mixdog 1.2.1 → 1.2.2

package/src/runtime/shared/turn-changes.mjs

@@ -5,9 +5,10 @@
 // turn-snapshot-store.mjs. Every file carries its own complete patch, separate
 // from the bounded display patch the review bar renders, so a historical turn
 // stays undoable after later turns, cache eviction or a runtime restart.
+import { createHash } from 'node:crypto';
 import { lstat, open, realpath, stat } from 'node:fs/promises';
-import { isAbsolute, relative, resolve } from 'node:path';
-import { applyPatch, parsePatch, reversePatch, structuredPatch } from 'diff';
+import { dirname, isAbsolute, relative, resolve } from 'node:path';
+import { structuredPatch } from 'diff';
 import { cleanString as clean } from './clean.mjs';
 import { runGitOffThread } from './git-runner.mjs';
 
@@ -344,25 +345,32 @@ export function turnChangesReply({ status, checkpointId, record = null, patch =
   return reply;
 }
 
-// ── Session review: net recorded changes ────────────────────────────────────
+// ── Session review: first-seen baselines against the disk ───────────────────
 
 export const NET_TEXT_MAX_BYTES = 1024 * 1024;
 /** Budget of the merged session patch, in UTF-8 bytes. */
 export const MERGED_PATCH_MAX_BYTES = 2 * 1024 * 1024;
 const VIEW_PATCH_MAX_BYTES = 256 * 1024;
 
-/** A git-format patch of exact before/after text under the names a viewer
- *  shows (absolute for a file outside the worktree). `before`/`after` are
- *  Buffers or null (absent). */
-export function namedChangePatch({ before, after, oldName, newName, maxBytes = VIEW_PATCH_MAX_BYTES }) {
-  const renamed = oldName !== newName;
+/** Counts and a placeholder-named patch of exact before/after bytes. */
+function measureChange(before, after, renamed) {
   const measured = trackedChangeFile({
     oldPath: renamed ? 'mx-old-file' : 'mx-file',
     newPath: renamed ? 'mx-new-file' : 'mx-file',
     before,
     after,
   });
-  const text = measured.patch ? measured.patch.toString('utf8') : '';
+  return {
+    status: measured.status,
+    additions: measured.additions,
+    deletions: measured.deletions,
+    ...(measured.binary ? { binary: true } : {}),
+    text: measured.patch ? measured.patch.toString('utf8') : '',
+  };
+}
+
+/** A measured patch with its placeholders replaced by the names a viewer shows. */
+function nameMeasuredPatch(text, oldName, newName) {
   const split = text.search(/\n@@ /);
   const head = (split >= 0 ? text.slice(0, split) : text)
     .split('mx-old-file')
@@ -371,19 +379,21 @@ export function namedChangePatch({ before, after, oldName, newName, maxBytes = V
     .join(newName)
     .split('mx-file')
     .join(newName);
-  const patch = head + (split >= 0 ? text.slice(split) : '');
-  return {
-    status: measured.status,
-    additions: measured.additions,
-    deletions: measured.deletions,
-    ...(measured.binary ? { binary: true } : {}),
-    patch: Buffer.byteLength(patch, 'utf8') > maxBytes ? '' : patch,
-  };
+  return head + (split >= 0 ? text.slice(split) : '');
+}
+
+/** A git-format patch of exact before/after text under the names a viewer
+ *  shows (absolute for a file outside the worktree). `before`/`after` are
+ *  Buffers or null (absent). */
+export function namedChangePatch({ before, after, oldName, newName, maxBytes = VIEW_PATCH_MAX_BYTES }) {
+  const { text, ...measured } = measureChange(before, after, oldName !== newName);
+  const patch = nameMeasuredPatch(text, oldName, newName);
+  return { ...measured, patch: Buffer.byteLength(patch, 'utf8') > maxBytes ? '' : patch };
 }
 
 const slashPath = (value) => clean(value).replace(/\\/g, '/');
 const isOutsidePath = (path) => isAbsolute(path) || /^[A-Za-z]:[\\/]/.test(path);
-const absoluteKey = (root, path) => changePathKey(isOutsidePath(path) ? resolve(path) : resolve(root, path));
+const absolutePath = (root, path) => (isOutsidePath(path) ? resolve(path) : resolve(root, path));
 const patchOf = (file) =>
   changePatchBuffer(file)?.toString('utf8') || (typeof file?.viewPatch === 'string' ? file.viewPatch : '');
 
