commandmate 0.45.1 → 0.46.0

package/dist/server/src/lib/polling/response-dedup.js

@@ -55,11 +55,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.DUPLICATE_RESPONSE_SKIP_LOG_TICK_INTERVAL = exports.STRUCTURED_HISTORY_RECHECK_TICK_INTERVAL = void 0;
 exports.isDuplicateResponse = isDuplicateResponse;
 exports.claimDuplicateResponseSkipLog = claimDuplicateResponseSkipLog;
+exports.resetDuplicateResponseSkipStreak = resetDuplicateResponseSkipStreak;
 exports.markStructuredHistoryRecheckPending = markStructuredHistoryRecheckPending;
 exports.settleStructuredHistoryRecheck = settleStructuredHistoryRecheck;
 exports.claimStructuredHistoryRecheck = claimStructuredHistoryRecheck;
 exports.clearResponseHashCache = clearResponseHashCache;
 exports.renameResponseHashCacheKey = renameResponseHashCacheKey;
+exports.renameResponseHashCacheKeys = renameResponseHashCacheKeys;
 const crypto_1 = require("crypto");
 const global_state_1 = require("../global-state");
 const responseHashCache = (0, global_state_1.getOrInitGlobal)('__responseHashCache', () => new Map());
@@ -97,7 +99,9 @@ exports.STRUCTURED_HISTORY_RECHECK_TICK_INTERVAL = 3;
  *
  * On `globalThis` for the same reason `responseHashCache` is, and cleared and
  * moved at exactly the same moments — see the module comment. A new
- * (non-duplicate) response restarts it in {@link isDuplicateResponse}.
+ * (non-duplicate) response restarts it in {@link isDuplicateResponse}, and a
+ * tick that reads the frame and finds no reply on it ends the run without
+ * touching the hash — see {@link resetDuplicateResponseSkipStreak} (#3552).
  */
 const duplicateResponseSkipStreak = (0, global_state_1.getOrInitGlobal)('__duplicateResponseSkipStreak', () => new Map());
 /**
@@ -148,6 +152,28 @@ function claimDuplicateResponseSkipLog(pollerKey) {
     const suppressed = consecutive === 1 ? 0 : exports.DUPLICATE_RESPONSE_SKIP_LOG_TICK_INTERVAL - 1;
     return { log, consecutive, suppressed };
 }
+/**
+ * End the current run of duplicate response ticks for this pollerKey without
+ * touching the cached hash (Issue #3552).
+ *
+ * Called by `response-checker` on the ticks that read the frame and decide it
+ * is not a duplicate of the saved reply: an unfinished frame
+ * (`extractCompletedTurn`), a finished frame with a live prompt on it, and a
+ * finished frame whose response is empty. The reply is no longer on screen, so
+ * if the same reply comes back the next duplicate is the first of a new run and
+ * logs. The hash stays: whether the returning reply is saved again is the
+ * guard's question (#1268), and this only thins the log line (#3519).
+ *
+ * Not called at the entrance of a finished frame — that would make every
+ * duplicate tick the first of its run — nor on a tick that skipped extraction
+ * on the line count (null) or returned on the cursor: neither says the reply
+ * has left the screen (the same judgement as #3538).
+ *
+ * @param pollerKey - Poller key ("worktreeId:instanceId")
+ */
+function resetDuplicateResponseSkipStreak(pollerKey) {
+    duplicateResponseSkipStreak.delete(pollerKey);
+}
 /**
  * Note that the transcript reader has unfinished business for this pollerKey
  * (Issue #2399).
@@ -233,6 +259,55 @@ function clearResponseHashCache(pollerKey) {
     // Issue #3519: the skip count is about the same hash.
     duplicateResponseSkipStreak.delete(pollerKey);
 }
+/** Remove everything held under `key` and return it. */
+function takeResponseDedupState(key) {
+    const state = {
+        hash: responseHashCache.get(key),
+        recheck: structuredHistoryRecheckCache.get(key),
+        streak: duplicateResponseSkipStreak.get(key),
+    };
+    responseHashCache.delete(key);
+    structuredHistoryRecheckCache.delete(key);
+    duplicateResponseSkipStreak.delete(key);
+    return state;
+}
+/**
+ * Write state lifted by {@link takeResponseDedupState} under `key`.
+ *
+ * `replaceRecheckWithHash` is the one difference between the batch and the
+ * single rename (Issue #3553): when a hash lands, the batch also replaces the
+ * recheck under `key` — deleting it when the source had none — so a recheck
+ * owed for a different turn is not attached to the hash that just arrived. The
+ * single rename keeps its earlier behaviour and leaves such a recheck alone.
