diff --git a/app/cli/internal/trace/README.md b/app/cli/internal/trace/README.md
index f1f648639..38deaed8c 100644
--- a/app/cli/internal/trace/README.md
+++ b/app/cli/internal/trace/README.md
@@ -94,7 +94,7 @@ Why not Yes:
 - **Net contribution and line ranges, all agents:** the push finds the last writer of each line with `git blame`. A later commit that only re-indents a line takes the line, because blame sees a change. For Cursor, the limits of line attribution apply too.
 - **Session updates, all agents:** the update works only in the clone where the work happened, while the CLI keeps the trace state of the session (30 days), and only when the commits of the session are on the branch that the push sends. The push reads only the commits that are not on the default branch of the remote (`origin/HEAD`, or else `origin/main` or `origin/master`). After the commits of a session are pushed to that branch, a later commit does not update the session.
 - **Renames and rewrites, all agents:** this works only in the clone where the work happened. Git finds a rename only when the file keeps at least half of its content. Two pushed commits can rename a file one after the other. A later change to the file under its middle name does not send the session again. A rename inside an amend or a squash of the session commit loses the AI lines: the new commit creates the file under its new name, so no line of it matches the trace state (issue 3686). The limits of session updates apply too. For Cursor, the limits of line attribution apply too.
-- **Shell changes attribution, all agents:** the hook before a shell command records only a hash of each file, not its content. The file at the `HEAD` commit from before the command stands in for the content before the command. Uncommitted lines that an earlier agent edit recorded are not recorded again, but uncommitted human lines of a file that the command changes count as AI.
+- **Shell changes attribution, all agents:** the hook before a shell command records only a hash of each file, not its content. The command's changes are the commits that it wrote itself, each against the `HEAD` it replaced, plus the worktree against the `HEAD` after the command. The `HEAD` reflog tells the command's own commits apart from moves to commits that it did not write, such as a rebase, a pull, a merge, a checkout or a reset: lines that such a move brings in do not count (PFM-8131). Both the files and the reftable ref storage are read. When the reflog is off, rewritten, or does not lead from the old `HEAD` to the new one, no commit of the command counts. Uncommitted lines that an earlier agent edit recorded are not recorded again, but uncommitted human lines of a file that the command changes count as AI.
 
 ## User experience
 
diff --git a/app/cli/internal/trace/attribution/shell.go b/app/cli/internal/trace/attribution/shell.go
index 4f55b46da..3b28cc073 100644
--- a/app/cli/internal/trace/attribution/shell.go
+++ b/app/cli/internal/trace/attribution/shell.go
@@ -15,7 +15,55 @@
 
 package attribution
 
-import "sort"
+import (
+	"sort"
+	"strings"
+
+	tracegit "github.com/chainloop-dev/chainloop/app/cli/internal/trace/git"
+)
+
+// ownCommitPrefixes are the reflog messages of a commit that git wrote from
+// the index: "git commit", also with --amend, and the first commit of a
+// branch. A merge commit ("commit (merge)") is left out because its content
+// comes from the merged branch.
+var ownCommitPrefixes = []string{"commit: ", "commit (amend): ", "commit (initial): "}
+
+// OwnCommits returns the HEAD moves of a shell command that are commits the
+// command wrote itself, oldest first. entries are the HEAD reflog entries that
+// the command wrote. Every other move, such as a rebase, a pull, a merge, a
+// checkout or a reset, points HEAD at content that the command did not write.
+//
+// An empty oldHead is a checkout with no commit before the command, which the
+// reflog shows as the zero ID.
+//
+// It returns nil when entries do not lead from oldHead to newHead, each entry
+// starting where the one before it ended: the reflog then does not tell the
+// whole story of the command, and none of its moves can be trusted.
+func OwnCommits(oldHead, newHead string, entries []tracegit.ReflogEntry) []tracegit.ReflogEntry {
+	if len(entries) == 0 || entries[len(entries)-1].New != newHead {
+		return nil
+	}
+	if first := entries[0].Old; first != oldHead && (oldHead != "" || !tracegit.IsZeroOID(first)) {
+		return nil
+	}
+	for i := 1; i < len(entries); i++ {
+		if entries[i].Old != entries[i-1].New {
+			return nil
+		}
+	}
+
+	var own []tracegit.ReflogEntry
+	for _, e := range entries {
+		for _, prefix := range ownCommitPrefixes {
+			if strings.HasPrefix(e.Message, prefix) {
+				own = append(own, e)
+				break
+			}
+		}
+	}
+
+	return own
+}
 
 // ChangedPaths diffs two working-tree signatures (repo-relative path → content
 // hash) captured before and after a shell command, returning the paths the
diff --git a/app/cli/internal/trace/attribution/shell_test.go b/app/cli/internal/trace/attribution/shell_test.go
index 943a35e2b..e946ba295 100644
--- a/app/cli/internal/trace/attribution/shell_test.go
+++ b/app/cli/internal/trace/attribution/shell_test.go
@@ -18,9 +18,111 @@ package attribution
 import (
 	"testing"
 
+	tracegit "github.com/chainloop-dev/chainloop/app/cli/internal/trace/git"
 	"github.com/stretchr/testify/assert"
 )
 