@@ -407,12 +417,13 @@ async function readBounded(file) {
   }
 }
 
-/** The file's current text: a string, null when absent, undefined when it
- *  cannot be netted (unreadable, binary, large, or reached through a link).
- *  An in-root file is followed only while it stays inside the recorded root;
- *  an outside file is read only at its exact recorded path, never through a
- *  link. */
-export async function currentText(root, path) {
+const missingFile = (error) => error?.code === 'ENOENT' || error?.code === 'ENOTDIR';
+
+/** The recorded file's absolute path when it may be read: null when absent,
+ *  undefined when it is reached through a link. An in-root file is followed
+ *  only while it stays inside the recorded root; an outside file is read only
+ *  at its exact recorded path, never through a link. */
+async function safeCurrentFile(root, path) {
   const outside = isOutsidePath(path);
   const file = outside ? resolve(path) : resolve(root, path);
   try {
@@ -426,10 +437,22 @@ export async function currentText(root, path) {
       const [realRoot, realFile] = await Promise.all([realpath(root), realpath(file)]);
       if (!insideDirectory(realRoot, realFile)) return undefined;
     }
+    return file;
+  } catch (error) {
+    return missingFile(error) ? null : undefined;
+  }
+}
+
+/** The file's current text: a string, null when absent, undefined when it
+ *  cannot be netted (unreadable, binary, large, or reached through a link). */
+export async function currentText(root, path) {
+  const file = await safeCurrentFile(root, path);
+  if (!file) return file;
+  try {
     const bytes = await readBounded(file);
     return bytes === undefined ? undefined : (decodeText(bytes) ?? undefined);
   } catch (error) {
-    return error?.code === 'ENOENT' || error?.code === 'ENOTDIR' ? null : undefined;
+    return missingFile(error) ? null : undefined;
   }
 }
 
@@ -459,248 +482,453 @@ export async function measureLegacyChangeFile(file, root) {
   return { ...file, additions: named.additions, deletions: named.deletions, viewPatch: named.patch };
 }
 
-/** The text a chain's file had before its first recorded turn, rebuilt by
- *  reverse-applying the recorded per-turn patches, newest first, onto the
- *  file as it is now (`current`: string, or null when absent). null = the file
- *  did not exist; undefined = a patch is missing or no longer matches, so the
- *  chain cannot be netted exactly. Nothing about the before-state is stored. */
-function originalText(entries, current) {
-  let text = current;
-  for (let index = entries.length - 1; index >= 0; index -= 1) {
-    const { file } = entries[index];
-    const patch = patchOf(file);
-    if (!patch || file.binary === true) return undefined;
-    let sections;
-    try {
-      sections = parsePatch(patch);
-    } catch {
-      return undefined;
-    }
-    if (sections.length !== 1) return undefined;
-    const [section] = sections;
-    if (file.status === 'D') {
-      if (text !== null) return undefined;
-      text = '';
-    } else if (text === null) {
-      return undefined;
-    }
-    if (section.hunks.length) {
-      const result = applyPatch(text, reversePatch(section));
-      if (result === false) return undefined;
-      text = result;
+// Largest current file hashed against a baseline whose bytes were not kept.
+const DIGEST_MAX_BYTES = 64 * 1024 * 1024;
+// Largest measured patch a review keeps cached between polls.
+const CACHED_PATCH_MAX_BYTES = 256 * 1024;
+const READ_CONCURRENCY = 16;
+const TOO_LARGE_REASON = 'file is too large to diff';
+const UNREADABLE_REASON = 'the file cannot be read safely now';
+const SEVERAL_TURNS_REASON = 'edited in several turns before its session baseline was recorded';
+/** Why a listed file has no exact diff against the session's first state. */
+const BASELINE_REASONS = {
+  'omitted-binary': "the session's original binary content was not captured",
+  'omitted-oversized': "the session's original content was too large to capture",
+  evicted: "the session's original content was evicted to bound storage",
+  missing: "the session's original state was not recorded",
+};
+
+const sha256 = (bytes) => createHash('sha256').update(bytes).digest('hex');
+
+async function mapLimit(items, limit, task) {
+  const results = new Array(items.length);
+  let next = 0;
+  const worker = async () => {
+    while (next < items.length) {
+      const index = next++;
+      results[index] = await task(items[index]);
     }
-    if (file.status === 'A') {
-      if (text !== '') return undefined;
-      text = null;
+  };
+  await Promise.all(Array.from({ length: Math.min(limit, items.length) }, worker));
+  return results;
+}
+
+/** An absolute file under the link rules of currentText: relative to its
+ *  recorded root when inside it, else its exact path. */
+const fileRef = (root, abs) =>
+  root && insideDirectory(root, abs) ? { root, path: relative(root, abs) } : { root: dirname(abs), path: abs };
+
+/** `{ state: 'absent' | 'unsafe' }` or `{ state: 'present', file, size, sig }`. */
+async function currentFile({ root, path }) {
+  const file = await safeCurrentFile(root, path);
+  if (file === null) return { state: 'absent' };
+  if (file === undefined) return { state: 'unsafe' };
+  try {
+    const info = await stat(file);
+    if (!info.isFile()) return { state: 'unsafe' };
+    return { state: 'present', file, size: info.size, sig: `${info.size}:${info.mtimeMs}:${info.ctimeMs}` };
+  } catch (error) {
+    return { state: missingFile(error) ? 'absent' : 'unsafe' };
+  }
+}
+
+const currentSig = (current) => (current?.state === 'present' ? current.sig : current?.state || '');
+
+/** Bytes of a present file up to NET_TEXT_MAX_BYTES; undefined past it or
+ *  when it cannot be read. */
+async function currentBytes(current) {
+  if (current.size > NET_TEXT_MAX_BYTES) return undefined;
+  try {
+    return await readBounded(current.file);
+  } catch {
+    return undefined;
+  }
+}
+
+async function fileDigest(file) {
+  let handle;
+  try {
+    handle = await open(file, 'r');
+    const info = await handle.stat();
+    if (!info.isFile() || info.size > DIGEST_MAX_BYTES) return undefined;
+    const hash = createHash('sha256');
+    const buffer = Buffer.alloc(1024 * 1024);
+    for (let position = 0; ; ) {
+      const { bytesRead } = await handle.read(buffer, 0, buffer.length, position);
+      if (!bytesRead) break;
+      hash.update(buffer.subarray(0, bytesRead));
+      position += bytesRead;
     }
+    return hash.digest('hex');
+  } catch {
+    return undefined;
+  } finally {
+    await handle?.close().catch(() => {});
   }
-  return text;
 }
 
