@vzn/vx-dte 0.0.651 → 0.0.653

package/src/seal.ts

@@ -7,6 +7,7 @@
 // opens no past run.
 
 import { createHash } from 'node:crypto'
+import { zstdCompressSync, zstdDecompressSync } from 'node:zlib'
 import { type Bytes, type CipherState, Handshake, MAX_PLAINTEXT } from './noise.js'
 import { RelayError, unsent as unsentBy, type Participant, type RelayMessage } from './wire.js'
 import { ui } from '@vzn/vx'
@@ -192,12 +193,16 @@ const REPLAY = Symbol('replay')
 
 /**
  * The size a body is padded to, so the relay learns its size class, not
- * its size: a power of two from 256 bytes, then whole transport messages.
+ * its size: a power of two from 64 bytes, then whole transport messages.
+ * From 256, each `ran`, `end` and `report`, mostly some 100 bytes, sealed
+ * in two to eight times its size, and their order and timing already
+ * say which is which (2026-11-06).
  */
 function padded(n: number): number {
   if (n >= MAX_PLAINTEXT) return Math.ceil(n / MAX_PLAINTEXT) * MAX_PLAINTEXT
-  return Math.min(2 ** Math.ceil(Math.log2(Math.max(n, 256))), MAX_PLAINTEXT)
+  return Math.min(2 ** Math.ceil(Math.log2(Math.max(n, MIN_CLASS))), MAX_PLAINTEXT)
 }
+const MIN_CLASS = 64
 
 /**
  * One worker and the orchestrator after their handshake. Each body is
@@ -208,37 +213,68 @@ function padded(n: number): number {
  */
 class Session {
   private sent = 0
+  /** What this side sealed and what it opened: the orchestrator's bodies' zstd dictionary. */
+  private readonly sealed: History
+  private readonly opened: History
   private readonly seen = new Set<number>()
   /** The last nonce of the newest body opened. */
   private newest = -1
+  /** A body's parts from its sends so far, until the send that ends it. */
+  private held: { n: number; c: string }[] = []
   /** The last send handed to the wire, or still sealing: the next waits on it. */
   private turn: Promise<unknown> = Promise.resolve()
+  /** Bodies asked for in this turn of the event loop, or while the send before seals: sealed as one. */
+  private group: { bodies: string[]; bytes: number; sent: Promise<void> } | undefined
 
   constructor(
     private readonly tx: CipherState,
     private readonly rx: CipherState,
-  ) {}
+    orchestrator: boolean,
+  ) {
+    this.sealed = new History(orchestrator ? HISTORY_BYTES : 0)
+    this.opened = new History(orchestrator ? 0 : HISTORY_BYTES)
+  }
 
   /**
    * `body` sealed and handed to `wire`, in the order sends were asked for:
    * sealing is async, and a big body sealed first reached the wire after a
    * small one sealed next (a worker's `end` before its `ran`, 2026-10-26).
    * The wire numbers a send as it is handed over, so only the handing waits.
+   * Bodies that wait together go as one: each was a send, a relay frame
+   * and its answer of its own. A body of more parts than a frame holds
+   * goes over several sends, each but the last led by `+`.
    */
-  async send(body: unknown, wire: (sealed: { seal: string[] }) => Promise<void>): Promise<void> {
-    let sent: Promise<void> | undefined
-    const mine = this.turn.then(async () => {
-      sent = wire(await this.seal(body))
+  send(body: unknown, wire: (sealed: string[]) => Promise<void>): Promise<void> {
+    const json = JSON.stringify(body)
+    const g = this.group
+    if (g !== undefined && g.bytes + json.length <= GROUP_BYTES) {
+      g.bodies.push(json)
+      g.bytes += json.length
+      return g.sent
+    }
+    const mine = { bodies: [json], bytes: json.length, sent: Promise.resolve() }
+    this.group = mine
+    let handed: Promise<void> | undefined
+    const sealed = this.turn.then(async () => {
+      if (this.group === mine) this.group = undefined
+      const parts = await this.seal(`[${mine.bodies.join(',')}]`)
+      const sends: Promise<void>[] = []
+      for (let at = 0; at < parts.length; at += SEND_PARTS) {
+        const some = parts.slice(at, at + SEND_PARTS)
+        sends.push(wire(at + SEND_PARTS < parts.length ? [MORE, ...some] : some))
+      }
+      handed = Promise.all(sends).then(() => undefined)
     })
-    // quiet: `await mine` below hands the caller this error; the next turn
-    // must not inherit it.
-    this.turn = mine.catch(() => undefined)
-    await mine
-    await sent
+    // quiet: `sent` hands each caller this error; the next turn must not inherit it.
+    this.turn = sealed.catch(() => undefined)
+    mine.sent = sealed.then(() => handed)
+    return mine.sent
   }
 
