diff --git a/.github/instructions/code-review.instructions.md b/.github/instructions/code-review.instructions.md
index 7d36b358..19859547 100644
--- a/.github/instructions/code-review.instructions.md
+++ b/.github/instructions/code-review.instructions.md
@@ -61,7 +61,7 @@ Invariants. Breaking one is a `[fix here]` finding even when the code works on t
 
 **Child processes run on Electron's bundled Node, never the host's.** Spawns go through `process.execPath` with `ELECTRON_RUN_AS_NODE=1` in the environment (see `runNpmWithEngineRetry` and the `playground:start` handler in `src/main.js`, and `buildChildEnv`). A bare `spawn('node')` or `spawn('npm')` assumes a host toolchain that is not there. On Windows child `npm` processes find a `node` at all only because of the `PATH` shim built by `ensureNodeShimDir` — new spawns must inherit that environment rather than build their own. The one exception is the bundled Git, which is not a Node process and gets its own environment from `src/git-binary.cjs` (next invariant).
 
-**Git is the binary the app ships, never the host's.** Since #364 the app bundles Git through `dugite`, unpacked from `app.asar`. `require('dugite')` appears in exactly one file, `src/git-binary.cjs`; every Git spawn resolves the binary with its `resolveGitBinary`, takes its environment from `buildGitEnv`, its options from `SPAWN_OPTIONS` (which already sets `detached` the way section 4 asks), and starts its arguments with `BASE_ARGS`. That env drops every `GIT_*` variable the host had (dugite would otherwise honour `LOCAL_GIT_DIRECTORY` and `GIT_EXEC_PATH` and run a different Git), turns the host's system and global config off, and turns prompting off, so the host's shell or `~/.gitconfig` cannot change what the app does. A `spawn('git')` that relies on `PATH`, a hand-joined path into the dugite tree, a `GitProcess.exec` outside that file, a Git call given `buildChildEnv`'s environment, or one spawned without an explicit `cwd` is a regression. Parse only porcelain-stable output, with the flag that pins it (`--porcelain=v2`, `-z`, an explicit `--format`); parsing human-facing output is a finding however convenient. During the migration the flows still run on `isomorphic-git`, and patch and diff generation stays hand-rolled in `src/main.js` (stage untracked files, diff working tree against `origin/trunk`) until the phase that moves it.
+**Git is the binary the app ships, never the host's.** Since #364 the app bundles Git through `dugite`, unpacked from `app.asar`. `require('dugite')` appears in exactly one file, `src/git-binary.cjs`; every Git spawn resolves the binary with its `resolveGitBinary`, takes its environment from `buildGitEnv`, its options from `SPAWN_OPTIONS` (which already sets `detached` the way section 4 asks), and starts its arguments with `BASE_ARGS`. That env drops every `GIT_*` variable the host had (dugite would otherwise honour `LOCAL_GIT_DIRECTORY` and `GIT_EXEC_PATH` and run a different Git), turns the host's system and global config off, and turns prompting off, so the host's shell or `~/.gitconfig` cannot change what the app does. A `spawn('git')` that relies on `PATH`, a hand-joined path into the dugite tree, a `GitProcess.exec` outside that file, a Git call given `buildChildEnv`'s environment, or one spawned without an explicit `cwd` is a regression. Parse only porcelain-stable output, with the flag that pins it (`--porcelain=v2`, `-z`, an explicit `--format`); parsing human-facing output is a finding however convenient. `src/git-run.cjs` is the only module that spawns the binary and `src/git-read.cjs` the only one that parses its output; a new read belongs there, with a parser test on fixture bytes, not inline at a call site. Since #384 every read outside the write flows runs on the bundled Git and returns the same shapes the `isomorphic-git` calls returned (status rows included), so a facade signature that changes with the engine is a finding; the writes and the clone, with the reads inside them, still run on `isomorphic-git` until #385, and patch and diff generation stays hand-rolled in `src/main.js` until the phase that moves it.
 
 **`electron-store` is the only persistence layer.** No database, no sidecar JSON. It holds the site registry and per-site metadata and is the single source of truth for "known sites". A second store, a cache file, or state parked in a module-level variable that outlives a handler is architectural drift — flag it.
 
diff --git a/AGENTS.md b/AGENTS.md
index e4fb2727..405f4d4f 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -87,7 +87,7 @@ When asked to add an existing pull request to an existing stack, preserve its co
 ## Architecture notes (non-obvious)
 
 - **Child processes run on Electron's own Node, not the system Node.** `npm install`, `npm run <script>`, and the Playground server are spawned via `process.execPath` + `ELECTRON_RUN_AS_NODE=1` — this is the mechanism behind "zero prerequisites." On Windows this requires shimming `node`/`npm`/`npx` into `PATH` so child `npm` processes can find a `node` binary at all.
-- **Git has no host dependency.** The app ships its own Git binary via `dugite` (#364), unpacked from `app.asar` and resolved only through `src/git-binary.cjs`, which also builds the environment it runs with (host system and global config off, prompting off, no `GIT_*` variable inherited from the host and nothing from a Node child). `require('dugite')` lives in that one file. Spawning a `git` found on `PATH`, or calling dugite's `GitProcess` from anywhere else, is a regression. While the #364 migration is in progress the flows still run on `isomorphic-git`; phase by phase they move to the bundled binary, and only porcelain-stable output (`--porcelain=v2`, `-z`, explicit `--format`) is ever parsed. Patch/diff generation is done by hand in `main.js`, not `git diff`: one status scan against the branch point each ticket recorded (#108), nothing staged, and `/dev/null` naming whichever side of an addition or a deletion does not exist — the app reads its own patches back when a mentor applies one, and that filename is the only thing its parser reads an add or a delete from (#85).
+- **Git has no host dependency.** The app ships its own Git binary via `dugite` (#364), unpacked from `app.asar` and resolved only through `src/git-binary.cjs`, which also builds the environment it runs with (host system and global config off, prompting off, no `GIT_*` variable inherited from the host and nothing from a Node child). `require('dugite')` lives in that one file; `src/git-run.cjs` is the only place the binary is spawned, and `src/git-read.cjs` holds every read and its parser. Spawning a `git` found on `PATH`, or calling dugite's `GitProcess` from anywhere else, is a regression. As of #384 every read outside the write flows (status, branches, history, blobs, the patch walk) runs on the bundled binary; the writes and the clone, including the reads inside them, still run on `isomorphic-git` until #385 moves them flow by flow. Only porcelain-stable output (`--porcelain=v2`, `-z`, explicit `--format`) is ever parsed. Patch/diff generation is done by hand in `main.js`, not `git diff`: one status scan against the branch point each ticket recorded (#108), nothing staged, and `/dev/null` naming whichever side of an addition or a deletion does not exist — the app reads its own patches back when a mentor applies one, and that filename is the only thing its parser reads an add or a delete from (#85).
 - **`electron-store` is the only persistence layer** — no separate DB. It holds the site registry and per-site metadata; treat it as the single source of truth for "known sites."
 - Long-running child-process output (installs, scripts, server) is streamed to the renderer via correlated IDs (`installId`/`runId`), not returned synchronously — expect async event handlers, not return values, when tracing that flow.
 
