simt-dev 0.7.1 → 0.8.0

package/src/index/store.mjs

@@ -8,10 +8,16 @@ import { execFile, spawn } from 'node:child_process';
 import { stat } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
 
+import { git as gitRaw } from '../sys/git.mjs';
+
 import { readManifest } from '../projection/manifest.mjs';
 import { readLocalConfig } from '../local/config.mjs';
 import { localEmbed } from '../local/client.mjs';
 import { extract, resolveImports } from './extract.mjs';
+// Q70: the extension-to-language map is the records' `languages[]` (ADR-013). `canonical`
+// names the extensions that RESOLVE to a language (JavaScript claims `.ts` for extraction
+// but not for resolution), so a record's extraction and resolution cannot desynchronize.
+import { languageResolver } from '../ecosystem/records.mjs';
 import {
   FTS_SCHEMA,
   FTS_TRI_SCHEMA,
@@ -34,24 +40,32 @@ export { JSONL_FILE, SQLITE_FILE, decodeVectorBlob, encodeVectorBlob };
 
 const MARKERS = ['package.json', 'pyproject.toml', 'go.mod', 'Cargo.toml', 'pom.xml'];
 
-const LANG = {
-  js: 'javascript', mjs: 'javascript', cjs: 'javascript', jsx: 'javascript',
-  ts: 'typescript', tsx: 'typescript', kt: 'kotlin', kts: 'kotlin', java: 'java',
-  py: 'python', go: 'go', rs: 'rust', swift: 'swift', dart: 'dart', rb: 'ruby', cs: 'csharp',
-};
+// A tracked blob larger than this is recorded with its size and counted in
+// `skipped`, not streamed and tokenized: a 65 MiB file is indexed as a row, and
+// tokenizing it would buy nothing (Q76). The cap sits under that file on purpose
+// so the 65 MiB test exercises the skip, not the tokenize path.
+const BLOB_CAP = 16 * 1024 * 1024;
+
+const LANG = languageResolver();
 
 /** `sqlite` when this process can open a database and create an FTS5 table. */
+// Probed once per process: the check builds both FTS schemas in a memory
+// database, and every read path used to pay for that (Q76).
+let backendProbe;
 async function probeBackend() {
-  try {
-    const { DatabaseSync } = await import('node:sqlite');
-    const db = new DatabaseSync(':memory:');
-    db.exec(FTS_SCHEMA);
-    db.exec(FTS_TRI_SCHEMA);
-    db.close();
-    return 'sqlite';
-  } catch {
-    return 'jsonl';
-  }
+  backendProbe ??= (async () => {
+    try {
+      const { DatabaseSync } = await import('node:sqlite');
+      const db = new DatabaseSync(':memory:');
+      db.exec(FTS_SCHEMA);
+      db.exec(FTS_TRI_SCHEMA);
+      db.close();
+      return 'sqlite';
+    } catch {
+      return 'jsonl';
+    }
+  })();
+  return backendProbe;
 }
 
