@webpieces/rules-config 0.4.543 → 0.4.545

package/src/main-sync-status.d.ts

@@ -1,21 +1,9 @@
 import { AtomicFile } from './atomic-file';
+import { MAIN_SYNC_STATUS_VERSION, MainSyncFileStore, MainSyncStatus, MainSyncStatusFile, PullRequestIndex } from './main-sync-file';
 import { DotWebpieces } from './state-dir';
+import { WorktreeService } from './worktrees';
+export { MainSyncStatus, MainSyncStatusFile, PullRequestIndex, MAIN_SYNC_STATUS_VERSION };
 export declare const DEFAULT_HANG_TIMEOUT_MINUTES = 5;
-export declare class MainSyncStatus {
-    branch: string;
-    branchAlreadyMerged: boolean;
-    mergedPr: string;
-    hasForkPoint: boolean;
-    forkPoint: string | null;
-    originMain: string;
-    featureHead: string;
-    conflict: boolean;
-    conflictFiles: string[];
-    timestamp: string;
-    openPr: string;
-    localMain: string;
-    constructor(branch: string, branchAlreadyMerged: boolean, mergedPr: string, hasForkPoint: boolean, forkPoint: string | null, originMain: string, featureHead: string, conflict: boolean, conflictFiles: string[], timestamp: string);
-}
 export declare class MainSyncLock {
     state: string;
     started: number;
@@ -29,7 +17,9 @@ export declare class MainSyncLock {
 export declare class MainSyncStatusService {
     private readonly dotDir;
     private readonly atomicFile;
-    constructor(dotDir?: DotWebpieces, atomicFile?: AtomicFile);
+    private readonly store;
+    private readonly worktrees;
+    constructor(dotDir?: DotWebpieces, atomicFile?: AtomicFile, store?: MainSyncFileStore, worktrees?: WorktreeService);
     /**
      * SHARED scope: `<primary>/.webpieces/main-sync-status.json`, one per repo.
      *
@@ -37,14 +27,13 @@ export declare class MainSyncStatusService {
      * one `.git`, one `origin/main`, one fetch, one answer. A per-worktree copy under single-flight
      * would only ever be written for whichever worktree won the lock anyway.
      *
-     * KNOWN CONSEQUENCE, stated plainly rather than discovered later: the file's CONTENT is keyed to
-     * one branch (`branch`, `featureHead`, `conflict`, `conflictFiles`), and every reader fails OPEN
-     * when the cached branch is not the branch being judged (`merged-branch-bash-guard` and
-     * `stale-main-bash-guard` both log `stale-cross-branch-cache (fail-open)`). With several worktrees
-     * on several branches, the losers of the lock therefore see a cross-branch cache and their guards
-     * allow rather than block. That is the fail-SAFE direction and it is inherent to single-flight, not
-     * to the shared path — but making the entries branch-keyed (a map of branch → status, written
-     * atomically) is the obvious follow-up.
+     * FORMERLY a known defect, now fixed: the file's CONTENT used to be keyed to ONE branch, and every
+     * reader fails OPEN when the cached branch is not the branch being judged (`stale-cross-branch-cache
+     * (fail-open)`). With several worktrees on several branches, only the winner of the lock was ever
+     * described, so every other worktree's guards abstained — and which one was armed thrashed as the
+     * lock changed hands. The file is now a MAP of branch -> status (see MainSyncStatusFile): the single
+     * winning refresher enumerates every worktree and records all of their branches in one atomic write,
+     * so one fetch arms everyone. Single-flight is unchanged; only what the winner writes changed.
      */
     mainSyncStatusPath(repoRoot: string): string;
     /**
@@ -62,14 +51,33 @@ export declare class MainSyncStatusService {
      * `isRefreshInProgress` proves the holder is finished, hung past hangTimeoutMinutes, or dead.
      */
     mainSyncLockPath(repoRoot: string): string;
-    readMainSyncStatus(repoRoot: string): MainSyncStatus | null;
     /**
-     * ATOMIC write (temp file + `rename()` in the same directory). The refresher writes this file while
-     * guards on the blocking path read it; a plain `writeFileSync` truncates first, so a reader landing
-     * in that window gets a torn document. Now that the file is repo-wide the reader may be in another
-     * worktree entirely, which widens the window rather than creating it. See AtomicFile.
+     * The cached status FOR ONE BRANCH — the only read the four main-sync guards perform.
+     *
+     * `branch` is mandatory and is the branch being judged. A branch the last refresh never saw
+     * returns null, which every guard already treats as `no-sync-cache (fail-open)`, so an unknown
+     * branch degrades exactly as a missing file did. Any error (missing, truncated, malformed JSON)
+     * also returns null — this must never throw on the blocking path.
