devrites 7.2.8 → 7.3.1

package/engine/internal/lib/context.go

@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"crypto/sha256"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -93,12 +94,18 @@ func RunContext(root string, args []string, stdout, stderr io.Writer) int {
 			return 2
 		}
 	}
+	sources := contextSources{dir: featureDir}
 	// One active slice per bundle, except a parallel batch: the root has to
 	// see the other slices to start them. Whole tasks/plan/decisions ride
 	// that batch's turns; serial runs stay scoped.
 	autoScope := false
 	if featureDir != "" && opts.role == "" && opts.slice == "" && !opts.whole && (opts.phase == "build" || opts.phase == "autocomplete") && !parallelPlanVisible(root, opts.slug) {
-		if id := activeSliceScope(featureDir); id != "" {
+		id, err := activeSliceScope(&sources)
+		if err != nil {
+			fmt.Fprintf(stderr, "context: %v\n", err)
+			return 2
+		}
+		if id != "" {
 			opts.slices, opts.slice, autoScope = []string{id}, id, true
 		}
 	}
@@ -110,10 +117,21 @@ func RunContext(root string, args []string, stdout, stderr io.Writer) int {
 	var inventory []byte
 	recheckPath := opts.recheck
 	if recheckPath != "" {
-		if !filepath.IsAbs(recheckPath) {
+		if filepath.IsAbs(recheckPath) {
+			absoluteFeature, absErr := filepath.Abs(featureDir)
+			if absErr != nil {
+				fmt.Fprintf(stderr, "context: --recheck: %v\n", absErr)
+				return 2
+			}
+			if rel, relErr := filepath.Rel(absoluteFeature, recheckPath); relErr == nil && filepath.IsLocal(rel) {
+				inventory, err = sources.read(rel)
+			} else {
+				inventory, err = readBoundedRegularFile(recheckPath, workspaceArtifactLimit)
+			}
+		} else {
+			inventory, err = sources.read(recheckPath)
 			recheckPath = filepath.Join(featureDir, filepath.FromSlash(recheckPath))
 		}
-		inventory, err = os.ReadFile(recheckPath) // #nosec G304 -- the root names its own recheck inventory file
 		if err == nil && len(bytes.TrimSpace(inventory)) == 0 {
 			err = fmt.Errorf("%s is empty", opts.recheck)
 		}
@@ -141,7 +159,7 @@ func RunContext(root string, args []string, stdout, stderr io.Writer) int {
 	var sliceBlock string
 	var sliceIDs []citedID
 	if opts.slice != "" {
-		raw, err := os.ReadFile(filepath.Join(featureDir, "tasks.md")) // #nosec G304 -- featureDir is the validated feature workspace
+		raw, err := sources.read("tasks.md")
 		if err != nil {
 			fmt.Fprintf(stderr, "context: %v\n", err)
 			return 2
@@ -238,12 +256,17 @@ func RunContext(root string, args []string, stdout, stderr io.Writer) int {
 	}
 	// The open findings lead a recheck bundle, before any reference text.
 	if inventory != nil {
-		writeContextEntry(&bundle, recheckPath, "recheck inventory: "+opts.recheck, seen, false)
+		writeContextData(&bundle, recheckPath, "recheck inventory: "+opts.recheck, inventory, nil, seen, false)
 		loaded++
 	}
 	var rootOnly []string
 	citedSections, packByReference := 0, 0
-	keepModel := opts.role == "" || keepModelSurface(opts.role, gatherTriggerFacts(root, featureDir, opts.role))
+	facts, err := gatherTriggerFacts(root, opts.role, &sources)
+	if err != nil {
+		fmt.Fprintf(stderr, "context: %v\n", err)
+		return 2
+	}
+	keepModel := opts.role == "" || keepModelSurface(opts.role, facts)
 	for _, rel := range files {
 		abs := filepath.Join(skillsRoot, filepath.FromSlash(rel))
 		if seen[abs] {
@@ -297,16 +320,21 @@ func RunContext(root string, args []string, stdout, stderr io.Writer) int {
 		}
 		for _, rel := range workspaceList {
 			abs := filepath.Join(featureDir, filepath.FromSlash(rel))
+			data, err := sources.read(rel)
+			if err != nil && !errors.Is(err, os.ErrNotExist) {
+				fmt.Fprintf(stderr, "context: %v\n", err)
+				return 2
+			}
 			// Role bundles without --slice (full Vet, Review, Seal) read
 			// everything; root and --slice bundles take over-budget
 			// artifacts by anchor.