diff --git a/TESTING.md b/TESTING.md
index 804ed10c..ff448d8e 100644
--- a/TESTING.md
+++ b/TESTING.md
@@ -29,6 +29,7 @@ To run one file: `node --test tests/unit/azure-sign.test.cjs`. To run one journe
 tests/
   unit/            layers 1-3 — npm test — under three seconds
     fixtures/      package.json trees the integration tests copy; not tests themselves
+    helpers/       the bundled-Git driver the Git suites share; not a test either
   e2e/
     journeys/      layer 4 — npm run test:e2e
     packaged/      layer 5 — npm run test:e2e:packaged, and it needs a build first
diff --git a/src/git-read.cjs b/src/git-read.cjs
new file mode 100644
index 00000000..ef277917
--- /dev/null
+++ b/src/git-read.cjs
@@ -0,0 +1,423 @@
+'use strict';
+
+/**
+ * Reads through the bundled Git (#384): every question the app asks a
+ * repository without changing it, and the parser for each answer.
+ *
+ * Every command here asks for porcelain-stable output with the flag that pins
+ * it (`--porcelain=v2`, `-z`, an explicit `--format`), and every parser is a
+ * pure function over the bytes so it can be tested on fixture strings without
+ * a repository. The read functions return the same shapes the isomorphic-git
+ * calls they replace returned, so the facades that call them
+ * (trunk-update.js, ticket-branches.js, pr-files.cjs, main.js) keep their
+ * signatures and the renderer does not know the engine changed.
+ *
+ * Status rows keep the `[path, head, workdir, stage]` shape documented in
+ * git-update.cjs. The mapping from `status --porcelain=v2` is at
+ * `rowFromStatusEntry`; the one known divergence from isomorphic-git is
+ * described there.
+ */
+
+const { runGit } = require('./git-run.cjs');
+
+const NUL = 0;
+
+/**
+ * NUL-separated fields, as Buffers. A trailing NUL terminates the last field
+ * rather than opening an empty one.
+ *
+ * @param {Buffer} buf
+ * @return {Buffer[]}
+ */
+function splitNul(buf) {
+	const fields = [];
+	let start = 0;
+	for (let i = 0; i < buf.length; i++) {
+		if (buf[i] === NUL) {
+			fields.push(buf.subarray(start, i));
+			start = i + 1;
+		}
+	}
+	if (start < buf.length) fields.push(buf.subarray(start));
+	return fields;
+}
+
+/**
+ * The row `status --porcelain=v2` describes, in statusMatrix's vocabulary.
+ * X is index against HEAD, Y is worktree against index; `.` means unchanged.
+ *
+ *   head    0 absent from HEAD, 1 present
+ *   workdir 0 absent from disk, 1 identical to HEAD, 2 different
+ *   stage   0 absent from index, 1 identical to HEAD, 2 staged change,
+ *           3 staged change with further unstaged edits
+ *
+ * Known divergences, both only reachable through a user's own client: a file
+ * staged and then edited back to its HEAD content is `workdir = 2` here (Y
+ * reports it as modified against the index) where isomorphic-git, which
+ * hashes, said 1; and a path removed from the index but kept on disk is one
+ * "different" row here where isomorphic-git said identical. Every consumer
+ * that acts on the file byte-compares afterwards (isCrlfOnlyChange,
+ * classifyChangedFile), so only a count can differ.
+ *
+ * @param {string} xy
+ * @param {string} filepath
+ * @return {Array}
+ */
+function rowFromStatusEntry(xy, filepath) {
+	const x = xy[0];
+	const y = xy[1];
+	// `A` in either column is a path HEAD does not have: staged as new (`A.`)
+	// or intent-to-add (`.A`). `D.` is a deletion already staged, so the file
+	// is gone from disk as well as from the index.
+	const head = x === 'A' || y === 'A' ? 0 : 1;
+	let workdir;
+	if (y === 'D' || (x === 'D' && y === '.')) workdir = 0;
+	else if (x === '.' && y === '.') workdir = 1;
+	else workdir = 2;
+	let stage;
+	if (x === '.') stage = head;
+	else if (x === 'D') stage = 0;
+	else if (y === '.') stage = 2;
+	else stage = 3;
+	return [filepath, head, workdir, stage];
+}
+
+/**
+ * `git status --porcelain=v2 -z` → status rows. Ignored entries (`!`) are not
+ * requested; untracked (`?`) become `[path, 0, 2, 0]`; unmerged (`u`) are
+ * reported as dirty on every axis, which is the conservative reading for an
+ * app that never merges. Renames are not requested either (`--no-renames`),
+ * but a `2` entry is still consumed whole, both of its paths, so a stray one
+ * cannot shift every field after it.
+ *
+ * @param {Buffer} buf
+ * @return {Array[]}
+ */
+function parseStatusV2Z(buf) {
+	const rows = [];
+	const fields = splitNul(buf);
+	// A path removed from the index but still on disk (`git rm --cached`)
+	// comes back twice, as `1 D.` and again as `?`. One row, "present and
+	// different": the byte compare downstream settles whether it really is.
+	const merge = (row) => {
+		const index = rows.findIndex(([filepath]) => filepath === row[0]);
+		if (index === -1) rows.push(row);
+		else rows[index] = [row[0], 1, 2, 0];
+	};
+	for (let i = 0; i < fields.length; i++) {
+		const entry = fields[i].toString('utf8');
+		const kind = entry[0];
+		if (kind === '?') {
+			merge([entry.slice(2), 0, 2, 0]);
+		} else if (kind === '1') {
+			// 1 <XY> <sub> <mH> <mI> <mW> <hH> <hI> <path>
+			const parts = entry.split(' ');
+			merge(rowFromStatusEntry(parts[1], parts.slice(8).join(' ')));
+		} else if (kind === '2') {
+			// 2 <XY> <sub> <mH> <mI> <mW> <hH> <hI> <Xscore> <path>, then <origPath>
+			const parts = entry.split(' ');
+			rows.push(rowFromStatusEntry(parts[1], parts.slice(9).join(' ')));
+			i += 1;
+		} else if (kind === 'u') {
+			// u <XY> <sub> <m1> <m2> <m3> <mW> <h1> <h2> <h3> <path>
+			const parts = entry.split(' ');
+			rows.push([parts.slice(10).join(' '), 1, 2, 3]);
+		}
+		// '!' (ignored) and '#' (headers) are never requested; skip anything else.
+	}
+	return rows;
+}
+
+/**
+ * `git diff --name-status -z --no-renames <commit>` → status rows against
+ * that commit, index column 0 because the index is not what was compared.
+ * Statuses: A added, M modified, T type change, D deleted. Untracked files
+ * are not in a diff; `parseZList` on `ls-files --others` supplies them.
+ *
+ * @param {Buffer} buf
+ * @return {Array[]}
+ */
+function parseNameStatusZ(buf) {
+	const rows = [];
+	const fields = splitNul(buf);
+	for (let i = 0; i + 1 < fields.length; i += 2) {
+		const status = fields[i].toString('utf8')[0];
+		const filepath = fields[i + 1].toString('utf8');
+		if (status === 'A') rows.push([filepath, 0, 2, 0]);
+		else if (status === 'D') rows.push([filepath, 1, 0, 0]);
+		else rows.push([filepath, 1, 2, 0]);
+	}
+	return rows;
+}
+
+/**
+ * A `-z` list of paths (`ls-files -z`, `for-each-ref` with `%00`).
+ *
+ * @param {Buffer} buf
+ * @return {string[]}
+ */
+function parseZList(buf) {
+	return splitNul(buf).map((field) => field.toString('utf8')).filter((s) => s.length > 0);
+}
+
+/**
+ * `git cat-file --batch` output, in request order → the object bytes per
+ * request, or null where Git answered `missing`. Paths are decoded as UTF-8
+ * here and everywhere below; a path that is not valid UTF-8 would round-trip
+ * wrongly, and wordpress-develop has none. Requests are `<oid>:<path>`
+ * strings; the caller supplies them in the same order it wrote them to stdin.
+ *
+ * Each answer is a header line `<sha> <type> <size>\n`, then `size` bytes,
+ * then a newline; or `<request> missing\n`.
+ *
+ * @param {Buffer}   buf
+ * @param {string[]} requests
+ * @return {Map<string, Buffer|null>}
+ */
+function parseCatFileBatch(buf, requests) {
+	const answers = new Map();
+	let pos = 0;
+	for (const request of requests) {
+		const nl = buf.indexOf(10, pos);
+		if (nl === -1) break;
+		const header = buf.subarray(pos, nl).toString('utf8');
+		pos = nl + 1;
+		if (header.endsWith(' missing')) {
+			answers.set(request, null);
+			continue;
+		}
+		const size = Number(header.split(' ')[2]);
+		// A `missing` echo of a path containing a newline does not end with
+		// " missing" on its first line; every offset after it would be wrong,
+		// so stop here and let the remaining requests read as absent.
+		if (!Number.isFinite(size)) break;
+		answers.set(request, Buffer.from(buf.subarray(pos, pos + size)));
+		pos += size + 1;
+	}
+	return answers;
+}
+
+/**
+ * `git cat-file --batch-check` output → the object id per request, or null.
+ *
+ * @param {Buffer}   buf
+ * @param {string[]} requests
+ * @return {Map<string, string|null>}
+ */
+function parseCatFileBatchCheck(buf, requests) {
+	const answers = new Map();
+	const lines = buf.toString('utf8').split('\n');
+	requests.forEach((request, i) => {
+		const line = lines[i] || '';
+		answers.set(request, line.endsWith(' missing') || !line ? null : line.split(' ')[0]);
+	});
+	return answers;
+}
+
+/**
+ * `git ls-tree -z <tree-ish> -- <path>` → the entry, or null when the path is
+ * not in that tree. Format: `<mode> <type> <oid>\t<path>`.
+ *
+ * @param {Buffer} buf
+ * @return {?{mode: string, type: string, oid: string, path: string}}
+ */
+function parseLsTreeZ(buf) {
+	const first = splitNul(buf)[0];
+	if (!first || first.length === 0) return null;
+	const text = first.toString('utf8');
+	const tab = text.indexOf('\t');
+	if (tab === -1) return null;
+	const [mode, type, oid] = text.slice(0, tab).split(' ');
+	return { mode, type, oid, path: text.slice(tab + 1) };
+}
+
+/**
+ * The Windows-only view createCrlfCompatibleFs gives isomorphic-git, for the
+ * binary: a site checked out by a host Git with a global `autocrlf = true`
+ * sits on disk as CRLF, its repository config says nothing, and the app's Git
+ * reads no global config (git-binary.cjs). Without this, `status` reports
+ * every text file. An explicit local value passes through untouched (#341).
+ *
+ * @param {string}   dir
+ * @param {Object}   [options]
+ * @param {string}   [options.platform]
+ * @param {Function} [options.run]
+ * @return {Promise<string[]>} Arguments to place before the subcommand.
+ */
+async function crlfArgs(dir, { platform = process.platform, run = runGit } = {}) {
+	if (platform !== 'win32') return [];
+	const { status } = await run(['config', '--local', '--get', 'core.autocrlf'], { cwd: dir, okCodes: [0, 1] });
+	return status === 1 ? ['-c', 'core.autocrlf=true'] : [];
+}
+
+/**
+ * The commit a ref points at, or null when it does not resolve.
+ *
+ * @param {string} dir
+ * @param {string} ref
+ * @return {Promise<?string>}
+ */
+async function resolveRef(dir, ref) {
+	const { status, stdout } = await runGit(['rev-parse', '--verify', '--quiet', `${ref}^{commit}`], { cwd: dir, okCodes: [0, 1] });
+	return status === 0 ? stdout.toString('utf8').trim() : null;
+}
+
+/**
+ * A commit's id and committer date, as the ISO string the app has always
+ * stored. `%ct` is the epoch second, so the string is UTC regardless of the
+ * committer's own offset, which is what `%cI` would have carried.
+ *
+ * @param {string} dir
+ * @param {string} ref
+ * @return {Promise<{oid: string, date: string}>} Throws when the ref is missing.
+ */
+async function readCommitInfo(dir, ref) {
+	const { stdout } = await runGit(['log', '-1', '--format=%H%x00%ct', ref, '--'], { cwd: dir });
+	const [oid, seconds] = stdout.toString('utf8').trim().split('\0');
+	return { oid, date: new Date(Number(seconds) * 1000).toISOString() };
+}
+
+/**
+ * The checked-out branch, or null when HEAD is detached. `symbolic-ref
+ * --quiet` answers a detached HEAD with exit 1; `rev-parse --abbrev-ref`
+ * would print the literal `HEAD` instead, and `--short` abbreviates against
+ * tags, so the prefix is stripped here.
+ *
+ * @param {string} dir
+ * @return {Promise<?string>}
+ */
+async function currentBranch(dir) {
+	const { status, stdout } = await runGit(['symbolic-ref', '--quiet', 'HEAD'], { cwd: dir, okCodes: [0, 1] });
+	if (status !== 0) return null;
+	return stdout.toString('utf8').trim().replace(/^refs\/heads\//, '');
+}
+
+/**
+ * Every local branch name. Ref names cannot contain a newline (or a space, or
+ * control characters: `git check-ref-format`), so the default one-per-line
+ * output is already unambiguous.
+ *
+ * @param {string} dir
+ * @return {Promise<string[]>}
+ */
+async function listBranches(dir) {
+	const { stdout } = await runGit(['for-each-ref', '--format=%(refname)', 'refs/heads/'], { cwd: dir });
+	return stdout.toString('utf8').split('\n').filter((line) => line.length > 0).map((ref) => ref.replace(/^refs\/heads\//, ''));
+}
+
+/**
+ * The worktree against HEAD, every non-ignored file, in status rows. This is
+ * the scan every park and every dirty check runs.
+ *
+ * @param {string}   dir
+ * @param {Object}   [options]
+ * @param {string}   [options.platform]
+ * @param {Function} [options.run]      Injection point for tests.
+ * @return {Promise<Array[]>}
+ */
+async function statusRows(dir, { platform = process.platform, run = runGit } = {}) {
+	const crlf = await crlfArgs(dir, { platform, run });
+	const { stdout } = await run([...crlf, 'status', '--porcelain=v2', '-z', '--untracked-files=all', '--no-renames'], { cwd: dir });
+	return parseStatusV2Z(stdout);
+}
+
+/**
+ * The worktree against an arbitrary commit (a ticket's branch point, which is
+ * not HEAD once work is parked), in status rows with the index column 0.
+ * `git diff <commit>` compares by content, so a file whose stat data is stale
+ * is hashed rather than reported; untracked files come from `ls-files`.
+ *
+ * @param {string}   dir
+ * @param {string}   ref
+ * @param {Object}   [options]
+ * @param {string}   [options.platform]
+ * @param {Function} [options.run]      Injection point for tests.
+ * @return {Promise<Array[]>}
+ */
+async function changesAgainst(dir, ref, { platform = process.platform, run = runGit } = {}) {
+	const crlf = await crlfArgs(dir, { platform, run });
+	const diff = await run([...crlf, 'diff', '--name-status', '-z', '--no-renames', ref, '--'], { cwd: dir });
+	const others = await run([...crlf, 'ls-files', '--others', '--exclude-standard', '-z'], { cwd: dir });
+	const rows = parseNameStatusZ(diff.stdout);
+	const byPath = new Map(rows.map((row, index) => [row[0], index]));
+	for (const filepath of parseZList(others.stdout)) {
+		const index = byPath.get(filepath);
+		if (index === undefined) {
+			byPath.set(filepath, rows.length);
+			rows.push([filepath, 0, 2, 0]);
+		} else if (rows[index][2] === 0) {
+			// The diff called it deleted because it left the index (`git rm
+			// --cached`), but the file is on disk. Reporting a deletion here is
+			// how a patch would delete a file the contributor still has (#85).
+			rows[index] = [filepath, 1, 2, 0];
+		}
+	}
+	return rows;
+}
+
+/**
+ * The bytes of several paths at one commit, in a single spawn. Raw object
+ * content: no line-ending conversion, exactly what `readBlob` returned.
+ *
+ * @param {string}   dir
+ * @param {string}   oid
+ * @param {string[]} filepaths
+ * @return {Promise<Map<string, Buffer|null>>} Keyed by path; null when absent.
+ */
+async function readBlobs(dir, oid, filepaths) {
+	if (filepaths.length === 0) return new Map();
+	const requests = filepaths.map((filepath) => `${oid}:${filepath}`);
+	const { stdout } = await runGit(['cat-file', '--batch', '-z'], { cwd: dir, input: `${requests.join('\0')}\0` });
+	const byRequest = parseCatFileBatch(stdout, requests);
+	return new Map(filepaths.map((filepath, i) => [filepath, byRequest.get(requests[i]) ?? null]));
+}
+
+/**
+ * The blob id of one path at one commit, or null when absent.
+ *
+ * @param {string} dir
+ * @param {string} oid
+ * @param {string} filepath
+ * @return {Promise<?string>}
+ */
+async function blobOid(dir, oid, filepath) {
+	const request = `${oid}:${filepath}`;
+	const { stdout } = await runGit(['cat-file', '--batch-check', '-z'], { cwd: dir, input: `${request}\0` });
+	return parseCatFileBatchCheck(stdout, [request]).get(request);
+}
+
+/**
+ * The mode a tree records for one path, or null when the path is not there.
+ * One `ls-tree` on the path rather than a walk of the whole commit.
+ *
+ * @param {string} dir
+ * @param {string} oid
+ * @param {string} filepath
+ * @return {Promise<?string>}
+ */
+async function treeEntryMode(dir, oid, filepath) {
+	const { stdout } = await runGit(['ls-tree', '-z', oid, '--', filepath], { cwd: dir });
+	const entry = parseLsTreeZ(stdout);
+	return entry ? entry.mode : null;
+}
+
+module.exports = {
+	splitNul,
+	rowFromStatusEntry,
+	parseStatusV2Z,
+	parseNameStatusZ,
+	parseZList,
+	parseCatFileBatch,
+	parseCatFileBatchCheck,
+	parseLsTreeZ,
+	crlfArgs,
+	resolveRef,
+	readCommitInfo,
+	currentBranch,
+	listBranches,
+	statusRows,
+	changesAgainst,
+	readBlobs,
+	blobOid,
+	treeEntryMode
+};
diff --git a/src/git-run.cjs b/src/git-run.cjs
new file mode 100644
index 00000000..56cb4b34
--- /dev/null
+++ b/src/git-run.cjs
@@ -0,0 +1,188 @@
+'use strict';
+
+/**
+ * Runs the bundled Git (#384, phase 2 of #364). The one place the binary is
+ * spawned: every caller hands in arguments and a working directory and gets
+ * bytes back. No parsing here; each read keeps its parser next to it in
+ * git-read.cjs, so a wrong flag and a wrong parser are found in the same file.
+ *
+ * `spawn`, not `execFile`: execFile buffers stdout against a `maxBuffer` and
+ * kills the child silently when it overflows, and it hides the ChildProcess
+ * that a cancellation needs. Here the cap is explicit, the overflow is an
+ * error the caller sees, and `spawnGit` returns the child so a later phase can
+ * stream a clone's progress and hand it to `killChildTree`.
+ *
+ * Two global options ride on every call:
+ *
+ * - `--no-optional-locks`: a read (`status`, `diff`) otherwise refreshes the
+ *   index opportunistically, which writes `.git/index`. Reads must not write.
+ * - `safe.directory=<cwd>`: with no system or global config in play
+ *   (git-binary.cjs), a site on a folder Git considers "dubiously owned" fails
+ *   every command with exit 128. The app only runs Git in directories it
+ *   registered itself, so trusting exactly the one it is about to use is the
+ *   narrow form; `*` is what a security review would flag.
+ */
+
+const { spawn: nodeSpawn } = require('child_process');
+const { resolveGitBinary, buildGitEnv, BASE_ARGS, SPAWN_OPTIONS } = require('./git-binary.cjs');
+const { killChildTree } = require('./kill-tree.js');
+
+/**
+ * Enough for any porcelain output the app asks for: `status -z` on a tree with
+ * 20,000 dirty paths is about 1 MiB. The cap exists so a runaway command is an
+ * error rather than an out-of-memory in the main process.
+ */
+const DEFAULT_MAX_STDOUT = 64 * 1024 * 1024;
+
+class GitError extends Error {
+	constructor(message, props) {
+		super(message);
+		this.name = 'GitError';
+		Object.assign(this, props);
+	}
+}
+
+/**
+ * The subcommand in an argument list, for messages: the first entry that is
+ * neither an option nor the value of a `-c key=value` pair.
+ *
+ * @param {string[]} args
+ * @return {string}
+ */
+function subcommandOf(args) {
+	for (let i = 0; i < args.length; i++) {
+		if (args[i] === '-c' || args[i] === '-C') { i += 1; continue; }
+		if (!args[i].startsWith('-')) return args[i];
+	}
+	return '(no subcommand)';
+}
+
+/**
+ * Both spellings on Windows: Git compares the directory it resolved, which it
+ * prints with forward slashes, and the value is multi-valued so listing the
+ * native form too costs nothing and cannot be wrong.
+ *
+ * @param {string} cwd
+ * @return {string[]}
+ */
+function safeDirectoryArgs(cwd) {
+	const forward = cwd.replace(/\\/g, '/');
+	const values = forward === cwd ? [cwd] : [cwd, forward];
+	return values.flatMap((value) => ['-c', `safe.directory=${value}`]);
+}
+
+/**
+ * Spawns the bundled Git and returns the child, for callers that stream
+ * (progress on stderr) or that may need to kill it. Most callers want
+ * `runGit`.
+ *
+ * @param {string[]}      args
+ * @param {Object}        options
+ * @param {string}        options.cwd        Required: Git never runs "wherever the
+ *                                           app happens to be".
+ * @param {Buffer|string} [options.input]    Written to stdin, then stdin is closed.
+ * @param {Object}        [options.extraEnv] Passed to buildGitEnv.
+ * @param {Function}      [options.spawn]    Injection point for tests.
+ * @return {import('child_process').ChildProcess}
+ */
+function spawnGit(args, { cwd, input, extraEnv, spawn = nodeSpawn } = {}) {
+	if (typeof cwd !== 'string' || cwd.length === 0) {
+		throw new TypeError('spawnGit needs an explicit cwd');
+	}
+	const argv = [...BASE_ARGS, '--no-optional-locks', ...safeDirectoryArgs(cwd), ...args];
+	return spawn(resolveGitBinary(), argv, {
+		...SPAWN_OPTIONS,
+		cwd,
+		env: buildGitEnv({ extraEnv }),
+		stdio: [input === undefined ? 'ignore' : 'pipe', 'pipe', 'pipe']
+	});
+}
+
+/**
+ * Runs Git to completion. Resolves with `{ status, stdout, stderr }` where
+ * stdout is a Buffer (blob contents are bytes, and `-z` output carries NULs)
+ * and stderr is a string.
+ *
+ * Rejects with a GitError carrying `code`, `signal`, `stderr`, `args` and
+ * `cwd` when the exit status is not in `okCodes`. Query commands that answer
+ * "no" with exit 1 (`rev-parse --verify`, `symbolic-ref`, `config --get`)
+ * pass `okCodes: [0, 1]` and read `status`. 128 is Git's "fatal" and always
+ * surfaces; so does 129 (usage), which means a bug in the caller.
+ *
+ * @param {string[]} args
+ * @param {Object}   options             As spawnGit, plus:
+ * @param {number[]} [options.okCodes]
+ * @param {number}   [options.maxStdout]
+ * @return {Promise<{status: number, stdout: Buffer, stderr: string}>}
+ */
+function runGit(args, { okCodes = [0], maxStdout = DEFAULT_MAX_STDOUT, ...spawnOptions } = {}) {
+	return new Promise((resolve, reject) => {
+		let child;
+		try {
+			child = spawnGit(args, spawnOptions);
+		} catch (error) {
+			reject(error);
+			return;
+		}
+
+		const { cwd, input } = spawnOptions;
+		const name = subcommandOf(args);
+		const out = [];
+		const err = [];
+		let outBytes = 0;
+		let overflow = false;
+		let settled = false;
+		const fail = (error) => {
+			if (settled) return;
+			settled = true;
+			reject(error);
+		};
+
+		child.stdout.on('data', (chunk) => {
+			if (overflow) return;
+			outBytes += chunk.length;
+			if (outBytes > maxStdout) {
+				overflow = true;
+				killChildTree(child);
+				return;
+			}
+			out.push(chunk);
+		});
+		child.stderr.on('data', (chunk) => err.push(chunk));
+		child.on('error', (error) => {
+			fail(new GitError(`git ${name} could not start: ${error.message}`, {
+				code: error.code, signal: null, stderr: '', args, cwd
+			}));
+		});
+		child.on('close', (status, signal) => {
+			if (settled) return;
+			const stderr = Buffer.concat(err).toString('utf8');
+			if (overflow) {
+				fail(new GitError(`git ${name} produced more than ${maxStdout} bytes of output`, {
+					code: 'stdout-overflow', signal, stderr, args, cwd
+				}));
+				return;
+			}
+			if (!okCodes.includes(status)) {
+				const reason = stderr.split(/\r?\n/).find((line) => line.trim()) || (signal ? `killed by ${signal}` : 'no output');
+				fail(new GitError(`git ${name} failed (${status === null ? signal : status}): ${reason}`, {
+					code: status, signal, stderr, args, cwd
+				}));
+				return;
+			}
+			settled = true;
+			resolve({ status, stdout: Buffer.concat(out), stderr });
+		});
+
+		if (input !== undefined) {
+			// EPIPE means Git exited before reading all of stdin, which its exit
+			// status already reports; anything else is a real write failure.
+			child.stdin.on('error', (error) => {
+				if (error.code !== 'EPIPE') fail(error);
+			});
+			child.stdin.end(input);
+		}
+	});
+}
+
+module.exports = { spawnGit, runGit, GitError, DEFAULT_MAX_STDOUT, subcommandOf, safeDirectoryArgs };
diff --git a/src/git-update.cjs b/src/git-update.cjs
index 14d8b547..aa278f92 100644
--- a/src/git-update.cjs
+++ b/src/git-update.cjs
@@ -1,11 +1,13 @@
 'use strict';
 