-  private async seal(body: unknown): Promise<{ seal: string[] }> {
-    const plain = squeeze(text.encode(JSON.stringify(body)))
+  private async seal(bodies: string): Promise<string[]> {
+    const json = text.encode(bodies)
+    const plain = squeeze(json, this.sealed)
+    this.sealed.add(json)
     // Trailing spaces: JSON.parse reads past them, and `unsqueeze` stops before them.
     const bytes = new Uint8Array(padded(plain.length)).fill(0x20)
     bytes.set(plain)
@@ -249,15 +285,17 @@ class Session {
       const c = await this.tx.encrypt(n, ad, bytes.subarray(at, at + MAX_PLAINTEXT))
       out.push(`${n}.${b64(c)}`)
     }
-    return { seal: out }
+    return out
   }
 
-  /** The body; `REPLAY` for one delivered before; undefined for one that does not open. */
-  async open(body: unknown): Promise<unknown> {
-    const s = (body as { seal?: unknown } | null)?.seal
-    if (!Array.isArray(s) || s.length === 0) return undefined
-    const parts: { n: number; c: string }[] = []
-    for (const p of s) {
+  /** Its bodies; `REPLAY` for one delivered before; undefined for one that does not open. */
+  async open(s: unknown): Promise<unknown[] | typeof REPLAY | undefined> {
+    const parts = this.held
+    this.held = []
+    if (!Array.isArray(s)) return undefined
+    const more = s[0] === MORE
+    if (s.length === (more ? 1 : 0)) return undefined
+    for (const p of more ? s.slice(1) : s) {
       if (typeof p !== 'string') return undefined
       const [n, c] = p.split('.')
       const seq = Number(n)
@@ -271,16 +309,23 @@ class Session {
     // The wire numbers sends outside the seal, in the order they were
     // sealed: one older than a body already opened was held back by the relay.
     if (parts[0]!.n <= this.newest) return undefined
+    if (more) {
+      this.held = parts
+      return []
+    }
     // Each part is sealed to its body's first nonce and part count: unbound,
     // a relay spliced a fresh first part onto a delivered body's second.
     const ad = bodyAd(parts[0]!.n, parts.length)
     try {
       const plain: Uint8Array[] = []
       for (const p of parts) plain.push(await this.rx.decrypt(p.n, ad, unb64(p.c)))
-      const body: unknown = JSON.parse(unsqueeze(Buffer.concat(plain)).toString())
+      const json = unsqueeze(Buffer.concat(plain), this.opened)
+      const bodies: unknown = JSON.parse(Buffer.from(json).toString())
+      if (!Array.isArray(bodies)) return undefined
+      this.opened.add(json)
       for (const p of parts) this.seen.add(p.n)
       this.newest = parts.at(-1)!.n
-      return body
+      return bodies
       // quiet: a body that does not open is the relay's tampering, which the caller says
     } catch {
       return undefined
@@ -288,29 +333,100 @@ class Session {
   }
 }
 
-/** Leads a compressed body: no JSON starts with it. */
+/**
+ * Transport messages per send: six of 64 KiB, in base64, pass the wire's
+ * 512 KiB frame, and a task's env of 1.3 MB sealed as one send passed the
+ * relay's 1 MiB (2026-11-08).
+ */
+const SEND_PARTS = 5
+/** Leads each send of a body but its last. */
+const MORE = '+'
+/** Leads a body zstd-compressed, and one as its JSON. */
 const ZSTD = 0
+const RAW = 1
+/**
+ * Bodies of up to this much JSON go sealed as one; each body of more goes
+ * alone, over as many sends as its parts take (`SEND_PARTS`).
+ */
+const GROUP_BYTES = 64 * 1024
+/** The lead byte and its sender's history length; a compressed one's frame length next. */
+const HEADER = 5
+/**
+ * The last this many bytes the orchestrator sealed to a worker are its
+ * next body's zstd dictionary: each batch sent its tasks' env and paths
+ * again. 32 KiB sealed no less for 1.7 times the CPU (1000 tasks,
+ * 2026-11-06). A worker's bodies go without one: a dictionary costs some
+ * 100 µs a body (node:zlib's per-call context), and the orchestrator
+ * opening each in turn ran a 1000-task run 0.3 s longer.
+ */
+const HISTORY_BYTES = 16 * 1024
 