+func TestOwnCommits(t *testing.T) {
+	entry := func(oldOID, newOID, msg string) tracegit.ReflogEntry {
+		return tracegit.ReflogEntry{Old: oldOID, New: newOID, Message: msg}
+	}
+	zero := "0000000000000000000000000000000000000000"
+
+	tests := []struct {
+		name    string
+		oldHead string
+		newHead string
+		entries []tracegit.ReflogEntry
+		want    []tracegit.ReflogEntry
+	}{
+		{
+			name:    "no move",
+			oldHead: "a", newHead: "a",
+		},
+		{
+			name:    "a commit",
+			oldHead: "a", newHead: "b",
+			entries: []tracegit.ReflogEntry{entry("a", "b", "commit: feat")},
+			want:    []tracegit.ReflogEntry{entry("a", "b", "commit: feat")},
+		},
+		{
+			name:    "an amend",
+			oldHead: "a", newHead: "b",
+			entries: []tracegit.ReflogEntry{entry("a", "b", "commit (amend): feat")},
+			want:    []tracegit.ReflogEntry{entry("a", "b", "commit (amend): feat")},
+		},
+		{
+			name:    "a rebase writes nothing of the command",
+			oldHead: "a", newHead: "d",
+			entries: []tracegit.ReflogEntry{
+				entry("a", "c", "rebase (start): checkout main"),
+				entry("c", "d", "rebase (pick): feat"),
+				entry("d", "d", "rebase (finish): returning to refs/heads/feature"),
+			},
+		},
+		{
+			name:    "a fast-forward pull, a checkout and a reset",
+			oldHead: "a", newHead: "d",
+			entries: []tracegit.ReflogEntry{
+				entry("a", "b", "pull: Fast-forward"),
+				entry("b", "c", "checkout: moving from feature to main"),
+				entry("c", "d", "reset: moving to d"),
+			},
+		},
+		{
+			name:    "a merge commit is not the command's own",
+			oldHead: "a", newHead: "m",
+			entries: []tracegit.ReflogEntry{entry("a", "m", "commit (merge): Merge branch 'main'")},
+		},
+		{
+			name:    "a commit before and after a rebase",
+			oldHead: "a", newHead: "e",
+			entries: []tracegit.ReflogEntry{
+				entry("a", "b", "commit: one"),
+				entry("b", "c", "rebase (start): checkout main"),
+				entry("c", "d", "rebase (pick): one"),
+				entry("d", "d", "rebase (finish): returning to refs/heads/feature"),
+				entry("d", "e", "commit: two"),
+			},
+			want: []tracegit.ReflogEntry{entry("a", "b", "commit: one"), entry("d", "e", "commit: two")},
+		},
+		{
+			name:    "entries that do not start at the old HEAD",
+			oldHead: "a", newHead: "c",
+			entries: []tracegit.ReflogEntry{entry("x", "c", "commit: feat")},
+		},
+		{
+			name:    "entries that do not end at the new HEAD",
+			oldHead: "a", newHead: "z",
+			entries: []tracegit.ReflogEntry{entry("a", "c", "commit: feat")},
+		},
+		{
+			name:    "entries with a gap between them",
+			oldHead: "a", newHead: "d",
+			entries: []tracegit.ReflogEntry{
+				entry("a", "b", "commit: one"),
+				entry("c", "d", "commit: two"),
+			},
+		},
+		{
+			name:    "the first commit of a checkout with no commit",
+			oldHead: "", newHead: "b",
+			entries: []tracegit.ReflogEntry{entry(zero, "b", "commit (initial): first")},
+			want:    []tracegit.ReflogEntry{entry(zero, "b", "commit (initial): first")},
+		},
+		{
+			name:    "no old HEAD and a first entry that replaces a commit",
+			oldHead: "", newHead: "b",
+			entries: []tracegit.ReflogEntry{entry("a", "b", "commit: feat")},
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.want, OwnCommits(tc.oldHead, tc.newHead, tc.entries))
+		})
+	}
+}
+
 func TestChangedPaths(t *testing.T) {
 	t.Run("detects created, modified, and deleted paths", func(t *testing.T) {
 		before := map[string]string{"a": "1", "b": "2", "c": "3"}
diff --git a/app/cli/internal/trace/git/blobs.go b/app/cli/internal/trace/git/blobs.go
new file mode 100644
index 000000000..cf9d60d62
--- /dev/null
+++ b/app/cli/internal/trace/git/blobs.go
@@ -0,0 +1,123 @@
+//
+// Copyright 2026 The Chainloop Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package git
+
+import (
+	"bufio"
+	"errors"
+	"fmt"
+	"io"
+	"os/exec"
+	"strconv"
+	"strings"
+)
+
+// ErrUnbatchableName reports a name that a BlobReader cannot ask git for,
+// because it holds a newline: read it in another way.
+var ErrUnbatchableName = errors.New("name holds a newline")
+
+// BlobReader reads files at commits through one long-running
+// "git cat-file --batch" process, so that many reads cost one process, not
+// several processes each. It is not safe for concurrent use.
+type BlobReader struct {
+	cmd *exec.Cmd
+	in  io.WriteCloser
+	out *bufio.Reader
+	// err is the first failure to talk to git. The output may then be out of
+	// step with the requests, so every later read fails too.
+	err error
+}
+
+// NewBlobReader starts a BlobReader for the repository at repoRoot. Close it
+// when done.
+func NewBlobReader(repoRoot string) (*BlobReader, error) {
+	cmd := exec.Command("git", "cat-file", "--batch")
+	cmd.Dir = repoRoot
+	in, err := cmd.StdinPipe()
+	if err != nil {
+		return nil, fmt.Errorf("git cat-file stdin: %w", err)
+	}
+	out, err := cmd.StdoutPipe()
+	if err != nil {
+		return nil, fmt.Errorf("git cat-file stdout: %w", err)
+	}
+	if err := cmd.Start(); err != nil {
+		return nil, fmt.Errorf("start git cat-file: %w", err)
+	}
+
+	return &BlobReader{cmd: cmd, in: in, out: bufio.NewReader(out)}, nil
+}
+
+// FileAt returns the content of path, repo-relative with forward slashes, at
+// rev. It returns nil when rev does not resolve or does not hold path as a
+// file, and ErrUnbatchableName when rev or path holds a newline.
+func (r *BlobReader) FileAt(rev, path string) ([]byte, error) {
+	if r.err != nil {
+		return nil, r.err
+	}
+	if strings.ContainsAny(rev+path, "\n") {
+		return nil, fmt.Errorf("read %q at %q: %w", path, rev, ErrUnbatchableName)
+	}
+
+	content, err := r.read(rev + ":" + path)
+	if err != nil {
+		r.err = err
+	}
+
+	return content, err
+}
+
+func (r *BlobReader) read(name string) ([]byte, error) {
+	if _, err := fmt.Fprintf(r.in, "%s\n", name); err != nil {
+		return nil, fmt.Errorf("write git cat-file request: %w", err)
+	}
+
+	header, err := r.out.ReadString('\n')
+	if err != nil {
+		return nil, fmt.Errorf("read git cat-file header: %w", err)
+	}
+	header = strings.TrimSuffix(header, "\n")
+	// "<name> missing" or "<name> ambiguous": the name can hold spaces.
+	if strings.HasSuffix(header, " missing") || strings.HasSuffix(header, " ambiguous") {
+		return nil, nil
+	}
+
+	// "<oid> <type> <size>", then the content and a newline.
+	fields := strings.Fields(header)
+	if len(fields) != 3 {
+		return nil, fmt.Errorf("unexpected git cat-file header %q", header)
+	}
+	size, err := strconv.Atoi(fields[2])
+	if err != nil {
+		return nil, fmt.Errorf("unexpected git cat-file header %q: %w", header, err)
+	}
+	content := make([]byte, size+1)
+	if _, err := io.ReadFull(r.out, content); err != nil {
+		return nil, fmt.Errorf("read git cat-file content: %w", err)
+	}
+	if fields[1] != "blob" {
+		return nil, nil
+	}
+
+	return content[:size], nil
+}
+
+// Close stops the git process.
+func (r *BlobReader) Close() error {
+	_ = r.in.Close()
+
+	return r.cmd.Wait()
+}
diff --git a/app/cli/internal/trace/git/reflog.go b/app/cli/internal/trace/git/reflog.go
new file mode 100644
index 000000000..4fccdd7d3
--- /dev/null
+++ b/app/cli/internal/trace/git/reflog.go
@@ -0,0 +1,290 @@
+//
+// Copyright 2026 The Chainloop Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package git
+
+import (
+	"bufio"
+	"bytes"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"slices"
+	"strconv"
+	"strings"
+)
+
+// ErrReflogRewritten reports that the HEAD reflog no longer holds a position
+// read from it earlier: something expired or rewrote it in between, so the
+// position no longer marks where the new entries start.
+var ErrReflogRewritten = errors.New("HEAD reflog was rewritten")
+
+// ReflogEntry is one move of HEAD, as the reflog records it.
+type ReflogEntry struct {
+	// Old and New are the commits HEAD pointed to before and after the move.
+	Old, New string
+	// Message says what moved HEAD, for example "commit: <subject>" or
+	// "rebase (finish): returning to refs/heads/main".
+	Message string
+}
+
+// ReflogPos marks the end of the HEAD reflog at one moment. Taken before a
+// command, it marks where the entries that the command writes start.
+type ReflogPos struct {
+	// Offset is the size in bytes of the reflog file, with the files ref
+	// storage.
+	Offset int64 `json:"offset,omitempty"`
+	// Top is the newest entry, as git prints it, with the reftable ref
+	// storage. It is empty when the reflog has no entry.
+	Top string `json:"top,omitempty"`
+}
+
+// IsZeroOID reports whether oid is the all-zero object ID that a reflog
+// entry holds for "no commit", as the old side of the first commit.
+func IsZeroOID(oid string) bool {
+	return oid != "" && strings.Trim(oid, "0") == ""
+}
+
+// headReflog locates the HEAD reflog of the checkout at repoRoot. A linked
+// worktree has its own HEAD, and its own reflog. With the files ref storage
+// the reflog is the file logs/HEAD in the checkout's git dir. With the
+// reftable ref storage (extensions.refStorage) it lives in binary tables that
+// only git reads, and reftable is true.
+func headReflog(repoRoot string) (path string, reftable bool, err error) {
+	gitDir, _, err := FindGitDirAndRootFrom(repoRoot)
+	if err != nil {
+		return "", false, err
+	}
+
+	commonDir := gitDir
+	if data, err := os.ReadFile(filepath.Join(gitDir, "commondir")); err == nil {
+		commonDir = strings.TrimSpace(string(data))
+		if !filepath.IsAbs(commonDir) {
+			commonDir = filepath.Join(gitDir, commonDir)
+		}
+	}
+	if fi, err := os.Stat(filepath.Join(commonDir, "reftable")); err == nil && fi.IsDir() { //nolint:gosec // the common dir that git wrote for this checkout
+		return "", true, nil
+	}
+
+	return filepath.Join(gitDir, "logs", "HEAD"), false, nil
+}
+
+// HeadReflogPos returns the position of the end of the HEAD reflog of the
+// checkout at repoRoot. It is cheap enough for a hook that runs before every
+// shell command, whatever the length of the reflog: a stat with the files ref
+// storage, and one entry read through git with reftable.
+func HeadReflogPos(repoRoot string) (ReflogPos, error) {
+	path, reftable, err := headReflog(repoRoot)
+	if err != nil {
+		return ReflogPos{}, err
+	}
+	if reftable {
+		lines, err := gitReflogLines(repoRoot, 1)
+		if err != nil || len(lines) == 0 {
+			return ReflogPos{}, err
+		}
+
+		return ReflogPos{Top: lines[0].line}, nil
+	}
+
+	fi, err := os.Stat(path)
+	if errors.Is(err, os.ErrNotExist) {
+		return ReflogPos{}, nil
+	}
+	if err != nil {
+		return ReflogPos{}, fmt.Errorf("stat HEAD reflog: %w", err)
+	}
+
+	return ReflogPos{Offset: fi.Size()}, nil
+}
+
+// HeadReflogSince returns the HEAD reflog entries written after pos, a
+// position that HeadReflogPos returned earlier, oldest first. It returns
+// ErrReflogRewritten when the reflog no longer holds pos.
+func HeadReflogSince(repoRoot string, pos ReflogPos) ([]ReflogEntry, error) {
+	path, reftable, err := headReflog(repoRoot)
+	if err != nil {
+		return nil, err
+	}
+	if reftable {
+		return gitHeadReflogSince(repoRoot, pos.Top)
+	}
+
+	f, err := os.Open(path)
+	if errors.Is(err, os.ErrNotExist) {
+		if pos.Offset > 0 {
+			return nil, ErrReflogRewritten
+		}
+
+		return nil, nil
+	}
+	if err != nil {
+		return nil, fmt.Errorf("open HEAD reflog: %w", err)
+	}
+	defer func() { _ = f.Close() }()
+
+	fi, err := f.Stat()
+	if err != nil {
+		return nil, fmt.Errorf("stat HEAD reflog: %w", err)
+	}
+	if fi.Size() < pos.Offset {
+		return nil, ErrReflogRewritten
+	}
+	if _, err := f.Seek(pos.Offset, io.SeekStart); err != nil {
+		return nil, fmt.Errorf("seek HEAD reflog: %w", err)
+	}
+
+	var entries []ReflogEntry
+	sc := bufio.NewScanner(f)
+	sc.Buffer(make([]byte, 0, 64*1024), 1024*1024)
+	for sc.Scan() {
+		entry, ok := parseReflogLine(sc.Text())
+		if !ok {
+			return nil, fmt.Errorf("parse HEAD reflog line %q", sc.Text())
+		}
+		entries = append(entries, entry)
+	}
+	if err := sc.Err(); err != nil {
+		return nil, fmt.Errorf("read HEAD reflog: %w", err)
+	}
+
+	return entries, nil
+}
+
+// reflogLine is one HEAD reflog entry as git prints it.
+type reflogLine struct {
+	// line is the whole entry: the commit, the selector with the time of the
+	// entry, and the message. It identifies the entry as a ReflogPos.Top.
+	line string
+	// newOID is the commit that the entry moved HEAD to.