 export function ftsKindOf(filePath, lang = '') {
@@ -224,7 +238,10 @@ export async function reindex(root, opts = {}) {
     changed.push(entry);
   }
   const sizes = await blobSizes(root, changed.map((entry) => entry.blob));
-  const texts = await blobTexts(root, changed.map((entry) => entry.blob));
+  // Over-cap blobs are recorded with their size and counted in `skipped`, not
+  // streamed and tokenized: their row is written, their text is never read.
+  const textBlobs = changed.map((entry) => entry.blob).filter((blob) => (sizes.get(blob) ?? 0) <= BLOB_CAP);
+  const texts = await blobTexts(root, textBlobs);
   const adapter = await resolveAdapter(root, opts);
   const paths = new Set(listed.map((entry) => entry.path));
   const next = [];
@@ -383,7 +400,14 @@ function withReadError(rows, error) {
 export async function readFiles(root, opts = {}) {
   const backend = opts.backend ?? await probeBackend();
   if (backend === 'sqlite') {
-    const { rows, error } = await readSqliteRows(root, 'select path, blob, lang, bytes, pkg from files order by path');
+    // The v5 layout keys files as `sources` rows; the git blob sha is `revision`
+    // and the package directory rides in `props`, which the v4 `files` table
+    // named `pkg`.
+    const { rows, error } = await readSqliteRows(
+      root,
+      `select s.path as path, s.revision as blob, s.lang as lang, s.bytes as bytes,
+        json_extract(s.props, '$.pkg') as pkg from sources s where s.kind = 'blob' order by s.path`,
+    );
     return withReadError(rows, error);
   }
   const { rows, error } = await readJsonl(root, 'files');
@@ -394,7 +418,14 @@ export async function readFiles(root, opts = {}) {
 export async function readSymbols(root, opts = {}) {
   const backend = opts.backend ?? await probeBackend();
   if (backend === 'sqlite') {
-    const { rows, error } = await readSqliteRows(root, 'select path, name, kind, line, sig, exported from symbols order by path, line, name, kind');
+    const { rows, error } = await readSqliteRows(
+      root,
+      `select s.path as path, n.name as name, json_extract(n.props, '$.kind') as kind,
+        n.line as line, json_extract(n.props, '$.sig') as sig,
+        json_extract(n.props, '$.exported') as exported
+        from nodes n join sources s on s.id = n.source_id and s.kind = 'blob'
+        where n.kind = 'symbol' order by s.path, n.line, n.name, n.kind`,
+    );
     return withReadError(rows, error);
   }
   const { rows, error } = await readJsonl(root, 'symbols');
@@ -405,7 +436,14 @@ export async function readSymbols(root, opts = {}) {
 export async function readEdges(root, opts = {}) {
   const backend = opts.backend ?? await probeBackend();
   if (backend === 'sqlite') {
-    const { rows, error } = await readSqliteRows(root, 'select src, dst, kind, weight from edges order by src, dst, kind');
+    // Paths come back from the node key (`file:<path>`) and the stable `dst_key`:
+    // node ids are regenerated when a file changes, so a path is the only key
+    // that survives a reindex of one endpoint.
+    const { rows, error } = await readSqliteRows(
+      root,
+      `select substr(ns.key, 6) as src, e.dst_key as dst, e.kind as kind, e.weight as weight
+        from edges e join nodes ns on ns.id = e.src_id order by src, dst, kind`,
+    );
     return withReadError(rows, error);
   }
   const { rows, error } = await readJsonl(root, 'edges');
@@ -416,7 +454,11 @@ export async function readEdges(root, opts = {}) {
 export async function readFts(root, opts = {}) {
   const backend = opts.backend ?? await probeBackend();
   if (backend === 'sqlite') {
-    const { rows, error } = await readSqliteRows(root, 'select kind, ref, body from fts order by ref, kind, rowid');
+    const { rows, error } = await readSqliteRows(
+      root,
+      `select f.kind as kind, substr(n.key, 6) as ref, f.body as body
+        from fts f join nodes n on n.id = f.node_id order by ref, kind, f.rowid`,
+    );
     return withReadError(rows, error);
   }
   const { rows, error } = await readJsonl(root, 'fts');
@@ -427,7 +469,12 @@ export async function readFts(root, opts = {}) {
 export async function readEmbeddings(root, opts = {}) {
   const backend = opts.backend ?? await probeBackend();
   if (backend === 'sqlite') {
-    const { rows: raw, error } = await readSqliteRows(root, 'select path, blob, model, dims, vec from embeddings order by path');
+    const { rows: raw, error } = await readSqliteRows(
+      root,
+      `select substr(n.key, 6) as path, s.revision as blob, v.model as model, v.dims as dims, v.vec as vec
+        from vectors v join nodes n on n.id = v.node_id
+        join sources s on s.id = n.source_id and s.kind = 'blob' order by path`,
+    );
     const rows = raw.map((row) => {
       const vec = decodeVectorBlob(row.vec);
       return {
@@ -500,11 +547,15 @@ export async function searchFtsBm25(root, task, opts = {}) {
 async function ftsBranch(root, table, terms) {
   if (terms.length === 0) return { rows: [], error: null };
   const matchExpr = terms.map((t) => `"${t}"`).join(' OR ');
-  const { rows, error } = await readSqliteRows(
-    root,
-    `select kind, ref as path, -bm25(${table}) as score from ${table} where ${table} match ? order by score desc, path asc limit ?`,
-    [matchExpr, FTS_LIMIT],
-  );
+  // `fts` is the v5 node-keyed table: the path comes back through the node key.
+  // `fts_tri` keeps its v4 (kind, ref, body) shape for the CJK trigram path (Q43),
+  // so it is queried the old way.
+  const sql = table === 'fts'
+    ? `select f.kind as kind, substr(n.key, 6) as path, -bm25(f) as score
+       from fts f join nodes n on n.id = f.node_id
+       where f match ? order by score desc, path asc limit ?`
+    : `select kind, ref as path, -bm25(${table}) as score from ${table} where ${table} match ? order by score desc, path asc limit ?`;
+  const { rows, error } = await readSqliteRows(root, sql, [matchExpr, FTS_LIMIT]);
   return {
     rows: rows.map((row) => ({ kind: row.kind, path: row.path, score: Number(row.score) || 0 })),
     error,
@@ -590,20 +641,10 @@ export async function packageOf(root, filePath, cache) {
   }
 }
 