 /**
- * A body over the smallest size class, zstd-compressed before it is sealed:
- * once sealed it is random bytes no relay or socket compression shrinks.
- * The padding still hides its size within a class.
+ * One direction's bodies, as JSON: both ends add each, in the order sealed,
+ * as the wire delivers each once and in order.
  */
-function squeeze(json: Uint8Array): Uint8Array {
-  if (json.length <= 256) return json
-  const z = Bun.zstdCompressSync(json)
-  if (z.length + 5 >= json.length) return json
-  const out = new Uint8Array(z.length + 5)
-  out[0] = ZSTD
-  new DataView(out.buffer).setUint32(1, z.length)
-  out.set(z, 5)
+class History {
+  constructor(private readonly bytes: number) {}
+  window = new Uint8Array(0)
+  /**
+   * Every body's bytes, before the window too: each body names its
+   * sender's, so one sealed after a body the relay kept back or refused
+   * does not open.
+   */
+  total = 0
+  add(json: Uint8Array): void {
+    this.total = (this.total + json.length) >>> 0
+    if (this.bytes === 0) return
+    const all = new Uint8Array(this.window.length + json.length)
+    all.set(this.window)
+    all.set(json, this.window.length)
+    this.window = all.subarray(Math.max(0, all.length - this.bytes))
+  }
+}
+
+/**
+ * A body zstd-compressed against what this side sealed before, before it
+ * is sealed, when smaller so: sealed, it is random bytes no relay or
+ * socket compression shrinks. The padding still hides its size within a
+ * class.
+ */
+function squeeze(json: Uint8Array, h: History): Uint8Array {
+  const z =
+    h.window.length === 0
+      ? Bun.zstdCompressSync(json)
+      : zstdCompressSync(json, { dictionary: h.window })
+  const raw = z.length + 4 >= json.length
+  const out = new Uint8Array(HEADER + (raw ? json.length : 4 + z.length))
+  const v = new DataView(out.buffer)
+  out[0] = raw ? RAW : ZSTD
+  v.setUint32(1, h.total)
+  if (raw) out.set(json, HEADER)
+  else {
+    v.setUint32(HEADER, z.length)
+    out.set(z, HEADER + 4)
+  }
   return out
 }
 
-function unsqueeze(plain: Uint8Array): Uint8Array {
-  if (plain[0] !== ZSTD) return plain
-  const n = new DataView(plain.buffer, plain.byteOffset).getUint32(1)
-  return Bun.zstdDecompressSync(plain.subarray(5, 5 + n))
+/**
+ * Its JSON, unpadded. Throws for one sealed after a body this side never
+ * opened: compressed, it decoded against another dictionary to other
+ * bytes, and either way the relay kept that body back.
+ */
+function unsqueeze(plain: Uint8Array, h: History): Uint8Array {
+  const v = new DataView(plain.buffer, plain.byteOffset)
+  if (v.getUint32(1) !== h.total) throw new Error('sealed after a body never opened')
+  if (plain[0] === RAW) {
+    // JSON.stringify ends no body with a space: what trails it is padding.
+    let end = plain.length
+    while (end > HEADER && plain[end - 1] === 0x20) end--
+    return plain.subarray(HEADER, end)
+  }
+  if (plain[0] !== ZSTD) throw new Error('no body')
+  const z = plain.subarray(HEADER + 4, HEADER + 4 + v.getUint32(HEADER))
+  return h.window.length === 0
+    ? Bun.zstdDecompressSync(z)
+    : zstdDecompressSync(z, { dictionary: h.window })
 }
 