+	newOID  string
+	message string
+}
+
+// gitReflogLines returns the newest n entries of the HEAD reflog through git,
+// newest first, for a ref storage that only git reads. The selector holds the
+// time of the entry, not its index, so the line of an entry stays the same
+// when newer entries are added. An unborn HEAD with no reflog yet has no
+// entries.
+func gitReflogLines(repoRoot string, n int) ([]reflogLine, error) {
+	cmd := exec.Command("git", "reflog", "show", "-n", strconv.Itoa(n), "--date=unix", "--format=%H%x09%gd%x09%gs", "HEAD", "--") //nolint:gosec // a fixed git command; n is a number
+	cmd.Dir = repoRoot
+	var stderr bytes.Buffer
+	cmd.Stderr = &stderr
+	out, err := cmd.Output()
+	if err != nil {
+		if hasHead := exec.Command("git", "-C", repoRoot, "rev-parse", "--verify", "-q", "HEAD").Run() == nil; !hasHead {
+			return nil, nil
+		}
+
+		return nil, fmt.Errorf("git reflog HEAD: %w: %s", err, strings.TrimSpace(stderr.String()))
+	}
+
+	var lines []reflogLine
+	for line := range strings.Lines(string(out)) {
+		line = strings.TrimSuffix(line, "\n")
+		fields := strings.SplitN(line, "\t", 3)
+		if len(fields) != 3 {
+			return nil, fmt.Errorf("parse git reflog line %q", line)
+		}
+		lines = append(lines, reflogLine{line: line, newOID: fields[0], message: fields[2]})
+	}
+
+	return lines, nil
+}
+
+// gitHeadReflogSince is HeadReflogSince for a ref storage that only git reads.
+// top is the newest entry before the command, empty when there was none. It
+// reads the reflog newest first, twice as many entries each time, until it
+// finds top: a command that wrote few entries costs one read, whatever the
+// length of the reflog.
+//
+// git prints the commit that each entry moved HEAD to, not the one it left.
+// The old side of an entry is the new side of the entry before it, or the zero
+// ID for the first entry of the reflog.
+func gitHeadReflogSince(repoRoot, top string) ([]ReflogEntry, error) {
+	for n := 16; ; n *= 2 {
+		lines, err := gitReflogLines(repoRoot, n)
+		if err != nil {
+			return nil, err
+		}
+
+		end := -1
+		if top != "" {
+			end = slices.IndexFunc(lines, func(l reflogLine) bool { return l.line == top })
+		}
+		if end < 0 {
+			if len(lines) == n {
+				continue // more entries to read
+			}
+			if top != "" {
+				return nil, ErrReflogRewritten
+			}
+			end = len(lines)
+		}
+
+		added := make([]ReflogEntry, 0, end)
+		for i := end - 1; i >= 0; i-- {
+			old := strings.Repeat("0", len(lines[i].newOID))
+			if i+1 < len(lines) {
+				old = lines[i+1].newOID
+			}
+			added = append(added, ReflogEntry{Old: old, New: lines[i].newOID, Message: lines[i].message})
+		}
+
+		return added, nil
+	}
+}
+
+// CommitPaths returns the repo-relative paths, with forward slashes, that
+// differ between the commits from and to. A zero from is the first commit of
+// a branch, and every path of to then counts.
+func CommitPaths(repoRoot, from, to string) (map[string]bool, error) {
+	args := []string{"diff-tree", "-r", "--no-renames", "--no-commit-id", "--name-only", "-z"}
+	if IsZeroOID(from) {
+		args = append(args, "--root", to)
+	} else {
+		args = append(args, from, to)
+	}
+	out, err := gitRawOutput(repoRoot, args...)
+	if err != nil {
+		return nil, fmt.Errorf("git diff-tree %s %s: %w", from, to, err)
+	}
+
+	paths := make(map[string]bool)
+	for p := range strings.SplitSeq(string(out), "\x00") {
+		if p != "" {
+			paths[p] = true
+		}
+	}
+
+	return paths, nil
+}
+
+// parseReflogLine parses one reflog line:
+// "<old> <new> <name> <<email>> <time> <tz>\t<message>".
+func parseReflogLine(line string) (ReflogEntry, bool) {
+	head, msg, _ := strings.Cut(line, "\t")
+	fields := strings.Fields(head)
+	if len(fields) < 2 {
+		return ReflogEntry{}, false
+	}
+
+	return ReflogEntry{Old: fields[0], New: fields[1], Message: msg}, true
+}
diff --git a/app/cli/internal/trace/git/reflog_test.go b/app/cli/internal/trace/git/reflog_test.go
new file mode 100644
index 000000000..b08fef48a
--- /dev/null
+++ b/app/cli/internal/trace/git/reflog_test.go
@@ -0,0 +1,247 @@
+//
+// Copyright 2026 The Chainloop Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package git
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func reflogRepo(t *testing.T, initArgs ...string) string {
+	t.Helper()
+	if _, err := exec.LookPath("git"); err != nil {
+		t.Skip("git binary not found")
+	}
+	dir := t.TempDir()
+	reflogGit(t, dir, append([]string{"init", "-q", "-b", "main"}, initArgs...)...)
+	reflogGit(t, dir, "config", "user.email", "test@example.com")
+	reflogGit(t, dir, "config", "user.name", "Test")
+	reflogGit(t, dir, "config", "commit.gpgsign", "false")
+
+	return dir
+}
+
+func reflogGit(t *testing.T, dir string, args ...string) string {
+	t.Helper()
+	cmd := exec.Command("git", args...)
+	cmd.Dir = dir
+	out, err := cmd.CombinedOutput()
+	require.NoError(t, err, "git %v: %s", args, out)
+
+	return strings.TrimSpace(string(out))
+}
+
+func reflogCommit(t *testing.T, dir, file, text, msg string) string {
+	t.Helper()
+	require.NoError(t, os.WriteFile(filepath.Join(dir, file), []byte(text), 0600))
+	reflogGit(t, dir, "add", file)
+	reflogGit(t, dir, "commit", "-q", "-m", msg)
+
+	return reflogGit(t, dir, "rev-parse", "HEAD")
+}
+
+// reftableSupported reports whether the git binary can create a repository
+// with the reftable ref storage (git 2.45 and later).
+func reftableSupported(t *testing.T) bool {
+	t.Helper()
+	cmd := exec.Command("git", "init", "-q", "--ref-format=reftable", t.TempDir()) //nolint:gosec // a fixed git command on a test temp dir
+
+	return cmd.Run() == nil
+}
+
+func TestHeadReflogSince(t *testing.T) {
+	tests := []struct {
+		name     string
+		initArgs []string
+		reftable bool
+	}{
+		{name: "files ref storage"},
+		{name: "reftable ref storage", initArgs: []string{"--ref-format=reftable"}, reftable: true},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			if tc.reftable && !reftableSupported(t) {
+				t.Skip("git does not support reftable")
+			}
+			dir := reflogRepo(t, tc.initArgs...)
+
+			// No commit yet: the reflog is empty.
+			start, err := HeadReflogPos(dir)
+			require.NoError(t, err)
+			assert.Zero(t, start)
+
+			first := reflogCommit(t, dir, fileA, "a\n", "first")
+			size, err := HeadReflogPos(dir)
+			require.NoError(t, err)
+			require.NotZero(t, size)
+
+			entries, err := HeadReflogSince(dir, start)
+			require.NoError(t, err)
+			require.Len(t, entries, 1)
+			assert.Equal(t, first, entries[0].New)
+			assert.Equal(t, "commit (initial): first", entries[0].Message)
+			assert.True(t, IsZeroOID(entries[0].Old), "the first commit replaces no commit: %q", entries[0].Old)
+
+			second := reflogCommit(t, dir, fileA, "b\n", "second")
+			reflogGit(t, dir, "checkout", "-q", "-b", "other", first)
+
+			entries, err = HeadReflogSince(dir, size)
+			require.NoError(t, err)
+			require.Len(t, entries, 2, "only the entries written after the size was taken")
+			assert.Equal(t, ReflogEntry{Old: first, New: second, Message: "commit: second"}, entries[0])
+			assert.Equal(t, second, entries[1].Old)
+			assert.Equal(t, first, entries[1].New)
+			assert.True(t, strings.HasPrefix(entries[1].Message, "checkout: moving from main to other"), entries[1].Message)
+
+			// Nothing written since the current position.
+			now, err := HeadReflogPos(dir)
+			require.NoError(t, err)
+			entries, err = HeadReflogSince(dir, now)
+			require.NoError(t, err)
+			assert.Empty(t, entries)
+
+			// More entries than one read of the reflog returns.
+			const many = 40
+			for i := range many {
+				reflogGit(t, dir, "commit", "-q", "--allow-empty", "-m", fmt.Sprintf("empty %d", i))
+			}
+			entries, err = HeadReflogSince(dir, now)
+			require.NoError(t, err)
+			require.Len(t, entries, many)
+			assert.Equal(t, first, entries[0].Old)
+			assert.Equal(t, "commit: empty 0", entries[0].Message)
+			for i := 1; i < many; i++ {
+				assert.Equal(t, entries[i-1].New, entries[i].Old, "entry %d starts where the one before it ended", i)
+			}
+			assert.Equal(t, reflogGit(t, dir, "rev-parse", "HEAD"), entries[many-1].New)
+
+			// A reflog that no longer holds the position was rewritten.
+			_, err = HeadReflogSince(dir, ReflogPos{Offset: 1 << 40, Top: "gone"})
+			assert.ErrorIs(t, err, ErrReflogRewritten)
+		})
+	}
+}
+
+// A linked worktree has its own HEAD reflog.
+func TestHeadReflogSince_LinkedWorktree(t *testing.T) {
+	for _, reftable := range []bool{false, true} {
+		t.Run(map[bool]string{false: "files", true: "reftable"}[reftable], func(t *testing.T) {
+			var initArgs []string
+			if reftable {
+				if !reftableSupported(t) {
+					t.Skip("git does not support reftable")
+				}
+				initArgs = []string{"--ref-format=reftable"}
+			}
+			testLinkedWorktreeReflog(t, reflogRepo(t, initArgs...))
+		})
+	}
+}
+
+func TestCommitPaths(t *testing.T) {
+	dir := reflogRepo(t)
+	first := reflogCommit(t, dir, fileA, "a\n", "first")
+	reflogCommit(t, dir, "b.txt", "b\n", "second")
+	require.NoError(t, os.MkdirAll(filepath.Join(dir, "sub"), 0o755))
+	third := reflogCommit(t, dir, filepath.Join("sub", "c d.txt"), "c\n", "third")
+
+	tests := []struct {
+		name     string
+		from, to string
+		want     map[string]bool
+	}{
+		{name: "a range of commits", from: first, to: third, want: map[string]bool{"b.txt": true, "sub/c d.txt": true}},
+		{name: "the first commit of a branch", from: strings.Repeat("0", len(first)), to: first, want: map[string]bool{fileA: true}},
+		{name: "no change", from: third, to: third, want: map[string]bool{}},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got, err := CommitPaths(dir, tc.from, tc.to)
+			require.NoError(t, err)
+			assert.Equal(t, tc.want, got)
+		})
+	}
+
+	_, err := CommitPaths(dir, first, "not-a-commit")
+	assert.Error(t, err)
+}
+
+func TestBlobReader(t *testing.T) {
+	dir := reflogRepo(t)
+	first := reflogCommit(t, dir, fileA, "one\ntwo\n", "first")
+	require.NoError(t, os.MkdirAll(filepath.Join(dir, "sub"), 0o755))
+	second := reflogCommit(t, dir, filepath.Join("sub", "b c.txt"), "", "second")
+
+	r, err := NewBlobReader(dir)
+	require.NoError(t, err)
+	defer func() { assert.NoError(t, r.Close()) }()
+
+	tests := []struct {
+		name      string
+		rev, path string
+		want      []byte
+	}{
+		{name: "a file", rev: first, path: fileA, want: []byte("one\ntwo\n")},
+		{name: "an empty file with a space in its path", rev: second, path: "sub/b c.txt", want: []byte{}},
+		{name: "a path the commit does not hold", rev: first, path: "sub/b c.txt"},
+		{name: "a directory", rev: second, path: "sub"},
+		{name: "a commit that does not resolve", rev: strings.Repeat("0", len(first)), path: fileA},
+		{name: "a symbolic revision", rev: "HEAD", path: fileA, want: []byte("one\ntwo\n")},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got, err := r.FileAt(tc.rev, tc.path)
+			require.NoError(t, err)
+			assert.Equal(t, tc.want, got)
+		})
+	}
+
+	_, err = r.FileAt(first, "a\nb")
+	assert.ErrorIs(t, err, ErrUnbatchableName)
+	got, err := r.FileAt(first, fileA)
+	require.NoError(t, err, "a rejected name does not break later reads")
+	assert.Equal(t, []byte("one\ntwo\n"), got)
+}
+
+func testLinkedWorktreeReflog(t *testing.T, dir string) {
+	t.Helper()
+	reflogCommit(t, dir, fileA, "a\n", "first")
+
+	wt := filepath.Join(t.TempDir(), "wt")
+	reflogGit(t, dir, "worktree", "add", "-q", "-b", "wt", wt)
+	mainSize, err := HeadReflogPos(dir)
+	require.NoError(t, err)
+	wtSize, err := HeadReflogPos(wt)
+	require.NoError(t, err)
+
+	reflogCommit(t, wt, "b.txt", "b\n", "in worktree")
+
+	entries, err := HeadReflogSince(wt, wtSize)
+	require.NoError(t, err)
+	require.Len(t, entries, 1)
+	assert.Equal(t, "commit: in worktree", entries[0].Message)
+
+	entries, err = HeadReflogSince(dir, mainSize)
+	require.NoError(t, err)
+	assert.Empty(t, entries, "the main checkout's HEAD did not move")
+}
diff --git a/app/cli/internal/trace/state/snapshot.go b/app/cli/internal/trace/state/snapshot.go
index 0cc01335e..6b41f3814 100644
--- a/app/cli/internal/trace/state/snapshot.go
+++ b/app/cli/internal/trace/state/snapshot.go
@@ -24,6 +24,8 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+
+	tracegit "github.com/chainloop-dev/chainloop/app/cli/internal/trace/git"
 )
 