-/** A recorded patch re-headed with the names the merged review shows, so a
- *  disambiguated file keeps one identity in its list row and its diff. */
-function retargetPatch(patch, { status, oldName, newName }) {
-  const split = patch.search(/\n@@ /);
-  const head = split >= 0 ? patch.slice(0, split) : patch;
-  const tail = split >= 0 ? patch.slice(split) : '';
-  const from = status === 'R' ? oldName : newName;
-  const tab = (name) => (name.includes(' ') ? '\t' : '');
-  const lines = head.split('\n').map((line) => {
-    if (line.startsWith('diff --git ')) return `diff --git a/${from} b/${newName}`;
-    if (line.startsWith('--- ') && !line.startsWith('--- /dev/null')) return `--- a/${from}${tab(from)}`;
-    if (line.startsWith('+++ ') && !line.startsWith('+++ /dev/null')) return `+++ b/${newName}${tab(newName)}`;
-    if (line.startsWith('rename from ')) return `rename from ${from}`;
-    if (line.startsWith('rename to ')) return `rename to ${newName}`;
-    return line;
+/** Whether a present file still holds the baseline's bytes: true, false, or
+ *  undefined when that cannot be told. */
+async function sameAsBaseline(entry, current, after) {
+  if (entry.size > 0 && entry.size !== current.size) return false;
+  if (!entry.sha256) return undefined;
+  const hash = after ? sha256(after) : await fileDigest(current.file);
+  return hash === undefined ? undefined : hash === entry.sha256;
+}
+
+/** A row the review cannot measure exactly: it never vouches for the set. */
+const partialChange = (status, reason, extra = {}) => ({
+  status,
+  additions: 0,
+  deletions: 0,
+  text: '',
+  reason,
+  partial: true,
+  ...extra,
+});
+
+const baselineGap = (entry, status) =>
+  partialChange(status, BASELINE_REASONS[entry.status] || BASELINE_REASONS.missing, {
+    baseline: entry.status,
+    ...(entry.status === 'omitted-binary' ? { binary: true } : {}),
   });
-  return lines.join('\n') + tail;
-}
-
-/** One path's turns, oldest first, as a single net change; null when the
- *  session left the file as it found it. The original is rebuilt from the
- *  recorded patches (see originalText) and compared with the disk, so undo,
- *  create→delete and renames fall out; when that fails the turns are merged
- *  per turn. `show` names a file for display. */
-async function netChain(chain, show) {
-  const first = chain.entries[0];
-  const last = chain.entries.at(-1);
-  const path = show(last.root, last.file.path);
-  const firstRel = first.file.oldPath || first.file.path;
-  const oldName = absoluteKey(first.root, firstRel) === chain.key ? path : show(first.root, firstRel);
-  const identity = {
-    id: slashPath(isOutsidePath(last.file.path) ? resolve(last.file.path) : resolve(last.root, last.file.path)),
-    outside: isOutsidePath(last.file.path),
-  };
-  const after = await currentText(last.root, last.file.path);
-  if (after !== undefined) {
-    const before = originalText(chain.entries, after);
-    if (before !== undefined) {
-      if (before === after && oldName === path) return null;
-      const net = namedChangePatch({
-        before: before === null ? null : Buffer.from(before, 'utf8'),
-        after: after === null ? null : Buffer.from(after, 'utf8'),
-        oldName,
-        newName: path,
-        maxBytes: MERGED_PATCH_MAX_BYTES,
-      });
-      const omitted = !net.patch && net.additions + net.deletions > 0;
-      return {
-        path,
-        ...identity,
-        ...(oldName !== path ? { oldPath: oldName } : {}),
-        ...net,
-        ...(omitted ? { patchOmitted: true } : {}),
-      };
+
+/** A file matching the hash of a first state whose bytes were not kept: not
+ *  listed, but it does not let the review vouch for the set either. */
+const UNVOUCHED_UNCHANGED = Object.freeze({ hidden: true, partial: true });
+
+/** One file (or rename) measured from its first-seen state `entry` to the
+ *  disk now (`current`); null when the session left it as it found it,
+ *  UNVOUCHED_UNCHANGED when only a hash says so. */
+async function measureBaseline(entry, current, renamed, readBlob) {
+  const changed = renamed ? 'R' : 'M';
+  if (current.state === 'unsafe') {
+    return partialChange(entry.state === 'absent' ? 'A' : changed, UNREADABLE_REASON);
+  }
+  const present = current.state === 'present';
+  const after = present ? await currentBytes(current) : null;
+  if (entry.state === 'absent') {
+    if (!present) return null;
+    if (after === undefined) return { status: 'A', additions: 0, deletions: 0, text: '', reason: TOO_LARGE_REASON };
+    return measureChange(null, after, false);
+  }
+  if (present) {
+    const same = await sameAsBaseline(entry, current, after);
