ctxr-cli 0.33.0 → 0.35.0

package/dist/core/approval/store-forges.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-forges.d.ts","sourceRoot":"","sources":["../../../src/core/approval/store-forges.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAExC,OAAO,EAAuB,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAEnD;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,EAAE,QAAQ,CAAC,EAAE,WAAW,GAAG,QAAQ,CAmBtG"}

package/dist/core/approval/store-forges.js

@@ -0,0 +1,33 @@
+import { APP_REPOSITORY_VAR, credentialsFor, ghCredentials } from '../forge/credentials.js';
+import { createGhForgeClient } from '../forge/github.js';
+/**
+ * approve-sessions-across-stores (proposal Impact): every store a session
+ * touches is read and written with the same recording identity — the same
+ * credential source, addressed at the mount's own repository through its
+ * clone's `origin`. `CONTEXTURE_GITHUB_REPOSITORY` names the home store's
+ * repository only, so it is not passed on to a mount.
+ *
+ * When a command was handed a forge client (a test's), mounts get a plain
+ * `gh` client in their own clone, so they are still addressed by their origin.
+ */
+export function storeForges(env, injected) {
+    const cache = new Map();
+    return (root, mount) => {
+        let client = cache.get(root);
+        if (client === undefined) {
+            client = (async () => {
+                if (injected !== undefined) {
+                    const credentials = ghCredentials(env.env);
+                    return { forge: createGhForgeClient(root, credentials), credentials };
+                }
+                const scoped = mount ? { ...env, env: { ...env.env, [APP_REPOSITORY_VAR]: undefined } } : env;
+                const credentials = await credentialsFor(scoped, root);
+                return { forge: createGhForgeClient(root, credentials), credentials };
+            })();
+            cache.set(root, client);
+            client.catch(() => cache.delete(root));
+        }
+        return client;
+    };
+}
+//# sourceMappingURL=store-forges.js.map

package/dist/core/approval/store-forges.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-forges.js","sourceRoot":"","sources":["../../../src/core/approval/store-forges.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,aAAa,EAAyB,MAAM,yBAAyB,CAAC;AACnH,OAAO,EAAE,mBAAmB,EAAoB,MAAM,oBAAoB,CAAC;AAG3E;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CAAC,GAAwC,EAAE,QAAsB;IAC1F,MAAM,KAAK,GAAG,IAAI,GAAG,EAA0E,CAAC;IAChG,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QACrB,IAAI,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,GAAG,CAAC,KAAK,IAAI,EAAE;gBACnB,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;oBAC3B,MAAM,WAAW,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBAC3C,OAAO,EAAE,KAAK,EAAE,mBAAmB,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,WAAW,EAAE,CAAC;gBACxE,CAAC;gBACD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;gBAC9F,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBACvD,OAAO,EAAE,KAAK,EAAE,mBAAmB,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,WAAW,EAAE,CAAC;YACxE,CAAC,CAAC,EAAE,CAAC;YACL,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACxB,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/browse/approve.d.ts

@@ -1,6 +1,7 @@
 import type { IncomingMessage } from 'node:http';
 import type { ChangeApprovalConfig } from '../../config/schema.js';
 import type { IdentityVerifier } from '../approval/identity.js';
+import { type ForgeFor } from '../approval/session-group.js';
 import type { ForgeCredentials } from '../forge/credentials.js';
 import type { ForgeClient } from '../forge/github.js';
 import type { GitRunner } from '../git/exec.js';
@@ -24,6 +25,13 @@ export interface ApprovalServer {
     verifier: IdentityVerifier;
     git: GitRunner;
     now(): Date;
+    /**
+     * approve-sessions-across-stores D8: the forge client and credential for a mounted store's clone, with the same
+     * recording identity. Omitted, mounts are read with `gh`'s own credential in their clone.
