mixdog 0.9.147 → 0.9.148

package/src/runtime/shared/tool-surface.mjs

@@ -365,7 +365,7 @@ export function toolLoadingTargets(name, args = {}) {
 
 const CATEGORY_ORDER = [
   'Read', 'Search', 'Load', 'MCP', 'Skill', 'Web Research', 'Memory',
-  'Patch', 'Git', 'Shell', 'Agent', 'Task', 'Schedule', 'Channel', 'Setup', 'Other',
+  'Patch', 'Git', 'Shell', 'Agent', 'Task', 'Setup', 'Other',
 ];
 
 const TOOL_CATEGORY = new Map([
@@ -443,8 +443,6 @@ const CATEGORY_COPY = new Map([
   ['Shell', { active: 'Running', done: 'Ran', noun: 'command' }],
   ['Agent', { active: 'Calling', done: 'Called', noun: 'agent' }],
   ['Task', { active: 'Checking', done: 'Checked', noun: 'task' }],
-  ['Schedule', { active: 'Running', done: 'Ran', noun: 'schedule' }],
-  ['Channel', { active: 'Sending', done: 'Sent', noun: 'message' }],
   ['Setup', { active: 'Setting up', done: 'Set up', noun: 'item' }],
   ['Other', { active: 'Calling', done: 'Called', noun: 'tool' }],
 ]);
@@ -584,8 +582,11 @@ export function toolWorkUnit(name, args = {}, category = '') {
     case 'job_wait':
       return unitDescriptor('Shell', { count: queryCount(a, 'command', 'commands', 'cmd') || 1, noun: 'command' });
     case 'git':
-    case 'git_stage':
       return unitDescriptor('Git', { count: queryCount(a, 'command', 'commands') || 1, noun: 'Git command' });
+    // Staging is not "running a Git command": it selects change_ids out of an
+    // existing diff. Its own work unit keeps the two apart on the activity row.
+    case 'git_stage':
+      return unitDescriptor('Git', { count: queryCount(a, 'change_ids', 'change_id') || 1, active: 'Staging', done: 'Staged', noun: 'change' });
     case 'agent':
     case 'bridge': {
       const type = String(a.type || a.action || '').toLowerCase();
@@ -604,8 +605,13 @@ export function toolWorkUnit(name, args = {}, category = '') {
     }
     case 'task': {
       const action = String(a.action || '').toLowerCase();
-      if (action === 'cancel') return unitDescriptor('Task', { count: queryCount(a, 'task_id', 'task_ids', 'id', 'ids') || 1, active: 'Cancelling', done: 'Cancelled', noun: 'task' });
-      return unitDescriptor('Task', { count: queryCount(a, 'task_id', 'task_ids', 'id', 'ids') || 1, noun: 'task' });
+      const taskCount = queryCount(a, 'task_id', 'task_ids', 'id', 'ids') || 1;
+      // Waiting on a task, enumerating tasks, and cancelling one are distinct
+      // work; only `read`/`status` falls through to the neutral check verb.
+      if (action === 'cancel') return unitDescriptor('Task', { count: taskCount, active: 'Cancelling', done: 'Cancelled', noun: 'task' });
+      if (action === 'wait') return unitDescriptor('Task', { count: taskCount, active: 'Waiting for', done: 'Waited for', noun: 'task' });
+      if (action === 'list') return unitDescriptor('Task', { count: taskCount, active: 'Listing', done: 'Listed', noun: 'task' });
+      return unitDescriptor('Task', { count: taskCount, noun: 'task' });
     }
     case 'skill':
     case 'skill_execute':
@@ -620,7 +626,9 @@ export function toolWorkUnit(name, args = {}, category = '') {
         count: queryCount(a, 'symbols', 'symbol', 'query', 'file', 'path') || 1,
         active: searching ? 'Mapping' : 'Reading',
         done: searching ? 'Mapped' : 'Read',
-        noun: searching ? 'symbol' : 'file',
+        // "code map", not "file": an overview/imports/impact pass reads
+        // structure, and sharing the plain read unit hid it behind file reads.
+        noun: searching ? 'symbol' : 'code map',
       });
     }
     case 'request_user_input':