+    const exact = entry.status === 'captured';
+    if (same === true && !renamed) return exact ? null : UNVOUCHED_UNCHANGED;
+    if (same === true) {
+      const moved = await measureChange(Buffer.alloc(0), Buffer.alloc(0), true);
+      return exact
+        ? moved
+        : { ...moved, partial: true, baseline: entry.status, reason: BASELINE_REASONS[entry.status] };
     }
+    if (same === undefined || !exact) return baselineGap(entry, changed);
   }
-  if (first.file.status === 'A' && last.file.status === 'D') return null;
-  const files = await Promise.all(chain.entries.map((entry) => measureLegacyChangeFile(entry.file, entry.root)));
-  const patches = files
-    .map((file) => {
-      const patch = patchOf(file);
-      return patch ? retargetPatch(patch, { status: file.status, oldName, newName: path }) : '';
-    })
-    .filter(Boolean);
-  const additions = files.reduce((sum, file) => sum + (Number(file.additions) || 0), 0);
-  const deletions = files.reduce((sum, file) => sum + (Number(file.deletions) || 0), 0);
-  const binary = files.some((file) => file.binary === true);
-  const patch = patches.join('');
-  return {
-    path,
-    ...identity,
-    ...(oldName !== path ? { oldPath: oldName } : {}),
-    status: first.file.status === 'A' ? 'A' : last.file.status,
-    additions,
-    deletions,
-    ...(binary ? { binary: true } : {}),
-    patch,
-    // A legacy record that measured nothing: the transcript may know more.
-    ...(!patch && additions + deletions === 0 && !binary ? { unmeasured: true, reason: clean(last.file.reason) } : {}),
-    ...(!patch && last.file.patchOmitted === true ? { patchOmitted: true } : {}),
-  };
+  const before = entry.status === 'captured' ? await readBlob(entry) : undefined;
+  if (!before)
+    return baselineGap(entry.status === 'captured' ? { ...entry, status: 'evicted' } : entry, present ? changed : 'D');
+  if (after === undefined) return { status: changed, additions: 0, deletions: 0, text: '', reason: TOO_LARGE_REASON };
+  return measureChange(before, after, renamed);
+}
+
+/** Every baseline not `covered` by another source, measured against the disk.
+ *  A path holding a renamed file pairs with the path it came from when that
+ *  one is gone. Measurements are reused while the files' stats are unchanged. */
+async function baselineChanges(baselines, covered, unvouched) {
+  const entries = new Map();
+  for (const entry of baselines.files) if (!covered(entry.path)) entries.set(entry.key, entry);
+  const list = [...entries.values()];
+  const states = await mapLimit(list, READ_CONCURRENCY, (entry) => currentFile(fileRef(entry.root, entry.path)));
+  const current = new Map(list.map((entry, index) => [entry.key, states[index]]));
+  const paired = new Set();
+  const units = [];
+  for (const [destinationKey, originKey] of baselines.renames) {
+    const destination = entries.get(destinationKey);
+    const origin = entries.get(originKey);
+    if (!destination || !origin || paired.has(destinationKey) || paired.has(originKey)) continue;
+    if (destination.state !== 'absent' || origin.state === 'absent') continue;
+    if (current.get(destinationKey).state === 'absent' || current.get(originKey).state !== 'absent') continue;
+    paired.add(destinationKey);
+    paired.add(originKey);
+    units.push({ key: `${originKey}\0${destinationKey}`, before: origin, after: destination });
+  }
+  for (const entry of list) if (!paired.has(entry.key)) units.push({ key: entry.key, before: entry, after: entry });
+  const measured = await mapLimit(units, READ_CONCURRENCY, async (unit) => {
+    const renamed = unit.before !== unit.after;
+    const now = current.get(unit.after.key);
+    const sig = [
+      unit.before.state,
+      unit.before.status,
+      unit.before.sha256 || '',
+      unit.before.blob || '',
+      unit.before.at,
+      unit.after.at,
+      currentSig(now),
+      currentSig(current.get(unit.before.key)),
+    ].join('|');
+    const cached = baselines.cache?.get(unit.key);
+    let change = cached?.sig === sig ? cached.change : undefined;
+    if (change === undefined) {
+      change = await measureBaseline(unit.before, now, renamed, baselines.readBlob);
+      if (Buffer.byteLength(change?.text || '', 'utf8') <= CACHED_PATCH_MAX_BYTES) {
+        baselines.cache?.set(unit.key, { sig, change });
+      }
+    }
+    if (change?.hidden) unvouched.add(unit.after.key);
+    if (!change || change.hidden) return null;
+    return {
+      key: unit.after.key,
+      abs: unit.after.path,
+      root: unit.after.root,
+      ...(renamed ? { oldAbs: unit.before.path, oldRoot: unit.before.root } : {}),
+      change,
+    };
+  });
+  return measured.filter(Boolean);
 }
 
