commandmate 0.45.1 → 0.46.1

package/dist/server/src/lib/session/chat-turn-progress.js

@@ -52,6 +52,7 @@ exports.publishChatTurnProgress = publishChatTurnProgress;
 const types_1 = require("../../lib/realtime/types");
 const logger_1 = require("../../lib/logger");
 const global_state_1 = require("../global-state");
+const poller_owner_1 = require("../../lib/polling/poller-owner");
 // Issue #3215: the name is the one these lines have always been logged under.
 // It is what an operator greps for, so it did not move with the code.
 const logger = (0, logger_1.createLogger)('current-output-builder');
@@ -169,6 +170,19 @@ function logChatTurnProgressOutcome(target, outcome, turnKey, extra = {}) {
  * @returns The frame to broadcast, or null when there is nothing new to say
  */
 async function buildChatTurnProgress(target, source, now = Date.now()) {
+    const prepared = await prepareChatTurnProgress(target, source, now);
+    return prepared === null ? null : commitChatTurnProgress(target, prepared);
+}
+/**
+ * The half of {@link buildChatTurnProgress} that awaits: the throttle, the read
+ * and the bound — and nothing remembered about the body (Issue #3705).
+ *
+ * Split so that {@link emitChatTurnProgress} can remember a body only once it is
+ * actually going out. Remembered at the build and refused at the broadcast (a
+ * poller snapshot superseded in the `await` between the two), the body stood
+ * as "already sent" and suppressed the successor's identical frame.
+ */
+async function prepareChatTurnProgress(target, source, now) {
     const key = chatTurnProgressKey(target);
     const state = chatTurnProgressState.get(key) ?? newChatTurnProgressState();
     if (now - state.askedAt < types_1.CHAT_TURN_PROGRESS_MIN_INTERVAL_MS)
@@ -186,20 +200,43 @@ async function buildChatTurnProgress(target, source, now = Date.now()) {
     }
     if (!draft || draft.body.length === 0)
         return null;
+    // Issue #3705: the frame of a poller snapshot whose tick was superseded while
+    // the transcript was read is not built — and, above all, not remembered: the
+    // turn key and body are what suppress the successor's identical frame.
+    if (!(0, poller_owner_1.maySnapshotPublish)())
+        return null;
     const bounded = (0, types_1.truncateChatTurnProgressBody)(draft.body);
     if (draft.turnKey === state.turnKey && bounded.body === state.body)
         return null;
-    state.turnKey = draft.turnKey;
-    state.body = bounded.body;
+    return {
+        turnKey: draft.turnKey,
+        body: bounded.body,
+        partial: bounded.truncated || draft.partial === true,
+    };
+}
+/**
+ * Remember a prepared frame and give it its version — synchronous, so the
+ * caller can make it the last step before the broadcast (Issue #3705). The
+ * no-change rule is applied again against what is remembered NOW, since another
+ * frame may have gone out while the read was in flight.
+ */
+function commitChatTurnProgress(target, prepared) {
+    const key = chatTurnProgressKey(target);
+    const state = chatTurnProgressState.get(key) ?? newChatTurnProgressState();
+    if (prepared.turnKey === state.turnKey && prepared.body === state.body)
+        return null;
+    state.turnKey = prepared.turnKey;
+    state.body = prepared.body;
     state.version += 1;
+    chatTurnProgressState.set(key, state);
     return {
         type: types_1.CHAT_TURN_PROGRESS_EVENT_TYPE,
         worktreeId: target.worktreeId,
         cliToolId: target.cliToolId,
         instanceId: target.instanceId ?? target.cliToolId,
-        turnKey: draft.turnKey,
-        body: bounded.body,
-        partial: bounded.truncated || draft.partial === true,
+        turnKey: prepared.turnKey,
+        body: prepared.body,
+        partial: prepared.partial,
         version: state.version,
         done: false,
     };
@@ -232,9 +269,18 @@ async function emitChatTurnProgress(target, source, now = Date.now()) {
             logChatTurnProgressOutcome(target, 'no-subscribers', null);
             return false;
         }
-        const event = await buildChatTurnProgress(target, source, now);
+        const prepared = await prepareChatTurnProgress(target, source, now);
         // Not logged: null is the throttle, an unchanged body, or a turn with no
         // text yet — the quiet, correct majority of ticks.
+        if (!prepared)
+            return false;
+        // Issue #3705: asked after the build's `await`, and BEFORE the body is
+        // remembered — a frame refused here leaves nothing behind that would make
+        // the successor's same body look already sent. From here to the broadcast
+        // there is no `await`.
+        if (!(0, poller_owner_1.maySnapshotPublish)())
+            return false;
+        const event = commitChatTurnProgress(target, prepared);
         if (!event)
             return false;
         broadcast(target.worktreeId, event);
@@ -302,6 +348,11 @@ async function publishChatTurnProgress(db, worktreeId, cliToolId, instanceId) {
         // sessions nobody is watching, which is the bargain that was already being
         // struck one frame later.
         const { hasRoomSubscribers } = await Promise.resolve().then(() => __importStar(require('../../lib/ws-server')));
+        // Issue #3705: the progress of a superseded tick's snapshot is not started.
+        // The detached read below keeps the snapshot's owner in its async context
+        // and asks again before it remembers or broadcasts anything.
+        if (!(0, poller_owner_1.maySnapshotPublish)())
+            return;
         if (!hasRoomSubscribers(worktreeId)) {
             logChatTurnProgressOutcome(target, 'no-subscribers', null);
             return;