 			if opts.slice == "" && opts.role != "" {
-				if writeContextEntry(&bundle, abs, "workspace/"+rel, seen, false) {
+				if writeContextData(&bundle, abs, "workspace/"+rel, data, err, seen, false) {
 					loaded++
 				}
 				continue
 			}
-			ok, byRef := writeSliceEntry(&bundle, filepath.Dir(root), abs, "workspace/"+rel, opts.slice, sliceBlock, sliceIDs, seen)
+			ok, byRef := writeSliceEntry(&bundle, filepath.Dir(root), abs, "workspace/"+rel, data, err, opts.slice, sliceBlock, sliceIDs, seen)
 			if ok {
 				loaded++
 			}
@@ -322,34 +350,11 @@ func RunContext(root string, args []string, stdout, stderr io.Writer) int {
 	withTOC := insertSectionTOC(bundle.String())
 	bundle.Reset()
 	bundle.WriteString(withTOC)
-	out := opts.out
-	if out == "" {
-		out = filepath.Join(featureDir, "ctx", bundleName(opts))
-	} else if !filepath.IsAbs(out) && featureDir != "" {
-		out = filepath.Join(featureDir, filepath.FromSlash(out))
-	}
-	if err := os.MkdirAll(filepath.Dir(out), 0o755); err != nil {
+	out, unchanged, err := publishContext(featureDir, opts, []byte(bundle.String()))
+	if err != nil {
 		fmt.Fprintf(stderr, "context: %v\n", err)
 		return 2
 	}
-	digestPath := out + ".sha256"
-	digest := fmt.Sprintf("%x", sha256.Sum256([]byte(bundle.String())))
-	unchanged := false
-	if prev, err := os.ReadFile(digestPath); err == nil && strings.TrimSpace(string(prev)) == digest { // #nosec G304 -- digestPath is generated under the feature workspace
-		if _, err := os.Stat(out); err == nil {
-			unchanged = true
-		}
-	}
-	if !unchanged {
-		if err := os.WriteFile(out, []byte(bundle.String()), 0o600); err != nil {
-			fmt.Fprintf(stderr, "context: %v\n", err)
-			return 2
-		}
-		if err := os.WriteFile(digestPath, []byte(digest+"\n"), 0o600); err != nil {
-			fmt.Fprintf(stderr, "context: %v\n", err)
-			return 2
-		}
-	}
 	if opts.slug != "" {
 		phaseLabel := opts.phase
 		if phaseLabel == "" {
@@ -396,7 +401,7 @@ func RunContext(root string, args []string, stdout, stderr io.Writer) int {
 			fmt.Fprintf(stdout, "triggers: auto=[%s] (fired by --role dispatch)\n",
 				strings.Join(autoTriggers, ","))
 		}
-		if suggested := suggestTriggers(manifest, root, featureDir, opts); len(suggested) > 0 {
+		if suggested := suggestTriggers(manifest, opts, facts); len(suggested) > 0 {
 			fmt.Fprintf(stdout, "triggers: suggested=[%s] (advisory — confirm each before use)\n",
 				strings.Join(suggested, ","))
 			// The advisory list is only actionable if the agent is told how to
@@ -558,11 +563,10 @@ const sliceInlineMaxBytes = 16 << 10
 // other artifact but spec.md over sliceInlineMaxBytes as a by-reference index;
 // any canonical artifact over its line/byte budget as a by-reference index;
 // everything else whole.
-func writeSliceEntry(bundle *strings.Builder, project, abs, label, slice, block string, ids []citedID, seen map[string]bool) (loaded, byRef bool) {
+func writeSliceEntry(bundle *strings.Builder, project, abs, label string, data []byte, err error, slice, block string, ids []citedID, seen map[string]bool) (loaded, byRef bool) {
 	if seen[abs] {
 		return false, false
 	}
-	data, err := os.ReadFile(abs) // #nosec G304 -- abs is resolved from the validated feature workspace
 	name := filepath.Base(abs)
 	if err == nil && name == "tasks.md" && slice != "" {
 		seen[abs] = true
@@ -570,7 +574,7 @@ func writeSliceEntry(bundle *strings.Builder, project, abs, label, slice, block
 	} else if err == nil && slice != "" && name != "spec.md" && len(data) > sliceInlineMaxBytes {
 		seen[abs] = true
 	} else if status, ok := state.ArtifactBudget(name, data); err != nil || !ok || !status.Over {
-		return writeContextEntry(bundle, abs, label, seen, false), false
+		return writeContextData(bundle, abs, label, data, err, seen, false), false
 	} else {
 		seen[abs] = true
 	}
@@ -726,12 +730,19 @@ func clipRunes(s string, n int) string {
 }
 