+     */
+    readMainSyncStatus(repoRoot: string, branch: string): MainSyncStatus | null;
+    readMainSyncStatusFile(repoRoot: string): MainSyncStatusFile | null;
+    /**
+     * Merge ONE branch's entry into the existing map, atomically, leaving siblings untouched.
+     *
+     * Read-modify-write rather than replace: this is the writer used by everyone who is NOT the
+     * single-flight refresher (notably pr-gate's post-merge stamp, which holds no lock and knows about
+     * exactly one branch). Replacing the document from there would erase every other worktree's entry
+     * and silently disarm their guards until the next refresh.
      */
     writeMainSyncStatus(repoRoot: string, status: MainSyncStatus): void;
+    /**
+     * Replace the WHOLE document — only the winning refresher may do this.
+     *
+     * ATOMIC (temp file + `rename()` in the same directory). The refresher writes this file while
+     * guards on the blocking path read it, possibly from another worktree; a plain `writeFileSync`
+     * truncates first, so a reader landing in that window gets a torn document. See AtomicFile.
+     */
+    writeMainSyncStatusFile(repoRoot: string, file: MainSyncStatusFile): void;
     readMainSyncLock(repoRoot: string): MainSyncLock | null;
     writeMainSyncLock(repoRoot: string, lock: MainSyncLock): void;
     isLockStale(lock: MainSyncLock, hangTimeoutMinutes: number, now?: number): boolean;
@@ -91,11 +99,42 @@ export declare class MainSyncStatusService {
     inProcessLock(now?: number, pid?: number): MainSyncLock;
     finishedLock(started: number): MainSyncLock;
     /**
-     * The SLOW path, run only inside the detached refresher. Computes every cached signal the
-     * feature-branch-guard needs. Never run on the hook's blocking path.
+     * The SLOW path for ONE branch: the branch checked out in `repoRoot`. Runs its own fetch and its
+     * own `gh` query, so it is the right entry point for a single-worktree caller and for tests.
+     * The refresher uses computeAllMainSyncStatuses instead — see there for why.
      */
     computeMainSyncStatus(repoRoot: string): MainSyncStatus;
+    /**
+     * The SLOW path for EVERY branch this repo has checked out — what the detached refresher runs.
+     *
+     * The cache is shared by all worktrees but was written for one branch, so only one worktree's
+     * guards were ever armed. Enumerating the worktrees here and writing all of their branches in one
+     * atomic map arms every worktree off a single refresh.
+     *
+     * NETWORK COST DOES NOT SCALE WITH BRANCH COUNT, which is the whole reason this is a separate
+     * method: ONE `git fetch` and ONE repo-wide `gh pr list` for all N branches (the old code asked
+     * `gh` twice per branch, so looping it would have cost 2N round trips). Everything after that is
+     * local git in each worktree — merge-base, rev-parse, diff, ls-files.
+     *
+     * The map is rebuilt from the LIVE worktree set every refresh, so a deleted branch or removed
+     * worktree simply stops appearing. No pruning pass, no unbounded growth.
+     */
+    computeAllMainSyncStatuses(repoRoot: string): MainSyncStatusFile;
+    private hasBranch;
+    /**
+     * One branch's status, computed in `worktreePath` (the tree that has it checked out — the
+     * working-tree overlap signals are only correct from there). Does NOT fetch and does NOT call
+     * `gh`: both are done once per refresh by the caller.
+     */
+    private computeBranchStatus;
     squashRecoverySteps(currentBranch: string): string[];
+    /**
+     * Synchronously stamp a clean "up to date with main" status — call right after a successful merge.
+     *
+     * This is the one writer that takes NO lock, and it knows about exactly one branch. It therefore
+     * goes through writeMainSyncStatus, which MERGES its entry into the existing map; writing a whole
+     * document from here would wipe every other worktree's entry.
+     */
     stampCleanMainSyncStatus(repoRoot: string): void;
     /**
      * Refresh `origin/main` WITHOUT writing `.git/FETCH_HEAD`.
@@ -121,14 +160,27 @@ export declare class MainSyncStatusService {
     private localMainHash;
     private changedFiles;
     private featureChangedFiles;
-    private detectMergedPr;
-    private detectOpenPr;
+    /**
+     * ONE repo-wide `gh pr list` giving every branch's merged/open PR — replaces the two per-branch
+     * `--head <branch>` queries. `--limit 200` bounds it; a branch whose only PR is older than that
+     * falls out of the index and reads as "no PR", which is the fail-OPEN direction (no merged PR =
+     * no block), the same way a missing `gh` or an offline machine already degraded.