 // FileSnapshotKey identifies the edit whose pre-edit content was captured.
@@ -152,6 +154,48 @@ func (s *Store) LoadShellPreSignature(key ShellCallKey) (WorktreeSignatures, err
 func (s *Store) DeleteShellPreSignature(key ShellCallKey) {
 	_ = os.Remove(s.shellPreSignaturePath(key))
 	_ = os.Remove(s.shellPreHeadsPath(key))
+	_ = os.Remove(s.shellPreReflogPath(key))
+}
+
+// shellPreReflogPath returns the path storing the HEAD reflog position of each
+// checkout before a shell command, next to the command's signature.
+func (s *Store) shellPreReflogPath(key ShellCallKey) string {
+	return strings.TrimSuffix(s.shellPreSignaturePath(key), ".json") + ".reflog.json"
+}
+
+// SaveShellPreReflog stores the end of the HEAD reflog of each checkout
+// (checkout root → position) before an agent-run shell command. The entries
+// past it are the HEAD moves of the command, which tell the commits it wrote
+// apart from the ones it only moved HEAD to.
+func (s *Store) SaveShellPreReflog(key ShellCallKey, positions map[string]tracegit.ReflogPos) error {
+	path := s.shellPreReflogPath(key)
+	if err := os.MkdirAll(filepath.Dir(path), 0755); err != nil {
+		return fmt.Errorf("create snapshot dir: %w", err)
+	}
+
+	data, err := json.Marshal(positions)
+	if err != nil {
+		return fmt.Errorf("marshal shell reflog positions: %w", err)
+	}
+
+	return os.WriteFile(path, data, 0600)
+}
+
+// LoadShellPreReflog loads the HEAD reflog positions saved before a shell
+// command. A command whose pre hook ran on an older CLI has none, and the
+// error then wraps os.ErrNotExist.
+func (s *Store) LoadShellPreReflog(key ShellCallKey) (map[string]tracegit.ReflogPos, error) {
+	data, err := os.ReadFile(s.shellPreReflogPath(key))
+	if err != nil {
+		return nil, err
+	}
+
+	var positions map[string]tracegit.ReflogPos
+	if err := json.Unmarshal(data, &positions); err != nil {
+		return nil, fmt.Errorf("parse shell reflog positions: %w", err)
+	}
+
+	return positions, nil
 }
 