 func writeContextEntry(bundle *strings.Builder, abs, label string, seen map[string]bool, expand bool) bool {
+	if seen[abs] {
+		return false
+	}
+	data, err := os.ReadFile(abs) // #nosec G304 -- abs is resolved from the validated context source set
+	return writeContextData(bundle, abs, label, data, err, seen, expand)
+}
+
+func writeContextData(bundle *strings.Builder, abs, label string, data []byte, err error, seen map[string]bool, expand bool) bool {
 	if seen[abs] {
 		return false
 	}
 	seen[abs] = true
 	fmt.Fprintf(bundle, "===== %s =====\n", label)
-	data, err := os.ReadFile(abs) // #nosec G304 -- abs is resolved from the validated context source set
 	if err != nil {
 		fmt.Fprintf(bundle, "MISSING: %s\n\n", label)
 		return false
@@ -926,20 +937,28 @@ func roleAgentPath(manifest loadsManifest, role string) string {
 
 // activeSliceScope is state.md's active_slice when it names a slice block in
 // tasks.md, else "" (unset, "none", or stale cursors keep the whole bundle).
-func activeSliceScope(featureDir string) string {
-	lines := strings.Split(string(readWorkspaceFile(featureDir, "state.md")), "\n")
+func activeSliceScope(sources *contextSources) (string, error) {
+	raw, err := sources.read("state.md")
+	if err != nil && !errors.Is(err, os.ErrNotExist) {
+		return "", err
+	}
+	lines := strings.Split(string(raw), "\n")
 	// active_slice outlives Build; after it the root's autocomplete bundle stays whole.
 	if phase, _ := state.CursorField(lines, state.CursorPhase); strings.TrimSpace(phase) != "build" {
-		return ""
+		return "", nil
 	}
 	id, _ := state.CursorField(lines, state.CursorActiveSlice)
 	if id = strings.TrimSpace(id); !state.ValidSliceID(id) {
-		return ""
+		return "", nil
+	}
+	tasks, err := sources.read("tasks.md")
+	if err != nil && !errors.Is(err, os.ErrNotExist) {
+		return "", err
 	}
-	if _, ok := state.ExtractTaskSlice(readWorkspaceFile(featureDir, "tasks.md"), id); !ok {
-		return ""
+	if _, ok := state.ExtractTaskSlice(tasks, id); !ok {
+		return "", nil
 	}
-	return id
+	return id, nil
 }
 