+     */
+    forgeFor?: ForgeFor;
+    /** The process environment, for an authenticated fetch of a mounted part's head and for a mount's forge calls. */
+    env?: Readonly<Record<string, string | undefined>>;
 }
 /** What a route needs from the browsing surface once the requester is known: the shell, and note links. */
 export interface PageKit {

package/dist/core/browse/approve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"approve.d.ts","sourceRoot":"","sources":["../../../src/core/browse/approve.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAInE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAIhE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,KAAK,EAAE,WAAW,EAAe,MAAM,oBAAoB,CAAC;AAEnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAA8B,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAO5E;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,cAAc,CAAC;AAOhD,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,oGAAoG;IACpG,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,WAAW,CAAC;IACnB,qHAAqH;IACrH,WAAW,EAAE,gBAAgB,CAAC;IAC9B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,GAAG,EAAE,SAAS,CAAC;IACf,GAAG,IAAI,IAAI,CAAC;CACb;AAED,2GAA2G;AAC3G,MAAM,WAAW,OAAO;IACtB,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACzD,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACzC,WAAW,EAAE,YAAY,CAAC;CAC3B;AAED,MAAM,WAAW,KAAK;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,mGAAmG;IACnG,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAQD,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEzD;AAgRD;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,cAAc,GAAG,IAAI,EAC7B,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,EAC/B,WAAW,GAAE,MAAM,GAAG,IAAW,GAChC,OAAO,CAAC,KAAK,CAAC,CAkBhB"}
+{"version":3,"file":"approve.d.ts","sourceRoot":"","sources":["../../../src/core/browse/approve.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAInE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAGhE,OAAO,EAQL,KAAK,QAAQ,EAOd,MAAM,8BAA8B,CAAC;AAOtC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,KAAK,EAAE,WAAW,EAAe,MAAM,oBAAoB,CAAC;AAEnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAA8B,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAO5E;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,cAAc,CAAC;AAOhD,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,oGAAoG;IACpG,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,WAAW,CAAC;IACnB,qHAAqH;IACrH,WAAW,EAAE,gBAAgB,CAAC;IAC9B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,GAAG,EAAE,SAAS,CAAC;IACf,GAAG,IAAI,IAAI,CAAC;IACZ;;;OAGG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,kHAAkH;IAClH,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;CACpD;AAED,2GAA2G;AAC3G,MAAM,WAAW,OAAO;IACtB,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACzD,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACzC,WAAW,EAAE,YAAY,CAAC;CAC3B;AAED,MAAM,WAAW,KAAK;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,mGAAmG;IACnG,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAQD,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEzD;AAqmBD;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,cAAc,GAAG,IAAI,EAC7B,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,EAC/B,WAAW,GAAE,MAAM,GAAG,IAAW,GAChC,OAAO,CAAC,KAAK,CAAC,CAkBhB"}

package/dist/core/browse/approve.js

@@ -1,16 +1,22 @@
 import path from 'node:path';
 import { pageUrlsFor } from '../../commands/publish-urls.js';
-import { decisionBody, isDecider } from '../approval/decision.js';
+import { decisionBody, isDecider, recordPartOf } from '../approval/decision.js';
 import { readFileDiffs, renderFileDiffs } from '../approval/file-diff.js';
 import { readLandingRecord } from '../approval/landing-record.js';
 import { baseRef, forgeRead, reviewStateOf, sessionPulls, sessionWorktrees } from '../approval/sessions.js';
+import { decidersOnForge, groupSessions, listOpen, readAsSessionPart, sessionState, storeLabel, storeReach, } from '../approval/session-group.js';
+import { parseSessionMarker, sessionRouteName } from '../approval/session-marker.js';
+import { storeForges } from '../approval/store-forges.js';
+import { runRemoteGit, ghCredentials } from '../forge/credentials.js';
+import { mainWorktreePath } from '../git/worktree.js';
+import { randomUUID } from 'node:crypto';
 import { ForgeUnreachableError } from '../errors.js';
 import { ForgeRequestError } from '../forge/github.js';
 import { storePrefix } from '../graph/tree.js';
 import { packagedTemplate } from '../templates.js';
 import { escapeHtml, renderNoteBody } from './render.js';
 import { configStamp, createMemo } from './memo.js';
-import { renderReview } from './review.js';
+import { renderReviewAt } from './review.js';
 import { resolveRange } from '../graph/diff.js';
 /**
  * change-approval spec: the approval index, one session's approval page, and
@@ -43,6 +49,7 @@ const STATE_LABEL = {
     'changes-requested': 'changes requested',
     'needs-reapproval': 'needs a new decision',
     blocked: 'blocked',
+    retrying: 'partly landed, the rest lands on the next run',
 };
 async function readForm(req) {
     const chunks = [];
@@ -87,19 +94,78 @@ async function locate(store, server, name) {
 async function indexPage(store, server, kit) {
     const html = [`<h1>${escapeHtml(copy('index-heading'))}</h1>`];
     try {
-        const pulls = await sessionPulls(server.git, store.root, store.config, server.forge, server.approval.recording_login, () => openPulls(server));
-        if (pulls.length === 0) {
+        // approve-sessions-across-stores: the store and its mounts, read once; a pull request without a session marker keeps today's row.