 // shellPreHeadsPath returns the path storing the HEAD commit of each checkout
diff --git a/app/cli/internal/trace/state/snapshot_test.go b/app/cli/internal/trace/state/snapshot_test.go
index 69945fff4..eee6e61bd 100644
--- a/app/cli/internal/trace/state/snapshot_test.go
+++ b/app/cli/internal/trace/state/snapshot_test.go
@@ -21,6 +21,7 @@ import (
 	"path/filepath"
 	"testing"
 
+	tracegit "github.com/chainloop-dev/chainloop/app/cli/internal/trace/git"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -124,6 +125,29 @@ func TestShellPreHeads(t *testing.T) {
 	assert.NotErrorIs(t, err, os.ErrNotExist)
 }
 
+func TestShellPreReflog(t *testing.T) {
+	store := NewGitStore(t.TempDir())
+	key := ShellCallKey{SessionID: shellSessionID, ToolUseID: "toolu_1"}
+
+	_, err := store.LoadShellPreReflog(key)
+	require.ErrorIs(t, err, os.ErrNotExist, "a command without saved positions has none")
+
+	positions := map[string]tracegit.ReflogPos{
+		"/repo":     {Offset: 1234},
+		"/reftable": {Top: "abc\tHEAD@{1700000000}\tcommit: feat"},
+		"/unborn":   {},
+	}
+	require.NoError(t, store.SaveShellPreSignature(key, WorktreeSignatures{"/repo": {fileA: "h"}}))
+	require.NoError(t, store.SaveShellPreReflog(key, positions))
+	got, err := store.LoadShellPreReflog(key)
+	require.NoError(t, err)
+	assert.Equal(t, positions, got)
+
+	store.DeleteShellPreSignature(key)
+	_, err = store.LoadShellPreReflog(key)
+	require.ErrorIs(t, err, os.ErrNotExist, "the positions go with the signature")
+}
+
 // A CLI upgrade can land between the pre and post hooks of one command. The
 // earlier single-checkout format must then be rejected, not misread.
 func TestShellPreSignatureRejectsSingleCheckoutFormat(t *testing.T) {
diff --git a/app/cli/pkg/action/trace_agent_hook.go b/app/cli/pkg/action/trace_agent_hook.go
index 3027c0c68..8e7e437a4 100644
--- a/app/cli/pkg/action/trace_agent_hook.go
+++ b/app/cli/pkg/action/trace_agent_hook.go
@@ -447,6 +447,7 @@ func captureWorktreeSnapshot(store *state.Store, repoRoot string, key state.Shel
 	client := tracegit.NewGitClient()
 	sigs := make(state.WorktreeSignatures)
 	heads := make(map[string]string)
+	reflogs := make(map[string]tracegit.ReflogPos)
 	for _, root := range shellSnapshotRoots(store, repoRoot, key.SessionID) {
 		sig, err := client.SnapshotWorktree(root)
 		if err != nil {
@@ -456,9 +457,17 @@ func captureWorktreeSnapshot(store *state.Store, repoRoot string, key state.Shel
 		sigs[root] = sig
 