package/src/runtime/shared/turn-snapshot-store.mjs

@@ -0,0 +1,168 @@
+// Durable turn-snapshot index.
+//
+// The shadow repository already writes every turn baseline to disk as a Git
+// tree object, but the map from a session to that tree lived only in runtime
+// memory. Beginning the next turn, evicting the 32-entry turn cache or
+// restarting the daemon therefore stripped a finished review of its revert
+// source while the tree itself was still sitting on disk (user: 실행취소는 왜
+// 안 먹는거).
+//
+// Persist the three values a revert actually needs — the worktree root, the
+// baseline tree hash, and the paths this session itself mutated — so a review
+// stays revertible for as long as the objects survive. The session-owned path
+// list is what lets a SHARED worktree still revert: the baseline describes the
+// whole tree, but only these paths may be restored from it.
+import { createHash } from 'node:crypto';
+import { mkdir, readFile, readdir, rename, rm, stat, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+// Same resolution as session-runtime/runtime-paths.mjs. Shared runtime code
+// cannot import the session layer, so the rule is repeated instead of inverted.
+const DATA_DIR = process.env.MIXDOG_DATA_DIR
+  || join(process.env.MIXDOG_HOME || join(homedir(), '.mixdog'), 'data');
+const RECORD_VERSION = 1;
+// Matches the shadow repository's own `gc --prune` window: once the tree object
+// is collected the record cannot restore anything anyway.
+const RECORD_TTL_MS = 7 * 24 * 60 * 60 * 1000;
+// Enough to cover the reviews a user can still act on; the newest turn wins.
+const MAX_TURNS_PER_SESSION = 8;
+// A bounded directory: one file per session, oldest swept first.
+const MAX_RECORD_FILES = 512;
+
+let recordRoot = join(DATA_DIR, 'turn-snapshots');
+// Per-session write chain. Two turns of one session never race their own file,
+// and a read never observes a partially written record (writes land by rename).
+const writeChains = new Map();
+let sweepDone = false;
+
+function clean(value) {
+  return typeof value === 'string' ? value.trim() : '';
+}
+
+function recordPath(sessionId) {
+  const hash = createHash('sha256').update(sessionId).digest('hex').slice(0, 24);
+  return join(recordRoot, `${hash}.json`);
+}
+
+function chain(sessionId, task) {
+  const previous = writeChains.get(sessionId) || Promise.resolve();
+  const next = previous.then(task, task);
+  writeChains.set(sessionId, next.then(() => undefined, () => undefined));
+  return next;
+}
+
+async function readRecordFile(path) {
+  try {
+    const parsed = JSON.parse(await readFile(path, 'utf8'));
+    if (!parsed || parsed.version !== RECORD_VERSION) return null;
+    if (!Array.isArray(parsed.turns)) return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+
+/** Oldest-first sweep so a long-lived install cannot accumulate records. */
+async function sweepRecords() {
+  if (sweepDone) return;
+  sweepDone = true;
+  try {
+    const names = await readdir(recordRoot);
+    const now = Date.now();
+    const kept = [];
+    for (const name of names) {
+      if (!name.endsWith('.json')) continue;
+      const path = join(recordRoot, name);
+      try {
+        const info = await stat(path);
+        if (now - info.mtimeMs > RECORD_TTL_MS) {