+        const view = await readSessionView(store, server, false);
+        const homeListing = view?.listings.find((l) => l.store === view.reach.home);
+        if (homeListing?.error)
+            throw new ForgeUnreachableError(homeListing.error);
+        const homePulls = homeListing === undefined ? () => openPulls(server) : async () => homeListing.pulls;
+        const pulls = (await sessionPulls(server.git, store.root, store.config, server.forge, server.approval.recording_login, homePulls)).filter((p) => !readAsSessionPart(p.pull, view?.reach.home.slug ?? null, store.config));
+        const rows = pulls.map((p) => `<tr><td><a href="${approveRoute(p.name)}">${escapeHtml(p.name)}</a></td><td>#${p.pull.number}</td>` +
+            `<td><code>${escapeHtml(p.pull.headSha.slice(0, 7))}</code></td><td>${escapeHtml(STATE_LABEL[p.review.state])}</td></tr>`);
+        const elsewhere = [];
+        if (view !== null) {
+            for (const listing of view.listings) {
+                if (listing.error === null || listing.store === view.reach.home)
+                    continue;
+                html.push(`<p class="ctxr-approve-notice">${escapeHtml(copy('store-unreachable').replace('__STORE__', storeLabel(listing.store)))}</p>`);
+            }
+            for (const group of view.groups) {
+                const state = await forgeRead(() => sessionState({ git: server.git, reach: view.reach, identity: group.identity, homedHere: group.homedHere, open: group.parts, recordingLogin: server.approval.recording_login }));
+                const single = group.parts.length === 1 && group.parts[0].store === view.reach.home;
+                const partCell = group.parts.map((p) => escapeHtml(single ? `#${p.pull.number}` : `${partStore(view, p.store)} #${p.pull.number}`)).join('<br>');
+                const headCell = group.parts.map((p) => `<code>${escapeHtml(p.pull.headSha.slice(0, 7))}</code>`).join('<br>');
+                if (group.homedHere) {
+                    const name = sessionRouteName(group.identity);
+                    const undecidable = unreadableParts(view, state).length > 0;
+                    rows.push(`<tr><td><a href="${approveRoute(name)}">${escapeHtml(name)}</a></td><td>${partCell}</td><td>${headCell}</td>` +
+                        `<td>${escapeHtml(STATE_LABEL[state.state])}${undecidable ? ` (${escapeHtml(copy('session-no-decision'))})` : ''}</td></tr>`);
+                }
+                else {
+                    elsewhere.push(`<tr><td>${escapeHtml(sessionRouteName(group.identity))}</td><td>${escapeHtml(group.identity.home)}</td><td>${partCell}</td><td>${headCell}</td><td>${escapeHtml(STATE_LABEL[state.state])}</td></tr>`);
+                }
+            }
+            // write-lifecycle spec: a mount's pull request with no session marker is a session of its own, homed in that
+            // mount. It is shown here as homed elsewhere and decided only on the mount's own page.
+            for (const listing of view.listings) {
+                if (listing.store === view.reach.home || listing.pulls === null)
+                    continue;
+                const mount = listing.store;
+                const login = mount.config.change_approval?.recording_login ?? null;
+                const base = await baseRef(server.git, mount.root, mount.config.git.default_branch);
+                for (const pull of listing.pulls) {
+                    if (parseSessionMarker(pull.body) !== null)
+                        continue;
+                    let label = STATE_LABEL.awaiting;
+                    if (login !== null) {
+                        try {
+                            label = STATE_LABEL[(await forgeRead(() => reviewStateOf(server.git, mount.root, base, mount.forge, login, pull))).state];
+                        }
+                        catch (err) {
+                            if (!(err instanceof ForgeUnreachableError))
+                                throw err;
+                            label = '—';
+                        }
+                    }
+                    elsewhere.push(`<tr><td>${escapeHtml(pull.headRef)}</td><td>${escapeHtml(mount.slug)}</td><td>${escapeHtml(`${partStore(view, mount)} #${pull.number}`)}</td>` +
+                        `<td><code>${escapeHtml(pull.headSha.slice(0, 7))}</code></td><td>${escapeHtml(label)}</td></tr>`);
+                }
+            }
+        }
+        if (rows.length === 0) {
             html.push(`<p class="ctxr-empty">${escapeHtml(copy('index-empty'))}</p>`);
         }
         else {
             html.push(`<p>${escapeHtml(copy('index-intro'))}</p>`);
             html.push('<table class="ctxr-approve-index"><thead><tr><th>Change</th><th>Pull request</th><th>Commit</th><th>State</th></tr></thead><tbody>');
-            for (const p of pulls) {
-                html.push(`<tr><td><a href="${approveRoute(p.name)}">${escapeHtml(p.name)}</a></td><td>#${p.pull.number}</td>` +
-                    `<td><code>${escapeHtml(p.pull.headSha.slice(0, 7))}</code></td><td>${escapeHtml(STATE_LABEL[p.review.state])}</td></tr>`);
-            }
+            html.push(...rows);
             html.push('</tbody></table>');
         }
+        if (elsewhere.length > 0) {
+            html.push(`<section class="ctxr-approve-elsewhere"><h2>${escapeHtml(copy('elsewhere-heading'))}</h2><p>${escapeHtml(copy('elsewhere-intro'))}</p>`);
+            html.push('<table class="ctxr-approve-index"><thead><tr><th>Session</th><th>Home</th><th>Pull request</th><th>Commit</th><th>State</th></tr></thead><tbody>');
+            html.push(...elsewhere, '</tbody></table></section>');
+        }
     }
     catch (err) {
         if (!(err instanceof ForgeUnreachableError))
@@ -108,6 +174,56 @@ async function indexPage(store, server, kit) {
     }
     return { status: 200, contentType: 'text/html; charset=utf-8', body: await kit.page('approve', { html: html.join('\n'), hasDiagram: false }) };
 }
+/**
+ * One pull request's change as the approval page shows it: the author's account, the knowledge changes, the
+ * changed pages and the line diff — the same for a single pull request and for each part of a session.