-/** Group the records' files into per-path chains (renames continue a chain).
- *  A chain is keyed by root + path, so two roots' `x.txt` stay two files. */
-function recordChains(records, { inRootKinds }) {
-  const chains = new Map();
+/**
+ * Files of the retained turn records that no baseline lists — a session (or
+ * turns) recorded before baselines existed. Never exact: a file edited in one
+ * turn keeps that turn's diff, one edited in several is listed unmeasured.
+ * Also returns the baseline keys such older records touched: those baselines
+ * were first seen after an unrecorded edit.
+ */
+async function legacyChanges(records, { kinds, listed, covered, since }) {
+  const groups = new Map();
+  const late = new Set();
   for (const record of records) {
     const root = clean(record?.root);
     const entries = [
-      ...(inRootKinds.has(record?.kind) ? record.files || [] : []),
+      ...(kinds.has(record?.kind) ? record.files || [] : []),
       ...(Array.isArray(record?.outside) ? record.outside : []),
     ];
     for (const file of entries) {
       if (!file?.path || file.state === 'reverted') continue;
-      const key = absoluteKey(root, file.path);
-      const from = file.oldPath ? absoluteKey(root, file.oldPath) : key;
-      const chain = chains.get(from) || chains.get(key) || { entries: [] };
-      chains.delete(chain.key);
-      chain.entries.push({ file, root });
-      chain.key = key;
-      chains.set(key, chain);
+      const abs = absolutePath(root, file.path);
+      const key = changePathKey(abs);
+      const oldAbs = file.oldPath ? absolutePath(root, file.oldPath) : '';
+      if (covered(abs)) continue;
+      if (listed.has(key) || (oldAbs && listed.has(changePathKey(oldAbs)))) {
+        if (!(Number(record.createdAt) >= since)) late.add(key);
+        continue;
+      }
+      const prior = groups.get(key) || (oldAbs ? groups.get(changePathKey(oldAbs)) : undefined);
+      if (prior) groups.delete(prior.key);
+      let origin = {};
+      if (prior) origin = { oldAbs: prior.oldAbs, oldRoot: prior.oldRoot };
+      else if (oldAbs) origin = { oldAbs, oldRoot: root };
+      groups.set(key, {
+        key,
+        abs,
+        root,
+        file,
+        first: prior?.first || file,
+        turns: (prior?.turns || 0) + 1,
+        ...origin,
+      });
     }
   }
-  return [...chains.values()];
+  const changes = [];
+  for (const group of groups.values()) {
+    const { file, first } = group;
+    if (group.turns > 1 && first.status === 'A' && file.status === 'D') continue;
+    const unit = {
+      key: group.key,
+      abs: group.abs,
+      root: group.root,
+      ...(group.oldAbs ? { oldAbs: group.oldAbs, oldRoot: group.oldRoot } : {}),
+    };
+    if (group.turns > 1) {
+      const status = first.status === 'A' ? 'A' : file.status;
+      changes.push({
+        ...unit,
+        change: partialChange(status, SEVERAL_TURNS_REASON, { baseline: 'missing', unmeasured: true }),
+      });
+      continue;
+    }
+    const measured = await measureLegacyChangeFile(file, group.root);
+    const recordPatch = patchOf(measured);
+    const counts = (Number(measured.additions) || 0) + (Number(measured.deletions) || 0);
+    changes.push({
+      ...unit,
+      change: {
+        status: file.status,
+        additions: Number(measured.additions) || 0,
+        deletions: Number(measured.deletions) || 0,
+        ...(measured.binary ? { binary: true } : {}),
+        text: '',
+        recordPatch,
+        recordName: slashPath(file.path),
+        partial: true,
+        baseline: 'missing',
+        ...(!recordPatch && counts === 0 && !measured.binary
+          ? { unmeasured: true, reason: clean(file.reason) || BASELINE_REASONS.missing }
+          : {}),
+        ...(!recordPatch && file.patchOmitted === true ? { patchOmitted: true } : {}),
+      },
+    });
+  }
+  return { changes, late };
 }
 