 func bundleName(opts contextOpts) string {

package/engine/internal/lib/context_io.go

@@ -0,0 +1,171 @@
+package lib
+
+import (
+	"bytes"
+	"crypto/sha256"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/devrites/devrites/internal/fsutil"
+)
+
+type contextSource struct {
+	data []byte
+	err  error
+}
+
+// contextSources retains one invocation's bytes, including optional absence.
+type contextSources struct {
+	dir   string
+	files map[string]contextSource
+}
+
+func (s *contextSources) read(name string) ([]byte, error) {
+	if s.dir == "" {
+		return nil, os.ErrNotExist
+	}
+	name = filepath.Clean(filepath.FromSlash(name))
+	if !filepath.IsLocal(name) {
+		return nil, fmt.Errorf("workspace artifact %q escapes workspace", name)
+	}
+	if source, ok := s.files[name]; ok {
+		return source.data, source.err
+	}
+	var source contextSource
+	if source.err = contextParents(s.dir, name); source.err == nil {
+		source.data, source.err = readBoundedRegularFile(filepath.Join(s.dir, name), workspaceArtifactLimit)
+	}
+	if source.err != nil {
+		source.err = fmt.Errorf("workspace artifact %s: %w", name, source.err)
+	}
+	if s.files == nil {
+		s.files = make(map[string]contextSource)
+	}
+	s.files[name] = source
+	return source.data, source.err
+}
+
+// Reject even in-workspace parent links: managed paths name actual directories.
+func contextParents(dir, rel string) error {
+	parent := filepath.Dir(rel)
+	if parent == "." {
+		return nil
+	}
+	for _, part := range strings.Split(parent, string(filepath.Separator)) {
+		dir = filepath.Join(dir, part)
+		info, err := os.Lstat(dir)
+		if os.IsNotExist(err) {
+			return nil
+		}
+		if err != nil {
+			return err
+		}
+		if !info.IsDir() {
+			return fmt.Errorf("context parent %s is not a directory (symlinks are not allowed)", dir)
+		}
+	}
+	return nil
+}
+
+func publishContext(featureDir string, opts contextOpts, body []byte) (out string, unchanged bool, err error) {
+	out = opts.out
+	managed := featureDir != "" && (out == "" || !filepath.IsAbs(out))
+	if out == "" {
+		out = filepath.Join("ctx", bundleName(opts))
+	}
+	base, rel := featureDir, out
+	if !managed && featureDir != "" {
+		absoluteFeature, absErr := filepath.Abs(featureDir)
+		if absErr != nil {
+			return out, false, absErr
+		}
+		if within, relErr := filepath.Rel(absoluteFeature, out); relErr == nil && filepath.IsLocal(within) {
+			managed, rel = true, within
+		}
+	}
+	if managed {
+		if !filepath.IsLocal(rel) {
+			return out, false, fmt.Errorf("context output %q escapes workspace", out)
+		}
+		if err := contextParents(base, rel); err != nil {
+			return out, false, err
+		}
+		out = filepath.Join(base, rel)
+	} else {
+		base, rel = filepath.Dir(out), filepath.Base(out)
+		if err := os.MkdirAll(base, 0o755); err != nil {
+			return out, false, err
+		}
+	}
+	ws, err := os.OpenRoot(base)
+	if err != nil {
+		return out, false, err
+	}
+	defer func() { _ = ws.Close() }()
+	if err := ws.MkdirAll(filepath.Dir(rel), 0o755); err != nil {
+		return out, false, err
+	}
+	digest := []byte(fmt.Sprintf("%x\n", sha256.Sum256(body)))
+	// Check both destinations before publishing either; never follow a leaf link.
+	matches := true
+	for _, entry := range []struct {
+		name string
+		data []byte
+	}{{rel, body}, {rel + ".sha256", digest}} {
+		info, err := ws.Lstat(entry.name)
+		if os.IsNotExist(err) {
+			matches = false
+			continue
+		}
+		if err != nil {
+			return out, false, err
+		}
+		if !info.Mode().IsRegular() {
+			return out, false, fmt.Errorf("context output %s is not a regular file", entry.name)
+		}
+		// shortcut: Windows FileMode cannot prove POSIX 0600; rebuild until ACL-aware reuse is needed.
+		if info.Mode() != 0o600 || info.Size() != int64(len(entry.data)) {
+			matches = false
+			continue
+		}
+		// Open through the confined root; replacement still uses an atomic rename.
+		file, err := ws.Open(entry.name)
+		if err != nil {
+			return out, false, err
+		}
+		opened, err := file.Stat()
+		if err == nil && (opened.Mode() != 0o600 || !os.SameFile(info, opened)) {
+			err = fmt.Errorf("context output %s changed while opening", entry.name)
+		}
+		var data []byte
+		if err == nil {
+			data, err = io.ReadAll(io.LimitReader(file, int64(len(entry.data))+1))
+		}
+		if err == nil {
+			current, statErr := ws.Lstat(entry.name)
+			if statErr != nil {
+				err = statErr
+			} else if current.Mode() != 0o600 || !os.SameFile(opened, current) {
+				err = fmt.Errorf("context output %s changed while reading", entry.name)
+			}
+		}
+		_ = file.Close()
+		if err != nil {
+			return out, false, err
+		}
+		matches = matches && bytes.Equal(data, entry.data)
+	}
+	if matches {
+		return out, true, nil
+	}
+	if err := fsutil.WriteFileAtomicIn(ws, rel, body, 0o600); err != nil {
+		return out, false, err
+	}
+	if err := fsutil.WriteFileAtomicIn(ws, rel+".sha256", digest, 0o600); err != nil {
+		return out, false, err
+	}
+	return out, false, nil
+}

