freeharness 0.4.2 → 0.4.3

package/canonical/skills/subagent-driven-development/scripts/validate-handoff.mjs

@@ -51,10 +51,10 @@ const DIGEST_BUDGET = 15;
 const CEILING_RE = /^[1-9]\d*$/;
 /** Budget ceiling (cache-read tokens) of a task of no security, complex or final class. */
 const DEFAULT_CEILING = 25000000;
-/** Class ceilings (cache-read tokens) set from the measured spend: security and complex tasks
- * cost several times an ordinary task, and one shared limit would stop them while leaving
- * ordinary tasks loose. */
-export const CLASS_CEILINGS = Object.freeze({ security: 60000000, complex: 60000000, final: 50000000, other: DEFAULT_CEILING });
+/** Class ceilings (cache-read tokens): security and complex tasks share the ordinary limit, so
+ * extra spend on them needs the owner's run authorization; only the final review, which reads
+ * the whole branch, gets more. */
+export const CLASS_CEILINGS = Object.freeze({ security: DEFAULT_CEILING, complex: DEFAULT_CEILING, final: 50000000, other: DEFAULT_CEILING });
 /** Fix rounds a task may open when the change's run authorization sets no `Rounds:`. */
 const DEFAULT_ROUNDS = 3;
 /** The run authorization's lines; anything else in its section is refused, never skipped. */
@@ -71,18 +71,12 @@ const TASK_LINE = /^\s*(?:[-*+]|\d{1,9}[.)])\s*\[(?:\s*([^\]\s])\s*\](?![([])|\]
 const TASK_ANNOTATION_RE = /^ {2,}(?:Verify|Interfaces|Boundary|Depends|Disposition):/;
 /** What `brief-init` leaves where only the lead's judgment can supply the value. */
 export const PLACEHOLDER_RE = /<fill:/;
-/** One short fragment (or a `pattern`, or a `phrases` list needing every member) per required
- * `## Run rules` line; a brief missing one reports its `key`. `phrase` is a case-insensitive
- * substring; `phrases` needs each entry as its own substring, any order; `pattern` tests the
- * section text as-is. A brief may restate a rule in its own words around the match.
- * `no-full-suite` needs one bullet with `never run` or `do not run` before `Suite:`, and verify:
- * a bullet that only conditions the run, or fragments borrowed from other bullets, would otherwise pass. */
 const SPACE_RE = /\s/;
 const LINE_END = /[\n\r\p{Zl}\p{Zp}]/u;
-/** The `no-full-suite` test as one pass over the text: a bullet opens at a `- ` with a space or the
- * text start before it and runs to the next ` - ` or line end. Nested lazy lookaheads took
- * quadratic time on one long bullet. A bullet opening right inside the one before it is skipped
- * when its text is a suffix of that one's, so the scan never rereads a character. */
+/** The `no-full-suite` test as one pass over the text, linear in its length: a bullet opens at a
+ * `- ` with a space or the text start before it and runs to the next ` - ` or line end. A bullet
+ * opening right inside the one before it is skipped when its text is a suffix of that one's, so
+ * the scan never rereads a character. */
 function noFullSuiteBullet(text) {
   const n = text.length;
   const isSpace = (ch) => ch !== undefined && SPACE_RE.test(ch);
@@ -101,6 +95,12 @@ function noFullSuiteBullet(text) {
   }
   return false;
 }
+/** One short fragment (or a `pattern`, or a `phrases` list needing every member) per required
+ * `## Run rules` line; a brief missing one reports its `key`. `phrase` is a case-insensitive
+ * substring; `phrases` needs each entry as its own substring, any order; `pattern` tests the
+ * section text as-is. A brief may restate a rule in its own words around the match.
+ * `no-full-suite` needs `never run` or `do not run` before `Suite:`, and verify, in one bullet
+ * bounded by the next ` - ` or line end, so borrowed fragments never pass. */
 export const REQUIRED_RUN_RULES = [
   { key: "build-before-tests", phrase: "build before" },
   { key: "comment-share", phrase: "comment share" },
@@ -136,8 +136,6 @@ export const PROBE_RE = /^(P[1-9]\d*): (.+?) -> (.+)$/;
 export const PROBE_BOUND = 12;
 /** An expected outcome that admits the behavior, so a fix that over-denies fails a probe. */
 const ALLOW_SIDE_RE = /\b(?:allow|allowed|accept|accepted|accepts|pass|passes|passed|ok|exit 0)\b/i;
-/** A probe that exercises the change over many inputs rather than one hand-picked case. */
-const CORPUS_RE = /\b(?:corpus|replay|fixture|fixtures|generator|generated)\b/i;
 /** Most non-blank lines a brief's `## Project rules` may hold: workers run without CLAUDE.md, so
  * the section carries only the rules that bear on the write scope, never the whole file. */
 export const PROJECT_RULES_BOUND = 20;
@@ -353,7 +351,7 @@ function parseProbes(lines) {
 }
 
 /** Probe problems of one brief: the section's own, then, for a security or complex class, a
- * missing allow-side or corpus probe; those two are judged only once the section exists. */
+ * missing allow-side probe, judged only once the section exists. */
 function probeRuleErrors(name, b) {
   const errors = (b.probeErrors ?? []).map((e) => `${name}: ${e}`);
   const probes = b.probes ?? [];
@@ -362,9 +360,6 @@ function probeRuleErrors(name, b) {
   if (!probes.some((p) => ALLOW_SIDE_RE.test(p.expected))) {
     errors.push(`${name}: Class ${cls} needs an allow-side probe (expected outcome an allow or a pass)`);
   }
-  if (!probes.some((p) => CORPUS_RE.test(`${p.id}: ${p.check} -> ${p.expected}`))) {
-    errors.push(`${name}: Class ${cls} needs a corpus probe (a corpus, fixture replay or generator command)`);
-  }
   return errors;
 }
 
@@ -862,9 +857,12 @@ function pathEscapesOrSymlinks(file, cwd) {
   return false;
 }
 
-/** True when the first 8 KB of `buf` holds a NUL byte (binary content). */
+/** Bytes from the start of a file searched for a NUL byte, the test that marks it binary. */
+const BINARY_SNIFF_BYTES = 8 * 1024;
+
+/** True when the first 8 KiB of `buf` holds a NUL byte (binary content). */
 function looksBinary(buf) {
-  const len = Math.min(buf.length, 8192);
+  const len = Math.min(buf.length, BINARY_SNIFF_BYTES);
   for (let i = 0; i < len; i++) if (buf[i] === 0x00) return true;
   return false;
 }
@@ -1087,14 +1085,16 @@ function isSpace(c) {
 }
 
 /** End index of the quoted literal opening at `i` (`q` long, quote char `ch`), past `n` when
- * unterminated; a backslash always skips the next character. */
-function literalEnd(text, i, ch, q) {
+ * unterminated; a backslash always skips the next character. With `eol`, an unescaped line
+ * terminator ends it, as in JavaScript. */
+function literalEnd(text, i, ch, q, eol = false) {
   const n = text.length;
   let k = i + q;
   while (k < n) {
     const c = text[k];
-    if (c === "\\") k += 2;
+    if (c === "\\") k += text[k + 1] === "\r" && text[k + 2] === "\n" ? 3 : 2;
     else if (c === ch && (q === 1 || (text[k + 1] === ch && text[k + 2] === ch))) return k + q;
+    else if (eol && (c === "\n" || c === "\r")) return k;
     else k++;
   }
   return n;
@@ -1145,7 +1145,7 @@ function jsCommentChars(text) {
       i = k + 1;
       regexOk = false;
     } else if (ch === "'" || ch === '"') {
-      i = literalEnd(text, i, ch, 1);
+      i = literalEnd(text, i, ch, 1, true);
       regexOk = false;
     } else if (ch === "`" || (ch === "}" && holes.length > 0 && holes[holes.length - 1] === 0)) {
       if (ch === "}") holes.pop();
@@ -1675,7 +1675,7 @@ export function changedTermErrors(brief, cwd = process.cwd(), cache = new Map())
         const buf = Buffer.alloc(st.size);
         let n = 0;
         for (let r = 1; n < st.size && r > 0; n += r) r = fs.readSync(fd, buf, n, st.size - n, n);
-        if (!buf.subarray(0, Math.min(n, 8192)).includes(0)) text = buf.subarray(0, n).toString("utf8");
+        if (!looksBinary(buf.subarray(0, n))) text = buf.subarray(0, n).toString("utf8");
       }
     } catch (err) {
       // A deleted file or a symlink holds nothing to search; any other failure is said.
@@ -1724,10 +1724,11 @@ export function changedTermErrors(brief, cwd = process.cwd(), cache = new Map())
   return errors;
 }
 