 /** What each part of one body is sealed to: its first nonce and how many parts. */
@@ -367,7 +483,7 @@ export function sealOrchestrator(
       proof.psk === undefined
         ? { type: 'hello', noise: answer, token: await proof.sign!(['hello', run, b64(hs.hash)]) }
         : { type: 'hello', noise: answer }
-    return { info: parsed, hello, session: new Session(send, receive) }
+    return { info: parsed, hello, session: new Session(send, receive, true) }
   }
   return {
     id: me.id,
@@ -424,7 +540,7 @@ export function sealOrchestrator(
           out.push({ from: 'relay', body: { type: 'lost', id: m.from } })
           continue
         }
-        out.push({ from: m.from, body })
+        for (const one of body) out.push({ from: m.from, body: one })
       }
       return out
     },
@@ -464,7 +580,7 @@ export async function sealWorker(
     )
       return false
     const { send, receive } = await hs.split()
-    session = new Session(send, receive)
+    session = new Session(send, receive, false)
     return true
   }
   return {
@@ -501,7 +617,7 @@ export async function sealWorker(
           throw new SealError(
             'a message from the orchestrator did not open: the relay changed or replayed it',
           )
-        out.push({ from: m.from, body })
+        for (const one of body) out.push({ from: m.from, body: one })
       }
       return out
     },

package/src/server-fit.ts

@@ -0,0 +1,80 @@
+// What a worker's servers use, charged to the tasks that make them work.
+// A server is no task of the run's: its CPU was no one's, so history
+// booked its dependants by their own trees and a server they kept at 100%
+// went unbooked. Each look gives one sample per server: the cores its
+// tree used and exactly which dependants ran then. The model is
+// cores = base + the sum of each running dependant's own cost, fitted
+// online (projected gradient: never below 0). Each sample's cores are
+// split by it: each dependant is charged its own cost's part, added to its
+// CPU, so history books it; the base is the server's own, booked once on
+// each worker that runs it (`Need.servers`), and the planner still sees
+// only tasks.
+
+/** The step of each update, as a share of the error: small enough not to swing on one noisy look. */
+const RATE = 0.3
+
+interface Model {
+  base: number
+  readonly cost: Map<string, number>
+}
+
+export interface ServerFit {
+  /**
+   * One look at `server`: `cores` its tree used over the last `ms` while
+   * `users` ran. `capped`: the machine was full, so `cores` is only what
+   * it got, a floor of what it asked for.
+   */
+  sample(server: string, users: readonly string[], cores: number, ms: number, capped: boolean): void
+  /** The server CPU charged to `task` since it began, in core-ms; taking it clears it. */
+  take(task: string): number
+  /** `server`'s model now: its base and each dependant's cost, cores. */
+  model(server: string): { base: number; cost: ReadonlyMap<string, number> } | undefined
+  /** Each server's base now, cores: what a worker reports, rounded to a hundredth. */
+  bases(): Record<string, number>
+}
+
+export function serverFit(): ServerFit {
+  const models = new Map<string, Model>()
+  const owed = new Map<string, number>()
+  return {
+    sample(server, users, cores, ms, capped) {
+      let m = models.get(server)
+      if (m === undefined) models.set(server, (m = { base: 0, cost: new Map() }))
+      const cost = (u: string): number => m.cost.get(u) ?? 0
+      let predicted = m.base
+      for (const u of users) predicted += cost(u)
+      const error = cores - predicted
+      // A capped look says only "at least": it may raise the model, never
+      // lower it. The base learns only from looks with no dependant, each
+      // cost only from looks with: from looks always with one, both moved
+      // alike and the base took half of what the dependant made it do.
+      // Unlearned, the base is 0: a dependant is charged too much, never
+      // too little.
+      if (!(capped && error < 0)) {
+        if (users.length === 0) m.base = Math.max(0, m.base + RATE * error)
+        else {
+          const step = (RATE * error) / users.length
+          for (const u of users) m.cost.set(u, Math.max(0, cost(u) + step))
+        }
+      }
+      if (users.length === 0 || !(cores > 0) || !(ms > 0)) return
+      let total = m.base
+      for (const u of users) total += cost(u)
+      if (!(total > 0)) return
+      for (const u of users) owed.set(u, (owed.get(u) ?? 0) + (cores * ms * cost(u)) / total)
+    },
+    take(task) {
+      const ms = owed.get(task) ?? 0
+      owed.delete(task)
+      return ms
+    },
+    model(server) {
+      return models.get(server)
+    },
+    bases() {
+      const out: Record<string, number> = {}
+      for (const [server, m] of models) out[server] = Math.round(m.base * 100) / 100
+      return out
+    },
+  }
+}

package/src/tree.ts

@@ -2,9 +2,11 @@
 // them. Workers compare trees, not commits, so a run on uncommitted changes
 // still matches the worktrees `local()` makes from them.
 