+ */
+function putResponseDedupState(key, state, replaceRecheckWithHash) {
+    if (state.hash !== undefined)
+        responseHashCache.set(key, state.hash);
+    // Issue #2399: the recheck caveat moves with the hash it is about. Leaving it
+    // behind would strand a turn whose transcript is still open — the new key
+    // starts owing nothing, so every later tick returns at the dedup guard and the
+    // Markdown row is never written. It moves without a hash too: the
+    // `lineCountIsCursor` path marks it with no hash cached.
+    if (state.recheck !== undefined) {
+        structuredHistoryRecheckCache.set(key, state.recheck);
+    }
+    else if (replaceRecheckWithHash && state.hash !== undefined) {
+        structuredHistoryRecheckCache.delete(key);
+    }
+    // Issue #3519: the skip count moves with the hash too, so a rename mid-run
+    // does not restart the thinning and log as if a new run had begun.
+    // Issue #3552: whenever the hash under `newKey` is replaced, so is its count
+    // — a count left over from the hash that was there before is about a
+    // different reply (the same rule as `renamePromptHashCacheKey`, #3538).
+    if (state.hash === undefined)
+        return;
+    if (state.streak !== undefined) {
+        duplicateResponseSkipStreak.set(key, state.streak);
+    }
+    else {
+        duplicateResponseSkipStreak.delete(key);
+    }
+}
 /**
  * Move the cached hash from one pollerKey to another.
  *
@@ -241,7 +316,8 @@ function clearResponseHashCache(pollerKey) {
  * during THIS turn?", and the turn does not end just because the ID moved —
  * dropping it would re-save the screen currently on display.
  *
- * No-op when nothing is cached under `oldKey`.
+ * No-op when nothing is cached under `oldKey`. A batch of renames whose keys
+ * overlap must go through {@link renameResponseHashCacheKeys} instead.
  *
  * @param oldKey - Poller key the cache entry lives under
  * @param newKey - Poller key it should live under
@@ -249,22 +325,30 @@ function clearResponseHashCache(pollerKey) {
 function renameResponseHashCacheKey(oldKey, newKey) {
     if (oldKey === newKey)
         return;
-    const hash = responseHashCache.get(oldKey);
-    responseHashCache.delete(oldKey);
-    if (hash !== undefined)
-        responseHashCache.set(newKey, hash);
-    // Issue #2399: the recheck caveat moves with the hash it is about. Leaving it
-    // behind would strand a turn whose transcript is still open — the new key
-    // starts owing nothing, so every later tick returns at the dedup guard and the
-    // Markdown row is never written.
-    const ticksToWait = structuredHistoryRecheckCache.get(oldKey);
-    structuredHistoryRecheckCache.delete(oldKey);
-    if (ticksToWait !== undefined)
-        structuredHistoryRecheckCache.set(newKey, ticksToWait);
-    // Issue #3519: the skip count moves with the hash too, so a rename mid-run
-    // does not restart the thinning and log as if a new run had begun.
-    const streak = duplicateResponseSkipStreak.get(oldKey);
-    duplicateResponseSkipStreak.delete(oldKey);
-    if (streak !== undefined)
-        duplicateResponseSkipStreak.set(newKey, streak);
+    putResponseDedupState(newKey, takeResponseDedupState(oldKey), false);
+}
+/**
+ * Move the response dedup state of a whole batch of pollerKeys (Issue #3553).
+ *
+ * Every source key is lifted before any destination is written, so a swap
+ * (A→B, B→A) or a chain (A→B→C) cannot overwrite a source that has not moved
+ * yet — calling {@link renameResponseHashCacheKey} once per pair would leave
+ * A with its own state and B empty after a swap. Each destination ends up with
+ * exactly what its source held: hash, skip count and recheck, the recheck
+ * moving even without a hash. A recheck already at the destination is
+ * replaced along with the hash, never kept beside the moved one.
+ *
+ * Pairs with `oldKey === newKey` are ignored.
+ *
+ * @param renames - Poller key moves applied together
+ */
+function renameResponseHashCacheKeys(renames) {
+    const lifted = [];
+    for (const { oldKey, newKey } of renames) {
+        if (oldKey === newKey)
+            continue;
+        lifted.push({ newKey, state: takeResponseDedupState(oldKey) });
+    }
+    for (const { newKey, state } of lifted)
+        putResponseDedupState(newKey, state, true);
 }

package/dist/server/src/lib/polling/response-poller-core.js

@@ -532,8 +532,11 @@ function splitPollerKey(pollerKey) {
  * one in-flight TUI response may be truncated at the rename boundary; the next
  * turn accumulates normally.