-/** Problems of a batch: each brief's header, digest and tree, plus scope overlap. Mode `set`
- * (briefs named one by one) adds the dispatch-set checks and the band `cap`; mode `dir` spares
- * landed briefs their removed trees. Any other mode throws, so no missing cap skips the band. A
- * malformed run authorization is one error per run. */
+/** Problems of a batch: each brief's header, digest and tree (tree-path, setup-missing), plus
+ * scope overlap. `{ kind: "set", cap }` (named briefs) adds tree-required, resource-overlap,
+ * manifest-parallel and `band` past `cap`; `{ kind: "dir" }` (landed briefs) skips those and
+ * tree-absent; `single` skips the set checks. Another mode or a missing cap throws. A malformed
+ * run authorization is one error per run. */
 export function validateBriefs(briefs, mode = { kind: "single" }) {
   const kind = mode && typeof mode === "object" ? mode.kind : undefined;
   if (!["single", "set", "dir"].includes(kind)) throw new TypeError(`validateBriefs mode must be { kind: 'single' | 'set' | 'dir' }; got ${JSON.stringify(mode)}`);
@@ -2033,58 +2034,28 @@ function collectBriefs(args) {
 /** Most bytes read of a transcript or a ledger: a worker transcript stays far below it, so a
  * larger file is runaway or hostile and its tail is dropped rather than buffered. */
 const SCAN_BOUND = 16 * 1024 * 1024;
-/** Most lines one scan kind prints; one `bash-write-capped` note counts the rest. */
+/** Most lines one scan kind prints; one `scan-capped` note counts the rest. */
 const SCAN_CAP = 50;
 /** Most characters of a command or path one scan line quotes. */
 const SCAN_DETAIL = 200;
 /** Longest path the scan resolves: past PATH_MAX no write can succeed. */
 const SCAN_PATH_MAX = 4096;
-/** Filesystem lookups one scan may spend before it compares paths by text alone, so a run of
- * distinct targets cannot turn the scan into a syscall storm. */
-const SCAN_FS_BUDGET = 10000;
-/** Characters of relative path one scan may resolve against a directory, so a run of distinct
- * words under a directory near PATH_MAX cannot cost bytes times PATH_MAX. */
-const SCAN_PATH_BUDGET = 16 * 1024 * 1024;
-/** Reserved words and `!` a command may follow; each counts only unquoted. */
-const RESERVED_PREFIXES = new Set(["!", "{", "}", "if", "then", "else", "elif", "do", "while", "until"]);
-/** Wrappers that run the command after their own options, keyed by basename. `short` letters and
- * `long` names take a value, as the next word unless joined; any other option is a flag, so an
- * unknown one never eats the command word. `tail` counts the operands read before the command,
- * as the duration of `timeout`. The BSD letters (`env -LPU`, `xargs -JRS`) are absent from GNU,
- * so consuming their value there only reads a word GNU would refuse. `chdir` names the letter
- * and the shortest unambiguous `--chdir` prefix of the option that runs the command elsewhere. */
-const COMMAND_PREFIXES = new Map([
-  ["time", { short: "", long: [] }],
-  ["nohup", { short: "", long: [] }],
-  ["exec", { short: "a", long: [] }],
-  ["command", { short: "", long: [] }],
-  ["env", { short: "uCSLPU", long: ["--unset", "--chdir", "--split-string"], chdir: ["C", 3] }],
-  ["sudo", { short: "ughpCDrtUacRT", long: ["--user", "--group", "--host", "--prompt", "--close-from", "--chdir", "--role", "--type", "--other-user", "--chroot", "--command-timeout", "--login-class", "--auth-type"], chdir: ["D", 5] }],
-  ["nice", { short: "n", long: ["--adjustment"] }],
-  ["timeout", { short: "sk", long: ["--signal", "--kill-after"], tail: 1 }],
-  ["xargs", { short: "adEILnPsJRS", long: ["--arg-file", "--delimiter", "--max-args", "--max-procs", "--max-chars"] }],
-  ["stdbuf", { short: "ioe", long: ["--input", "--output", "--error"] }],
-]);
-const WRITE_REDIRECTS = new Set([">", ">>", ">&", "<>"]);
-const SHELLS = new Set(["bash", "sh", "zsh", "dash"]);
-const WRITE_CALLS = ["writeFile", "appendFile", "createWriteStream", "fs.write", "write_text", "write_bytes", "print >", "File.write", "IO.write"];
 /** Git subcommands that write the index or HEAD whatever their arguments; matched by whole word,
  * so `merge-base` and `cherry` stay reads. */
 const INDEX_SUBCOMMANDS = new Set(["add", "rm", "mv", "commit", "reset", "switch", "merge", "rebase", "cherry-pick", "pull", "update-index"]);
-/** The operand an `xargs` writer builds from stdin: an expanded word, so it is only noted. */
-const XARGS_OPERAND = Object.freeze({ text: "xargs", expand: true, quoted: false });
-/** How many `find -exec` levels one command is unwrapped, so nested finds stay linear. */
-const FIND_DEPTH = 2;
-/** Commands that write a copy, a move, an install or a link of a file, with the `g` names
- * Homebrew gives GNU coreutils. */
-const COPY_TOOLS = new Set(["cp", "mv", "install", "ln", "gcp", "gmv", "ginstall", "gln"]);
-/** Long options of those commands whose value may be the next word, each with the shortest
- * prefix GNU getopt accepts for it unambiguously. */
-const COPY_LONG_VALUED = [["--target-directory", 3], ["--suffix", 4]];
-const CP_LONG_VALUED = [["--sparse", 4], ["--no-preserve", 6]];
-const INSTALL_LONG_VALUED = [["--mode", 3], ["--owner", 3], ["--group", 3], ["--strip-program", 8]];
 /** Git global options whose value is the next word. */
 const GIT_VALUED = new Set(["-c", "--git-dir", "--work-tree", "--namespace", "--config-env", "--super-prefix"]);
+/** Commands whose operands a Bash call writes or removes; `sed` counts only with `-i`. */
+const WRITE_WORDS = new Set(["tee", "cp", "mv", "install", "rm", "touch", "ln"]);
+/** Of those, the commands that take a `-t` target directory; all but `mv` write only the target. */
+const COPY_WORDS = new Set(["cp", "mv", "install", "ln"]);
+/** Words a command may run behind; only the bare word is skipped, never its options. */
+const WRAPPER_WORDS = new Set(["sudo", "env", "command", "nice", "nohup", "time", "exec", "xargs"]);
+/** The separators a Bash command is split on. Quotes are not parsed, so a separator inside a
+ * quoted string splits there too: the scan reports, the diff guards decide. */
+const SEPARATOR_RE = /;|&&|\|\||\|/;
+/** A redirect word: its fd or `&`, the operator, an fd-duplicating `&` and a joined target. */
+const REDIRECT_RE = /^(?:\d*|&)>>?\|?(&?)(.*)$/;
 
 /** Up to `bound` bytes of `file` (its tail when `fromEnd`) through one no-follow, non-blocking
  * fd, so a symlinked leaf or a FIFO is refused rather than followed or waited on; null when
@@ -2190,289 +2161,6 @@ export function transcriptFor(agentId, changeDir) {
   return { paths: [...paths], notes: [...notes] };
 }
 
