spexcode 0.1.6 → 0.2.1

package/spec-cli/src/gateway.ts

@@ -8,11 +8,13 @@ import https from 'node:https'
 import net from 'node:net'
 import { createHmac, timingSafeEqual } from 'node:crypto'
 import { execFileSync, spawnSync } from 'node:child_process'
-import { readFileSync, existsSync, mkdirSync, writeFileSync } from 'node:fs'
+import { readFileSync, existsSync, mkdirSync, writeFileSync, statSync } from 'node:fs'
+import { gzipSync, createGzip } from 'node:zlib'
 import { join, normalize, extname } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { homedir } from 'node:os'
 import { loginPage } from './login-page.js'
+import { listenOrExit } from './listen.js'
 
 // @@@ resolvePublicConfig - the cert/gate is a RESOLVED value, never hardcoded. Reads the same precedence
 // chain the spec promises: flag > env > spexcode.json > self-signed default. Returns null when public mode
@@ -117,7 +119,7 @@ export function resolveDistDir(): string {
   return join(pkgRoot, '..', 'spec-dashboard', 'dist')
 }
 
-export type GatewayOpts = { publicPort: number; upstreamPort: number; password: string; tls: { cert: string; key: string } | null; distDir: string; host?: string; label?: string }
+export type GatewayOpts = { publicPort: number; upstreamPort: number; password: string; tls: { cert: string; key: string } | null; distDir: string; host?: string; label?: string; onBindFail?: () => void }
 
 export function startGateway(opts: GatewayOpts): void {
   // gated ONLY when a password is set; otherwise the login layer doesn't exist and the dashboard is served open.
@@ -144,10 +146,18 @@ export function startGateway(opts: GatewayOpts): void {
       }
     }
     if (url.startsWith('/api')) return proxyHttp(req, res, opts.upstreamPort)
-    return serveStatic(res, opts.distDir, url)
+    return serveStatic(req, res, opts.distDir, url)
   }
 
-  const server = secure ? https.createServer({ cert: opts.tls!.cert, key: opts.tls!.key }, handler) : http.createServer(handler)
+  // server-side connection reaping ([[spec-cli]] / [[public-mode]]) - the internet-facing gateway is the
+  // public server in public mode, so it carries the SAME reaping as the child: an abandoned/slow connection
+  // dies here instead of piling up. Idle keep-alive / slow-header / never-completing request only; the gated
+  // WS upgrade (handled below) is an active connection, not reaped by these. Set AT CONSTRUCTION so the
+  // connection-checking sweep is armed with our cadence (a post-hoc set leaves it under-effective).
+  const reap = { keepAliveTimeout: 10000, headersTimeout: 20000, requestTimeout: 60000, connectionsCheckingInterval: 10000 }
+  const server = secure
+    ? https.createServer({ cert: opts.tls!.cert, key: opts.tls!.key, ...reap }, handler)
+    : http.createServer(reap, handler)
 
   // @@@ WS gate - the terminal socket rides an HTTP upgrade. Gate it by the SAME cookie (the browser sends
   // it on the same-origin handshake), then raw-pipe to the loopback supervisor, replaying the buffered
@@ -163,18 +173,21 @@ export function startGateway(opts: GatewayOpts): void {
     socket.on('error', bail); up.on('error', bail)
   })
 