  *
- * Takes the whole batch because IDs can swap (A→B, B→A): every source key is
- * removed before any destination key is written.
+ * Takes the whole batch because IDs can swap (A→B, B→A) or chain (A→B→C):
+ * every source key is removed before any destination key is written. That
+ * includes the dedup state (Issue #3553) — of running pollers and paused chains
+ * alike — which is lifted off every source key in one pass and only then
+ * written, so a pair handled early cannot overwrite a source handled later.
  *
  * @param renames - Worktree ID pairs being applied
  * @param resolveCliToolId - Maps a poller's (worktree, instance) back to its CLI
@@ -596,33 +599,21 @@ function migrateResponsePollerWorktreeIds(renames, resolveCliToolId) {
         coordinator.pendingRestart.delete(move.oldKey);
         carried.set(move.newKey, { startedAt: exports.pollingStartTimes.get(move.oldKey) });
         exports.pollingStartTimes.delete(move.oldKey);
-        (0, prompt_dedup_1.renamePromptHashCacheKey)(move.oldKey, move.newKey);
-        (0, response_dedup_1.renameResponseHashCacheKey)(move.oldKey, move.newKey);
-        // Issue #1695: the prompt hash moved on the line above, so the guard keeps
-        // suppressing the prompt on screen under the new ID. Its tally has to move
-        // with it, or `capture --json` reports zero skips for a session that is
-        // still skipping. Old worktree ID comes back out of the key we just left.
-        const movedFrom = splitPollerKey(move.oldKey);
-        if (movedFrom) {
-            (0, prompt_dedup_state_1.renamePromptDedupSkips)(movedFrom.worktreeId, move.newWorktreeId, move.cliToolId, move.instanceId);
-        }
         (0, tui_accumulator_1.clearTuiAccumulator)(move.oldKey);
     }
+    // Stop the abandoned pollers before any dedup state is written: the stop
+    // clears every cache under its key, and that key can be the destination of
+    // another move in this batch (A:x paused → B:x while B:x is abandoned).
+    // Stopped afterwards, it erased the state that had just arrived (#3553).
+    // An abandoned key is never a move source, so nothing still to be moved is
+    // lost here; and the paused chains are collected after it, as before, so a
+    // pause the stop ends is not carried.
     for (const pollerKey of abandoned) {
         stopPollingByKey(pollerKey);
         logger.warn('poller:migrate-abandoned', { pollerKey });
     }
-    // Phase 2: restart each poller under its new identity.
-    for (const move of moves) {
-        const startedAt = carried.get(move.newKey)?.startedAt;
-        exports.pollingStartTimes.set(move.newKey, startedAt ?? Date.now());
-        if (isFullScreenTui(move.cliToolId)) {
-            (0, tui_accumulator_1.initTuiAccumulator)(move.newKey);
-        }
-        scheduleNextResponsePoll(move.newWorktreeId, move.cliToolId, move.instanceId);
-    }
-    // Issue #2230: a chain paused on a prompt has no timer, so the loop above
-    // never sees it — but it is holding the response hash for the turn it paused
+    // Issue #2230: a chain paused on a prompt has no timer, so the loops here
+    // never see it — but it is holding the response hash for the turn it paused
     // on, and `/respond` will resume it under the NEW ID. Move the hash and the
     // pause mark with it; the chain itself stays paused until that resume.
     const pausedMoves = [];
@@ -635,11 +626,41 @@ function migrateResponsePollerWorktreeIds(renames, resolveCliToolId) {
             continue;
         pausedMoves.push({ oldKey: pollerKey, newKey: `${newWorktreeId}:${parts.instanceId}` });
     }
+    // Issue #3553: the dedup state of the whole batch moves in one call per map
+    // family, each lifting every source before writing any destination. Re-keyed
+    // pair by pair, a swap left A with its own state and B empty.
+    (0, prompt_dedup_1.renamePromptHashCacheKeys)(moves);
+    (0, response_dedup_1.renameResponseHashCacheKeys)([...moves, ...pausedMoves]);
+    // Issue #1695: the prompt hash moved above, so the guard keeps suppressing
+    // the prompt on screen under the new ID. Its tally has to move with it, or
+    // `capture --json` reports zero skips for a session that is still skipping.
+    // Old worktree ID comes back out of the key being left.