+          await rm(path, { force: true });
+          continue;
+        }
+        kept.push({ path, mtimeMs: info.mtimeMs });
+      } catch { /* a record that cannot be read is not worth keeping */ }
+    }
+    kept.sort((left, right) => left.mtimeMs - right.mtimeMs);
+    for (const entry of kept.slice(0, Math.max(0, kept.length - MAX_RECORD_FILES))) {
+      await rm(entry.path, { force: true });
+    }
+  } catch { /* the store is best-effort: a revert falls back to memory */ }
+}
+
+/**
+ * Fold one turn into a session's record. `generation` identifies the turn, so
+ * re-recording the same turn updates it in place rather than appending.
+ */
+export async function saveTurnSnapshotRecord(sessionId, turn) {
+  const id = clean(sessionId);
+  const baselineTree = clean(turn?.baselineTree);
+  const root = clean(turn?.root);
+  if (!id || !baselineTree || !root) return false;
+  return await chain(id, async () => {
+    try {
+      await mkdir(recordRoot, { recursive: true });
+      void sweepRecords();
+      const path = recordPath(id);
+      const existing = await readRecordFile(path);
+      const generation = Number(turn?.generation) || 0;
+      const turns = (existing?.turns || []).filter((entry) => entry?.generation !== generation);
+      turns.push({
+        generation,
+        root,
+        baselineTree,
+        // Relative, forward-slashed paths this session's own tools mutated.
+        toolFiles: [...new Set((Array.isArray(turn?.toolFiles) ? turn.toolFiles : [])
+          .map((value) => clean(value))
+          .filter(Boolean))],
+        sealed: turn?.sealed === true,
+        updatedAt: Date.now(),
+      });
+      turns.sort((left, right) => (left.generation || 0) - (right.generation || 0));
+      const payload = {
+        version: RECORD_VERSION,
+        sessionId: id,
+        turns: turns.slice(-MAX_TURNS_PER_SESSION),
+      };
+      const temporary = `${path}.${process.pid}.tmp`;
+      await writeFile(temporary, JSON.stringify(payload), 'utf8');
+      await rename(temporary, path);
+      return true;
+    } catch {
+      return false;
+    }
+  });
+}
+
+/**
+ * The newest recorded turn that actually owns files. A turn that mutated
+ * nothing has nothing to revert, and returning it would hide the completed
+ * turn behind it — which is exactly the review the user is looking at.
+ */
+export async function loadTurnSnapshotRecord(sessionId) {
+  const id = clean(sessionId);
+  if (!id) return null;
+  const record = await readRecordFile(recordPath(id));
+  if (!record) return null;
+  for (let index = record.turns.length - 1; index >= 0; index -= 1) {
+    const turn = record.turns[index];
+    if (!turn?.baselineTree || !turn?.root) continue;
+    if (!Array.isArray(turn.toolFiles) || turn.toolFiles.length === 0) continue;
+    return turn;
+  }
+  return null;
+}
+
+export async function deleteTurnSnapshotRecords(sessionId) {
+  const id = clean(sessionId);
+  if (!id) return;
+  await chain(id, async () => {
+    try { await rm(recordPath(id), { force: true }); } catch { /* best effort */ }
+  });
+}
+
+export function _setTurnSnapshotStoreRootForTest(directory) {
+  recordRoot = clean(directory) || join(DATA_DIR, 'turn-snapshots');
+  writeChains.clear();
+  sweepDone = false;
+}