-  // `spex dashboard` passes an explicit loopback host; `--public` passes none → bind ALL interfaces (the
-  // original behaviour, IPv4+IPv6), so adding the local path never narrows the public gateway's reach.
-  const isLocal = !!opts.host
+  // `spex dashboard` passes an explicit host (loopback by default, --host to widen); `--public` passes
+  // none → bind ALL interfaces (the original behaviour, IPv4+IPv6), so adding the local path never
+  // narrows the public gateway's reach. The gate note keys on LOOPBACK, not on host-being-explicit:
+  // an ungated loopback bind is normal, an ungated wide bind is announced — never silent.
+  const isLoopback = opts.host === '127.0.0.1' || opts.host === 'localhost' || opts.host === '::1'
   const onListen = () => {
     const scheme = secure ? 'https' : 'http'
     const label = opts.label ?? 'public mode'
-    const gate = isLocal ? '' : ` — ${gated ? 'password-gated' : 'OPEN (no password)'}`   // ungated loopback is normal, not a warning
-    console.log(`[gateway] ${label} on ${scheme}://${isLocal ? 'localhost' : '0.0.0.0'}:${opts.publicPort}${gate}, proxying /api to :${opts.upstreamPort}`)
-    if (!secure && !isLocal) console.log('[gateway] (TLS off — --http)')
+    const gate = isLoopback ? '' : ` — ${gated ? 'password-gated' : 'OPEN (no password)'}`
+    console.log(`[gateway] ${label} on ${scheme}://${isLoopback ? 'localhost' : (opts.host ?? '0.0.0.0')}:${opts.publicPort}${gate}, proxying /api to :${opts.upstreamPort}`)
+    if (!secure && !isLoopback && !opts.host) console.log('[gateway] (TLS off — --http)')
   }
-  if (opts.host) server.listen(opts.publicPort, opts.host, onListen)
-  else server.listen(opts.publicPort, onListen)
+  // a busy public port is a hard, loud, non-zero exit — the SAME contract as the supervisor's proxy
+  // (see [[spec-cli]] / listen.ts), so `spex serve` and `spex dashboard` fail a port clash identically.
+  listenOrExit(server, opts.publicPort, { host: opts.host, label: opts.label ?? 'gateway', cleanup: opts.onBindFail, onListen })
 }
 
 function rawHeaders(req: http.IncomingMessage): string {
@@ -194,26 +207,51 @@ function doLogin(req: http.IncomingMessage, res: http.ServerResponse, password:
   })
 }
 
-// reverse-proxy an /api request to the loopback supervisor (which forwards to the live child).
+// @@@ gzip at the gateway - compression is TRANSPORT, so it lives here, once, for every deployment — the
+// loopback upstream and the product semantics never know it exists. Text-ish payloads only; three
+// structural exclusions, each load-bearing: an SSE stream must not sit in a zlib buffer (event latency),
+// an already-encoded response is not re-encoded, and binary media (video/image evidence) gains nothing
+// and would fight Range requests.
+const COMPRESSIBLE = /^(text\/|application\/(json|javascript|xml)|image\/svg)/
+const wantsGzip = (req: http.IncomingMessage) => /\bgzip\b/.test(String(req.headers['accept-encoding'] || ''))
+
+// reverse-proxy an /api request to the loopback supervisor (which forwards to the live child) —
+// stream-gzipping compressible bodies (measured: the board JSON rides down at under a third).
 function proxyHttp(req: http.IncomingMessage, res: http.ServerResponse, upstreamPort: number) {
   const up = http.request({ host: '127.0.0.1', port: upstreamPort, path: req.url, method: req.method, headers: req.headers }, (upRes) => {
-    res.writeHead(upRes.statusCode || 502, upRes.headers)
-    upRes.pipe(res)
+    const type = String(upRes.headers['content-type'] || '')
+    const skip = !wantsGzip(req) || upRes.headers['content-encoding'] || !COMPRESSIBLE.test(type) || type.startsWith('text/event-stream')
+    if (skip) { res.writeHead(upRes.statusCode || 502, upRes.headers); upRes.pipe(res); return }
+    const headers = { ...upRes.headers, 'content-encoding': 'gzip', vary: 'Accept-Encoding' }
+    delete headers['content-length']   // streamed; the encoded length isn't knowable up front
+    res.writeHead(upRes.statusCode || 502, headers)
+    upRes.pipe(createGzip()).pipe(res)
   })
   up.on('error', () => { if (!res.headersSent) res.writeHead(502); res.end('upstream unreachable') })
   req.pipe(up)
 }
 