package/dist/server/src/lib/session/current-output-builder.js

@@ -48,6 +48,7 @@ const auto_yes_dialog_gate_1 = require("../../lib/polling/auto-yes-dialog-gate")
 const layer_disagreement_1 = require("../../lib/session/layer-disagreement");
 const structured_prompt_1 = require("../../lib/session/structured-prompt");
 const chat_turn_progress_1 = require("./chat-turn-progress");
+const poller_owner_1 = require("../../lib/polling/poller-owner");
 const structured_status_merge_1 = require("./structured-status-merge");
 const current_output_history_writers_1 = require("./current-output-history-writers");
 const detection_divergence_1 = require("./detection-divergence");
@@ -74,6 +75,11 @@ const logger = (0, logger_1.createLogger)('current-output-builder');
  */
 async function buildCurrentOutput(db, worktreeId, cliToolId, instanceId, resolution) {
     const payload = await buildPayload(db, worktreeId, cliToolId, instanceId);
+    // Issue #3705: the payload's own writers asked after their awaits (see
+    // `buildPayload`); the progress frame below is one more write, of the turn
+    // the payload describes.
+    if (!(0, poller_owner_1.maySnapshotPublish)())
+        throw new poller_owner_1.RetiredSnapshotError();
     // Issue #2199. Fire-and-forget, and placed HERE rather than in the poller for
     // one reason: this is the function both live paths run through. The WebSocket
     // push calls it from `broadcastTerminalSnapshot` on every generating poller
@@ -565,6 +571,15 @@ async function buildPayload(db, worktreeId, cliToolId, instanceId) {
     const sessionName = cliTool.getSessionName(worktreeId, instanceId);
     const { stopEventAt, eventSource, askUserQuestion, structuredEvents } = readAgentEvents(worktreeId, cliToolId, instanceId, resolvedInstanceId);
     const running = await cliTool.isRunning(worktreeId, instanceId);
+    // Issue #3705: a terminal snapshot the response poller started for a tick
+    // that has since been superseded writes nothing from here on — not the
+    // latch, the starting state, the unclassified-frame row, the structured
+    // prompt row or the status evidence — because they would describe the turn
+    // that ended on top of the successor's. Thrown, not answered, so the payload
+    // type stays what the route reads; `broadcastTerminalSnapshot` catches it.
+    // Never thrown outside a poller snapshot (`maySnapshotPublish`).
+    if (!(0, poller_owner_1.maySnapshotPublish)())
+        throw new poller_owner_1.RetiredSnapshotError();
     if (!running) {
         // Issue #1926: the latch describes a process, and this one is gone. Dropped
         // rather than aged out so the next session on this key starts with no
@@ -632,6 +647,10 @@ async function buildPayload(db, worktreeId, cliToolId, instanceId) {
     const sessionState = (0, db_1.getSessionState)(db, worktreeId, resolvedInstanceId);
     const lastCapturedLine = sessionState?.lastCapturedLine || 0;
     const output = await (0, cli_session_1.captureSessionOutput)(worktreeId, cliToolId, status_capture_config_1.STATUS_CAPTURE_LINES, instanceId);
+    // Issue #3705: the last `await` of the build. Everything below it, through
+    // `observeStatusEvidence`, runs without one.
+    if (!(0, poller_owner_1.maySnapshotPublish)())
+        throw new poller_owner_1.RetiredSnapshotError();
     const lines = output.split('\n');
     const totalLines = lines.length;
     // Issue #1670: `content` is "everything the poller has not saved yet", which