package/engine/internal/lib/detect.go

@@ -251,27 +251,27 @@ func manifestFallback(root string, slot string) (detectedCommand, bool) {
 	}
 	manifests := []manifest{
 		{"go.mod", "go.mod", map[string]string{
-			"unit": "go test ./...", "integration": "go test -tags=integration ./...",
+			"unit": "go test ./...",
 			"lint": "golangci-lint run", "vet": "go vet ./...", "build": "go build ./...",
 		}},
 		{"Cargo.toml", "Cargo.toml", map[string]string{
-			"unit": "cargo test", "integration": "cargo test -- --ignored",
+			"unit": "cargo test",
 			"lint": "cargo clippy --all-targets", "vet": "cargo check", "build": "cargo build",
 		}},
 		{"pyproject.toml", "pyproject.toml", map[string]string{
-			"unit": "python -m pytest", "integration": "python -m pytest -m integration",
+			"unit": "python -m pytest",
 			"lint": "ruff check", "vet": "mypy .", "build": "python -m build",
 		}},
 		{"setup.py", "setup.py", map[string]string{
-			"unit": "python -m pytest", "integration": "python -m pytest -m integration",
+			"unit": "python -m pytest",
 			"lint": "flake8", "vet": "mypy .",
 		}},
 		{"pom.xml", "pom.xml", map[string]string{
-			"unit": "mvn test", "integration": "mvn verify",
-			"vet": "mvn -q compile", "build": "mvn package",
+			"unit": "mvn test",
+			"vet":  "mvn -q compile", "build": "mvn package",
 		}},
 		{"build.gradle", "build.gradle", map[string]string{
-			"unit": "gradle test", "integration": "gradle integrationTest",
+			"unit": "gradle test",
 			"lint": "gradle check", "build": "gradle build",
 		}},
 		{"composer.json", "composer.json", map[string]string{
@@ -279,7 +279,7 @@ func manifestFallback(root string, slot string) (detectedCommand, bool) {
 			"vet": "vendor/bin/phpstan analyse",
 		}},
 		{"Gemfile", "Gemfile", map[string]string{
-			"unit": "bundle exec rspec", "integration": "bundle exec rspec --tag integration",
+			"unit": "bundle exec rspec",
 			"lint": "bundle exec rubocop",
 		}},
 		{"mix.exs", "mix.exs", map[string]string{

package/engine/internal/lib/dispatch.go

@@ -325,6 +325,8 @@ func dispatchLocked(root, slug, sub, phase, wave, role, handle, reason string, r
 					if err := lintReviewCandidate(root, slug, packet); err != nil {
 						return fail("BLOCKED: %v", err)
 					}
+				} else if err := lintPacketDiffs(root, slug, packet, false); err != nil {
+					return fail("BLOCKED: %v", err)
 				}
 				break
 			}