 /**
- * Pure helpers for the trunk update path (issue #94), operating on
- * isomorphic-git statusMatrix rows and blob oids. Kept dependency-free so
- * `node --test` can require them directly while the git I/O stays in main.js.
+ * Pure helpers for the trunk update path (issue #94), operating on the app's
+ * status rows and on blob oids. Kept dependency-free so `node --test` can
+ * require them directly while the git I/O stays in git-read.cjs and main.js.
  *
- * statusMatrix row shape: [filepath, head, workdir, stage] where
+ * Status row shape (isomorphic-git's statusMatrix vocabulary, which
+ * git-read.cjs keeps producing from `git status --porcelain=v2`):
+ * [filepath, head, workdir, stage] where
  * head: 0 absent, 1 present; workdir: 0 absent, 1 identical, 2 different;
  * stage: 0 absent, 1 identical, 2 modified-staged, 3 modified-unstaged.
  */
diff --git a/src/main.js b/src/main.js
index 639eed8f..834524f8 100644
--- a/src/main.js
+++ b/src/main.js
@@ -35,6 +35,7 @@ const { fetchLinkedPrs, fetchPrDiff } = require('./github-prs');
 const { getClientId: getGithubClientId, requestDeviceCode, pollForToken, fetchViewer } = require('./github-auth.cjs');
 const { openPullRequest, buildPullRequestBody, testMode: githubTestMode } = require('./github-pr.cjs');
 const { buildPullRequestEntries } = require('./pr-files.cjs');
+const { resolveRef, changesAgainst, readBlobs, readCommitInfo, treeEntryMode } = require('./git-read.cjs');
 const { openAndScrape, fetchAttachment } = require('./trac-view');
 const { openExternalUrl, ALLOWED_URL_SCHEMES } = require('./external-url');
 const { deleteRegisteredSite, revealRegisteredSite, clearRegisteredSiteLog } = require('./site-registry');
@@ -432,7 +433,11 @@ function buildPatchHtml(content) {
 // Returns the base commit alongside the files because the pull request needs it
 // as the commit's parent, and it is the same oid the diff was taken against.
 async function collectChangedFiles(dir, baseOid = null) {
-    const gitFs = await ensureAutocrlf(dir) || fs;
+    // Still the first call, and still awaited: the sites:add and patch tests
+    // end the handler here, and a directory that is not a repository fails
+    // here too. Line endings themselves are the binary's business now
+    // (crlfArgs in git-read.cjs).
+    await ensureAutocrlf(dir);
     // The diff base is the branch point of whatever ticket is being worked on
     // (#108) — the trunk snapshot this branch was created from, passed in by the
     // caller from the site's registry entry.
@@ -456,26 +461,37 @@ async function collectChangedFiles(dir, baseOid = null) {
         // No branch point on record: a site still on trunk, or one adopted from
         // disk. HEAD is the trunk snapshot there, which is what this always used
         // to diff against.
-        try { base = await git.resolveRef({ fs: gitFs, dir, ref: 'HEAD' }); } catch {}
+        try { base = await resolveRef(dir, 'HEAD'); } catch {}
         if (!base) {
-            try { base = await git.resolveRef({ fs: gitFs, dir, ref: 'refs/heads/trunk' }); } catch {}
+            try { base = await resolveRef(dir, 'refs/heads/trunk'); } catch {}
         }
     }
+    if (!base) {
+        // Nothing to compare against: `.git` is gone, unreadable, or has no
+        // commit. An error, not "No changes": a patch panel that quietly shows
+        // nothing for a broken site is the failure nobody reports.
+        throw new Error(`${dir} is not a repository the app can read: no HEAD and no trunk to compare against.`);
+    }
 