package/src/runtime/shared/turn-snapshot.mjs

@@ -5,9 +5,12 @@ import {
   _resetTurnWorktreeSnapshotsForTest,
   createTurnWorktreeSnapshot,
   refreshTurnWorktreeSnapshot,
+  resumeTurnWorktreeSnapshot,
   revertTurnWorktreeFile,
+  revertTurnWorktreePaths,
   revertTurnWorktreeSnapshot,
 } from './turn-worktree-snapshot.mjs';
+import { loadTurnSnapshotRecord, saveTurnSnapshotRecord } from './turn-snapshot-store.mjs';
 
 // Turn-scoped review registry.
 //
@@ -96,6 +99,9 @@ function createDiffTracker(meta = {}) {
     originByCurrentPath: new Map(),
     unifiedDiff: '',
     worktreeSnapshot: null,
+    // Session-owned relative paths. These outlive the before/after buffers on
+    // purpose: they are what scopes a revert once the exact content is gone.
+    ownedPaths: new Set(),
   };
 }
 
@@ -346,6 +352,13 @@ export function recordTurnDiffChanges(sessionId, changes = []) {
     const before = contentBuffer(raw?.before);
     const after = contentBuffer(raw?.after);
     const destinationPath = clean(raw?.newPath);
+    // WHICH files this session wrote has to survive releasing their content —
+    // on turn completion, and on the tracked-size ceiling. That list is the
+    // attribution a shared worktree cannot otherwise reconstruct.
+    tracker.ownedPaths.add(sourceDisplay);
+    if (destinationPath) {
+      tracker.ownedPaths.add(displayPath(raw?.newDisplayPath || destinationPath));
+    }
     if (!destinationPath) {
       if (before === null && after !== null) {
         tracker.originByCurrentPath.delete(sourceKey);
@@ -549,14 +562,37 @@ export function completeAgentTurnReview(handle, patches = []) {
   }
 }
 
+/** Persist the durable half of a finished review: the baseline tree hash plus
+ *  the paths this session owns. Memory keeps the fast path; the record is what
+ *  survives the next turn, a cache eviction and a runtime restart. A CONTENDED
+ *  worktree is recorded too — the baseline is still exact, and the owned paths
+ *  are precisely the attribution that contention destroys. */
+async function persistTurnSnapshotRecord(ownerSessionId, tracker) {
+  const snapshot = tracker?.worktreeSnapshot;
+  if (!ownerSessionId || !snapshot?.baselineTree || !snapshot.root) return;
+  const owned = [...tracker.ownedPaths];
+  if (owned.length === 0) return;
+  try {
+    await saveTurnSnapshotRecord(ownerSessionId, {
+      generation: _turnsBySession.get(ownerSessionId)?.generation || 0,
+      root: snapshot.root,
+      baselineTree: snapshot.baselineTree,
+      toolFiles: owned,
+      sealed: true,
+    });
+  } catch { /* the record adds to a review, it is never required by one */ }
+}
+
 /** Freeze a completed Lead turn while retaining only its bounded review data. */
 export async function completeTurnSnapshot(sessionId) {
-  const tracker = _diffTrackersBySession.get(clean(sessionId));
+  const ownerSessionId = clean(sessionId);
+  const tracker = _diffTrackersBySession.get(ownerSessionId);
   if (!tracker) return false;
   if (worktreeSnapshotUsable(tracker)) {
     try { await refreshTurnWorktreeSnapshot(tracker.worktreeSnapshot); } catch {}
   }
   tracker.sealed = true;
+  await persistTurnSnapshotRecord(ownerSessionId, tracker);
   // Only a usable Git baseline can replace the exact apply_patch buffers. A
   // contended worktree — and a worktree with no Git baseline at all — retains
   // this session's bounded before/after content so Review can still undo its
@@ -590,6 +626,71 @@ function worktreeSnapshotUsable(tracker) {
   return Boolean(tracker && !tracker.worktreeContended && tracker.worktreeSnapshot);
 }
 
