@@ -3,7 +3,7 @@ import type { Plan, PlanItem } from './plan.ts';
 import type { Segment } from './linking.ts';
 
 /** Stable representation ignores object-key order and normalizes CRLF, not whitespace. */
-function stable(value: unknown): string {
+export function stable(value: unknown): string {
   if (typeof value === 'string') return JSON.stringify(value.replace(/\r\n/g, '\n'));
   if (Array.isArray(value)) return `[${value.map(stable).join(',')}]`;
   if (value !== null && typeof value === 'object') return `{${Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, val]) => `${JSON.stringify(key)}:${stable(val)}`).join(',')}}`;
@@ -33,11 +33,13 @@ export function applyChoices(plan: Plan, segments: readonly Segment[], choices:
   });
 }
 export interface Approval { item: string; fingerprint: string }
-function fingerprint(item: PlanItem, segments: readonly Segment[], identity: PlanIdentity): string {
-  return stable({ identity: identityKey(identity), item, segments: segments.filter(s => s.row === item.id).map(s => ({
-    path: s.path, oldPath: s.oldPath, kind: s.kind, operation: s.operation,
-    content: s.content, context: s.context, owners: [...s.owners].sort(),
-  })) });
+/** Every segment field an approval covers. */
+export const reviewedSegment = (s: Segment) => ({
+  path: s.path, oldPath: s.oldPath, kind: s.kind, operation: s.operation,
+  content: s.content, context: s.context, owners: [...s.owners].sort(),
+});
+export function fingerprint(item: PlanItem, segments: readonly Segment[], identity: PlanIdentity): string {
+  return stable({ identity: identityKey(identity), item, segments: segments.filter(s => s.row === item.id).map(reviewedSegment) });
 }
 export function approveItem(plan: Plan, segments: readonly Segment[], itemId: string, identity: PlanIdentity, confirmNoChange = false): Approval {
   const item = plan.items.find(item => item.id === itemId);
 
@@ -5,7 +5,8 @@ import { Store, type ReviewState, type SnippetReference } from './store.ts';
 import type { PlanIdentity } from '../core/identity.ts';
 import { readHistory } from '../git/history.ts';
 import { linkHistory } from '../core/linking.ts';
-import { applyChoices, approvalStates, approveItem, choiceKeys } from '../core/approvals.ts';
+import { applyChoices, approvalStates, approveItem, choiceKeys, fingerprint, reviewedSegment, stable } from '../core/approvals.ts';
+import type { PlanItem } from '../core/plan.ts';
 import type { GhMergeConfig } from '../github/merge.ts';
 
 export interface ReviewConfig { database: string; repository: string; identity: PlanIdentity; pathIdentity: { caseSensitive: boolean; unicodeNormalization: 'none' | 'NFC' }; demo?: boolean; github?: GhMergeConfig }
@@ -63,6 +64,29 @@ export class ReviewService {
     const contextIds = new Map(plan.items.map(item => [item.id,createHash('sha256').update(JSON.stringify(segments.filter(segment=>segment.row===item.id).map(segment=>segment.key))).digest('hex')]));
     const notes = this.store.getReviewNotes(identity).map(note => {const contextId=contextIds.get(note.item)!;return { ...note, contextId, answerOutdated: note.snapshotId!==snapshot.id || note.revision!==plan.revision || (!!note.answer?.contextId && note.answer.contextId!==contextId), outdated: !!note.reference && (note.reference.head !== history.head || note.reference.base !== history.base || !segments.some(segment => segment.key === note.reference!.key && segment.row === note.item)) };});
     if (this.store.reviewVersion(identity) !== reviewVersion || this.store.getPlan(identity).revision !== plan.revision || this.store.getSnapshot(identity).id !== snapshot.id) throw new Error('Stale review state. Reload before writing.');
+    // Names each stale item's stale state from every input that decides it, so the page keeps a reviewer's view choice only while that state is unchanged.
+    const staleKeys = new Map<string, string | null>();
+    // Every field an approval covers, in the approval fingerprint's canonical form, hashed once per segment so a segment shared by many stale items is not serialized once per owner.