 		// A checkout with no commit yet has no HEAD; its files count as new.
+		// It is saved with an empty HEAD, so that the post hook can tell it
+		// apart from a HEAD that was not saved.
+		heads[root] = ""
 		if sha, _, err := client.CommitHeadInfo(root); err == nil {
 			heads[root] = sha
 		}
+		if pos, err := tracegit.HeadReflogPos(root); err == nil {
+			reflogs[root] = pos
+		} else {
+			log.Debug().Err(err).Str("root", root).Msg("pre-command: HEAD reflog position failed")
+		}
 	}
 
 	if len(sigs) == 0 {
@@ -471,6 +480,9 @@ func captureWorktreeSnapshot(store *state.Store, repoRoot string, key state.Shel
 	if err := store.SaveShellPreHeads(key, heads); err != nil {
 		log.Debug().Err(err).Msg("pre-command: save HEAD commits failed")
 	}
+	if err := store.SaveShellPreReflog(key, reflogs); err != nil {
+		log.Debug().Err(err).Msg("pre-command: save HEAD reflog positions failed")
+	}
 }
 
 // shellSnapshotRoots returns the checkouts that a shell command of the session
@@ -894,18 +906,21 @@ func recordCommandLineRanges(provider trace.Provider, input *trace.HookInput, st
 		return
 	}
 	defer store.DeleteShellPreSignature(key)
-	// A pre hook from an older CLI saved no HEAD. That case, and a heads file
-	// that cannot be read, fall back to the current HEAD.
+	// A pre hook from an older CLI saved no HEAD and no reflog position. That
+	// case, and a file that cannot be read, fall back to the current HEAD.
 	heads, err := store.LoadShellPreHeads(key)
 	if err != nil && !errors.Is(err, os.ErrNotExist) {
 		log.Debug().Err(err).Msg("post-command: cannot read pre-command HEAD commits; using the current HEAD")
 	}
+	reflogs, err := store.LoadShellPreReflog(key)
+	if err != nil && !errors.Is(err, os.ErrNotExist) {
+		log.Debug().Err(err).Msg("post-command: cannot read pre-command HEAD reflog positions")
+	}
 
 	for root, rootBefore := range before {
-		base := heads[root]
-		if base == "" {
-			base = "HEAD"
-		}
+		var pre preCommand
+		pre.head, pre.hasHead = heads[root]
+		pre.reflogPos, pre.hasReflog = reflogs[root]
 
 		rootStore := store
 		if !sameDir(root, repoRoot) {
@@ -918,22 +933,46 @@ func recordCommandLineRanges(provider trace.Provider, input *trace.HookInput, st
 			rootStore, root = s, r
 		}
 
-		recordRootChanges(rootStore, root, base, rootBefore, key.SessionID, log)
+		recordRootChanges(rootStore, root, pre, rootBefore, key.SessionID, log)
 	}
 }
 
+// preCommand is the state of one checkout that the pre hook saved before a
+// shell command.
+type preCommand struct {
+	// head is the HEAD commit. It is empty for a checkout with no commit
+	// yet, and when the pre hook saved none.
+	head string
+	// hasHead is false when the pre hook saved no HEAD for the checkout: a
+	// pre hook from an older CLI, or a heads file that cannot be read.
+	hasHead bool
+	// reflogPos is the end of the HEAD reflog. hasReflog is false when the
+	// pre hook saved none.
+	reflogPos tracegit.ReflogPos
+	hasReflog bool
+}
+
 // recordRootChanges diffs the signature of one checkout captured before a
-// shell command against its current worktree, and records every
-// created/modified file and every deleted file as AI-attributed.
+// shell command against its current worktree, and records the lines that the
+// command wrote in each created, modified or deleted file as AI-attributed.
 //
 // The signature holds hashes, not content, so the content before the command
-// is not known. The file at base, the HEAD commit before the command, stands in
-// for it: lines the command did not touch are then not claimed, also when the
-// command commits its own change. Uncommitted lines are in the diff too. Those
-// that an earlier edit of the session recorded are left out (DropOpen); other
-// ones, such as uncommitted human lines, are claimed. An untracked file counts
-// as new.
-func recordRootChanges(store *state.Store, repoRoot, base string, before map[string]string, sessionID string, log zerolog.Logger) {
+// is not known. Two kinds of change stand in for what the command wrote:
+//
+//   - The commits that the command wrote itself (OwnCommits), each against the
+//     HEAD it replaced, so an amend counts only what it added.
+//   - The uncommitted lines: the worktree against the HEAD after the command.
+//
+// A command that moves HEAD to commits that it did not write, such as a
+// rebase, a pull, a merge, a checkout or a reset, brings in their content.
+// That content is in neither kind of change, so it is not claimed (PFM-8131).
+// When the reflog cannot tell the commits of the command apart, none of them
+// counts: missing lines are a smaller error than claiming upstream ones.
+//
+// Uncommitted lines that an earlier edit of the session recorded are left out
+// (DropOpen); other ones, such as uncommitted human lines, are claimed. An
+// untracked file counts as new.
+func recordRootChanges(store *state.Store, repoRoot string, pre preCommand, before map[string]string, sessionID string, log zerolog.Logger) {
 	client := tracegit.NewGitClient()
 	after, err := client.SnapshotWorktree(repoRoot)
 	if err != nil {
@@ -941,8 +980,41 @@ func recordRootChanges(store *state.Store, repoRoot, base string, before map[str
 		return
 	}
 
-	atBase := func(relPath string) []byte {
-		content, err := client.FileAt(repoRoot, base, filepath.ToSlash(relPath))
+	// When the pre hook saved no HEAD, the HEAD after the command stands in,
+	// as before. A pre hook that saved an empty HEAD and a reflog position saw a
+	// checkout with no commit yet, so a HEAD now is a move, and the first
+	// commit can be the command's own.
+	head, moved := "HEAD", false
+	var own []tracegit.ReflogEntry
+	if pre.head != "" || (pre.hasHead && pre.hasReflog) {
+		if pre.head != "" {
+			head = pre.head
+		}
+		if sha, _, err := client.CommitHeadInfo(repoRoot); err == nil && sha != pre.head {
+			head, moved = sha, true
+			own = commandCommits(repoRoot, pre, sha, log)
+		}
+	}
+
+	// One git process serves every read of a file at a commit. Without one,
+	// each read starts its own processes.
+	blobs, err := tracegit.NewBlobReader(repoRoot)
+	if err != nil {
+		log.Debug().Err(err).Str("root", repoRoot).Msg("post-command: no batch reader; reading files one by one")
+	} else {
+		defer func() { _ = blobs.Close() }()
+	}
+	// A read that the batch reader cannot serve, such as a path with a
+	// newline or a git process that stopped, falls back to a read of its own:
+	// a file wrongly read as absent would count all its lines as new.
+	fileAt := func(rev, relPath string) []byte {
+		path := filepath.ToSlash(relPath)
+		if blobs != nil {
+			if content, err := blobs.FileAt(rev, path); err == nil {
+				return content
+			}
+		}
+		content, err := client.FileAt(repoRoot, rev, path)
 		if err != nil {
 			return nil
 		}
@@ -950,9 +1022,54 @@ func recordRootChanges(store *state.Store, repoRoot, base string, before map[str
 		return content
 	}
 