+/** Match a user-supplied file against a recorded session-owned path. */
+function recordedPathMatchesFile(owned, root, file) {
+  const target = clean(file);
+  if (!target) return false;
+  const normalizedRoot = pathKey(root);
+  const normalizedTarget = pathKey(target);
+  const relativeTarget = normalizedRoot && normalizedTarget.startsWith(`${normalizedRoot}/`)
+    ? normalizedTarget.slice(normalizedRoot.length + 1)
+    : normalizedTarget;
+  const normalizedOwned = pathKey(owned);
+  return normalizedOwned === relativeTarget || normalizedOwned === normalizedTarget;
+}
+
+/** Re-open the recorded baseline for a session whose tracker is gone. Returns
+ *  null when the record is missing or its tree object has been collected. */
+async function resumeRecordedSnapshot(ownerSessionId) {
+  if (!ownerSessionId) return null;
+  let record = null;
+  try {
+    record = await loadTurnSnapshotRecord(ownerSessionId);
+  } catch {
+    return null;
+  }
+  if (!record) return null;
+  const snapshot = await resumeTurnWorktreeSnapshot(record.root, record.baselineTree, {
+    paths: record.toolFiles,
+  }).catch(() => null);
+  if (!snapshot) return null;
+  return { record, snapshot };
+}
+
+/** A review rebuilt from the durable record. Same shape as the live one, but
+ *  scoped to the recording session's own paths so a worktree shared with other
+ *  sessions stays attributable instead of losing its revert entirely. */
+async function scopedReviewFromRecord(ownerSessionId) {
+  const resumed = await resumeRecordedSnapshot(ownerSessionId);
+  if (!resumed) return null;
+  return {
+    supported: true,
+    files: resumed.snapshot.files || [],
+    patch: resumed.snapshot.patch || '',
+    snapshotKind: 'scoped',
+    revertMode: 'scoped',
+    patchTruncated: resumed.snapshot.patchTruncated === true,
+    authoritative: true,
+    agents: publicAgentReviews(ownerSessionId),
+    reason: 'recorded',
+  };
+}
+
+/** Restore recorded paths — every one of them, or just the file the user picked. */
+async function revertFromRecord(worktree, ownerSessionId, file) {
+  const resumed = await resumeRecordedSnapshot(ownerSessionId);
+  if (!resumed) return null;
+  const owned = resumed.record.toolFiles;
+  const targets = file
+    ? owned.filter((path) => recordedPathMatchesFile(path, resumed.record.root, file))
+    : owned;
+  if (targets.length === 0) {
+    throw new Error('turn review revert cannot attribute this file to the session');
+  }
+  await revertTurnWorktreePaths(resumed.snapshot, targets);
+  return await getTurnReviewDiff(worktree, ownerSessionId);
+}
+
 /** Return the authoritative Lead net diff plus attributed child reviews. */
 export async function getTurnReviewDiff(_worktree, sessionId, options = {}) {
   if (DISABLED) return { supported: false, files: [], patch: '', agents: [] };
@@ -609,6 +710,13 @@ export async function getTurnReviewDiff(_worktree, sessionId, options = {}) {
   const trackedRevertAvailable = !snapshot
     && tracker?.valid === true
     && trackedPairs(tracker).length > 0;
+  if (!snapshot && !trackedRevertAvailable) {
+    // Both in-memory sources are gone: the next turn replaced the tracker, the
+    // turn cache evicted it, or the runtime restarted. The recorded baseline is
+    // still on disk and still exact.
+    const recorded = await scopedReviewFromRecord(ownerSessionId);
+    if (recorded) return recorded;
+  }
   return {
     supported: true,
     files: snapshot?.files || [],
@@ -635,15 +743,23 @@ export async function revertTurnReviewFile(_worktree, sessionId, file) {
   const tracker = _diffTrackersBySession.get(ownerSessionId);
   if (tracker && !worktreeSnapshotUsable(tracker)) {
     const pairs = trackedPairs(tracker);
-    if (pairs.length === 0) throw new Error(unavailableTrackedRevertReason(tracker));
-    const pair = pairs.find((entry) => pairMatchesFile(entry, _worktree, file));
-    if (!pair) throw new Error('turn review tracked file snapshot is unavailable');
-    await revertTrackedPairs(tracker, _worktree, [pair]);
+    if (pairs.length > 0) {
+      const pair = pairs.find((entry) => pairMatchesFile(entry, _worktree, file));
+      if (!pair) throw new Error('turn review tracked file snapshot is unavailable');
+      await revertTrackedPairs(tracker, _worktree, [pair]);
+      return await getTurnReviewDiff(_worktree, ownerSessionId);
+    }
+    const recorded = await revertFromRecord(_worktree, ownerSessionId, file);
+    if (recorded) return recorded;
+    throw new Error(unavailableTrackedRevertReason(tracker));
+  }
+  if (tracker?.worktreeSnapshot) {
+    await revertTurnWorktreeFile(tracker.worktreeSnapshot, file);
     return await getTurnReviewDiff(_worktree, ownerSessionId);
   }
-  if (!tracker?.worktreeSnapshot) throw new Error('turn worktree snapshot is unavailable');
-  await revertTurnWorktreeFile(tracker.worktreeSnapshot, file);
-  return await getTurnReviewDiff(_worktree, ownerSessionId);
+  const recorded = await revertFromRecord(_worktree, ownerSessionId, file);
+  if (recorded) return recorded;
+  throw new Error('turn worktree snapshot is unavailable');
 }
 