 // serve the built dashboard (vite dist). Unknown non-file paths fall back to index.html (SPA). Path
-// traversal is blocked by normalising and confining to distDir.
-function serveStatic(res: http.ServerResponse, distDir: string, urlPath: string) {
+// traversal is blocked by normalising and confining to distDir. Compressible files ship gzipped, memoized
+// per (path, mtime) — a dist file is immutable per build, so each is compressed once, not per request.
+const gzMemo = new Map<string, { mtime: number; gz: Buffer }>()
+function serveStatic(req: http.IncomingMessage, res: http.ServerResponse, distDir: string, urlPath: string) {
   const rel = normalize(decodeURIComponent(urlPath)).replace(/^(\.\.[/\\])+/, '')
   let file = join(distDir, rel)
   if (!file.startsWith(distDir)) file = join(distDir, 'index.html')
   if (urlPath === '/' || !existsSync(file)) file = join(distDir, 'index.html')
   if (!existsSync(file)) { res.writeHead(503); return res.end('dashboard build missing') }
-  res.writeHead(200, { 'Content-Type': MIME[extname(file)] || 'application/octet-stream' })
-  res.end(readFileSync(file))
+  const type = MIME[extname(file)] || 'application/octet-stream'
+  const raw = readFileSync(file)
+  if (wantsGzip(req) && COMPRESSIBLE.test(type)) {
+    const mtime = statSync(file).mtimeMs
+    let hit = gzMemo.get(file)
+    if (!hit || hit.mtime !== mtime) { hit = { mtime, gz: gzipSync(raw) }; gzMemo.set(file, hit) }
+    res.writeHead(200, { 'Content-Type': type, 'Content-Encoding': 'gzip', Vary: 'Accept-Encoding' })
+    return res.end(hit.gz)
+  }
+  res.writeHead(200, { 'Content-Type': type })
+  res.end(raw)
 }
 
 function sendHtml(res: http.ServerResponse, status: number, html: string) {
@@ -234,13 +272,15 @@ export function ensureDashboardBuilt(repoRoot: string, distDir: string): void {
 }
 
 // @@@ serveDashboardLocal - the engine behind `spex dashboard`: the SAME gateway as public mode, bound to
-// loopback with no TLS and no password. It serves the bundled dist and proxies /api + the terminal socket
-// to a separately-run `spex serve`. This is the post-install replacement for the dogfood-only `npm run web`
-// (a vite dev server an installed user has no source tree for). See [[packaging]].
-export function serveDashboardLocal(opts: { port: number; apiPort: number }): void {
+// loopback by default with no TLS and no password — `--host` widens the bind to a chosen interface
+// (LAN/tailnet viewing) while staying plain HTTP; the internet face remains `spex serve --public`.
+// It serves the bundled dist and proxies /api + the terminal socket to a separately-run `spex serve`.
+// This is the post-install replacement for the dogfood-only `npm run web` (a vite dev server an
+// installed user has no source tree for). See [[packaging]].
+export function serveDashboardLocal(opts: { port: number; apiPort: number; host?: string }): void {
   const pkgRoot = fileURLToPath(new URL('..', import.meta.url))
   const distDir = resolveDistDir()
   ensureDashboardBuilt(join(pkgRoot, '..'), distDir) // bundled dist already has index.html → returns at once
   console.log(`[dashboard] serving ${distDir.endsWith('dashboard-dist') ? 'bundled' : 'monorepo'} build, /api → backend :${opts.apiPort}`)
-  startGateway({ host: '127.0.0.1', publicPort: opts.port, upstreamPort: opts.apiPort, password: '', tls: null, distDir, label: 'dashboard' })
+  startGateway({ host: opts.host ?? '127.0.0.1', publicPort: opts.port, upstreamPort: opts.apiPort, password: '', tls: null, distDir, label: 'dashboard' })
 }

package/spec-cli/src/git.ts

@@ -113,41 +113,6 @@ export function worktreeSpecSig(wtPath: string): string {
 export type Version = { hash: string; date: string; reason: string; session: string | null }
 export type DiffStat = { additions: number; deletions: number; files: number }
 