-/** The operator at `src[i]` (`&`, `>` or `<`) and its width; `&>` and `&>>` write like `>`. */
-function redirectOperator(src, i) {
-  const [a, b, c] = [src[i], src[i + 1], src[i + 2]];
-  if (a === "&") return c === ">" ? [">>", 3] : [">", 2];
-  if (a === ">") return b === ">" ? [">>", 2] : b === "|" ? [">", 2] : b === "&" ? [">&", 2] : [">", 1];
-  if (b === "<") return c === "<" ? ["<<<", 3] : c === "-" ? ["<<-", 3] : ["<<", 2];
-  return b === ">" ? ["<>", 2] : b === "&" ? ["<&", 2] : ["<", 1];
-}
-
-/** Appends the `$…` or backquote expansion at `src[i]` to `w` and returns the index past it. A
- * substitution or `${…}` marks `w.nested`: its end is found by counting, not by parsing the shell
- * inside, so a comment or a case pattern there can end it at the wrong `)`. */
-function expansion(src, i, w) {
-  w.expand = true;
-  const n = src.length;
-  let j = i + 1;
-  if (src[i] === "`" || src[j] === "(" || src[j] === "{") w.nested = true;
-  if (src[i] === "`") {
-    while (j < n && src[j] !== "`") j += src[j] === "\\" ? 2 : 1;
-    j = Math.min(j + 1, n);
-  } else if (src[j] === "(" || src[j] === "{") {
-    const open = src[j];
-    const close = open === "(" ? ")" : "}";
-    let depth = 0;
-    while (j < n) {
-      const ch = src[j];
-      if (ch === "\\") j += 2;
-      else if (ch === "'" || ch === '"') {
-        let k = j + 1;
-        while (k < n && src[k] !== ch) k += src[k] === "\\" && ch === '"' ? 2 : 1;
-        j = k + 1;
-      } else {
-        j++;
-        if (ch === open) depth++;
-        else if (ch === close && --depth === 0) break;
-      }
-    }
-    j = Math.min(j, n);
-  }
-  w.text += src.slice(i, j);
-  return j;
-}
-
-/** Appends the double-quoted run from `src[i]` (past the opening quote) to `w`; returns the
- * index past the closing quote. */
-function doubleQuoted(src, i, w) {
-  const n = src.length;
-  while (i < n) {
-    const ch = src[i];
-    if (ch === '"') return i + 1;
-    if (ch === "$" || ch === "`") {
-      i = expansion(src, i, w);
-      continue;
-    }
-    if (ch === "\\" && i + 1 < n) {
-      const nx = src[i + 1];
-      if (nx !== "\n") w.text += '"\\$`'.includes(nx) ? nx : ch + nx;
-      i += 2;
-      continue;
-    }
-    w.text += ch;
-    i++;
-  }
-  return n;
-}
-
-/** Characters the one-letter ANSI-C escapes stand for. */
-const ANSI_C_NAMED = new Map([
-  ["a", "\x07"], ["b", "\b"], ["e", "\x1b"], ["E", "\x1b"], ["f", "\f"], ["n", "\n"],
-  ["r", "\r"], ["t", "\t"], ["v", "\v"], ["\\", "\\"], ["'", "'"], ['"', '"'],
-]);
-/** Digit count and radix of the numeric ANSI-C escapes, keyed by the letter after the backslash. */
-const ANSI_C_NUMERIC = new Map([["x", [2, 16]], ["u", [4, 16]], ["U", [8, 16]]]);
-
-/** The length of the run of up to `max` digits of `radix` at `src[i]`. */
-function digitRun(src, i, max, radix) {
-  let k = i;
-  while (k < src.length && k - i < max && !Number.isNaN(parseInt(src[k], radix))) k++;
-  return k - i;
-}
-
-/** Appends the `$'...'` body from `src[i]` (past the opening quote), escapes decoded as bash
- * does, to `w`; returns the index past the closing quote. Bash keeps a decoded string up to its
- * first NUL, so the text after one is dropped: a path tail past it never runs. */
-function ansiC(src, i, w) {
-  const n = src.length;
-  let out = "";
-  let cut = false;
-  while (i < n && src[i] !== "'") {
-    let ch = src[i++];
-    if (ch === "\\" && i < n) {
-      const e = src[i++];
-      const numeric = ANSI_C_NUMERIC.get(e) ?? (e >= "0" && e <= "7" ? [3, 8] : null);
-      if (ANSI_C_NAMED.has(e)) ch = ANSI_C_NAMED.get(e);
-      else if (numeric === null) ch = `\\${e}`;
-      else {
-        const from = e === "x" || e === "u" || e === "U" ? i : i - 1;
-        const len = digitRun(src, from, numeric[0], numeric[1]);
-        const v = parseInt(src.slice(from, from + len), numeric[1]);
-        if (len === 0 || v > 0x10ffff) ch = src.slice(i - 2, from + len);
-        else ch = e === "u" || e === "U" ? String.fromCodePoint(v) : String.fromCharCode(v & 0xff);
-        i = from + len;
-      }
-    }
-    if (ch === "\0") cut = true;
-    else if (!cut) out += ch;
-  }
-  w.text += out;
-  return Math.min(i + 1, n);
-}
-
-/** Attaches each pending heredoc's body, read line by line from `pos`, to its command; returns
- * the index past the last delimiter line. */
-function heredocBodies(src, pos, pending) {
-  const n = src.length;
-  for (const h of pending) {
-    const start = pos;
-    let end = n;
-    while (pos < n) {
-      const e = src.indexOf("\n", pos);
-      const lineEnd = e < 0 ? n : e;
-      let from = pos;
-      if (h.strip) while (from < lineEnd && src[from] === "\t") from++;
-      const next = e < 0 ? n : e + 1;
-      if (lineEnd - from === h.delim.length && src.startsWith(h.delim, from)) {
-        end = pos;
-        pos = next;
-        break;
-      }
-      pos = next;
-    }
-    h.cmd.bodies.push(src.slice(start, end));
-  }
-  pending.length = 0;
-  return pos;
-}
-
-/** The entries `shellCommands` puts between commands where a subshell opens and closes; a close
- * read after a construct the tokenizer does not parse exactly is `SUBSHELL_CLOSE_UNSURE`. */
-const SUBSHELL_OPEN = Object.freeze({ scope: "open" });
-const SUBSHELL_CLOSE = Object.freeze({ scope: "close" });
-const SUBSHELL_CLOSE_UNSURE = Object.freeze({ scope: "close" });
-/** The frame an open `case` holds on the scope stack: a `)` under it ends a pattern. */
-const CASE_FRAME = Object.freeze({ case: true });
-/** Reserved words after which a command word is still in keyword position. */
-const LEAD_WORDS = new Set(["!", "{", "if", "then", "else", "elif", "do", "while", "until"]);
-
-/** The keyword state after word `t` of a command whose state was `lead`: `time` keeps it through
- * `-p` and `--`, and `coproc` through one NAME, so a `case` after them is still the keyword. */
-function nextLead(lead, t) {
-  if (t === "time" || t === "coproc") return t;
-  if (lead === "time" && (t === "-p" || t === "--")) return "time";
-  return LEAD_WORDS.has(t) || (lead === "coproc" && t !== "case" && /^[A-Za-z_]\w*$/.test(t));
-}
-
-/** Splits shell source into simple commands in one left-to-right pass that consumes every
- * quote, escape, expansion and heredoc body once and never backtracks, so hostile input costs
- * time linear in its length. A word records whether an expansion touched it. A matched `( ... )`
- * is bracketed by `SUBSHELL_OPEN` and `SUBSHELL_CLOSE`; a `((` reads as two of them until its
- * inner `)` meets a second `)`, which makes it arithmetic and drops what was read inside, as
- * bash decides. Once a substitution or a `case` word outside keyword position is read, a `)` may
- * be misread, so every later close is `SUBSHELL_CLOSE_UNSURE`. */
-function shellCommands(src) {
-  const n = src.length;
-  const commands = [];
-  const pending = [];
-  const frames = [];
-  let unsure = false;
-  let cmd = null;
-  let word = null;
-  let op = null;
-  const current = (i) => {
-    cmd ??= { start: i, end: i, words: [], redirects: [], bodies: [], lead: true };
-    return cmd;
-  };
-  const endWord = (i) => {
-    if (word === null) return;
-    const c = current(i);
-    c.end = i;
-    if (word.nested) unsure = true;
-    if (op === null) {
-      c.words.push(word);
-      const t = word.quoted || word.expand ? "" : word.text;
-      if (c.lead) {
-        if (t === "case") frames.push(CASE_FRAME);
-        else if (t === "esac" && frames.at(-1) === CASE_FRAME) frames.pop();
-        c.lead = nextLead(c.lead, t);
-      } else if (t === "case") unsure = true;
-    } else if (op === "<<" || op === "<<-") pending.push({ cmd: c, delim: word.text, strip: op === "<<-" });
-    else c.redirects.push({ op, target: word });
-    word = null;
-    op = null;
-  };
-  const endCommand = (i) => {
-    endWord(i);
-    op = null;
-    if (cmd !== null) commands.push(cmd);
-    cmd = null;
-  };
-  let i = 0;
-  while (i < n) {
-    const ch = src[i];
-    if (ch === "\n") {
-      endCommand(i);
-      i = heredocBodies(src, i + 1, pending);
-    } else if (ch === " " || ch === "\t" || ch === "\r") {
-      endWord(i);
-      i++;
-    } else if (ch === "(") {
-      endCommand(i);
-      const arith = src[i + 1] === "(" ? commands.length : undefined;
-      commands.push(SUBSHELL_OPEN);
-      frames.push({});
-      if (arith !== undefined) {
-        commands.push(SUBSHELL_OPEN);
-        frames.push({ arith });
-      }
-      i += arith === undefined ? 1 : 2;
-    } else if (ch === ")") {
-      endCommand(i);
-      const f = frames.at(-1);
-      i++;
-      if (f !== undefined && f !== CASE_FRAME) {
-        frames.pop();
-        if (f.arith !== undefined && src[i] === ")") {
-          frames.pop();
-          commands.length = f.arith;
-          i++;
-        } else commands.push(unsure ? SUBSHELL_CLOSE_UNSURE : SUBSHELL_CLOSE);
-      }
-    } else if (ch === ";") {
-      endCommand(i);
-      i++;
-    } else if (ch === "|" || (ch === "&" && src[i + 1] !== ">")) {
-      endCommand(i);
-      i += src[i + 1] === "|" || src[i + 1] === "&" ? 2 : 1;
-    } else if (ch === "&" || ch === ">" || ch === "<") {
-      const fd = ch !== "&" && word !== null && !word.quoted && !word.expand && /^\d+$/.test(word.text);
-      if (fd) word = null;
-      else endWord(i);
-      // A redirect ends keyword position: `>f case` runs a command named case.
-      current(i).lead = false;
-      const [token, width] = redirectOperator(src, i);
-      op = token;
-      i += width;
-    } else if (ch === "#" && word === null) {
-      const e = src.indexOf("\n", i);
-      i = e < 0 ? n : e;
-    } else if (ch === "\\" && src[i + 1] === "\n") {
-      i += 2;
-    } else {
-      current(i);
-      word ??= { text: "", expand: false, quoted: false };
-      const w = word;
-      if (ch === "\\") {
-        w.quoted = true;
-        w.text += src.slice(i + 1, i + 2);
-        i += 2;
-      } else if (ch === "'") {
-        w.quoted = true;
-        const e = src.indexOf("'", i + 1);
-        const end = e < 0 ? n : e;
-        w.text += src.slice(i + 1, end);
-        i = end + 1;
-      } else if (ch === '"') {
-        w.quoted = true;
-        i = doubleQuoted(src, i + 1, w);
-      } else if (ch === "$" && src[i + 1] === "'") {
-        w.quoted = true;
-        i = ansiC(src, i + 2, w);
-      } else if (ch === "$" || ch === "`") {
-        i = expansion(src, i, w);
-      } else {
-        if (ch === "~" && w.text === "" && !w.quoted) w.expand = true;
-        w.text += ch;
-        i++;
-      }
-    }
-  }
-  endCommand(n);
-  return commands;
-}
-
 /** Whitespace-collapsed `text`, JSON-quoted when it holds a control character so it cannot forge
  * an output line, bounded. */
 function scanDetail(text) {
@@ -2484,28 +2172,6 @@ function shownPath(p) {
   return quotedText(p).slice(0, SCAN_DETAIL);
 }
 
-/** Spends `cost` of the scan's `kind` budget (`fs` lookups or path `chars`); false once that
- * budget is spent, the first refusal adding one `bash-write-budget` note, since past it the scan
- * decides by text alone or not at all. */
-function spend(ctx, kind, cost) {
-  if (ctx.budget[kind] > 0) {
-    ctx.budget[kind] -= cost;
-    return true;
-  }
-  if (!ctx.notes.includes("bash-write-budget")) ctx.notes.push("bash-write-budget");
-  return false;
-}
-
-/** The value `make()` gives for (`a`, `b`), computed once per pair. Nested maps keep the key the
- * string itself, whose hash the engine caches, so a lookup costs no pass over a 4 KB path. */
-function memo(map, a, b, make) {
-  let inner = map.get(a);
-  if (inner === undefined) map.set(a, (inner = new Map()));
-  let v = inner.get(b);
-  if (v === undefined) inner.set(b, (v = make()));
-  return v;
-}
-
 /** Records one scan line once; past the per-kind cap it only counts toward the capped note. */
 function emit(ctx, kind, line, note = false) {
   if (ctx.seen.has(line)) return;
@@ -2519,72 +2185,6 @@ function emit(ctx, kind, line, note = false) {
   (note ? ctx.notes : ctx.failures).push(line);
 }
 
-/** Real path of `dir`, or of its longest existing ancestor joined with the rest. A loop with one
- * lookup per ancestor, because a transcript's directory may hold thousands of components. */
-function realDir(dir, ctx) {
-  const hit = ctx.dirs.get(dir);
-  if (hit !== undefined) return hit;
-  const abs = path.resolve(dir);
-  const rootLen = path.parse(abs).root.length;
-  let cut = abs.length;
-  let real;
-  for (;;) {
-    const head = cut < rootLen ? abs.slice(0, rootLen) : abs.slice(0, cut);
-    real = ctx.dirs.get(head);
-    if (real !== undefined) break;
-    if (!spend(ctx, "fs", 1)) {
-      real = head;
-      break;
-    }
-    try {
-      real = fs.realpathSync(head);
-      break;
-    } catch {
-      // Missing: try the parent.
-    }
-    if (cut < rootLen) {
-      real = head;
-      break;
-    }
-    cut = abs.lastIndexOf(path.sep, cut - 1);
-  }
-  const rest = cut >= abs.length ? "" : abs.slice(cut + 1);
-  const out = rest === "" ? real : `${real.endsWith(path.sep) ? real : real + path.sep}${rest}`;
-  ctx.dirs.set(dir, out);
-  return out;
-}
-
-/** `abs` relative to the working tree after symlinks resolve, or null outside it; once per path.
- * A path inside only by folded case joins `ctx.folded`. */
-function insideTree(abs, ctx) {
-  const hit = ctx.inside.get(abs);
-  if (hit !== undefined) return hit;
-  let rel = null;
-  if (abs.length <= SCAN_PATH_MAX) {
-    const cut = abs.lastIndexOf(path.sep);
-    const dir = realDir(cut <= 0 ? path.sep : abs.slice(0, cut), ctx);
-    let real = abs.length === 1 ? abs : `${dir.endsWith(path.sep) ? dir : dir + path.sep}${abs.slice(cut + 1)}`;
-    if (spend(ctx, "fs", 1)) {
-      try {
-        const st = fs.lstatSync(real, { throwIfNoEntry: false });
-        if (st && st.isSymbolicLink()) real = fs.realpathSync(real);
-      } catch {
-        // A dangling or unreachable leaf is written where its text says.
-      }
-    }
-    rel = treeRelative(real, ctx.tree);
-    if (rel !== null && FOLD_CASE && treeRelative(real, ctx.tree, false) === null) ctx.folded.add(abs);
-  }
-  ctx.inside.set(abs, rel);
-  return rel;
-}
-
-/** `insideTree`, or with `exact` null for a path inside only by folded case. */
-function insideExactly(abs, ctx, exact) {
-  const rel = insideTree(abs, ctx);
-  return exact && ctx.folded.has(abs) ? null : rel;
-}
-
 /** Whether tree containment ignores case: the default macOS file system does, so a case-variant
  * path names the same file and must not read as outside the tree. */
 const FOLD_CASE = process.platform === "darwin";
@@ -2599,63 +2199,28 @@ export function treeRelative(real, tree, fold = FOLD_CASE) {
   return real.length > root.length && same(real.slice(0, root.length), root) ? real.slice(root.length) : null;
 }
 
