status: fix FSMonitor history and clean-proof gaps - #74

The daemon currently assumes that each client which advances an
FSMonitor token also updates the repository's canonical index. That
does not hold for commands using GIT_INDEX_FILE. A private index can
advance the daemon past the canonical index's token and cause the
canonical index's next query to receive a global invalidation.

Keep a deduplicated overflow batch instead of discarding old paths.
Clients at the overflow sequence still get an exact delta. Older
clients get a conservative union of paths, which may overreport but
cannot miss a change.

All paths are interned. Keep a pointer-identity hash set with the
overflow batch so later compactions hash only newly retired paths,
rather than rebuilding a set over the daemon's lifetime history.

Add a regression which advances a private index repeatedly, verifies
that compaction remains deduplicated, and then checks that a read-only
canonical status reports both changed files without a trivial response.

Retired batches are collapsed into a path-only overflow set.  That keeps
old indexes complete, but it loses the sequence in which each path was
last observed.  A client that consumed an inode event can therefore see
it again after another index compacts the batch list, causing repeated
hard-link scans.  Unpinned batches have a zero pinned time and are also
eligible for compaction immediately despite the default grace period.

Do not use unpinned batches as truncation boundaries.  Record the newest
original batch sequence for every overflow path, and filter overflow
responses against the client's requested sequence.  The normal batch
walk remains unchanged; sequence lookups are confined to overflow
responses.

Cover both the default retention grace and the cross-index hard-link
case.  The latter persists a nonzero checkpoint, compacts through a
private index, and verifies repeated canonical reads do not rescan or
fall back to global invalidation.

The delayed-cookie tests send the v1 timestamp token "0" and only check
that the response is nonempty.  Both recovery and fallback can satisfy
that assertion with the same trivial response, so the tests do not
distinguish a rescued cookie from a token-generation reset.

Send a deterministic valid v2 token instead.  Verify that the 1200ms
case preserves its token generation without a global invalidation, while
the 2500ms case changes generation and sends the fallback invalidation.

215845a (fsmonitor: preserve authenticated proofs across ordinary
commands, 2026-08-15) enabled the clean-status history handoff for
merges, but excluded invocations where fast_forward was FF_NO.
Requested merge topology does not determine whether the resulting index
is semantically safe.  A clean non-fast-forward merge can carry the same
authenticated FSUC/FSCF state as a fast-forward merge.

As a result, --no-ff, --no-ff --no-commit, and merge.ff=false all
dropped FSUC and reduced the FSCF flags from 15 to 9 after a clean
merge.  Each subsequent read-only status invalidated the external
history and rescanned the semantic manifest.

Enable the handoff for every merge using the canonical index.  Conflict
handling still invalidates unsafe proofs, and explicit alternate indexes
remain excluded.  Cover all three non-fast-forward forms, repeated
read-only status calls, conflicts, and alternate indexes.

An exact clean status can repair a stale FSMonitor checkpoint or cached
stat data while it scans.  The repair requires an index write, so the
existing issue path leaves no clean sidecar behind.  Read-only callers
then repeat the full scan until a second writable exact status publishes
the proof.

After the repair is written and resumable history is durable, install a
sidecar bound to the rewritten index.  Keep optional-lock-disabled
commands read-only, preserve the literal exact-command restriction, and
do not extend sidecar support to linked worktrees.

Cover repeated read-only scans after a legacy daemon replacement, the
single writable index repair in main and linked worktrees, and the next
read-only sidecar hit in the main worktree.  Keep option-bearing status
commands ineligible for proof publication.

A configured pull can discard each layer of authenticated status history
even when worktree inputs remain unchanged. Command-scoped protocol and
HTTP settings change the config digest, directory events with more than
64 tracked descendants reject the semantic proof, and a fast-forward
which adds an indexed directory drops the paired untracked cache. The
next status can consequently preload and refresh the full index.

Treat command-scoped protocol and HTTP settings as transport-only. For a
large directory event, authenticate each distinct attribute source once
instead of rejecting the cone outright. When a checkout adds tracked
paths, retain the paired untracked cache and replay those additions
through its existing invalidation path.

Cover configured pulls in main and linked worktrees, large directory
events, nested attribute-source changes, and branch switches which add
tracked directories. The conservative full-scan fallback remains in
place when an attribute source changes.

Configured pulls preserve FSMonitor clean proofs when checkout can
authenticate every index change.  Tracked policy files were an
exception: adding or replacing .gitattributes or .gitignore made the
generic semantic transfer reject the whole proof.  Later read-only
status commands then had to rescan the worktree and could not restore
the paired untracked proof.

Let checkout retain history across regular policy-file changes that it
writes itself.  Attribute changes refresh the worktree manifest before
the provider boundary is rebound, and fail closed if that refresh cannot
authenticate the new sources.  Keep the existing untracked-cache
invalidation for ignore changes, and transfer that cache only while the
full tracked proof remains current.

Exercise configured fast-forward pulls in main and linked worktrees.  A
required-filter control also verifies that changed attributes invalidate
the affected tracked entry instead of certifying it.