-/** Records whose emptiness the session review may vouch for: a baseline that
- *  lists the files itself, or retained records (undo-aware). Without either
- *  the history is absent, never authoritative. */
-const knownSources = new Set(['git', 'empty', 'tool']);
+/** Files (`{ root, abs }`) the session claims but no baseline or record
+ *  lists: the ones still present are listed without a diff. */
+async function missingChanges(refs, { listed, covered }) {
+  const files = [];
+  for (const { root, abs } of refs) {
+    const key = changePathKey(abs);
+    if (listed.has(key) || covered(abs)) continue;
+    listed.add(key);
+    files.push({ key, abs, root });
+  }
+  const states = await mapLimit(files, READ_CONCURRENCY, (file) => currentFile(fileRef(file.root, file.abs)));
+  return files.map((file, index) =>
+    states[index].state === 'absent'
+      ? { ...file, gone: true }
+      : { ...file, change: partialChange('M', BASELINE_REASONS.missing, { baseline: 'missing' }) }
+  );
+}
 
 /**
- * The session-wide review completed with the turns' recorded changes — the
- * source the transcript's turn-changes cards read — as ONE net change per
- * file, identical before and after a runtime restart. `base.source` says what
- * the baseline review could vouch for:
- *  - `git`: the baseline is authoritative; only edits outside its root are added.
- *  - `empty` / `tool`: no baseline lists files (a non-Git session, or a
- *    session whose tracker holds nothing yet): the `tracked` records and the
- *    running turn (`live`) supply them, never the tracker's single-turn patch.
- *  - `absent` / `unavailable`: no ownership metadata survived; every retained
- *    record supplies the files, and with no record the review is not complete.
- * A file the user undid is never listed; Reapply lists it again. Each listed
- * file carries an `id` (root + path); when two roots would show the same
+ * The session-wide review: the Git baseline review (`base`) completed with
+ * every file it does not cover — a non-Git root, or a file outside the Git
+ * root — measured from its first-seen state in `baselines` (the Lead's and
+ * its attributed workers' edits together) against the disk now. `base.source`
+ * says what the Git side vouches for (`git`: its root; `empty`: nothing was
+ * owned). Retained `records` only list files no baseline knows (a session
+ * recorded before baselines existed) and never make the result complete.
+ * `complete` is set only when every listed file was measured exactly from a
+ * first state the session itself recorded; otherwise the result is `partial`.
+ * A file the user undid is back at its first state and is not listed. Each
+ * listed file carries an `id` (its absolute path); two roots sharing a
  * relative name both show their absolute path.
  */
-export async function mergeRecordedSessionChanges(base, records, live = null) {
-  const source = base?.source || '';
+export async function sessionChangeReview(base, { baselines = null, records = [] } = {}) {
+  const { source = '', reason: unavailableReason, owned, ...kept } = base || {};
   const gitBacked = source === 'git';
-  const cleared = source === 'tool' ? { ...base, files: [], patch: '' } : base;
-  const retained = Array.isArray(records) ? records : [];
-  const withLive =
-    live && !retained.some((record) => record?.checkpointId === live.checkpointId) ? [...retained, live] : retained;
-  let inRootKinds = new Set(['tracked']);
-  if (gitBacked) inRootKinds = new Set();
-  else if (source === 'absent' || source === 'unavailable') inRootKinds = new Set(['git', 'tracked']);
-  const baseFiles = Array.isArray(cleared?.files) ? cleared.files : [];
-  const basePatch = typeof cleared?.patch === 'string' ? cleared.patch : '';
   const baseRoot = clean(base?.root);
-  const known = new Set();
-  for (const file of baseFiles) {
-    if (file?.path) known.add(absoluteKey(baseRoot, file.path));