     // One scan, against the branch point. Untracked files need no staging to
-    // appear: statusMatrix already reports them as [path, 0, 2, 0] and the
+    // appear: the scan already reports them as [path, 0, 2, 0] and the
     // head !== workdir filter below keeps them. The `git.add` loop that used to
     // stand here staged every untracked file into the contributor's real index
     // and never unstaged it (#85) — with the branch point as the base it earns
     // nothing, so it is gone. (`staleStagedPaths` in trunk-update.js stays: it
     // still has to clean up residue left in indexes by earlier versions.)
-    const matrix = await git.statusMatrix({ fs: gitFs, dir, ref: base });
+    const matrix = await changesAgainst(dir, base);
     const changed = matrix.filter(([, head, workdir]) => head !== workdir);
+    // Every base blob in one spawn, rather than one process per changed file.
+    // A failed batch reads as every base unreadable, which classifyChangedFile
+    // names above the diff rather than diffing: wider than the per-file catch
+    // this replaced, but on the safe side.
+    const inBase = changed.filter(([, head]) => head !== 0).map(([filepath]) => filepath);
+    const baseBlobs = await readBlobs(dir, base, inBase).catch(() => new Map());
     const files = [];
     for (const [filepath, head, workdir] of changed) {
         const abs = path.join(dir, filepath);
         const workBuf = workdir ? await fs.promises.readFile(abs).catch(() => null) : null;
-        const baseBlob = head && base ? await git.readBlob({ fs: gitFs, dir, oid: base, filepath }).catch(() => null) : null;
         files.push({
             path: filepath,
             // The status codes, not the buffers, are what say whether a file is
@@ -485,7 +501,7 @@ async function collectChangedFiles(dir, baseOid = null) {
             // nobody removed (#85).
             inHead: head !== 0,
             inWorkdir: workdir !== 0,
-            base: baseBlob ? Buffer.from(baseBlob.blob) : null,
+            base: (head !== 0 && baseBlobs.get(filepath)) || null,
             work: workBuf
         });
     }
@@ -670,7 +686,7 @@ async function collectPullRequestFiles(dir, baseOid = null) {
     // the commit the files were compared against, which under #108 is the
     // branch point — the same oid the pull request needs as its parent, so the
     // value is right even where the name has not caught up.
-    const entries = await buildPullRequestEntries(files, { git, fs, dir, headOid: base, platform: process.platform });
+    const entries = await buildPullRequestEntries(files, { treeEntryMode, fs, dir, headOid: base, platform: process.platform });
     return { baseOid: base, files: entries };
 }
 
@@ -1227,8 +1243,8 @@ async function baseProvenance(dir, baseOid, meta) {
         return { trunkOid: meta.trunkOid, trunkDate: meta.trunkDate };
     }
     try {
-        const { commit } = await git.readCommit({ fs, dir, oid: baseOid });
-        return { trunkOid: baseOid, trunkDate: new Date(commit.committer.timestamp * 1000).toISOString() };
+        const { date } = await readCommitInfo(dir, baseOid);
+        return { trunkOid: baseOid, trunkDate: date };
     } catch {
         return { trunkOid: baseOid, trunkDate: null };
     }
diff --git a/src/pr-files.cjs b/src/pr-files.cjs
index 9a9ed3a3..8c081c91 100644
--- a/src/pr-files.cjs
+++ b/src/pr-files.cjs
@@ -20,9 +20,10 @@
  * side — is carried byte-for-byte, which is the one thing the `.diff` cannot
  * do.
  *
- * Kept out of main.js and behind injected dependencies (platform, stat, git)
- * so both sides of the platform split below are exercised by `node --test`
- * from one machine — the house pattern, per win-spawn-patch.test.cjs.
+ * Kept out of main.js and behind injected dependencies (platform, stat,
+ * treeEntryMode) so both sides of the platform split below are exercised by
+ * `node --test` from one machine — the house pattern, per
+ * win-spawn-patch.test.cjs.
  */
 
 const path = require('path');
@@ -71,28 +72,19 @@ function isProbablyBinary(buf) {
 }
 
 /**
- * The mode git recorded for one path in one commit, read by walking that
- * path's trees rather than the whole commit: a full walk of wordpress-develop
- * is tens of thousands of entries to answer a question about five files.
+ * The mode git recorded for one path in one commit: one `ls-tree` on the
+ * path (git-read.cjs) rather than a walk of the whole commit, which for
+ * wordpress-develop is tens of thousands of entries to answer a question
+ * about five files.
  *
- * @param {Object} deps     `{ git, fs, dir }`
+ * @param {Object} deps     `{ treeEntryMode, dir }`
  * @param {string} oid
  * @param {string} filepath
  * @return {Promise<string|null>}
  */
 async function modeInCommit(deps, oid, filepath) {
-	const { git, fs, dir } = deps;
-	const { commit } = await git.readCommit({ fs, dir, oid });
-	let treeOid = commit.tree;
-	const segments = filepath.split('/');
-	for (let i = 0; i < segments.length; i++) {
-		const { tree } = await git.readTree({ fs, dir, oid: treeOid });
-		const entry = tree.find((e) => e.path === segments[i]);
-		if (!entry) return null;
-		if (i === segments.length - 1) return entry.mode;
-		treeOid = entry.oid;
-	}
-	return null;
+	const { treeEntryMode, dir } = deps;
+	return treeEntryMode(dir, oid, filepath);
 }
 
 /**
@@ -105,7 +97,7 @@ async function modeInCommit(deps, oid, filepath) {
  * added file on Windows has no recorded mode and no bit to read, so 100644 is
  * the only answer available, and the right one for source.
  *
- * @param {Object} deps `{ git, fs, dir, headOid, platform, stat }`
+ * @param {Object} deps `{ treeEntryMode, fs, dir, headOid, platform, stat }`
  * @param {Object} file One collectChangedFiles entry.
  * @return {Promise<string>}
  */
@@ -138,7 +130,7 @@ async function fileModeForEntry(deps, file) {
  * alternatives are committing a deletion or an empty file under that path.
  *
  * @param {Array}  files
- * @param {Object} deps  `{ git, fs, dir, headOid, platform, stat }`
+ * @param {Object} deps  `{ treeEntryMode, fs, dir, headOid, platform, stat }`
  * @return {Promise<Array<{path: string, kind: string, content: Buffer|null, mode: string}>>}
  */
 async function buildPullRequestEntries(files, deps) {
diff --git a/src/ticket-branches.js b/src/ticket-branches.js
index 2acc9c8a..fee0e67d 100644
--- a/src/ticket-branches.js
+++ b/src/ticket-branches.js
@@ -9,8 +9,9 @@
  *
  * No Electron dependency, so `node --test` can exercise it against real
  * repositories (same rationale as trunk-update.js, whose `ensureAutocrlf` this
- * module reuses rather than re-deriving). main.js owns the IPC plumbing and the
- * electron-store writes.
+ * module reuses rather than re-deriving). Reads go through the bundled Git
+ * (git-read.cjs, #384); the writes still run on isomorphic-git until #385.
+ * main.js owns the IPC plumbing and the electron-store writes.
  *
  * Two invariants hold everything else up:
  *
@@ -30,6 +31,7 @@ const fs = require('fs');
 const git = require('isomorphic-git');
 const { ensureAutocrlf } = require('./trunk-update.js');
 const { mapCheckoutPhase } = require('./switch-progress.cjs');
+const { currentBranch, listBranches, statusRows, changesAgainst } = require('./git-read.cjs');
 
 /** The pristine snapshot branch. Never committed to, never deleted. */
 const TRUNK = 'trunk';
@@ -77,8 +79,7 @@ function ticketIdFromRef(ref) {
  * @param {string} dir
  */
 async function currentBranchName(dir) {
-	const name = await git.currentBranch({ fs, dir, fullname: false });
-	return name || null;
+	return currentBranch(dir);
 }
 
 /**
@@ -88,7 +89,7 @@ async function currentBranchName(dir) {
  * @param {string} dir
  */
 async function listTicketBranches(dir) {
-	const branches = await git.listBranches({ fs, dir });
+	const branches = await listBranches(dir);
 	return branches.filter((ref) => ref !== TRUNK);
 }
 