+ */
+async function changeSections(server, kit, view) {
+    const { pull } = view;
+    const head = pull.headSha;
+    const base = await baseRef(server.git, view.cwd, view.config.git.default_branch);
+    const prefix = await storePrefix(server.git, view.prefixRoot);
+    const worktreeStoreRoot = path.join(view.cwd, prefix);
+    const mergeBase = (await resolveRange(server.git, view.cwd, base, head)).base;
+    const range = `${mergeBase}..${head}`;
+    const [facts, parts] = await Promise.all([
+        renderReviewAt(server.git, worktreeStoreRoot, view.config, prefix, null, view.linkFor, kit.resolveLink, head),
+        changeParts.get(`${configStamp(view.config)}\0${view.memoName}\0${prefix}\0${mergeBase}\0${head}`, async () => {
+            const [log, pages, files] = await Promise.all([
+                server.git.run(['log', '--reverse', '--no-color', '--format=%H%x1f%B%x1e', range], { cwd: view.cwd }),
+                pageUrlsFor({ root: worktreeStoreRoot, config: view.config }, [range]),
+                readFileDiffs(server.git, worktreeStoreRoot, mergeBase, head, view.config.derived.paths),
+            ]);
+            const commits = log.stdout
+                .split('\x1e')
+                .map((entry) => entry.trim())
+                .filter(Boolean)
+                .map((entry) => {
+                const [sha, message] = entry.split('\x1f');
+                return { sha, message: message.trim() };
+            });
+            return { commits, pages, files };
+        }),
+    ]);
+    const html = [];
+    let hasDiagram = false;
+    // The author's account: labelled as such, and kept apart from everything computed below.
+    const authorBody = renderNoteBody(pull.body, kit.resolveLink);
+    hasDiagram ||= authorBody.hasDiagram;
+    const commits = parts.commits.map((c) => `<li><code>${escapeHtml(c.sha.slice(0, 7))}</code><pre class="ctxr-commit-message">${escapeHtml(c.message)}</pre></li>`);
+    html.push(`<section class="ctxr-author-account"><h2>${escapeHtml(copy('author-heading'))}</h2>`, `<p class="ctxr-summary">${escapeHtml(copy('author-note'))}</p>`, `<h3>${escapeHtml(pull.title)}</h3>`, authorBody.html, `<h3>${escapeHtml(copy('commits-heading'))}</h3><ol class="ctxr-commits">${commits.join('\n')}</ol>`, '</section>');
+    hasDiagram ||= facts.hasDiagram;
+    html.push(`<section class="ctxr-derived"><h2>${escapeHtml(copy('facts-heading'))}</h2>`, facts.html, '</section>');
+    const pages = parts.pages;
+    if (pages.length > 0) {
+        const link = (address) => address === null ? '—' : `<a href="${escapeHtml(address.url ?? address.route)}">${escapeHtml(address.url ?? address.route)}</a>`;
+        const rows = pages.map((p) => `<tr><td>${escapeHtml(p.status)}</td><td>${escapeHtml(p.lifespan)}</td><td><code>${escapeHtml(p.path)}</code></td>` +
+            `<td>${p.status === 'removed' ? '—' : link(p.preview)}</td><td>${link(p.published)}</td></tr>`);
+        html.push(`<section class="ctxr-pages"><h2>${escapeHtml(copy('pages-heading'))}</h2><p class="ctxr-summary">${escapeHtml(copy('pages-note'))}</p>`, `<table><thead><tr><th>Status</th><th>Lifespan</th><th>Page</th><th>Preview</th><th>Published</th></tr></thead><tbody>${rows.join('')}</tbody></table></section>`);
+    }
+    html.push(`<section class="ctxr-changed-files"><h2>${escapeHtml(copy('diff-heading'))}</h2>`, renderFileDiffs(parts.files, { binary: copy('diff-binary'), noFiles: copy('diff-empty') }), '</section>');
+    return { html, hasDiagram };
+}
 async function renderChangePage(store, server, kit, name, notice = {}) {
     const title = `approve — ${name}`;
     const shell = async (status, parts, hasDiagram = false) => ({
@@ -118,6 +234,15 @@ async function renderChangePage(store, server, kit, name, notice = {}) {
     const html = [`<h1>${escapeHtml(name)}</h1>`];
     if (notice.message !== undefined)
         html.push(`<p class="ctxr-approve-notice">${escapeHtml(notice.message)}</p>`);
+    // approve-sessions-across-stores: a session with a marker, homed here, has a page of its own.