+     */
+    private loadPullRequestIndex;
+    /**
+     * A `main` entry synthesised WITHOUT a worktree standing on main. Carries only the two hashes
+     * read-stale-guard / stale-main-bash-guard actually compare (originMain vs the live tree's
+     * ancestry) — never merged, never conflicting, so it can only ever produce the stale-main verdict.
+     */
+    private mainOnlyStatus;
     private benignStatus;
 }
 export declare function mainSyncStatusPath(repoRoot: string): string;
 export declare function mainSyncLockPath(repoRoot: string): string;
-export declare function readMainSyncStatus(repoRoot: string): MainSyncStatus | null;
+export declare function readMainSyncStatus(repoRoot: string, branch: string): MainSyncStatus | null;
+export declare function readMainSyncStatusFile(repoRoot: string): MainSyncStatusFile | null;
 export declare function writeMainSyncStatus(repoRoot: string, status: MainSyncStatus): void;
+export declare function writeMainSyncStatusFile(repoRoot: string, file: MainSyncStatusFile): void;
 export declare function readMainSyncLock(repoRoot: string): MainSyncLock | null;
 export declare function writeMainSyncLock(repoRoot: string, lock: MainSyncLock): void;
 export declare function isLockStale(lock: MainSyncLock, hangTimeoutMinutes: number, now?: number): boolean;
@@ -137,5 +189,6 @@ export declare function tryAcquireMainSyncLock(repoRoot: string, hangTimeoutMinu
 export declare function inProcessLock(now?: number, pid?: number): MainSyncLock;
 export declare function finishedLock(started: number): MainSyncLock;
 export declare function computeMainSyncStatus(repoRoot: string): MainSyncStatus;
+export declare function computeAllMainSyncStatuses(repoRoot: string): MainSyncStatusFile;
 export declare function squashRecoverySteps(currentBranch: string): string[];
 export declare function stampCleanMainSyncStatus(repoRoot: string): void;

package/src/main-sync-status.js

@@ -1,10 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MainSyncStatusService = exports.MainSyncLock = exports.MainSyncStatus = exports.DEFAULT_HANG_TIMEOUT_MINUTES = void 0;
+exports.MainSyncStatusService = exports.MainSyncLock = exports.DEFAULT_HANG_TIMEOUT_MINUTES = exports.MAIN_SYNC_STATUS_VERSION = exports.PullRequestIndex = exports.MainSyncStatusFile = exports.MainSyncStatus = void 0;
 exports.mainSyncStatusPath = mainSyncStatusPath;
 exports.mainSyncLockPath = mainSyncLockPath;
 exports.readMainSyncStatus = readMainSyncStatus;
+exports.readMainSyncStatusFile = readMainSyncStatusFile;
 exports.writeMainSyncStatus = writeMainSyncStatus;
+exports.writeMainSyncStatusFile = writeMainSyncStatusFile;
 exports.readMainSyncLock = readMainSyncLock;
 exports.writeMainSyncLock = writeMainSyncLock;
 exports.isLockStale = isLockStale;
@@ -13,6 +15,7 @@ exports.tryAcquireMainSyncLock = tryAcquireMainSyncLock;
 exports.inProcessLock = inProcessLock;
 exports.finishedLock = finishedLock;
 exports.computeMainSyncStatus = computeMainSyncStatus;
+exports.computeAllMainSyncStatuses = computeAllMainSyncStatuses;
 exports.squashRecoverySteps = squashRecoverySteps;
 exports.stampCleanMainSyncStatus = stampCleanMainSyncStatus;
 const tslib_1 = require("tslib");
@@ -21,8 +24,14 @@ const fs = tslib_1.__importStar(require("fs"));
 const path = tslib_1.__importStar(require("path"));
 const inversify_1 = require("inversify");
 const atomic_file_1 = require("./atomic-file");
+const main_sync_file_1 = require("./main-sync-file");
+Object.defineProperty(exports, "MAIN_SYNC_STATUS_VERSION", { enumerable: true, get: function () { return main_sync_file_1.MAIN_SYNC_STATUS_VERSION; } });
+Object.defineProperty(exports, "MainSyncStatus", { enumerable: true, get: function () { return main_sync_file_1.MainSyncStatus; } });
+Object.defineProperty(exports, "MainSyncStatusFile", { enumerable: true, get: function () { return main_sync_file_1.MainSyncStatusFile; } });
+Object.defineProperty(exports, "PullRequestIndex", { enumerable: true, get: function () { return main_sync_file_1.PullRequestIndex; } });
 const state_dir_1 = require("./state-dir");
 const to_error_1 = require("./to-error");
+const worktrees_1 = require("./worktrees");
 // Shared "is my feature branch healthy relative to origin/main?" state. The SLOW signals (git fetch +
 // merge-base + same-file-overlap + a merged-PR lookup) are computed by the ai-hook-rules refresher in a
 // DETACHED background process; the feature-branch-guard only READS this cached file. pr-gate's merge
@@ -33,39 +42,6 @@ const MAIN_SYNC_STATUS_FILE = 'main-sync-status.json';
 const MAIN_SYNC_LOCK_FILE = 'main-sync.lock.json';
 const LOCK_STATE_INPROCESS = 'inprocess';
 const LOCK_STATE_FINISHED = 'finished';
-// Data-only (per CLAUDE.md, classes for data).