-    if (file?.oldPath) known.add(absoluteKey(baseRoot, file.oldPath));
-  }
-  const chains = recordChains(withLive, { inRootKinds }).filter((chain) => !known.has(chain.key));
-  // A relative name shared by different roots (or with a baseline file) is
-  // shown absolute, so each file stays distinct.
+  const covered = (abs) => gitBacked && Boolean(baseRoot) && insideDirectory(baseRoot, abs);
+  const listed = new Set((baselines?.files || []).map((entry) => entry.key));
+  let kinds = new Set(['tracked']);
+  if (gitBacked) kinds = new Set();
+  else if (source === 'absent' || source === 'unavailable') kinds = new Set(['git', 'tracked']);
+  // Baselines nothing is listed for, yet whose emptiness cannot be vouched for.
+  const unvouched = new Set();
+  const measured = baselines ? await baselineChanges(baselines, covered, unvouched) : [];
+  const legacy = await legacyChanges(Array.isArray(records) ? records : [], {
+    kinds,
+    listed,
+    covered,
+    since: Number(baselines?.createdAt) || Number.POSITIVE_INFINITY,
+  });
+  for (const change of legacy.changes) listed.add(change.key);
+  // Owned files of the non-Git root, and paths whose first state a clear in
+  // another process removed (the baselines are incomplete for them).
+  const refs = (baselines?.missing || []).map((entry) => ({ root: entry.root, abs: entry.path }));
+  if (!gitBacked && Array.isArray(owned)) {
+    for (const path of owned) refs.push({ root: baseRoot, abs: absolutePath(baseRoot, path) });
+  }
+  const missing = await missingChanges(refs, { listed, covered });
+  for (const change of measured) {
+    if (legacy.late.has(change.key)) change.change = { ...change.change, partial: true, reason: SEVERAL_TURNS_REASON };
+  }
+  const changes = [...measured, ...legacy.changes, ...missing.filter((file) => file.change)];
+  const baseFiles = gitBacked && Array.isArray(base.files) ? base.files : [];
+  const basePatch = gitBacked && typeof base.patch === 'string' ? base.patch : '';
+  // A relative name shared by different roots (or with a Git file) is shown
+  // absolute, so each file stays distinct.
+  const nameOf = (abs, root) => (root && insideDirectory(root, abs) ? slashPath(relative(root, abs)) : slashPath(abs));
   const owners = new Map();
-  const claim = (rel, key) => {
-    const name = changePathKey(rel);
-    owners.set(name, new Set([...(owners.get(name) || []), key]));
+  const claim = (name, abs) => {
+    if (isOutsidePath(name)) return;
+    const key = changePathKey(name);
+    owners.set(key, new Set([...(owners.get(key) || []), changePathKey(abs)]));
   };
-  for (const file of baseFiles) if (file?.path) claim(file.path, absoluteKey(baseRoot, file.path));
-  for (const chain of chains) {
-    const entry = chain.entries.at(-1);
-    claim(entry.file.path, chain.key);
-    const origin = chain.entries[0];
-    if (origin.file.oldPath) claim(origin.file.oldPath, absoluteKey(origin.root, origin.file.oldPath));
-  }
-  const show = (root, rel) =>
-    isOutsidePath(rel) || (owners.get(changePathKey(rel))?.size || 0) <= 1
-      ? slashPath(rel)
-      : slashPath(resolve(root, rel));
-  const nets = [];
-  for (const chain of chains) {
-    const net = await netChain(chain, show);
-    if (net) nets.push(net);
-  }
-  const { source: _source, reason: unavailableReason, ...kept } = cleared || {};
-  const complete = knownSources.has(source) || withLive.length > 0;
-  if (nets.length === 0) {
-    // Nothing recorded to add: the baseline answer stands (an unavailable
-    // baseline stays unavailable, never an invented empty set).
-    if (cleared?.supported === false) return { ...kept, reason: unavailableReason };
-    return { ...kept, ...(complete ? { complete: true } : {}) };
+  for (const file of baseFiles) if (file?.path) claim(file.path, resolve(baseRoot, file.path));
+  for (const change of changes) {