+    const reviewedDigests = new Map<string, string>();
+    const reviewedDigest = (segment: typeof segments[number]) => {
+      let digest = reviewedDigests.get(segment.key);
+      if (digest === undefined) reviewedDigests.set(segment.key, digest = createHash('sha256').update(stable(reviewedSegment(segment))).digest('hex'));
+      return digest;
+    };
+    const staleKey = (item: PlanItem): string | null => {
+      if (staleKeys.has(item.id)) return staleKeys.get(item.id) ?? null;
+      staleKeys.set(item.id, null);
+      if (states[item.id] !== 'stale') return null;
+      const key = createHash('sha256').update(JSON.stringify({
+        approval: saved.approvals.find(value => value.item === item.id) ?? null,
+        current: fingerprint(item, segments, identity),
+        ambiguous: segments.filter(segment => segment.row === 'Ambiguous' && segment.owners.includes(item.id)).map(reviewedDigest),
+        dependencies: item.depends_on.map(id => { const dependency = plan.items.find(value => value.id === id); return dependency ? staleKey(dependency) : null; }),
+        replacement: replacementReview ? { snapshotId: snapshot.id, revision: plan.revision, requiresFreshReview: mergeAttempt.requiresFreshReview, reviewVersion: mergeAttempt.reviewVersion } : null,
+      })).digest('hex');
+      staleKeys.set(item.id, key);
+      return key;
+    };
     const items = plan.items.map(item => {
       const owned = segments.filter(segment => segment.row === item.id);
       const ambiguous = segments.filter(segment => segment.row === 'Ambiguous' && segment.owners.includes(item.id)).length;
@@ -80,7 +104,7 @@ export class ReviewService {
         for (const dep of item.depends_on) if (states[dep] === 'stale') reasons.push(`Depends on ${dep}, which changed`);
         if (!reasons.length) reasons.push('Code or plan definition changed');
       }
-      return { ...item, state: states[item.id], count: owned.length, ambiguousCount: ambiguous, reasons, before,
+      return { ...item, state: states[item.id], count: owned.length, ambiguousCount: ambiguous, reasons, before, staleKey: staleKey(item),
         checks: { attributed: ambiguous ? `! ${ambiguous} ambiguous` : owned.length ? '✓ Attributed' : '– No changes', scope: outside.length ? `✕ ${new Set(outside).size} out of scope` : owned.length ? '✓ In scope' : '– No changes', tests: item.acceptance.some(check => check.type === 'cmd') ? '– Not run' : '– No tests defined', ai: '– Not run' }, outside: [...new Set(outside)],
       };
     });
 
@@ -10,6 +10,7 @@ import { choiceKeys } from '../../core/approvals.ts';
 import { ReviewService } from '../../runner/review.ts';
 import { startServer } from '../../web/server.ts';
 import type { MergeGateway, MergeQueueGateway } from '../../github/merge.ts';
+import { fixtureGit } from '../fixtures/git.ts';
 let root: string, app: Awaited<ReturnType<typeof startServer>>;
 // Resolves once the server has parsed the headers of the request that carries `marker` and is reading its body, so that partial request is provably admitted before shutdown starts.
 // Matching the marker matters: any other client on the port (a polling tab, a reused ephemeral port) also emits 'request' and would start shutdown too early.
@@ -98,6 +99,43 @@ test('reviews real changes, persists approval and conversation, and assigns fore
   await page.getByRole('button',{name:/P1 Bound exponential retries/}).click();await expect(page.getByText('! Stale:',{exact:false})).toBeVisible();await expect(page.getByRole('heading',{name:'At approval'})).toBeVisible();
   await page.screenshot({path:'test-results/review-desktop.png',fullPage:true});expect(errors).toEqual([]);
 });
+test('opens an item selected while an assignment is in flight in the view its answered state calls for',async({page})=>{
+ await page.goto(app.url);await page.getByRole('button',{name:'Approve P1',exact:true}).click();await expect(page.getByText('1 of 3 approved')).toBeVisible();
+ let release!:()=>void,arrived!:()=>void;const held=new Promise<void>(resolve=>{release=resolve;}),assignArrived=new Promise<void>(resolve=>{arrived=resolve;});
+ await page.route('**/api/action',async route=>{if(route.request().postDataJSON().action==='assign'){arrived();await held;}await route.continue();});
+ await page.getByRole('button',{name:/Unplanned changes/}).click();await page.getByLabel('Assign change 1 to').selectOption('P1');await page.getByRole('button',{name:'Assign',exact:true}).first().click();await assignArrived;
+ // P1 is still approved in the page when it is selected; the held answer makes it stale.
