From 7ed4749ef23619d4e8aeee7444179618015cfc56 Mon Sep 17 00:00:00 2001
From: Jose Ignacio Paris Prieto <jiparis@chainloop.dev>
Date: Wed, 4 Nov 2026 00:15:07 +0100
Subject: [PATCH 1/6] fix(trace): do not count upstream lines when a shell
 command moves HEAD

An agent shell command that moves HEAD, such as a rebase, a pull, a
merge, a checkout or a reset, recorded every line of the commits that
it moved to as an AI edit of the session, which inflated
ai_generated_lines_added and ai_generated_lines_removed and added
unrelated files to the session's ledger.

The pre hook now saves the size of the HEAD reflog. The post hook reads
the entries that the command added, credits only the commits that the
command wrote itself, each against the HEAD it replaced, plus the
uncommitted changes against the HEAD after the command.

Refs: PFM-8131

Assisted-by: Claude Code
Signed-off-by: Jose Ignacio Paris Prieto <jiparis@chainloop.dev>

Chainloop-Trace-Sessions: 66252f01-6f1c-4e49-b41b-d21335c39743
---
 app/cli/internal/trace/README.md              |   2 +-
 app/cli/internal/trace/attribution/shell.go   |  39 ++++-
 .../internal/trace/attribution/shell_test.go  |  82 ++++++++++
 app/cli/internal/trace/git/reflog.go          | 134 +++++++++++++++++
 app/cli/internal/trace/git/reflog_test.go     | 120 +++++++++++++++
 app/cli/internal/trace/state/snapshot.go      |  42 ++++++
 app/cli/internal/trace/state/snapshot_test.go |  19 +++
 app/cli/pkg/action/trace_agent_hook.go        | 142 ++++++++++++++----
 .../pkg/action/trace_line_attribution_test.go | 133 +++++++++++++++-
 9 files changed, 681 insertions(+), 32 deletions(-)
 create mode 100644 app/cli/internal/trace/git/reflog.go
 create mode 100644 app/cli/internal/trace/git/reflog_test.go

diff --git a/app/cli/internal/trace/README.md b/app/cli/internal/trace/README.md
index f1f648639..fa947575c 100644
--- a/app/cli/internal/trace/README.md
+++ b/app/cli/internal/trace/README.md
@@ -94,7 +94,7 @@ Why not Yes:
 - **Net contribution and line ranges, all agents:** the push finds the last writer of each line with `git blame`. A later commit that only re-indents a line takes the line, because blame sees a change. For Cursor, the limits of line attribution apply too.
 - **Session updates, all agents:** the update works only in the clone where the work happened, while the CLI keeps the trace state of the session (30 days), and only when the commits of the session are on the branch that the push sends. The push reads only the commits that are not on the default branch of the remote (`origin/HEAD`, or else `origin/main` or `origin/master`). After the commits of a session are pushed to that branch, a later commit does not update the session.
 - **Renames and rewrites, all agents:** this works only in the clone where the work happened. Git finds a rename only when the file keeps at least half of its content. Two pushed commits can rename a file one after the other. A later change to the file under its middle name does not send the session again. A rename inside an amend or a squash of the session commit loses the AI lines: the new commit creates the file under its new name, so no line of it matches the trace state (issue 3686). The limits of session updates apply too. For Cursor, the limits of line attribution apply too.
-- **Shell changes attribution, all agents:** the hook before a shell command records only a hash of each file, not its content. The file at the `HEAD` commit from before the command stands in for the content before the command. Uncommitted lines that an earlier agent edit recorded are not recorded again, but uncommitted human lines of a file that the command changes count as AI.
+- **Shell changes attribution, all agents:** the hook before a shell command records only a hash of each file, not its content. The command's changes are the commits that it wrote itself, each against the `HEAD` it replaced, plus the worktree against the `HEAD` after the command. The `HEAD` reflog tells the command's own commits apart from moves to commits that it did not write, such as a rebase, a pull, a merge, a checkout or a reset: lines that such a move brings in do not count (PFM-8131). When the reflog is off or cannot be read, no commit of the command counts. Uncommitted lines that an earlier agent edit recorded are not recorded again, but uncommitted human lines of a file that the command changes count as AI.
 
 ## User experience
 
diff --git a/app/cli/internal/trace/attribution/shell.go b/app/cli/internal/trace/attribution/shell.go
index 4f55b46da..23dad01d7 100644
--- a/app/cli/internal/trace/attribution/shell.go
+++ b/app/cli/internal/trace/attribution/shell.go
@@ -15,7 +15,44 @@
 
 package attribution
 
-import "sort"
+import (
+	"sort"
+	"strings"
+
+	tracegit "github.com/chainloop-dev/chainloop/app/cli/internal/trace/git"
+)
+
+// ownCommitPrefixes are the reflog messages of a commit that git wrote from
+// the index: "git commit", also with --amend, and the first commit of a
+// branch. A merge commit ("commit (merge)") is left out because its content
+// comes from the merged branch.
+var ownCommitPrefixes = []string{"commit: ", "commit (amend): ", "commit (initial): "}
+
+// OwnCommits returns the HEAD moves of a shell command that are commits the
+// command wrote itself, oldest first. entries are the HEAD reflog entries that
+// the command wrote. Every other move, such as a rebase, a pull, a merge, a
+// checkout or a reset, points HEAD at content that the command did not write.
+//
+// It returns nil when entries do not lead from oldHead to newHead: the reflog
+// then does not tell the whole story of the command, and none of its moves can
+// be trusted.
+func OwnCommits(oldHead, newHead string, entries []tracegit.ReflogEntry) []tracegit.ReflogEntry {
+	if len(entries) == 0 || entries[0].Old != oldHead || entries[len(entries)-1].New != newHead {
+		return nil
+	}
+
+	var own []tracegit.ReflogEntry
+	for _, e := range entries {
+		for _, prefix := range ownCommitPrefixes {
+			if strings.HasPrefix(e.Message, prefix) {
+				own = append(own, e)
+				break
+			}
+		}
+	}
+
+	return own
+}
 
 // ChangedPaths diffs two working-tree signatures (repo-relative path → content
 // hash) captured before and after a shell command, returning the paths the
diff --git a/app/cli/internal/trace/attribution/shell_test.go b/app/cli/internal/trace/attribution/shell_test.go
index 943a35e2b..7fcd72abc 100644
--- a/app/cli/internal/trace/attribution/shell_test.go
+++ b/app/cli/internal/trace/attribution/shell_test.go
@@ -18,9 +18,91 @@ package attribution
 import (
 	"testing"
 
+	tracegit "github.com/chainloop-dev/chainloop/app/cli/internal/trace/git"
 	"github.com/stretchr/testify/assert"
 )
 
+func TestOwnCommits(t *testing.T) {
+	entry := func(old, new, msg string) tracegit.ReflogEntry {
+		return tracegit.ReflogEntry{Old: old, New: new, Message: msg}
+	}
+
+	tests := []struct {
+		name    string
+		oldHead string
+		newHead string
+		entries []tracegit.ReflogEntry
+		want    []tracegit.ReflogEntry
+	}{
+		{
+			name:    "no move",
+			oldHead: "a", newHead: "a",
+		},
+		{
+			name:    "a commit",
+			oldHead: "a", newHead: "b",
+			entries: []tracegit.ReflogEntry{entry("a", "b", "commit: feat")},
+			want:    []tracegit.ReflogEntry{entry("a", "b", "commit: feat")},
+		},
+		{
+			name:    "an amend",
+			oldHead: "a", newHead: "b",
+			entries: []tracegit.ReflogEntry{entry("a", "b", "commit (amend): feat")},
+			want:    []tracegit.ReflogEntry{entry("a", "b", "commit (amend): feat")},
+		},
+		{
+			name:    "a rebase writes nothing of the command",
+			oldHead: "a", newHead: "d",
+			entries: []tracegit.ReflogEntry{
+				entry("a", "c", "rebase (start): checkout main"),
+				entry("c", "d", "rebase (pick): feat"),
+				entry("d", "d", "rebase (finish): returning to refs/heads/feature"),
+			},
+		},
+		{
+			name:    "a fast-forward pull, a checkout and a reset",
+			oldHead: "a", newHead: "d",
+			entries: []tracegit.ReflogEntry{
+				entry("a", "b", "pull: Fast-forward"),
+				entry("b", "c", "checkout: moving from feature to main"),
+				entry("c", "d", "reset: moving to d"),
+			},
+		},
+		{
+			name:    "a merge commit is not the command's own",
+			oldHead: "a", newHead: "m",
+			entries: []tracegit.ReflogEntry{entry("a", "m", "commit (merge): Merge branch 'main'")},
+		},
+		{
+			name:    "a commit before and after a rebase",
+			oldHead: "a", newHead: "e",
+			entries: []tracegit.ReflogEntry{
+				entry("a", "b", "commit: one"),
+				entry("b", "c", "rebase (start): checkout main"),
+				entry("c", "d", "rebase (pick): one"),
+				entry("d", "d", "rebase (finish): returning to refs/heads/feature"),
+				entry("d", "e", "commit: two"),
+			},
+			want: []tracegit.ReflogEntry{entry("a", "b", "commit: one"), entry("d", "e", "commit: two")},
+		},
+		{
+			name:    "entries that do not start at the old HEAD",
+			oldHead: "a", newHead: "c",
+			entries: []tracegit.ReflogEntry{entry("x", "c", "commit: feat")},
+		},
+		{
+			name:    "entries that do not end at the new HEAD",
+			oldHead: "a", newHead: "z",
+			entries: []tracegit.ReflogEntry{entry("a", "c", "commit: feat")},
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.want, OwnCommits(tc.oldHead, tc.newHead, tc.entries))
+		})
+	}
+}
+
 func TestChangedPaths(t *testing.T) {
 	t.Run("detects created, modified, and deleted paths", func(t *testing.T) {
 		before := map[string]string{"a": "1", "b": "2", "c": "3"}
diff --git a/app/cli/internal/trace/git/reflog.go b/app/cli/internal/trace/git/reflog.go
new file mode 100644
index 000000000..780f912d0
--- /dev/null
+++ b/app/cli/internal/trace/git/reflog.go
@@ -0,0 +1,134 @@
+//
+// Copyright 2026 The Chainloop Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package git
+
+import (
+	"bufio"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+// ErrReflogRewritten reports that the HEAD reflog is shorter than an offset
+// read from it earlier: something expired or rewrote it in between, so the
+// offset no longer marks where the new entries start.
+var ErrReflogRewritten = errors.New("HEAD reflog was rewritten")
+
+// ReflogEntry is one move of HEAD, as the reflog records it.
+type ReflogEntry struct {
+	// Old and New are the commits HEAD pointed to before and after the move.
+	Old, New string
+	// Message says what moved HEAD, for example "commit: <subject>" or
+	// "rebase (finish): returning to refs/heads/main".
+	Message string
+}
+
+// headReflogPath returns the HEAD reflog of the checkout at repoRoot. A linked
+// worktree has its own HEAD, and its own reflog in its private git dir.
+func headReflogPath(repoRoot string) (string, error) {
+	gitDir, _, err := FindGitDirAndRootFrom(repoRoot)
+	if err != nil {
+		return "", err
+	}
+
+	return filepath.Join(gitDir, "logs", "HEAD"), nil
+}
+
+// HeadReflogSize returns the size in bytes of the HEAD reflog of the checkout
+// at repoRoot, zero when it has none yet. Taken before a command, it marks
+// where the entries that the command writes start. It only stats the file, so
+// it is cheap enough for a hook that runs before every shell command.
+func HeadReflogSize(repoRoot string) (int64, error) {
+	path, err := headReflogPath(repoRoot)
+	if err != nil {
+		return 0, err
+	}
+
+	fi, err := os.Stat(path)
+	if errors.Is(err, os.ErrNotExist) {
+		return 0, nil
+	}
+	if err != nil {
+		return 0, fmt.Errorf("stat HEAD reflog: %w", err)
+	}
+
+	return fi.Size(), nil
+}
+
+// HeadReflogSince returns the HEAD reflog entries written after offset, a size
+// that HeadReflogSize returned earlier, oldest first. It returns
+// ErrReflogRewritten when the reflog is now shorter than offset.
+func HeadReflogSince(repoRoot string, offset int64) ([]ReflogEntry, error) {
+	path, err := headReflogPath(repoRoot)
+	if err != nil {
+		return nil, err
+	}
+
+	f, err := os.Open(path)
+	if errors.Is(err, os.ErrNotExist) {
+		if offset > 0 {
+			return nil, ErrReflogRewritten
+		}
+
+		return nil, nil
+	}
+	if err != nil {
+		return nil, fmt.Errorf("open HEAD reflog: %w", err)
+	}
+	defer func() { _ = f.Close() }()
+
+	fi, err := f.Stat()
+	if err != nil {
+		return nil, fmt.Errorf("stat HEAD reflog: %w", err)
+	}
+	if fi.Size() < offset {
+		return nil, ErrReflogRewritten
+	}
+	if _, err := f.Seek(offset, io.SeekStart); err != nil {
+		return nil, fmt.Errorf("seek HEAD reflog: %w", err)
+	}
+
+	var entries []ReflogEntry
+	sc := bufio.NewScanner(f)
+	sc.Buffer(make([]byte, 0, 64*1024), 1024*1024)
+	for sc.Scan() {
+		entry, ok := parseReflogLine(sc.Text())
+		if !ok {
+			return nil, fmt.Errorf("parse HEAD reflog line %q", sc.Text())
+		}
+		entries = append(entries, entry)
+	}
+	if err := sc.Err(); err != nil {
+		return nil, fmt.Errorf("read HEAD reflog: %w", err)
+	}
+
+	return entries, nil
+}
+
+// parseReflogLine parses one reflog line:
+// "<old> <new> <name> <<email>> <time> <tz>\t<message>".
+func parseReflogLine(line string) (ReflogEntry, bool) {
+	head, msg, _ := strings.Cut(line, "\t")
+	fields := strings.Fields(head)
+	if len(fields) < 2 {
+		return ReflogEntry{}, false
+	}
+
+	return ReflogEntry{Old: fields[0], New: fields[1], Message: msg}, true
+}
diff --git a/app/cli/internal/trace/git/reflog_test.go b/app/cli/internal/trace/git/reflog_test.go
new file mode 100644
index 000000000..c7e03e5f7
--- /dev/null
+++ b/app/cli/internal/trace/git/reflog_test.go
@@ -0,0 +1,120 @@
+//
+// Copyright 2026 The Chainloop Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package git
+
+import (
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func reflogRepo(t *testing.T) string {
+	t.Helper()
+	if _, err := exec.LookPath("git"); err != nil {
+		t.Skip("git binary not found")
+	}
+	dir := t.TempDir()
+	reflogGit(t, dir, "init", "-q", "-b", "main")
+	reflogGit(t, dir, "config", "user.email", "test@example.com")
+	reflogGit(t, dir, "config", "user.name", "Test")
+	reflogGit(t, dir, "config", "commit.gpgsign", "false")
+
+	return dir
+}
+
+func reflogGit(t *testing.T, dir string, args ...string) string {
+	t.Helper()
+	cmd := exec.Command("git", args...)
+	cmd.Dir = dir
+	out, err := cmd.CombinedOutput()
+	require.NoError(t, err, "git %v: %s", args, out)
+
+	return strings.TrimSpace(string(out))
+}
+
+func reflogCommit(t *testing.T, dir, file, text, msg string) string {
+	t.Helper()
+	require.NoError(t, os.WriteFile(filepath.Join(dir, file), []byte(text), 0600))
+	reflogGit(t, dir, "add", file)
+	reflogGit(t, dir, "commit", "-q", "-m", msg)
+
+	return reflogGit(t, dir, "rev-parse", "HEAD")
+}
+
+func TestHeadReflogSince(t *testing.T) {
+	dir := reflogRepo(t)
+
+	// No commit yet: there is no reflog, and its size is zero.
+	size, err := HeadReflogSize(dir)
+	require.NoError(t, err)
+	assert.Zero(t, size)
+
+	first := reflogCommit(t, dir, "a.txt", "a\n", "first")
+	size, err = HeadReflogSize(dir)
+	require.NoError(t, err)
+	require.Positive(t, size)
+
+	second := reflogCommit(t, dir, "a.txt", "b\n", "second")
+	reflogGit(t, dir, "checkout", "-q", "-b", "other", first)
+
+	entries, err := HeadReflogSince(dir, size)
+	require.NoError(t, err)
+	require.Len(t, entries, 2, "only the entries written after the size was taken")
+	assert.Equal(t, ReflogEntry{Old: first, New: second, Message: "commit: second"}, entries[0])
+	assert.Equal(t, second, entries[1].Old)
+	assert.Equal(t, first, entries[1].New)
+	assert.True(t, strings.HasPrefix(entries[1].Message, "checkout: moving from main to other"), entries[1].Message)
+
+	// Nothing written since the current size.
+	now, err := HeadReflogSize(dir)
+	require.NoError(t, err)
+	entries, err = HeadReflogSince(dir, now)
+	require.NoError(t, err)
+	assert.Empty(t, entries)
+
+	// A reflog that is now shorter than the offset was rewritten.
+	_, err = HeadReflogSince(dir, now+1)
+	assert.ErrorIs(t, err, ErrReflogRewritten)
+}
+
+// A linked worktree has its own HEAD reflog.
+func TestHeadReflogSince_LinkedWorktree(t *testing.T) {
+	dir := reflogRepo(t)
+	reflogCommit(t, dir, "a.txt", "a\n", "first")
+
+	wt := filepath.Join(t.TempDir(), "wt")
+	reflogGit(t, dir, "worktree", "add", "-q", "-b", "wt", wt)
+	mainSize, err := HeadReflogSize(dir)
+	require.NoError(t, err)
+	wtSize, err := HeadReflogSize(wt)
+	require.NoError(t, err)
+
+	reflogCommit(t, wt, "b.txt", "b\n", "in worktree")
+
+	entries, err := HeadReflogSince(wt, wtSize)
+	require.NoError(t, err)
+	require.Len(t, entries, 1)
+	assert.Equal(t, "commit: in worktree", entries[0].Message)
+
+	entries, err = HeadReflogSince(dir, mainSize)
+	require.NoError(t, err)
+	assert.Empty(t, entries, "the main checkout's HEAD did not move")
+}
diff --git a/app/cli/internal/trace/state/snapshot.go b/app/cli/internal/trace/state/snapshot.go
index 0cc01335e..b089b306e 100644
--- a/app/cli/internal/trace/state/snapshot.go
+++ b/app/cli/internal/trace/state/snapshot.go
@@ -152,6 +152,48 @@ func (s *Store) LoadShellPreSignature(key ShellCallKey) (WorktreeSignatures, err
 func (s *Store) DeleteShellPreSignature(key ShellCallKey) {
 	_ = os.Remove(s.shellPreSignaturePath(key))
 	_ = os.Remove(s.shellPreHeadsPath(key))
+	_ = os.Remove(s.shellPreReflogPath(key))
+}
+
+// shellPreReflogPath returns the path storing the HEAD reflog size of each
+// checkout before a shell command, next to the command's signature.
+func (s *Store) shellPreReflogPath(key ShellCallKey) string {
+	return strings.TrimSuffix(s.shellPreSignaturePath(key), ".json") + ".reflog.json"
+}
+
+// SaveShellPreReflog stores the size of the HEAD reflog of each checkout
+// (checkout root → bytes) before an agent-run shell command. The entries past
+// it are the HEAD moves of the command, which tell the commits it wrote apart
+// from the ones it only moved HEAD to.
+func (s *Store) SaveShellPreReflog(key ShellCallKey, sizes map[string]int64) error {
+	path := s.shellPreReflogPath(key)
+	if err := os.MkdirAll(filepath.Dir(path), 0755); err != nil {
+		return fmt.Errorf("create snapshot dir: %w", err)
+	}
+
+	data, err := json.Marshal(sizes)
+	if err != nil {
+		return fmt.Errorf("marshal shell reflog sizes: %w", err)
+	}
+
+	return os.WriteFile(path, data, 0600)
+}
+
+// LoadShellPreReflog loads the HEAD reflog sizes saved before a shell command.
+// A command whose pre hook ran on an older CLI has none, and the error then
+// wraps os.ErrNotExist.
+func (s *Store) LoadShellPreReflog(key ShellCallKey) (map[string]int64, error) {
+	data, err := os.ReadFile(s.shellPreReflogPath(key))
+	if err != nil {
+		return nil, err
+	}
+
+	var sizes map[string]int64
+	if err := json.Unmarshal(data, &sizes); err != nil {
+		return nil, fmt.Errorf("parse shell reflog sizes: %w", err)
+	}
+
+	return sizes, nil
 }
 