-class MainSyncStatus {
-    branch;
-    branchAlreadyMerged;
-    mergedPr;
-    hasForkPoint;
-    forkPoint;
-    originMain;
-    featureHead;
-    conflict;
-    conflictFiles;
-    timestamp;
-    // An OPEN (not merged) PR tracking this branch, if any — '' = none or not-yet-known. Advisory.
-    // Kept OUT of the positional constructor (a defaulted field) so existing call sites don't churn.
-    openPr = '';
-    // The LOCAL refs/heads/main hash — '' = main does not exist locally (fresh clone / worktree) or
-    // could not be read. Paired with `originMain`, this is what tells the read-stale-guard whether a
-    // checked-out `main` is behind its remote. Defaulted field for the same reason as `openPr`.
-    localMain = '';
-    constructor(branch, branchAlreadyMerged, mergedPr, hasForkPoint, forkPoint, originMain, featureHead, conflict, conflictFiles, timestamp) {
-        this.branch = branch;
-        this.branchAlreadyMerged = branchAlreadyMerged;
-        this.mergedPr = mergedPr;
-        this.hasForkPoint = hasForkPoint;
-        this.forkPoint = forkPoint;
-        this.originMain = originMain;
-        this.featureHead = featureHead;
-        this.conflict = conflict;
-        this.conflictFiles = conflictFiles;
-        this.timestamp = timestamp;
-    }
-}
-exports.MainSyncStatus = MainSyncStatus;
 // Concurrency state machine for the detached refresher. `started` is epoch ms. `pid` is the refresher
 // process's pid (0 = unknown) — used so a KILLED refresher doesn't wedge `inprocess` for the timeout.
 class MainSyncLock {
@@ -86,9 +62,13 @@ exports.MainSyncLock = MainSyncLock;
 let MainSyncStatusService = class MainSyncStatusService {
     dotDir;
     atomicFile;
-    constructor(dotDir = state_dir_1.dotWebpieces, atomicFile = new atomic_file_1.AtomicFile()) {
+    store;
+    worktrees;
+    constructor(dotDir = state_dir_1.dotWebpieces, atomicFile = new atomic_file_1.AtomicFile(), store = new main_sync_file_1.MainSyncFileStore(atomicFile), worktrees = new worktrees_1.WorktreeService()) {
         this.dotDir = dotDir;
         this.atomicFile = atomicFile;
+        this.store = store;
+        this.worktrees = worktrees;
     }
     /**
      * SHARED scope: `<primary>/.webpieces/main-sync-status.json`, one per repo.
@@ -97,14 +77,13 @@ let MainSyncStatusService = class MainSyncStatusService {
      * one `.git`, one `origin/main`, one fetch, one answer. A per-worktree copy under single-flight
      * would only ever be written for whichever worktree won the lock anyway.
      *
-     * KNOWN CONSEQUENCE, stated plainly rather than discovered later: the file's CONTENT is keyed to
-     * one branch (`branch`, `featureHead`, `conflict`, `conflictFiles`), and every reader fails OPEN
-     * when the cached branch is not the branch being judged (`merged-branch-bash-guard` and
-     * `stale-main-bash-guard` both log `stale-cross-branch-cache (fail-open)`). With several worktrees
-     * on several branches, the losers of the lock therefore see a cross-branch cache and their guards
-     * allow rather than block. That is the fail-SAFE direction and it is inherent to single-flight, not
-     * to the shared path — but making the entries branch-keyed (a map of branch → status, written
-     * atomically) is the obvious follow-up.