+    const view = await readSessionView(store, server, false).catch((err) => {
+        if (err instanceof ForgeUnreachableError)
+            return null;
+        throw err;
+    });
+    const group = view === null ? undefined : findSession(view, name);
+    if (view !== null && group !== undefined)
+        return renderSessionPage(server, kit, view, group, html, title, notice);
     let located;
     try {
         located = await locate(store, server, name);
@@ -150,50 +275,15 @@ async function renderChangePage(store, server, kit, name, notice = {}) {
     if (present.exitCode !== 0) {
         return shell(notice.status ?? 200, [...html, `<p class="ctxr-approve-notice">${escapeHtml(copy('head-missing')).replace('__HEAD__', () => `<code>${escapeHtml(head)}</code>`)}</p>`]);
     }
-    const base = await baseRef(server.git, located.worktreePath, store.config.git.default_branch);
-    const prefix = await storePrefix(server.git, store.root);
-    const worktreeStoreRoot = path.join(located.worktreePath, prefix);
-    const mergeBase = (await resolveRange(server.git, located.worktreePath, base, head)).base;
-    const range = `${mergeBase}..${head}`;
     // The decision state is read fresh every time; everything the commits fix is computed once per pair.
-    const [state, facts, parts] = await Promise.all([
+    const base = await baseRef(server.git, located.worktreePath, store.config.git.default_branch);
+    const [state, sections] = await Promise.all([
         forgeRead(() => reviewStateOf(server.git, located.worktreePath, base, server.forge, server.approval.recording_login, pull)),
-        renderReview(server.git, store, name, null, kit.linkFor, kit.resolveLink, head),
-        changeParts.get(`${configStamp(store.config)}\0${name}\0${prefix}\0${mergeBase}\0${head}`, async () => {
-            const [log, pages, files] = await Promise.all([
-                server.git.run(['log', '--reverse', '--no-color', '--format=%H%x1f%B%x1e', range], { cwd: located.worktreePath }),
-                pageUrlsFor({ root: worktreeStoreRoot, config: store.config }, [range]),
-                readFileDiffs(server.git, worktreeStoreRoot, mergeBase, head, store.config.derived.paths),
-            ]);
-            const commits = log.stdout
-                .split('\x1e')
-                .map((entry) => entry.trim())
-                .filter(Boolean)
-                .map((entry) => {
-                const [sha, message] = entry.split('\x1f');
-                return { sha, message: message.trim() };
-            });
-            return { commits, pages, files };
-        }),
+        changeSections(server, kit, { cwd: located.worktreePath, prefixRoot: store.root, config: store.config, memoName: name, pull, linkFor: kit.linkFor }),
     ]);
-    let hasDiagram = false;
+    let hasDiagram = sections.hasDiagram;
     html.push(`<p>Pull request <a href="${escapeHtml(pull.url)}">#${pull.number}</a>, commit <code>${escapeHtml(head)}</code>. ${escapeHtml(copy('state-line').replace('__STATE__', STATE_LABEL[state.state]))}</p>`);
-    // The author's account: labelled as such, and kept apart from everything computed below.
-    const authorBody = renderNoteBody(pull.body, kit.resolveLink);
-    hasDiagram ||= authorBody.hasDiagram;
-    const commits = parts.commits.map((c) => `<li><code>${escapeHtml(c.sha.slice(0, 7))}</code><pre class="ctxr-commit-message">${escapeHtml(c.message)}</pre></li>`);
-    html.push(`<section class="ctxr-author-account"><h2>${escapeHtml(copy('author-heading'))}</h2>`, `<p class="ctxr-summary">${escapeHtml(copy('author-note'))}</p>`, `<h3>${escapeHtml(pull.title)}</h3>`, authorBody.html, `<h3>${escapeHtml(copy('commits-heading'))}</h3><ol class="ctxr-commits">${commits.join('\n')}</ol>`, '</section>');
-    hasDiagram ||= facts.hasDiagram;
-    html.push(`<section class="ctxr-derived"><h2>${escapeHtml(copy('facts-heading'))}</h2>`, facts.html, '</section>');
-    const pages = parts.pages;
-    if (pages.length > 0) {
-        const link = (address) => address === null ? '—' : `<a href="${escapeHtml(address.url ?? address.route)}">${escapeHtml(address.url ?? address.route)}</a>`;
-        const rows = pages.map((p) => `<tr><td>${escapeHtml(p.status)}</td><td>${escapeHtml(p.lifespan)}</td><td><code>${escapeHtml(p.path)}</code></td>` +