package/dist/server/src/lib/session/next-action-helper.js

@@ -3,14 +3,14 @@
  * Next Action Helper - Derived state for worktree next actions and review status.
  *
  * Issue #600: UX refresh - provides getNextAction() and getReviewStatus()
- * for Review screen and WorktreeCard display.
+ * for the Review screen (via `/api/worktrees`) and the sidebar row
+ * (`toBranchItem` in `src/types/sidebar.ts`).
  *
  * Uses exhaustive check (satisfies never) pattern to catch future
  * SessionStatus extensions at compile time [DR2-005].
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.NEXT_ACTION_KEYS = void 0;
-exports.isNextActionKey = isNextActionKey;
 exports.getNextAction = getNextAction;
 exports.getReviewStatus = getReviewStatus;
 /**
@@ -31,19 +31,6 @@ exports.NEXT_ACTION_KEYS = {
     checkStalled: 'nextAction.checkStalled',
     running: 'nextAction.running',
 };
-const NEXT_ACTION_KEY_SET = new Set(Object.values(exports.NEXT_ACTION_KEYS));
-/**
- * Whether a value is a key this module produces (Issue #1787).
- *
- * `Worktree.nextAction` is a plain `string` on the wire, and a server that
- * predates this Issue still sends the old English literal. Callers must gate
- * `t()` on this: next-intl reports a missing key by rendering the key path, so
- * feeding it `"Approve / Reject"` would put `worktree.Approve / Reject` on
- * screen. Anything that fails this test is rendered verbatim instead.
- */
-function isNextActionKey(value) {
-    return NEXT_ACTION_KEY_SET.has(value);
-}
 /**
  * Determine the next action for a given session state.
  *