 /** Restore every file in the reviewed turn to its turn-start state. */
@@ -652,13 +768,21 @@ export async function revertTurnReview(_worktree, sessionId) {
   const tracker = _diffTrackersBySession.get(ownerSessionId);
   if (tracker && !worktreeSnapshotUsable(tracker)) {
     const pairs = trackedPairs(tracker);
-    if (pairs.length === 0) throw new Error(unavailableTrackedRevertReason(tracker));
-    await revertTrackedPairs(tracker, _worktree, pairs);
+    if (pairs.length > 0) {
+      await revertTrackedPairs(tracker, _worktree, pairs);
+      return await getTurnReviewDiff(_worktree, ownerSessionId);
+    }
+    const recorded = await revertFromRecord(_worktree, ownerSessionId, null);
+    if (recorded) return recorded;
+    throw new Error(unavailableTrackedRevertReason(tracker));
+  }
+  if (tracker?.worktreeSnapshot) {
+    await revertTurnWorktreeSnapshot(tracker.worktreeSnapshot);
     return await getTurnReviewDiff(_worktree, ownerSessionId);
   }
-  if (!tracker?.worktreeSnapshot) throw new Error('turn worktree snapshot is unavailable');
-  await revertTurnWorktreeSnapshot(tracker.worktreeSnapshot);
-  return await getTurnReviewDiff(_worktree, ownerSessionId);
+  const recorded = await revertFromRecord(_worktree, ownerSessionId, null);
+  if (recorded) return recorded;
+  throw new Error('turn worktree snapshot is unavailable');
 }
 
 export function _resetTurnSnapshotForTest() {

package/src/runtime/shared/turn-worktree-snapshot.mjs

@@ -10,14 +10,23 @@ import {
   rm,
   writeFile,
 } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
+import { homedir } from 'node:os';
 import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
 
 const COMMAND_TIMEOUT_MS = 30_000;
 const COMMAND_MAX_BYTES = 8 * 1024 * 1024;
 const PATCH_MAX_BYTES = 2 * 1024 * 1024;
 const MAX_UNTRACKED_FILE_BYTES = 2 * 1024 * 1024;
-const SNAPSHOT_ROOT = join(tmpdir(), 'mixdog-turn-worktree-snapshots-v1');
+// Baselines used to live in the OS temp directory, where a reboot or a disk
+// cleaner could remove the only copy of a turn's revert source. Keep them with
+// the rest of the runtime data (same resolution as
+// session-runtime/runtime-paths.mjs; shared code cannot import that layer).
+const DATA_DIR = process.env.MIXDOG_DATA_DIR
+  || join(process.env.MIXDOG_HOME || join(homedir(), '.mixdog'), 'data');
+const SNAPSHOT_ROOT = join(DATA_DIR, 'turn-worktree-snapshots-v1');
+// A baseline tree is unreachable by design (no commit, no ref), so collection
+// is what bounds how long a review stays revertible.
+const SHADOW_GC_PRUNE = '7.days.ago';
 const states = new Map();
 
 function clean(value) {
@@ -417,11 +426,14 @@ function parseNumstat(text) {
   return out;
 }
 