+     * FORMERLY a known defect, now fixed: the file's CONTENT used to be keyed to ONE branch, and every
+     * reader fails OPEN when the cached branch is not the branch being judged (`stale-cross-branch-cache
+     * (fail-open)`). With several worktrees on several branches, only the winner of the lock was ever
+     * described, so every other worktree's guards abstained — and which one was armed thrashed as the
+     * lock changed hands. The file is now a MAP of branch -> status (see MainSyncStatusFile): the single
+     * winning refresher enumerates every worktree and records all of their branches in one atomic write,
+     * so one fetch arms everyone. Single-flight is unchanged; only what the winner writes changed.
      */
     mainSyncStatusPath(repoRoot) {
         return this.dotDir.sharedFile(repoRoot, MAIN_SYNC_STATUS_FILE);
@@ -126,33 +105,41 @@ let MainSyncStatusService = class MainSyncStatusService {
     mainSyncLockPath(repoRoot) {
         return this.dotDir.sharedFile(repoRoot, MAIN_SYNC_LOCK_FILE);
     }
-    // Pure read — any error (missing file, malformed JSON) returns null so the guard fails OPEN.
-    readMainSyncStatus(repoRoot) {
-        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions
-        try {
-            const statusPath = this.mainSyncStatusPath(repoRoot);
-            if (!fs.existsSync(statusPath))
-                return null;
-            const raw = JSON.parse(fs.readFileSync(statusPath, 'utf8'));
-            const status = new MainSyncStatus(raw.branch ?? '', raw.branchAlreadyMerged ?? false, raw.mergedPr ?? '', raw.hasForkPoint ?? true, raw.forkPoint ?? null, raw.originMain ?? '', raw.featureHead ?? '', raw.conflict ?? false, raw.conflictFiles ?? [], raw.timestamp ?? '');
-            status.openPr = raw.openPr ?? '';
-            status.localMain = raw.localMain ?? '';
-            return status;
-        }
-        catch (err) {
-            const error = (0, to_error_1.toError)(err);
-            void error;
-            return null;
-        }
+    /**
+     * The cached status FOR ONE BRANCH — the only read the four main-sync guards perform.
+     *
+     * `branch` is mandatory and is the branch being judged. A branch the last refresh never saw
+     * returns null, which every guard already treats as `no-sync-cache (fail-open)`, so an unknown
+     * branch degrades exactly as a missing file did. Any error (missing, truncated, malformed JSON)
+     * also returns null — this must never throw on the blocking path.
+     */
+    readMainSyncStatus(repoRoot, branch) {
+        return this.store.branchStatus(this.readMainSyncStatusFile(repoRoot), branch);
+    }
+    // The whole branch-keyed document, or null. Callers that need more than one branch use this.
+    readMainSyncStatusFile(repoRoot) {
+        return this.store.readFile(this.mainSyncStatusPath(repoRoot));
     }
     /**
-     * ATOMIC write (temp file + `rename()` in the same directory). The refresher writes this file while
-     * guards on the blocking path read it; a plain `writeFileSync` truncates first, so a reader landing
-     * in that window gets a torn document. Now that the file is repo-wide the reader may be in another
-     * worktree entirely, which widens the window rather than creating it. See AtomicFile.
+     * Merge ONE branch's entry into the existing map, atomically, leaving siblings untouched.
+     *
+     * Read-modify-write rather than replace: this is the writer used by everyone who is NOT the
+     * single-flight refresher (notably pr-gate's post-merge stamp, which holds no lock and knows about
+     * exactly one branch). Replacing the document from there would erase every other worktree's entry
+     * and silently disarm their guards until the next refresh.
      */
     writeMainSyncStatus(repoRoot, status) {
-        this.atomicFile.writeJsonAtomic(this.mainSyncStatusPath(repoRoot), status);
+        this.store.mergeBranch(this.mainSyncStatusPath(repoRoot), status);
+    }
+    /**
+     * Replace the WHOLE document — only the winning refresher may do this.
+     *
+     * ATOMIC (temp file + `rename()` in the same directory). The refresher writes this file while
+     * guards on the blocking path read it, possibly from another worktree; a plain `writeFileSync`
+     * truncates first, so a reader landing in that window gets a torn document. See AtomicFile.
+     */
+    writeMainSyncStatusFile(repoRoot, file) {
+        this.store.writeFile(this.mainSyncStatusPath(repoRoot), file);
     }
     readMainSyncLock(repoRoot) {
         // eslint-disable-next-line @webpieces/no-unmanaged-exceptions
@@ -249,16 +236,59 @@ let MainSyncStatusService = class MainSyncStatusService {
         return new MainSyncLock(LOCK_STATE_FINISHED, started, 0);
     }
     /**
-     * The SLOW path, run only inside the detached refresher. Computes every cached signal the
-     * feature-branch-guard needs. Never run on the hook's blocking path.