-function git(root, args, input) {
-  return new Promise((resolve, reject) => {
-    const child = execFile('git', args, { cwd: root, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 }, (error, stdout, stderr) => {
-      if (error) reject(Object.assign(error, { stdout, stderr }));
-      else resolve(stdout);
-    });
-    if (input !== undefined) {
-      child.stdin.end(input);
-    }
-  });
-}
+
 
 async function lsFiles(root) {
-  const stdout = await git(root, ['ls-files', '-s', '-z']);
+  const stdout = await gitRaw(root, ['ls-files', '-s', '-z']);
   const rows = [];
   for (const rec of stdout.split('\0')) {
     if (rec === '') continue;
@@ -738,7 +779,9 @@ async function blobSizes(root, blobs) {
   const unique = [...new Set(blobs)];
   const sizes = new Map();
   if (unique.length === 0) return sizes;
-  const stdout = await git(root, ['cat-file', '--batch-check=%(objectname) %(objectsize)'], `${unique.join('\n')}\n`);
+  const stdout = await gitRaw(root, ['cat-file', '--batch-check=%(objectname) %(objectsize)'], {
+    input: `${unique.join('\n')}\n`,
+  });
   for (const line of stdout.split('\n')) {
     if (line === '') continue;
     const sp = line.indexOf(' ');

package/src/index/tests.mjs

@@ -6,8 +6,9 @@
 // the tree is not a guess. Co-change is a different kind: files that land in
 // the same commit are not, by that fact, a test.
 
-import { isTestPath } from '../bench/mine.mjs';
+import { isTestPath } from '../testing/paths.mjs';
 import { extract, resolveImports } from './extract.mjs';
+import { cmp } from '../util/sort.mjs';
 
 export { scriptSpecifiers } from './extract.mjs';
 
@@ -251,11 +252,6 @@ function byEdge(a, b) {
   return cmp(a.kind, b.kind) || cmp(a.src, b.src) || cmp(a.dst, b.dst);
 }
 
-function cmp(a, b) {
-  if (a < b) return -1;
-  if (a > b) return 1;
-  return 0;
-}
 
 /** Imports in a file, resolved against the tracked tree. One path now: `extract`
  * reads scripts with `scriptSpecifiers`, so gate, impact and the index agree on

package/src/journal.mjs

@@ -41,17 +41,15 @@
 // a second `undo` naturally targets the set before it, and the untouched-check
 // refuses when the two sets overlap on a file the first undo already restored.
 