-/** The tree-relative posix path a write to `abs` lands on, or null when it is outside the tree,
- * the tree itself, or under `.freeharness/`; once per path. With `ctx.main`, a write outside the
- * tree that lands in the main root, outside its `.freeharness/`, fails `tree-leak`. */
-function treeWrite(abs, ctx) {
-  const hit = ctx.trees.get(abs);
-  if (hit !== undefined) return hit;
-  const rel = insideTree(abs, ctx);
-  const out = writable(rel);
-  ctx.trees.set(abs, out);
-  // A case-sensitive volume holds another directory at a folded match, so its exemptions do not
-  // hold there and the leak an exact comparison finds still fails.
-  const leak = !ctx.main ? null : rel === null ? treeWrite(abs, ctx.main) : ctx.folded.has(abs) ? writable(insideExactly(abs, ctx.main, true)) : null;
-  if (leak !== null) emit(ctx, "tree-leak", `tree-leak ${shownPath(leak)}`);
-  return out;
-}
-
-/** The change workspace `report` sits in, as a third tree sharing the scan's budgets and cache:
- * `{ tree, report, shown }`, the real directory, the report's name in it and the directory as
- * printed from the main root; null when the report is not under `.freeharness/sdd/<change>/`.
- * The name is null unless the report is a regular file with one link, since a symlink or a hard
- * link there would spare the trusted file it shares. */
-function changeWorkspace(report, ctx) {
-  const abs = path.resolve(report);
-  const dir = realDir(path.dirname(abs), ctx);
-  const sdd = path.dirname(dir);
-  const fold = (s) => (FOLD_CASE ? s.toLowerCase() : s);
-  if (fold(path.basename(sdd)) !== "sdd" || fold(path.basename(path.dirname(sdd))) !== ".freeharness") return null;
-  const ws = { tree: dir, budget: ctx.budget, notes: ctx.notes, dirs: ctx.dirs, inside: new Map(), folded: new Set(), planted: new Map() };
-  let plain = false;
+/** The spellings of directory `dir` a transcript may print: as given, its real path and, on
+ * macOS, the real path without `/private`, since `/tmp` and `/var` link into it. A fixed lookup
+ * per root, so a target path is placed by its text alone. */
+function spellings(dir) {
+  const out = new Set([path.resolve(dir)]);
   try {
-    const st = fs.lstatSync(path.join(dir, path.basename(abs)), { throwIfNoEntry: false });
-    plain = st !== undefined && st.isFile() && st.nlink === 1;
+    const real = fs.realpathSync(dir);
+    out.add(real);
+    if (real.startsWith("/private/")) out.add(real.slice("/private".length));
   } catch {
-    // An unreadable leaf spares nothing.
+    // A missing root is placed as written.
   }
-  ws.report = plain ? path.basename(abs) : null;
-  ws.shown = path.relative(path.dirname(path.dirname(sdd)), dir).split(path.sep).join("/");
-  return ws;
+  return [...out];
 }
 
-/** Whether a write to `abs` lands in the change workspace, failing `tree-leak` in a tree run,
- * else `kind`; once per path. The directory itself is a hit, as a copy into it or its removal
- * plants or drops files. Only a `tool` write to the exact-case report is spared: a shell write
- * or link there may rewrite the file another name shares. */
-function plantedWrite(abs, ctx, kind, tool = false) {
-  const ws = ctx.ws;
-  if (!ws) return false;
-  let hit = ws.planted.get(abs);
-  if (hit === undefined) {
-    const rel = insideTree(abs, ws);
-    hit = rel === null ? null : { report: rel === ws.report && !ws.folded.has(abs), shown: shownPath(rel === "" ? ws.shown : `${ws.shown}/${rel.split(path.sep).join("/")}`) };
-    ws.planted.set(abs, hit);
+/** `abs` relative to the first of `roots` it lies under ("" for a root itself), or null. */
+function under(abs, roots) {
+  for (const root of roots) {
+    const rel = treeRelative(abs, root);
+    if (rel !== null) return rel;
   }
-  if (hit === null || (tool && hit.report)) return false;
-  const shown = hit.shown;
-  if (kind !== null || ctx.main) emit(ctx, ctx.main ? "tree-leak" : kind, `${ctx.main ? "tree-leak" : kind} ${shown}`);
-  return true;
+  return null;
 }
 
 /** `rel` as a posix path, or null for no path, the root itself or a path under `.freeharness/`. */
@@ -2664,382 +2229,173 @@ function writable(rel) {
   return p === null || p === ".freeharness" || p.startsWith(".freeharness/") ? null : p;
 }
 
-/** `dir` resolved against `here`; null when unknown, past PATH_MAX or past the path budget. Once
- * per pair, and a relative `dir` charges the characters it resolves, so the scan stays linear in
- * the transcript however long `here` is. */
-function resolveDir(here, dir, ctx) {
-  const absolute = path.isAbsolute(dir);
-  if (here === null && !absolute) return null;
-  return memo(ctx.resolved, absolute ? null : here, dir, () => {
-    if (!absolute && !spend(ctx, "chars", here.length + dir.length)) return null;
-    const abs = path.resolve(here ?? "/", dir);
-    return abs.length > SCAN_PATH_MAX ? null : abs;
-  });
-}
-
-/** Fails `bash-write` for a write target in the tree or the change workspace; an expanded one can
- * only be noted. */
-function writeTarget(word, here, ctx) {
-  const t = word.text;
-  if (word.expand || (here === null && !path.isAbsolute(t))) {
-    emit(ctx, "bash-write-unresolved", `bash-write-unresolved ${shownPath(t)}`, true);
-    return;
+/** The change workspace `report` sits in: `{ roots, report, shown }`, the directory's spellings,
+ * the report's name in it and the directory as printed from the main root; null when the report
+ * is not under `.freeharness/sdd/<change>/`. The name is null unless the report is a regular file
+ * with one link, since a symlink or a hard link there would spare the trusted file it shares. */
+function changeWorkspace(report) {
+  const abs = path.resolve(report);
+  let dir = path.dirname(abs);
+  const roots = spellings(dir);
+  try {
+    dir = fs.realpathSync(dir);
+  } catch {
+    // A missing workspace is placed as written.
   }
-  if (t === "" || t === "-" || t.startsWith("/dev/") || t.length > SCAN_PATH_MAX) return;
-  const line = memo(ctx.targets, here, t, () => {
-    const abs = resolveDir(here, t, ctx);
-    const p = abs === null ? null : treeWrite(abs, ctx);
-    if (p === null && abs !== null) plantedWrite(abs, ctx, "bash-write");
-    return p === null ? null : `bash-write ${shownPath(p)}`;
-  });
-  if (line !== null) emit(ctx, "bash-write", line);
-}
-
-/** Commands that delete their operands. A worker deletes its own files with plain `rm`, so only
- * a removal in the change workspace fails. */
-const REMOVERS = new Set(["rm", "rmdir", "unlink", "grm", "grmdir", "gunlink"]);
-
-/** The operands of a removal: none of its options takes a value word, and from the first operand
- * on every word is one, as BSD getopt stops there. */
-function removeTargets(args) {
-  let k = 1;
-  while (k < args.length && args[k].text[0] === "-" && args[k].text !== "-") {
-    if (args[k++].text === "--") break;
+  const sdd = path.dirname(dir);
+  const fold = (s) => (FOLD_CASE ? s.toLowerCase() : s);
+  if (fold(path.basename(sdd)) !== "sdd" || fold(path.basename(path.dirname(sdd))) !== ".freeharness") return null;
+  let plain = false;
+  try {
+    const st = fs.lstatSync(path.join(dir, path.basename(abs)), { throwIfNoEntry: false });
+    plain = st !== undefined && st.isFile() && st.nlink === 1;
+  } catch {
+    // An unreadable leaf spares nothing.
   }
-  return args.slice(k);
+  return { roots, report: plain ? path.basename(abs) : null, shown: path.relative(path.dirname(path.dirname(sdd)), dir).split(path.sep).join("/") };
 }
 
-/** Fails a removal of the change workspace or a file in it other than the report; an expanded
- * operand is left alone, as removals elsewhere are never judged. */
-function removedPath(word, here, ctx) {
-  const t = word.text;
-  if (word.expand || t === "" || t.length > SCAN_PATH_MAX || (here === null && !path.isAbsolute(t))) return;
-  const abs = resolveDir(here, t, ctx);
-  if (abs !== null) plantedWrite(abs, ctx, "bash-write");
+/** `rel` inside the change workspace as printed from the main root. */
+function workspacePath(ws, rel) {
+  return shownPath(rel === "" ? ws.shown : `${ws.shown}/${rel.split(path.sep).join("/")}`);
 }
 
-/** The directory a `cd` word list leaves the shell in; null when it cannot be known. */
-function changeDir(args, here, ctx) {
-  const w = args.slice(1).find((a) => !(a.text.startsWith("-") && a.text !== "-"));
-  if (!w) return os.homedir();
-  return w.expand || w.text === "-" ? null : resolveDir(here, w.text, ctx);
+/** `word` with one pair of surrounding quotes dropped. */
+function unquote(word) {
+  return word.length >= 2 && (word[0] === "'" || word[0] === '"') && word[word.length - 1] === word[0] ? word.slice(1, -1) : word;
 }
 
-function teeTargets(args) {
-  let opts = true;
-  return args.slice(1).filter((w) => {
-    if (opts && w.text === "--") return (opts = false);
-    return !(opts && w.text.startsWith("-"));
-  });
+/** `word` as an absolute path from `here`, or null when it is no literal path: an expansion, a
+ * glob, an option, a device, a URL, or a relative path from an unknown directory. */
+function literalPath(word, here) {
+  const p = unquote(word);
+  if (p === "" || p === "-" || p.length > SCAN_PATH_MAX || p[0] === "-" || p[0] === "~" || /[$`*?()<>]/.test(p)) return null;
+  if (p.startsWith("/dev/") || p.includes("://") || (here === null && !path.isAbsolute(p))) return null;
+  const abs = path.resolve(here ?? path.sep, p);
+  return abs.length > SCAN_PATH_MAX ? null : abs;
 }
 