-import { copyFile, mkdtemp, rm, stat, utimes } from 'node:fs/promises'
+import { existsSync, lstatSync } from 'node:fs'
+import { copyFile, mkdtemp, rm, stat, utimes, writeFile } from 'node:fs/promises'
 import os from 'node:os'
 import path from 'node:path'
+import { PROJECT_CONFIG_FILENAMES, UserError } from '@vzn/vx'
 
 /**
  * A commit of the tracked files as they are now (`HEAD`'s when none changed),
@@ -18,10 +20,14 @@ export async function snapshot(root: string): Promise<{ commit: string; tree: st
   // leaves the index and the working tree as they are. `git stash create`
   // did the same, but refused an intent-to-add entry (`git add -N`), and
   // HEAD stood in for the changes (2026-10-28).
-  const index = (
-    await git(['rev-parse', '--path-format=absolute', '--git-path', 'index'], root)
-  )?.trim()
-  if (index === undefined) return none
+  const [top, index] =
+    (
+      await git(
+        ['rev-parse', '--show-toplevel', '--path-format=absolute', '--git-path', 'index'],
+        root,
+      )
+    )?.split('\n') ?? []
+  if (top === undefined || index === undefined) return none
   const dir = await mkdtemp(path.join(os.tmpdir(), 'vx-dte-index-'))
   try {
     const env = { GIT_INDEX_FILE: path.join(dir, 'index') }
@@ -37,7 +43,16 @@ export async function snapshot(root: string): Promise<{ commit: string; tree: st
       // quiet: no index yet, so HEAD's tree is its tracked set.
       if ((await git(['read-tree', head], root, env)) === undefined) return none
     }
-    if ((await git(['add', '-u', '--', ':/'], root, env)) === undefined) return none
+    await unflag(top, env)
+    // The executable bit as on disk, which core keys from an lstat under
+    // `core.fileMode=false` too: there `add -u` staged no `chmod +x`,
+    // workers checked the file out 644, and saved what it built under the
+    // key of its 755 (2026-11-08).
+    if (
+      (await git([...UNSPARSE, '-c', 'core.fileMode=true', 'add', '-u', '--', ':/'], root, env)) ===
+      undefined
+    )
+      return none
     const tree = (await git(['write-tree'], root, env))?.trim()
     if (tree === undefined || tree === '') return none
     const was = (await git(['rev-parse', `${head}^{tree}`], root))?.trim()
@@ -53,6 +68,198 @@ export async function snapshot(root: string): Promise<{ commit: string; tree: st
   }
 }
 