-import { execFile } from 'node:child_process';
 import { createHash } from 'node:crypto';
 import { chmod, cp, mkdir, readFile, readdir, rename, rmdir, stat, unlink, writeFile } from 'node:fs/promises';
 import { dirname, join, relative, sep } from 'node:path';
-import { promisify } from 'node:util';
 
+import { noteEvent } from './state/events.mjs';
 import { STATE_DIR } from './name.mjs';
 import { LOCAL_DIR } from './state.mjs';
 import { HOOKS_DIR } from './hooks/shim.mjs';
-
-const exec = promisify(execFile);
+import { git, gitText } from './sys/git.mjs';
 
 const JOURNAL_DIR = join(LOCAL_DIR, 'journal');
 const JOURNAL_DIR_LEGACY = '.simt/journal';
@@ -222,8 +220,7 @@ export async function journaledRemoveFile(root, acc, path) {
 /** Read one git config value in a repo, or null when unset. */
 export async function readGitValue(root, key) {
   try {
-    const { stdout } = await exec('git', ['config', '--get', key], { cwd: root });
-    return stdout.replace(/\n$/, '');
+    return await gitText(root, ['config', '--get', key]);
   } catch (error) {
     if (error.code === 1) return null;
     throw error;
@@ -246,9 +243,9 @@ export async function journaledGitConfig(root, acc, key, value) {
   const before = await readGitValue(root, key);
   if (before === value) return null;
   if (value === null) {
-    await exec('git', ['config', '--unset', key], { cwd: root });
+    await git(root, ['config', '--unset', key]);
   } else {
-    await exec('git', ['config', key, value], { cwd: root });
+    await git(root, ['config', key, value]);
   }
   const entry = { kind: 'git-config', key, before, after: value };
   acc.push(entry);
@@ -407,6 +404,14 @@ export async function commitJournal(root, command, acc, { at = Date.now() } = {}
   const tmp = join(dir, `${id}.tmp-${process.pid}`);
   await writeFile(tmp, body, 'utf8');
   await rename(tmp, join(dir, id));
+  // The log is the record; the journal set is what `undo` restores from. Written after the
+  // set, so the event describes what landed rather than what was intended (Q73).
+  await noteEvent(root, {
+    kind: 'write.committed',
+    subject: command,
+    tree: null,
+    data: { entries: entries.length, paths: entries.map((entry) => entry.path) },
+  });
   return id;
 }
 
@@ -528,9 +533,7 @@ function entryBytes(entry) {
 /** Restore one entry: bytes and permission bits for files, the value for config. */
 async function restoreEntry(root, entry) {
   if (entry.kind === 'git-config') {
-    await exec('git', entry.before === null ? ['config', '--unset', entry.key] : ['config', entry.key, entry.before], {
-      cwd: root,
-    });
+    await git(root, entry.before === null ? ['config', '--unset', entry.key] : ['config', entry.key, entry.before]);
     return;
   }
   const abs = join(root, entry.path);
@@ -610,5 +613,7 @@ export async function undoLastJournalSet(root) {
   const [id] = await listJournalSets(root);
   if (!id) return { empty: true };
   const result = await undoJournalSet(root, id);
+  // The set is gone from disk, so the log is now the only record it existed (Q73).
+  await noteEvent(root, { kind: 'write.undone', subject: id, data: { restored: result?.restored?.length ?? 0 } });
   return { set: id, ...result };
 }

package/src/kernel/card.mjs

@@ -22,7 +22,7 @@
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 
-import { ECOSYSTEMS } from '../projection/manifest.mjs';
+import { cardBuilds, cardFocused, cardFallbacks, ecosystemGateRows, evalTemplate, matches } from '../ecosystem/records.mjs';
 import { resolveNodeRunner, runScript } from '../ecosystem/node-runner.mjs';
 
 /**
@@ -53,59 +53,35 @@ const VERBS = CARD_VERBS;
 const DROP_ORDER = ['format', 'typecheck', 'lint', 'build'];
 