+    (0, prompt_dedup_state_1.renamePromptDedupSkipsBatch)(moves.flatMap((move) => {
+        const movedFrom = splitPollerKey(move.oldKey);
+        return movedFrom
+            ? [{
+                    oldWorktreeId: movedFrom.worktreeId,
+                    newWorktreeId: move.newWorktreeId,
+                    cliToolId: move.cliToolId,
+                    instanceId: move.instanceId,
+                }]
+            : [];
+    }));
+    // Phase 2: restart each poller under its new identity.
+    for (const move of moves) {
+        const startedAt = carried.get(move.newKey)?.startedAt;
+        exports.pollingStartTimes.set(move.newKey, startedAt ?? Date.now());
+        if (isFullScreenTui(move.cliToolId)) {
+            (0, tui_accumulator_1.initTuiAccumulator)(move.newKey);
+        }
+        scheduleNextResponsePoll(move.newWorktreeId, move.cliToolId, move.instanceId);
+    }
+    // Issue #2230: the pause marks of the chains collected above follow their
+    // hashes (moved with the batch). All removed before any is added, for the
+    // same swap reason.
     for (const move of pausedMoves)
         coordinator.pausedOnPrompt.delete(move.oldKey);
-    for (const move of pausedMoves) {
-        (0, response_dedup_1.renameResponseHashCacheKey)(move.oldKey, move.newKey);
+    for (const move of pausedMoves)
         coordinator.pausedOnPrompt.add(move.newKey);
-    }
     return moves;
 }

package/dist/server/src/lib/session/next-action-helper.js

@@ -3,14 +3,14 @@
  * Next Action Helper - Derived state for worktree next actions and review status.
  *
  * Issue #600: UX refresh - provides getNextAction() and getReviewStatus()
- * for Review screen and WorktreeCard display.
+ * for the Review screen (via `/api/worktrees`) and the sidebar row
+ * (`toBranchItem` in `src/types/sidebar.ts`).
  *
  * Uses exhaustive check (satisfies never) pattern to catch future
  * SessionStatus extensions at compile time [DR2-005].
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.NEXT_ACTION_KEYS = void 0;
-exports.isNextActionKey = isNextActionKey;
 exports.getNextAction = getNextAction;
 exports.getReviewStatus = getReviewStatus;
 /**
@@ -31,19 +31,6 @@ exports.NEXT_ACTION_KEYS = {
     checkStalled: 'nextAction.checkStalled',
     running: 'nextAction.running',
 };
-const NEXT_ACTION_KEY_SET = new Set(Object.values(exports.NEXT_ACTION_KEYS));
-/**
- * Whether a value is a key this module produces (Issue #1787).
- *
- * `Worktree.nextAction` is a plain `string` on the wire, and a server that
- * predates this Issue still sends the old English literal. Callers must gate
- * `t()` on this: next-intl reports a missing key by rendering the key path, so
- * feeding it `"Approve / Reject"` would put `worktree.Approve / Reject` on
- * screen. Anything that fails this test is rendered verbatim instead.
- */
-function isNextActionKey(value) {
-    return NEXT_ACTION_KEY_SET.has(value);
-}
 /**
  * Determine the next action for a given session state.
  *

package/dist/server/src/lib/verification/env-clean-gate.js

@@ -39,6 +39,7 @@ exports.ENV_CLEAN_GUIDANCE = exports.MAX_REPORTED_ENV_CHANGES = exports.isLivePi
 exports.resolveRequireEnvClean = resolveRequireEnvClean;
 exports.attributeSessionName = attributeSessionName;
 exports.attributeAnchor = attributeAnchor;
+exports.isZcompdumpEntry = isZcompdumpEntry;
 exports.demoVitestPid = demoVitestPid;
 exports.attributeHomeEntry = attributeHomeEntry;
 exports.resolveTaskSessionName = resolveTaskSessionName;
@@ -200,6 +201,17 @@ exports.readLivePidCwd = readLivePidCwd;
  * established.
  */
 const DEMO_VITEST_HOME_ENTRY = /^\.commandmate-demo-vitest-([1-9]\d*)$/;
+/**
+ * zsh's `compinit` cache: `~/.zcompdump` itself, and the `~/.zcompdump.<host>.<pid>`
+ * scratch file it writes before renaming (#3664). A worker's shell start makes
+ * it; the pid in it is already gone by the time the gate looks. Only these two
+ * shapes — any other `.zcompdump*` name stays a violation.