-async function diffTreesUnlocked(state, baselineTree, currentTree) {
+async function diffTreesUnlocked(state, baselineTree, currentTree, paths = null) {
   if (!baselineTree || !currentTree || baselineTree === currentTree) {
     return { patch: '', files: [], patchTruncated: false, currentTree };
   }
-  const rangeArgs = ['--find-renames', baselineTree, currentTree, '--', '.'];
+  // A scoped review restricts the range to the paths its session owns: the
+  // baseline describes the whole worktree, concurrent sessions included.
+  const pathspec = Array.isArray(paths) && paths.length > 0 ? paths : ['.'];
+  const rangeArgs = ['--find-renames', baselineTree, currentTree, '--', ...pathspec];
   const [nameStatus, numstat] = await Promise.all([
     runGit(shadowArgs(state, ['diff', '--name-status', '-z', ...rangeArgs]), { cwd: state.root }),
     runGit(shadowArgs(state, ['diff', '--numstat', '-z', ...rangeArgs]), { cwd: state.root }),
@@ -462,6 +474,26 @@ async function diffTreesUnlocked(state, baselineTree, currentTree) {
   return { patch, files, patchTruncated, currentTree };
 }
 
+// One maintenance pass per shadow repository per process, off the turn's
+// critical path. `--auto` does nothing until the repository actually needs it,
+// so the common case costs a process spawn and nothing else.
+const maintainedShadowRepositories = new Set();
+
+function scheduleShadowGc(state) {
+  if (maintainedShadowRepositories.has(state.gitDir)) return;
+  maintainedShadowRepositories.add(state.gitDir);
+  const timer = setTimeout(() => {
+    // Deliberately outside the state lock: collection can run for minutes and
+    // git serializes itself through gc.lock, so a clash just retries later.
+    void runGit(shadowArgs(state, ['gc', '--auto', `--prune=${SHADOW_GC_PRUNE}`, '--quiet']), {
+      cwd: state.root,
+      allowFailure: true,
+      timeoutMs: 300_000,
+    }).catch(() => {});
+  }, 60_000);
+  timer.unref?.();
+}
+
 export async function createTurnWorktreeSnapshot(worktree) {
   const root = await repositoryRoot(worktree).catch(() => null);
   if (!root) return null;
@@ -469,6 +501,7 @@ export async function createTurnWorktreeSnapshot(worktree) {
   return await withStateLock(state, async () => {
     const baselineTree = await captureTreeUnlocked(state);
     if (!baselineTree) return null;
+    scheduleShadowGc(state);
     return {
       state,
       root,
@@ -477,16 +510,57 @@ export async function createTurnWorktreeSnapshot(worktree) {
       patch: '',
       files: [],
       patchTruncated: false,
+      scopePaths: null,
     };
   });
 }
 
+/** Re-open a recorded baseline after the runtime lost its in-memory tracker.
+ *  The tree object is the durable half of a review; `paths` scopes both this
+ *  diff and any later revert to what the recording session actually owns. */
+export async function resumeTurnWorktreeSnapshot(worktree, baselineTree, { paths = null } = {}) {
+  const tree = clean(baselineTree);
+  if (!tree) return null;
+  const root = await repositoryRoot(worktree).catch(() => null);
+  if (!root) return null;
+  const state = stateForRoot(root);
+  return await withStateLock(state, async () => {
+    await ensureState(state);
+    // A collected or never-written baseline restores nothing. Report that as
+    // "no snapshot" instead of failing every later call made against it.
+    const kind = await runGit(shadowArgs(state, ['cat-file', '-t', tree]), {
+      cwd: state.root,
+      allowFailure: true,
+    });
+    if (kind.code !== 0 || clean(kind.stdout) !== 'tree') return null;
+    const scopePaths = Array.isArray(paths) && paths.length > 0 ? [...new Set(paths)] : null;
+    const snapshot = {
+      state,
+      root,
+      baselineTree: tree,
+      currentTree: tree,
+      patch: '',
+      files: [],
+      patchTruncated: false,
+      scopePaths,
+    };
+    const currentTree = await captureTreeUnlocked(state);
+    Object.assign(snapshot, await diffTreesUnlocked(state, tree, currentTree, scopePaths));
+    return snapshot;
+  });
+}
+
 export async function refreshTurnWorktreeSnapshot(snapshot) {
   if (!snapshot?.state || !snapshot.baselineTree) return null;
   return await withStateLock(snapshot.state, async () => {
     const currentTree = await captureTreeUnlocked(snapshot.state);
     if (currentTree === snapshot.currentTree) return snapshot;
-    const review = await diffTreesUnlocked(snapshot.state, snapshot.baselineTree, currentTree);
+    const review = await diffTreesUnlocked(
+      snapshot.state,
+      snapshot.baselineTree,
+      currentTree,
+      snapshot.scopePaths,
+    );
     Object.assign(snapshot, review);
     return snapshot;
   });
@@ -531,19 +605,29 @@ async function restorePathFromTree(snapshot, rel) {
   }
 }
 