+ await page.getByRole('button',{name:/P1 Bound exponential retries/}).click();await expect(page.getByRole('heading',{name:'Bound exponential retries'})).toBeVisible();await expect(page.getByText('! Stale:',{exact:false})).toHaveCount(0);
+ release();await expect(page.getByText('! Stale:',{exact:false})).toBeVisible();
+ await expect(page.getByRole('button',{name:'Since approval',exact:true})).toHaveAttribute('aria-pressed','true');await expect(page.getByRole('heading',{name:'At approval'})).toBeVisible();
+ expect(app.service.load().items.find(item=>item.id==='P1')!.state).toBe('stale');
+ // An explicit choice survives the next answer.
+ await page.getByRole('button',{name:'Full change',exact:true}).click();await expect(page.getByRole('heading',{name:'At approval'})).toHaveCount(0);
+ // Every check below already holds before the Refresh answer, so wait until that answer is rendered.
+ const answered=page.waitForResponse('**/api/review');await page.getByRole('button',{name:'Refresh',exact:true}).click();await answered;await expect(page.locator('#banner')).not.toContainText('Linking changes');
+ await expect(page.getByText('! Stale:',{exact:false})).toBeVisible();await expect(page.getByRole('button',{name:'Full change',exact:true})).toHaveAttribute('aria-pressed','true');await expect(page.getByRole('heading',{name:'At approval'})).toHaveCount(0);
+ // A code change on the still-stale item is a new state, so the choice made on the old one no longer holds.
+ const repository=app.service.config.repository;writeFileSync(join(repository,'retry.ts'),'export function delay(attempt: number) {\n  return 42;\n}\n');fixtureGit(repository,'commit','-am','External change');
+ await page.getByRole('button',{name:'Refresh',exact:true}).click();await expect(page.getByText('! Stale:',{exact:false}).first()).toBeVisible();await expect(page.getByRole('button',{name:'Since approval',exact:true})).toHaveAttribute('aria-pressed','true');await expect(page.getByRole('heading',{name:'At approval'})).toBeVisible();
+ // After approval, a new stale state opens the comparison again.
+ await page.getByRole('button',{name:'Full change',exact:true}).click();await expect(page.getByRole('heading',{name:'At approval'})).toHaveCount(0);
+ await page.getByRole('button',{name:'Approve P1',exact:true}).click();await expect(page.getByText('! Stale:',{exact:false})).toHaveCount(0);
+ let view=app.service.load();view=app.service.act({action:'assign',key:view.segments.find(segment=>segment.row==='Unplanned'&&segment.path==='retry.ts')!.key,item:'P1',token:view.token});expect(view.items.find(item=>item.id==='P1')!.state).toBe('stale');
+ await page.getByRole('button',{name:'Refresh',exact:true}).click();await expect(page.getByText('! Stale:',{exact:false}).first()).toBeVisible();await expect(page.getByRole('button',{name:'Since approval',exact:true})).toHaveAttribute('aria-pressed','true');await expect(page.getByRole('heading',{name:'At approval'})).toBeVisible();
+});
+test('keeps an explicit view choice only while the server names the same stale state',async({page})=>{
+ let view=app.service.load();view=app.service.act({action:'approve',item:'P1',confirmNoChange:false,token:view.token});
+ view=app.service.act({action:'assign',key:view.segments.find(segment=>segment.row==='Unplanned')!.key,item:'P1',token:view.token});expect(view.items.find(item=>item.id==='P1')!.state).toBe('stale');
+ // The answer is the server's own, except that P1's staleKey can be replaced; nothing else about P1 changes.