 // shellPreHeadsPath returns the path storing the HEAD commit of each checkout
diff --git a/app/cli/internal/trace/state/snapshot_test.go b/app/cli/internal/trace/state/snapshot_test.go
index 69945fff4..f39c34905 100644
--- a/app/cli/internal/trace/state/snapshot_test.go
+++ b/app/cli/internal/trace/state/snapshot_test.go
@@ -124,6 +124,25 @@ func TestShellPreHeads(t *testing.T) {
 	assert.NotErrorIs(t, err, os.ErrNotExist)
 }
 
+func TestShellPreReflog(t *testing.T) {
+	store := NewGitStore(t.TempDir())
+	key := ShellCallKey{SessionID: shellSessionID, ToolUseID: "toolu_1"}
+
+	_, err := store.LoadShellPreReflog(key)
+	require.ErrorIs(t, err, os.ErrNotExist, "a command without saved sizes has none")
+
+	sizes := map[string]int64{"/repo": 1234}
+	require.NoError(t, store.SaveShellPreSignature(key, WorktreeSignatures{"/repo": {fileA: "h"}}))
+	require.NoError(t, store.SaveShellPreReflog(key, sizes))
+	got, err := store.LoadShellPreReflog(key)
+	require.NoError(t, err)
+	assert.Equal(t, sizes, got)
+
+	store.DeleteShellPreSignature(key)
+	_, err = store.LoadShellPreReflog(key)
+	require.ErrorIs(t, err, os.ErrNotExist, "the sizes go with the signature")
+}
+
 // A CLI upgrade can land between the pre and post hooks of one command. The
 // earlier single-checkout format must then be rejected, not misread.
 func TestShellPreSignatureRejectsSingleCheckoutFormat(t *testing.T) {
diff --git a/app/cli/pkg/action/trace_agent_hook.go b/app/cli/pkg/action/trace_agent_hook.go
index 3027c0c68..e75bf3b94 100644
--- a/app/cli/pkg/action/trace_agent_hook.go
+++ b/app/cli/pkg/action/trace_agent_hook.go
@@ -447,6 +447,7 @@ func captureWorktreeSnapshot(store *state.Store, repoRoot string, key state.Shel
 	client := tracegit.NewGitClient()
 	sigs := make(state.WorktreeSignatures)
 	heads := make(map[string]string)
+	reflogs := make(map[string]int64)
 	for _, root := range shellSnapshotRoots(store, repoRoot, key.SessionID) {
 		sig, err := client.SnapshotWorktree(root)
 		if err != nil {
@@ -459,6 +460,11 @@ func captureWorktreeSnapshot(store *state.Store, repoRoot string, key state.Shel
 		if sha, _, err := client.CommitHeadInfo(root); err == nil {
 			heads[root] = sha
 		}
+		if size, err := tracegit.HeadReflogSize(root); err == nil {
+			reflogs[root] = size
+		} else {
+			log.Debug().Err(err).Str("root", root).Msg("pre-command: HEAD reflog size failed")
+		}
 	}
 
 	if len(sigs) == 0 {
@@ -471,6 +477,9 @@ func captureWorktreeSnapshot(store *state.Store, repoRoot string, key state.Shel
 	if err := store.SaveShellPreHeads(key, heads); err != nil {
 		log.Debug().Err(err).Msg("pre-command: save HEAD commits failed")
 	}
+	if err := store.SaveShellPreReflog(key, reflogs); err != nil {
+		log.Debug().Err(err).Msg("pre-command: save HEAD reflog sizes failed")
+	}
 }
 
 // shellSnapshotRoots returns the checkouts that a shell command of the session
@@ -894,18 +903,20 @@ func recordCommandLineRanges(provider trace.Provider, input *trace.HookInput, st
 		return
 	}
 	defer store.DeleteShellPreSignature(key)
-	// A pre hook from an older CLI saved no HEAD. That case, and a heads file
-	// that cannot be read, fall back to the current HEAD.
+	// A pre hook from an older CLI saved no HEAD and no reflog size. That
+	// case, and a file that cannot be read, fall back to the current HEAD.
 	heads, err := store.LoadShellPreHeads(key)
 	if err != nil && !errors.Is(err, os.ErrNotExist) {
 		log.Debug().Err(err).Msg("post-command: cannot read pre-command HEAD commits; using the current HEAD")
 	}
+	reflogs, err := store.LoadShellPreReflog(key)
+	if err != nil && !errors.Is(err, os.ErrNotExist) {
+		log.Debug().Err(err).Msg("post-command: cannot read pre-command HEAD reflog sizes")
+	}
 
 	for root, rootBefore := range before {
-		base := heads[root]
-		if base == "" {
-			base = "HEAD"
-		}
+		pre := preCommand{head: heads[root]}
+		pre.reflogSize, pre.hasReflog = reflogs[root]
 
 		rootStore := store
 		if !sameDir(root, repoRoot) {
@@ -918,22 +929,43 @@ func recordCommandLineRanges(provider trace.Provider, input *trace.HookInput, st
 			rootStore, root = s, r
 		}
 
-		recordRootChanges(rootStore, root, base, rootBefore, key.SessionID, log)
+		recordRootChanges(rootStore, root, pre, rootBefore, key.SessionID, log)
 	}
 }
 
+// preCommand is the state of one checkout that the pre hook saved before a
+// shell command.
+type preCommand struct {
+	// head is the HEAD commit. It is empty when the pre hook saved none: a
+	// checkout with no commit yet, or a pre hook from an older CLI.
+	head string
+	// reflogSize is the size of the HEAD reflog. hasReflog is false when the
+	// pre hook saved none.
+	reflogSize int64
+	hasReflog  bool
+}
+
 // recordRootChanges diffs the signature of one checkout captured before a
-// shell command against its current worktree, and records every
-// created/modified file and every deleted file as AI-attributed.
+// shell command against its current worktree, and records the lines that the
+// command wrote in each created, modified or deleted file as AI-attributed.
 //
 // The signature holds hashes, not content, so the content before the command
-// is not known. The file at base, the HEAD commit before the command, stands in
-// for it: lines the command did not touch are then not claimed, also when the
-// command commits its own change. Uncommitted lines are in the diff too. Those
-// that an earlier edit of the session recorded are left out (DropOpen); other
-// ones, such as uncommitted human lines, are claimed. An untracked file counts
-// as new.
-func recordRootChanges(store *state.Store, repoRoot, base string, before map[string]string, sessionID string, log zerolog.Logger) {
+// is not known. Two kinds of change stand in for what the command wrote:
+//
+//   - The commits that the command wrote itself (OwnCommits), each against the
+//     HEAD it replaced, so an amend counts only what it added.
+//   - The uncommitted lines: the worktree against the HEAD after the command.
+//
+// A command that moves HEAD to commits that it did not write, such as a
+// rebase, a pull, a merge, a checkout or a reset, brings in their content.
+// That content is in neither kind of change, so it is not claimed (PFM-8131).
+// When the reflog cannot tell the commits of the command apart, none of them
+// counts: missing lines are a smaller error than claiming upstream ones.
+//
+// Uncommitted lines that an earlier edit of the session recorded are left out
+// (DropOpen); other ones, such as uncommitted human lines, are claimed. An
+// untracked file counts as new.
+func recordRootChanges(store *state.Store, repoRoot string, pre preCommand, before map[string]string, sessionID string, log zerolog.Logger) {
 	client := tracegit.NewGitClient()
 	after, err := client.SnapshotWorktree(repoRoot)
 	if err != nil {
@@ -941,8 +973,18 @@ func recordRootChanges(store *state.Store, repoRoot, base string, before map[str
 		return
 	}
 
-	atBase := func(relPath string) []byte {
-		content, err := client.FileAt(repoRoot, base, filepath.ToSlash(relPath))
+	head, moved := "HEAD", false
+	var own []tracegit.ReflogEntry
+	if pre.head != "" {
+		head = pre.head
+		if sha, _, err := client.CommitHeadInfo(repoRoot); err == nil && sha != pre.head {
+			head, moved = sha, true
+			own = commandCommits(repoRoot, pre, sha, log)
+		}
+	}
+
+	fileAt := func(rev, relPath string) []byte {
+		content, err := client.FileAt(repoRoot, rev, filepath.ToSlash(relPath))
 		if err != nil {
 			return nil
 		}
@@ -951,8 +993,40 @@ func recordRootChanges(store *state.Store, repoRoot, base string, before map[str
 	}
 
 	open := store.LoadAILineAttribution(sessionID).Open
-	record := func(relPath string, edit attribution.Edit) error {
-		return store.RecordEdit(sessionID, relPath, editRecord(attribution.DropOpen(edit, open[relPath])))
+	record := func(relPath string, content []byte) error {
+		recorded := false
+		write := func(edit attribution.Edit) error {
+			if recorded {
+				// The open lines include the edit just recorded for the file.
+				open = store.LoadAILineAttribution(sessionID).Open
+			}
+			if err := store.RecordEdit(sessionID, relPath, editRecord(attribution.DropOpen(edit, open[relPath]))); err != nil {
+				return err
+			}
+			recorded = true
+
+			return nil
+		}
+
+		for _, c := range own {
+			if edit := attribution.ComputeEdit(fileAt(c.Old, relPath), fileAt(c.New, relPath)); edit.Changed {
+				if err := write(edit); err != nil {
+					return err
+				}
+			}
+		}
+
+		edit := attribution.ComputeEdit(fileAt(head, relPath), content)
+		// When HEAD did not move, ChangedPaths already proved the file changed,
+		// so record it even when the diff finds nothing (created empty, or
+		// restored to HEAD): the file is then AI-touched with zero lines, as a
+		// deletion-only edit. When HEAD moved, a file with no change of the
+		// command came in with the commits that HEAD moved to.
+		if !edit.Changed && (recorded || moved) {
+			return nil
+		}
+
+		return write(edit)
 	}
 
 	changed, deleted := attribution.ChangedPaths(before, after)
@@ -961,22 +1035,36 @@ func recordRootChanges(store *state.Store, repoRoot, base string, before map[str
 		if err != nil {
 			continue
 		}
-		// ChangedPaths already proved the file changed, so record it even when
-		// the diff finds nothing (created empty, or restored to base): the
-		// file is then AI-touched with zero lines, as a deletion-only edit.
-		if err := record(relPath, attribution.ComputeEdit(atBase(relPath), content)); err != nil {
+		if err := record(relPath, content); err != nil {
 			log.Debug().Err(err).Str("file", relPath).Msg("post-command: record line ranges failed")
 		}
 	}
 	for _, relPath := range deleted {
-		// The removed lines are the file at base, matching the file-writing
+		// The removed lines are the file at HEAD, matching the file-writing
 		// hook's treatment of deletions.
-		if err := record(relPath, attribution.ComputeEdit(atBase(relPath), nil)); err != nil {
+		if err := record(relPath, nil); err != nil {
 			log.Debug().Err(err).Str("file", relPath).Msg("post-command: record deletion failed")
 		}
 	}
 