+async function revertPathsUnlocked(snapshot, targets) {
+  for (const target of targets) {
+    await restorePathFromTree(snapshot, target);
+  }
+  const currentTree = await captureTreeUnlocked(snapshot.state);
+  Object.assign(snapshot, await diffTreesUnlocked(
+    snapshot.state,
+    snapshot.baselineTree,
+    currentTree,
+    snapshot.scopePaths,
+  ));
+  return snapshot;
+}
+
 export async function revertTurnWorktreeFile(snapshot, value) {
   if (!snapshot?.state || !snapshot.baselineTree) throw new Error('turn worktree snapshot is unavailable');
   return await withStateLock(snapshot.state, async () => {
     const rel = safeRelativePath(snapshot.root, value);
     const entry = snapshot.files.find((file) =>
       pathKey(file.path) === pathKey(rel) || pathKey(file.oldPath) === pathKey(rel));
-    const targets = [...new Set([entry?.path || rel, entry?.oldPath].filter(Boolean))];
-    for (const target of targets) {
-      await restorePathFromTree(snapshot, safeRelativePath(snapshot.root, target));
-    }
-    const currentTree = await captureTreeUnlocked(snapshot.state);
-    Object.assign(snapshot, await diffTreesUnlocked(snapshot.state, snapshot.baselineTree, currentTree));
-    return snapshot;
+    const targets = [...new Set([entry?.path || rel, entry?.oldPath].filter(Boolean))]
+      .map((target) => safeRelativePath(snapshot.root, target));
+    return await revertPathsUnlocked(snapshot, targets);
   });
 }
 
@@ -557,12 +641,20 @@ export async function revertTurnWorktreeSnapshot(snapshot) {
       .flatMap((file) => [file.path, file.oldPath])
       .filter(Boolean))]
       .map((target) => safeRelativePath(snapshot.root, target));
-    for (const target of targets) {
-      await restorePathFromTree(snapshot, target);
-    }
-    const currentTree = await captureTreeUnlocked(snapshot.state);
-    Object.assign(snapshot, await diffTreesUnlocked(snapshot.state, snapshot.baselineTree, currentTree));
-    return snapshot;
+    return await revertPathsUnlocked(snapshot, targets);
+  });
+}
+
+/** Restore only the listed paths. This is the session-owned revert: a shared
+ *  worktree cannot attribute the whole-tree diff, but the paths this session's
+ *  own tools wrote are exactly attributable. */
+export async function revertTurnWorktreePaths(snapshot, values) {
+  if (!snapshot?.state || !snapshot.baselineTree) throw new Error('turn worktree snapshot is unavailable');
+  const requested = (Array.isArray(values) ? values : []).filter(Boolean);
+  if (requested.length === 0) throw new Error('turn review revert has no restorable files');
+  return await withStateLock(snapshot.state, async () => {
+    const targets = [...new Set(requested.map((value) => safeRelativePath(snapshot.root, value)))];
+    return await revertPathsUnlocked(snapshot, targets);
   });
 }