-            `<td>${p.status === 'removed' ? '—' : link(p.preview)}</td><td>${link(p.published)}</td></tr>`);
-        html.push(`<section class="ctxr-pages"><h2>${escapeHtml(copy('pages-heading'))}</h2><p class="ctxr-summary">${escapeHtml(copy('pages-note'))}</p>`, `<table><thead><tr><th>Status</th><th>Lifespan</th><th>Page</th><th>Preview</th><th>Published</th></tr></thead><tbody>${rows.join('')}</tbody></table></section>`);
-    }
-    const files = parts.files;
-    html.push(`<section class="ctxr-changed-files"><h2>${escapeHtml(copy('diff-heading'))}</h2>`, renderFileDiffs(files, { binary: copy('diff-binary'), noFiles: copy('diff-empty') }), '</section>');
+    html.push(...sections.html);
     const action = `${approveRoute(name)}decision`;
     const note = escapeHtml(copy('decision-note')).replace('__HEAD__', () => `<code>${escapeHtml(head.slice(0, 7))}</code>`);
     html.push(`<section class="ctxr-decision"><h2>${escapeHtml(copy('decision-heading'))}</h2><p>${note}</p>`, `<form method="post" action="${action}"><input type="hidden" name="decision" value="approve"><input type="hidden" name="head" value="${head}"><button type="submit">${escapeHtml(copy('approve-button'))}</button></form>`, `<form method="post" action="${action}"><input type="hidden" name="decision" value="request-changes"><input type="hidden" name="head" value="${head}">` +
@@ -209,6 +299,8 @@ async function decide(store, server, makeKit, req, name, email) {
     const form = await readForm(req);
     if (form === null)
         return text(413, 'decision too large');
+    if (form.getAll('part').length > 0)
+        return decideSession(store, server, makeKit, form, name, email);
     const decision = form.get('decision');
     const head = form.get('head') ?? '';
     const comment = (form.get('comment') ?? '').trim();
@@ -255,6 +347,232 @@ async function decide(store, server, makeKit, req, name, email) {
         landingRequested: kind === 'approve',
     };
 }
+const forgeForCache = new WeakMap();
+function forgeForOf(server) {
+    if (server.forgeFor !== undefined)
+        return server.forgeFor;
+    let forgeFor = forgeForCache.get(server);
+    if (forgeFor === undefined) {
+        const env = server.env ?? {};
+        forgeFor = storeForges({ env, git: server.git, now: () => server.now() }, server.forge);
+        forgeForCache.set(server, forgeFor);
+    }
+    return forgeFor;
+}
+/**
+ * Null when the store has no `origin` to name it by — no session can be homed in it then. `fresh` skips the
+ * page-view cache of the store's own open pull requests, as a decision must.
+ */
+async function readSessionView(store, server, fresh) {
+    const canonical = await mainWorktreePath(server.git, store.root);
+    const reach = await storeReach(server.git, { root: store.root, canonical, config: store.config, forge: server.forge, credentials: server.credentials }, forgeForOf(server));
+    if (reach === null)
+        return null;
+    const listings = await listOpen(reach, fresh ? undefined : () => openPulls(server));
+    return { reach, listings, groups: groupSessions(reach, listings) };
+}
+/** The session homed here whose page is `name`: the home session's branch as a worktree directory name. */
+function findSession(view, name) {
+    return view.groups.find((g) => g.homedHere && sessionRouteName(g.identity) === name);
+}
+function partStore(view, store) {
+    return store === view.reach.home ? view.reach.home.slug : (store.mountName ?? store.slug);
+}
+/** The session's parts, named or open, on a store whose pull requests could not be read: no decision is offered then. */
+function unreadableParts(view, state) {
+    const unreadable = view.listings.filter((l) => l.error !== null).map((l) => l.store.slug);
+    return state.parts.filter((p) => unreadable.includes(p.storeSlug)).map((p) => `${p.storeSlug}#${p.number}`);
+}
+/**
+ * change-approval spec ("The approval page shows every part of a session"): the
+ * checkout a part's change is read in. The home store's session worktree when
+ * it is here; otherwise the store's own clone, after fetching the part's head
+ * into a ref namespace of this server's own (`refs/ctxr-approve/<number>`),
+ * which leaves the clone's branches and working tree untouched.