-// per-commit numstat for one file, rename-followed; a pure rename is 0/0 so callers tell "moved" from
-// "changed". The per-file path for files outside `.spec` (`.spec` goes through the bulk index below).
-function fileStatsFollow(root: string, relPath: string): Map<string, DiffStat> {
-  const m = new Map<string, DiffStat>()
-  let out = ''
-  try {
-    out = git(['-C', root, 'log', '--follow', '--format=%H', '--numstat', '--', relPath])
-  } catch {
-    return m
-  }
-  let cur = ''
-  for (const line of out.split('\n')) {
-    const t = line.trim()
-    if (/^[0-9a-f]{7,40}$/.test(t)) { cur = t; if (!m.has(cur)) m.set(cur, { additions: 0, deletions: 0, files: 0 }); continue }
-    const n = line.match(/^(\d+|-)\t(\d+|-)\t/)
-    if (n && cur) { const s = m.get(cur)!; s.files++; s.additions += n[1] === '-' ? 0 : +n[1]; s.deletions += n[2] === '-' ? 0 : +n[2] }
-  }
-  return m
-}
-
-function historyFollow(root: string, relPath: string): Version[] {
-  let out = ''
-  try {
-    out = git(['-C', root, 'log', `--format=%H${US}%aI${US}%s${US}%b${RS}`, '--follow', '--', relPath])
-  } catch {
-    return []
-  }
-  const stats = fileStatsFollow(root, relPath)
-  return out.split(RS).map((r) => r.trim()).filter(Boolean).map((rec) => {
-    const [hash, date, reason, body = ''] = rec.split(US)
-    const m = body.match(/Session:\s*(\S+)/)
-    return { hash, date, reason, session: m ? m[1] : null }
-  }).filter((v) => { const s = stats.get(v.hash); return s != null && s.additions + s.deletions > 0 })
-}
-
 // ---- bulk spec history index ----
 
 export type HistoryIndex = {
@@ -174,14 +139,35 @@ function parseStatPath(token: string): { from: string; to: string } {
   return { from: token, to: token }
 }
 
-let indexCache: { head: string; idx: HistoryIndex } | null = null
+// Both bulk indices are pure functions of a checkout's HEAD, and they are read for SEVERAL roots at
+// once — the backend checkout (board, loadSpecs) plus every session worktree ([[review-proof]]'s eval
+// tab roots its readings at the session's branch). A single-slot cache thrashes between those roots:
+// each eval-tab request evicts the board's entry and vice versa, so every request re-runs a full-history
+// `git log` and re-parses it on the event loop — which is what starves every other request (the board,
+// remark posts) under load. So the cache is a small LRU keyed by HEAD (same head ⇒ same index, whatever
+// the root), holding the in-flight PROMISE so concurrent requests for one head share a single build.
+const INDEX_SLOTS = 16
+function lruGet<V>(m: Map<string, V>, k: string): V | undefined {
+  const v = m.get(k)
+  if (v !== undefined) { m.delete(k); m.set(k, v) }   // refresh recency
+  return v
+}
+function lruPut<V>(m: Map<string, V>, k: string, v: V): void {
+  m.set(k, v)
+  while (m.size > INDEX_SLOTS) m.delete(m.keys().next().value!)
+}
+
+const indexCache = new Map<string, Promise<HistoryIndex>>()
 
-export async function historyIndex(root: string): Promise<HistoryIndex> {
+export function historyIndex(root: string): Promise<HistoryIndex> {
   const head = headOrEmpty(root)
-  if (indexCache && head && indexCache.head === head) return indexCache.idx
-  const idx = await buildIndex(root)
-  if (head) indexCache = { head, idx }
-  return idx
+  if (!head) return buildIndex(root)
+  const hit = lruGet(indexCache, head)
+  if (hit) return hit
+  const p = buildIndex(root)
+  p.catch(() => { indexCache.delete(head) })   // don't pin a failed build
+  lruPut(indexCache, head, p)
+  return p
 }
 