+ */
+const ZCOMPDUMP_HOME_ENTRY = /^\.zcompdump(?:\.[A-Za-z0-9._-]+\.[1-9]\d*)?$/;
+/** Whether a `$HOME` entry name is a zsh compinit cache file (#3664). */
+function isZcompdumpEntry(name) {
+    return ZCOMPDUMP_HOME_ENTRY.test(name);
+}
 const isLivePid = (pid) => {
     try {
         process.kill(pid, 0);
@@ -581,7 +593,8 @@ function diffEnvSnapshots(baseline, final, context, options = {}) {
         const afterKeys = new Set(after.entries.map((entry) => entry.key));
         // Only `home-entries`, and only by the whole name: the same string under
         // `~/.commandmate` is a different directory and stays counted.
-        const isIgnoredByConfig = (entry) => probeId === 'home-entries' && ignoredHomeEntries.has(entry.key);
+        const isIgnoredByConfig = (entry) => probeId === 'home-entries' &&
+            (ignoredHomeEntries.has(entry.key) || isZcompdumpEntry(entry.key));
         const added = [];
         const ignoredAdded = [];
         const taskSessionAdded = [];

package/dist/server/src/lib/verification/gate-runner.js

@@ -751,7 +751,10 @@ function namesOpencodeInstance(db, worktreeId, instanceId) {
  * gates — the precise failure `verify-completion.sh` was written to catch.
  *
  * Contract files are evidence of the *orchestrator*, not of the agent, so
- * neither side counts them (see {@link CONTRACT_DIR_PREFIX}).
+ * neither side counts them (see {@link CONTRACT_DIR_PREFIX}). Nor is the
+ * orchestrator's module-reference fold commit (orchestrate 6-4, judged by
+ * scope-gate's `collectBranchCommitChanges`): a branch that holds only a fold
+ * has no work of the worker's in it (#3633).
  *
  * ## The opencode second witness (Issue #2043)
  *
@@ -796,18 +799,20 @@ async function evaluateWorkEvidence(worktreePath, baseRef, requireCommit, agentE
     // pathspec is not exclusions alone, and it anchors both patterns at the root
     // rather than at cwd. A setup commit that only carries the contract must not
     // read as a commit's worth of work.
-    const revList = await runGit([
-        'rev-list',
-        '--count',
-        `${base}..HEAD`,
-        '--',
-        ':(top)',
-        `:(exclude,top)${scope_gate_1.CONTRACT_DIR_PREFIX}`,
-    ], worktreePath);
+    const revList = await runGit(['rev-list', `${base}..HEAD`, '--', ':(top)', `:(exclude,top)${scope_gate_1.CONTRACT_DIR_PREFIX}`], worktreePath);
     if (revList.code !== 0) {
-        return done('error', `work-evidence: 'git rev-list --count ${base}..HEAD' failed.`, null);
+        return done('error', `work-evidence: 'git rev-list ${base}..HEAD' failed.`, null);
     }
-    const commitCount = Number.parseInt(revList.stdout.trim(), 10);
+    // The orchestrator's fold commit is not the worker's (#3633), by the same
+    // rule the scope gate drops what only folds touched (#3588).
+    const branchChanges = await (0, scope_gate_1.collectBranchCommitChanges)(worktreePath, base);
+    if ('error' in branchChanges) {
+        return done('error', `work-evidence: ${branchChanges.error}`, null);
+    }
+    const foldShas = new Set(branchChanges.changes.filter((c) => c.fold).map((c) => c.sha));
+    const branchShas = revList.stdout.split('\n').filter((sha) => sha.trim() !== '');
+    const foldCount = branchShas.filter((sha) => foldShas.has(sha)).length;
+    const commitCount = branchShas.length - foldCount;
     // -z -uall for the same reasons scope-gate uses them: the human format
     // C-quotes paths with spaces and joins renames with ` -> `, and the default
     // untracked mode collapses a fresh `.commandmate/tasks/` to one directory
@@ -841,6 +846,7 @@ async function evaluateWorkEvidence(worktreePath, baseRef, requireCommit, agentE
     const summary = `work-evidence: baseRef=${baseRef} commits=${commitCount} uncommitted=${uncommittedCount}` +
         (requireCommit.required ? ' requireCommit=true' : '') +