+ */
+async function partCheckout(server, view, store, pull) {
+    if (store === view.reach.home) {
+        const worktree = (await sessionWorktrees(server.git, store.root, store.config)).find((w) => w.branch === pull.headRef);
+        if (worktree !== undefined) {
+            const there = await server.git.run(['cat-file', '-e', `${pull.headSha}^{commit}`], { cwd: worktree.path, allowFailure: true });
+            if (there.exitCode === 0)
+                return worktree.path;
+        }
+    }
+    const present = async () => (await server.git.run(['cat-file', '-e', `${pull.headSha}^{commit}`], { cwd: store.root, allowFailure: true })).exitCode === 0;
+    if (await present())
+        return store.root;
+    const refspec = `+refs/heads/${pull.headRef}:refs/ctxr-approve/${pull.number}`;
+    const env = server.env ?? {};
+    await runRemoteGit(server.git, store.credentials ?? ghCredentials(env), env, ['fetch', '--quiet', '--no-tags', 'origin', refspec], { cwd: store.root, allowFailure: true });
+    return (await present()) ? store.root : null;
+}
+async function renderSessionPage(server, kit, view, group, html, title, notice) {
+    let state = null;
+    try {
+        state = await forgeRead(() => sessionState({ git: server.git, reach: view.reach, identity: group.identity, homedHere: true, open: group.parts, recordingLogin: server.approval.recording_login }));
+    }
+    catch (err) {
+        if (!(err instanceof ForgeUnreachableError))
+            throw err;
+    }
+    let hasDiagram = false;
+    html.push(`<p>${escapeHtml(copy('session-intro').replace('__COUNT__', String(group.parts.length)))}</p>`);
+    if (state !== null)
+        html.push(`<p>${escapeHtml(copy('state-line').replace('__STATE__', STATE_LABEL[state.state]))}</p>`);
+    else
+        html.push(`<p class="ctxr-approve-notice">${escapeHtml(copy('forge-unreachable'))}</p>`);
+    for (const listing of view.listings) {
+        if (listing.error !== null)
+            html.push(`<p class="ctxr-approve-notice">${escapeHtml(copy('store-unreachable').replace('__STORE__', storeLabel(listing.store)))}</p>`);
+    }
+    let decidable = state !== null && unreadableParts(view, state).length === 0;
+    const fields = [];
+    // Landing order: the parts in mounted stores first, then this store's.
+    for (const part of group.parts) {
+        const { store, pull } = part;
+        const pullLink = `<a href="${escapeHtml(pull.url)}">#${pull.number}</a>`;
+        const heading = escapeHtml(copy('part-heading'))
+            .replace('__STORE__', () => escapeHtml(partStore(view, store)))
+            .replace('__PULL__', () => pullLink);
+        html.push(`<section class="ctxr-approve-part"><h2>${heading}</h2>`, `<p>Commit <code>${escapeHtml(pull.headSha)}</code>.</p>`);
+        const cwd = await partCheckout(server, view, store, pull);
+        if (cwd === null) {
+            decidable = false;
+            html.push(`<p class="ctxr-approve-notice">${escapeHtml(copy('head-missing')).replace('__HEAD__', () => `<code>${escapeHtml(pull.headSha)}</code>`)}</p>`, '</section>');
+            continue;
+        }
+        const location = store.mountName === null ? null : `shared/${store.mountName}`;
+        const sections = await changeSections(server, kit, {
+            cwd,
+            prefixRoot: store.root,
+            config: store.config,
+            memoName: `${store.slug}#${pull.number}`,
+            pull,
+            linkFor: location === null ? kit.linkFor : (notePath) => kit.linkFor(`${location}/${notePath}`),
+        });
+        hasDiagram ||= sections.hasDiagram;
+        html.push(...sections.html, '</section>');
+        fields.push(`<input type="hidden" name="part" value="${escapeHtml(`${store.slug}#${pull.number}@${pull.headSha}`)}">`);
+    }
+    if (!decidable) {
+        html.push(`<section class="ctxr-decision"><h2>${escapeHtml(copy('decision-heading'))}</h2><p class="ctxr-approve-notice">${escapeHtml(copy('session-no-decision'))}</p></section>`);
+    }
+    else {
+        const action = `${approveRoute(sessionRouteName(group.identity))}decision`;
+        const hidden = fields.join('');
+        html.push(`<section class="ctxr-decision"><h2>${escapeHtml(copy('decision-heading'))}</h2><p>${escapeHtml(copy('session-decision-note'))}</p>`, `<form method="post" action="${action}"><input type="hidden" name="decision" value="approve">${hidden}<button type="submit">${escapeHtml(copy('approve-button'))}</button></form>`, `<form method="post" action="${action}"><input type="hidden" name="decision" value="request-changes">${hidden}` +
+            `<label for="ctxr-comment">${escapeHtml(copy('comment-label'))}</label><textarea id="ctxr-comment" name="comment" rows="5" required></textarea>` +
+            `<button type="submit">${escapeHtml(copy('request-changes-button'))}</button></form>`, '</section>');
+    }
+    return { status: notice.status ?? 200, contentType: 'text/html; charset=utf-8', body: await kit.page(title, { html: html.join('\n'), hasDiagram }) };
+}
+const PART_FIELD = /^([^/#@\s]+\/[^/#@\s]+)#(\d+)@([0-9a-f]{40})$/;
+/**
+ * change-approval spec ("A session is decided only on its home store's page,
+ * for every part it names"): the parts posted must be exactly the session's
+ * open parts at the heads the page showed, every store they are on must be
+ * readable, and the decider must be a decider of every one of those stores.