package/dist/server/src/lib/session/worktree-session-reconcile.js

@@ -86,6 +86,8 @@ const session_ownership_1 = require("../../lib/tmux/session-ownership");
 const control_mode_tmux_transport_1 = require("../../lib/tmux/control-mode-tmux-transport");
 const auto_yes_manager_1 = require("../../lib/polling/auto-yes-manager");
 const response_poller_1 = require("../../lib/polling/response-poller");
+const auto_yes_poller_state_1 = require("../../lib/polling/auto-yes-poller-state");
+const auto_yes_enter_fallback_1 = require("../../lib/polling/auto-yes-enter-fallback");
 const ws_server_1 = require("../../lib/ws-server");
 const logger_1 = require("../../lib/logger");
 const logger = (0, logger_1.createLogger)('worktree-session-reconcile');
@@ -152,8 +154,9 @@ function planSessionRenames(db, rename, errors) {
             // getSessionName validates already; assert it explicitly so the guarantee
             // is stated where the name is about to be handed to tmux (Issue #1621).
             (0, validation_1.validateSessionName)(newName);
-            if (oldName !== newName)
-                plans.push({ oldName, newName, rename, source: 'roster' });
+            if (oldName !== newName) {
+                plans.push({ oldName, newName, rename, cliToolId, instanceId, source: 'roster' });
+            }
         }
         catch (error) {
             errors.push(`session name for ${rename.oldId}/${instanceId}: ${error instanceof Error ? error.message : String(error)}`);
@@ -284,8 +287,16 @@ function discoverSessionRenames(renames, liveNames, knownIds, result) {
                 : attributed.cliToolId;
             const newName = tool.getSessionName(rename.newId, instanceId);
             (0, validation_1.validateSessionName)(newName);
-            if (name !== newName)
-                plans.push({ oldName: name, newName, rename, source: 'live' });
+            if (name !== newName) {
+                plans.push({
+                    oldName: name,
+                    newName,
+                    rename,
+                    cliToolId: attributed.cliToolId,
+                    instanceId,
+                    source: 'live',
+                });
+            }
         }
         catch (error) {
             result.errors.push(`attribute session ${name}: ${error instanceof Error ? error.message : String(error)}`);
@@ -374,6 +385,10 @@ function allocateTempName(taken, ordinal) {
 }
 /**
  * Rename the live tmux sessions in two stages so no intermediate state collides.
+ *
+ * @returns The plans whose session was renamed in BOTH stages (Issue #3713: a
+ *   stage-2 `false` — the session vanished from its temporary name — is not
+ *   one; it is reported as skipped).
  */
 async function renameSessionsTwoStage(plans, live, deps, result) {
     if (plans.length === 0)
@@ -426,7 +441,14 @@ async function renameSessionsTwoStage(plans, live, deps, result) {
     const completed = [];
     for (const { plan, tempName } of staged) {
         try {
-            await deps.renameSession(tempName, plan.newName);
+            if (!(await deps.renameSession(tempName, plan.newName))) {
+                result.skippedSessions.push({
+                    oldName: plan.oldName,
+                    newName: plan.newName,
+                    reason: 'session no longer exists',
+                });
+                continue;
+            }
             result.renamedSessions.push({ oldName: plan.oldName, newName: plan.newName });
             completed.push(plan);
             // The control-mode attach survived the rename; only the registry key is
@@ -453,6 +475,37 @@ async function renameSessionsTwoStage(plans, live, deps, result) {
     }
     return completed;
 }
+/** The Auto-Yes composite key of a plan's instance under `worktreeId`. */
+function autoYesKeyOf(plan, worktreeId) {
+    return (0, auto_yes_manager_1.buildCompositeKey)(worktreeId, plan.cliToolId, plan.instanceId);
+}
+/**
+ * Carry Auto-Yes's memory of an answer stopped part-way, and of a send still in
+ * flight, to the new key of each session that moved (Issue #3713).
+ *
+ * Only for the renames that succeeded in both stages: a refused, failed or