+    claim(nameOf(change.abs, change.root), change.abs);
+    if (change.oldAbs) claim(nameOf(change.oldAbs, change.oldRoot), change.oldAbs);
   }
+  const show = (abs, root) => {
+    const name = nameOf(abs, root);
+    return isOutsidePath(name) || (owners.get(changePathKey(name))?.size || 0) <= 1 ? name : slashPath(abs);
+  };
+  const rows = changes
+    .map(({ abs, root, oldAbs, oldRoot, change }) => {
+      const path = show(abs, root);
+      const oldName = oldAbs ? show(oldAbs, oldRoot) : path;
+      let patch = '';
+      if (change.text) patch = nameMeasuredPatch(change.text, oldName, path);
+      else if (change.recordPatch && change.recordName === path) patch = change.recordPatch;
+      let patchOmitted = change.patchOmitted === true;
+      if (Buffer.byteLength(patch, 'utf8') > MERGED_PATCH_MAX_BYTES) {
+        patch = '';
+        patchOmitted = true;
+      }
+      return {
+        path,
+        id: slashPath(abs),
+        outside: !(root && insideDirectory(root, abs)),
+        ...(oldName !== path ? { oldPath: oldName } : {}),
+        status: change.status,
+        additions: change.additions,
+        deletions: change.deletions,
+        ...(change.binary ? { binary: true } : {}),
+        ...(change.reason ? { reason: change.reason } : {}),
+        ...(change.baseline ? { baseline: change.baseline } : {}),
+        ...(change.unmeasured ? { unmeasured: true } : {}),
+        ...(patchOmitted ? { patchOmitted: true } : {}),
+        patch,
+      };
+    })
+    .sort((left, right) => {
+      if (left.path === right.path) return 0;
+      return left.path < right.path ? -1 : 1;
+    });
   // The merged response stays bounded: past the budget a file is listed
   // without its diff.
   let budget = MERGED_PATCH_MAX_BYTES - Buffer.byteLength(basePatch, 'utf8');
   let truncated = false;
   const files = [];
   const patches = [];
-  for (const { patch, ...file } of nets) {
-    const size = patch ? Buffer.byteLength(patch, 'utf8') : 0;
+  for (const { patch, ...file } of rows) {
+    const size = Buffer.byteLength(patch, 'utf8');
     if (patch && size <= budget) {
       budget -= size;
       patches.push(patch);
     } else if (patch) {
       truncated = true;
-      files.push({ ...file, patchOmitted: true });
-      continue;
+      file.patchOmitted = true;
     }
     files.push(file);
   }
+  // A baseline first seen after an older recorded edit (`late`) was not the
+  // session's first state: even with no row it cannot vouch for the set.
+  // Baselines the disk refused (`unsaved`) are known only to this process.
+  const partial =
+    baselines?.incomplete === true ||
+    baselines?.unsaved === true ||
+    unvouched.size > 0 ||
+    legacy.late.size > 0 ||
+    missing.length > 0 ||
+    changes.some((change) => change.change.partial === true);
+  const vouched = (gitBacked || source === 'empty' || Boolean(baselines)) && !partial;
+  const all = [...baseFiles, ...files];
+  // An unavailable Git baseline with nothing else to list stays unavailable.
+  if (all.length === 0 && !vouched && kept.supported === false) return { ...kept, reason: unavailableReason };
   return {
     ...kept,
     supported: true,
-    authoritative: true,
-    complete,
-    files: [...baseFiles, ...files],
+    // Emptiness is claimed only when it can be vouched for.
+    authoritative: all.length > 0 || vouched,
+    ...(vouched ? { complete: true } : {}),
+    ...(partial ? { partial: true } : {}),
+    ...(baselines?.unsaved === true ? { baselinesUnsaved: true } : {}),
+    files: all,
     patch: [basePatch, ...patches].filter(Boolean).join(basePatch.endsWith('\n') || !basePatch ? '' : '\n'),
-    patchTruncated: kept.patchTruncated === true || truncated,
-    snapshotKind: cleared?.snapshotKind || 'session',
+    patchTruncated: (gitBacked && kept.patchTruncated === true) || truncated,
+    snapshotKind: kept.snapshotKind || 'session',
   };
 }