-/** Files a `sed` word list edits in place: none without `-i`; the operands after the script,
- * which is the first operand unless `-e` or `-f` gave one. A bare `-i` takes BSD's `''` or
- * `.ext` suffix word. */
-function sedTargets(args) {
-  let inPlace = false;
-  let script = false;
-  const operands = [];
-  for (let k = 1; k < args.length; k++) {
-    const t = args[k].text;
-    if (t.startsWith("--")) {
-      if (t === "--in-place" || t.startsWith("--in-place=")) inPlace = true;
-      else if (t === "--expression" || t === "--file") {
+/** The words of one command segment that name a written path: redirect targets, the operands of
+ * `tee`, `rm`, `touch`, `mv` and `sed -i` (past the script and the `-e` or `-f` values), and
+ * the last operand or `-t` directory of `cp`, `install` and `ln`, whose sources are only named.
+ * An fd duplication such as `2>&1` writes no file. */
+function writeWords(words) {
+  const out = [];
+  for (let k = 0; k < words.length; k++) {
+    const m = REDIRECT_RE.exec(words[k]);
+    if (!m || (m[1] === "&" && /^(?:\d+|-)?$/.test(m[2]))) continue;
+    if (m[2] !== "") out.push(m[2]);
+    else if (k + 1 < words.length) out.push(words[++k]);
+  }
+  // The command word: past assignments and bare wrapper words, so `git rm` is no removal.
+  let k = 0;
+  while (k < words.length && (/^[A-Za-z_]\w*=/.test(words[k]) || WRAPPER_WORDS.has(words[k]))) k++;
+  if (k < words.length) {
+    const name = path.posix.basename(words[k]);
+    const sed = name === "sed" && words.slice(k + 1).some((w) => /^(?:-[A-Za-z]*i|--in-place)/.test(w));
+    if (!WRITE_WORDS.has(name) && !sed) return out;
+    let ops = [];
+    let target = null;
+    let script = false;
+    for (let j = k + 1; j < words.length; j++) {
+      const w = words[j];
+      const r = REDIRECT_RE.exec(w);
+      if (r || w[0] === "<") {
+        if ((r ? r[2] : w.replace(/^\d*<+-?/, "")) === "") j++;
+      } else if (w[0] !== "-") ops.push(w);
+      else if (sed && w === "-i" && (words[j + 1] === "''" || words[j + 1] === '""')) j++;
+      else if (sed && /^(?:-e|-f|--expression|--file)$/.test(w)) {
         script = true;
-        k++;
-      } else if (t.startsWith("--expression=") || t.startsWith("--file=")) script = true;
-    } else if (t.length > 1 && t[0] === "-") {
-      for (let p = 1; p < t.length; p++) {
-        const last = p === t.length - 1;
-        if (t[p] === "i") {
-          inPlace = true;
-          const nx = args[k + 1];
-          if (last && nx && (nx.text === "" || (nx.text.startsWith(".") && !/[/\s]/.test(nx.text)))) k++;
-          break;
-        }
-        if (t[p] === "e" || t[p] === "f" || t[p] === "l") {
-          if (t[p] !== "l") script = true;
-          if (last) k++;
-          break;
-        }
-      }
-    } else operands.push(args[k]);
-  }
-  if (!inPlace) return [];
-  return script ? operands : operands.slice(1);
-}
-
-/** Files a `perl` word list edits in place: none without `-i`; with `-e` every operand, else
- * the operands after the script file. */
-function perlTargets(args) {
-  let inPlace = false;
-  let code = false;
-  const operands = [];
-  let opts = true;
-  for (let k = 1; k < args.length; k++) {
-    const t = args[k].text;
-    if (opts && t === "--") opts = false;
-    else if (opts && t.length > 1 && t[0] === "-") {
-      for (let p = 1; p < t.length; p++) {
-        if (t[p] === "i") {
-          inPlace = true;
-          break;
-        }
-        if (t[p] === "e" || t[p] === "E") {
-          code = true;
-          if (p === t.length - 1) k++;
-          break;
-        }
-        if ("MmIxlCdDF0".includes(t[p])) break;
-      }
-    } else operands.push(args[k]);
-  }
-  if (!inPlace) return [];
-  return code ? operands : operands.slice(1);
-}
-
-/** Paths a `cp`, `mv`, `install` or `ln` word list writes: every `-t`/`--target-directory`
- * value, else the last of two or more operands, or the basename of a lone `ln` operand in the
- * current directory; `install -d` creates every operand and `mv` deletes each source, so each
- * operand is one there. Options count anywhere before `--`, as GNU getopt permutes them, and
- * one taking a value consumes it, so a suffix, a mode or a sparse mode after the operands is no
- * false last operand. BSD getopt stops at the first operand instead, so once an option word
- * follows it every later operand is a target too, as is the last word (BSD's destination) even
- * when a GNU option took it as its value, and for `mv` the first operand and every word after it
- * (BSD's moved sources); a value taken before the last word stays out for the others, which BSD
- * only reads. The GNU result comes first and is never dropped. */
-function copyTargets(name, args) {
-  const tool = name.length > 2 && name[0] === "g" ? name.slice(1) : name;
-  const short = tool === "install" ? "mogSt" : "St";
-  const extra = tool === "install" ? INSTALL_LONG_VALUED.concat([["--directory", 4]]) : tool === "cp" ? CP_LONG_VALUED : [];
-  const long = COPY_LONG_VALUED.concat(extra);
-  const dirs = [];
-  const operands = [];
-  // Words from the first operand on that BSD would read as operands.
-  let bsd = [];
-  let first = -1;
-  let optionAfter = false;
-  let mkdirs = false;
-  let opts = true;
-  for (let k = 1; k < args.length; k++) {
-    const w = args[k];
-    const t = w.text;
-    const seen = operands.length > 0;
-    if (!opts || t === "-" || t[0] !== "-") {
-      if (!seen) first = k;
-      operands.push(w);
-      if (seen || tool === "mv") bsd.push(w);
-      continue;
-    }
-    if (seen) {
-      optionAfter = true;
-      if (tool === "mv" || k === args.length - 1) bsd.push(w);
-    }
-    if (t === "--") opts = false;
-    else if (t[1] === "-") {
-      const eq = t.indexOf("=");
-      const opt = eq < 0 ? t : t.slice(0, eq);
-      const hit = long.find(([full, min]) => opt.length >= min && full.startsWith(opt));
-      if (!hit) continue;
-      if (hit[0] === "--directory") {
-        mkdirs = true;
-        continue;
-      }
-      const value = eq < 0 ? args[++k] : { ...w, text: t.slice(eq + 1) };
-      if (hit[0] === "--target-directory" && value) dirs.push(value);
-    } else {
-      for (let p = 1; p < t.length; p++) {
-        if (tool === "install" && t[p] === "d") mkdirs = true;
-        if (!short.includes(t[p])) continue;
-        const value = p === t.length - 1 ? args[++k] : { ...w, text: t.slice(p + 1) };
-        if (t[p] === "t" && value) dirs.push(value);
-        break;
-      }
-    }
-  }
-  let gnu;
-  if (mkdirs || (dirs.length > 0 && tool === "mv")) gnu = dirs.concat(operands);
-  else if (dirs.length > 0) gnu = dirs;
-  else if (operands.length >= 2) gnu = tool === "mv" ? operands : [operands[operands.length - 1]];
-  else if (tool === "ln" && operands.length === 1) gnu = [operands[0].expand ? operands[0] : { ...operands[0], text: path.posix.basename(operands[0].text) }];
-  else gnu = [];
-  if (!optionAfter) return gnu;
-  if (tool === "mv") bsd = args.slice(first);
-  else if (!bsd.includes(args[args.length - 1])) bsd.push(args[args.length - 1]);
-  const kept = new Set(gnu);
-  return gnu.concat(bsd.filter((w) => !kept.has(w)));
-}
-
-/** Operands of a word list whose options may sit anywhere before `--`: a short option in
- * `short` or a long one in `long` takes the next word as its value unless joined, any other
- * option is a flag. */
-function permutedOperands(args, short, long) {
-  const operands = [];
-  let opts = true;
-  for (let k = 1; k < args.length; k++) {
-    const t = args[k].text;
-    if (!opts || t === "-" || t[0] !== "-") operands.push(args[k]);
-    else if (t === "--") opts = false;
-    else if (t[1] === "-") {
-      if (!t.includes("=") && long.includes(t)) k++;
-    } else {
-      for (let p = 1; p < t.length; p++) {
-        if (!short.includes(t[p])) continue;
-        if (p === t.length - 1) k++;
-        break;
-      }
-    }
-  }
-  return operands;
-}
-
-/** Files a `touch` word list creates or stamps: every operand; `-r`, `-d`, `-t` and BSD's `-A`
- * take a value. */
-function touchTargets(args) {
-  return permutedOperands(args, "rdtA", ["--reference", "--date", "--time"]);
-}
-
-/** Files a `truncate` word list sizes: every operand; `-s` and `-r` take a value. */
-function truncateTargets(args) {
-  return permutedOperands(args, "sr", ["--size", "--reference"]);
-}
-
-/** The files a `dd` word list writes: the value of each `of=`. */
-function ddTargets(args) {
-  return args.slice(1).filter((w) => w.text.startsWith("of=")).map((w) => ({ ...w, text: w.text.slice(3) }));
-}
-
-/** Collectors of the paths each file-writing command writes, keyed by name, with the `g` names
- * Homebrew gives GNU coreutils for the coreutils ones. */
-const WRITERS = new Map([
-  ["tee", teeTargets],
-  ["sed", sedTargets],
-  ["perl", perlTargets],
-  ...["touch", "truncate", "dd"].flatMap((n) => {
-    const f = n === "touch" ? touchTargets : n === "truncate" ? truncateTargets : ddTargets;
-    return [[n, f], [`g${n}`, f]];
-  }),
-  ...[...COPY_TOOLS].map((n) => [n, (args) => copyTargets(n, args)]),
-  ...["link", "glink"].map((n) => [n, linkTargets]),
-]);
-
-/** The name `link FILE1 FILE2` creates: its second operand. */
-function linkTargets(args) {
-  const ops = args.slice(1).filter((w) => w.text !== "--");
-  return ops.slice(1, 2);
-}
-
-/** The index of the command word in `words` from `from` past every reserved word, assignment and
- * wrapper with its options, whether `xargs` was one of the wrappers, and each wrapper's chdir
- * directory word in order, every one read from the previous. Wrappers nest, as in `sudo env -i nice -n 5 cp`, and match quoted
- * or by path, as the shell runs them either way. */
-function unwrapCommand(words, from) {
-  let k = from;
-  let xargs = false;
-  const chdirs = [];
-  while (k < words.length) {
-    const w = words[k];
-    if (!w.quoted && RESERVED_PREFIXES.has(w.text)) k++;
-    else if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(w.text)) k++;
-    else {
-      const name = w.expand ? "" : path.posix.basename(w.text);
-      const spec = COMMAND_PREFIXES.get(name);
-      if (spec === undefined) break;
-      if (name === "xargs") xargs = true;
-      k = prefixOptions(words, k + 1, spec, chdirs);
-    }
+        j++;
+      } else if (sed && /^(?:-e|-f|--expression=|--file=)/.test(w)) script = true;
+      else if (COPY_WORDS.has(name) && w === "-t") target = words[++j] ?? null;
+      else if (COPY_WORDS.has(name) && w.startsWith("--target-directory=")) target = w.slice("--target-directory=".length);
+      else if (name === "install" && /^-[mog]$/.test(w)) j++;
+    }
+    // Without -e or -f the first operand is the sed script, no path.
+    if (sed && !script) ops.shift();
+    // An mv removes its sources, so each is a written path; cp, install and ln only read theirs.
+    if (COPY_WORDS.has(name) && target !== null) ops = name === "mv" ? [...ops, target] : [target];
+    else if (COPY_WORDS.has(name) && name !== "mv") ops = ops.slice(-1);
+    out.push(...ops);
   }
-  return { k, xargs, chdirs };
+  return out;
 }
 
