaUnlocked(session);
+            return;
+        }
         const summary = summarizeSessionMessages(readSessionMessagesForSession(session));
         session.toolsUsed = summary.toolsUsed;
         session.filesModified = summary.filesModified;
@@ -2553,6 +2568,12 @@ function deleteSession(sessionId) {
         updateSessionCatalog(catalog => {
             delete catalog.sessions[sessionId];
         });
+        // v0.3.26 #276 — a cutover Session's v2 records are the authoritative
+        // history; permanent deletion must remove them with the legacy files.
+        // The Web deletion dialog promises exactly that.
+        if ((0, legacy_thread_materializer_1.deleteSessionThreadRecordsV1)(session.projectPath, sessionId)) {
+            deleted = true;
+        }
         return deleted;
     }) ?? false);
 }

package/dist/services/workspace-registry.d.ts

@@ -3,6 +3,15 @@ export interface WorkspaceRegistryEntryV1 {
     readonly canonicalPath: string;
     readonly label: string;
     readonly lastActivatedAt: string;
+    /**
+     * v0.3.25 #272 — when the workspace was first registered. Navigation order is
+     * derived from this stable timestamp; `lastActivatedAt` no longer reorders
+     * the tree when sessions are activated. Documents persisted before this field
+     * existed are backfilled from `lastActivatedAt` on parse (and persisted with
+     * the backfilled value on the next write), which keeps the migration
+     * deterministic.
+     */
+    readonly registeredAt: string;
     readonly pinnedOrder?: number;
 }
 export interface WorkspaceRegistryOptions {

package/dist/services/workspace-registry.js

@@ -47,6 +47,7 @@ class WorkspaceRegistryV1 {
                 canonicalPath,
                 label: workspaceLabel(canonicalPath),
                 lastActivatedAt: options.activated ? now : (existing?.lastActivatedAt ?? now),
+                registeredAt: existing?.registeredAt ?? now,
                 ...(existing?.pinnedOrder !== undefined ? { pinnedOrder: existing.pinnedOrder } : {}),
             });
             const entries = existing
@@ -74,6 +75,7 @@ class WorkspaceRegistryV1 {
                     canonicalPath: path,
                     label: workspaceLabel(path),
                     lastActivatedAt: path === active ? now : (existing?.lastActivatedAt ?? now),
+                    registeredAt: existing?.registeredAt ?? now,
                     ...(existing?.pinnedOrder !== undefined ? { pinnedOrder: existing.pinnedOrder } : {}),
                 }));
             }
@@ -102,6 +104,7 @@ class WorkspaceRegistryV1 {
                 canonicalPath: target.canonicalPath,
                 label: target.label,
                 lastActivatedAt: target.lastActivatedAt,
+                registeredAt: target.registeredAt,
                 ...(pinned ? { pinnedOrder: target.pinnedOrder ?? currentMax + 1 } : {}),
             });
             this.writeDocument(document.entries.map(entry => (entry.id === id ? updated : entry)));
@@ -189,6 +192,11 @@ function parseEntry(value) {
         !row.label.trim() ||
         typeof row.lastActivatedAt !== 'string' ||
         !Number.isFinite(Date.parse(row.lastActivatedAt)) ||
+        // v0.3.25 #272 — older documents have no registeredAt; backfill from
+        // lastActivatedAt so the migration is deterministic and the write-back
+        // persists the stable value.
+        (row.registeredAt !== undefined &&
+            (typeof row.registeredAt !== 'string' || !Number.isFinite(Date.parse(row.registeredAt)))) ||
         (row.pinnedOrder !== undefined &&
             (!Number.isSafeInteger(row.pinnedOrder) || Number(row.pinnedOrder) < 1))) {
         return invalidDocument();
@@ -198,6 +206,7 @@ function parseEntry(value) {
         canonicalPath: row.canonicalPath,
         label: row.label,
         lastActivatedAt: row.lastActivatedAt,
+        registeredAt: typeof row.registeredAt === 'string' ? row.registeredAt : row.lastActivatedAt,
         ...(row.pinnedOrder !== undefined ? { pinnedOrder: Number(row.pinnedOrder) } : {}),
     });
 }
@@ -209,8 +218,10 @@ function compareEntries(left, right) {
     const rightPinned = right.pinnedOrder ?? Number.MAX_SAFE_INTEGER;
     if (leftPinned !== rightPinned)
         return leftPinned - rightPinned;
-    const recent = Date.parse(right.lastActivatedAt) - Date.parse(left.lastActivatedAt);
-    return recent || left.label.localeCompare(right.label) || left.id.localeCompare(right.id);
+    // v0.3.25 #272 — stable registration order: activating a session must not
+    // reorder the navigation tree, so lastActivatedAt no longer participates.
+    const registration = Date.parse(left.registeredAt) - Date.parse(right.registeredAt);
+    return registration || left.label.localeCompare(right.label) || left.id.localeCompare(right.id);
 }
 function freezeEntries(entries) {
     return Object.freeze([...entries].sort(compareEntries).map(entry => Object.freeze({ ...entry })));