-	log.Debug().Int("changed", len(changed)).Int("deleted", len(deleted)).Str("session_id", sessionID).Str("root", repoRoot).Msg("command line ranges recorded")
+	log.Debug().Int("changed", len(changed)).Int("deleted", len(deleted)).Int("own_commits", len(own)).Bool("head_moved", moved).Str("session_id", sessionID).Str("root", repoRoot).Msg("command line ranges recorded")
+}
+
+// commandCommits returns the commits that a shell command wrote itself, from
+// the HEAD reflog entries that it added. It returns nil when the pre hook saved
+// no reflog size or the reflog cannot be read.
+func commandCommits(repoRoot string, pre preCommand, newHead string, log zerolog.Logger) []tracegit.ReflogEntry {
+	if !pre.hasReflog {
+		return nil
+	}
+
+	entries, err := tracegit.HeadReflogSince(repoRoot, pre.reflogSize)
+	if err != nil {
+		log.Debug().Err(err).Str("root", repoRoot).Msg("post-command: cannot read the HEAD reflog; no commit of the command counts")
+		return nil
+	}
+
+	return attribution.OwnCommits(pre.head, newHead, entries)
 }
 
 // editRecord converts a computed edit into its ledger record.
diff --git a/app/cli/pkg/action/trace_line_attribution_test.go b/app/cli/pkg/action/trace_line_attribution_test.go
index 12ea3922a..aec00d6cc 100644
--- a/app/cli/pkg/action/trace_line_attribution_test.go
+++ b/app/cli/pkg/action/trace_line_attribution_test.go
@@ -655,9 +655,13 @@ func (r *lineRepo) shellWrite(sessionID string, run func()) {
 	require.NoError(r.t, err)
 	heads, err := r.store.LoadShellPreHeads(key)
 	require.NoError(r.t, err)
-	base := heads[r.dir]
-	require.NotEmpty(r.t, base, "the pre hook saves the HEAD commit")
-	recordRootChanges(r.store, r.dir, base, sigs[r.dir], sessionID, zerolog.Nop())
+	reflogs, err := r.store.LoadShellPreReflog(key)
+	require.NoError(r.t, err)
+	pre := preCommand{head: heads[r.dir]}
+	pre.reflogSize, pre.hasReflog = reflogs[r.dir]
+	require.NotEmpty(r.t, pre.head, "the pre hook saves the HEAD commit")
+	require.True(r.t, pre.hasReflog, "the pre hook saves the HEAD reflog size")
+	recordRootChanges(r.store, r.dir, pre, sigs[r.dir], sessionID, zerolog.Nop())
 	r.store.DeleteShellPreSignature(key)
 }
 
@@ -693,6 +697,129 @@ func TestLineAttribution_ShellCommandThatCommits(t *testing.T) {
 	assert.Equal(t, 2, attr.Written["a.go"].Len())
 }
 
+// divergedRepo returns a repository on branch feature, with one human commit,
+// and a main branch that rewrote big.txt and added other.txt since.
+func divergedRepo(t *testing.T) *lineRepo {
+	t.Helper()
+	r := newLineRepo(t)
+
+	r.humanWrite("big.txt", content(numbered("old", 100)))
+	r.commit("chore: big", "big.txt")
+
+	runGit(t, r.dir, "checkout", "-q", "-b", "feature")
+	r.humanWrite("wire_gen.go", "package main\n")
+	r.commit("feat: wire", "wire_gen.go")
+
+	runGit(t, r.dir, "checkout", "-q", "main")
+	r.humanWrite("big.txt", content(numbered("new", 100)))
+	r.humanWrite("other.txt", content(numbered("other", 50)))
+	r.commit("chore: upstream", "big.txt", "other.txt")
+	runGit(t, r.dir, "checkout", "-q", "feature")
+
+	return r
+}
+
+// A shell command that moves HEAD to commits that it did not write records
+// none of their lines (PFM-8131). Only the lines that the command wrote count.
+func TestLineAttribution_ShellHeadMoveRecordsNoUpstreamLines(t *testing.T) {
+	tests := []struct {
+		name string
+		run  func(t *testing.T, r *lineRepo)
+		// wantAdded and wantRemoved are the generated lines of the session.
+		wantAdded, wantRemoved int
+		// wantFiles are the files in the ledger of the session.
+		wantFiles []string
+	}{
+		{
+			name: "rebase, then a regenerated file",
+			run: func(t *testing.T, r *lineRepo) {
+				r.shellWrite(lineSession, func() { runGit(t, r.dir, "rebase", "-q", "main") })
+				r.shellWrite(lineSession, func() { r.humanWrite("wire_gen.go", "package main\n\nfunc a() {}\n") })
+			},
+			wantAdded: 2, wantFiles: []string{"wire_gen.go"},
+		},
+		{
+			name: "rebase and a change in one command",
+			run: func(t *testing.T, r *lineRepo) {
+				r.shellWrite(lineSession, func() {
+					runGit(t, r.dir, "rebase", "-q", "main")
+					r.humanWrite("wire_gen.go", "package main\n\nfunc a() {}\n")
+				})
+			},
+			wantAdded: 2, wantFiles: []string{"wire_gen.go"},
+		},
+		{
+			name: "merge commit",
+			run: func(t *testing.T, r *lineRepo) {
+				r.shellWrite(lineSession, func() { runGit(t, r.dir, "merge", "-q", "--no-edit", "main") })
+			},
+		},
+		{
+			name: "fast-forward",
+			run: func(t *testing.T, r *lineRepo) {
+				runGit(t, r.dir, "checkout", "-q", "-b", "behind", "main~1")
+				r.shellWrite(lineSession, func() { runGit(t, r.dir, "merge", "-q", "--ff-only", "main") })
+			},
+		},
+		{
+			name: "checkout of another branch",
+			run: func(t *testing.T, r *lineRepo) {
+				r.shellWrite(lineSession, func() { runGit(t, r.dir, "checkout", "-q", "main") })
+			},
+		},
+		{
+			name: "hard reset",
+			run: func(t *testing.T, r *lineRepo) {
+				r.shellWrite(lineSession, func() { runGit(t, r.dir, "reset", "-q", "--hard", "main") })
+			},
+		},
+		{
+			name: "a commit of the command, then a rebase",
+			run: func(t *testing.T, r *lineRepo) {
+				r.shellWrite(lineSession, func() {
+					r.humanWrite("a.go", "one\ntwo\n")
+					runGit(t, r.dir, "add", "a.go")
+					runGit(t, r.dir, "commit", "-q", "-m", "feat: a")
+					runGit(t, r.dir, "rebase", "-q", "main")
+				})
+			},
+			wantAdded: 2, wantFiles: []string{"a.go"},
+		},
+		{
+			name: "an amend of a human commit",
+			run: func(t *testing.T, r *lineRepo) {
+				r.shellWrite(lineSession, func() {
+					r.humanWrite("wire_gen.go", "package main\n\nfunc a() {}\n")
+					runGit(t, r.dir, "commit", "-q", "-a", "--amend", "--no-edit")
+				})
+			},
+			wantAdded: 2, wantFiles: []string{"wire_gen.go"},
+		},
+		{
+			name: "rebase without a reflog",
+			run: func(t *testing.T, r *lineRepo) {
+				runGit(t, r.dir, "config", "core.logAllRefUpdates", "false")
+				r.shellWrite(lineSession, func() { runGit(t, r.dir, "rebase", "-q", "main") })
+			},
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			r := divergedRepo(t)
+			tc.run(t, r)
+
+			attr := r.store.LoadAILineAttribution(lineSession)
+			assert.Equal(t, tc.wantAdded, attr.GeneratedAdded, "generated lines added")
+			assert.Equal(t, tc.wantRemoved, attr.GeneratedRemoved, "generated lines removed")
+			var files []string
+			for f := range attr.Files {
+				files = append(files, f)
+			}
+			assert.ElementsMatch(t, tc.wantFiles, files)
+		})
+	}
+}
+
 // R-011: the ledger keeps the lines that every agent edit added and removed,
 // also the ones that never reach a commit.
 func TestLineAttribution_GeneratedLines(t *testing.T) {

From b76412a4fcfa3b960b923e27bad484c51a44b07f Mon Sep 17 00:00:00 2001
From: Jose Ignacio Paris Prieto <jiparis@chainloop.dev>
Date: Wed, 4 Nov 2026 12:13:18 +0100
Subject: [PATCH 2/6] fix(trace): address review of shell HEAD-move attribution

Read the reflog of reftable repositories, require the reflog entries of
a command to be continuous, credit the first commit of a checkout with
no previous commit, and fix lint findings.

Assisted-by: Claude Code
Signed-off-by: Jose Ignacio Paris Prieto <jiparis@chainloop.dev>

Chainloop-Trace-Sessions: 66252f01-6f1c-4e49-b41b-d21335c39743
---
 app/cli/internal/trace/README.md              |   2 +-
 app/cli/internal/trace/attribution/shell.go   |  19 ++-
 .../internal/trace/attribution/shell_test.go  |  24 +++-
 app/cli/internal/trace/git/reflog.go          | 117 ++++++++++++++++--
 app/cli/internal/trace/git/reflog_test.go     | 116 +++++++++++------
 app/cli/pkg/action/trace_agent_hook.go        |  13 +-
 .../pkg/action/trace_line_attribution_test.go |  35 ++++--
 7 files changed, 258 insertions(+), 68 deletions(-)

diff --git a/app/cli/internal/trace/README.md b/app/cli/internal/trace/README.md
index fa947575c..38deaed8c 100644
--- a/app/cli/internal/trace/README.md
+++ b/app/cli/internal/trace/README.md
@@ -94,7 +94,7 @@ Why not Yes:
 - **Net contribution and line ranges, all agents:** the push finds the last writer of each line with `git blame`. A later commit that only re-indents a line takes the line, because blame sees a change. For Cursor, the limits of line attribution apply too.
 - **Session updates, all agents:** the update works only in the clone where the work happened, while the CLI keeps the trace state of the session (30 days), and only when the commits of the session are on the branch that the push sends. The push reads only the commits that are not on the default branch of the remote (`origin/HEAD`, or else `origin/main` or `origin/master`). After the commits of a session are pushed to that branch, a later commit does not update the session.
 - **Renames and rewrites, all agents:** this works only in the clone where the work happened. Git finds a rename only when the file keeps at least half of its content. Two pushed commits can rename a file one after the other. A later change to the file under its middle name does not send the session again. A rename inside an amend or a squash of the session commit loses the AI lines: the new commit creates the file under its new name, so no line of it matches the trace state (issue 3686). The limits of session updates apply too. For Cursor, the limits of line attribution apply too.
-- **Shell changes attribution, all agents:** the hook before a shell command records only a hash of each file, not its content. The command's changes are the commits that it wrote itself, each against the `HEAD` it replaced, plus the worktree against the `HEAD` after the command. The `HEAD` reflog tells the command's own commits apart from moves to commits that it did not write, such as a rebase, a pull, a merge, a checkout or a reset: lines that such a move brings in do not count (PFM-8131). When the reflog is off or cannot be read, no commit of the command counts. Uncommitted lines that an earlier agent edit recorded are not recorded again, but uncommitted human lines of a file that the command changes count as AI.
+- **Shell changes attribution, all agents:** the hook before a shell command records only a hash of each file, not its content. The command's changes are the commits that it wrote itself, each against the `HEAD` it replaced, plus the worktree against the `HEAD` after the command. The `HEAD` reflog tells the command's own commits apart from moves to commits that it did not write, such as a rebase, a pull, a merge, a checkout or a reset: lines that such a move brings in do not count (PFM-8131). Both the files and the reftable ref storage are read. When the reflog is off, rewritten, or does not lead from the old `HEAD` to the new one, no commit of the command counts. Uncommitted lines that an earlier agent edit recorded are not recorded again, but uncommitted human lines of a file that the command changes count as AI.
 
 ## User experience
 
diff --git a/app/cli/internal/trace/attribution/shell.go b/app/cli/internal/trace/attribution/shell.go
index 23dad01d7..3b28cc073 100644
--- a/app/cli/internal/trace/attribution/shell.go
+++ b/app/cli/internal/trace/attribution/shell.go
@@ -33,13 +33,24 @@ var ownCommitPrefixes = []string{"commit: ", "commit (amend): ", "commit (initia
 // the command wrote. Every other move, such as a rebase, a pull, a merge, a
 // checkout or a reset, points HEAD at content that the command did not write.
 //
-// It returns nil when entries do not lead from oldHead to newHead: the reflog
-// then does not tell the whole story of the command, and none of its moves can
-// be trusted.
+// An empty oldHead is a checkout with no commit before the command, which the
+// reflog shows as the zero ID.
+//
+// It returns nil when entries do not lead from oldHead to newHead, each entry
+// starting where the one before it ended: the reflog then does not tell the
+// whole story of the command, and none of its moves can be trusted.
 func OwnCommits(oldHead, newHead string, entries []tracegit.ReflogEntry) []tracegit.ReflogEntry {
-	if len(entries) == 0 || entries[0].Old != oldHead || entries[len(entries)-1].New != newHead {
+	if len(entries) == 0 || entries[len(entries)-1].New != newHead {
+		return nil
+	}
+	if first := entries[0].Old; first != oldHead && (oldHead != "" || !tracegit.IsZeroOID(first)) {
 		return nil
 	}
+	for i := 1; i < len(entries); i++ {
+		if entries[i].Old != entries[i-1].New {
+			return nil
+		}
+	}
 
 	var own []tracegit.ReflogEntry
 	for _, e := range entries {
diff --git a/app/cli/internal/trace/attribution/shell_test.go b/app/cli/internal/trace/attribution/shell_test.go
index 7fcd72abc..e946ba295 100644
--- a/app/cli/internal/trace/attribution/shell_test.go
+++ b/app/cli/internal/trace/attribution/shell_test.go
@@ -23,9 +23,10 @@ import (
 )
 
 func TestOwnCommits(t *testing.T) {
-	entry := func(old, new, msg string) tracegit.ReflogEntry {
-		return tracegit.ReflogEntry{Old: old, New: new, Message: msg}
+	entry := func(oldOID, newOID, msg string) tracegit.ReflogEntry {
+		return tracegit.ReflogEntry{Old: oldOID, New: newOID, Message: msg}
 	}
+	zero := "0000000000000000000000000000000000000000"
 
 	tests := []struct {
 		name    string
@@ -95,6 +96,25 @@ func TestOwnCommits(t *testing.T) {
 			oldHead: "a", newHead: "z",
 			entries: []tracegit.ReflogEntry{entry("a", "c", "commit: feat")},
 		},
+		{
+			name:    "entries with a gap between them",
+			oldHead: "a", newHead: "d",
+			entries: []tracegit.ReflogEntry{
+				entry("a", "b", "commit: one"),
+				entry("c", "d", "commit: two"),
+			},
+		},
+		{
+			name:    "the first commit of a checkout with no commit",
+			oldHead: "", newHead: "b",
+			entries: []tracegit.ReflogEntry{entry(zero, "b", "commit (initial): first")},
+			want:    []tracegit.ReflogEntry{entry(zero, "b", "commit (initial): first")},
+		},
+		{
+			name:    "no old HEAD and a first entry that replaces a commit",
+			oldHead: "", newHead: "b",
+			entries: []tracegit.ReflogEntry{entry("a", "b", "commit: feat")},
+		},
 	}
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {
diff --git a/app/cli/internal/trace/git/reflog.go b/app/cli/internal/trace/git/reflog.go
index 780f912d0..0275e0fbc 100644
--- a/app/cli/internal/trace/git/reflog.go
+++ b/app/cli/internal/trace/git/reflog.go
@@ -17,11 +17,14 @@ package git
 
 import (
 	"bufio"
+	"bytes"
 	"errors"
 	"fmt"
 	"io"
 	"os"
+	"os/exec"
 	"path/filepath"
+	"slices"
 	"strings"
 )
 