         ' (contract files excluded)' +
+        (foldCount > 0 ? ` (${foldCount} orchestrator fold commit(s) excluded)` : '') +
         (skillInstalledCount > 0
             ? ` (${skillInstalledCount} CommandMate-installed Skill file(s) excluded)`
             : '') +

package/dist/server/src/lib/verification/scope-gate.js

@@ -30,11 +30,16 @@
  * @module lib/verification/scope-gate
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SCOPE_SKIP_NOT_REQUIRED = exports.SCOPE_SKIP_NO_CONTRACT = exports.ScopeMatcher = exports.CONTRACT_DIR_PREFIX = exports.SCOPE_EXEMPT_CONTRACT_PATH = exports.SCOPE_EXEMPT_ALWAYS_ALLOWED = exports.SCOPE_PATTERN_ARROW = exports.ALWAYS_ALLOWED_PREFIX = exports.SCOPE_ALLOW_GUIDANCE = exports.MAX_REPORTED_VIOLATIONS = void 0;
+exports.SCOPE_SKIP_NOT_REQUIRED = exports.SCOPE_SKIP_NO_CONTRACT = exports.ScopeMatcher = exports.ORCHESTRATOR_FOLD_TRAILER_VALUE = exports.ORCHESTRATOR_FOLD_TRAILER_KEY = exports.ORCHESTRATOR_FILES = exports.CONTRACT_DIR_PREFIX = exports.SCOPE_EXEMPT_CONTRACT_PATH = exports.SCOPE_EXEMPT_ALWAYS_ALLOWED = exports.SCOPE_PATTERN_ARROW = exports.ALWAYS_ALLOWED_PREFIX = exports.SCOPE_ALLOW_GUIDANCE = exports.MAX_REPORTED_VIOLATIONS = void 0;
+exports.isOrchestratorOnlyCommit = isOrchestratorOnlyCommit;
+exports.parseBranchCommits = parseBranchCommits;
+exports.isFoldCommit = isFoldCommit;
+exports.orchestratorOnlyPaths = orchestratorOnlyPaths;
 exports.isContractPath = isContractPath;
 exports.parsePorcelainEntries = parsePorcelainEntries;
 exports.parsePorcelainStatusEntries = parsePorcelainStatusEntries;
 exports.isSkillInstalledUntrackedEntry = isSkillInstalledUntrackedEntry;
+exports.collectBranchCommitChanges = collectBranchCommitChanges;
 exports.collectChangedPaths = collectChangedPaths;
 exports.scopeSkipDetachedContract = scopeSkipDetachedContract;
 exports.evaluateScope = evaluateScope;
@@ -117,6 +122,88 @@ exports.SCOPE_EXEMPT_CONTRACT_PATH = '(exempt: contract path)';
  * explicit `deny` can still catch an agent weakening its own gates.
  */
 exports.CONTRACT_DIR_PREFIX = '.commandmate/tasks/';
+/**
+ * Files the orchestrator commits on a PR branch after the worker's checks
+ * (orchestrate 6-4: the module-reference fold) (#3588).
+ *
+ * Copy of `ORCHESTRATOR_FILES` in `scripts/orchestrate/pr-common.mjs`, where
+ * `merge-pr.mjs` uses the same file rule to look past a fold commit to the
+ * worker's HEAD. A test imports the .mjs and compares the two arrays, so the
+ * merge side and this gate cannot drift apart.
+ */
+exports.ORCHESTRATOR_FILES = ['docs/module-reference.md'];
+/**
+ * The trailer that marks a fold commit, read the way `git interpret-trailers`
+ * reads it — from the message's trailer block only, so the same words in the
+ * middle of a body do not count (#3588).
+ *
+ * The file set alone cannot tell the orchestrator's fold from a worker that
+ * committed module-reference on its own, so this gate also requires the
+ * trailer. `workHeads` in pr-common.mjs deliberately does not: the merge side
+ * only decides which HEAD's records to read, and stays permissive.
+ */
+exports.ORCHESTRATOR_FOLD_TRAILER_KEY = 'Orchestrator-Fold';
+exports.ORCHESTRATOR_FOLD_TRAILER_VALUE = 'module-reference';
+/**
+ * Whether a commit's file list is the orchestrator's: at least one file, and
+ * every file in {@link ORCHESTRATOR_FILES} — the file rule of `workHeads` in
+ * `scripts/orchestrate/pr-common.mjs` (#3588).
+ */
+function isOrchestratorOnlyCommit(files) {
+    return files.length > 0 && files.every((file) => exports.ORCHESTRATOR_FILES.includes(file));
+}
+const FIELD_SEPARATOR = '\x1f';
+const TRAILER_SEPARATOR = '\x1e';
+/**
+ * Per commit: sha, parents, fold trailer values. With `-z` each record ends in
+ * NUL, which no commit message can contain; the sha and parent fields are hex,
+ * so only the trailer field is free text, and it is last.