A clean status proof can survive a pull only when its configuration,
tracked-file state, FSMonitor token, and paired untracked cache still
describe the resulting worktree. Command-scoped push transport settings
were included in the configuration fingerprint. Checkout could also
discard the untracked proof for policy-file changes or leave events from
its own worktree writes outside the proof.

The next diff, write-tree, or status then repeated tracked and untracked
work. With optional locks disabled, status could not publish the repair,
so each invocation paid the same cost.

Treat push.negotiate and remote.*.pushurl like other command-scoped
transport settings. Preserve the paired untracked cache across checkout,
invalidate only affected policy scopes, and authenticate distinct
attribute-source directories before transferring semantic history.

For checkout, reset, merge, and sequencer worktree updates, write a
provisional index under the existing lock, consume the daemon events
caused by the update, and certify the result against that locked index
before the final write. This also covers stash cleanup through its hard
reset. Alternate indexes, split or sparse indexes, unsafe filter or
manifest state, and incomplete stat data still fall back.

Cover configured pulls, root and nested policy changes, main and linked
worktrees, rebase, reset, stash, checkout, and repeated read-only
status.

The Linux listener queued every inotify event as a file pathname.
Directory events therefore lacked the trailing slash used by semantic
invalidation. After an owned worktree update retained a clean proof, a
following read-only status could not close those events against it. The
command scanned all tracked entries. With core.preloadIndexBulk enabled,
this work appears as statx calls instead of lstat counters.

Format Linux worktree events through
fsmonitor_format_worktree_paths() and use IN_ISDIR to preserve their
directory identity. Advertise directory metadata support and mark Linux
tokens so clients replace daemons using the old event format.

Concurrent clients can see an expected connection reset while one client
replaces a stale daemon. Silence that diagnostic only for gentle IPC
reads, which already reconnect, without changing ordinary IPC error
handling.

Cover both bulk preload modes plus single and concurrent daemon
replacement.

Bulk index preload can defer content and conversion checks to the diff
that normally follows refresh_index(). repair_fsmonitor_proof() only
refreshes the index before deciding whether to persist a clean proof; it
does not run that diff. With core.preloadIndexBulk enabled, a pull or
rebase that changes .gitattributes or .gitignore can therefore leave
tracked entries dirty after the writer reports a successful repair.
Repeated read-only status calls cannot persist the missing repairs.

Do not request deferred bulk results in the writer-repair path. This
keeps the ordinary status and diff bulk path unchanged while forcing the
exceptional repair to finish its tracked checks before certifying and
writing the proof.

Enable bulk preload in the existing fast-forward, policy-file, and
sequencer writer tests. They verify targeted refreshes and two
subsequent read-only status calls without scans or index writes.

A writable Git command can leave a complete FSMonitor proof in a
repairable state when it changes policy files, adds or removes an
intent-to-add entry, or delegates the final index write to a child
process. The existing repair path assumed that the manifest and
untracked cache remained closed. The sequencer also kept its stale
in-memory index after git commit rewrote the canonical index. Stash
operations and completed rebases could therefore drop FSUC or overwrite
the child's newer token. Read-only status could not persist the repair
and repeated tracked or directory work.

Let index-only writers refresh changed manifests and rebuild the paired
untracked cache against the provisional locked index. Preserve unrelated
history for safe intent-to-add changes and unmerged non-attribute paths,
then reload the canonical index after child writers before repairing it.
Active filters and unresolved structural indexes still fall back.

Linux can report an event for a watched directory without a child name.
Keep the watched directory in that case, encode its token capabilities
in the order understood by Linux clients, and serialize incompatible
daemon replacement on Linux as on macOS.

Cover stash creation and application, policy-file updates, ordinary and
--rebase-merges conflict completion, cherry-pick's deliberately weaker
tracked-only proof, nameless inotify events, and primary and linked
worktrees. Repeated optional-lock-free status calls must not rewrite the
index or rescan tracked entries.

The Darwin daemon treats delivery of its cookie-file event as proof
that all earlier worktree changes have been published. That assumes the
callback containing the cookie cannot overtake logically older work.

A retained FSEvents trace disproves that assumption. The cookie
callback completed before a later callback published removals that had
happened before the cookie was created. A status query could therefore
answer from incomplete event history and report a dirty worktree as
clean.

After the ordinary cookie wait, ask a long-lived worker to flush the
FSEvents stream and then drain its serial callback queue. The flush
schedules provider events; the queue drain waits for those callbacks
to finish publishing. Accept the boundary only when the cookie was
seen in the same token generation, and coalesce overlapping requests
onto a single fence.

If the bounded fence times out or intersects shutdown, return a
conservative result and retire the daemon before unsafe stream
teardown. Advertise the stronger boundary as a capability and token
suffix so new clients replace unfenced daemons while older clients
retain prefix compatibility.

Exercise split and blocked callbacks, timeout replacement, generation
reset, listener shutdown, concurrent coalescing, second-wave requests,
rename and cache scopes, and protocol compatibility. Keep status proof
tests outside the split-index matrix where that proof is deliberately
disabled, and materialize externally restored tokens before raw-index
helpers consume them. The provider fence adds work to each Darwin
query, while overlapping queries share a fence when their cookies are
already registered.