-/** The index past the options of one wrapper starting at `k`, and past its `tail` operands; the
- * value word of its last chdir option joins `chdirs`, since env and sudo keep only that one and
- * read it from where they start. */
-function prefixOptions(words, k, spec, chdirs) {
-  const [letter, min] = spec.chdir ?? ["", 0];
-  // A missing value leaves no command word, so nothing is judged from it.
-  const valueAt = (i) => words[i] ?? { text: "", expand: true, quoted: false };
-  let dir = null;
-  while (k < words.length) {
-    const w = words[k];
-    const t = w.text;
-    if (t === "--") {
-      k++;
-      break;
-    }
-    if (t[0] !== "-") break;
-    k++;
-    if (t.startsWith("--")) {
-      const eq = t.indexOf("=");
-      const opt = eq < 0 ? t : t.slice(0, eq);
-      if (min > 0 && opt.length >= min && "--chdir".startsWith(opt)) {
-        dir = eq < 0 ? valueAt(k++) : { ...w, text: t.slice(eq + 1) };
-      } else if (eq < 0 && spec.long.includes(t)) k++;
-      continue;
-    }
-    for (let p = 1; p < t.length; p++) {
-      if (!spec.short.includes(t[p])) continue;
-      const last = p === t.length - 1;
-      if (t[p] === letter) dir = last ? valueAt(k) : { ...w, text: t.slice(p + 1) };
-      if (last) k++;
-      break;
-    }
+/** Notes `bash-path` for a path a Bash command names: any path in the change workspace or, in a
+ * tree run, in the main root outside the tree, its admin dir and its `.freeharness/`; and a `write` target in
+ * the tree outside the write scope and `.freeharness/`, or outside the tree. A note, never a
+ * failure: the diff guards and the lead's diff read decide. */
+function bashPath(abs, write, ctx) {
+  const inWs = ctx.ws ? under(abs, ctx.ws.roots) : null;
+  if (inWs !== null) return emit(ctx, "bash-path", `bash-path ${workspacePath(ctx.ws, inWs)}`, true);
+  const rel = under(abs, ctx.tree);
+  if (rel !== null) {
+    const p = writable(rel);
+    if (write && p !== null && !ctx.scope.some((s) => scopeMatches(s, p))) emit(ctx, "bash-path", `bash-path ${shownPath(p)}`, true);
+    return;
   }
-  if (dir !== null) chdirs.push(dir);
-  return Math.min(k + (spec.tail ?? 0), words.length);
+  const inMain = ctx.main ? under(abs, ctx.main) : null;
+  if (inMain !== null) {
+    const p = writable(inMain);
+    // The tree's admin dir belongs to the tree: like a tree path, only a write there is noted.
+    const own = !write && adminDir(ctx) !== null && under(abs, ctx.admin) !== null;
+    if (p !== null && !own) emit(ctx, "bash-path", `bash-path ${shownPath(p)}`, true);
+  } else if (write) emit(ctx, "bash-path", `bash-path ${shownPath(abs)}`, true);
 }
 
-/** The command word lists `find` runs through `-exec`, `-execdir`, `-ok` and `-okdir`, each up to
- * its `;` or to a `+` right after `{}`; a word holding `{}` becomes an expanded operand, since
- * find fills in each found path. */
-function execSegments(args) {
-  const out = [];
-  for (let k = 1; k < args.length; k++) {
-    if (!/^-(?:exec|execdir|ok|okdir)$/.test(args[k].text)) continue;
-    const seg = [];
-    for (k++; k < args.length; k++) {
-      const t = args[k].text;
-      if (t === ";" || (t === "+" && seg.length > 0 && seg[seg.length - 1].text === "{}")) break;
-      seg.push(t.includes("{}") ? { ...args[k], expand: true } : args[k]);
-    }
-    out.push(seg);
+/** The spellings of the tree's git admin dir, looked up once per scan; null when git names none. */
+function adminDir(ctx) {
+  if (ctx.admin === undefined) {
+    const info = treeInfo(ctx.mainDir, ctx.treeDir);
+    ctx.admin = info.ok ? spellings(info.gitDir) : null;
   }
-  return out;
+  return ctx.admin;
 }
 