@@ -39,26 +42,56 @@ type ReflogEntry struct {
 	Message string
 }
 
-// headReflogPath returns the HEAD reflog of the checkout at repoRoot. A linked
-// worktree has its own HEAD, and its own reflog in its private git dir.
-func headReflogPath(repoRoot string) (string, error) {
+// IsZeroOID reports whether oid is the all-zero object ID that a reflog
+// entry holds for "no commit", as the old side of the first commit.
+func IsZeroOID(oid string) bool {
+	return oid != "" && strings.Trim(oid, "0") == ""
+}
+
+// headReflog locates the HEAD reflog of the checkout at repoRoot. A linked
+// worktree has its own HEAD, and its own reflog. With the files ref storage
+// the reflog is the file logs/HEAD in the checkout's git dir. With the
+// reftable ref storage (extensions.refStorage) it lives in binary tables that
+// only git reads, and reftable is true.
+func headReflog(repoRoot string) (path string, reftable bool, err error) {
 	gitDir, _, err := FindGitDirAndRootFrom(repoRoot)
 	if err != nil {
-		return "", err
+		return "", false, err
 	}
 
-	return filepath.Join(gitDir, "logs", "HEAD"), nil
+	commonDir := gitDir
+	if data, err := os.ReadFile(filepath.Join(gitDir, "commondir")); err == nil {
+		commonDir = strings.TrimSpace(string(data))
+		if !filepath.IsAbs(commonDir) {
+			commonDir = filepath.Join(gitDir, commonDir)
+		}
+	}
+	if fi, err := os.Stat(filepath.Join(commonDir, "reftable")); err == nil && fi.IsDir() {
+		return "", true, nil
+	}
+
+	return filepath.Join(gitDir, "logs", "HEAD"), false, nil
 }
 
-// HeadReflogSize returns the size in bytes of the HEAD reflog of the checkout
-// at repoRoot, zero when it has none yet. Taken before a command, it marks
-// where the entries that the command writes start. It only stats the file, so
-// it is cheap enough for a hook that runs before every shell command.
+// HeadReflogSize returns the position of the end of the HEAD reflog of the
+// checkout at repoRoot, zero when it has none yet. Taken before a command, it
+// marks where the entries that the command writes start. With the files ref
+// storage it is the size of the reflog in bytes: a stat, cheap enough for a
+// hook that runs before every shell command. With reftable it is the number of
+// entries, which git has to count.
 func HeadReflogSize(repoRoot string) (int64, error) {
-	path, err := headReflogPath(repoRoot)
+	path, reftable, err := headReflog(repoRoot)
 	if err != nil {
 		return 0, err
 	}
+	if reftable {
+		entries, err := gitHeadReflog(repoRoot)
+		if err != nil {
+			return 0, err
+		}
+
+		return int64(len(entries)), nil
+	}
 
 	fi, err := os.Stat(path)
 	if errors.Is(err, os.ErrNotExist) {
@@ -71,14 +104,17 @@ func HeadReflogSize(repoRoot string) (int64, error) {
 	return fi.Size(), nil
 }
 
-// HeadReflogSince returns the HEAD reflog entries written after offset, a size
-// that HeadReflogSize returned earlier, oldest first. It returns
+// HeadReflogSince returns the HEAD reflog entries written after offset, a
+// position that HeadReflogSize returned earlier, oldest first. It returns
 // ErrReflogRewritten when the reflog is now shorter than offset.
 func HeadReflogSince(repoRoot string, offset int64) ([]ReflogEntry, error) {
-	path, err := headReflogPath(repoRoot)
+	path, reftable, err := headReflog(repoRoot)
 	if err != nil {
 		return nil, err
 	}
+	if reftable {
+		return gitHeadReflogSince(repoRoot, offset)
+	}
 
 	f, err := os.Open(path)
 	if errors.Is(err, os.ErrNotExist) {
@@ -121,6 +157,61 @@ func HeadReflogSince(repoRoot string, offset int64) ([]ReflogEntry, error) {
 	return entries, nil
 }
 
+// gitHeadReflog returns the HEAD reflog entries through git, newest first, for
+// a ref storage that only git reads. git prints the commit that each entry
+// moved HEAD to, not the one it left. The old side of an entry is then the new
+// side of the entry before it, or the zero ID for the first one. An unborn
+// HEAD with no reflog yet has no entries.
+func gitHeadReflog(repoRoot string) ([]ReflogEntry, error) {
+	cmd := exec.Command("git", "reflog", "show", "--format=%H%x09%gs", "HEAD", "--")
+	cmd.Dir = repoRoot
+	var stderr bytes.Buffer
+	cmd.Stderr = &stderr
+	out, err := cmd.Output()
+	if err != nil {
+		if hasHead := exec.Command("git", "-C", repoRoot, "rev-parse", "--verify", "-q", "HEAD").Run() == nil; !hasHead {
+			return nil, nil
+		}
+
+		return nil, fmt.Errorf("git reflog HEAD: %w: %s", err, strings.TrimSpace(stderr.String()))
+	}
+
+	var entries []ReflogEntry
+	for line := range strings.Lines(string(out)) {
+		newOID, msg, ok := strings.Cut(strings.TrimSuffix(line, "\n"), "\t")
+		if !ok {
+			return nil, fmt.Errorf("parse git reflog line %q", line)
+		}
+		entries = append(entries, ReflogEntry{New: newOID, Message: msg})
+	}
+	for i := range entries {
+		if i+1 < len(entries) {
+			entries[i].Old = entries[i+1].New
+		} else {
+			entries[i].Old = strings.Repeat("0", len(entries[i].New))
+		}
+	}
+
+	return entries, nil
+}
+
+// gitHeadReflogSince is HeadReflogSince for a ref storage that only git reads,
+// where offset is a number of entries.
+func gitHeadReflogSince(repoRoot string, offset int64) ([]ReflogEntry, error) {
+	all, err := gitHeadReflog(repoRoot)
+	if err != nil {
+		return nil, err
+	}
+	if int64(len(all)) < offset {
+		return nil, ErrReflogRewritten
+	}
+
+	added := all[:int64(len(all))-offset]
+	slices.Reverse(added)
+
+	return added, nil
+}
+
 // parseReflogLine parses one reflog line:
 // "<old> <new> <name> <<email>> <time> <tz>\t<message>".
 func parseReflogLine(line string) (ReflogEntry, bool) {
diff --git a/app/cli/internal/trace/git/reflog_test.go b/app/cli/internal/trace/git/reflog_test.go
index c7e03e5f7..0dcfc1803 100644
--- a/app/cli/internal/trace/git/reflog_test.go
+++ b/app/cli/internal/trace/git/reflog_test.go
@@ -26,13 +26,13 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func reflogRepo(t *testing.T) string {
+func reflogRepo(t *testing.T, initArgs ...string) string {
 	t.Helper()
 	if _, err := exec.LookPath("git"); err != nil {
 		t.Skip("git binary not found")
 	}
 	dir := t.TempDir()
-	reflogGit(t, dir, "init", "-q", "-b", "main")
+	reflogGit(t, dir, append([]string{"init", "-q", "-b", "main"}, initArgs...)...)
 	reflogGit(t, dir, "config", "user.email", "test@example.com")
 	reflogGit(t, dir, "config", "user.name", "Test")
 	reflogGit(t, dir, "config", "commit.gpgsign", "false")
@@ -59,45 +59,91 @@ func reflogCommit(t *testing.T, dir, file, text, msg string) string {
 	return reflogGit(t, dir, "rev-parse", "HEAD")
 }
 
-func TestHeadReflogSince(t *testing.T) {
-	dir := reflogRepo(t)
-
-	// No commit yet: there is no reflog, and its size is zero.
-	size, err := HeadReflogSize(dir)
-	require.NoError(t, err)
-	assert.Zero(t, size)
-
-	first := reflogCommit(t, dir, "a.txt", "a\n", "first")
-	size, err = HeadReflogSize(dir)
-	require.NoError(t, err)
-	require.Positive(t, size)
-
-	second := reflogCommit(t, dir, "a.txt", "b\n", "second")
-	reflogGit(t, dir, "checkout", "-q", "-b", "other", first)
+// reftableSupported reports whether the git binary can create a repository
+// with the reftable ref storage (git 2.45 and later).
+func reftableSupported(t *testing.T) bool {
+	t.Helper()
+	cmd := exec.Command("git", "init", "-q", "--ref-format=reftable", t.TempDir())
 
-	entries, err := HeadReflogSince(dir, size)
-	require.NoError(t, err)
-	require.Len(t, entries, 2, "only the entries written after the size was taken")
-	assert.Equal(t, ReflogEntry{Old: first, New: second, Message: "commit: second"}, entries[0])
-	assert.Equal(t, second, entries[1].Old)
-	assert.Equal(t, first, entries[1].New)
-	assert.True(t, strings.HasPrefix(entries[1].Message, "checkout: moving from main to other"), entries[1].Message)
-
-	// Nothing written since the current size.
-	now, err := HeadReflogSize(dir)
-	require.NoError(t, err)
-	entries, err = HeadReflogSince(dir, now)
-	require.NoError(t, err)
-	assert.Empty(t, entries)
+	return cmd.Run() == nil
+}
 
-	// A reflog that is now shorter than the offset was rewritten.
-	_, err = HeadReflogSince(dir, now+1)
-	assert.ErrorIs(t, err, ErrReflogRewritten)
+func TestHeadReflogSince(t *testing.T) {
+	tests := []struct {
+		name     string
+		initArgs []string
+		reftable bool
+	}{
+		{name: "files ref storage"},
+		{name: "reftable ref storage", initArgs: []string{"--ref-format=reftable"}, reftable: true},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			if tc.reftable && !reftableSupported(t) {
+				t.Skip("git does not support reftable")
+			}
+			dir := reflogRepo(t, tc.initArgs...)
+
+			// No commit yet: the reflog is empty.
+			start, err := HeadReflogSize(dir)
+			require.NoError(t, err)
+			assert.Zero(t, start)
+
+			first := reflogCommit(t, dir, "a.txt", "a\n", "first")
+			size, err := HeadReflogSize(dir)
+			require.NoError(t, err)
+			require.Positive(t, size)
+
+			entries, err := HeadReflogSince(dir, start)
+			require.NoError(t, err)
+			require.Len(t, entries, 1)
+			assert.Equal(t, first, entries[0].New)
+			assert.Equal(t, "commit (initial): first", entries[0].Message)
+			assert.True(t, IsZeroOID(entries[0].Old), "the first commit replaces no commit: %q", entries[0].Old)
+
+			second := reflogCommit(t, dir, "a.txt", "b\n", "second")
+			reflogGit(t, dir, "checkout", "-q", "-b", "other", first)
+
+			entries, err = HeadReflogSince(dir, size)
+			require.NoError(t, err)
+			require.Len(t, entries, 2, "only the entries written after the size was taken")
+			assert.Equal(t, ReflogEntry{Old: first, New: second, Message: "commit: second"}, entries[0])
+			assert.Equal(t, second, entries[1].Old)
+			assert.Equal(t, first, entries[1].New)
+			assert.True(t, strings.HasPrefix(entries[1].Message, "checkout: moving from main to other"), entries[1].Message)
+
+			// Nothing written since the current size.
+			now, err := HeadReflogSize(dir)
+			require.NoError(t, err)
+			entries, err = HeadReflogSince(dir, now)
+			require.NoError(t, err)
+			assert.Empty(t, entries)
+
+			// A reflog that is now shorter than the offset was rewritten.
+			_, err = HeadReflogSince(dir, now+1)
+			assert.ErrorIs(t, err, ErrReflogRewritten)
+		})
+	}
 }
 
 // A linked worktree has its own HEAD reflog.
 func TestHeadReflogSince_LinkedWorktree(t *testing.T) {
-	dir := reflogRepo(t)
+	for _, reftable := range []bool{false, true} {
+		t.Run(map[bool]string{false: "files", true: "reftable"}[reftable], func(t *testing.T) {
+			var initArgs []string
+			if reftable {
+				if !reftableSupported(t) {
+					t.Skip("git does not support reftable")
+				}
+				initArgs = []string{"--ref-format=reftable"}
+			}
+			testLinkedWorktreeReflog(t, reflogRepo(t, initArgs...))
+		})
+	}
+}
+
+func testLinkedWorktreeReflog(t *testing.T, dir string) {
+	t.Helper()
 	reflogCommit(t, dir, "a.txt", "a\n", "first")
 
 	wt := filepath.Join(t.TempDir(), "wt")
diff --git a/app/cli/pkg/action/trace_agent_hook.go b/app/cli/pkg/action/trace_agent_hook.go
index e75bf3b94..47dbef38f 100644
--- a/app/cli/pkg/action/trace_agent_hook.go
+++ b/app/cli/pkg/action/trace_agent_hook.go
@@ -937,7 +937,8 @@ func recordCommandLineRanges(provider trace.Provider, input *trace.HookInput, st
 // shell command.
 type preCommand struct {
 	// head is the HEAD commit. It is empty when the pre hook saved none: a
-	// checkout with no commit yet, or a pre hook from an older CLI.
+	// checkout with no commit yet (hasReflog is then true), or a pre hook
+	// from an older CLI.
 	head string
 	// reflogSize is the size of the HEAD reflog. hasReflog is false when the
 	// pre hook saved none.
@@ -973,10 +974,16 @@ func recordRootChanges(store *state.Store, repoRoot string, pre preCommand, befo
 		return
 	}
 
+	// A pre hook from an older CLI saved neither a HEAD nor a reflog size: the
+	// HEAD after the command stands in, as before. A pre hook that saved a
+	// reflog size and no HEAD saw a checkout with no commit yet, so a HEAD
+	// now is a move, and the first commit can be the command's own.
 	head, moved := "HEAD", false
 	var own []tracegit.ReflogEntry
-	if pre.head != "" {
-		head = pre.head
+	if pre.head != "" || pre.hasReflog {
+		if pre.head != "" {
+			head = pre.head
+		}
 		if sha, _, err := client.CommitHeadInfo(repoRoot); err == nil && sha != pre.head {
 			head, moved = sha, true
 			own = commandCommits(repoRoot, pre, sha, log)
diff --git a/app/cli/pkg/action/trace_line_attribution_test.go b/app/cli/pkg/action/trace_line_attribution_test.go
index aec00d6cc..8f40705bf 100644
--- a/app/cli/pkg/action/trace_line_attribution_test.go
+++ b/app/cli/pkg/action/trace_line_attribution_test.go
@@ -659,7 +659,6 @@ func (r *lineRepo) shellWrite(sessionID string, run func()) {
 	require.NoError(r.t, err)
 	pre := preCommand{head: heads[r.dir]}
 	pre.reflogSize, pre.hasReflog = reflogs[r.dir]
-	require.NotEmpty(r.t, pre.head, "the pre hook saves the HEAD commit")
 	require.True(r.t, pre.hasReflog, "the pre hook saves the HEAD reflog size")
 	recordRootChanges(r.store, r.dir, pre, sigs[r.dir], sessionID, zerolog.Nop())
 	r.store.DeleteShellPreSignature(key)
@@ -697,6 +696,9 @@ func TestLineAttribution_ShellCommandThatCommits(t *testing.T) {
 	assert.Equal(t, 2, attr.Written["a.go"].Len())
 }
 