+     * The SLOW path for ONE branch: the branch checked out in `repoRoot`. Runs its own fetch and its
+     * own `gh` query, so it is the right entry point for a single-worktree caller and for tests.
+     * The refresher uses computeAllMainSyncStatuses instead — see there for why.
      */
-    // webpieces-disable max-lines-new-methods -- one cohesive slow-path computation
     computeMainSyncStatus(repoRoot) {
-        const branch = this.gitBranch(repoRoot);
-        const mergedPr = this.detectMergedPr(repoRoot, branch);
-        const openPr = this.detectOpenPr(repoRoot, branch);
         // Best-effort network refresh; offline just means we evaluate against the last-fetched ref.
         this.fetchOriginMain(repoRoot);
+        return this.computeBranchStatus(repoRoot, this.gitBranch(repoRoot), this.loadPullRequestIndex(repoRoot));
+    }
+    /**
+     * The SLOW path for EVERY branch this repo has checked out — what the detached refresher runs.
+     *
+     * The cache is shared by all worktrees but was written for one branch, so only one worktree's
+     * guards were ever armed. Enumerating the worktrees here and writing all of their branches in one
+     * atomic map arms every worktree off a single refresh.
+     *
+     * NETWORK COST DOES NOT SCALE WITH BRANCH COUNT, which is the whole reason this is a separate
+     * method: ONE `git fetch` and ONE repo-wide `gh pr list` for all N branches (the old code asked
+     * `gh` twice per branch, so looping it would have cost 2N round trips). Everything after that is
+     * local git in each worktree — merge-base, rev-parse, diff, ls-files.
+     *
+     * The map is rebuilt from the LIVE worktree set every refresh, so a deleted branch or removed
+     * worktree simply stops appearing. No pruning pass, no unbounded growth.
+     */
+    computeAllMainSyncStatuses(repoRoot) {
+        this.fetchOriginMain(repoRoot);
+        const index = this.loadPullRequestIndex(repoRoot);
+        const branches = {};
+        for (const tree of this.worktrees.listWorktrees(repoRoot)) {
+            // Detached HEAD (and a bare worktree) has no branch to key an entry on. Skipping it must
+            // not stop the others being recorded, which is why this is a `continue`, not a bail-out.
+            if (tree.branch === '' || this.hasBranch(branches, tree.branch))
+                continue;
+            branches[tree.branch] = this.computeBranchStatus(tree.path, tree.branch, index);
+        }
+        // `main` always present, even with no worktree on it: read-stale-guard's state A looks itself
+        // up under 'main', and an absent entry there would silently disarm the stale-main block.
+        if (!this.hasBranch(branches, 'main'))
+            branches['main'] = this.mainOnlyStatus(repoRoot);
+        return new main_sync_file_1.MainSyncStatusFile(main_sync_file_1.MAIN_SYNC_STATUS_VERSION, new Date().toISOString(), branches);
+    }
+    hasBranch(branches, branch) {
+        return Object.prototype.hasOwnProperty.call(branches, branch);
+    }
+    /**
+     * One branch's status, computed in `worktreePath` (the tree that has it checked out — the
+     * working-tree overlap signals are only correct from there). Does NOT fetch and does NOT call
+     * `gh`: both are done once per refresh by the caller.
+     */
+    // webpieces-disable max-lines-new-methods -- one cohesive slow-path computation
+    computeBranchStatus(repoRoot, branch, index) {
+        const mergedPr = index.mergedFor(branch);
+        const openPr = index.openFor(branch);
         const head = this.capture(repoRoot, 'git', ['rev-parse', 'HEAD']);
         const originMain = this.capture(repoRoot, 'git', ['rev-parse', 'origin/main']);
         const localMain = this.localMainHash(repoRoot);
@@ -273,7 +303,7 @@ let MainSyncStatusService = class MainSyncStatusService {
         }
         const forkPoint = this.capture(repoRoot, 'git', ['merge-base', 'origin/main', 'HEAD']);
         if (!forkPoint.ok || forkPoint.out === '') {
-            const noFork = new MainSyncStatus(branch, mergedPr !== '', mergedPr, false, null, originMain.out, featureHead, false, [], new Date().toISOString());
+            const noFork = new main_sync_file_1.MainSyncStatus(branch, mergedPr !== '', mergedPr, false, null, originMain.out, featureHead, false, [], new Date().toISOString());
             noFork.openPr = openPr;
             noFork.localMain = localMain;
             return noFork;
@@ -281,7 +311,7 @@ let MainSyncStatusService = class MainSyncStatusService {
         const featureFiles = new Set(this.featureChangedFiles(repoRoot, forkPoint.out));
         const mainFiles = this.changedFiles(repoRoot, forkPoint.out, 'origin/main');
         const conflictFiles = mainFiles.filter((file) => featureFiles.has(file));
-        const status = new MainSyncStatus(branch, mergedPr !== '', mergedPr, true, forkPoint.out, originMain.out, featureHead, conflictFiles.length > 0, conflictFiles, new Date().toISOString());
+        const status = new main_sync_file_1.MainSyncStatus(branch, mergedPr !== '', mergedPr, true, forkPoint.out, originMain.out, featureHead, conflictFiles.length > 0, conflictFiles, new Date().toISOString());
         status.openPr = openPr;
         status.localMain = localMain;
         return status;
@@ -302,7 +332,13 @@ let MainSyncStatusService = class MainSyncStatusService {
             '5. If a PR exists:               open a NEW PR for the -v2 branch and close the old one.',
         ];
     }
-    // Synchronously stamp a clean "up to date with main" status — call right after a successful merge.