 /**
- * Build commands for ecosystems whose build entrypoint is not a package script. Keyed by
- * a marker fact or stack tag, whichever the ecosystem is identified by. `npm` is handled
- * before this table, because a Node repository states its own build script and stating it
- * again here would be a second answer to the same question.
+ * Build commands for ecosystems whose build entrypoint is not a package script. The rows are
+ * the records' `card.build` facet, in first-match-wins order; `npm` is handled before this
+ * table, because a Node repository states its own build script and stating it again here
+ * would be a second answer to the same question.
  */
-const BUILDS = [
-  { fact: 'has-cargo-toml', command: 'cargo build' },
-  { fact: 'has-go-mod', command: 'go build ./...' },
-  { fact: 'has-nuget', command: 'dotnet build' },
-  { fact: 'has-swift-package', command: 'swift build' },
-  { fact: 'has-mix', command: 'mix compile' },
-  { stack: 'gradle', command: './gradlew build' },
-];
+function buildRows(root) {
+  return cardBuilds(root);
+}
 
 /**
- * One focused-test template per path kind. Entries are ordered, and the FIRST match wins,
- * so a repository that carries more than one marker gets the more specific template:
- * `has-uv-lock` before `has-pyproject`, `has-android-manifest` before the plain `gradle`
- * tag, `has-deno-config` before the Node fallback. A duplicate template for the same path
- * kind would be two answers, and the second is the wrong one.
+ * One focused-test template per path kind. The rows are the records' `card.focused` facet,
+ * in first-match-wins order: a repository that carries more than one marker gets the more
+ * specific template — `has-uv-lock` before `has-pyproject`, `has-android-manifest` before
+ * the plain `gradle` tag, `has-deno-config` before the Node fallback. A duplicate template
+ * for the same path kind would be two answers, and the second is the wrong one.
+ *
+ * The Node row is the one whose shape depends on the repo's own runner: a repository whose
+ * test script is vitest or jest takes a file argument through the script; one with no such
+ * script gets the built-in runner, which is the only answer that needs nothing installed to
+ * already be true. `<manager> test -- <file>` is the ADR-010 shape (never `npx`) — that
+ * choice is the template's `dynamic` form in the record, resolved by `evalTemplate`.
  */
-const FOCUSED = [
-  { kind: 'Android', when: (s, f) => f.has('has-android-manifest'), template: () => './gradlew :{module}:testDebugUnitTest --tests {class}' },
-  { kind: 'JVM', when: (s) => s.has('gradle'), template: () => './gradlew test --tests {class}' },
-  { kind: 'Maven', when: (s, f) => f.has('has-maven-pom'), template: () => './mvnw test -Dtest={class}' },
-  { kind: 'Go package', when: (s, f) => f.has('has-go-mod'), template: () => 'go test ./{pkg} -run {Test}' },
-  { kind: 'Rust', when: (s, f) => f.has('has-cargo-toml'), template: () => 'cargo test {name}' },
-  { kind: 'Python', when: (s, f) => f.has('has-uv-lock'), template: () => 'uv run -m pytest {file}::{test}' },
-  { kind: 'Python', when: (s, f) => f.has('has-pyproject') || f.has('has-requirements'), template: () => 'pytest {file}::{test}' },
-  { kind: '.NET', when: (s, f) => f.has('has-nuget'), template: () => 'dotnet test --filter {test}' },
-  { kind: 'Swift', when: (s, f) => f.has('has-swift-package'), template: () => 'swift test --filter {test}' },
-  { kind: 'Deno', when: (s, f) => f.has('has-deno-config'), template: () => 'deno test {file}' },
-  { kind: 'Ruby', when: (s, f) => f.has('has-gemfile'), template: () => 'bundle exec rspec {file}' },
-  { kind: 'Dart', when: (s, f) => f.has('has-pubspec'), template: () => 'dart test {file}' },
-  { kind: 'Elixir', when: (s, f) => f.has('has-mix'), template: () => 'mix test {file}' },
-  {
-    kind: 'Node',
-    when: (s) => s.has('node'),
-    // The repo's own runner decides the shape. A repository whose test script is vitest
-    // or jest takes a file argument through the script; one with no such script gets the
-    // built-in runner, which is the only answer that needs nothing installed to already
-    // be true. `<manager> test -- <file>` is the ADR-010 shape (never `npx`).
-    template: (s, f, scripts, runner) => {
-      const test = scripts?.test ?? '';
-      if (!/vitest|jest/.test(test)) return 'node --test {file}';
-      const run = runner?.run ?? 'npm';
-      return `${run} test -- {file}`;
-    },
-  },
-];
+function focusedRows(root) {
+  return cardFocused(root);
+}
 