package/engine/internal/lib/packet.go

@@ -91,6 +91,21 @@ func RunPacket(root string, args []string, stdout, stderr io.Writer) int {
 	if err != nil {
 		return fail(err)
 	}
+	code := 0
+	if err := state.WithFeatureLock(root, slug, func() error {
+		code = renderPacketLocked(root, slug, workspace, wave, phase, role, slice, checks, focus, recheck, wright, doubt, stdout, stderr)
+		return nil
+	}); err != nil {
+		return fail(err)
+	}
+	return code
+}
+
+func renderPacketLocked(root, slug, workspace, wave, phase, role, slice, checks, focus, recheck string, wright, doubt bool, stdout, stderr io.Writer) int {
+	fail := func(err error) int {
+		fmt.Fprintf(stderr, "packet: %v\n", err)
+		return 3
+	}
 	rel := workspaceRel(root, workspace)
 	bundle := "ctx/" + bundleName(contextOpts{phase: phase, role: role, slice: slice, recheck: recheck})
 	if info, err := os.Stat(filepath.Join(workspace, filepath.FromSlash(bundle))); err != nil || !info.Mode().IsRegular() {
@@ -188,16 +203,24 @@ func RunPacket(root string, args []string, stdout, stderr io.Writer) int {
 		return fail(err)
 	}
 	// Lint a sibling draft so a refused re-render keeps the packet already on disk.
-	draft := filepath.Join(workspace, "packets", "."+name+".draft")
-	if err := state.AtomicWrite(draft, []byte(b.String()), 0o600); err != nil {
+	draftFile, err := os.CreateTemp(filepath.Dir(out), "."+name+".draft-*")
+	if err != nil {
+		return fail(err)
+	}
+	draft := draftFile.Name()
+	defer func() { _ = os.Remove(draft) }()
+	_, writeErr := io.WriteString(draftFile, b.String())
+	if writeErr == nil {
+		writeErr = draftFile.Sync()
+	}
+	closeErr := draftFile.Close()
+	if err := errors.Join(writeErr, closeErr); err != nil {
 		return fail(err)
 	}
 	if err := lintRenderedPacket(root, slug, draft, role, wright, finalPhase); err != nil {
-		_ = os.Remove(draft)
 		return fail(fmt.Errorf("BLOCKED: %w", err))
 	}
 	if err := os.Rename(draft, out); err != nil {
-		_ = os.Remove(draft)
 		return fail(err)
 	}
 	fmt.Fprintf(stdout, "packet: %s/packets/%s (%s, %d bytes)\n", rel, name, role, b.Len())
@@ -216,7 +239,7 @@ func lintRenderedPacket(root, slug, path, role string, wright, finalPhase bool)
 	if finalPhase {
 		return lintReviewCandidate(root, slug, path)
 	}
-	return nil
+	return lintPacketDiffs(root, slug, path, false)
 }
 
 // frozenCandidate returns packets/<wave>.sha256 when candidate freeze wrote
@@ -231,8 +254,15 @@ func frozenCandidate(workspace, wave string) (sums string, partial bool, err err
 	if err != nil {
 		return "", false, fmt.Errorf("packets/%s.sha256: %w", wave, err)
 	}
-	if info, err := os.Stat(filepath.Join(workspace, "packets", wave+".diff")); err != nil || !info.Mode().IsRegular() || info.Size() == 0 {
-		return "", false, fmt.Errorf("packets/%s.sha256 has no non-empty packets/%s.diff beside it; rerun candidate freeze under a new wave", wave, wave)
+	bindings, err := frozenDiffBindings(raw)
+	if err != nil || len(bindings) != 1 || bindings[0].name != "packets/"+wave+".diff" {
+		return "", false, fmt.Errorf("packets/%s.sha256 must bind exactly packets/%s.diff with a diff SHA256 checksum", wave, wave)
+	}
+	if _, _, err := candidatePathInfo(workspace, "packets/"+wave+".diff"); err != nil {
+		return "", false, err
+	}
+	if err := verifyFrozenDiff(filepath.Join(workspace, "packets", wave+".diff"), bindings[0].digest); err != nil {
+		return "", false, fmt.Errorf("packets/%s.diff: %w", wave, err)
 	}
 	if len(raw) <= maxContractBytes/2 {
 		return string(raw), false, nil