+/**
+ * Each tracked file a git filter of this machine checked out other than
+ * the commit holds it (`text`, `eol`, `ident`, `filter`,
+ * `working-tree-encoding`, `core.autocrlf`), written back as the commit's
+ * bytes; the paths written. The run keys its disk's bytes and refuses a
+ * task that keys a file the commit holds otherwise, so these are the bytes
+ * its key read: a worktree that smudged LF to CRLF built CRLF output under
+ * the key of the LF file, a stale hit (2026-11-08).
+ */
+export async function unfilter(root: string): Promise<string[]> {
+  const top = (await git(['rev-parse', '--show-toplevel'], root))?.trim()
+  if (top === undefined || top === '') return []
+  const vars = await git(['var', '-l'], top)
+  if (vars === undefined) return []
+  const config = varList(vars)
+  const every = autocrlf(config)
+  // The common repository names no filter: no index read.
+  if (!every && !(await attributed(top, config))) return []
+  const staged = await git([...UNSPARSE, 'ls-files', '-s', '-z'], top)
+  if (staged === undefined) return []
+  const blobs = new Map<string, string>()
+  for (const e of staged.split('\0')) {
+    const m = /^(?:100644|100755) ([0-9a-f]+) 0\t(.*)$/s.exec(e)
+    if (m !== null) blobs.set(m[2]!, m[1]!)
+  }
+  let paths = [...blobs.keys()]
+  if (!every) paths = await filtered(top, paths)
+  // `--stdin-paths` reads lines; a file off disk (a sparse checkout's) is no checkout.
+  paths = paths.filter((p) => !p.includes('\n') && isFile(path.join(top, p)))
+  if (paths.length === 0) return []
+  const raw = await git(
+    ['hash-object', '--no-filters', '--stdin-paths'],
+    top,
+    undefined,
+    paths.join('\n') + '\n',
+  )
+  if (raw === undefined) return []
+  const oids = raw.split('\n')
+  const off = paths.filter((p, i) => oids[i] !== blobs.get(p))
+  if (off.length === 0) return []
+  const p = Bun.spawn(['git', 'cat-file', '--batch'], {
+    cwd: top,
+    stdin: Buffer.from(off.map((f) => blobs.get(f)).join('\n') + '\n'),
+    stdout: 'pipe',
+    stderr: 'ignore',
+  })
+  const [out, code] = await Promise.all([new Response(p.stdout).bytes(), p.exited])
+  if (code !== 0) throw new UserError(`vx dte worker: git could not read ${off[0]}'s blob`)
+  // Each `<oid> blob <size>\n<bytes>\n`.
+  let at = 0
+  for (const f of off) {
+    const nl = out.indexOf(10, at)
+    const size = Number(new TextDecoder().decode(out.subarray(at, nl)).split(' ')[2])
+    await writeFile(path.join(top, f), out.subarray(nl + 1, nl + 1 + size))
+    at = nl + 1 + size + 1
+  }
+  return off
+}
+
+/** Whether `file` is a regular file on disk. */
+function isFile(file: string): boolean {
+  try {
+    return lstatSync(file).isFile()
+  } catch {
+    // quiet: off disk is no file
+    return false
+  }
+}
+
+/** `git var -l`'s last value of each name; a bare key (true) has none. */
+function varList(vars: string): Map<string, string | undefined> {
+  const out = new Map<string, string | undefined>()
+  for (const line of vars.split('\n')) {
+    const eq = line.indexOf('=')
+    if (eq === -1) out.set(line.toLowerCase(), undefined)
+    else out.set(line.slice(0, eq).toLowerCase(), line.slice(eq + 1))
+  }
+  return out
+}
+
+/** Whether `core.autocrlf`, as git reads it, converts line ends. */
+function autocrlf(config: Map<string, string | undefined>): boolean {
+  if (!config.has('core.autocrlf')) return false
+  const v = config.get('core.autocrlf')
+  if (v === undefined) return true
+  const s = v.trim().toLowerCase()
+  if (s === 'input' || s === 'true' || s === 'yes' || s === 'on') return true
+  return /^-?\d+$/.test(s) && Number(s) !== 0
+}
+
+/**
+ * Whether any attributes file may name a filter: a `.gitattributes` in the
+ * tree, `$GIT_DIR/info/attributes`, or the global or system one git names
+ * (`git var`, from git 2.42; an older git names neither, so any may).
+ */
+async function attributed(top: string, config: Map<string, string | undefined>): Promise<boolean> {
+  if (existsSync(path.join(top, '.gitattributes'))) return true
+  const [tracked, info] = await Promise.all([
+    git([...UNSPARSE, 'ls-files', '-z', '--', ':(glob)**/.gitattributes'], top),
+    git(['rev-parse', '--path-format=absolute', '--git-path', 'info/attributes'], top),
+  ])