+ * vanished rename leaves the destination's live session — and its memory —
+ * alone. Not part of {@link migrateRuntimeState}, which still runs for every
+ * requested pair: a grant, a response poller or a WebSocket room is about the
+ * worktree, this memory is about one process.
+ */
+function moveAutoYesPartialAnswers(completed, sourceEpochs) {
+    const moves = [];
+    for (const plan of completed) {
+        const sourceEpoch = sourceEpochs.get(plan);
+        if (sourceEpoch === undefined)
+            continue;
+        moves.push({
+            oldKey: autoYesKeyOf(plan, plan.rename.oldId),
+            newKey: autoYesKeyOf(plan, plan.rename.newId),
+            sourceEpoch,
+        });
+    }
+    const received = (0, auto_yes_poller_state_1.movePartialAnswers)(moves);
+    if (received.length > 0) {
+        logger.info('reconcile:auto-yes-partial-answers-moved', { keys: received });
+    }
+}
 /**
  * Move the in-process state that is keyed on a worktree ID.
  *
@@ -468,15 +521,27 @@ function migrateRuntimeState(db, renames, result) {
     const runningAutoYesPollers = new Set((0, auto_yes_manager_1.getAutoYesPollerCompositeKeys)());
     const movedAutoYes = (0, auto_yes_manager_1.migrateAutoYesStateWorktreeIds)(renames);
     result.movedAutoYesKeys = movedAutoYes.map((move) => move.newKey);
+    // The poller's timer chain captures the worktree ID, so re-keying its map
+    // would leave it polling the old session. Stop and restart instead — the
+    // Auto-Yes *state* (deadline, stop pattern) is what must survive, and it
+    // already has. Every old poller is stopped before any successor starts
+    // (Issue #3713): in a swap (A↔B) with both running, stop A → start B would
+    // find B's own poller still there ("already_running"), and the stop B that
+    // follows would leave the B side with none.
+    const restarts = [];
     for (const move of movedAutoYes) {
         if (!runningAutoYesPollers.has(move.oldKey))
             continue;
         try {
-            // The poller's timer chain captures the worktree ID, so re-keying its map
-            // would leave it polling the old session. Stop and restart instead — the
-            // Auto-Yes *state* (deadline, stop pattern) is what must survive, and it
-            // already has.
             (0, auto_yes_manager_1.stopAutoYesPolling)(move.oldKey);
+            restarts.push(move);
+        }
+        catch (error) {
+            result.errors.push(`auto-yes poller ${move.newKey}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    for (const move of restarts) {
+        try {
             const started = (0, auto_yes_manager_1.startAutoYesPolling)(move.newWorktreeId, move.cliToolId, move.instanceId);
             if (started.started) {
                 result.restartedAutoYesPollers.push(move.newKey);
@@ -572,7 +637,15 @@ async function reconcileWorktreeSessions(db, renamesOrOldId, newIdOrOptions, may
                 result.planSources.discovered++;
         }
         const ownedPlans = excludeForeignSessionPlans(db, plans, live, livePaths, deps, result);
-        await renameSessionsTwoStage(ownedPlans, live, deps, result);
+        // Issue #3713: each source session's epoch, read before the first rename's
+        // await — a session begun under the old key while the renames run is not the
+        // one that moves, and its memory stays where it is.
+        const sourceEpochs = new Map(ownedPlans.map((plan) => [plan, (0, auto_yes_enter_fallback_1.getEnterFallbackSessionEpoch)(autoYesKeyOf(plan, plan.rename.oldId))]));
+        const completed = await renameSessionsTwoStage(ownedPlans, live, deps, result);
+        // No await between the renames and this: Auto-Yes's memory of an answer
+        // stopped part-way (and of a send still in flight) follows exactly the
+        // sessions that moved, before any poller restarts below.
+        moveAutoYesPartialAnswers(completed, sourceEpochs);
     }
     // Runtime state moves after the sessions: a poller that ticks in between
     // fails one capture against a name that is briefly gone, which is a logged