package/engine/internal/lib/packet_freeze.go

@@ -1,6 +1,7 @@
 package lib
 
 import (
+	"bytes"
 	"crypto/sha256"
 	"errors"
 	"fmt"
@@ -80,6 +81,22 @@ func RunCandidateFreeze(root string, args []string, stdout, stderr io.Writer) in
 	if err != nil {
 		return fail(err)
 	}
+	code := 0
+	if err := state.WithFeatureLock(root, slug, func() error {
+		code = freezeCandidateLocked(root, slug, workspace, wave, slice, base, worktree, paths, stdout, stderr)
+		return nil
+	}); err != nil {
+		return fail(err)
+	}
+	return code
+}
+
+func freezeCandidateLocked(root, slug, workspace, wave, slice, base, worktree string, paths []string, stdout, stderr io.Writer) int {
+	fail := func(err error) int {
+		fmt.Fprintf(stderr, "candidate freeze: %v\n", err)
+		return 3
+	}
+	var err error
 	if slice != "" {
 		if paths, err = slicePaths(root, slug, slice); err != nil {
 			return fail(err)
@@ -98,13 +115,10 @@ func RunCandidateFreeze(root string, args []string, stdout, stderr io.Writer) in
 	if err := validateCandidateRows(project, rows); err != nil {
 		return fail(err)
 	}
-	diff, baseCommit, err := freezeDiff(project, base, rows)
+	digest, err := hashCandidate(project, rows, true)
 	if err != nil {
 		return fail(err)
 	}
-	if len(diff) == 0 {
-		return fail(errors.New("the path set has no change against the base; there is no candidate to freeze"))
-	}
 	head := ""
 	if worktree != "" {
 		// Review binds to the transfer commit, so the frozen tree must be exactly it.
@@ -115,24 +129,27 @@ func RunCandidateFreeze(root string, args []string, stdout, stderr io.Writer) in
 		if len(dirty) != 0 {
 			return fail(errors.New("the worktree has uncommitted changes on the path set; the frozen candidate must be its HEAD transfer commit"))
 		}
-		head = "head " + commit + "\n"
+		head = commit
 	}
-	digest, err := hashCandidate(project, rows)
+	diff, baseCommit, err := freezeDiff(project, base, rows)
 	if err != nil {
 		return fail(err)
 	}
+	if len(diff) == 0 {
+		return fail(errors.New("the path set has no change against the base; there is no candidate to freeze"))
+	}
 	var sums strings.Builder
-	fmt.Fprintf(&sums, "%s %s\nbase %s\n%sdiff %x packets/%s.diff\n", candidateDigestDomain, candidateDigestVersion, baseCommit, head, sha256.Sum256(diff), wave)
+	fmt.Fprintf(&sums, "%s %s\nbase %s\n", candidateDigestDomain, candidateDigestVersion, baseCommit)
+	if head != "" {
+		fmt.Fprintf(&sums, "head %s\n", head)
+	}
+	fmt.Fprintf(&sums, "diff %x packets/%s.diff\n", sha256.Sum256(diff), wave)
 	for _, row := range rows {
 		if row.state != "present" {
 			fmt.Fprintf(&sums, "file absent %s\n", row.path)
 			continue
 		}
-		file := sha256.New()
-		if err := hashCandidateFile(file, project, row); err != nil {
-			return fail(fmt.Errorf("candidate %q: %w", row.path, err))
-		}
-		fmt.Fprintf(&sums, "file %x %s\n", file.Sum(nil), row.path)
+		fmt.Fprintf(&sums, "file %s %s\n", row.fileDigest, row.path)
 	}
 	fmt.Fprintf(&sums, "aggregate %s\n", digest)
 
@@ -143,6 +160,9 @@ func RunCandidateFreeze(root string, args []string, stdout, stderr io.Writer) in
 	} else if err != nil && !errors.Is(err, os.ErrNotExist) {
 		return fail(err)
 	}
+	if err := revalidateFrozenCandidate(project, baseCommit, rows, digest, diff, head); err != nil {
+		return fail(err)
+	}
 	if err := os.MkdirAll(dir, 0o755); err != nil {
 		return fail(err)
 	}
@@ -157,6 +177,34 @@ func RunCandidateFreeze(root string, args []string, stdout, stderr io.Writer) in
 	return 0
 }
 
+// Bracket Git's mutable worktree reads; refuse observed drift, not a filesystem snapshot guarantee.
+func revalidateFrozenCandidate(project, base string, rows []candidateRow, digest string, diff []byte, head string) error {
+	currentDiff, commit, err := freezeDiff(project, base, rows)
+	if err != nil {
+		return err
+	}
+	if commit != base || !bytes.Equal(currentDiff, diff) {
+		return errors.New("candidate diff changed during freeze; retry under a new wave")
+	}
+	current, err := hashCandidate(project, rows, false)
+	if err != nil {
+		return fmt.Errorf("candidate changed during freeze: %w", err)
+	}
+	if current != digest {
+		return errors.New("candidate bytes changed during freeze; retry under a new wave")
+	}
+	if head != "" {
+		dirty, currentHead, err := freezeDiff(project, "HEAD", rows)
+		if err != nil {
+			return err
+		}
+		if currentHead != head || len(dirty) != 0 {
+			return errors.New("worktree HEAD or path set changed during freeze; candidate must remain its clean transfer commit")
+		}
+	}
+	return nil
+}
+
 // slicePaths is the slice's tasks.md write set: Writer allowlist, else Files
 // likely touched.
 func slicePaths(root, slug, slice string) ([]string, error) {