 // resolve HEAD for cache-keying, '' if unreadable (fails the cache test → recompute); warns once.
@@ -232,9 +218,6 @@ async function buildIndex(root: string): Promise<HistoryIndex> {
   return { versions, stats }
 }
 
-// reset the cache when a process knows HEAD will have moved out from under it (tests, hooks).
-export function resetHistoryCache(): void { indexCache = null }
-
 // pure lookups over a prebuilt index (no git). rowsFor drops pure-rename rows (0/0) so a move isn't a version.
 export function rowsFor(idx: HistoryIndex, relPath: string): Version[] {
   const rows = idx.versions.get(relPath) ?? []
@@ -266,18 +249,6 @@ export async function pathsStats(root: string, paths: string[]): Promise<Map<str
   return m
 }
 
-// a file's version timeline: `.spec` from the bulk index, anything else (governed code) via per-file --follow.
-export async function history(root: string, relPath: string): Promise<Version[]> {
-  if (relPath.startsWith('.spec/')) return rowsFor(await historyIndex(root), relPath)
-  return historyFollow(root, relPath)
-}
-
-// per-commit stat for this node's spec.md (rename-followed), summed with governed-code stats by specHistory.
-export async function specStats(root: string, relPath: string): Promise<Map<string, DiffStat>> {
-  if (relPath.startsWith('.spec/')) return statsFor(await historyIndex(root), relPath)
-  return fileStatsFollow(root, relPath)
-}
-
 // the patch a spec.md got in one commit (vs parent); resolve its path AT that commit (reparents move it)
 // via the stable leaf dir `…/<id>/spec.md`, then `git show` that path. `-M` keeps a rename+edit's body. '' on error.
 export async function fileDiffAt(root: string, relPath: string, hash: string): Promise<string> {
@@ -288,35 +259,44 @@ export async function fileDiffAt(root: string, relPath: string, hash: string): P
   return gitA(['-C', root, '-c', 'core.quotePath=false', 'show', '-M', '--format=', hash, '--', at])
 }
 
-// ONE cached `git log` over HEAD (mirrors historyIndex): each commit's position (0 = newest) + per
-// file the commits that touched it; driftFor() is then a pure lookup. `acks`/`specNodes` carry the
-// Spec-OK convention (see driftFor): acks[hash] = node ids declared still-valid via `Spec-OK:` trailers;
-// specNodes[hash] = node ids whose spec.md it touched.
+// A cached `git log` over HEAD (HEAD-keyed like historyIndex), enriched with parent edges so "newer than
+// the spec" is answered by true DAG reachability, never by a log-position/date compare (a linear
+// order can't encode a branching history's partial order and silently under-reports — back-dated
+// branches, adoption). driftFor()/ancestorsOf() are then pure in-memory lookups. `acks`/`specNodes`
+// carry the Spec-OK convention (see driftFor): acks[hash] = node ids declared still-valid via
+// `Spec-OK:` trailers; specNodes[hash] = node ids whose spec.md it touched.
 export type DriftIndex = {
-  pos: Map<string, number>
+  ord: Map<string, number>            // hash -> dense id from the walk: a bitset slot, NEVER an order to compare
+  parents: Map<string, string[]>      // hash -> parent hashes (the DAG edges, from the same walk)
   fileCommits: Map<string, string[]>
   acks: Map<string, Set<string>>      // commit hash -> node ids acknowledged via `Spec-OK:` trailers
   specNodes: Map<string, Set<string>> // commit hash -> node ids whose spec.md it touched (its versions)
+  anc: Map<string, Uint8Array>        // memoized reachability bitsets, lazily built per queried sha
 }
-let driftIdxCache: { head: string; idx: DriftIndex } | null = null
+const driftIdxCache = new Map<string, Promise<DriftIndex>>()   // HEAD-keyed LRU, same shape as indexCache above
 