+// wireGenFile is a file that a code generator rewrites.
+const wireGenFile = "wire_gen.go"
+
 // divergedRepo returns a repository on branch feature, with one human commit,
 // and a main branch that rewrote big.txt and added other.txt since.
 func divergedRepo(t *testing.T) *lineRepo {
@@ -707,8 +709,8 @@ func divergedRepo(t *testing.T) *lineRepo {
 	r.commit("chore: big", "big.txt")
 
 	runGit(t, r.dir, "checkout", "-q", "-b", "feature")
-	r.humanWrite("wire_gen.go", "package main\n")
-	r.commit("feat: wire", "wire_gen.go")
+	r.humanWrite(wireGenFile, "package main\n")
+	r.commit("feat: wire", wireGenFile)
 
 	runGit(t, r.dir, "checkout", "-q", "main")
 	r.humanWrite("big.txt", content(numbered("new", 100)))
@@ -734,19 +736,19 @@ func TestLineAttribution_ShellHeadMoveRecordsNoUpstreamLines(t *testing.T) {
 			name: "rebase, then a regenerated file",
 			run: func(t *testing.T, r *lineRepo) {
 				r.shellWrite(lineSession, func() { runGit(t, r.dir, "rebase", "-q", "main") })
-				r.shellWrite(lineSession, func() { r.humanWrite("wire_gen.go", "package main\n\nfunc a() {}\n") })
+				r.shellWrite(lineSession, func() { r.humanWrite(wireGenFile, "package main\n\nfunc a() {}\n") })
 			},
-			wantAdded: 2, wantFiles: []string{"wire_gen.go"},
+			wantAdded: 2, wantFiles: []string{wireGenFile},
 		},
 		{
 			name: "rebase and a change in one command",
 			run: func(t *testing.T, r *lineRepo) {
 				r.shellWrite(lineSession, func() {
 					runGit(t, r.dir, "rebase", "-q", "main")
-					r.humanWrite("wire_gen.go", "package main\n\nfunc a() {}\n")
+					r.humanWrite(wireGenFile, "package main\n\nfunc a() {}\n")
 				})
 			},
-			wantAdded: 2, wantFiles: []string{"wire_gen.go"},
+			wantAdded: 2, wantFiles: []string{wireGenFile},
 		},
 		{
 			name: "merge commit",
@@ -789,11 +791,11 @@ func TestLineAttribution_ShellHeadMoveRecordsNoUpstreamLines(t *testing.T) {
 			name: "an amend of a human commit",
 			run: func(t *testing.T, r *lineRepo) {
 				r.shellWrite(lineSession, func() {
-					r.humanWrite("wire_gen.go", "package main\n\nfunc a() {}\n")
+					r.humanWrite(wireGenFile, "package main\n\nfunc a() {}\n")
 					runGit(t, r.dir, "commit", "-q", "-a", "--amend", "--no-edit")
 				})
 			},
-			wantAdded: 2, wantFiles: []string{"wire_gen.go"},
+			wantAdded: 2, wantFiles: []string{wireGenFile},
 		},
 		{
 			name: "rebase without a reflog",
@@ -802,6 +804,19 @@ func TestLineAttribution_ShellHeadMoveRecordsNoUpstreamLines(t *testing.T) {
 				r.shellWrite(lineSession, func() { runGit(t, r.dir, "rebase", "-q", "main") })
 			},
 		},
+		{
+			name: "the first commit of a checkout with no commit",
+			run: func(t *testing.T, r *lineRepo) {
+				runGit(t, r.dir, "checkout", "-q", "--orphan", "fresh")
+				runGit(t, r.dir, "rm", "-rfq", ".")
+				r.shellWrite(lineSession, func() {
+					r.humanWrite("a.go", "one\ntwo\n")
+					runGit(t, r.dir, "add", "a.go")
+					runGit(t, r.dir, "commit", "-q", "-m", "feat: a")
+				})
+			},
+			wantAdded: 2, wantFiles: []string{"a.go"},
+		},
 	}
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {
@@ -811,7 +826,7 @@ func TestLineAttribution_ShellHeadMoveRecordsNoUpstreamLines(t *testing.T) {
 			attr := r.store.LoadAILineAttribution(lineSession)
 			assert.Equal(t, tc.wantAdded, attr.GeneratedAdded, "generated lines added")
 			assert.Equal(t, tc.wantRemoved, attr.GeneratedRemoved, "generated lines removed")
-			var files []string
+			files := make([]string, 0, len(attr.Files))
 			for f := range attr.Files {
 				files = append(files, f)
 			}

From 066c66f2ee10bf2557e86d8a3906b8408aade968 Mon Sep 17 00:00:00 2001
From: Jose Ignacio Paris Prieto <jiparis@chainloop.dev>
Date: Wed, 4 Nov 2026 12:23:51 +0100
Subject: [PATCH 3/6] fix(trace): annotate gosec false positives in reflog
 reading

Assisted-by: Claude Code
Signed-off-by: Jose Ignacio Paris Prieto <jiparis@chainloop.dev>

Chainloop-Trace-Sessions: 66252f01-6f1c-4e49-b41b-d21335c39743
---
 app/cli/internal/trace/git/reflog.go      | 2 +-
 app/cli/internal/trace/git/reflog_test.go | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/cli/internal/trace/git/reflog.go b/app/cli/internal/trace/git/reflog.go
index 0275e0fbc..cdb32c427 100644
--- a/app/cli/internal/trace/git/reflog.go
+++ b/app/cli/internal/trace/git/reflog.go
@@ -66,7 +66,7 @@ func headReflog(repoRoot string) (path string, reftable bool, err error) {
 			commonDir = filepath.Join(gitDir, commonDir)
 		}
 	}
-	if fi, err := os.Stat(filepath.Join(commonDir, "reftable")); err == nil && fi.IsDir() {
+	if fi, err := os.Stat(filepath.Join(commonDir, "reftable")); err == nil && fi.IsDir() { //nolint:gosec // the common dir that git wrote for this checkout
 		return "", true, nil
 	}
 
diff --git a/app/cli/internal/trace/git/reflog_test.go b/app/cli/internal/trace/git/reflog_test.go
index 0dcfc1803..ad127bb64 100644
--- a/app/cli/internal/trace/git/reflog_test.go
+++ b/app/cli/internal/trace/git/reflog_test.go
@@ -63,7 +63,7 @@ func reflogCommit(t *testing.T, dir, file, text, msg string) string {
 // with the reftable ref storage (git 2.45 and later).
 func reftableSupported(t *testing.T) bool {
 	t.Helper()
-	cmd := exec.Command("git", "init", "-q", "--ref-format=reftable", t.TempDir())
+	cmd := exec.Command("git", "init", "-q", "--ref-format=reftable", t.TempDir()) //nolint:gosec // a fixed git command on a test temp dir
 
 	return cmd.Run() == nil
 }

From dcfce8026cdb7e5cd976d1884800567e5da3c223 Mon Sep 17 00:00:00 2001
From: Jose Ignacio Paris Prieto <jiparis@chainloop.dev>
Date: Wed, 4 Nov 2026 12:35:24 +0100
Subject: [PATCH 4/6] fix(trace): do not see a HEAD move when the pre-command
 HEAD was not saved

The pre hook now saves an empty HEAD for a checkout with no commit, so the
post hook treats a missing HEAD as unknown, not as a checkout with no commit.

Assisted-by: Claude Code
Signed-off-by: Jose Ignacio Paris Prieto <jiparis@chainloop.dev>

Chainloop-Trace-Sessions: 66252f01-6f1c-4e49-b41b-d21335c39743
---
 app/cli/pkg/action/trace_agent_hook.go        | 24 ++++++++------
 .../pkg/action/trace_line_attribution_test.go | 32 ++++++++++++++++++-
 2 files changed, 46 insertions(+), 10 deletions(-)

diff --git a/app/cli/pkg/action/trace_agent_hook.go b/app/cli/pkg/action/trace_agent_hook.go
index 47dbef38f..e4f608077 100644
--- a/app/cli/pkg/action/trace_agent_hook.go
+++ b/app/cli/pkg/action/trace_agent_hook.go
@@ -457,6 +457,9 @@ func captureWorktreeSnapshot(store *state.Store, repoRoot string, key state.Shel
 		sigs[root] = sig
 
 		// A checkout with no commit yet has no HEAD; its files count as new.
+		// It is saved with an empty HEAD, so that the post hook can tell it
+		// apart from a HEAD that was not saved.
+		heads[root] = ""
 		if sha, _, err := client.CommitHeadInfo(root); err == nil {
 			heads[root] = sha
 		}
@@ -915,7 +918,8 @@ func recordCommandLineRanges(provider trace.Provider, input *trace.HookInput, st
 	}
 
 	for root, rootBefore := range before {
-		pre := preCommand{head: heads[root]}
+		var pre preCommand
+		pre.head, pre.hasHead = heads[root]
 		pre.reflogSize, pre.hasReflog = reflogs[root]
 
 		rootStore := store
@@ -936,10 +940,12 @@ func recordCommandLineRanges(provider trace.Provider, input *trace.HookInput, st
 // preCommand is the state of one checkout that the pre hook saved before a
 // shell command.
 type preCommand struct {
-	// head is the HEAD commit. It is empty when the pre hook saved none: a
-	// checkout with no commit yet (hasReflog is then true), or a pre hook
-	// from an older CLI.
+	// head is the HEAD commit. It is empty for a checkout with no commit
+	// yet, and when the pre hook saved none.
 	head string
+	// hasHead is false when the pre hook saved no HEAD for the checkout: a
+	// pre hook from an older CLI, or a heads file that cannot be read.
+	hasHead bool
 	// reflogSize is the size of the HEAD reflog. hasReflog is false when the
 	// pre hook saved none.
 	reflogSize int64
@@ -974,13 +980,13 @@ func recordRootChanges(store *state.Store, repoRoot string, pre preCommand, befo
 		return
 	}
 
-	// A pre hook from an older CLI saved neither a HEAD nor a reflog size: the
-	// HEAD after the command stands in, as before. A pre hook that saved a
-	// reflog size and no HEAD saw a checkout with no commit yet, so a HEAD
-	// now is a move, and the first commit can be the command's own.
+	// When the pre hook saved no HEAD, the HEAD after the command stands in,
+	// as before. A pre hook that saved an empty HEAD and a reflog size saw a
+	// checkout with no commit yet, so a HEAD now is a move, and the first
+	// commit can be the command's own.
 	head, moved := "HEAD", false
 	var own []tracegit.ReflogEntry
-	if pre.head != "" || pre.hasReflog {
+	if pre.head != "" || (pre.hasHead && pre.hasReflog) {
 		if pre.head != "" {
 			head = pre.head
 		}
diff --git a/app/cli/pkg/action/trace_line_attribution_test.go b/app/cli/pkg/action/trace_line_attribution_test.go
index 8f40705bf..920b298a7 100644
--- a/app/cli/pkg/action/trace_line_attribution_test.go
+++ b/app/cli/pkg/action/trace_line_attribution_test.go
@@ -657,8 +657,10 @@ func (r *lineRepo) shellWrite(sessionID string, run func()) {
 	require.NoError(r.t, err)
 	reflogs, err := r.store.LoadShellPreReflog(key)
 	require.NoError(r.t, err)
-	pre := preCommand{head: heads[r.dir]}
+	var pre preCommand
+	pre.head, pre.hasHead = heads[r.dir]
 	pre.reflogSize, pre.hasReflog = reflogs[r.dir]
+	require.True(r.t, pre.hasHead, "the pre hook saves the HEAD")
 	require.True(r.t, pre.hasReflog, "the pre hook saves the HEAD reflog size")
 	recordRootChanges(r.store, r.dir, pre, sigs[r.dir], sessionID, zerolog.Nop())
 	r.store.DeleteShellPreSignature(key)
@@ -696,6 +698,34 @@ func TestLineAttribution_ShellCommandThatCommits(t *testing.T) {
 	assert.Equal(t, 2, attr.Written["a.go"].Len())
 }
 
+// A pre hook whose HEAD commits were lost (the heads file is missing or
+// unreadable) but whose reflog size was saved does not see a HEAD move when
+// HEAD did not move: a file that the command restored to HEAD is still
+// recorded as AI-touched with zero lines.
+func TestLineAttribution_ShellLostHeadsIsNotAHeadMove(t *testing.T) {
+	r := newLineRepo(t)
+	r.humanWrite("a.go", "one\n")
+	r.commit("feat: a", "a.go")
+	r.humanWrite("a.go", "one\ntwo\n")
+
+	key := state.ShellCallKey{SessionID: lineSession, ToolUseID: "toolu"}
+	captureWorktreeSnapshot(r.store, r.dir, key, zerolog.Nop())
+	runGit(t, r.dir, "checkout", "--", "a.go")
+
+	sigs, err := r.store.LoadShellPreSignature(key)
+	require.NoError(t, err)
+	reflogs, err := r.store.LoadShellPreReflog(key)
+	require.NoError(t, err)
+	pre := preCommand{}
+	pre.reflogSize, pre.hasReflog = reflogs[r.dir]
+	require.True(t, pre.hasReflog)
+	recordRootChanges(r.store, r.dir, pre, sigs[r.dir], lineSession, zerolog.Nop())
+
+	attr := r.store.LoadAILineAttribution(lineSession)
+	assert.Contains(t, attr.Files, "a.go")
+	assert.Equal(t, 0, attr.GeneratedAdded)
+}
+
 // wireGenFile is a file that a code generator rewrites.
 const wireGenFile = "wire_gen.go"
 

From 0e4bba99389707c072966490092692a05a09b00b Mon Sep 17 00:00:00 2001
From: Jose Ignacio Paris Prieto <jiparis@chainloop.dev>
Date: Wed, 4 Nov 2026 13:27:43 +0100
Subject: [PATCH 5/6] perf(trace): cut git calls of shell HEAD-move attribution

Read files at commits through one git cat-file --batch process, and read
a file only at the own commits that changed it. With the reftable ref
storage, save the newest HEAD reflog entry before a shell command instead
of counting every entry, and read the reflog newest first until that entry.