+	// The paths that each own commit changed, so that a file is read only at
+	// the commits that touched it. nil when git cannot tell: every file is
+	// then read at that commit, and the diff finds the ones it did not touch.
+	ownPaths := make([]map[string]bool, len(own))
+	for i, c := range own {
+		if paths, err := tracegit.CommitPaths(repoRoot, c.Old, c.New); err == nil {
+			ownPaths[i] = paths
+		}
+	}
+
 	open := store.LoadAILineAttribution(sessionID).Open
-	record := func(relPath string, edit attribution.Edit) error {
-		return store.RecordEdit(sessionID, relPath, editRecord(attribution.DropOpen(edit, open[relPath])))
+	record := func(relPath string, content []byte) error {
+		recorded := false
+		write := func(edit attribution.Edit) error {
+			if recorded {
+				// The open lines include the edit just recorded for the file.
+				open = store.LoadAILineAttribution(sessionID).Open
+			}
+			if err := store.RecordEdit(sessionID, relPath, editRecord(attribution.DropOpen(edit, open[relPath]))); err != nil {
+				return err
+			}
+			recorded = true
+
+			return nil
+		}
+
+		for i, c := range own {
+			if ownPaths[i] != nil && !ownPaths[i][filepath.ToSlash(relPath)] {
+				continue
+			}
+			if edit := attribution.ComputeEdit(fileAt(c.Old, relPath), fileAt(c.New, relPath)); edit.Changed {
+				if err := write(edit); err != nil {
+					return err
+				}
+			}
+		}
+
+		edit := attribution.ComputeEdit(fileAt(head, relPath), content)
+		// When HEAD did not move, ChangedPaths already proved the file changed,
+		// so record it even when the diff finds nothing (created empty, or
+		// restored to HEAD): the file is then AI-touched with zero lines, as a
+		// deletion-only edit. When HEAD moved, a file with no change of the
+		// command came in with the commits that HEAD moved to.
+		if !edit.Changed && (recorded || moved) {
+			return nil
+		}
+
+		return write(edit)
 	}
 
 	changed, deleted := attribution.ChangedPaths(before, after)
@@ -961,22 +1078,36 @@ func recordRootChanges(store *state.Store, repoRoot, base string, before map[str
 		if err != nil {
 			continue
 		}
-		// ChangedPaths already proved the file changed, so record it even when
-		// the diff finds nothing (created empty, or restored to base): the
-		// file is then AI-touched with zero lines, as a deletion-only edit.
-		if err := record(relPath, attribution.ComputeEdit(atBase(relPath), content)); err != nil {
+		if err := record(relPath, content); err != nil {
 			log.Debug().Err(err).Str("file", relPath).Msg("post-command: record line ranges failed")
 		}
 	}
 	for _, relPath := range deleted {
-		// The removed lines are the file at base, matching the file-writing
+		// The removed lines are the file at HEAD, matching the file-writing
 		// hook's treatment of deletions.
-		if err := record(relPath, attribution.ComputeEdit(atBase(relPath), nil)); err != nil {
+		if err := record(relPath, nil); err != nil {
 			log.Debug().Err(err).Str("file", relPath).Msg("post-command: record deletion failed")
 		}
 	}
 
-	log.Debug().Int("changed", len(changed)).Int("deleted", len(deleted)).Str("session_id", sessionID).Str("root", repoRoot).Msg("command line ranges recorded")
+	log.Debug().Int("changed", len(changed)).Int("deleted", len(deleted)).Int("own_commits", len(own)).Bool("head_moved", moved).Str("session_id", sessionID).Str("root", repoRoot).Msg("command line ranges recorded")
+}
+
+// commandCommits returns the commits that a shell command wrote itself, from
+// the HEAD reflog entries that it added. It returns nil when the pre hook saved
+// no reflog position or the reflog cannot be read.
+func commandCommits(repoRoot string, pre preCommand, newHead string, log zerolog.Logger) []tracegit.ReflogEntry {
+	if !pre.hasReflog {
+		return nil
+	}
+
+	entries, err := tracegit.HeadReflogSince(repoRoot, pre.reflogPos)
+	if err != nil {
+		log.Debug().Err(err).Str("root", repoRoot).Msg("post-command: cannot read the HEAD reflog; no commit of the command counts")
+		return nil
+	}
+
+	return attribution.OwnCommits(pre.head, newHead, entries)
 }
 
 // editRecord converts a computed edit into its ledger record.
diff --git a/app/cli/pkg/action/trace_line_attribution_test.go b/app/cli/pkg/action/trace_line_attribution_test.go
index 12ea3922a..dc870a623 100644
--- a/app/cli/pkg/action/trace_line_attribution_test.go
+++ b/app/cli/pkg/action/trace_line_attribution_test.go
@@ -655,9 +655,14 @@ func (r *lineRepo) shellWrite(sessionID string, run func()) {
 	require.NoError(r.t, err)
 	heads, err := r.store.LoadShellPreHeads(key)
 	require.NoError(r.t, err)
-	base := heads[r.dir]
-	require.NotEmpty(r.t, base, "the pre hook saves the HEAD commit")
-	recordRootChanges(r.store, r.dir, base, sigs[r.dir], sessionID, zerolog.Nop())
+	reflogs, err := r.store.LoadShellPreReflog(key)
+	require.NoError(r.t, err)
+	var pre preCommand
+	pre.head, pre.hasHead = heads[r.dir]
+	pre.reflogPos, pre.hasReflog = reflogs[r.dir]
+	require.True(r.t, pre.hasHead, "the pre hook saves the HEAD")
+	require.True(r.t, pre.hasReflog, "the pre hook saves the HEAD reflog position")
+	recordRootChanges(r.store, r.dir, pre, sigs[r.dir], sessionID, zerolog.Nop())
 	r.store.DeleteShellPreSignature(key)
 }
 
@@ -693,6 +698,196 @@ func TestLineAttribution_ShellCommandThatCommits(t *testing.T) {
 	assert.Equal(t, 2, attr.Written["a.go"].Len())
 }
 
