@@ -21,7 +21,8 @@
  *     re-clone if needed.
  *
  * Decorates Fastify with `reconcileDataRepo({ onMoved })`: fetch outside the
- * lock, then reconcile under the repository's write lock — the same mutex
+ * lock, then reconcile (gitsheets `repo.sync()`, see store/reconcile.ts)
+ * under the repository's write lock — the same mutex
  * `transact` holds (gitsheets `repo.withLock`), so a reconcile can never race
  * a write. When the reconcile moves the branch, the public store is
  * refreshed and `onMoved` runs inside the same lock, so the hot-reload
@@ -74,12 +75,17 @@ async function reconcilePlugin(fastify: FastifyInstance): Promise<void> {
       const logger = fastify.log;
 
       // Network outside the lock: writes keep flowing during a slow fetch.
-      // The ref moves below are CAS (`update-ref <ref> <new> <old>`).
+      // gitsheets' sync moves refs compare-and-swap.
       if (!(await fetchRemoteBranch({ repoPath, branch, logger }))) {
         const head = (await fastify.publicRepo.resolveRef('HEAD')) ?? '';
         return { outcome: 'fetch-failed', oldCommit: head, newCommit: head };
       }
 
+      // One critical section of the serving repository's write lock covers
+      // the ref move, the store refresh and `onMoved` (the hot-reload
+      // rebuild), so no transact can run between them. reconcileDataRepo
+      // syncs through a side Repository handle because `repo.sync()` takes
+      // its own handle's lock and refuses to nest inside `withLock`.
       return fastify.publicRepo.withLock(async () => {
         const result = await reconcileDataRepo({
           repoPath,
 
@@ -27,18 +27,14 @@
  * deployment surface stable across environments that haven't been
  * configured for hot reloads yet.
  */
-import { execFile } from 'node:child_process';
 import { timingSafeEqual } from 'node:crypto';
-import { promisify } from 'node:util';
 
 import type { FastifyInstance } from 'fastify';
 
 import { errorResponse, ok } from '../lib/response.js';
 import { reloadInMemoryStateAndFts, type ReloadMode } from '../store/memory/reload.js';
 import type { ReconcileOutcome, ReconcileResult } from '../store/reconcile.js';
 
-const exec = promisify(execFile);
-
 /** Bearer-token regex — case-insensitive, single whitespace separator. */
 const BEARER_RE = /^Bearer\s+(\S+)$/i;
 
@@ -146,44 +142,35 @@ export async function internalRoutes(fastify: FastifyInstance): Promise<void> {
       }
 
       const startedAt = Date.now();
-      const repoPath = fastify.config.CFP_DATA_REPO_PATH;
       const commitHash = body.commitHash;
 
       // ---- Cheap pre-check: is `commitHash` already in local HEAD? ----
-      // No lock acquired here — `merge-base --is-ancestor` only reads
-      // git's object store, which is safe alongside an in-flight
-      // gitsheets transact. Worst case (a transact lands between this
-      // check and the answer being read) we accept a stale "no" and
-      // proceed to the full reconcile.
+      // No lock acquired here — `repo.isAncestor` only reads git's object
+      // store, which is safe alongside an in-flight gitsheets transact.
+      // Worst case (a transact lands between resolving HEAD and the answer
+      // being read) we accept a stale "no" and proceed to the full
+      // reconcile.
       if (commitHash) {
         try {
-          const head = (
-            await exec('git', ['rev-parse', 'HEAD'], { cwd: repoPath })
-          ).stdout.trim();
-          await exec(
-            'git',
-            ['merge-base', '--is-ancestor', commitHash, head],
-            { cwd: repoPath },
-          );
-          // `git merge-base --is-ancestor` exits 0 = is-ancestor, 1 = not.
-          // Reaching here means exit 0; short-circuit.
-          fastify.log.info(
-            { branch, commitHash, head },
-            'hot-reload short-circuit: commit already in local HEAD',
-          );
-          return reply.send(
-            ok({
-              noChanges: true,
-              outcome: 'in-sync' as ReconcileOutcome,
-              head,
-              durationMs: Date.now() - startedAt,
-            }),
-          );
+          const head = await fastify.publicRepo.resolveRef('HEAD');
+          if (head && (await fastify.publicRepo.isAncestor(commitHash, head))) {
+            fastify.log.info(
+              { branch, commitHash, head },
+              'hot-reload short-circuit: commit already in local HEAD',
+            );
+            return reply.send(
+              ok({
+                noChanges: true,
+                outcome: 'in-sync' as ReconcileOutcome,
+                head,
+                durationMs: Date.now() - startedAt,
+              }),
+            );
+          }
         } catch (err) {
-          // exec throws with `code: 1` when not-ancestor (continue to
-          // reconcile) and with other codes when the commit is unknown
-          // or git itself fails. We treat all non-zero as "fall through
-          // to reconcile" — the reconcile will fetch and try again.
+          // RefError when the commit isn't in the local object store yet
+          // (the usual case for an upstream push). Fall through to the
+          // reconcile, which fetches and tries again.
           fastify.log.debug(
             {
               err: err instanceof Error ? err.message : String(err),