Assisted-by: Claude Code
Signed-off-by: Jose Ignacio Paris Prieto <jiparis@chainloop.dev>

Chainloop-Trace-Sessions: 66252f01-6f1c-4e49-b41b-d21335c39743
---
 app/cli/internal/trace/git/blobs.go           | 118 ++++++++++++
 app/cli/internal/trace/git/reflog.go          | 173 ++++++++++++------
 app/cli/internal/trace/git/reflog_test.go     |  99 +++++++++-
 app/cli/internal/trace/state/snapshot.go      |  32 ++--
 app/cli/internal/trace/state/snapshot_test.go |  15 +-
 app/cli/pkg/action/trace_agent_hook.go        |  59 ++++--
 .../pkg/action/trace_line_attribution_test.go |  31 +++-
 7 files changed, 424 insertions(+), 103 deletions(-)
 create mode 100644 app/cli/internal/trace/git/blobs.go

diff --git a/app/cli/internal/trace/git/blobs.go b/app/cli/internal/trace/git/blobs.go
new file mode 100644
index 000000000..35fd2c4a6
--- /dev/null
+++ b/app/cli/internal/trace/git/blobs.go
@@ -0,0 +1,118 @@
+//
+// Copyright 2026 The Chainloop Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package git
+
+import (
+	"bufio"
+	"fmt"
+	"io"
+	"os/exec"
+	"strconv"
+	"strings"
+)
+
+// BlobReader reads files at commits through one long-running
+// "git cat-file --batch" process, so that many reads cost one process, not
+// several processes each. It is not safe for concurrent use.
+type BlobReader struct {
+	cmd *exec.Cmd
+	in  io.WriteCloser
+	out *bufio.Reader
+	// err is the first failure to talk to git. The output may then be out of
+	// step with the requests, so every later read fails too.
+	err error
+}
+
+// NewBlobReader starts a BlobReader for the repository at repoRoot. Close it
+// when done.
+func NewBlobReader(repoRoot string) (*BlobReader, error) {
+	cmd := exec.Command("git", "cat-file", "--batch")
+	cmd.Dir = repoRoot
+	in, err := cmd.StdinPipe()
+	if err != nil {
+		return nil, fmt.Errorf("git cat-file stdin: %w", err)
+	}
+	out, err := cmd.StdoutPipe()
+	if err != nil {
+		return nil, fmt.Errorf("git cat-file stdout: %w", err)
+	}
+	if err := cmd.Start(); err != nil {
+		return nil, fmt.Errorf("start git cat-file: %w", err)
+	}
+
+	return &BlobReader{cmd: cmd, in: in, out: bufio.NewReader(out)}, nil
+}
+
+// FileAt returns the content of path, repo-relative with forward slashes, at
+// rev. It returns nil when rev does not resolve or does not hold path as a
+// file.
+func (r *BlobReader) FileAt(rev, path string) ([]byte, error) {
+	if r.err != nil {
+		return nil, r.err
+	}
+	if strings.ContainsAny(rev+path, "\n") {
+		return nil, fmt.Errorf("cannot read %q at %q: name holds a newline", path, rev)
+	}
+
+	content, err := r.read(rev + ":" + path)
+	if err != nil {
+		r.err = err
+	}
+
+	return content, err
+}
+
+func (r *BlobReader) read(name string) ([]byte, error) {
+	if _, err := fmt.Fprintf(r.in, "%s\n", name); err != nil {
+		return nil, fmt.Errorf("write git cat-file request: %w", err)
+	}
+
+	header, err := r.out.ReadString('\n')
+	if err != nil {
+		return nil, fmt.Errorf("read git cat-file header: %w", err)
+	}
+	header = strings.TrimSuffix(header, "\n")
+	// "<name> missing" or "<name> ambiguous": the name can hold spaces.
+	if strings.HasSuffix(header, " missing") || strings.HasSuffix(header, " ambiguous") {
+		return nil, nil
+	}
+
+	// "<oid> <type> <size>", then the content and a newline.
+	fields := strings.Fields(header)
+	if len(fields) != 3 {
+		return nil, fmt.Errorf("unexpected git cat-file header %q", header)
+	}
+	size, err := strconv.Atoi(fields[2])
+	if err != nil {
+		return nil, fmt.Errorf("unexpected git cat-file header %q: %w", header, err)
+	}
+	content := make([]byte, size+1)
+	if _, err := io.ReadFull(r.out, content); err != nil {
+		return nil, fmt.Errorf("read git cat-file content: %w", err)
+	}
+	if fields[1] != "blob" {
+		return nil, nil
+	}
+
+	return content[:size], nil
+}
+
+// Close stops the git process.
+func (r *BlobReader) Close() error {
+	_ = r.in.Close()
+
+	return r.cmd.Wait()
+}
diff --git a/app/cli/internal/trace/git/reflog.go b/app/cli/internal/trace/git/reflog.go
index cdb32c427..5ad6693dd 100644
--- a/app/cli/internal/trace/git/reflog.go
+++ b/app/cli/internal/trace/git/reflog.go
@@ -25,12 +25,13 @@ import (
 	"os/exec"
 	"path/filepath"
 	"slices"
+	"strconv"
 	"strings"
 )
 
-// ErrReflogRewritten reports that the HEAD reflog is shorter than an offset
+// ErrReflogRewritten reports that the HEAD reflog no longer holds a position
 // read from it earlier: something expired or rewrote it in between, so the
-// offset no longer marks where the new entries start.
+// position no longer marks where the new entries start.
 var ErrReflogRewritten = errors.New("HEAD reflog was rewritten")
 
 // ReflogEntry is one move of HEAD, as the reflog records it.
@@ -42,6 +43,17 @@ type ReflogEntry struct {
 	Message string
 }
 
+// ReflogPos marks the end of the HEAD reflog at one moment. Taken before a
+// command, it marks where the entries that the command writes start.
+type ReflogPos struct {
+	// Offset is the size in bytes of the reflog file, with the files ref
+	// storage.
+	Offset int64 `json:"offset,omitempty"`
+	// Top is the newest entry, as git prints it, with the reftable ref
+	// storage. It is empty when the reflog has no entry.
+	Top string `json:"top,omitempty"`
+}
+
 // IsZeroOID reports whether oid is the all-zero object ID that a reflog
 // entry holds for "no commit", as the old side of the first commit.
 func IsZeroOID(oid string) bool {
@@ -73,52 +85,50 @@ func headReflog(repoRoot string) (path string, reftable bool, err error) {
 	return filepath.Join(gitDir, "logs", "HEAD"), false, nil
 }
 
-// HeadReflogSize returns the position of the end of the HEAD reflog of the
-// checkout at repoRoot, zero when it has none yet. Taken before a command, it
-// marks where the entries that the command writes start. With the files ref
-// storage it is the size of the reflog in bytes: a stat, cheap enough for a
-// hook that runs before every shell command. With reftable it is the number of
-// entries, which git has to count.
-func HeadReflogSize(repoRoot string) (int64, error) {
+// HeadReflogPos returns the position of the end of the HEAD reflog of the
+// checkout at repoRoot. It is cheap enough for a hook that runs before every
+// shell command, whatever the length of the reflog: a stat with the files ref
+// storage, and one entry read through git with reftable.
+func HeadReflogPos(repoRoot string) (ReflogPos, error) {
 	path, reftable, err := headReflog(repoRoot)
 	if err != nil {
-		return 0, err
+		return ReflogPos{}, err
 	}
 	if reftable {
-		entries, err := gitHeadReflog(repoRoot)
-		if err != nil {
-			return 0, err
+		lines, err := gitReflogLines(repoRoot, 1)
+		if err != nil || len(lines) == 0 {
+			return ReflogPos{}, err
 		}
 
-		return int64(len(entries)), nil
+		return ReflogPos{Top: lines[0].line}, nil
 	}
 
 	fi, err := os.Stat(path)
 	if errors.Is(err, os.ErrNotExist) {
-		return 0, nil
+		return ReflogPos{}, nil
 	}
 	if err != nil {
-		return 0, fmt.Errorf("stat HEAD reflog: %w", err)
+		return ReflogPos{}, fmt.Errorf("stat HEAD reflog: %w", err)
 	}
 
-	return fi.Size(), nil
+	return ReflogPos{Offset: fi.Size()}, nil
 }
 
-// HeadReflogSince returns the HEAD reflog entries written after offset, a
-// position that HeadReflogSize returned earlier, oldest first. It returns
-// ErrReflogRewritten when the reflog is now shorter than offset.
-func HeadReflogSince(repoRoot string, offset int64) ([]ReflogEntry, error) {
+// HeadReflogSince returns the HEAD reflog entries written after pos, a
+// position that HeadReflogPos returned earlier, oldest first. It returns
+// ErrReflogRewritten when the reflog no longer holds pos.
+func HeadReflogSince(repoRoot string, pos ReflogPos) ([]ReflogEntry, error) {
 	path, reftable, err := headReflog(repoRoot)
 	if err != nil {
 		return nil, err
 	}
 	if reftable {
-		return gitHeadReflogSince(repoRoot, offset)
+		return gitHeadReflogSince(repoRoot, pos.Top)
 	}
 
 	f, err := os.Open(path)
 	if errors.Is(err, os.ErrNotExist) {
-		if offset > 0 {
+		if pos.Offset > 0 {
 			return nil, ErrReflogRewritten
 		}
 
@@ -133,10 +143,10 @@ func HeadReflogSince(repoRoot string, offset int64) ([]ReflogEntry, error) {
 	if err != nil {
 		return nil, fmt.Errorf("stat HEAD reflog: %w", err)
 	}
-	if fi.Size() < offset {
+	if fi.Size() < pos.Offset {
 		return nil, ErrReflogRewritten
 	}
-	if _, err := f.Seek(offset, io.SeekStart); err != nil {
+	if _, err := f.Seek(pos.Offset, io.SeekStart); err != nil {
 		return nil, fmt.Errorf("seek HEAD reflog: %w", err)
 	}
 
@@ -157,13 +167,23 @@ func HeadReflogSince(repoRoot string, offset int64) ([]ReflogEntry, error) {
 	return entries, nil
 }
 
-// gitHeadReflog returns the HEAD reflog entries through git, newest first, for
-// a ref storage that only git reads. git prints the commit that each entry
-// moved HEAD to, not the one it left. The old side of an entry is then the new
-// side of the entry before it, or the zero ID for the first one. An unborn
-// HEAD with no reflog yet has no entries.
-func gitHeadReflog(repoRoot string) ([]ReflogEntry, error) {
-	cmd := exec.Command("git", "reflog", "show", "--format=%H%x09%gs", "HEAD", "--")
+// reflogLine is one HEAD reflog entry as git prints it.
+type reflogLine struct {
+	// line is the whole entry: the commit, the selector with the time of the
+	// entry, and the message. It identifies the entry as a ReflogPos.Top.
+	line string
+	// newOID is the commit that the entry moved HEAD to.
+	newOID  string
+	message string
+}
+
+// gitReflogLines returns the newest n entries of the HEAD reflog through git,
+// newest first, for a ref storage that only git reads. The selector holds the
+// time of the entry, not its index, so the line of an entry stays the same
+// when newer entries are added. An unborn HEAD with no reflog yet has no
+// entries.
+func gitReflogLines(repoRoot string, n int) ([]reflogLine, error) {
+	cmd := exec.Command("git", "reflog", "show", "-n", strconv.Itoa(n), "--date=unix", "--format=%H%x09%gd%x09%gs", "HEAD", "--")
 	cmd.Dir = repoRoot
 	var stderr bytes.Buffer
 	cmd.Stderr = &stderr
@@ -176,40 +196,85 @@ func gitHeadReflog(repoRoot string) ([]ReflogEntry, error) {
 		return nil, fmt.Errorf("git reflog HEAD: %w: %s", err, strings.TrimSpace(stderr.String()))
 	}
 
-	var entries []ReflogEntry
+	var lines []reflogLine
 	for line := range strings.Lines(string(out)) {
-		newOID, msg, ok := strings.Cut(strings.TrimSuffix(line, "\n"), "\t")
-		if !ok {
+		line = strings.TrimSuffix(line, "\n")
+		fields := strings.SplitN(line, "\t", 3)
+		if len(fields) != 3 {
 			return nil, fmt.Errorf("parse git reflog line %q", line)
 		}
-		entries = append(entries, ReflogEntry{New: newOID, Message: msg})
+		lines = append(lines, reflogLine{line: line, newOID: fields[0], message: fields[2]})
 	}
-	for i := range entries {
-		if i+1 < len(entries) {
-			entries[i].Old = entries[i+1].New
-		} else {
-			entries[i].Old = strings.Repeat("0", len(entries[i].New))
+
+	return lines, nil
+}
+
+// gitHeadReflogSince is HeadReflogSince for a ref storage that only git reads.
+// top is the newest entry before the command, empty when there was none. It
+// reads the reflog newest first, twice as many entries each time, until it
+// finds top: a command that wrote few entries costs one read, whatever the
+// length of the reflog.
+//
+// git prints the commit that each entry moved HEAD to, not the one it left.
+// The old side of an entry is the new side of the entry before it, or the zero
+// ID for the first entry of the reflog.
+func gitHeadReflogSince(repoRoot, top string) ([]ReflogEntry, error) {
+	for n := 16; ; n *= 2 {
+		lines, err := gitReflogLines(repoRoot, n)
+		if err != nil {
+			return nil, err
 		}
-	}
 
-	return entries, nil
+		end := -1
+		if top != "" {
+			end = slices.IndexFunc(lines, func(l reflogLine) bool { return l.line == top })
+		}
+		if end < 0 {
+			if len(lines) == n {
+				continue // more entries to read
+			}
+			if top != "" {
+				return nil, ErrReflogRewritten
+			}
+			end = len(lines)
+		}
+
+		added := make([]ReflogEntry, 0, end)
+		for i := end - 1; i >= 0; i-- {
+			old := strings.Repeat("0", len(lines[i].newOID))
+			if i+1 < len(lines) {
+				old = lines[i+1].newOID
+			}
+			added = append(added, ReflogEntry{Old: old, New: lines[i].newOID, Message: lines[i].message})
+		}
+
+		return added, nil
+	}
 }
 
-// gitHeadReflogSince is HeadReflogSince for a ref storage that only git reads,
-// where offset is a number of entries.
-func gitHeadReflogSince(repoRoot string, offset int64) ([]ReflogEntry, error) {
-	all, err := gitHeadReflog(repoRoot)
-	if err != nil {
-		return nil, err
+// CommitPaths returns the repo-relative paths, with forward slashes, that
+// differ between the commits from and to. A zero from is the first commit of
+// a branch, and every path of to then counts.
+func CommitPaths(repoRoot, from, to string) (map[string]bool, error) {
+	args := []string{"diff-tree", "-r", "--no-renames", "--no-commit-id", "--name-only", "-z"}
+	if IsZeroOID(from) {
+		args = append(args, "--root", to)
+	} else {
+		args = append(args, from, to)
 	}
-	if int64(len(all)) < offset {
-		return nil, ErrReflogRewritten
+	out, err := gitRawOutput(repoRoot, args...)
+	if err != nil {
+		return nil, fmt.Errorf("git diff-tree %s %s: %w", from, to, err)
 	}
 
-	added := all[:int64(len(all))-offset]
-	slices.Reverse(added)
+	paths := make(map[string]bool)
+	for p := range strings.SplitSeq(string(out), "\x00") {
+		if p != "" {
+			paths[p] = true
+		}
+	}
 
-	return added, nil
+	return paths, nil
 }
 
 // parseReflogLine parses one reflog line:
diff --git a/app/cli/internal/trace/git/reflog_test.go b/app/cli/internal/trace/git/reflog_test.go
index ad127bb64..fee793c65 100644
--- a/app/cli/internal/trace/git/reflog_test.go
+++ b/app/cli/internal/trace/git/reflog_test.go
@@ -16,6 +16,7 @@
 package git
 
 import (
+	"fmt"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -85,14 +86,14 @@ func TestHeadReflogSince(t *testing.T) {
 			dir := reflogRepo(t, tc.initArgs...)
 