+    /**
+     * Synchronously stamp a clean "up to date with main" status — call right after a successful merge.
+     *
+     * This is the one writer that takes NO lock, and it knows about exactly one branch. It therefore
+     * goes through writeMainSyncStatus, which MERGES its entry into the existing map; writing a whole
+     * document from here would wipe every other worktree's entry.
+     */
     stampCleanMainSyncStatus(repoRoot) {
         // eslint-disable-next-line @webpieces/no-unmanaged-exceptions
         try {
@@ -311,7 +347,7 @@ let MainSyncStatusService = class MainSyncStatusService {
             const featureHead = this.capture(repoRoot, 'git', ['rev-parse', 'HEAD']);
             if (!originMain.ok || !featureHead.ok)
                 return;
-            const status = new MainSyncStatus(branch, false, '', true, originMain.out, originMain.out, featureHead.out, false, [], new Date().toISOString());
+            const status = new main_sync_file_1.MainSyncStatus(branch, false, '', true, originMain.out, originMain.out, featureHead.out, false, [], new Date().toISOString());
             status.localMain = this.localMainHash(repoRoot);
             this.writeMainSyncStatus(repoRoot, status);
         }
@@ -411,30 +447,44 @@ let MainSyncStatusService = class MainSyncStatusService {
         add(['ls-files', '--others', '--exclude-standard']); // untracked new files (respects .gitignore)
         return [...out];
     }
-    // Has this feature branch already been merged into main? Reliable signal: a MERGED PR exists.
-    detectMergedPr(repoRoot, branch) {
-        if (!branch || branch === 'main')
-            return '';
-        const result = this.capture(repoRoot, 'gh', ['pr', 'list', '--head', branch, '--state', 'merged', '--json', 'number', '--jq', '.[0].number']);
-        return result.ok ? result.out : '';
+    /**
+     * ONE repo-wide `gh pr list` giving every branch's merged/open PR — replaces the two per-branch
+     * `--head <branch>` queries. `--limit 200` bounds it; a branch whose only PR is older than that
+     * falls out of the index and reads as "no PR", which is the fail-OPEN direction (no merged PR =
+     * no block), the same way a missing `gh` or an offline machine already degraded.
+     */
+    loadPullRequestIndex(repoRoot) {
+        const result = this.capture(repoRoot, 'gh', [
+            'pr', 'list', '--state', 'all', '--json', 'number,headRefName,state', '--limit', '200',
+        ]);
+        if (!result.ok || result.out === '')
+            return new main_sync_file_1.PullRequestIndex({}, {});
+        return this.store.indexPullRequests(result.out);
     }
-    // An OPEN PR tracking this branch, if any. Best-effort/advisory.
-    detectOpenPr(repoRoot, branch) {
-        if (!branch || branch === 'main')
-            return '';
-        const result = this.capture(repoRoot, 'gh', ['pr', 'list', '--head', branch, '--state', 'open', '--json', 'number', '--jq', '.[0].number']);
-        return result.ok ? result.out : '';
+    /**
+     * A `main` entry synthesised WITHOUT a worktree standing on main. Carries only the two hashes
+     * read-stale-guard / stale-main-bash-guard actually compare (originMain vs the live tree's
+     * ancestry) — never merged, never conflicting, so it can only ever produce the stale-main verdict.