+// Each commit of a command counts only for the files that it changed, and a
+// file that a later commit changes again counts at each of its commits.
+func TestLineAttribution_ShellCommandWithSeveralCommits(t *testing.T) {
+	r := newLineRepo(t)
+
+	r.shellWrite(lineSession, func() {
+		r.humanWrite("a.go", "one\ntwo\n")
+		runGit(t, r.dir, "add", "a.go")
+		runGit(t, r.dir, "commit", "-m", "feat: a")
+		r.humanWrite("b.go", "one\n")
+		runGit(t, r.dir, "add", "b.go")
+		runGit(t, r.dir, "commit", "-m", "feat: b")
+		r.humanWrite("a.go", "one\ntwo\nthree\n")
+		runGit(t, r.dir, "add", "a.go")
+		runGit(t, r.dir, "commit", "-m", "feat: a again")
+	})
+
+	attr := r.store.LoadAILineAttribution(lineSession)
+	assert.Equal(t, 3, attr.Written["a.go"].Len())
+	assert.Equal(t, 1, attr.Written["b.go"].Len())
+	assert.Equal(t, 4, attr.GeneratedAdded)
+}
+
+// A pre hook whose HEAD commits were lost (the heads file is missing or
+// unreadable) but whose reflog position was saved does not see a HEAD move when
+// HEAD did not move: a file that the command restored to HEAD is still
+// recorded as AI-touched with zero lines.
+func TestLineAttribution_ShellLostHeadsIsNotAHeadMove(t *testing.T) {
+	r := newLineRepo(t)
+	r.humanWrite("a.go", "one\n")
+	r.commit("feat: a", "a.go")
+	r.humanWrite("a.go", "one\ntwo\n")
+
+	key := state.ShellCallKey{SessionID: lineSession, ToolUseID: "toolu"}
+	captureWorktreeSnapshot(r.store, r.dir, key, zerolog.Nop())
+	runGit(t, r.dir, "checkout", "--", "a.go")
+
+	sigs, err := r.store.LoadShellPreSignature(key)
+	require.NoError(t, err)
+	reflogs, err := r.store.LoadShellPreReflog(key)
+	require.NoError(t, err)
+	pre := preCommand{}
+	pre.reflogPos, pre.hasReflog = reflogs[r.dir]
+	require.True(t, pre.hasReflog)
+	recordRootChanges(r.store, r.dir, pre, sigs[r.dir], lineSession, zerolog.Nop())
+
+	attr := r.store.LoadAILineAttribution(lineSession)
+	assert.Contains(t, attr.Files, "a.go")
+	assert.Equal(t, 0, attr.GeneratedAdded)
+}
+
+// wireGenFile is a file that a code generator rewrites.
+const wireGenFile = "wire_gen.go"
+
+// divergedRepo returns a repository on branch feature, with one human commit,
+// and a main branch that rewrote big.txt and added other.txt since.
+func divergedRepo(t *testing.T) *lineRepo {
+	t.Helper()
+	r := newLineRepo(t)
+
+	r.humanWrite("big.txt", content(numbered("old", 100)))
+	r.commit("chore: big", "big.txt")
+
+	runGit(t, r.dir, "checkout", "-q", "-b", "feature")
+	r.humanWrite(wireGenFile, "package main\n")
+	r.commit("feat: wire", wireGenFile)
+
+	runGit(t, r.dir, "checkout", "-q", "main")
+	r.humanWrite("big.txt", content(numbered("new", 100)))
+	r.humanWrite("other.txt", content(numbered("other", 50)))
+	r.commit("chore: upstream", "big.txt", "other.txt")
+	runGit(t, r.dir, "checkout", "-q", "feature")
+
+	return r
+}
+
+// A shell command that moves HEAD to commits that it did not write records
+// none of their lines (PFM-8131). Only the lines that the command wrote count.
+func TestLineAttribution_ShellHeadMoveRecordsNoUpstreamLines(t *testing.T) {
+	tests := []struct {
+		name string
+		run  func(t *testing.T, r *lineRepo)
+		// wantAdded and wantRemoved are the generated lines of the session.
+		wantAdded, wantRemoved int
+		// wantFiles are the files in the ledger of the session.
+		wantFiles []string
+	}{
+		{
+			name: "rebase, then a regenerated file",
+			run: func(t *testing.T, r *lineRepo) {
+				r.shellWrite(lineSession, func() { runGit(t, r.dir, "rebase", "-q", "main") })
+				r.shellWrite(lineSession, func() { r.humanWrite(wireGenFile, "package main\n\nfunc a() {}\n") })
+			},
+			wantAdded: 2, wantFiles: []string{wireGenFile},
+		},
+		{
+			name: "rebase and a change in one command",
+			run: func(t *testing.T, r *lineRepo) {
+				r.shellWrite(lineSession, func() {
+					runGit(t, r.dir, "rebase", "-q", "main")
+					r.humanWrite(wireGenFile, "package main\n\nfunc a() {}\n")
+				})
+			},
+			wantAdded: 2, wantFiles: []string{wireGenFile},
+		},
+		{
+			name: "merge commit",
+			run: func(t *testing.T, r *lineRepo) {
+				r.shellWrite(lineSession, func() { runGit(t, r.dir, "merge", "-q", "--no-edit", "main") })
+			},
+		},
+		{
+			name: "fast-forward",
+			run: func(t *testing.T, r *lineRepo) {
+				runGit(t, r.dir, "checkout", "-q", "-b", "behind", "main~1")
+				r.shellWrite(lineSession, func() { runGit(t, r.dir, "merge", "-q", "--ff-only", "main") })
+			},
+		},
+		{
+			name: "checkout of another branch",
+			run: func(t *testing.T, r *lineRepo) {
+				r.shellWrite(lineSession, func() { runGit(t, r.dir, "checkout", "-q", "main") })
+			},
+		},
+		{
+			name: "hard reset",
+			run: func(t *testing.T, r *lineRepo) {
+				r.shellWrite(lineSession, func() { runGit(t, r.dir, "reset", "-q", "--hard", "main") })
+			},
+		},
+		{
+			name: "a commit of the command, then a rebase",
+			run: func(t *testing.T, r *lineRepo) {
+				r.shellWrite(lineSession, func() {
+					r.humanWrite("a.go", "one\ntwo\n")
+					runGit(t, r.dir, "add", "a.go")
+					runGit(t, r.dir, "commit", "-q", "-m", "feat: a")
+					runGit(t, r.dir, "rebase", "-q", "main")
+				})
+			},
+			wantAdded: 2, wantFiles: []string{"a.go"},
+		},
+		{
+			name: "an amend of a human commit",
+			run: func(t *testing.T, r *lineRepo) {
+				r.shellWrite(lineSession, func() {
+					r.humanWrite(wireGenFile, "package main\n\nfunc a() {}\n")
+					runGit(t, r.dir, "commit", "-q", "-a", "--amend", "--no-edit")
+				})
+			},
+			wantAdded: 2, wantFiles: []string{wireGenFile},
+		},
+		{
+			name: "rebase without a reflog",
+			run: func(t *testing.T, r *lineRepo) {
+				runGit(t, r.dir, "config", "core.logAllRefUpdates", "false")
+				r.shellWrite(lineSession, func() { runGit(t, r.dir, "rebase", "-q", "main") })
+			},
+		},
+		{
+			name: "the first commit of a checkout with no commit",
+			run: func(t *testing.T, r *lineRepo) {
+				runGit(t, r.dir, "checkout", "-q", "--orphan", "fresh")
+				runGit(t, r.dir, "rm", "-rfq", ".")
+				r.shellWrite(lineSession, func() {
+					r.humanWrite("a.go", "one\ntwo\n")
+					runGit(t, r.dir, "add", "a.go")
+					runGit(t, r.dir, "commit", "-q", "-m", "feat: a")
+				})
+			},
+			wantAdded: 2, wantFiles: []string{"a.go"},
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			r := divergedRepo(t)
+			tc.run(t, r)
+
+			attr := r.store.LoadAILineAttribution(lineSession)
+			assert.Equal(t, tc.wantAdded, attr.GeneratedAdded, "generated lines added")
+			assert.Equal(t, tc.wantRemoved, attr.GeneratedRemoved, "generated lines removed")
+			files := make([]string, 0, len(attr.Files))
+			for f := range attr.Files {
+				files = append(files, f)
+			}
+			assert.ElementsMatch(t, tc.wantFiles, files)
+		})
+	}
+}
+
 // R-011: the ledger keeps the lines that every agent edit added and removed,
 // also the ones that never reach a commit.
 func TestLineAttribution_GeneratedLines(t *testing.T) {