 			// No commit yet: the reflog is empty.
-			start, err := HeadReflogSize(dir)
+			start, err := HeadReflogPos(dir)
 			require.NoError(t, err)
 			assert.Zero(t, start)
 
 			first := reflogCommit(t, dir, "a.txt", "a\n", "first")
-			size, err := HeadReflogSize(dir)
+			size, err := HeadReflogPos(dir)
 			require.NoError(t, err)
-			require.Positive(t, size)
+			require.NotZero(t, size)
 
 			entries, err := HeadReflogSince(dir, start)
 			require.NoError(t, err)
@@ -112,15 +113,30 @@ func TestHeadReflogSince(t *testing.T) {
 			assert.Equal(t, first, entries[1].New)
 			assert.True(t, strings.HasPrefix(entries[1].Message, "checkout: moving from main to other"), entries[1].Message)
 
-			// Nothing written since the current size.
-			now, err := HeadReflogSize(dir)
+			// Nothing written since the current position.
+			now, err := HeadReflogPos(dir)
 			require.NoError(t, err)
 			entries, err = HeadReflogSince(dir, now)
 			require.NoError(t, err)
 			assert.Empty(t, entries)
 
-			// A reflog that is now shorter than the offset was rewritten.
-			_, err = HeadReflogSince(dir, now+1)
+			// More entries than one read of the reflog returns.
+			const many = 40
+			for i := range many {
+				reflogGit(t, dir, "commit", "-q", "--allow-empty", "-m", fmt.Sprintf("empty %d", i))
+			}
+			entries, err = HeadReflogSince(dir, now)
+			require.NoError(t, err)
+			require.Len(t, entries, many)
+			assert.Equal(t, first, entries[0].Old)
+			assert.Equal(t, "commit: empty 0", entries[0].Message)
+			for i := 1; i < many; i++ {
+				assert.Equal(t, entries[i-1].New, entries[i].Old, "entry %d starts where the one before it ended", i)
+			}
+			assert.Equal(t, reflogGit(t, dir, "rev-parse", "HEAD"), entries[many-1].New)
+
+			// A reflog that no longer holds the position was rewritten.
+			_, err = HeadReflogSince(dir, ReflogPos{Offset: 1 << 40, Top: "gone"})
 			assert.ErrorIs(t, err, ErrReflogRewritten)
 		})
 	}
@@ -142,15 +158,80 @@ func TestHeadReflogSince_LinkedWorktree(t *testing.T) {
 	}
 }
 
+func TestCommitPaths(t *testing.T) {
+	dir := reflogRepo(t)
+	first := reflogCommit(t, dir, "a.txt", "a\n", "first")
+	reflogCommit(t, dir, "b.txt", "b\n", "second")
+	require.NoError(t, os.MkdirAll(filepath.Join(dir, "sub"), 0o755))
+	third := reflogCommit(t, dir, filepath.Join("sub", "c d.txt"), "c\n", "third")
+
+	tests := []struct {
+		name     string
+		from, to string
+		want     map[string]bool
+	}{
+		{name: "a range of commits", from: first, to: third, want: map[string]bool{"b.txt": true, "sub/c d.txt": true}},
+		{name: "the first commit of a branch", from: strings.Repeat("0", len(first)), to: first, want: map[string]bool{"a.txt": true}},
+		{name: "no change", from: third, to: third, want: map[string]bool{}},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got, err := CommitPaths(dir, tc.from, tc.to)
+			require.NoError(t, err)
+			assert.Equal(t, tc.want, got)
+		})
+	}
+
+	_, err := CommitPaths(dir, first, "not-a-commit")
+	assert.Error(t, err)
+}
+
+func TestBlobReader(t *testing.T) {
+	dir := reflogRepo(t)
+	first := reflogCommit(t, dir, "a.txt", "one\ntwo\n", "first")
+	require.NoError(t, os.MkdirAll(filepath.Join(dir, "sub"), 0o755))
+	second := reflogCommit(t, dir, filepath.Join("sub", "b c.txt"), "", "second")
+
+	r, err := NewBlobReader(dir)
+	require.NoError(t, err)
+	defer func() { assert.NoError(t, r.Close()) }()
+
+	tests := []struct {
+		name      string
+		rev, path string
+		want      []byte
+	}{
+		{name: "a file", rev: first, path: "a.txt", want: []byte("one\ntwo\n")},
+		{name: "an empty file with a space in its path", rev: second, path: "sub/b c.txt", want: []byte{}},
+		{name: "a path the commit does not hold", rev: first, path: "sub/b c.txt"},
+		{name: "a directory", rev: second, path: "sub"},
+		{name: "a commit that does not resolve", rev: strings.Repeat("0", len(first)), path: "a.txt"},
+		{name: "a symbolic revision", rev: "HEAD", path: "a.txt", want: []byte("one\ntwo\n")},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got, err := r.FileAt(tc.rev, tc.path)
+			require.NoError(t, err)
+			assert.Equal(t, tc.want, got)
+		})
+	}
+
+	_, err = r.FileAt(first, "a\nb")
+	assert.Error(t, err)
+	got, err := r.FileAt(first, "a.txt")
+	require.NoError(t, err, "a rejected name does not break later reads")
+	assert.Equal(t, []byte("one\ntwo\n"), got)
+}
+
 func testLinkedWorktreeReflog(t *testing.T, dir string) {
 	t.Helper()
 	reflogCommit(t, dir, "a.txt", "a\n", "first")
 
 	wt := filepath.Join(t.TempDir(), "wt")
 	reflogGit(t, dir, "worktree", "add", "-q", "-b", "wt", wt)
-	mainSize, err := HeadReflogSize(dir)
+	mainSize, err := HeadReflogPos(dir)
 	require.NoError(t, err)
-	wtSize, err := HeadReflogSize(wt)
+	wtSize, err := HeadReflogPos(wt)
 	require.NoError(t, err)
 
 	reflogCommit(t, wt, "b.txt", "b\n", "in worktree")
diff --git a/app/cli/internal/trace/state/snapshot.go b/app/cli/internal/trace/state/snapshot.go
index b089b306e..8cef4a4db 100644
--- a/app/cli/internal/trace/state/snapshot.go
+++ b/app/cli/internal/trace/state/snapshot.go
@@ -24,6 +24,8 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+
+	tracegit "github.com/chainloop-dev/chainloop/app/cli/internal/trace/git"
 )
 
 // FileSnapshotKey identifies the edit whose pre-edit content was captured.
@@ -161,39 +163,39 @@ func (s *Store) shellPreReflogPath(key ShellCallKey) string {
 	return strings.TrimSuffix(s.shellPreSignaturePath(key), ".json") + ".reflog.json"
 }
 
-// SaveShellPreReflog stores the size of the HEAD reflog of each checkout
-// (checkout root → bytes) before an agent-run shell command. The entries past
-// it are the HEAD moves of the command, which tell the commits it wrote apart
-// from the ones it only moved HEAD to.
-func (s *Store) SaveShellPreReflog(key ShellCallKey, sizes map[string]int64) error {
+// SaveShellPreReflog stores the end of the HEAD reflog of each checkout
+// (checkout root → position) before an agent-run shell command. The entries
+// past it are the HEAD moves of the command, which tell the commits it wrote
+// apart from the ones it only moved HEAD to.
+func (s *Store) SaveShellPreReflog(key ShellCallKey, positions map[string]tracegit.ReflogPos) error {
 	path := s.shellPreReflogPath(key)
 	if err := os.MkdirAll(filepath.Dir(path), 0755); err != nil {
 		return fmt.Errorf("create snapshot dir: %w", err)
 	}
 
-	data, err := json.Marshal(sizes)
+	data, err := json.Marshal(positions)
 	if err != nil {
-		return fmt.Errorf("marshal shell reflog sizes: %w", err)
+		return fmt.Errorf("marshal shell reflog positions: %w", err)
 	}
 
 	return os.WriteFile(path, data, 0600)
 }
 
-// LoadShellPreReflog loads the HEAD reflog sizes saved before a shell command.
-// A command whose pre hook ran on an older CLI has none, and the error then
-// wraps os.ErrNotExist.
-func (s *Store) LoadShellPreReflog(key ShellCallKey) (map[string]int64, error) {
+// LoadShellPreReflog loads the HEAD reflog positions saved before a shell
+// command. A command whose pre hook ran on an older CLI has none, and the
+// error then wraps os.ErrNotExist.
+func (s *Store) LoadShellPreReflog(key ShellCallKey) (map[string]tracegit.ReflogPos, error) {
 	data, err := os.ReadFile(s.shellPreReflogPath(key))
 	if err != nil {
 		return nil, err
 	}
 
-	var sizes map[string]int64
-	if err := json.Unmarshal(data, &sizes); err != nil {
-		return nil, fmt.Errorf("parse shell reflog sizes: %w", err)
+	var positions map[string]tracegit.ReflogPos
+	if err := json.Unmarshal(data, &positions); err != nil {
+		return nil, fmt.Errorf("parse shell reflog positions: %w", err)
 	}
 
-	return sizes, nil
+	return positions, nil
 }
 
 // shellPreHeadsPath returns the path storing the HEAD commit of each checkout
diff --git a/app/cli/internal/trace/state/snapshot_test.go b/app/cli/internal/trace/state/snapshot_test.go
index f39c34905..eee6e61bd 100644
--- a/app/cli/internal/trace/state/snapshot_test.go
+++ b/app/cli/internal/trace/state/snapshot_test.go
@@ -21,6 +21,7 @@ import (
 	"path/filepath"
 	"testing"
 
+	tracegit "github.com/chainloop-dev/chainloop/app/cli/internal/trace/git"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -129,18 +130,22 @@ func TestShellPreReflog(t *testing.T) {
 	key := ShellCallKey{SessionID: shellSessionID, ToolUseID: "toolu_1"}
 
 	_, err := store.LoadShellPreReflog(key)
-	require.ErrorIs(t, err, os.ErrNotExist, "a command without saved sizes has none")
+	require.ErrorIs(t, err, os.ErrNotExist, "a command without saved positions has none")
 
-	sizes := map[string]int64{"/repo": 1234}
+	positions := map[string]tracegit.ReflogPos{
+		"/repo":     {Offset: 1234},
+		"/reftable": {Top: "abc\tHEAD@{1700000000}\tcommit: feat"},
+		"/unborn":   {},
+	}
 	require.NoError(t, store.SaveShellPreSignature(key, WorktreeSignatures{"/repo": {fileA: "h"}}))
-	require.NoError(t, store.SaveShellPreReflog(key, sizes))
+	require.NoError(t, store.SaveShellPreReflog(key, positions))
 	got, err := store.LoadShellPreReflog(key)
 	require.NoError(t, err)
-	assert.Equal(t, sizes, got)
+	assert.Equal(t, positions, got)
 
 	store.DeleteShellPreSignature(key)
 	_, err = store.LoadShellPreReflog(key)
-	require.ErrorIs(t, err, os.ErrNotExist, "the sizes go with the signature")
+	require.ErrorIs(t, err, os.ErrNotExist, "the positions go with the signature")
 }
 
 // A CLI upgrade can land between the pre and post hooks of one command. The
diff --git a/app/cli/pkg/action/trace_agent_hook.go b/app/cli/pkg/action/trace_agent_hook.go
index e4f608077..9ac4bec0a 100644
--- a/app/cli/pkg/action/trace_agent_hook.go
+++ b/app/cli/pkg/action/trace_agent_hook.go
@@ -447,7 +447,7 @@ func captureWorktreeSnapshot(store *state.Store, repoRoot string, key state.Shel
 	client := tracegit.NewGitClient()
 	sigs := make(state.WorktreeSignatures)
 	heads := make(map[string]string)
-	reflogs := make(map[string]int64)
+	reflogs := make(map[string]tracegit.ReflogPos)
 	for _, root := range shellSnapshotRoots(store, repoRoot, key.SessionID) {
 		sig, err := client.SnapshotWorktree(root)
 		if err != nil {
@@ -463,10 +463,10 @@ func captureWorktreeSnapshot(store *state.Store, repoRoot string, key state.Shel
 		if sha, _, err := client.CommitHeadInfo(root); err == nil {
 			heads[root] = sha
 		}
-		if size, err := tracegit.HeadReflogSize(root); err == nil {
-			reflogs[root] = size
+		if pos, err := tracegit.HeadReflogPos(root); err == nil {
+			reflogs[root] = pos
 		} else {
-			log.Debug().Err(err).Str("root", root).Msg("pre-command: HEAD reflog size failed")
+			log.Debug().Err(err).Str("root", root).Msg("pre-command: HEAD reflog position failed")
 		}
 	}
 
@@ -481,7 +481,7 @@ func captureWorktreeSnapshot(store *state.Store, repoRoot string, key state.Shel
 		log.Debug().Err(err).Msg("pre-command: save HEAD commits failed")
 	}
 	if err := store.SaveShellPreReflog(key, reflogs); err != nil {
-		log.Debug().Err(err).Msg("pre-command: save HEAD reflog sizes failed")
+		log.Debug().Err(err).Msg("pre-command: save HEAD reflog positions failed")
 	}
 }
 
@@ -906,7 +906,7 @@ func recordCommandLineRanges(provider trace.Provider, input *trace.HookInput, st
 		return
 	}
 	defer store.DeleteShellPreSignature(key)
-	// A pre hook from an older CLI saved no HEAD and no reflog size. That
+	// A pre hook from an older CLI saved no HEAD and no reflog position. That
 	// case, and a file that cannot be read, fall back to the current HEAD.
 	heads, err := store.LoadShellPreHeads(key)
 	if err != nil && !errors.Is(err, os.ErrNotExist) {
@@ -914,13 +914,13 @@ func recordCommandLineRanges(provider trace.Provider, input *trace.HookInput, st
 	}
 	reflogs, err := store.LoadShellPreReflog(key)
 	if err != nil && !errors.Is(err, os.ErrNotExist) {
-		log.Debug().Err(err).Msg("post-command: cannot read pre-command HEAD reflog sizes")
+		log.Debug().Err(err).Msg("post-command: cannot read pre-command HEAD reflog positions")
 	}
 
 	for root, rootBefore := range before {
 		var pre preCommand
 		pre.head, pre.hasHead = heads[root]
-		pre.reflogSize, pre.hasReflog = reflogs[root]
+		pre.reflogPos, pre.hasReflog = reflogs[root]
 
 		rootStore := store
 		if !sameDir(root, repoRoot) {
@@ -946,10 +946,10 @@ type preCommand struct {
 	// hasHead is false when the pre hook saved no HEAD for the checkout: a
 	// pre hook from an older CLI, or a heads file that cannot be read.
 	hasHead bool
-	// reflogSize is the size of the HEAD reflog. hasReflog is false when the
+	// reflogPos is the end of the HEAD reflog. hasReflog is false when the
 	// pre hook saved none.
-	reflogSize int64
-	hasReflog  bool
+	reflogPos tracegit.ReflogPos
+	hasReflog bool
 }
 
 // recordRootChanges diffs the signature of one checkout captured before a
@@ -981,7 +981,7 @@ func recordRootChanges(store *state.Store, repoRoot string, pre preCommand, befo
 	}
 
 	// When the pre hook saved no HEAD, the HEAD after the command stands in,
-	// as before. A pre hook that saved an empty HEAD and a reflog size saw a
+	// as before. A pre hook that saved an empty HEAD and a reflog position saw a
 	// checkout with no commit yet, so a HEAD now is a move, and the first
 	// commit can be the command's own.
 	head, moved := "HEAD", false
@@ -996,8 +996,22 @@ func recordRootChanges(store *state.Store, repoRoot string, pre preCommand, befo
 		}
 	}
 
+	// One git process serves every read of a file at a commit. Without one,
+	// each read starts its own processes.
+	blobs, err := tracegit.NewBlobReader(repoRoot)
+	if err != nil {
+		log.Debug().Err(err).Str("root", repoRoot).Msg("post-command: no batch reader; reading files one by one")
+	} else {
+		defer func() { _ = blobs.Close() }()
+	}
 	fileAt := func(rev, relPath string) []byte {
-		content, err := client.FileAt(repoRoot, rev, filepath.ToSlash(relPath))
+		var content []byte
+		var err error
+		if blobs != nil {
+			content, err = blobs.FileAt(rev, filepath.ToSlash(relPath))
+		} else {
+			content, err = client.FileAt(repoRoot, rev, filepath.ToSlash(relPath))
+		}
 		if err != nil {
 			return nil
 		}
@@ -1005,6 +1019,16 @@ func recordRootChanges(store *state.Store, repoRoot string, pre preCommand, befo
 		return content
 	}
 
+	// The paths that each own commit changed, so that a file is read only at
+	// the commits that touched it. nil when git cannot tell: every file is
+	// then read at that commit, and the diff finds the ones it did not touch.
+	ownPaths := make([]map[string]bool, len(own))
+	for i, c := range own {
+		if paths, err := tracegit.CommitPaths(repoRoot, c.Old, c.New); err == nil {
+			ownPaths[i] = paths
+		}
+	}
+
 	open := store.LoadAILineAttribution(sessionID).Open
 	record := func(relPath string, content []byte) error {
 		recorded := false
@@ -1021,7 +1045,10 @@ func recordRootChanges(store *state.Store, repoRoot string, pre preCommand, befo
 			return nil
 		}
 