@@ -160,15 +161,18 @@ async function countChangesAgainst(dir, ref = 'HEAD') {
 
 /**
  * One worktree scan, and what the callers need from it. Split out because the
- * scan is the expensive part of every park and every switch — `statusMatrix`
- * hashes every non-ignored file, and wordpress-develop has thousands.
+ * scan is the expensive part of every park and every switch: Git hashes every
+ * file whose stat data went stale, and wordpress-develop has thousands.
+ *
+ * Against HEAD it is `git status`, which also fills the index column
+ * `stageWorktree` reads; against any other commit (a ticket's branch point,
+ * once work is parked) it is `git diff <commit>` plus the untracked files.
  *
  * @param {string} dir
  * @param {string} [ref]
  */
 async function scanWorktree(dir, ref = 'HEAD') {
-	const gitFs = await ensureAutocrlf(dir);
-	const matrix = await git.statusMatrix({ fs: gitFs, dir, ref });
+	const matrix = ref === 'HEAD' ? await statusRows(dir) : await changesAgainst(dir, ref);
 	return { matrix, changed: matrix.some(([, head, workdir]) => head !== workdir) };
 }
 
@@ -232,7 +236,7 @@ async function parkCurrentWork(dir, { baseOid, author = WIP_AUTHOR, onProgress =
  */
 async function startTicketBranch(dir, ticketId) {
 	const ref = ticketBranchRef(ticketId);
-	const existing = await git.listBranches({ fs, dir });
+	const existing = await listBranches(dir);
 	if (existing.includes(ref)) {
 		const error = new Error(`Already working on ticket #${ticketId} in this site`);
 		error.code = 'branch-exists';
@@ -272,7 +276,7 @@ async function switchToBranch(dir, ref, { baseOid, author = WIP_AUTHOR, onProgre
 	const from = await currentBranchName(dir);
 	if (from === ref) return { switched: false, from, to: ref, parked: false };
 
-	const branches = await git.listBranches({ fs, dir });
+	const branches = await listBranches(dir);
 	if (!branches.includes(ref)) {
 		const error = new Error(`No such branch: ${ref}`);
 		error.code = 'no-such-branch';
@@ -351,7 +355,7 @@ async function deleteTicketBranch(dir, ref) {
 		error.code = 'not-a-ticket-branch';
 		throw error;
 	}
-	const branches = await git.listBranches({ fs, dir });
+	const branches = await listBranches(dir);
 	if (!branches.includes(ref)) {
 		const error = new Error(`No such branch: ${ref}`);
 		error.code = 'no-such-branch';
diff --git a/src/trunk-update.js b/src/trunk-update.js
index a08a5dc2..c73837b4 100644
--- a/src/trunk-update.js
+++ b/src/trunk-update.js
@@ -3,11 +3,12 @@
 /**
  * Git operations for the trunk update path (#94). No Electron dependency, so
  * `node --test` can exercise it against real repositories (same rationale as
- * npm-runner.js). All git I/O goes through isomorphic-git — the app never
- * shells out to a git binary.
+ * npm-runner.js). Reads go through the bundled Git (git-read.cjs, #384);
+ * the writes below still run on isomorphic-git until #385 moves them, flow
+ * by flow. Nothing here ever reaches a git found on the host.
  *
  * main.js owns the IPC plumbing and electron-store writes; the pure
- * statusMatrix/oid decision rules live in git-update.cjs.
+ * status-row/oid decision rules live in git-update.cjs.
  */
 
 const path = require('path');
@@ -20,6 +21,7 @@ const {
 	lockfileChangedFromBlobOids,
 	normalizeEolBuffer
 } = require('./git-update.cjs');
+const { readCommitInfo, resolveRef, statusRows, readBlobs, blobOid } = require('./git-read.cjs');
 
 /**
  * Give isomorphic-git a Windows-only, in-memory view of core.autocrlf=true
@@ -108,55 +110,54 @@ async function ensureAutocrlf(dir, options) {
  * @param {string} dir
  */
 async function readTrunkInfo(dir) {
-	let trunkOid;
+	let info;
 	try {
-		trunkOid = await git.resolveRef({ fs, dir, ref: 'refs/heads/trunk' });
+		info = await readCommitInfo(dir, 'refs/heads/trunk');
 	} catch {
-		trunkOid = await git.resolveRef({ fs, dir, ref: 'HEAD' });
+		info = await readCommitInfo(dir, 'HEAD');
 	}
-	const { commit } = await git.readCommit({ fs, dir, oid: trunkOid });
-	const trunkDate = new Date(commit.committer.timestamp * 1000).toISOString();
-	return { trunkOid, trunkDate };
+	return { trunkOid: info.oid, trunkDate: info.date };
 }
 
 async function readLockfileBlobOid(dir, oid) {
 	try {
-		const { oid: blobOid } = await git.readBlob({ fs, dir, oid, filepath: 'package-lock.json' });
-		return blobOid;
+		return await blobOid(dir, oid, 'package-lock.json');
 	} catch {
 		return null;
 	}
 }
 
-// statusMatrix's autocrlf normalization only covers valid-UTF8 files, so
-// non-UTF8 text fixtures (wordpress-develop's Big5/Latin-1 encoding tests)
-// smudged to CRLF by a native-git checkout still hash as modified. Confirm
-// with a byte-level, encoding-agnostic comparison.
-async function isCrlfOnlyChange(dir, headOid, filepath) {
+// Git's autocrlf handling is byte-based, but on macOS and Linux the app runs
+// with no autocrlf at all, so a file a native-git checkout smudged to CRLF
+// still reports as modified there. Confirm with a byte-level,
+// encoding-agnostic comparison against the blob HEAD holds.
+async function isCrlfOnlyChange(dir, filepath, headBlob) {
+	if (!headBlob) return false;
 	try {
-		const { blob } = await git.readBlob({ fs, dir, oid: headOid, filepath });
 		const work = await fs.promises.readFile(path.join(dir, filepath));
-		return normalizeEolBuffer(Buffer.from(blob)).equals(normalizeEolBuffer(work));
+		return normalizeEolBuffer(headBlob).equals(normalizeEolBuffer(work));
 	} catch {
 		return false;
 	}
 }
 
 /**
- * The files that genuinely differ from HEAD — statusMatrix candidates minus
+ * The files that genuinely differ from HEAD — status candidates minus
  * CRLF-only false positives. What this returns is what the dirty-tree dialog
  * lists, and it matches what patch generation would emit.
  *
  * @param {string} dir
  */
 async function collectDirtyFiles(dir) {
-	const gitFs = await ensureAutocrlf(dir);
-	const matrix = await git.statusMatrix({ fs: gitFs, dir });
-	let headOid = null;
-	try { headOid = await git.resolveRef({ fs, dir, ref: 'HEAD' }); } catch {}
+	const matrix = await statusRows(dir);
+	const headOid = await resolveRef(dir, 'HEAD');
+	const { rows } = isDirtyFromStatusMatrix(matrix);
+	const modified = rows.filter(([, head, workdir]) => head === 1 && workdir === 2).map(([filepath]) => filepath);
+	// One spawn for every candidate blob rather than one per file.
+	const headBlobs = headOid ? await readBlobs(dir, headOid, modified) : new Map();
 	const files = [];
-	for (const [filepath, head, workdir] of isDirtyFromStatusMatrix(matrix).rows) {
-		if (head === 1 && workdir === 2 && headOid && await isCrlfOnlyChange(dir, headOid, filepath)) continue;
+	for (const [filepath, head, workdir] of rows) {
+		if (head === 1 && workdir === 2 && await isCrlfOnlyChange(dir, filepath, headBlobs.get(filepath))) continue;
 		files.push(filepath);
 	}
 	return files;
diff --git a/tests/e2e/journeys/patch-apply.spec.js b/tests/e2e/journeys/patch-apply.spec.js
index d61a96f0..c40da4a1 100644
--- a/tests/e2e/journeys/patch-apply.spec.js
+++ b/tests/e2e/journeys/patch-apply.spec.js
@@ -113,6 +113,11 @@ test( 'reverting puts the checkout back and leaves unrelated work alone', async
 
 	await revert.click();
 	await expect( revert ).toHaveCount( 0, { timeout: 60_000 } );
+	// The button leaves the moment the revert starts, so it is not the signal
+	// that the revert finished. The next-step line is: it names the operation
+	// while it runs and moves on once the status has been reloaded, which
+	// happens after the checkout and the record are both written.
+	await expect( page.getByText( 'A patch is being applied or reverted.' ) ).toHaveCount( 0, { timeout: 60_000 } );
 
 	// INVARIANT — the patched file is back, byte for byte.
 	expect( read( site.dir, LOGIN ) ).toBe( `${ TRUNK_LOGIN }\n` );
diff --git a/tests/e2e/journeys/store-persistence.spec.js b/tests/e2e/journeys/store-persistence.spec.js
index 53755447..a55e20f6 100644
--- a/tests/e2e/journeys/store-persistence.spec.js
+++ b/tests/e2e/journeys/store-persistence.spec.js
@@ -93,6 +93,11 @@ test( 'an applied patch is still applied after a restart, and still revertable',
 	await expect( reopened.getByRole( 'button', { name: 'Revert this patch', exact: true } ) ).toHaveCount( 0, {
 		timeout: 60_000,
 	} );
+	// The button leaves the moment the revert starts, so it is not the signal
+	// that the revert finished. The next-step line is: it names the operation
+	// while it runs and moves on once the status has been reloaded, which
+	// happens after the checkout and the record are both written.
+	await expect( reopened.getByText( 'A patch is being applied or reverted.' ) ).toHaveCount( 0, { timeout: 60_000 } );
 	expect( read( site.dir, LOGIN ) ).toBe( `${ TRUNK_LOGIN }\n` );
 } );
 
diff --git a/tests/unit/git-binary.integration.test.cjs b/tests/unit/git-binary.integration.test.cjs
index 58dcd2b9..8f934292 100644
--- a/tests/unit/git-binary.integration.test.cjs
+++ b/tests/unit/git-binary.integration.test.cjs
@@ -3,9 +3,8 @@ const assert = require('node:assert/strict');
 const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
-const { spawnSync } = require('node:child_process');
 
-const { resolveGitBinary, buildGitEnv, BASE_ARGS, SPAWN_OPTIONS } = require('../../src/git-binary.cjs');
+const { BINARY, GIT_VERSION, git, tempDir } = require('./helpers/git.cjs');
 
 // The bundled Git actually runs, from the source tree, on whatever platform
 // runs this suite — and `npm run test:electron` repeats it on Electron's own
@@ -20,43 +19,6 @@ const { resolveGitBinary, buildGitEnv, BASE_ARGS, SPAWN_OPTIONS } = require('../
 // to keep it out (a `commit.gpgsign` there would otherwise fail the commit
 // below), and nothing here works around it.
 