package/dist/server/src/lib/timer-manager.js

@@ -53,6 +53,13 @@ async function executeTimer(timerId) {
         const instanceId = timer.instanceId;
         // [Issue #539] Check if session is running before sending
         const isRunning = await cliTool.isRunning(timer.worktreeId, instanceId);
+        // [Issue #3707] A cancel can succeed while the await above is pending.
+        // Re-read synchronously (no await between this read and the update below,
+        // so better-sqlite3 makes read+update atomic) and bail out unless the
+        // timer is still pending; otherwise 'cancelled' would be overwritten.
+        const current = (0, timer_db_1.getTimerById)(db, timerId);
+        if (!current || current.status !== 'pending')
+            return;
         if (!isRunning) {
             logger.warn('timer:no-session', { timerId, worktreeId: timer.worktreeId, instanceId });
             (0, timer_db_1.updateTimerStatus)(db, timerId, timer_constants_1.TIMER_STATUS.NO_SESSION);

package/dist/server/src/lib/tmux/tmux.js

@@ -4,7 +4,7 @@
  * Provides functions to manage tmux sessions for Claude CLI integration
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DIRECT_INPUT_TEXT_CHUNK_BYTES = exports.REPAINT_INVALIDATE_DELAY_MS = exports.NAVIGATION_KEY_VALUES = exports.SPECIAL_KEY_VALUES = void 0;
+exports.DIRECT_INPUT_TEXT_CHUNK_BYTES = exports.REPAINT_INVALIDATE_DELAY_MS = exports.NAVIGATION_KEY_VALUES = exports.SPECIAL_KEY_VALUES = exports.SpecialKeysAbortedError = void 0;
 exports.exactTarget = exactTarget;
 exports.reconcileSessionGeometry = reconcileSessionGeometry;
 exports.hasSession = hasSession;
@@ -577,6 +577,21 @@ function isSendableSpecialKey(key) {
 }
 /** Delay between individual key presses for TUI apps that need processing time (ms). */
 const SPECIAL_KEY_DELAY_MS = 100;
+/**
+ * {@link sendSpecialKeys} stopped between two keys because its
+ * `shouldContinue` said so (Issue #3706). Not wrapped in the transport error.
+ */
+class SpecialKeysAbortedError extends Error {
+    keysSent;
+    constructor(
+    /** How many keys reached tmux before the stop (always at least one). */
+    keysSent) {
+        super(`Special key sequence stopped after ${keysSent} key(s)`);
+        this.keysSent = keysSent;
+        this.name = 'SpecialKeysAbortedError';
+    }
+}
+exports.SpecialKeysAbortedError = SpecialKeysAbortedError;
 /**
  * Send tmux special keys (unquoted key names like Down, Up, Enter, Space).
  * Used for cursor-based navigation in CLI tool prompts (e.g., Claude Code AskUserQuestion).
@@ -587,9 +602,11 @@ const SPECIAL_KEY_DELAY_MS = 100;
  *
  * @param sessionName - Target session name
  * @param keys - Array of tmux special key names (e.g., ['Down', 'Down', 'Space', 'Enter'])
+ * @param options - Optional `shouldContinue`, asked after each delay (Issue #3706)
  * @throws {Error} If any key name is not in the allowed set, or if tmux command fails
+ * @throws {SpecialKeysAbortedError} If `shouldContinue` returned false between two keys
  */
-async function sendSpecialKeys(sessionName, keys) {
+async function sendSpecialKeys(sessionName, keys, options) {
     if (keys.length === 0)
         return;
     // Validate all keys are in the allowed set (command injection prevention)
@@ -604,10 +621,15 @@ async function sendSpecialKeys(sessionName, keys) {
             // Delay between key presses (skip after the last key)
             if (i < keys.length - 1) {
                 await new Promise(resolve => setTimeout(resolve, SPECIAL_KEY_DELAY_MS));
+                if (options?.shouldContinue && !options.shouldContinue()) {
+                    throw new SpecialKeysAbortedError(i + 1);
+                }
             }
         }
     }
     catch (error) {
+        if (error instanceof SpecialKeysAbortedError)
+            throw error;
         const errorMessage = error instanceof Error ? error.message : String(error);
         throw new Error(`Failed to send special keys to tmux session: ${errorMessage}`);
     }