 /** Fails `index-write` for a git command that writes the index or HEAD when its effective
  * directory lies in the working tree or its admin dir, and `tree-leak` when it lies elsewhere in
  * the main root; a temporary repository stays free. `--git-dir`, `--work-tree` and the `GIT_DIR`,
- * `GIT_WORK_TREE` and `GIT_INDEX_FILE` assignments in `env` are judged too, since they move the
- * index a command writes away from its directory. */
-function gitIndexWrite(args, here, text, ctx, env = []) {
+ * `GIT_WORK_TREE` and `GIT_INDEX_FILE` assignments before `git` are judged too, since they move the
+ * index a command writes away from its directory. `git` counts only as the command word: every
+ * word before it is an assignment, a wrapper word, an option after a wrapper or that option's
+ * value, so `sudo -u me git` counts while `echo remember to git add` does not. */
+function gitIndexWrite(words, here, text, ctx) {
+  let g = 0;
+  let wrapped = false;
+  while (g < words.length && words[g] !== "git" && !words[g].endsWith("/git")) {
+    const w = words[g];
+    const value = wrapped && g > 0 && words[g - 1][0] === "-" && w[0] !== "-";
+    if (WRAPPER_WORDS.has(w)) wrapped = true;
+    else if (!/^[A-Za-z_]\w*=/.test(w) && !(wrapped && w[0] === "-") && !value) return;
+    g++;
+  }
+  if (g >= words.length) return;
   let dir = here;
   // Values git resolves only after every -C, as it does.
   const repo = [];
-  for (const w of env) {
-    const m = /^GIT_(?:DIR|WORK_TREE|INDEX_FILE)=/.exec(w.text);
-    if (m) repo.push(w.expand ? null : w.text.slice(m[0].length));
+  for (const w of words.slice(0, g)) {
+    const m = /^GIT_(?:DIR|WORK_TREE|INDEX_FILE)=/.exec(w);
+    if (m) repo.push(w.slice(m[0].length));
   }
-  let k = 1;
-  while (k < args.length && args[k].text.startsWith("-")) {
-    const t = args[k].text;
+  let k = g + 1;
+  while (k < words.length && words[k].startsWith("-")) {
+    const t = words[k];
     const eq = /^--(?:git-dir|work-tree)=/.exec(t);
     if (t === "-C") {
-      const d = args[k + 1];
-      dir = !d || d.expand ? null : resolveDir(dir, d.text, ctx);
+      dir = words[k + 1] === undefined ? null : literalPath(words[k + 1], dir);
       k += 2;
     } else if (eq) {
-      repo.push(args[k].expand ? null : t.slice(eq[0].length));
+      repo.push(t.slice(eq[0].length));
       k++;
     } else if (t === "--git-dir" || t === "--work-tree") {
-      const d = args[k + 1];
-      repo.push(!d || d.expand ? null : d.text);
+      if (words[k + 1] !== undefined) repo.push(words[k + 1]);
       k += 2;
     } else k += GIT_VALUED.has(t) ? 2 : 1;
   }
-  if (k >= args.length) return;
-  const sub = args[k].text;
-  const rest = args.slice(k + 1).map((w) => w.text);
+  if (k >= words.length) return;
+  const sub = words[k];
+  const rest = words.slice(k + 1);
   const writes =
     INDEX_SUBCOMMANDS.has(sub) ||
     (sub === "stash" && rest[0] !== "list" && rest[0] !== "show") ||
@@ -3049,182 +2405,73 @@ function gitIndexWrite(args, here, text, ctx, env = []) {
   if (!writes) return;
   const dirs = dir === null ? [] : [dir];
   for (const v of repo) {
-    const abs = v === null || v === "" || v.length > SCAN_PATH_MAX ? null : resolveDir(dir, v, ctx);
+    const abs = literalPath(v, dir);
     if (abs !== null) dirs.push(abs);
   }
-  if (ctx.main && ctx.admin === undefined) {
-    const info = treeInfo(ctx.main.tree, ctx.tree);
-    ctx.admin = info.ok ? path.relative(ctx.main.tree, info.gitDir) : null;
-  }
+  const admin = ctx.main ? adminDir(ctx) : null;
   // Only git reads the admin dir as the tree's index; a file write there stays a leak.
-  const own = (d, exact) => {
-    if (insideExactly(d, ctx, exact) !== null) return true;
-    const m = ctx.main && ctx.admin !== null ? insideExactly(d, ctx.main, exact) : null;
-    return m !== null && (m === ctx.admin || m.startsWith(ctx.admin + path.sep));
-  };
-  if (dirs.some((d) => own(d, false))) emit(ctx, "index-write", `index-write ${scanDetail(text)}`);
-  // A leak either comparison finds fails, so folded case never removes one.
-  const leaks = (d, exact) => !own(d, exact) && insideExactly(d, ctx.main, exact) !== null;
-  if (ctx.main && dirs.some((d) => leaks(d, true) || leaks(d, false))) emit(ctx, "tree-leak", `tree-leak ${scanDetail(text)}`);
-}
-
-/** Code bodies an interpreter word list runs: `-c`, `-e`-style arguments, here-strings and
- * heredocs. */
-function interpreterBodies(flags, args, c) {
-  const bodies = [];
-  for (let k = 1; k < args.length - 1; k++) {
-    const t = args[k].text;
-    if (flags.includes(t) || (/^-[A-Za-z]+$/.test(t) && flags.includes(`-${t[t.length - 1]}`))) bodies.push(args[++k].text);
-  }
-  for (const r of c.redirects) if (r.op === "<<<") bodies.push(r.target.text);
-  return bodies.concat(c.bodies);
-}
-
-/** Quoted string literals of one line each in `body`. */
-function quotedLiterals(body) {
-  const out = [];
-  const n = body.length;
-  let i = 0;
-  while (i < n) {
-    const q = body[i];
-    if (q !== "'" && q !== '"' && q !== "`") {
-      i++;
+  const own = (d) => under(d, ctx.tree) !== null || (admin !== null && under(d, admin) !== null);
+  if (dirs.some(own)) emit(ctx, "index-write", `index-write ${scanDetail(text)}`);
+  if (ctx.main && dirs.some((d) => !own(d) && under(d, ctx.main) !== null)) emit(ctx, "tree-leak", `tree-leak ${scanDetail(text)}`);
+}
+
+/** Applies the literal checks to one Bash command run from `here`. The command splits on the
+ * separators alone and each segment on whitespace; a leading `cd` or `pushd` moves `here` for
+ * the segments after it, and an expanded directory leaves it unknown. */
+function scanBash(command, here, ctx) {
+  let cwdNoted = false;
+  for (const segment of command.split(SEPARATOR_RE)) {
+    const words = segment.trim().split(/\s+/).filter((w) => w !== "");
+    if (words.length === 0) continue;
+    if (words[0] === "cd" || words[0] === "pushd") {
+      const arg = words.slice(1).find((w) => !/^-[A-Za-z@]+$/.test(w));
+      here = arg === undefined ? null : literalPath(arg, here);
       continue;
     }
-    let j = i + 1;
-    while (j < n && body[j] !== q && body[j] !== "\n") j += body[j] === "\\" ? 2 : 1;
-    if (j < n && body[j] === q) {
-      out.push(body.slice(i + 1, j));
-      i = j + 1;
-    } else i = j;
-  }
-  return out;
-}
-
-function isWriteMode(m) {
-  return m.startsWith(">") || m.startsWith("+<") || (m.length <= 4 && /^[rwaxbtU+]+$/.test(m) && /[wax+]/.test(m));
-}
-
-/** Whether an `open(` call in `body` passes a write mode within its first 200 characters. */
-function opensForWrite(body) {
-  for (let at = body.indexOf("open("); at >= 0; at = body.indexOf("open(", at + 5)) {
-    const window = body.slice(at + 5, at + 205);
-    const cut = window.indexOf(")");
-    if (quotedLiterals(cut < 0 ? window : window.slice(0, cut)).some(isWriteMode)) return true;
-  }
-  return false;
-}
-
-/** Whether an interpreter body calls a file-write function and names a literal path that lands
- * in the working tree outside `.freeharness/`, or in the change workspace of a shared-tree run. */
-function writesInTree(body, here, ctx) {
-  if (!WRITE_CALLS.some((s) => body.includes(s)) && !opensForWrite(body)) return false;
-  for (const lit of quotedLiterals(body)) {
-    let s = 0;
-    while (s < lit.length && "<>+ ".includes(lit[s])) s++;
-    const p = lit.slice(s);
-    if (p === "" || p.length > SCAN_PATH_MAX || p[0] === "-" || /\s/.test(p) || p.includes("://") || !/[./]/.test(p)) continue;
-    const abs = resolveDir(here, p, ctx);
-    if (abs !== null && treeWrite(abs, ctx) !== null) return true;
-    // A tree run fails the workspace path itself, so the interpreter line is the shared run's.
-    if (abs !== null && plantedWrite(abs, ctx, null) && !ctx.main) return true;
-  }
-  return false;
-}
-
-/** Applies every check to the simple commands of one shell source run from `here`; a `cd`
- * carries to the commands after it up to the end of its subshell, and a shell's own `-c` body
- * is scanned two levels deep. `flat` is the directory with every `cd` carried past its subshell;
- * after a close that may be misread, each target is judged from both, so a misread `)` can only
- * add failures. */
-function scanShell(src, here, ctx, depth) {
-  let noted = false;
-  const saved = [];
-  let flat = here;
-  let unsure = false;
-  for (const c of shellCommands(src)) {
-    if (c === SUBSHELL_OPEN) saved.push(here);
-    else if (c === SUBSHELL_CLOSE || c === SUBSHELL_CLOSE_UNSURE) {
-      unsure ||= c === SUBSHELL_CLOSE_UNSURE;
-      if (saved.length > 0) here = saved.pop();
-    }
-    if (c.scope !== undefined) continue;
-    const dirs = unsure && flat !== here ? [here, flat] : [here];
-    const { k, xargs, chdirs } = unwrapCommand(c.words, 0);
-    const args = c.words.slice(k);
-    const name = args.length > 0 ? path.posix.basename(args[0].text) : "";
-    const text = src.slice(c.start, c.end);
-    if (name !== "[[") {
-      for (const r of c.redirects) {
-        if (WRITE_REDIRECTS.has(r.op) && !(r.op === ">&" && /^(?:\d+|-)$/.test(r.target.text))) for (const d of dirs) writeTarget(r.target, d, ctx);
+    if (ctx.main && !cwdNoted && here !== null && under(here, ctx.tree) === null) {
+      cwdNoted = true;
+      emit(ctx, "tree-cwd", `tree-cwd ${scanDetail(command)}`, true);
+    }
+    gitIndexWrite(words, here, segment, ctx);
+    const written = writeWords(words);
+    const named = words.filter((w) => !written.includes(w) && unquote(w).includes("/"));
+    for (const [list, write] of [[written, true], [named, false]]) {
+      for (const w of list) {
+        const abs = literalPath(w, here);
+        if (abs !== null) bashPath(abs, write, ctx);
       }
     }
-    // The note quotes the whole call, so it is built once per call, keeping the scan linear; a
-    // leading cd places it.
-    if (!noted && ctx.main && depth === 0 && name !== "" && name !== "cd" && name !== "pushd" && here !== null && insideTree(here, ctx) === null) {
-      noted = true;
-      emit(ctx, "tree-cwd", `tree-cwd ${scanDetail(src)}`, true);
-    }
-    if (name === "cd" || name === "pushd") {
-      const was = here;
-      here = changeDir(args, here, ctx);
-      flat = flat === was ? here : changeDir(args, flat, ctx);
-    }
-    if (name !== "cd" && name !== "pushd") for (const d of dirs) judgeWrapped(args, c.words.slice(0, k), xargs, chdirs, { c, here: d, ctx, text, depth, finds: 0 });
-    if (ctx.suite !== "" && text.replace(/\s+/g, " ").includes(ctx.suite)) emit(ctx, "suite-run", "suite-run");
-  }
-}
-
-/** `judgeCommand` from the shell's directory `at.here` and, behind a wrapper chdir, also from an
- * unknown one: the chdir value is never resolved, so an absolute target is judged as from the
- * shell and a relative one is only noted. The redirects stay the shell's. */
-function judgeWrapped(args, env, xargs, chdirs, at) {
-  judgeCommand(args, env, xargs, at);
-  if (chdirs.length > 0) judgeCommand(args, env, xargs, { ...at, here: null });
-}
-
-/** Applies the write, index and interpreter checks to one command word list `args`, run behind
- * the prefix words `env`, from `at.here`. Under `xargs` a writer also notes the operand stdin
- * supplies, and each `find -exec` command is judged in turn, `FIND_DEPTH` levels deep. */
-function judgeCommand(args, env, xargs, at) {
-  const { c, here, ctx, text, depth } = at;
-  const name = args.length > 0 ? path.posix.basename(args[0].text) : "";
-  const collect = WRITERS.get(name);
-  if (collect) {
-    for (const w of collect(args)) writeTarget(w, here, ctx);
-    if (xargs) writeTarget(XARGS_OPERAND, here, ctx);
-  } else if (REMOVERS.has(name)) {
-    if (ctx.ws) for (const w of removeTargets(args)) removedPath(w, here, ctx);
-  } else if (name === "git") gitIndexWrite(args, here, text, ctx, env);
-  else if (name === "find" && at.finds < FIND_DEPTH) {
-    // The heredocs and here-strings stay with the outer command, so a run of -exec shells does
-    // not rescan one body per segment.
-    const inner = { ...at, c: { redirects: [], bodies: [] }, finds: at.finds + 1 };
-    for (const seg of execSegments(args)) {
-      const u = unwrapCommand(seg, 0);
-      judgeWrapped(seg.slice(u.k), seg.slice(0, u.k), xargs || u.xargs, u.chdirs, inner);
-    }
   }
-  if (SHELLS.has(name)) {
-    if (depth < 2) for (const body of interpreterBodies(["-c"], args, c)) scanShell(body, here, ctx, depth + 1);
-  } else {
-    const flags = /^python[0-9.]*$/.test(name) ? ["-c"] : name === "node" || name === "nodejs" ? ["-e", "--eval", "-p", "--print"] : name === "perl" || name === "ruby" ? ["-e", "-E"] : null;
-    if (flags && interpreterBodies(flags, args, c).some((b) => writesInTree(b, here, ctx))) emit(ctx, "bash-write", `bash-write ${shownPath(name)}`);
-  }
-}
-
-/** Scans every Bash call a worker transcript records (at most `SCAN_BOUND` bytes of it) for
- * edits outside the Edit and Write tools, index writes and a run of the brief's `Suite:`
- * command; the working tree is the git top-level of `cwd`, or `cwd` itself with a
- * `transcript-tree-unresolved <git's first error line>` note when git names none. Malformed
- * lines are skipped. Returns `{ failures, notes }`: the FAIL and NOTE line bodies in scan order;
- * an unreadable transcript gives no failures and the one note `transcript-unavailable unreadable`.
- * With `mainRoot`, `cwd` is a task's tree: a write under the main root outside the tree, from a
- * Bash command or the Edit, MultiEdit, Write and NotebookEdit tools, fails `tree-leak`, as does an index
- * write there, and a command run outside the tree is noted `tree-cwd`. With `report`, the path
- * of the review package in `<root>/.freeharness/sdd/<change>/`, any write in that directory but a
- * tool write to the report fails too: `tree-leak` with `mainRoot`, else `bash-write` from Bash and
- * `workspace-write` from a tool, since the guard trusts the ledger and round copies there. */
+  if (ctx.suite !== "" && command.replace(/\s+/g, " ").includes(ctx.suite)) emit(ctx, "suite-run", "suite-run");
+}
+
+/** Judges one Edit, MultiEdit, Write or NotebookEdit path: in a tree run a path under the main
+ * root outside the tree and its `.freeharness/` fails `tree-leak`; a path in the change workspace
+ * other than a spared report fails `tree-leak` in a tree run, else `workspace-write`. An edit
+ * inside the tree is the diff guards' to judge. */
+function toolWrite(abs, ctx) {
+  if (ctx.main && under(abs, ctx.tree) === null) {
+    const p = writable(under(abs, ctx.main));
+    if (p !== null) emit(ctx, "tree-leak", `tree-leak ${shownPath(p)}`);
+  }
+  const rel = ctx.ws ? under(abs, ctx.ws.roots) : null;
+  if (rel === null || rel === ctx.ws.report) return;
+  const kind = ctx.main ? "tree-leak" : "workspace-write";
+  emit(ctx, kind, `${kind} ${workspacePath(ctx.ws, rel)}`);
+}
+
+/** Checks every tool call a worker transcript records (at most `SCAN_BOUND` bytes of it) by
+ * literal rules: Bash commands for index writes, a run of the brief's `Suite:` command and the
+ * paths they name, and tool writes for a tree leak or a planted change workspace. The working
+ * tree is the git top-level of `cwd`, or `cwd` itself with a `transcript-tree-unresolved <git's
+ * first error line>` note when git names none. Malformed lines are skipped. Returns
+ * `{ failures, notes, truncated }`: the FAIL and NOTE line bodies in scan order and whether the
+ * bound cut the transcript, which the caller notes with the agent id; an unreadable transcript
+ * gives no failures and the one note `transcript-unavailable unreadable`. With `mainRoot`, `cwd`
+ * is a task's tree: an index write or a tool write under the main root outside the tree fails
+ * `tree-leak`, and a command run outside the tree is noted `tree-cwd`. With `report`, the path
+ * of the review package in `<root>/.freeharness/sdd/<change>/`, a tool write in that directory
+ * other than to the report fails too, since the guard trusts the ledger and round copies there. */
 export function scanTranscript(file, brief, cwd, mainRoot, report) {
   const read = readBoundedNoFollow(file, SCAN_BOUND, false);
   if (read === null) return { failures: [], notes: ["transcript-unavailable unreadable"] };
@@ -3237,25 +2484,13 @@ export function scanTranscript(file, brief, cwd, mainRoot, report) {
     notes.push(`transcript-tree-unresolved ${scanDetail(String(err instanceof Error ? err.message : err).split("\n")[0])}`);
   }
   const suite = brief && brief.header && typeof brief.header.Suite === "string" ? brief.header.Suite.replace(/\s+/g, " ").trim() : "";
-  const ctx = {
-    tree,
-    suite,
-    failures: [],
-    notes,
-    seen: new Set(),
-    counts: new Map(),
-    capped: 0,
-    budget: { fs: SCAN_FS_BUDGET, chars: SCAN_PATH_BUDGET },
-    dirs: new Map(),
-    resolved: new Map(),
-    inside: new Map(),
-    folded: new Set(),
-    trees: new Map(),
-    targets: new Map(),
-  };
-  // The main root seen as a second working tree, sharing the budgets and the lookup cache.
-  if (mainRoot !== undefined) ctx.main = { tree: realDir(mainRoot, ctx), budget: ctx.budget, notes, dirs: ctx.dirs, inside: new Map(), folded: new Set(), trees: new Map() };
-  if (report !== undefined) ctx.ws = changeWorkspace(report, ctx);
+  const scope = brief && Array.isArray(brief.scope) ? brief.scope : [];
+  const ctx = { tree: spellings(tree), treeDir: tree, suite, scope, failures: [], notes, seen: new Set(), counts: new Map(), capped: 0 };
+  if (mainRoot !== undefined) {
+    ctx.main = spellings(mainRoot);
+    ctx.mainDir = mainRoot;
+  }
+  if (report !== undefined) ctx.ws = changeWorkspace(report);
   const text = read.cut ? read.text.slice(0, read.text.lastIndexOf("\n") + 1) : read.text;
   for (const raw of text.split("\n")) {
     let rec;
@@ -3266,25 +2501,19 @@ export function scanTranscript(file, brief, cwd, mainRoot, report) {
     }
     const content = rec && rec.type === "assistant" && rec.message ? rec.message.content : null;
     if (!Array.isArray(content)) continue;
-    const dir = typeof rec.cwd === "string" && path.isAbsolute(rec.cwd) ? rec.cwd : tree;
-    // A real starting directory keeps text-only resolution, once the fs budget is spent, comparable
-    // with the real tree; one past PATH_MAX no shell could stand in is unknown.
-    const here = dir.length > SCAN_PATH_MAX ? null : realDir(dir, ctx);
+    const dir = typeof rec.cwd === "string" && path.isAbsolute(rec.cwd) ? path.resolve(rec.cwd) : tree;
+    const here = dir.length > SCAN_PATH_MAX ? null : dir;
     for (const part of content) {
       if (!part || part.type !== "tool_use" || !part.input) continue;
-      if (part.name === "Bash" && typeof part.input.command === "string") scanShell(part.input.command, here, ctx, 0);
+      if (part.name === "Bash" && typeof part.input.command === "string") scanBash(part.input.command, here, ctx);
       const target = part.name === "NotebookEdit" ? (part.input.notebook_path ?? part.input.file_path) : part.input.file_path;
       if ((ctx.main || ctx.ws) && ["Edit", "MultiEdit", "Write", "NotebookEdit"].includes(part.name) && typeof target === "string" && target.length <= SCAN_PATH_MAX) {
-        const abs = resolveDir(here, target, ctx);
-        // Only for a leak or a planted workspace file: an edit inside the tree is the tool's job.
-        if (abs !== null && ctx.main) treeWrite(abs, ctx);
-        if (abs !== null) plantedWrite(abs, ctx, "workspace-write", true);
+        if (path.isAbsolute(target) || here !== null) toolWrite(path.resolve(here ?? path.sep, target), ctx);
       }
     }
   }
-  if (ctx.capped > 0) ctx.notes.push(`bash-write-capped ${ctx.capped}`);
-  if (read.cut) ctx.notes.push("transcript-truncated");
-  return { failures: ctx.failures, notes: ctx.notes };
+  if (ctx.capped > 0) ctx.notes.push(`scan-capped ${ctx.capped}`);
+  return { failures: ctx.failures, notes: ctx.notes, truncated: read.cut };
 }
 