 /**
- * Verbs for ecosystems the gate table does not seed, used by the card alone.
+ * Verbs for ecosystems the gate table does not seed, used by the card alone. The rows are
+ * the records' `card.fallback` facet.
  *
  * Python is the case, and it is not an oversight that the tool seeds no Python gate: the
  * runner genuinely varies (uv, poetry, tox, nox, a project wrapper), so a seeded gate would
@@ -116,10 +92,9 @@ const FOCUSED = [
  * test. Without a lockfile the card names the plain runner, which is what the python
  * profile assumes when it says "no `pytest.skip`".
  */
-const CARD_FALLBACKS = [
-  { when: (s, f) => f.has('has-uv-lock'), commands: { test: 'uv run -m pytest' } },
-  { when: (s, f) => f.has('has-pyproject') || f.has('has-requirements'), commands: { test: 'pytest' } },
-];
+function fallbackRows(root) {
+  return cardFallbacks(root);
+}
 
 /** A non-empty string, or null. Guards JSON that is present but not a command. */
 function text(value) {
@@ -165,7 +140,7 @@ async function readScripts(root) {
  * repository has declared nothing. The last is the same table the tool seeds gates from,
  * so the card and the gate list cannot name two different commands for one repository.
  */
-function resolveVerb(verb, { manifest, facts, stack, scripts, runner }) {
+function resolveVerb(verb, { manifest, facts, stack, scripts, runner, root }) {
   const declared = text(manifest?.gates?.commands?.[verb]);
   if (declared) return declared;
 
@@ -179,20 +154,19 @@ function resolveVerb(verb, { manifest, facts, stack, scripts, runner }) {
 
   if (verb === 'build') {
     if (text(scripts?.build)) return runScript(runner?.id ?? 'npm', 'build');
-    for (const row of BUILDS) {
-      if (row.fact && facts.has(row.fact)) return row.command;
-      if (row.stack && stack.has(row.stack)) return row.command;
+    for (const row of buildRows(root)) {
+      if (matches(row.condition, { facts, stack })) return row.command;
     }
     return null;
   }
 
-  for (const eco of ECOSYSTEMS) {
+  for (const eco of ecosystemGateRows(root)) {
     if (!facts.has(eco.fact)) continue;
     const command = text(eco.commands?.[verb]);
     if (command) return command;
   }
-  for (const row of CARD_FALLBACKS) {
-    if (!row.when(stack, facts, scripts)) continue;
+  for (const row of fallbackRows(root)) {
+    if (!matches(row.condition, { facts, stack })) continue;
     const command = text(row.commands?.[verb]);
     if (command) return command;
   }
@@ -246,17 +220,17 @@ export async function commandCard({ root, manifest = null, stack = [], facts = [
 
   const lines = [];
   for (const verb of VERBS) {
-    const command = resolveVerb(verb, { manifest, facts: factSet, stack: stackSet, scripts, runner: effective });
+    const command = resolveVerb(verb, { manifest, facts: factSet, stack: stackSet, scripts, runner: effective, root });
     if (command) lines.push({ label: verb, command, verb });
   }
-  for (const entry of FOCUSED) {
-    if (!entry.when(stackSet, factSet, scripts)) continue;
+  for (const entry of focusedRows(root)) {
+    if (!matches(entry.condition, { facts: factSet, stack: stackSet })) continue;
     // One template per path kind: `has-uv-lock` and `has-pyproject` both match a uv repo,
     // and two Python lines would be two answers with the second one wrong.
     if (lines.some((l) => l.kind === entry.kind)) continue;
     lines.push({
       label: `focused test (${entry.kind})`,
-      command: entry.template(stackSet, factSet, scripts, effective),
+      command: evalTemplate(entry.template, { scripts, runner: effective }),
       kind: entry.kind,
       verb: 'focused',
     });

package/src/kernel/checks.mjs

@@ -9,14 +9,11 @@
 // index has the edges (R21). A direction still has to be named before the prose
 // can leave, or the line would say Enforced and nothing would be enforcing it.
 