package/dist/server/src/lib/verification/env-clean-gate.js

@@ -39,6 +39,7 @@ exports.ENV_CLEAN_GUIDANCE = exports.MAX_REPORTED_ENV_CHANGES = exports.isLivePi
 exports.resolveRequireEnvClean = resolveRequireEnvClean;
 exports.attributeSessionName = attributeSessionName;
 exports.attributeAnchor = attributeAnchor;
+exports.isZcompdumpEntry = isZcompdumpEntry;
 exports.demoVitestPid = demoVitestPid;
 exports.attributeHomeEntry = attributeHomeEntry;
 exports.resolveTaskSessionName = resolveTaskSessionName;
@@ -200,6 +201,17 @@ exports.readLivePidCwd = readLivePidCwd;
  * established.
  */
 const DEMO_VITEST_HOME_ENTRY = /^\.commandmate-demo-vitest-([1-9]\d*)$/;
+/**
+ * zsh's `compinit` cache: `~/.zcompdump` itself, and the `~/.zcompdump.<host>.<pid>`
+ * scratch file it writes before renaming (#3664). A worker's shell start makes
+ * it; the pid in it is already gone by the time the gate looks. Only these two
+ * shapes — any other `.zcompdump*` name stays a violation.
+ */
+const ZCOMPDUMP_HOME_ENTRY = /^\.zcompdump(?:\.[A-Za-z0-9._-]+\.[1-9]\d*)?$/;
+/** Whether a `$HOME` entry name is a zsh compinit cache file (#3664). */
+function isZcompdumpEntry(name) {
+    return ZCOMPDUMP_HOME_ENTRY.test(name);
+}
 const isLivePid = (pid) => {
     try {
         process.kill(pid, 0);
@@ -560,6 +572,7 @@ function diffEnvSnapshots(baseline, final, context, options = {}) {
                 removedByOtherRepository: [],
                 removedStaleDemoVitest: [],
                 ignoredByConfig: [],
+                ignoredBuiltIn: [],
             };
         }
         if (!after || after.status !== 'ok') {
@@ -575,6 +588,7 @@ function diffEnvSnapshots(baseline, final, context, options = {}) {
                 removedByOtherRepository: [],
                 removedStaleDemoVitest: [],
                 ignoredByConfig: [],
+                ignoredBuiltIn: [],
             };
         }
         const beforeKeys = new Set(before.entries.map((entry) => entry.key));
@@ -582,10 +596,12 @@ function diffEnvSnapshots(baseline, final, context, options = {}) {
         // Only `home-entries`, and only by the whole name: the same string under
         // `~/.commandmate` is a different directory and stays counted.
         const isIgnoredByConfig = (entry) => probeId === 'home-entries' && ignoredHomeEntries.has(entry.key);
+        const isIgnoredBuiltIn = (entry) => probeId === 'home-entries' && isZcompdumpEntry(entry.key);
         const added = [];
         const ignoredAdded = [];
         const taskSessionAdded = [];
         const ignoredByConfig = [];
+        const ignoredBuiltIn = [];
         for (const entry of after.entries) {
             if (beforeKeys.has(entry.key))
                 continue;
@@ -594,6 +610,10 @@ function diffEnvSnapshots(baseline, final, context, options = {}) {
                 ignoredByConfig.push(toChange(entry, owner));
                 continue;
             }
+            if (isIgnoredBuiltIn(entry)) {
+                ignoredBuiltIn.push(toChange(entry, owner));
+                continue;
+            }
             if (probeId === 'tmux-sessions' && taskSession && entry.key === taskSession) {
                 // Additions only: a task session that existed at task start and is gone
                 // falls through to `removed` below like everything else (#1624).
@@ -619,6 +639,9 @@ function diffEnvSnapshots(baseline, final, context, options = {}) {
             if (isIgnoredByConfig(entry)) {
                 ignoredByConfig.push(change);
             }
+            else if (isIgnoredBuiltIn(entry)) {
+                ignoredBuiltIn.push(change);
+            }
             else if (tmuxServerSurvived &&
                 change.owner !== 'self' &&
                 otherServerSessions.has(entry.key)) {
@@ -648,6 +671,7 @@ function diffEnvSnapshots(baseline, final, context, options = {}) {
             removedByOtherRepository,
             removedStaleDemoVitest,
             ignoredByConfig,
+            ignoredBuiltIn,
         };
     });
     // A measured violation is a verdict and outranks an unmeasured probe; an
@@ -722,6 +746,20 @@ function formatIgnoredByConfig(changes) {
     const names = changes.map((change) => change.key).join(', ');
     return [`    ignored (options.envCleanIgnoreHomeEntries): ${names}`];
 }
+/** Built-in `home-entries` exclusions (zsh compinit cache), on their own line (#3672). */
+function formatIgnoredBuiltIn(changes) {
+    if (changes.length === 0)
+        return [];
+    const names = changes.map((change) => change.key).join(', ');
+    return [`    ignored (built-in): ${names}`];
+}
+/** Additions excused as another worktree's, named on a clean report (#3683). */
+function formatIgnoredAttributed(changes) {
+    if (changes.length === 0)
+        return [];
+    const names = changes.map((change) => change.key).join(', ');
+    return [`    ignored (attributed to another worktree): ${names}`];
+}
 /**
  * The header's account of what could be excused, so a report judged against a
  * baseline written before #2472 says why the task's own session was not.
@@ -752,6 +790,8 @@ function formatEnvCleanReport(diff) {
             lines.push(...formatRemovedByOtherRepository(probe.removedByOtherRepository));
             lines.push(...formatRemovedStaleDemoVitest(probe.removedStaleDemoVitest));
             lines.push(...formatIgnoredByConfig(probe.ignoredByConfig));
+            lines.push(...formatIgnoredBuiltIn(probe.ignoredBuiltIn));
+            lines.push(...formatIgnoredAttributed(probe.ignoredAdded));
             continue;
         }
         lines.push(`  ${probe.probeId} VIOLATED (${label}): +${probe.added.length} -${probe.removed.length}`);
@@ -762,6 +802,7 @@ function formatEnvCleanReport(diff) {
         lines.push(...formatRemovedByOtherRepository(probe.removedByOtherRepository));
         lines.push(...formatRemovedStaleDemoVitest(probe.removedStaleDemoVitest));
         lines.push(...formatIgnoredByConfig(probe.ignoredByConfig));
+        lines.push(...formatIgnoredBuiltIn(probe.ignoredBuiltIn));
         for (const excused of probe.ignoredAdded) {
             lines.push(`    · ${excused.key} (ignored: belongs to another worktree)`);
         }