+ */
+const BRANCH_COMMITS_FORMAT = `--format=%H%x1f%P%x1f%(trailers:key=${exports.ORCHESTRATOR_FOLD_TRAILER_KEY},` +
+    'valueonly,unfold,separator=%x1e)';
+/** Parse `git log -z` output in {@link BRANCH_COMMITS_FORMAT} (#3588). */
+function parseBranchCommits(output) {
+    const commits = [];
+    for (const record of output.split('\0')) {
+        const first = record.indexOf(FIELD_SEPARATOR);
+        const second = record.indexOf(FIELD_SEPARATOR, first + 1);
+        if (first <= 0 || second < 0)
+            continue;
+        const trailers = record.slice(second + 1);
+        commits.push({
+            sha: record.slice(0, first),
+            parents: record.slice(first + 1, second).split(' ').filter(Boolean),
+            foldTrailers: trailers === '' ? [] : trailers.split(TRAILER_SEPARATOR),
+        });
+    }
+    return commits;
+}
+/** Whether a non-merge commit is a fold (#3588): the trailer and the file rule both hold. */
+function isFoldCommit(commit, files) {
+    return (commit.parents.length === 1 &&
+        commit.foldTrailers.includes(exports.ORCHESTRATOR_FOLD_TRAILER_VALUE) &&
+        isOrchestratorOnlyCommit(files));
+}
+/**
+ * Paths that only fold commits touched on the branch (#3588).
+ *
+ * A path any other non-merge commit also touched is not returned: a worker
+ * that committed `docs/module-reference.md` itself — alone or with other
+ * files — is still judged on it. Merges are not passed in
+ * ({@link collectBranchCommitChanges} skips them): a merge's own edit inside
+ * {@link ORCHESTRATOR_FILES} is the approved integration of a refresh and
+ * leaves a fold-only path excluded, while its edits elsewhere stay in the
+ * branch diff and are judged as the worker's.
+ */
+function orchestratorOnlyPaths(commits) {
+    const byOrchestrator = new Set();
+    const byWorker = new Set();
+    for (const commit of commits) {
+        const target = commit.fold ? byOrchestrator : byWorker;
+        commit.files.forEach((file) => target.add(file));
+    }
+    return new Set([...byOrchestrator].filter((path) => !byWorker.has(path)));
+}
 /** Whether git reported a path that {@link CONTRACT_DIR_PREFIX} excludes. */
 function isContractPath(path) {
     return path.startsWith(exports.CONTRACT_DIR_PREFIX);
@@ -352,6 +439,61 @@ function parsePorcelainStatusEntries(output) {
 function isSkillInstalledUntrackedEntry(entry, owned) {
     return entry.status === '??' && entry.paths.every((path) => owned.has(path));
 }
+/**
+ * The non-merge commits of `<base>..HEAD` of a worktree, each judged by
+ * {@link isFoldCommit} (#3588). The scope gate drops what only folds touched
+ * ({@link orchestratorOnlyPaths}); the work-evidence gate does not count a
+ * fold as the worker's commit (#3633). Empty when no commit carries the fold
+ * trailer: none can be a fold, so the per-commit calls are skipped.
+ *
+ * File lists come from one `git diff-tree -z` per commit rather than from one
+ * `git log --name-only -z` stream: in that stream a commit header and a path
+ * are both NUL-terminated fields, and a path may start with a newline or a
+ * control character, so no parse of it can tell them apart. diff-tree prints
+ * paths and nothing else.
+ *
+ * A merge's own edits are split by path. Inside {@link ORCHESTRATOR_FILES}
+ * they are the approved integration — orchestrate lets the orchestrator
+ * resolve a refresh conflict in shared files such as module-reference by
+ * machine — so a fold-only path stays excluded. Every other path a merge edits
+ * is never a candidate (a fold changes only ORCHESTRATOR_FILES), so it stays in
+ * the branch diff and scope judges it as the worker's. Merges are therefore
+ * skipped here without asking `git diff-tree --cc`.
+ */
+async function collectBranchCommitChanges(worktreePath, base) {
+    const log = await runGit(['log', '-z', BRANCH_COMMITS_FORMAT, `${base}..HEAD`], worktreePath);
+    if (log.code !== 0) {
+        return {
+            error: `'git log ${base}..HEAD' failed.` + (log.stderr.trim() ? `\n${log.stderr.trim()}` : ''),
+        };
+    }
+    const commits = parseBranchCommits(log.stdout);
+    // Nothing to exclude without a trailer; skip the per-commit calls.