+  if (tracked !== '' || info === undefined || existsSync(info.trim())) return true
+  if (!config.has('git_attr_global')) return true
+  for (const name of ['git_attr_global', 'git_attr_system']) {
+    const f = config.get(name)
+    if (f !== undefined && f !== '' && existsSync(f)) return true
+  }
+  return false
+}
+
+/** Of `paths`, those a filter attribute names (set, or given a value). */
+async function filtered(top: string, paths: string[]): Promise<string[]> {
+  const out = await git(
+    ['check-attr', '-z', '--stdin', 'text', 'eol', 'ident', 'filter', 'working-tree-encoding'],
+    top,
+    undefined,
+    paths.join('\0') + '\0',
+  )
+  if (out === undefined) return paths
+  const named = new Set<string>()
+  const f = out.split('\0')
+  for (let i = 0; i + 2 < f.length; i += 3)
+    if (f[i + 2] !== 'unspecified' && f[i + 2] !== 'unset') named.add(f[i]!)
+  return paths.filter((p) => named.has(p))
+}
+
+/**
+ * The workspace config core loads (the first `.vx/workspace.*` under
+ * `root`), when `tree` lacks it: every worker started without one failed
+ * `unknown command: dte`, and started again three times, before a task
+ * said why (2026-11-07).
+ */
+export async function untrackedWorkspace(root: string, tree: string): Promise<string | undefined> {
+  for (const name of WORKSPACE_FILES) {
+    if (!(await Bun.file(path.join(root, name)).exists())) continue
+    return (await git(['cat-file', '-e', `${tree}:./${name}`], root)) === undefined
+      ? name
+      : undefined
+  }
+  return undefined
+}
+
+/** Core's names in its order: a project config's extensions. */
+const WORKSPACE_FILES = PROJECT_CONFIG_FILENAMES.map((n) => `.vx/workspace${path.extname(n)}`)
+
+/**
+ * The copy's assume-unchanged and skip-worktree flags cleared, so `add -u`
+ * takes those files from disk: it passed over them, and the tree kept
+ * HEAD's blob of a file core's key hashed as edited, a stale hit
+ * (2026-11-07). A skip-worktree file off disk (a sparse checkout's) stays
+ * flagged: its bytes are the index's, not a deletion.
+ */
+async function unflag(top: string, env: Record<string, string>): Promise<void> {
+  const listed = await git([...UNSPARSE, 'ls-files', '-v', '-z'], top, env)
+  if (listed === undefined) return
+  const assumed: string[] = []
+  const skipped: string[] = []
+  for (const entry of listed.split('\0')) {
+    const tag = entry[0]
+    if (tag === undefined) continue
+    const file = entry.slice(2)
+    // Lower case is assume-unchanged; S (s: both flags) skip-worktree.
+    if (tag !== tag.toUpperCase()) assumed.push(file)
+    if ((tag === 'S' || tag === 's') && existsSync(path.join(top, file))) skipped.push(file)
+  }
+  // One flag a call: given both, update-index clears the first and skips
+  // the second.
+  for (const [flag, files] of [
+    ['--no-assume-unchanged', assumed],
+    ['--no-skip-worktree', skipped],
+  ] as const) {
+    if (files.length === 0) continue
+    const p = Bun.spawn(['git', ...UNSPARSE, 'update-index', flag, '-z', '--stdin'], {
+      cwd: top,
+      stdin: Buffer.from(files.join('\0') + '\0'),
+      stdout: 'ignore',
+      stderr: 'pipe',
+      env: { ...process.env, ...env },
+    })
+    const [err, code] = await Promise.all([new Response(p.stderr).text(), p.exited])
+    if (code !== 0)
+      throw new UserError(
+        `dte(): git could not take ${files[0]} (flagged assume-unchanged or skip-worktree) from disk, so workers would run its committed bytes: ${err.trim()}`,
+      )
+  }
+}
+
+// A sparse checkout's patterns kept `add` off a file outside them that is
+// on disk all the same, and its index reads clear the flag of such a file
+// in memory only, so `ls-files` named it unflagged.
+const UNSPARSE = ['-c', 'core.sparseCheckout=false']
+
 const IDENTITY = {
   GIT_AUTHOR_NAME: 'vx',
   GIT_AUTHOR_EMAIL: 'vx@localhost',
@@ -65,10 +272,11 @@ async function git(
   args: string[],
   cwd: string,
   env?: Record<string, string>,
+  input?: string,
 ): Promise<string | undefined> {
   const p = Bun.spawn(['git', ...args], {
     cwd,
-    stdin: 'ignore',
+    stdin: input === undefined ? 'ignore' : Buffer.from(input),
     stdout: 'pipe',
     stderr: 'ignore',
     ...(env === undefined ? {} : { env: { ...process.env, ...env } }),