-const BINARY = resolveGitBinary();
-const ENV = buildGitEnv();
-// The Git dugite@3.2.3 embeds; a different one here means a different tree.
-const GIT_VERSION = /^git version 2\.53\.0(?:$|[.\s])/;
-
-function git(args, cwd) {
-	const result = spawnSync(BINARY, [...BASE_ARGS, ...args], { ...SPAWN_OPTIONS, cwd, env: ENV, encoding: 'utf8' });
-	return {
-		status: result.status,
-		stdout: (result.stdout || '').trim(),
-		stderr: (result.stderr || '').trim(),
-		error: result.error ? result.error.message : null
-	};
-}
-
-function tempDir(t, prefix) {
-	const dir = fs.mkdtempSync(path.join(os.tmpdir(), prefix));
-	t.after(() => removeRepo(dir));
-	return dir;
-}
-
-// Git writes its objects read-only, and on Windows `rmSync` answers that with
-// EPERM rather than deleting them (#381). Make everything writable first.
-function removeRepo(dir) {
-	const walk = (entry) => {
-		const stat = fs.lstatSync(entry);
-		if (stat.isDirectory()) {
-			fs.chmodSync(entry, 0o777);
-			for (const child of fs.readdirSync(entry)) walk(path.join(entry, child));
-		} else if (stat.isFile()) {
-			fs.chmodSync(entry, 0o666);
-		}
-	};
-	if (fs.existsSync(dir)) walk(dir);
-	fs.rmSync(dir, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 });
-}
-
 test('the bundled binary is present and runs', () => {
 	assert.ok(fs.existsSync(BINARY), `${BINARY} is missing`);
 	const result = git(['--version'], os.tmpdir());
diff --git a/tests/unit/git-read.integration.test.cjs b/tests/unit/git-read.integration.test.cjs
new file mode 100644
index 00000000..00b8d5ca
--- /dev/null
+++ b/tests/unit/git-read.integration.test.cjs
@@ -0,0 +1,126 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const read = require('../../src/git-read.cjs');
+const { git, tempDir } = require('./helpers/git.cjs');
+
+// The read functions against a repository the bundled Git built, so the flag
+// set each command uses is proven on this platform too, including the states
+// only a user's own client produces. The parsers on their own are in
+// git-read.test.cjs.
+
+
+function makeRepo(t) {
+	const dir = tempDir(t, 'toolkit-git-read-');
+	assert.equal(git(['init', '-b', 'trunk'], dir).status, 0);
+	fs.mkdirSync(path.join(dir, 'src'));
+	fs.writeFileSync(path.join(dir, 'src', 'wp-login.php'), '<?php // login\n');
+	fs.writeFileSync(path.join(dir, 'with space.txt'), 'spaced\n');
+	fs.writeFileSync(path.join(dir, 'package-lock.json'), '{"name":"x"}\n');
+	fs.writeFileSync(path.join(dir, '.gitignore'), 'node_modules/\n');
+	assert.equal(git(['add', '.'], dir).status, 0);
+	const commit = git(['-c', 'user.name=T', '-c', 'user.email=t@example.com', 'commit', '-q', '-m', 'first'], dir);
+	assert.equal(commit.status, 0, commit.stderr);
+	return dir;
+}
+
+test('resolveRef, readCommitInfo and currentBranch on a fresh repository', async (t) => {
+	const dir = makeRepo(t);
+	const head = git(['rev-parse', 'HEAD'], dir).stdout;
+	assert.equal(await read.resolveRef(dir, 'HEAD'), head);
+	assert.equal(await read.resolveRef(dir, 'refs/heads/trunk'), head);
+	assert.equal(await read.resolveRef(dir, 'refs/heads/nope'), null);
+
+	const info = await read.readCommitInfo(dir, 'refs/heads/trunk');
+	assert.equal(info.oid, head);
+	const seconds = Number(git(['log', '-1', '--format=%ct'], dir).stdout);
+	assert.equal(info.date, new Date(seconds * 1000).toISOString());
+	await assert.rejects(read.readCommitInfo(dir, 'refs/heads/nope'), (error) => error.code === 128);
+
+	assert.equal(await read.currentBranch(dir), 'trunk');
+	assert.equal(git(['checkout', '-q', '--detach'], dir).status, 0);
+	assert.equal(await read.currentBranch(dir), null);
+});
+
+test('listBranches sees a branch made by hand', async (t) => {
+	const dir = makeRepo(t);
+	assert.equal(git(['branch', 'ticket/60001'], dir).status, 0);
+	assert.deepEqual((await read.listBranches(dir)).sort(), ['ticket/60001', 'trunk']);
+});
+
+test('statusRows: clean tree, then a modification, an untracked file, a deletion, and nothing ignored', async (t) => {
+	const dir = makeRepo(t);
+	assert.deepEqual(await read.statusRows(dir, { platform: 'darwin' }), []);
+
+	fs.writeFileSync(path.join(dir, 'src', 'wp-login.php'), '<?php // edited\n');
+	fs.writeFileSync(path.join(dir, 'new file.txt'), 'new\n');
+	fs.unlinkSync(path.join(dir, 'with space.txt'));
+	fs.mkdirSync(path.join(dir, 'node_modules', 'react'), { recursive: true });
+	fs.writeFileSync(path.join(dir, 'node_modules', 'react', 'index.js'), 'expensive\n');
+
+	const rows = (await read.statusRows(dir, { platform: 'darwin' })).sort();
+	assert.deepEqual(rows, [
+		['new file.txt', 0, 2, 0],
+		['src/wp-login.php', 1, 2, 1],
+		['with space.txt', 1, 0, 1]
+	]);
+});
+
+test('changesAgainst compares the worktree with a commit that is not HEAD', async (t) => {
+	const dir = makeRepo(t);
+	const base = git(['rev-parse', 'HEAD'], dir).stdout;
+	// A second commit moves HEAD; the worktree then diverges from both.
+	fs.writeFileSync(path.join(dir, 'src', 'wp-login.php'), '<?php // parked\n');
+	assert.equal(git(['-c', 'user.name=T', '-c', 'user.email=t@example.com', 'commit', '-q', '-am', 'wip'], dir).status, 0);
+	fs.writeFileSync(path.join(dir, 'untracked.txt'), 'u\n');
+	fs.unlinkSync(path.join(dir, 'package-lock.json'));
+
+	assert.deepEqual((await read.changesAgainst(dir, 'HEAD', { platform: 'darwin' })).sort(), [
+		['package-lock.json', 1, 0, 0],
+		['untracked.txt', 0, 2, 0]
+	]);
+	assert.deepEqual((await read.changesAgainst(dir, base, { platform: 'darwin' })).sort(), [
+		['package-lock.json', 1, 0, 0],
+		['src/wp-login.php', 1, 2, 0],
+		['untracked.txt', 0, 2, 0]
+	]);
+});
+
+test('a path removed from the index but kept on disk is present, never a deletion', async (t) => {
+	// `git rm --cached`: the file is on disk and the contributor still has it.
+	// A deletion here is how a patch would delete it for them (#85).
+	const dir = makeRepo(t);
+	const base = git(['rev-parse', 'HEAD'], dir).stdout;
+	assert.equal(git(['rm', '-q', '--cached', 'with space.txt'], dir).status, 0);
+	assert.deepEqual(await read.statusRows(dir, { platform: 'darwin' }), [['with space.txt', 1, 2, 0]]);
+	assert.deepEqual(await read.changesAgainst(dir, base, { platform: 'darwin' }), [['with space.txt', 1, 2, 0]]);
+	// And a staged deletion is one that really is gone from disk.
+	assert.equal(git(['rm', '-q', 'package-lock.json'], dir).status, 0);
+	assert.deepEqual((await read.statusRows(dir, { platform: 'darwin' })).sort(), [
+		['package-lock.json', 1, 0, 0],
+		['with space.txt', 1, 2, 0]
+	]);
+});
+
+test('readBlobs, blobOid and treeEntryMode read one commit without touching the worktree', async (t) => {
+	const dir = makeRepo(t);
+	const base = git(['rev-parse', 'HEAD'], dir).stdout;
+	fs.writeFileSync(path.join(dir, 'src', 'wp-login.php'), '<?php // edited\n');
+
+	const blobs = await read.readBlobs(dir, base, ['src/wp-login.php', 'with space.txt', 'nope.txt']);
+	assert.equal(blobs.get('src/wp-login.php').toString('utf8'), '<?php // login\n');
+	assert.equal(blobs.get('with space.txt').toString('utf8'), 'spaced\n');
+	assert.equal(blobs.get('nope.txt'), null);
+	assert.deepEqual(await read.readBlobs(dir, base, []), new Map());
+
+	const oid = await read.blobOid(dir, base, 'package-lock.json');
+	assert.equal(oid, git(['rev-parse', `${base}:package-lock.json`], dir).stdout);
+	assert.equal(await read.blobOid(dir, base, 'nope.json'), null);
+
+	assert.equal(await read.treeEntryMode(dir, base, 'src/wp-login.php'), '100644');
+	assert.equal(await read.treeEntryMode(dir, base, 'src/nope.php'), null);
+	// The worktree edit above is still there: reads write nothing.
+	assert.equal(fs.readFileSync(path.join(dir, 'src', 'wp-login.php'), 'utf8'), '<?php // edited\n');
+});
diff --git a/tests/unit/git-read.test.cjs b/tests/unit/git-read.test.cjs
new file mode 100644
index 00000000..4ea9ff09
--- /dev/null
+++ b/tests/unit/git-read.test.cjs
@@ -0,0 +1,144 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+
+const read = require('../../src/git-read.cjs');
+
+// The parsers are pure functions over bytes, so these feed them the exact
+// byte layouts Git documents for each porcelain format, including the shapes
+// only a hostile repository produces (a stray rename entry, a NUL inside a
+// blob, a path with a space). The same commands against a repository the
+// bundled Git built are in git-read.integration.test.cjs.
+
+const z = (...fields) => Buffer.from(fields.map((f) => `${f}\0`).join(''), 'utf8');
+
+test('status v2: every XY combination lands on the documented row', () => {
+	const cases = [
+		['..', [1, 1, 1]],
+		['.M', [1, 2, 1]],
+		['.D', [1, 0, 1]],
+		['M.', [1, 2, 2]],
+		['MM', [1, 2, 3]],
+		['MD', [1, 0, 3]],
+		['A.', [0, 2, 2]],
+		['AM', [0, 2, 3]],
+		['AD', [0, 0, 3]],
+		['D.', [1, 0, 0]],
+		['T.', [1, 2, 2]],
+		['.T', [1, 2, 1]],
+		// Intent-to-add: not in HEAD, on disk, a placeholder in the index.
+		['.A', [0, 2, 0]]
+	];
+	for (const [xy, expected] of cases) {
+		const [, head, workdir, stage] = read.rowFromStatusEntry(xy, 'f');
+		assert.deepEqual([head, workdir, stage], expected, xy);
+	}
+});
+
+test('status v2: ordinary, untracked, unmerged and a stray rename entry parse without drifting', () => {
+	const buf = z(
+		'1 .M N... 100644 100644 100644 aaaa bbbb src/wp-login.php',
+		'? new file.txt',
+		'2 R. N... 100644 100644 100644 cccc dddd R100 renamed.php', 'original.php',
+		'u UU N... 100644 100644 100644 100644 eeee ffff gggg conflicted.php',
+		'1 D. N... 100644 000000 000000 hhhh 0000 gone.php'
+	);
+	assert.deepEqual(read.parseStatusV2Z(buf), [
+		['src/wp-login.php', 1, 2, 1],
+		['new file.txt', 0, 2, 0],
+		['renamed.php', 1, 2, 2],
+		['conflicted.php', 1, 2, 3],
+		['gone.php', 1, 0, 0]
+	]);
+});
+
+test('status v2: a path removed from the index but kept on disk is one row, not two', () => {
+	// `git rm --cached keep.php` makes Git report the path twice.
+	const buf = z('1 D. N... 100644 000000 000000 hhhh 0000 keep.php', '? keep.php', '? other.txt');
+	assert.deepEqual(read.parseStatusV2Z(buf), [
+		['keep.php', 1, 2, 0],
+		['other.txt', 0, 2, 0]
+	]);
+});
+
+test('status v2: an empty answer is an empty matrix', () => {
+	assert.deepEqual(read.parseStatusV2Z(Buffer.alloc(0)), []);
+});
+
+test('name-status: A, M, T and D against a commit', () => {
+	const buf = z('A', 'added.php', 'M', 'src/wp-login.php', 'T', 'link', 'D', 'gone.php');
+	assert.deepEqual(read.parseNameStatusZ(buf), [
+		['added.php', 0, 2, 0],
+		['src/wp-login.php', 1, 2, 0],
+		['link', 1, 2, 0],
+		['gone.php', 1, 0, 0]
+	]);
+});
+
+test('a -z list keeps spaces and drops the empty trailer', () => {
+	assert.deepEqual(read.parseZList(z('a b', 'c')), ['a b', 'c']);
+	assert.deepEqual(read.parseZList(Buffer.alloc(0)), []);
+});
+
+test('cat-file --batch: hits, a missing object and a blob with newlines and NUL bytes', () => {
+	const body = Buffer.concat([Buffer.from('line 1\n'), Buffer.from([0, 0xff]), Buffer.from('\nend')]);
+	const buf = Buffer.concat([
+		Buffer.from(`1111111111111111111111111111111111111111 blob ${body.length}\n`), body, Buffer.from('\n'),
+		Buffer.from('abc:no such file missing\n'),
+		Buffer.from('2222222222222222222222222222222222222222 blob 0\n\n')
+	]);
+	const requests = ['abc:with space.txt', 'abc:no such file', 'abc:empty'];
+	const answers = read.parseCatFileBatch(buf, requests);
+	assert.deepEqual(answers.get('abc:with space.txt'), body);
+	assert.equal(answers.get('abc:no such file'), null);
+	assert.deepEqual(answers.get('abc:empty'), Buffer.alloc(0));
+});
+
+test('cat-file --batch: a missing echo with a newline in the path stops the parse instead of poisoning it', () => {
+	const buf = Buffer.from('HEAD:b\nnope.txt missing\n1111111111111111111111111111111111111111 blob 2\nhi\n');
+	const answers = read.parseCatFileBatch(buf, ['HEAD:b\nnope.txt', 'HEAD:ok.txt']);
+	assert.equal(answers.get('HEAD:b\nnope.txt'), undefined);
+	assert.equal(answers.get('HEAD:ok.txt'), undefined);
+});
+
+test('cat-file --batch-check: oid per request, null when missing', () => {
+	const buf = Buffer.from('1111111111111111111111111111111111111111 blob 12\nabc:nope missing\n');
+	const answers = read.parseCatFileBatchCheck(buf, ['abc:package-lock.json', 'abc:nope']);
+	assert.equal(answers.get('abc:package-lock.json'), '1111111111111111111111111111111111111111');
+	assert.equal(answers.get('abc:nope'), null);
+});
+
+test('ls-tree: one entry, or null for a path the tree does not have', () => {