-import { execFile } from 'node:child_process';
 import { readFile, stat } from 'node:fs/promises';
 import { relative, resolve, sep } from 'node:path';
-import { promisify } from 'node:util';
 
 import { CLI } from '../name.mjs';
-
-const exec = promisify(execFile);
+import { git, gitPaths } from '../sys/git.mjs';
 
 export const CHECK_MARKER = 'simt-check';
 
@@ -360,8 +357,7 @@ function exempt(rel, prefixes) {
 
 async function tracked(root) {
   try {
-    const { stdout } = await exec('git', ['ls-files', '-z'], { cwd: root });
-    return stdout.split('\0').filter((p) => p !== '');
+    return await gitPaths(root, ['ls-files']);
   } catch {
     return null;
   }
@@ -370,8 +366,7 @@ async function tracked(root) {
 async function workDiff(root) {
   let text = '';
   try {
-    const { stdout } = await exec('git', ['diff', '--no-ext-diff', '--unified=0', 'HEAD'], { cwd: root, maxBuffer: 8 * 1024 * 1024 });
-    text = stdout;
+    text = await git(root, ['diff', '--no-ext-diff', '--unified=0', 'HEAD'], { maxBuffer: 8 * 1024 * 1024 });
   } catch (error) {
     if (error.code === 'ENOENT') return null;
     text = typeof error.stdout === 'string' ? error.stdout : '';
@@ -379,8 +374,7 @@ async function workDiff(root) {
   const files = parseDiff(text);
   let untracked = [];
   try {
-    const { stdout } = await exec('git', ['ls-files', '--others', '--exclude-standard', '-z'], { cwd: root });
-    untracked = stdout.split('\0').filter((p) => p !== '');
+    untracked = await gitPaths(root, ['ls-files', '--others', '--exclude-standard']);
   } catch {
     return { files };
   }

package/src/lease.mjs

@@ -25,7 +25,7 @@ export const LEASE_FILE = localRel('leases.json');
 const LEASE_FILE_LEGACY = '.simt/leases.json';
 
 /** The schema the file is written with; a reader that does not know it refuses. */
-const LEASE_SCHEMA = 1;
+const LEASE_SCHEMA = 2;
 
 /**
  * How long a claim lives when the caller does not say.
@@ -35,6 +35,89 @@ const LEASE_SCHEMA = 1;
  */
 export const DEFAULT_TTL_SECONDS = 3600;
 