 /** Usage text: one line per subcommand with its arguments, in order. `commit` runs the repo's
@@ -3518,6 +2747,25 @@ function leavesRoot(root, dir) {
   return rel === ".." || rel.startsWith(`..${path.sep}`) || path.isAbsolute(rel);
 }
 
+/** The main worktree of the checkout at `top`, by its common git directory; `{ error }` when no
+ * main tree holds that directory. */
+function mainWorktree(top) {
+  let gitDir;
+  let commonDir;
+  try {
+    [gitDir, commonDir] = runGit(["rev-parse", "--git-dir", "--git-common-dir"], top)
+      .split("\n")
+      .slice(0, 2)
+      .map((p) => fs.realpathSync(path.resolve(top, p.trim())));
+  } catch (err) {
+    return { error: `common git directory unresolved (${quoted(String(err instanceof Error ? err.message : err).split("\n")[0])})` };
+  }
+  if (gitDir === commonDir) return { root: top };
+  const main = path.dirname(commonDir);
+  const info = treeInfo(main, fs.realpathSync(top));
+  return info.ok ? { root: main } : { error: `no main worktree holds ${quoted(commonDir)} (${quoted(info.reason)})` };
+}
+
 /** Runs `brief-init`: the skeleton of one task's brief, never written over an existing brief. */
 function runBriefInit(rest) {
   if (rest.length !== 2) return null;
@@ -3525,12 +2773,21 @@ function runBriefInit(rest) {
   const fail = (e) => report([e], "brief-init");
   if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(change)) return fail(`task-shape change ${quoted(change)} is not kebab-case`);
   if (!BRIEF_TASK_RE.test(task)) return fail(`task-shape task ${quoted(task)} is not a dotted task id or final`);
-  let root = process.cwd();
+  // The lead and hooks read the main tree's workspace; Base stays this checkout's HEAD.
+  let here = process.cwd();
+  let root = here;
+  let top = null;
   try {
-    root = git(["rev-parse", "--show-toplevel"], root);
+    top = git(["rev-parse", "--show-toplevel"], here);
   } catch {
     // outside a repository the current directory is the project root
   }
+  if (top !== null) {
+    const main = mainWorktree(top);
+    if (main.error) return fail(`tree-path ${quoted(top)}: ${main.error}`);
+    here = top;
+    root = main.root;
+  }
   const tasksFile = path.join(root, "openspec", "changes", change, "tasks.md");
   let tasks;
   try {
@@ -3545,7 +2802,7 @@ function runBriefInit(rest) {
   if (!template) return fail(`template-missing ${quoted(templateFile)}`);
   let base = null;
   try {
-    base = git(["rev-parse", "HEAD"], root);
+    base = git(["rev-parse", "HEAD"], here);
   } catch {
     // no commit yet: Base stays a placeholder
   }
@@ -3734,6 +2991,7 @@ function runHandoff(rest) {
     for (const p of found.paths) {
       const scan = scanTranscript(p, briefInfo, work, main ?? undefined, file);
       notes.push(...scan.notes);
+      if (scan.truncated) notes.push(`transcript-truncated ${quoted(agent)}`);
       for (const f of scan.failures) failures.add(f);
     }
     // The scan quotes what it shows; this pass keeps every transcript-derived line safe whatever
@@ -4419,7 +3677,8 @@ function treeRoundArgs(rest) {
 }
 
 /** Lines of a regular file read without following a symlink; 0 for anything else, so an
- * untracked link or FIFO never blocks or leaves the tree. */
+ * untracked link or FIFO never blocks or leaves the tree; 0 when the first 8 KiB hold a NUL
+ * byte, as numstat counts a binary file. */
 function untrackedLines(abs) {
   let fd;
   try {
@@ -4431,8 +3690,12 @@ function untrackedLines(abs) {
     if (!fs.fstatSync(fd).isFile()) return 0;
     const buf = Buffer.allocUnsafe(64 * 1024);
     let n = 0;
+    let seen = 0;
     let last = 0x0a;
     for (let got; (got = fs.readSync(fd, buf, 0, buf.length, null)) > 0; last = buf[got - 1]) {
+      const sniff = Math.min(got, Math.max(0, BINARY_SNIFF_BYTES - seen));
+      if (sniff > 0 && buf.subarray(0, sniff).includes(0)) return 0;
+      seen += got;
       for (let i = 0; i < got; i++) if (buf[i] === 0x0a) n++;
     }
     return last === 0x0a ? n : n + 1;