+	const entry = read.parseLsTreeZ(z('100755 blob 3333333333333333333333333333333333333333\tbin/run me.sh'));
+	assert.deepEqual(entry, { mode: '100755', type: 'blob', oid: '3333333333333333333333333333333333333333', path: 'bin/run me.sh' });
+	assert.equal(read.parseLsTreeZ(Buffer.alloc(0)), null);
+});
+
+test('crlfArgs: Windows adds autocrlf only when the repository does not say', async () => {
+	const seen = [];
+	const runWith = (status) => async (args, options) => { seen.push({ args, options }); return { status, stdout: Buffer.alloc(0), stderr: '' }; };
+	assert.deepEqual(await read.crlfArgs('/site', { platform: 'win32', run: runWith(1) }), ['-c', 'core.autocrlf=true']);
+	assert.deepEqual(await read.crlfArgs('/site', { platform: 'win32', run: runWith(0) }), []);
+	assert.deepEqual(seen[0].args, ['config', '--local', '--get', 'core.autocrlf']);
+	assert.deepEqual(seen[0].options.okCodes, [0, 1]);
+	assert.deepEqual(await read.crlfArgs('/site', { platform: 'darwin', run: runWith(1) }), []);
+	assert.equal(seen.length, 2, 'no config read off Windows');
+});
+
+test('on Windows the autocrlf view reaches the status and diff commands themselves', async () => {
+	// A dropped spread here would be green on every other platform and bring
+	// back the ~5,000 phantom modifications of a CRLF checkout.
+	const argv = [];
+	const run = async (args) => {
+		argv.push(args);
+		return { status: args[0] === 'config' ? 1 : 0, stdout: Buffer.alloc(0), stderr: '' };
+	};
+	await read.statusRows('/site', { platform: 'win32', run });
+	await read.changesAgainst('/site', 'abc', { platform: 'win32', run });
+	const commands = argv.filter((args) => args[0] !== 'config');
+	assert.equal(commands.length, 3);
+	for (const args of commands) {
+		assert.deepEqual(args.slice(0, 2), ['-c', 'core.autocrlf=true'], args.join(' '));
+	}
+	assert.deepEqual(commands.map((args) => args[2]), ['status', 'diff', 'ls-files']);
+});
+
diff --git a/tests/unit/git-run.integration.test.cjs b/tests/unit/git-run.integration.test.cjs
new file mode 100644
index 00000000..680916bc
--- /dev/null
+++ b/tests/unit/git-run.integration.test.cjs
@@ -0,0 +1,21 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+
+const { runGit } = require('../../src/git-run.cjs');
+const { git, tempDir } = require('./helpers/git.cjs');
+
+// The runner against the real binary: the scripted-child tests in
+// git-run.test.cjs prove the contract, this proves the pieces meet.
+
+test('the real binary answers through runGit inside a repository', async (t) => {
+	const dir = tempDir(t, 'toolkit-git-run-');
+	assert.equal(git(['init', '-b', 'trunk'], dir).status, 0);
+	const { status, stdout } = await runGit(['rev-parse', '--git-dir'], { cwd: dir });
+	assert.equal(status, 0);
+	assert.equal(stdout.toString('utf8').trim(), '.git');
+
+	const missing = await runGit(['rev-parse', '--verify', '--quiet', 'refs/heads/nope'], { cwd: dir, okCodes: [0, 1] });
+	assert.equal(missing.status, 1);
+
+	await assert.rejects(runGit(['rev-parse', '--verify', 'refs/heads/nope'], { cwd: dir }), (error) => error.code === 128);
+});
diff --git a/tests/unit/git-run.test.cjs b/tests/unit/git-run.test.cjs
new file mode 100644
index 00000000..220bcdf1
--- /dev/null
+++ b/tests/unit/git-run.test.cjs
@@ -0,0 +1,154 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const path = require('node:path');
+const { EventEmitter } = require('node:events');
+const { PassThrough } = require('node:stream');
+
+const { spawnGit, runGit, GitError, subcommandOf, safeDirectoryArgs } = require('../../src/git-run.cjs');
+const { BASE_ARGS } = require('../../src/git-binary.cjs');
+
+// The runner's contract, checked without a Git: `spawn` is injected and hands
+// back a scripted child, so argv, stdio, exit-code handling, overflow and the
+// spawn-failure path are all exercised on any machine. The real binary is
+// driven in git-run.integration.test.cjs.
+
+function fakeChild({ stdout = [], stderr = [], status = 0, signal = null, error = null, delay = 0 } = {}) {
+	const child = new EventEmitter();
+	// No pid: killChildTree declines to signal, so an overflow test cannot
+	// reach a real process that happens to hold a fake pid on a CI runner.
+	child.pid = 0;
+	child.exitCode = null;
+	child.signalCode = null;
+	child.stdout = new PassThrough();
+	child.stderr = new PassThrough();
+	child.stdin = new PassThrough();
+	child.stdinChunks = [];
+	child.stdin.on('data', (chunk) => child.stdinChunks.push(chunk));
+	child.killed = false;
+	child.kill = () => { child.killed = true; return true; };
+	setTimeout(() => {
+		if (error) {
+			child.emit('error', error);
+			child.emit('close', null, null);
+			return;
+		}
+		for (const chunk of stdout) child.stdout.write(chunk);
+		for (const chunk of stderr) child.stderr.write(chunk);
+		child.stdout.end();
+		child.stderr.end();
+		setTimeout(() => {
+			child.exitCode = status;
+			child.signalCode = signal;
+			child.emit('close', status, signal);
+		}, 0);
+	}, delay);
+	return child;
+}
+
+function recordingSpawn(childOptions) {
+	const calls = [];
+	const spawn = (file, args, options) => {
+		const child = fakeChild(childOptions);
+		calls.push({ file, args, options, child });
+		return child;
+	};
+	return { spawn, calls };
+}
+
+test('spawnGit refuses to run without an explicit cwd', () => {
+	assert.throws(() => spawnGit(['status'], {}), TypeError);
+	assert.throws(() => spawnGit(['status'], { cwd: '' }), TypeError);
+});
+
+test('every call carries the base arguments, no optional locks and the cwd as a safe directory', () => {
+	const { spawn, calls } = recordingSpawn();
+	spawnGit(['status', '--porcelain=v2'], { cwd: '/sites/demo', spawn });
+
+	const [{ file, args, options }] = calls;
+	assert.ok(path.isAbsolute(file));
+	assert.deepEqual(args.slice(0, BASE_ARGS.length), [...BASE_ARGS]);
+	assert.equal(args[BASE_ARGS.length], '--no-optional-locks');
+	assert.ok(args.includes('safe.directory=/sites/demo'));
+	assert.deepEqual(args.slice(-2), ['status', '--porcelain=v2']);
+	assert.equal(options.cwd, '/sites/demo');
+	assert.equal(options.shell, false);
+	assert.equal(options.windowsHide, true);
+	assert.equal(options.detached, process.platform !== 'win32');
+	// The environment is the bundled Git's, never the host's.
+	assert.equal(options.env.GIT_CONFIG_NOSYSTEM, '1');
+	assert.deepEqual(options.stdio, ['ignore', 'pipe', 'pipe']);
+});
+
+test('a Windows cwd is trusted under both spellings', () => {
+	assert.deepEqual(safeDirectoryArgs('C:\\Sites\\demo'), [
+		'-c', 'safe.directory=C:\\Sites\\demo',
+		'-c', 'safe.directory=C:/Sites/demo'
+	]);
+	assert.deepEqual(safeDirectoryArgs('/sites/demo'), ['-c', 'safe.directory=/sites/demo']);
+});
+
+test('the subcommand named in errors skips options and -c pairs', () => {
+	assert.equal(subcommandOf(['-c', 'core.autocrlf=true', '--no-pager', 'status', '-z']), 'status');
+	assert.equal(subcommandOf(['--version']), '(no subcommand)');
+});
+
+test('stdin is only opened when there is input, and the input is written whole', async () => {
+	const { spawn, calls } = recordingSpawn({ stdout: ['ok\n'] });
+	await runGit(['cat-file', '--batch'], { cwd: '/sites/demo', input: 'abc:path\0', spawn });
+	assert.deepEqual(calls[0].options.stdio, ['pipe', 'pipe', 'pipe']);
+	// The scripted child recorded what reached its stdin.
+	const written = Buffer.concat(calls[0].child.stdinChunks).toString('utf8');
+	assert.equal(written, 'abc:path\0');
+});
+
+test('stdout comes back as bytes and stderr as text', async () => {
+	const { spawn } = recordingSpawn({ stdout: [Buffer.from([0x61, 0x00, 0x62]), Buffer.from('c')], stderr: ['warning: x\n'] });
+	const result = await runGit(['status'], { cwd: '/sites/demo', spawn });
+	assert.equal(result.status, 0);
+	assert.ok(Buffer.isBuffer(result.stdout));
+	assert.deepEqual([...result.stdout], [0x61, 0x00, 0x62, 0x63]);
+	assert.equal(result.stderr, 'warning: x\n');
+});
+
+test('an exit status outside okCodes rejects with the stderr and the arguments', async () => {
+	const { spawn } = recordingSpawn({ status: 128, stderr: ['fatal: not a git repository\n'] });
+	await assert.rejects(
+		runGit(['rev-parse', 'HEAD'], { cwd: '/sites/demo', spawn }),
+		(error) => {
+			assert.ok(error instanceof GitError);
+			assert.equal(error.code, 128);
+			assert.equal(error.stderr, 'fatal: not a git repository\n');
+			assert.deepEqual(error.args, ['rev-parse', 'HEAD']);
+			assert.equal(error.cwd, '/sites/demo');
+			assert.match(error.message, /^git rev-parse failed \(128\): fatal: not a git repository$/);
+			return true;
+		}
+	);
+});
+
+test('okCodes lets a query answer "no" without throwing', async () => {
+	const { spawn } = recordingSpawn({ status: 1 });
+	const result = await runGit(['rev-parse', '--verify', '--quiet', 'nope'], { cwd: '/sites/demo', okCodes: [0, 1], spawn });
+	assert.equal(result.status, 1);
+	assert.equal(result.stdout.length, 0);
+});
+
+test('a spawn failure is a GitError with the system code, not an unhandled event', async () => {
+	const enoent = Object.assign(new Error('spawn git ENOENT'), { code: 'ENOENT' });
+	const { spawn } = recordingSpawn({ error: enoent });
+	await assert.rejects(
+		runGit(['status'], { cwd: '/sites/demo', spawn }),
+		(error) => error instanceof GitError && error.code === 'ENOENT' && /could not start/.test(error.message)
+	);
+});
+
+// The fake child has no pid, so this proves the rejection and that reading
+// stops, not that the kill was sent; killChildTree's own tests cover that.
+test('output past maxStdout rejects rather than growing without bound', async () => {
+	const { spawn, calls } = recordingSpawn({ stdout: [Buffer.alloc(600, 0x41), Buffer.alloc(600, 0x41)], status: 0 });
+	await assert.rejects(
+		runGit(['status'], { cwd: '/sites/demo', maxStdout: 1000, spawn }),
+		(error) => error instanceof GitError && error.code === 'stdout-overflow'
+	);
+	assert.equal(calls.length, 1);
+});
diff --git a/tests/unit/helpers/git.cjs b/tests/unit/helpers/git.cjs
new file mode 100644
index 00000000..e1fd4c65
--- /dev/null
+++ b/tests/unit/helpers/git.cjs
@@ -0,0 +1,70 @@
+'use strict';
+
+// The bundled Git, for tests that drive it directly: build a repository, put
+// it in a state the app never creates (a detached HEAD, a hand-made branch),
+// or check what the app wrote. Not a test file: discovery is by `*.test.cjs`,
+// so nothing here runs on its own (see the note at the top of
+// ipc-wiring.test.cjs).
+
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+
+const { resolveGitBinary, buildGitEnv, BASE_ARGS, SPAWN_OPTIONS } = require('../../../src/git-binary.cjs');
+
+const BINARY = resolveGitBinary();
+const ENV = buildGitEnv();
+
+// The Git dugite@3.2.3 embeds; a different one here means a different tree.
+const GIT_VERSION = /^git version 2\.53\.0(?:$|[.\s])/;
+
+/**
+ * Runs one Git command synchronously and returns trimmed text.
+ *
+ * @param {string[]} args
+ * @param {string}   cwd
+ */
+function git(args, cwd) {
+	const result = spawnSync(BINARY, [...BASE_ARGS, ...args], { ...SPAWN_OPTIONS, cwd, env: ENV, encoding: 'utf8' });
+	return {
+		status: result.status,
+		stdout: (result.stdout || '').trim(),
+		stderr: (result.stderr || '').trim(),
+		error: result.error ? result.error.message : null
+	};
+}
+
+/**
+ * A fresh directory under the OS temp dir, removed when the test ends.
+ *
+ * @param {import('node:test').TestContext} t
+ * @param {string}                          prefix
+ */
+function tempDir(t, prefix) {
+	const dir = fs.mkdtempSync(path.join(os.tmpdir(), prefix));
+	t.after(() => removeRepo(dir));
+	return dir;
+}
+
+/**
+ * Git writes its objects read-only, and on Windows `rmSync` answers that with
+ * EPERM rather than deleting them (#381). Make everything writable first.
+ *
+ * @param {string} dir
+ */
+function removeRepo(dir) {
+	const walk = (entry) => {
+		const stat = fs.lstatSync(entry);
+		if (stat.isDirectory()) {
+			fs.chmodSync(entry, 0o777);
+			for (const child of fs.readdirSync(entry)) walk(path.join(entry, child));
+		} else if (stat.isFile()) {
+			fs.chmodSync(entry, 0o666);
+		}
+	};
+	if (fs.existsSync(dir)) walk(dir);
+	fs.rmSync(dir, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 });
+}
+
+module.exports = { BINARY, ENV, GIT_VERSION, git, tempDir, removeRepo };
diff --git a/tests/unit/pr-files.test.cjs b/tests/unit/pr-files.test.cjs
index a6912090..71143493 100644
--- a/tests/unit/pr-files.test.cjs
+++ b/tests/unit/pr-files.test.cjs
@@ -21,34 +21,15 @@ const {
 