+ let staleKey:string|null=null;
+ await page.route('**/api/review',async route=>{const response=await route.fetch(),body=await response.json();if(staleKey)body.items.find((item:{id:string})=>item.id==='P1').staleKey=staleKey;await route.fulfill({response,json:body});});
+ const refresh=async()=>{const answered=page.waitForResponse('**/api/review');await page.getByRole('button',{name:'Refresh',exact:true}).click();await answered;await expect(page.locator('#banner')).not.toContainText('Linking changes');};
+ await page.goto(app.url);await page.getByRole('button',{name:/P1 Bound exponential retries/}).click();await expect(page.getByRole('heading',{name:'At approval'})).toBeVisible();
+ await page.getByRole('button',{name:'Full change',exact:true}).click();await expect(page.getByRole('heading',{name:'At approval'})).toHaveCount(0);
+ await refresh();await expect(page.getByRole('button',{name:'Full change',exact:true})).toHaveAttribute('aria-pressed','true');await expect(page.getByRole('heading',{name:'At approval'})).toHaveCount(0);
+ staleKey='0'.repeat(64);await refresh();
+ await expect(page.getByRole('button',{name:'Since approval',exact:true})).toHaveAttribute('aria-pressed','true');await expect(page.getByRole('heading',{name:'At approval'})).toBeVisible();
+});
 test('shows file metadata and no-change confirmation, supports narrow desktop and keyboard',async({page})=>{
   await page.goto(app.url);await page.getByRole('button',{name:/P2 Document retry behavior/}).click();await expect(page.getByText('File mode changed',{exact:false})).toBeVisible();await expect(page.getByText('✕ Out of scope',{exact:true})).toBeVisible();
   await page.getByRole('button',{name:/P3 Confirm API compatibility/}).click();await page.getByRole('button',{name:'Confirm no change needed',exact:true}).click();await expect(page.getByText('1 of 3 approved')).toBeVisible();
 
@@ -0,0 +1,26 @@
+import { afterEach, expect, it, vi } from 'vitest';
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { fixtureGit } from './fixtures/git.ts';
+
+const roots: string[] = [];
+afterEach(() => { vi.unstubAllEnvs(); roots.splice(0).forEach(root => rmSync(root, { recursive: true, force: true })); });
+function repository() {
+  const root = mkdtempSync(join(tmpdir(), 'codeboost-fixture-git-')); roots.push(root);
+  const inside = join(root, 'inside'), outside = join(root, 'outside');
+  for (const path of [inside, outside]) { fixtureGit(root, 'init', '-q', '-b', 'main', path); fixtureGit(path, 'config', 'user.name', 'Fixture'); fixtureGit(path, 'config', 'user.email', 'fixture@example.invalid'); }
+  return { inside, outside };
+}
+it('ignores inherited Git variables and user or system config, so a commit stays in the fixture', () => {
+  const { inside, outside } = repository();
+  // An alias is set nowhere else, so running it succeeds only if the inherited config file was read.
+  const inherited = join(inside, '..', 'inherited.gitconfig'); writeFileSync(inherited, '[alias]\n\tinherited = rev-parse --git-dir\n');
+  vi.stubEnv('GIT_DIR', join(outside, '.git')); vi.stubEnv('GIT_WORK_TREE', outside); vi.stubEnv('GIT_AUTHOR_NAME', 'Inherited');
+  vi.stubEnv('GIT_CONFIG_GLOBAL', inherited); vi.stubEnv('GIT_CONFIG_SYSTEM', inherited); vi.stubEnv('GIT_CONFIG_NOSYSTEM', '0');
+  writeFileSync(join(inside, 'file.txt'), 'x\n'); fixtureGit(inside, 'add', 'file.txt'); fixtureGit(inside, 'commit', '-q', '-m', 'Inside');
+  expect(fixtureGit(inside, 'log', '-1', '--format=%an %s')).toBe('Fixture Inside');
+  expect(() => fixtureGit(inside, 'inherited')).toThrow(/not a git command/);
+  vi.unstubAllEnvs();
+  expect(() => fixtureGit(outside, 'rev-parse', '--verify', 'HEAD')).toThrow();
+});
@@ -0,0 +1,13 @@
+import { execFileSync } from 'node:child_process';
+
+/**
+ * Runs Git in a test fixture repository with the repository's hardened invocation: an allowlisted environment,
+ * no user or system config, no hooks, no lazy fetch and no network protocols. Commit identity comes from the
+ * fixture's own repository config.
+ */
+export function fixtureGit(repository: string, ...args: string[]): string {
+  return execFileSync('git', ['--no-pager', '--no-replace-objects', '-c', 'core.hooksPath=/dev/null', '-c', 'protocol.allow=never', ...args], {
+    cwd: repository, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'],
+    env: { PATH: process.env.PATH ?? '', GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: '/dev/null', GIT_TERMINAL_PROMPT: '0', GIT_NO_LAZY_FETCH: '1' },
+  }).trim();
+}