+    if (!commits.some((commit) => commit.foldTrailers.length > 0))
+        return { changes: [] };
+    const changes = [];
+    for (const commit of commits) {
+        if (commit.parents.length !== 1)
+            continue;
+        const tree = await runGit(['diff-tree', '--no-commit-id', '--name-only', '-z', '--no-renames', '-r', commit.sha], worktreePath);
+        if (tree.code !== 0) {
+            return {
+                error: `'git diff-tree ${commit.sha}' failed.` +
+                    (tree.stderr.trim() ? `\n${tree.stderr.trim()}` : ''),
+            };
+        }
+        const files = splitNul(tree.stdout);
+        changes.push({ sha: commit.sha, files, fold: isFoldCommit(commit, files) });
+    }
+    return { changes };
+}
+/** {@link orchestratorOnlyPaths} for `<base>..HEAD` of a worktree (#3588). */
+async function collectOrchestratorOnlyPaths(worktreePath, base) {
+    const result = await collectBranchCommitChanges(worktreePath, base);
+    if ('error' in result)
+        return result;
+    return { paths: orchestratorOnlyPaths(result.changes) };
+}
 /**
  * Every path this worktree changed relative to `baseRef`.
  *
@@ -379,6 +521,18 @@ async function collectChangedPaths(worktreePath, baseRef) {
                 (diff.stderr.trim() ? `\n${diff.stderr.trim()}` : ''),
         };
     }
+    // The orchestrator's fold commit (6-4) can sit under a re-instructed worker's
+    // commits; what only it touched is not the worker's change (#3588).
+    const orchestratorOnly = await collectOrchestratorOnlyPaths(worktreePath, base);
+    if ('error' in orchestratorOnly)
+        return orchestratorOnly;
+    const orchestratorExcluded = new Set();
+    const committed = splitNul(diff.stdout).filter((path) => {
+        if (!orchestratorOnly.paths.has(path))
+            return true;
+        orchestratorExcluded.add(path);
+        return false;
+    });
     // -uall: without it a new directory collapses to a single `?? dir/` entry, and
     // the gate would judge a directory name instead of the files inside it.
     const status = await runGit(['status', '--porcelain', '-z', '--untracked-files=all'], worktreePath);
@@ -405,12 +559,14 @@ async function collectChangedPaths(worktreePath, baseRef) {
         return true;
     });
     // Both sides are filtered, not just the working tree: an orchestrator may
-    // also have committed the contract as a setup commit (#1580).
-    const paths = new Set([...splitNul(diff.stdout), ...workingTree.flatMap((entry) => entry.paths)].filter((path) => !isContractPath(path)));
+    // also have committed the contract as a setup commit (#1580). The working
+    // tree keeps an uncommitted module-reference edit: no fold commit made it.
+    const paths = new Set([...committed, ...workingTree.flatMap((entry) => entry.paths)].filter((path) => !isContractPath(path)));
     return {
         paths: [...paths].sort(),
         mergeBase: base,
         agentStateExcluded: [...agentStateExcluded].sort(),
+        orchestratorExcluded: [...orchestratorExcluded].filter((path) => !paths.has(path)).sort(),
     };
 }
 // =============================================================================
@@ -470,6 +626,15 @@ function formatAgentStateExcluded(excluded) {
         ...(remainder > 0 ? [`  ... (+${remainder} more)`] : []),
     ];
 }
+/** The `excluded:` section naming orchestrator-only committed paths (#3588). */
+function formatOrchestratorExcluded(excluded) {
+    if (excluded.length === 0)
+        return [];
+    return [
+        'excluded (changed only by orchestrator commits, not counted as change):',
+        ...excluded.map((path) => `  ~ ${path}`),
+    ];
+}
 /**
  * Reasons the gate has nothing to judge, phrased for `log_tail`.
  *
@@ -546,6 +711,7 @@ async function evaluateScope(worktreePath, scope, requireScopeClean, baseRef, co
         `deny: ${formatPatterns(scope.deny)}`,
         ...formatAdmitted(admitted),
         ...formatAgentStateExcluded(changed.agentStateExcluded),
+        ...formatOrchestratorExcluded(changed.orchestratorExcluded),
     ].join('\n');
     if (violations.length === 0) {
         // An empty change set passes: work-evidence is the gate that judges "nothing

package/dist/server/src/types/sidebar.js

@@ -337,6 +337,7 @@ function toBranchItem(worktree) {
         exitedInstanceIds,
         unclassifiedInstanceIds,
         worktreePath: worktree.path,
+        worktreeStatus: worktree.status ?? null,
         waitingKind,
         awaitingInstruction,
         // `promptType` mirrors what `/api/worktrees` does with the same data