+     */
+    mainOnlyStatus(repoRoot) {
+        const originMain = this.capture(repoRoot, 'git', ['rev-parse', 'origin/main']);
+        const localMain = this.localMainHash(repoRoot);
+        const status = new main_sync_file_1.MainSyncStatus('main', false, '', true, localMain === '' ? null : localMain, originMain.ok ? originMain.out : '', localMain, false, [], new Date().toISOString());
+        status.localMain = localMain;
+        return status;
     }
     // A benign status that never blocks — used when origin/main can't be resolved.
     benignStatus(branch, featureHead) {
-        return new MainSyncStatus(branch, false, '', true, null, '', featureHead, false, [], new Date().toISOString());
+        return new main_sync_file_1.MainSyncStatus(branch, false, '', true, null, '', featureHead, false, [], new Date().toISOString());
     }
 };
 exports.MainSyncStatusService = MainSyncStatusService;
 exports.MainSyncStatusService = MainSyncStatusService = tslib_1.__decorate([
     (0, inversify_1.injectable)(inversify_1.bindingScopeValues.Singleton),
     tslib_1.__metadata("design:paramtypes", [state_dir_1.DotWebpieces,
-        atomic_file_1.AtomicFile])
+        atomic_file_1.AtomicFile,
+        main_sync_file_1.MainSyncFileStore,
+        worktrees_1.WorktreeService])
 ], MainSyncStatusService);
 // Temporary migration delegators to MainSyncStatusService — removed once consumers inject it.
 const mainSyncSvc = new MainSyncStatusService();
@@ -443,10 +493,14 @@ function mainSyncStatusPath(repoRoot) { return mainSyncSvc.mainSyncStatusPath(re
 // webpieces-disable no-function-outside-class -- temporary back-compat delegator to MainSyncStatusService; removed once consumers inject it
 function mainSyncLockPath(repoRoot) { return mainSyncSvc.mainSyncLockPath(repoRoot); }
 // webpieces-disable no-function-outside-class -- temporary back-compat delegator to MainSyncStatusService; removed once consumers inject it
-function readMainSyncStatus(repoRoot) { return mainSyncSvc.readMainSyncStatus(repoRoot); }
+function readMainSyncStatus(repoRoot, branch) { return mainSyncSvc.readMainSyncStatus(repoRoot, branch); }
+// webpieces-disable no-function-outside-class -- temporary back-compat delegator to MainSyncStatusService; removed once consumers inject it
+function readMainSyncStatusFile(repoRoot) { return mainSyncSvc.readMainSyncStatusFile(repoRoot); }
 // webpieces-disable no-function-outside-class -- temporary back-compat delegator to MainSyncStatusService; removed once consumers inject it
 function writeMainSyncStatus(repoRoot, status) { mainSyncSvc.writeMainSyncStatus(repoRoot, status); }
 // webpieces-disable no-function-outside-class -- temporary back-compat delegator to MainSyncStatusService; removed once consumers inject it
+function writeMainSyncStatusFile(repoRoot, file) { mainSyncSvc.writeMainSyncStatusFile(repoRoot, file); }
+// webpieces-disable no-function-outside-class -- temporary back-compat delegator to MainSyncStatusService; removed once consumers inject it
 function readMainSyncLock(repoRoot) { return mainSyncSvc.readMainSyncLock(repoRoot); }
 // webpieces-disable no-function-outside-class -- temporary back-compat delegator to MainSyncStatusService; removed once consumers inject it
 function writeMainSyncLock(repoRoot, lock) { mainSyncSvc.writeMainSyncLock(repoRoot, lock); }
@@ -463,6 +517,8 @@ function finishedLock(started) { return mainSyncSvc.finishedLock(started); }
 // webpieces-disable no-function-outside-class -- temporary back-compat delegator to MainSyncStatusService; removed once consumers inject it
 function computeMainSyncStatus(repoRoot) { return mainSyncSvc.computeMainSyncStatus(repoRoot); }
 // webpieces-disable no-function-outside-class -- temporary back-compat delegator to MainSyncStatusService; removed once consumers inject it
+function computeAllMainSyncStatuses(repoRoot) { return mainSyncSvc.computeAllMainSyncStatuses(repoRoot); }
+// webpieces-disable no-function-outside-class -- temporary back-compat delegator to MainSyncStatusService; removed once consumers inject it
 function squashRecoverySteps(currentBranch) { return mainSyncSvc.squashRecoverySteps(currentBranch); }
 // webpieces-disable no-function-outside-class -- temporary back-compat delegator to MainSyncStatusService; removed once consumers inject it
 function stampCleanMainSyncStatus(repoRoot) { mainSyncSvc.stampCleanMainSyncStatus(repoRoot); }