 const DIR = '/sites/wp';
 
-// A fake `git` whose HEAD commit records the given path → mode map. Tree
-// lookups walk path segments the way the real module does, so a nested path
-// exercises the descent.
-function fakeGitWithModes(modes) {
-	const paths = Object.keys(modes);
-	return {
-		readCommit: async () => ({ commit: { tree: 'root' } }),
-		readTree: async ({ oid }) => {
-			const prefix = oid === 'root' ? '' : `${oid}/`;
-			const seen = new Set();
-			const tree = [];
-			for (const p of paths.filter((x) => x.startsWith(prefix))) {
-				const rest = p.slice(prefix.length);
-				const segment = rest.split('/')[0];
-				if (seen.has(segment)) continue;
-				seen.add(segment);
-				tree.push(rest.includes('/')
-					? { path: segment, oid: `${prefix}${segment}`, mode: '040000' }
-					: { path: segment, oid: `blob-${p}`, mode: modes[p] });
-			}
-			return { tree };
-		}
-	};
+// A fake `treeEntryMode` answering from the given path → mode map, the way
+// git-read.cjs answers from one `ls-tree` on the path.
+function fakeTreeWithModes(modes) {
+	return async (dir, oid, filepath) => (Object.hasOwn(modes, filepath) ? modes[filepath] : null);
 }
 
 function deps(overrides = {}) {
 	return {
-		git: fakeGitWithModes({}),
+		treeEntryMode: fakeTreeWithModes({}),
 		fs: null,
 		dir: DIR,
 		headOid: 'head',
@@ -88,7 +69,7 @@ test('on Windows the mode recorded in HEAD decides, and the filesystem is never
 		deps({
 			platform: 'win32',
 			stat: async () => { statted = true; return { mode: 0o644 }; },
-			git: fakeGitWithModes({ 'tools/build.sh': '100755' })
+			treeEntryMode: fakeTreeWithModes({ 'tools/build.sh': '100755' })
 		}),
 		{ path: 'tools/build.sh', inHead: true, inWorkdir: true }
 	);
@@ -98,7 +79,7 @@ test('on Windows the mode recorded in HEAD decides, and the filesystem is never
 
 test('an added file on Windows has no recorded mode and no bit: 100644', async () => {
 	const mode = await fileModeForEntry(
-		deps({ platform: 'win32', git: fakeGitWithModes({}) }),
+		deps({ platform: 'win32', treeEntryMode: fakeTreeWithModes({}) }),
 		{ path: 'new-file.php', inHead: false, inWorkdir: true }
 	);
 	assert.strictEqual(mode, GIT_MODE_FILE);
@@ -111,7 +92,7 @@ test('a deletion reads its mode from HEAD without touching the missing path', as
 		[{ path: 'src/wp-includes/gone.php', inHead: true, inWorkdir: false, base: Buffer.from('x'), work: null }],
 		deps({
 			stat: async () => { statted = true; throw new Error('ENOENT'); },
-			git: fakeGitWithModes({ 'src/wp-includes/gone.php': '100644' })
+			treeEntryMode: fakeTreeWithModes({ 'src/wp-includes/gone.php': '100644' })
 		})
 	);
 	assert.deepStrictEqual(entries, [{
diff --git a/tests/unit/ticket-branches.integration.test.cjs b/tests/unit/ticket-branches.integration.test.cjs
index 8bef4341..09ffe8e1 100644
--- a/tests/unit/ticket-branches.integration.test.cjs
+++ b/tests/unit/ticket-branches.integration.test.cjs
@@ -1,7 +1,10 @@
 'use strict';
 
 // Integration tests for src/ticket-branches.js (#108) against real on-disk
-// repositories — no mocking of isomorphic-git, same as the trunk-update suite.
+// repositories — no mocking of either engine, same as the trunk-update suite.
+// The fixture is built by isomorphic-git and read by the bundled Git (#384),
+// which is the two-engine agreement check phase 2 asks for: every read below
+// answers about a repository the other engine wrote.
 //
 // The fixture mirrors what a site actually looks like: a `trunk` branch holding
 // a wordpress-develop-shaped tree, plus a gitignored `node_modules` standing in
@@ -26,6 +29,7 @@ const {
 	deleteTicketBranch
 } = require('../../src/ticket-branches.js');
 const { describeSwitchProgress } = require('../../src/switch-progress.cjs');
+const { git: bundledGit } = require('./helpers/git.cjs');
 
 const AUTHOR = { name: 'test', email: 'test@example.com' };
 
@@ -342,3 +346,18 @@ test('a switch without a progress callback still works (issue #173)', async (t)
 	assert.equal(result.switched, true);
 	assert.equal(result.parked, true);
 });
+
+test('a detached HEAD, which only a user\'s own client makes, reads as no branch (issue #384)', async (t) => {
+	const { dir } = await makeSite(t);
+	assert.equal(await currentBranchName(dir), TRUNK);
+	assert.equal(bundledGit(['checkout', '-q', '--detach'], dir).status, 0);
+	assert.equal(await currentBranchName(dir), null);
+});
+
+test('a branch made by hand in a real git client shows up next to the app\'s own (issue #384)', async (t) => {
+	const { dir } = await makeSite(t);
+	await startTicketBranch(dir, 60001);
+	assert.equal(bundledGit(['branch', 'ticket/60002'], dir).status, 0);
+	assert.equal(bundledGit(['branch', 'experiment'], dir).status, 0);
+	assert.deepEqual((await listTicketBranches(dir)).sort(), ['experiment', 'ticket/60001', 'ticket/60002']);
+});