package/dist/web/git-diff-document.d.ts

@@ -41,6 +41,18 @@ export interface GitHunkV2 {
     readonly complete: boolean;
 }
 export type GitDiffDocumentKindV2 = 'text' | 'binary' | 'symlink' | 'submodule' | 'metadata';
+/**
+ * v0.3.26 #275 — parser state for a hunk that a page boundary split. Carried in
+ * the continuation cursor so the next page re-opens the hunk with its stable
+ * identity (`index:oldStart:newStart`) and correct running line cursors instead
+ * of demoting the continuation rows to document meta.
+ */
+export interface GitDiffHunkResumeV1 {
+    readonly header: string;
+    readonly index: number;
+    readonly oldCursor: number;
+    readonly newCursor: number;
+}
 export interface GitDiffCapabilitiesV2 {
     readonly stageFile: boolean;
     readonly unstageFile: boolean;
@@ -63,6 +75,11 @@ export interface GitDiffDocumentV2 {
     readonly hunks: readonly GitHunkV2[];
     /** Metadata lines that are not part of any hunk (file headers, mode changes, …). */
     readonly meta: readonly string[];
+    /**
+     * v0.3.26 #275 — the hunk still open when this page ended, for the
+     * continuation cursor. Null when the page ends on a hunk boundary.
+     */
+    readonly pendingHunk: GitDiffHunkResumeV1 | null;
     readonly completeness: 'complete' | 'paged' | 'limited';
     readonly additions: number;
     readonly deletions: number;
@@ -79,5 +96,7 @@ export declare function parseGitDiffDocument(input: {
     readonly hasMore: boolean;
     /** Host-signed continuation cursor, or null. Never synthesised here. */
     readonly nextCursor: string | null;
+    /** v0.3.26 #275 — hunk state from the previous page's `pendingHunk`. */
+    readonly resume?: GitDiffHunkResumeV1 | null;
 }): GitDiffDocumentV2;
 //# sourceMappingURL=git-diff-document.d.ts.map