+ * Anything else records nothing. An accepted decision gets one id; its record
+ * review goes on the record part first, then a copy on every other part. A
+ * copy that fails leaves the decision standing, and the reply says which.
+ */
+async function decideSession(store, server, makeKit, form, name, email) {
+    const decision = form.get('decision');
+    const comment = (form.get('comment') ?? '').trim();
+    const posted = [];
+    for (const value of form.getAll('part')) {
+        const m = PART_FIELD.exec(value);
+        if (m === null)
+            return text(400, 'malformed decision');
+        posted.push({ store: m[1], number: Number.parseInt(m[2], 10), head: m[3] });
+    }
+    if (decision !== 'approve' && decision !== 'request-changes')
+        return text(400, 'malformed decision');
+    if (comment.length > MAX_COMMENT_CHARS)
+        return text(413, 'comment too long');
+    const view = await readSessionView(store, server, true);
+    if (view === null)
+        return text(404, 'not found');
+    const page = async (notice) => renderChangePage(store, server, await makeKit(), name, notice);
+    const elsewhere = view.groups.find((g) => !g.homedHere && sessionRouteName(g.identity) === name);
+    if (elsewhere !== undefined)
+        return text(409, copy('homed-elsewhere').replace('__HOME__', elsewhere.identity.home));
+    const group = findSession(view, name);
+    if (group === undefined)
+        return text(404, 'not found');
+    const postedStores = new Set(posted.map((p) => p.store));
+    const unreadable = view.listings.find((l) => l.error !== null && (postedStores.has(l.store.slug) || l.store === view.reach.home));
+    if (unreadable !== undefined)
+        return page({ status: 502, message: copy('store-unreachable').replace('__STORE__', storeLabel(unreadable.store)) });
+    const current = group.parts.map((p) => `${p.store.slug}#${p.pull.number}@${p.pull.headSha}`).sort();
+    const sent = posted.map((p) => `${p.store}#${p.number}@${p.head}`).sort();
+    if (current.length !== sent.length || current.some((c, i) => c !== sent[i]))
+        return page({ status: 409, message: copy('parts-changed') });
+    if (decision === 'request-changes' && comment === '')
+        return page({ status: 400, message: copy('comment-required') });
+    // D5: every store the session changes must count this person among its deciders, read from the forge now.
+    for (const part of group.parts) {
+        if (part.store === view.reach.home)
+            continue;
+        let deciders;
+        try {
+            deciders = await decidersOnForge(server.git, part.store);
+        }
+        catch (err) {
+            if (!(err instanceof ForgeRequestError))
+                throw err;
+            return page({ status: 502, message: copy('record-failed') });
+        }
+        if (!isDecider(email, deciders))
+            return page({ status: 403, message: copy('not-decider').replace('__STORE__', storeLabel(part.store)) });
+    }
+    const kind = decision;
+    const at = server.now().toISOString();
+    const parts = group.parts.map((p) => ({ store: p.store.slug, number: p.pull.number, head: p.pull.headSha }));
+    const session = { id: randomUUID(), session: group.identity, parts };
+    const record = recordPartOf(session);
+    const post = async (ref) => {
+        const part = group.parts.find((p) => p.store.slug === ref.store && p.pull.number === ref.number);
+        await part.store.forge.createReview(ref.number, {
+            event: kind === 'approve' ? 'APPROVE' : 'REQUEST_CHANGES',
+            commitId: ref.head,
+            body: decisionBody({ decision: kind, head: ref.head, by: email, at, carriedFrom: null, comment: kind === 'approve' ? null : comment, session }),
+        });
+    };
+    try {
+        await post(record);
+    }
+    catch (err) {
+        if (!(err instanceof ForgeRequestError))
+            throw err;
+        return page({ status: 502, message: copy('record-failed') });
+    }
+    const missing = [];
+    for (const ref of parts) {
+        if (ref === record)
+            continue;
+        try {
+            await post(ref);
+        }
+        catch (err) {
+            if (!(err instanceof ForgeRequestError))
+                throw err;
+            missing.push(`${ref.store}#${ref.number}`);
+        }
+    }
+    if (missing.length > 0) {
+        const reply = await page({ status: 200, message: copy('copies-missing').replace('__PARTS__', missing.join(', ')) });
+        return { ...reply, landingRequested: kind === 'approve' };
+    }
+    return {
+        status: 303,
+        contentType: 'text/plain; charset=utf-8',
+        body: 'recorded\n',
+        headers: { Location: approveRoute(name) },
+        landingRequested: kind === 'approve',
+    };
+}
 /**
  * Answers every request under the approval prefix. `server` is null when the
  * store declares no change approval, and then every such path is `404` —