+/**
+ * A v1 record in the v2 shape.
+ *
+ * v1 stored `{path, session, harness, expiresAt}`; v2 stores a resource, a holder, a
+ * fencing token and an acquisition time (Q74). The reader accepts both because a claim
+ * file written by the previous release is still a claim the hook must honour, and
+ * refusing it would silently un-lease every held path on upgrade.
+ */
+export function toV2(entry) {
+  if (entry !== null && typeof entry === 'object' && entry.resource !== undefined && entry.holder !== undefined) {
+    return entry;
+  }
+  // `...entry` keeps the fields a caller put on its own claim - a slice claim carries
+  // `kind: 'slice'` and the slice id - which the schema does not name but must not drop.
+  return {
+    ...entry,
+    resource: { kind: 'path', id: entry.path },
+    holder: { session: entry.session, harness: entry.harness ?? null },
+    fence: Number.isInteger(entry.fence) ? entry.fence : 1,
+    acquiredAt: typeof entry.acquiredAt === 'number' ? entry.acquiredAt : null,
+    expiresAt: entry.expiresAt,
+  };
+}
+
+/**
+ * The v2 record flattened into the fields every reader of this tool already uses.
+ *
+ * Keeping `path`, `session`, `harness` and `expiresAt` on the in-memory entry is not
+ * backwards compatibility theatre: the hook, the command and four call sites compare
+ * those fields, and rewriting all of them to reach through `resource.id` would be a
+ * second change riding on a schema change.
+ */
+export function flattenLease(entry) {
+  const v2 = toV2(entry);
+  return {
+    ...v2,
+    path: v2.resource.id,
+    session: v2.holder.session,
+    harness: v2.holder.harness ?? null,
+    expiresAt: v2.expiresAt,
+  };
+}
+
+/** A record that is worth honouring, or null. A bad expiry would hold a path forever. */
+function normaliseLease(entry) {
+  if (entry === null || typeof entry !== 'object') return null;
+  const v2 = entry.resource !== undefined ? entry : toV2(entry);
+  const id = v2?.resource?.id;
+  const session = v2?.holder?.session;
+  if (typeof id !== 'string' || typeof session !== 'string' || !Number.isFinite(v2.expiresAt)) return null;
+  if (v2.resource.kind !== 'path' && v2.resource.kind !== 'dir') return null;
+  return flattenLease(v2);
+}
+
+/**
+ * Whether a claim covers a repository-relative path.
+ *
+ * A `dir` claim covers everything under it, which is what makes "this session owns
+ * `src/index/`" one claim instead of forty (Q74). The prefix test includes the separator
+ * so `src/index` does not cover `src/indexer`.
+ */
+export function leaseCovers(lease, rel) {
+  const resource = toV2(lease).resource;
+  if (resource.kind === 'dir') return rel === resource.id || rel.startsWith(`${resource.id}/`);
+  return rel === resource.id;
+}
+
+/**
+ * The store the lease commands read and write through.
+ *
+ * A file today; a remote store and a server clock later (Q74). Everything above this line
+ * is a function of the records, not of the file, so the second implementation changes
+ * where `read` and `write` point and nothing else.
+ */
+export function fileLeaseStore(root) {
+  return {
+    root,
+    read: () => readLeases(root),
+    write: (leases) => writeLeases(root, leases),
+    withLock: (fn) => withLeaseLock(root, fn),
+  };
+}
+
 /**
  * The one spelling a path has for lease matching: repository-relative, symlinks
  * resolved, case-folded when the repository's git compares case-insensitively, or
@@ -105,10 +188,7 @@ export async function readLeases(root) {
     }
     // A malformed entry is dropped rather than trusted: an expiry that is not a number
     // would otherwise live forever, which is the opposite of what a TTL promises.
-    const leases = parsed.leases.filter(
-      (l) => l !== null && typeof l === 'object' && typeof l.path === 'string' &&
-        typeof l.session === 'string' && Number.isFinite(l.expiresAt),
-    );
+    const leases = parsed.leases.map(normaliseLease).filter((l) => l !== null);
     return { path, leases, error: null };
   } catch (error) {
     return { path, leases: [], error: `${LEASE_FILE} is not valid JSON (${error.message})` };
@@ -136,8 +216,23 @@ export function activeLeases({ leases } = { leases: [] }, now = Date.now()) {
  */
 export async function writeLeases(root, leases) {
   const path = join(root, LEASE_FILE);
-  const sorted = [...leases].sort((a, b) => a.path.localeCompare(b.path));
-  const body = `${JSON.stringify({ schemaVersion: LEASE_SCHEMA, leases: sorted }, null, 2)}\n`;
+  // v2 on disk: a resource, a holder and a fence, sorted by resource id so two writes of
+  // the same claims produce the same bytes (Q74).
+  const records = leases
+    .map(toV2)
+    .map((l) => ({
+      // Additive, not a rename: the pre-edit hook, the slice claim and the tests read
+      // `path` and `session` straight off the file, and a v2 writer that stopped writing
+      // them would break every one of those readers at once.
+      ...l,
+      resource: l.resource,
+      holder: { session: l.holder.session, harness: l.holder.harness ?? null },
+      fence: l.fence,
+      acquiredAt: l.acquiredAt,
+      expiresAt: l.expiresAt,
+    }))
+    .sort((a, b) => a.resource.id.localeCompare(b.resource.id));
+  const body = `${JSON.stringify({ schemaVersion: LEASE_SCHEMA, leases: records }, null, 2)}\n`;
   await mkdir(dirname(path), { recursive: true });
   // Atomic against a concurrent writer and a concurrent reader: a half-written
   // claim file fails closed for every edit (review 0003 Q20).