-		for _, c := range own {
+		for i, c := range own {
+			if ownPaths[i] != nil && !ownPaths[i][filepath.ToSlash(relPath)] {
+				continue
+			}
 			if edit := attribution.ComputeEdit(fileAt(c.Old, relPath), fileAt(c.New, relPath)); edit.Changed {
 				if err := write(edit); err != nil {
 					return err
@@ -1065,13 +1092,13 @@ func recordRootChanges(store *state.Store, repoRoot string, pre preCommand, befo
 
 // commandCommits returns the commits that a shell command wrote itself, from
 // the HEAD reflog entries that it added. It returns nil when the pre hook saved
-// no reflog size or the reflog cannot be read.
+// no reflog position or the reflog cannot be read.
 func commandCommits(repoRoot string, pre preCommand, newHead string, log zerolog.Logger) []tracegit.ReflogEntry {
 	if !pre.hasReflog {
 		return nil
 	}
 
-	entries, err := tracegit.HeadReflogSince(repoRoot, pre.reflogSize)
+	entries, err := tracegit.HeadReflogSince(repoRoot, pre.reflogPos)
 	if err != nil {
 		log.Debug().Err(err).Str("root", repoRoot).Msg("post-command: cannot read the HEAD reflog; no commit of the command counts")
 		return nil
diff --git a/app/cli/pkg/action/trace_line_attribution_test.go b/app/cli/pkg/action/trace_line_attribution_test.go
index 920b298a7..dc870a623 100644
--- a/app/cli/pkg/action/trace_line_attribution_test.go
+++ b/app/cli/pkg/action/trace_line_attribution_test.go
@@ -659,9 +659,9 @@ func (r *lineRepo) shellWrite(sessionID string, run func()) {
 	require.NoError(r.t, err)
 	var pre preCommand
 	pre.head, pre.hasHead = heads[r.dir]
-	pre.reflogSize, pre.hasReflog = reflogs[r.dir]
+	pre.reflogPos, pre.hasReflog = reflogs[r.dir]
 	require.True(r.t, pre.hasHead, "the pre hook saves the HEAD")
-	require.True(r.t, pre.hasReflog, "the pre hook saves the HEAD reflog size")
+	require.True(r.t, pre.hasReflog, "the pre hook saves the HEAD reflog position")
 	recordRootChanges(r.store, r.dir, pre, sigs[r.dir], sessionID, zerolog.Nop())
 	r.store.DeleteShellPreSignature(key)
 }
@@ -698,8 +698,31 @@ func TestLineAttribution_ShellCommandThatCommits(t *testing.T) {
 	assert.Equal(t, 2, attr.Written["a.go"].Len())
 }
 
+// Each commit of a command counts only for the files that it changed, and a
+// file that a later commit changes again counts at each of its commits.
+func TestLineAttribution_ShellCommandWithSeveralCommits(t *testing.T) {
+	r := newLineRepo(t)
+
+	r.shellWrite(lineSession, func() {
+		r.humanWrite("a.go", "one\ntwo\n")
+		runGit(t, r.dir, "add", "a.go")
+		runGit(t, r.dir, "commit", "-m", "feat: a")
+		r.humanWrite("b.go", "one\n")
+		runGit(t, r.dir, "add", "b.go")
+		runGit(t, r.dir, "commit", "-m", "feat: b")
+		r.humanWrite("a.go", "one\ntwo\nthree\n")
+		runGit(t, r.dir, "add", "a.go")
+		runGit(t, r.dir, "commit", "-m", "feat: a again")
+	})
+
+	attr := r.store.LoadAILineAttribution(lineSession)
+	assert.Equal(t, 3, attr.Written["a.go"].Len())
+	assert.Equal(t, 1, attr.Written["b.go"].Len())
+	assert.Equal(t, 4, attr.GeneratedAdded)
+}
+
 // A pre hook whose HEAD commits were lost (the heads file is missing or
-// unreadable) but whose reflog size was saved does not see a HEAD move when
+// unreadable) but whose reflog position was saved does not see a HEAD move when
 // HEAD did not move: a file that the command restored to HEAD is still
 // recorded as AI-touched with zero lines.
 func TestLineAttribution_ShellLostHeadsIsNotAHeadMove(t *testing.T) {
@@ -717,7 +740,7 @@ func TestLineAttribution_ShellLostHeadsIsNotAHeadMove(t *testing.T) {
 	reflogs, err := r.store.LoadShellPreReflog(key)
 	require.NoError(t, err)
 	pre := preCommand{}
-	pre.reflogSize, pre.hasReflog = reflogs[r.dir]
+	pre.reflogPos, pre.hasReflog = reflogs[r.dir]
 	require.True(t, pre.hasReflog)
 	recordRootChanges(r.store, r.dir, pre, sigs[r.dir], lineSession, zerolog.Nop())
 

From d103e089a67ab660d5b83ec65cf0eb115936b173 Mon Sep 17 00:00:00 2001
From: Jose Ignacio Paris Prieto <jiparis@chainloop.dev>
Date: Wed, 4 Nov 2026 13:41:13 +0100
Subject: [PATCH 6/6] fix(trace): fall back to single reads when the batch
 reader fails

A path with a newline, or a git cat-file process that stopped, is read on
its own instead of as an absent file. Also fix lint findings and a stale
comment.

Assisted-by: Claude Code
Signed-off-by: Jose Ignacio Paris Prieto <jiparis@chainloop.dev>

Chainloop-Trace-Sessions: 66252f01-6f1c-4e49-b41b-d21335c39743
---
 app/cli/internal/trace/git/blobs.go       |  9 +++++++--
 app/cli/internal/trace/git/reflog.go      |  2 +-
 app/cli/internal/trace/git/reflog_test.go | 22 +++++++++++-----------
 app/cli/internal/trace/state/snapshot.go  |  2 +-
 app/cli/pkg/action/trace_agent_hook.go    | 13 ++++++++-----
 5 files changed, 28 insertions(+), 20 deletions(-)

diff --git a/app/cli/internal/trace/git/blobs.go b/app/cli/internal/trace/git/blobs.go
index 35fd2c4a6..cf9d60d62 100644
--- a/app/cli/internal/trace/git/blobs.go
+++ b/app/cli/internal/trace/git/blobs.go
@@ -17,6 +17,7 @@ package git
 
 import (
 	"bufio"
+	"errors"
 	"fmt"
 	"io"
 	"os/exec"
@@ -24,6 +25,10 @@ import (
 	"strings"
 )
 
+// ErrUnbatchableName reports a name that a BlobReader cannot ask git for,
+// because it holds a newline: read it in another way.
+var ErrUnbatchableName = errors.New("name holds a newline")
+
 // BlobReader reads files at commits through one long-running
 // "git cat-file --batch" process, so that many reads cost one process, not
 // several processes each. It is not safe for concurrent use.
@@ -58,13 +63,13 @@ func NewBlobReader(repoRoot string) (*BlobReader, error) {
 
 // FileAt returns the content of path, repo-relative with forward slashes, at
 // rev. It returns nil when rev does not resolve or does not hold path as a
-// file.
+// file, and ErrUnbatchableName when rev or path holds a newline.
 func (r *BlobReader) FileAt(rev, path string) ([]byte, error) {
 	if r.err != nil {
 		return nil, r.err
 	}
 	if strings.ContainsAny(rev+path, "\n") {
-		return nil, fmt.Errorf("cannot read %q at %q: name holds a newline", path, rev)
+		return nil, fmt.Errorf("read %q at %q: %w", path, rev, ErrUnbatchableName)
 	}
 
 	content, err := r.read(rev + ":" + path)
diff --git a/app/cli/internal/trace/git/reflog.go b/app/cli/internal/trace/git/reflog.go
index 5ad6693dd..4fccdd7d3 100644
--- a/app/cli/internal/trace/git/reflog.go
+++ b/app/cli/internal/trace/git/reflog.go
@@ -183,7 +183,7 @@ type reflogLine struct {
 // when newer entries are added. An unborn HEAD with no reflog yet has no
 // entries.
 func gitReflogLines(repoRoot string, n int) ([]reflogLine, error) {
-	cmd := exec.Command("git", "reflog", "show", "-n", strconv.Itoa(n), "--date=unix", "--format=%H%x09%gd%x09%gs", "HEAD", "--")
+	cmd := exec.Command("git", "reflog", "show", "-n", strconv.Itoa(n), "--date=unix", "--format=%H%x09%gd%x09%gs", "HEAD", "--") //nolint:gosec // a fixed git command; n is a number
 	cmd.Dir = repoRoot
 	var stderr bytes.Buffer
 	cmd.Stderr = &stderr
diff --git a/app/cli/internal/trace/git/reflog_test.go b/app/cli/internal/trace/git/reflog_test.go
index fee793c65..b08fef48a 100644
--- a/app/cli/internal/trace/git/reflog_test.go
+++ b/app/cli/internal/trace/git/reflog_test.go
@@ -90,7 +90,7 @@ func TestHeadReflogSince(t *testing.T) {
 			require.NoError(t, err)
 			assert.Zero(t, start)
 
-			first := reflogCommit(t, dir, "a.txt", "a\n", "first")
+			first := reflogCommit(t, dir, fileA, "a\n", "first")
 			size, err := HeadReflogPos(dir)
 			require.NoError(t, err)
 			require.NotZero(t, size)
@@ -102,7 +102,7 @@ func TestHeadReflogSince(t *testing.T) {
 			assert.Equal(t, "commit (initial): first", entries[0].Message)
 			assert.True(t, IsZeroOID(entries[0].Old), "the first commit replaces no commit: %q", entries[0].Old)
 
-			second := reflogCommit(t, dir, "a.txt", "b\n", "second")
+			second := reflogCommit(t, dir, fileA, "b\n", "second")
 			reflogGit(t, dir, "checkout", "-q", "-b", "other", first)
 
 			entries, err = HeadReflogSince(dir, size)
@@ -160,7 +160,7 @@ func TestHeadReflogSince_LinkedWorktree(t *testing.T) {
 
 func TestCommitPaths(t *testing.T) {
 	dir := reflogRepo(t)
-	first := reflogCommit(t, dir, "a.txt", "a\n", "first")
+	first := reflogCommit(t, dir, fileA, "a\n", "first")
 	reflogCommit(t, dir, "b.txt", "b\n", "second")
 	require.NoError(t, os.MkdirAll(filepath.Join(dir, "sub"), 0o755))
 	third := reflogCommit(t, dir, filepath.Join("sub", "c d.txt"), "c\n", "third")
@@ -171,7 +171,7 @@ func TestCommitPaths(t *testing.T) {
 		want     map[string]bool
 	}{
 		{name: "a range of commits", from: first, to: third, want: map[string]bool{"b.txt": true, "sub/c d.txt": true}},
-		{name: "the first commit of a branch", from: strings.Repeat("0", len(first)), to: first, want: map[string]bool{"a.txt": true}},
+		{name: "the first commit of a branch", from: strings.Repeat("0", len(first)), to: first, want: map[string]bool{fileA: true}},
 		{name: "no change", from: third, to: third, want: map[string]bool{}},
 	}
 	for _, tc := range tests {
@@ -188,7 +188,7 @@ func TestCommitPaths(t *testing.T) {
 
 func TestBlobReader(t *testing.T) {
 	dir := reflogRepo(t)
-	first := reflogCommit(t, dir, "a.txt", "one\ntwo\n", "first")
+	first := reflogCommit(t, dir, fileA, "one\ntwo\n", "first")
 	require.NoError(t, os.MkdirAll(filepath.Join(dir, "sub"), 0o755))
 	second := reflogCommit(t, dir, filepath.Join("sub", "b c.txt"), "", "second")
 
@@ -201,12 +201,12 @@ func TestBlobReader(t *testing.T) {
 		rev, path string
 		want      []byte
 	}{
-		{name: "a file", rev: first, path: "a.txt", want: []byte("one\ntwo\n")},
+		{name: "a file", rev: first, path: fileA, want: []byte("one\ntwo\n")},
 		{name: "an empty file with a space in its path", rev: second, path: "sub/b c.txt", want: []byte{}},
 		{name: "a path the commit does not hold", rev: first, path: "sub/b c.txt"},
 		{name: "a directory", rev: second, path: "sub"},
-		{name: "a commit that does not resolve", rev: strings.Repeat("0", len(first)), path: "a.txt"},
-		{name: "a symbolic revision", rev: "HEAD", path: "a.txt", want: []byte("one\ntwo\n")},
+		{name: "a commit that does not resolve", rev: strings.Repeat("0", len(first)), path: fileA},
+		{name: "a symbolic revision", rev: "HEAD", path: fileA, want: []byte("one\ntwo\n")},
 	}
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {
@@ -217,15 +217,15 @@ func TestBlobReader(t *testing.T) {
 	}
 
 	_, err = r.FileAt(first, "a\nb")
-	assert.Error(t, err)
-	got, err := r.FileAt(first, "a.txt")
+	assert.ErrorIs(t, err, ErrUnbatchableName)
+	got, err := r.FileAt(first, fileA)
 	require.NoError(t, err, "a rejected name does not break later reads")
 	assert.Equal(t, []byte("one\ntwo\n"), got)
 }
 
 func testLinkedWorktreeReflog(t *testing.T, dir string) {
 	t.Helper()
-	reflogCommit(t, dir, "a.txt", "a\n", "first")
+	reflogCommit(t, dir, fileA, "a\n", "first")
 
 	wt := filepath.Join(t.TempDir(), "wt")
 	reflogGit(t, dir, "worktree", "add", "-q", "-b", "wt", wt)
diff --git a/app/cli/internal/trace/state/snapshot.go b/app/cli/internal/trace/state/snapshot.go
index 8cef4a4db..6b41f3814 100644
--- a/app/cli/internal/trace/state/snapshot.go
+++ b/app/cli/internal/trace/state/snapshot.go
@@ -157,7 +157,7 @@ func (s *Store) DeleteShellPreSignature(key ShellCallKey) {
 	_ = os.Remove(s.shellPreReflogPath(key))
 }
 
-// shellPreReflogPath returns the path storing the HEAD reflog size of each
+// shellPreReflogPath returns the path storing the HEAD reflog position of each
 // checkout before a shell command, next to the command's signature.
 func (s *Store) shellPreReflogPath(key ShellCallKey) string {
 	return strings.TrimSuffix(s.shellPreSignaturePath(key), ".json") + ".reflog.json"
diff --git a/app/cli/pkg/action/trace_agent_hook.go b/app/cli/pkg/action/trace_agent_hook.go
index 9ac4bec0a..8e7e437a4 100644
--- a/app/cli/pkg/action/trace_agent_hook.go
+++ b/app/cli/pkg/action/trace_agent_hook.go
@@ -1004,14 +1004,17 @@ func recordRootChanges(store *state.Store, repoRoot string, pre preCommand, befo
 	} else {
 		defer func() { _ = blobs.Close() }()
 	}
+	// A read that the batch reader cannot serve, such as a path with a
+	// newline or a git process that stopped, falls back to a read of its own:
+	// a file wrongly read as absent would count all its lines as new.
 	fileAt := func(rev, relPath string) []byte {
-		var content []byte
-		var err error
+		path := filepath.ToSlash(relPath)
 		if blobs != nil {
-			content, err = blobs.FileAt(rev, filepath.ToSlash(relPath))
-		} else {
-			content, err = client.FileAt(repoRoot, rev, filepath.ToSlash(relPath))
+			if content, err := blobs.FileAt(rev, path); err == nil {
+				return content
+			}
 		}
+		content, err := client.FileAt(repoRoot, rev, path)
 		if err != nil {
 			return nil
 		}