package/dist/web/git-diff-document.js

@@ -75,6 +75,31 @@ function parseGitDiffDocument(input) {
     let additions = 0;
     let deletions = 0;
     let current;
+    const openHunk = (header, index, oldCursor, newCursor) => {
+        const headerMatch = HUNK_HEADER.exec(header);
+        if (!headerMatch)
+            return;
+        const oldStart = Number(headerMatch[1]);
+        const newStart = Number(headerMatch[3]);
+        current = {
+            header,
+            oldStart,
+            oldLines: headerMatch[2] === undefined ? 1 : Number(headerMatch[2]),
+            newStart,
+            newLines: headerMatch[4] === undefined ? 1 : Number(headerMatch[4]),
+            contextLabel: (headerMatch[5] ?? '').trim(),
+            lines: [],
+            oldCursor,
+            newCursor,
+            index,
+        };
+    };
+    // v0.3.26 #275 — a continuation page starts mid-hunk: re-open it from the
+    // resume state before the first line is classified. A page that happens to
+    // start with its own `@@` header simply ignores the resume state.
+    if (input.resume && !HUNK_HEADER.test(input.lines[0] ?? '')) {
+        openHunk(input.resume.header, input.resume.index, input.resume.oldCursor, input.resume.newCursor);
+    }
     const closeHunk = () => {
         if (!current)
             return;
@@ -134,14 +159,22 @@ function parseGitDiffDocument(input) {
             }));
             continue;
         }
-        if (isMetaLine(raw)) {
+        // v0.3.26 #274 — the body marker decides first. A deletion of a line that
+        // itself starts with `-- ` produces the body row `--- old comment`, which a
+        // header-first check mistook for the old-file header, closing the hunk and
+        // demoting the remaining body to document meta. Genuine document-level lines
+        // carry no body marker by construction: context rows start with a space,
+        // additions with `+`, deletions with `-`, and file boundaries are announced
+        // by a markerless `diff --git` line.
+        const marker = raw[0];
+        const isBodyRow = marker === '+' || marker === '-' || marker === ' ' || raw === '';
+        if (!isBodyRow && isMetaLine(raw)) {
             // A file boundary inside one page (multi-command reads) closes the current hunk.
             closeHunk();
             if (raw)
                 meta.push(raw);
             continue;
         }
-        const marker = raw[0];
         const text = raw.length > 0 ? raw.slice(1) : '';
         let lineKind;
         let oldLineNumber = null;
@@ -185,6 +218,16 @@ function parseGitDiffDocument(input) {
             raw,
         }));
     }
+    // v0.3.26 #275 — a page that ends inside a hunk publishes the hunk state for
+    // the continuation cursor; a page ending on a boundary has nothing to resume.
+    const pendingHunk = input.hasMore && current
+        ? Object.freeze({
+            header: current.header,
+            index: current.index,
+            oldCursor: current.oldCursor,
+            newCursor: current.newCursor,
+        })
+        : null;
     closeHunk();
     const frozenHunks = Object.freeze(hunks);
     let completeness = 'complete';
@@ -203,6 +246,7 @@ function parseGitDiffDocument(input) {
         binary,
         hunks: frozenHunks,
         meta: Object.freeze(meta),
+        pendingHunk,
         completeness,
         additions,
         deletions,

package/dist/web/git-history-service.js

@@ -572,11 +572,14 @@ function createGitHistoryReader(options) {
             // `--follow` only accepts a single path, which is exactly this case. It explains its own
             // limits for copies and complex merges (plan G6) — we surface `followed` rather than
             // pretending tracking is complete.
+            // v0.3.25 #270 — the validated revision must reach the log command: it was
+            // previously used only for the existence check, so every query walked HEAD.
             const raw = await runGit([
                 'log',
                 `--max-count=${limit + 1}`,
                 `--format=${LIST_FORMAT}${RECORD_SEPARATOR}`,
                 '--follow',
+                target,
                 '--',
                 path,
             ]);

package/dist/web/git-read-model-service.d.ts

@@ -207,6 +207,15 @@ export declare class GitReadModelServiceV1 {
     }): Promise<GitDiffDocumentV2>;
     private versionReaderInstance?;
     private versionReader;
+    /**
+     * v0.3.25 #269 — reads one working-tree file for the conflict view, refusing
+     * to leave the repository: the requested relative path (already guarded as
+     * relative and non-sensitive by the version reader) is resolved against the
+     * repository root and both the file's real path and its parent's real path
+     * must stay inside the root's real path. Returns null instead of throwing so
+     * a missing or unreadable file reads as an absent worktree version.
+     */
+    private readContainedWorktreeFile;
     /**
      * v0.3.17 S5 — base / ours / theirs / worktree for a conflicted file.
      *