 async function buildDriftIndex(root: string): Promise<DriftIndex> {
-  const pos = new Map<string, number>(), fileCommits = new Map<string, string[]>()
+  const ord = new Map<string, number>(), parents = new Map<string, string[]>()
+  const fileCommits = new Map<string, string[]>()
   const acks = new Map<string, Set<string>>(), specNodes = new Map<string, Set<string>>()
-  // RS-delimited records: `<hash>US<comma-joined Spec-OK values>` on line 1, then the --name-only file
-  // list. `valueonly,separator` collapses the trailer block to one line so it never collides with the
-  // file names below it (a raw `%b` body would interleave with them and be unparseable).
+  const idx: DriftIndex = { ord, parents, fileCommits, acks, specNodes, anc: new Map() }
+  // RS-delimited records: `<hash>US<parents>US<comma-joined Spec-OK values>` on line 1, then the
+  // --name-only file list. `valueonly,separator` collapses the trailer block to one line so it never
+  // collides with the file names below it (a raw `%b` body would interleave and be unparseable).
   const out = await gitA(['-C', root, '-c', 'core.quotePath=false', 'log', '--name-only',
-    `--format=${RS}%H${US}%(trailers:key=Spec-OK,valueonly,separator=%x2C)`, 'HEAD'])
-  if (!out) return { pos, fileCommits, acks, specNodes }
+    `--format=${RS}%H${US}%P${US}%(trailers:key=Spec-OK,valueonly,separator=%x2C)`, 'HEAD'])
+  if (!out) return idx
   let i = 0
   for (const rec of out.split(RS)) {
     const r = rec.replace(/^\n/, '')
     if (!r) continue
     const lines = r.split('\n')
-    const [hash, ackStr = ''] = lines[0].split(US)
+    const [hash, parentStr = '', ackStr = ''] = lines[0].split(US)
     if (!hash) continue
-    if (!pos.has(hash)) pos.set(hash, i++)
+    if (!ord.has(hash)) {
+      ord.set(hash, i++)
+      parents.set(hash, parentStr.split(' ').filter(Boolean))
+    }
     const ackSet = new Set(ackStr.split(',').map((s) => s.trim()).filter(Boolean))
     if (ackSet.size) acks.set(hash, ackSet)
     for (const line of lines.slice(1)) {
@@ -329,42 +309,75 @@ async function buildDriftIndex(root: string): Promise<DriftIndex> {
       }
     }
   }
-  return { pos, fileCommits, acks, specNodes }
+  return idx
 }
-export async function driftIndex(root: string): Promise<DriftIndex> {
+export function driftIndex(root: string): Promise<DriftIndex> {
   const head = headOrEmpty(root) // filesystem HEAD, no subprocess — see historyIndex
-  if (driftIdxCache && head && driftIdxCache.head === head) return driftIdxCache.idx
-  const idx = await buildDriftIndex(root)
-  if (head) driftIdxCache = { head, idx }
-  return idx
+  if (!head) return buildDriftIndex(root)
+  const hit = lruGet(driftIdxCache, head)
+  if (hit) return hit
+  const p = buildDriftIndex(root)
+  p.catch(() => { driftIdxCache.delete(head) })
+  lruPut(driftIdxCache, head, p)
+  return p
+}
+// the reachability set of `sha` — itself plus every ancestor — as a bitset over the walk's dense ids.
+// Built once per queried sha by following parent edges in memory (no git fork), memoized on the index;
+// a bitset costs history-length BITS, so hundreds of cached shas stay cheap on the board hot path.
+// undefined when `sha` is not reachable from HEAD (rebased away, an unmerged branch, or never on any
+// ref) — callers apply their own conservative rule to that "can't prove" case.
+export function ancestorsOf(idx: DriftIndex, sha: string): Uint8Array | undefined {