package/dist/server/src/lib/verification/gate-runner.js

@@ -751,7 +751,10 @@ function namesOpencodeInstance(db, worktreeId, instanceId) {
  * gates — the precise failure `verify-completion.sh` was written to catch.
  *
  * Contract files are evidence of the *orchestrator*, not of the agent, so
- * neither side counts them (see {@link CONTRACT_DIR_PREFIX}).
+ * neither side counts them (see {@link CONTRACT_DIR_PREFIX}). Nor is the
+ * orchestrator's module-reference fold commit (orchestrate 6-4, judged by
+ * scope-gate's `collectBranchCommitChanges`): a branch that holds only a fold
+ * has no work of the worker's in it (#3633).
  *
  * ## The opencode second witness (Issue #2043)
  *
@@ -796,18 +799,20 @@ async function evaluateWorkEvidence(worktreePath, baseRef, requireCommit, agentE
     // pathspec is not exclusions alone, and it anchors both patterns at the root
     // rather than at cwd. A setup commit that only carries the contract must not
     // read as a commit's worth of work.
-    const revList = await runGit([
-        'rev-list',
-        '--count',
-        `${base}..HEAD`,
-        '--',
-        ':(top)',
-        `:(exclude,top)${scope_gate_1.CONTRACT_DIR_PREFIX}`,
-    ], worktreePath);
+    const revList = await runGit(['rev-list', `${base}..HEAD`, '--', ':(top)', `:(exclude,top)${scope_gate_1.CONTRACT_DIR_PREFIX}`], worktreePath);
     if (revList.code !== 0) {
-        return done('error', `work-evidence: 'git rev-list --count ${base}..HEAD' failed.`, null);
+        return done('error', `work-evidence: 'git rev-list ${base}..HEAD' failed.`, null);
     }
-    const commitCount = Number.parseInt(revList.stdout.trim(), 10);
+    // The orchestrator's fold commit is not the worker's (#3633), by the same
+    // rule the scope gate drops what only folds touched (#3588).
+    const branchChanges = await (0, scope_gate_1.collectBranchCommitChanges)(worktreePath, base);
+    if ('error' in branchChanges) {
+        return done('error', `work-evidence: ${branchChanges.error}`, null);
+    }
+    const foldShas = new Set(branchChanges.changes.filter((c) => c.fold).map((c) => c.sha));
+    const branchShas = revList.stdout.split('\n').filter((sha) => sha.trim() !== '');
+    const foldCount = branchShas.filter((sha) => foldShas.has(sha)).length;
+    const commitCount = branchShas.length - foldCount;
     // -z -uall for the same reasons scope-gate uses them: the human format
     // C-quotes paths with spaces and joins renames with ` -> `, and the default
     // untracked mode collapses a fresh `.commandmate/tasks/` to one directory
@@ -841,6 +846,7 @@ async function evaluateWorkEvidence(worktreePath, baseRef, requireCommit, agentE
     const summary = `work-evidence: baseRef=${baseRef} commits=${commitCount} uncommitted=${uncommittedCount}` +
         (requireCommit.required ? ' requireCommit=true' : '') +
         ' (contract files excluded)' +
+        (foldCount > 0 ? ` (${foldCount} orchestrator fold commit(s) excluded)` : '') +
         (skillInstalledCount > 0
             ? ` (${skillInstalledCount} CommandMate-installed Skill file(s) excluded)`
             : '') +