378744b (status: reuse closed proofs for scoped queries,
2026-08-11) taught the untracked cache to reconcile a provider-reported
direct child without reopening its directory.  A valid cached directory
can still have a null exclude_oid when its existing contents are all
tracked, since traversal never needed to load its tracked .gitignore.
prep_exclude() interprets that null OID as proof that no per-directory
exclude exists.  The targeted refresh can therefore report a newly
created ignored file as untracked.

Before refreshing a provider-dirty cached directory with a null exclude
OID, use its tracked exclude as the expected identity and load the
worktree source.  Prefer the exact stage-zero entry, then look for a
case-folded alias on case-insensitive worktrees.  add_patterns() still
opens and hashes the actual source when only an alias exists, so a case
collision can only force invalidation.  Use the empty-blob ID for an
unmerged, non-regular, removed, or intent-to-add match so that it forces
a source read and conservative invalidation unless the source is truly
empty.

Cover both exact and case-folded tracked excludes with read-only status
calls.  They must match a cold oracle without opening the directory or
writing the index, and a changed source must invalidate the cache.  Also
pin the sparse-index boundaries: an in-cone event retains targeted
refresh without expansion, while a vivified outside-cone source takes
the existing conservative expansion path.

An authenticated clean-status sidecar is bound to the identity of the
index file it certifies. During an interactive rebase, the child commit
run by "rebase --continue" can replace that index. The worktree and
index are clean when the replay finishes, but the remaining sidecar
still names the old inode. The next read-only status rejects it with a
fast-index-mismatch and falls back to the slower history path.

Remember whether the rebase started with a regular, singly linked
sidecar and persistent FSMonitor proof history. After the replay
finishes successfully, reread the final index and use the existing
writer-proof repair to publish a replacement sidecar. Only do so when
optional locks are available and no post-index-change hook is
configured, matching the existing stash guardrails.

Move the sidecar-presence check and sidecar-capable repair helper into
wt-status so stash and sequencer can share them. Cover a conflicted
interactive rebase whose continuation must publish a replacement
sidecar and whose next read-only status must hit it.

The clean-status sidecar path accepts only the main worktree. A newly
created linked worktree therefore cannot publish a proof after a full
clean scan. Later read-only status commands rescan the worktree even
though each linked worktree has its own index and sidecar path.

Accept a linked worktree only when its per-worktree gitdir remains
registered in the common directory and the registered path names the
current worktree. Reject an alternate worktree paired with a linked-
worktree gitdir; the repository fingerprint continues to bind the
resolved worktree, gitdir, common directory, index, and filesystem
identities.

New worktrees are commonly probed with "git status --short". Let the
exact top-level --short and -s forms certify empty output. A fresh
worktree index can still be racy, so write and re-read it before saving
resumable history and issuing the sidecar. This binds both proofs to the
new on-disk index epoch.

Cover issuance and optional-lock-free reuse in a registered linked
worktree, and verify that an impostor worktree sharing its gitdir falls
back.

Stash and rebase may repair and reissue a clean-status sidecar after
their primary operation has completed.  A lock, read, or proof-repair
failure in that optional work currently replaces the successful command
result.  The command then reports failure even though it has already
updated the repository and worktree.

The repair path also commits its updated index before rereading it and
issuing the sidecar.  Another writer can replace the index in that gap.
The old clean scan could then be bound to the replacement index.
A later status could hide a newly staged change.

Treat sidecar repair as best-effort after stash and rebase complete.
Retain a descriptor-backed snapshot of the index produced by each
postwrite clean scan.  Require it to match both the reread index state
and the canonical index path before installing the sidecar.  A failed
repair or intervening write therefore omits the cache and falls back to
ordinary status without changing the primary command result.  The normal
sidecar-hit path remains unchanged.

Cover lock contention after successful stash and rebase operations, and
replace the index at deterministic postwrite barriers in both repair and
status issuance paths.

The reset used by worktree add has no index proof to repair, and its
explicit GIT_WORK_TREE prevents proof authentication. A later optional
status can establish history, but GIT_OPTIONAL_LOCKS=0 suppresses that
priming step. Subsequent read-only status calls cannot persist the
missing proof and keep repeating the tracked-file scan.

When FSMonitor and writable untracked caching are enabled, let the
checkout discover the already registered worktree. Preserve the explicit
repository environment for unsupported contexts, including relative
configuration-file overrides whose meaning would change with cwd.

For a hard reset that creates the index, certify the checkout under the
mandatory index lock before committing it. Attach the current config to
the new index state, query the provider after checkout, and reuse the
writer repair machinery to bind the tracked and untracked proofs. Allow
certification under this owned lock even when optional locks are
disabled; ordinary read-only status still cannot write or repair its
index.

Require a complete untracked scan and a closing provider query. Active
filters, provider errors, and provider resets must leave the checkout
usable without certifying it. Cover those failures, post-checkout edits,
and repeated read-only status calls that reuse the proof without writing
the index or scanning tracked files.