+  const hit = idx.anc.get(sha)
+  if (hit) return hit
+  const start = idx.ord.get(sha)
+  if (start === undefined) return undefined
+  const bits = new Uint8Array((idx.ord.size + 7) >> 3)
+  bits[start >> 3] |= 1 << (start & 7)
+  const stack = [sha]
+  while (stack.length) {
+    for (const p of idx.parents.get(stack.pop()!) ?? []) {
+      const o = idx.ord.get(p)
+      if (o === undefined) continue // shallow-clone boundary: an unwalked parent ends the chain
+      const m = 1 << (o & 7)
+      if (bits[o >> 3] & m) continue
+      bits[o >> 3] |= m
+      stack.push(p)
+    }
+  }
+  idx.anc.set(sha, bits)
+  return bits
 }
-// pure lookup: how many commits to `path` are newer than `sinceHash` (the spec's last version) and not
-// yet acknowledged. No git calls.
+export function inAncestors(idx: DriftIndex, bits: Uint8Array, sha: string): boolean {
+  const o = idx.ord.get(sha)
+  return o !== undefined && (bits[o >> 3] & (1 << (o & 7))) !== 0
+}
+
+// pure lookup, no git: a commit to `path` is drift iff it is NOT an ancestor of `sinceHash` — it lies
+// in `sinceHash..HEAD` by true DAG reachability, wherever a date-ordered log happens to place it.
 //
 // `sinceHash` is the node's OWN latest version commit, so the node(s) it's a version of
-// (specNodes[sinceHash]) name the node being measured; an ack counts only if its `Spec-OK:` set names one
-// of those — `Spec-OK: A` quiets A's drift, never B's.
+// (specNodes[sinceHash]) name the node being measured; an ack counts only if its `Spec-OK:` set names
+// one of those — `Spec-OK: A` quiets A's drift, never B's. An ack that is itself an ancestor of the
+// version can't speak for it (a re-version invalidates older acks); a valid ack quiets exactly the
+// commits reachable from it. An off-history `sinceHash` → 0: no basis on HEAD to measure from.
 export function driftFor(idx: DriftIndex, sinceHash: string, path: string): number {
   if (!sinceHash) return 0
-  const sp = idx.pos.get(sinceHash)
-  if (sp === undefined) return 0
+  const base = ancestorsOf(idx, sinceHash)
+  if (!base) return 0
   const targets = idx.specNodes.get(sinceHash)
-  // the newest commit that acks a target (smallest pos = closest to HEAD) is the floor at/below which all
-  // drift is acknowledged. No target / no matching ack → Infinity, so nothing is quieted. An ack at or
-  // before the version (p >= sp) can't speak for it — a re-version invalidates older acks.
-  let ackPos = Infinity
+  const ackCover: Uint8Array[] = []
   if (targets) {
     for (const [h, ackSet] of idx.acks) {
-      const p = idx.pos.get(h)
-      if (p === undefined || p >= sp) continue
-      if ([...targets].some((t) => ackSet.has(t))) ackPos = Math.min(ackPos, p)
+      if (inAncestors(idx, base, h)) continue
+      if (![...targets].some((t) => ackSet.has(t))) continue
+      const a = ancestorsOf(idx, h)
+      if (a) ackCover.push(a)
     }
   }
   let n = 0
   for (const h of idx.fileCommits.get(path) ?? []) {
-    const p = idx.pos.get(h)
-    if (p === undefined || p >= sp) continue   // older than / at the version → not drift
-    if (p >= ackPos) continue                  // at or below the newest covering ack → acknowledged
+    if (inAncestors(idx, base, h)) continue           // reachable from the version → not drift
+    if (ackCover.some((a) => inAncestors(idx, a, h))) continue // covered by an ack → acknowledged
     n++
   }
   return n