Fixes #181
Fixes #182
Fixes #183
Fixes #184
Fixes #185
Fixes #186

Co-authored-by: Copilot App <[email protected]>

* Implement managed shared-index lifecycle

Add isolated managed storage, guarded reader and owner lifetimes, atomic explicit and adaptive advancement, reference-aware resumable collection, allocations, and versioned live/offline management. Preserve ordinary and retain-all v1 behavior, document the generic client contract, and add native lifecycle qualification.

Co-authored-by: Copilot App <[email protected]>

* Repair managed publication recovery and bounded retries

Restore authoritative full publications after committed failures, retain adaptive decisions across deferral, and checkpoint WAL before mutations. Correct idle-stop authorization and native ownership portability. Exercise live recovery and record checked measurement cleanup and UTC windows.

Co-authored-by: Copilot App <[email protected]>

* Classify nested Git watcher metadata by its most specific root

Use a bounded metadata-root list and choose the shortest matching relative path. Exercise both root orders against a real linked-worktree view, including HEAD, index, configuration, lock and unrelated-event controls.

Co-authored-by: Copilot App <[email protected]>

* Define the macOS process-group inventory selector locally

Use the documented sys/proc_info.h ABI value because the pinned libc crate exposes proc_listpids without PROC_PGRP_ONLY. Keep the bounded, positively identified zombie-only inventory check unchanged.

Co-authored-by: Copilot App <[email protected]>

* Bound managed WAL publication without requiring immediate truncation

Serialize headroom admission with SQLite writer acquisition, account for FULL-sync padding and future sidecars, and bound spill-disabled pager payloads. Preserve durable usage and reject unsafe policy reductions before mutation. Cover actual held-reader CLI service and owner-reaper contention.

Co-authored-by: Copilot App <[email protected]>

* Fix Windows catalog WAL locks and concurrent metadata replay

Use the smallest immutable upstream SQLite correction for canonical Windows paths, cover native read-lock release and real PSOW padding, and serialize metadata execution before deciding whether a receipt is terminal.

Co-authored-by: Copilot App <[email protected]>

* Reject unexercised native WAL rendezvous in regression test

Record bounded rendezvous timeouts inside the callback and assert only after restoring the VFS hook. Exercise the sticky timeout path without native callbacks.

Co-authored-by: Copilot App <[email protected]>

* Qualify installed managed CLI and report its actual shared backend

Exercise the normally installed release binary through owner lifetime, generation reuse, private views, shared-v2 scan parity, exact migration replay and explicit release. Reuse version-aware backend labels for filename search stats.

Co-authored-by: Copilot App <[email protected]>

* Probe native macOS content generations and retained writable mappings

Require supported nonzero content evidence for an unmapped owned fixture, invalidate timestamp-restored writes, and reject reusable evidence while a writable mapping survives its creator descriptor. This native proof does not assert a deletion exclusion fence.

Co-authored-by: Copilot App <[email protected]>

* Seal intended managed producer content and preserve incomplete proof

Add authentication format discrimination, bounded immutable block proof batches, creation-handle ownership snapshots, exact post-commit proof replay, and conservative producer recovery. Charge authentication scratch memory and catalog storage; compact proof rows in bounded units. This is an intermediate producer slice; native authenticated collection remains separate unfinished work.

Co-authored-by: Copilot App <[email protected]>

* Authenticate bounded collection against producer proofs

Retain native continuity observations, authenticate surviving prefixes and deletion intents, preserve ownership changes, and account for volatile verifier resources.

Co-authored-by: Copilot App <[email protected]>

* Correct native lease binding and preserve committed control intent errors

Use the Linux F_SETOWN_EX UAPI with its thread-owner struct, and retain cross-platform final-boundary ownership regressions without losing durable intent state.

Co-authored-by: Copilot App <[email protected]>

* Distinguish native macOS missing ACL evidence from lookup failures

Record the descriptor-backed absent FILESEC_ACL state separately from bounded ACL encodings and add native absence, ACL-change, and restoration controls.

Co-authored-by: Copilot App <[email protected]>

* Keep verifier memory admission ahead of catalog locking

Centralize bounded unreserved admission with memory-first locking and verify the lock order through a deterministic nonhanging fault boundary.

Co-authored-by: Copilot App <[email protected]>

* Preserve verifier lifetime across inventory and bound cached proof reuse

Retain the cross-platform inventory regression and exercise policy/allocation restarts, expiration, cancellation, and active-versus-idle shutdown resources.

Co-authored-by: Copilot App <[email protected]>

* Honor cancellation at collection boundaries and rebind native verifier guards

Invalidate all version-stale proof without conflicting with retained inventory descriptors. Observe cancellation before destructive I/O and atomically in the final saved result.

Co-authored-by: Copilot App <[email protected]>

* Revalidate exact retirement receipts after concurrent native cleanup

Keep missing guards unknown without matching retirement evidence, avoid duplicate control credits, and place the control-removal barrier after confirmed Windows handle release.

Co-authored-by: Copilot App <[email protected]>

* Coordinate native control verification and preserve idle retry receipts

Fence matching control opens without blocking unrelated owner admission. Separate root withdrawal from physical cleanup, serialize protected-reader admission with retirement, and retain accepted idle tokens across admission contention. Preserve deterministic same-control, unrelated-owner and same-token regressions.

Co-authored-by: Copilot App <[email protected]>

* Preserve terminal idle decisions across concurrent token replays

Reread the authoritative receipt after maintenance admission and hold serialization through error publication. Add a deterministic accepted-receipt interleaving that previously replaced a non-stopping decision with a committed stop.

Co-authored-by: Copilot App <[email protected]>

* Preserve recovery receipts and resume deferred control cleanup

Revalidate terminal recovery state under maintenance serialization before lifetime checks and execution. Retain the exact pending collection object when another bounded control verifier owns admission, exposing the Busy skip without losing continuation or recrediting removed members. Add deterministic completed/failed/cancelled replay and physical-cleanup continuation controls.

Co-authored-by: Copilot App <[email protected]>

* Decouple logical owner release from physical root-control cleanup

Co-authored-by: Copilot App <[email protected]>

* Prepare a stable read mark for native WAL overlap qualification

Co-authored-by: Copilot App <[email protected]>

* Bind lifecycle fault hooks to exact operations and retain measured binaries

Scope known-operation pause and error hooks before asynchronous admission becomes visible. Preserve causal reconciliation, crash, recovery, native and legacy controls, and capture the exact Cargo-selected measurement CLI and harness as qualification artifacts.

Co-authored-by: Copilot App <[email protected]>

* Bound crash reconnect retries to terminal catalog contention

Preserve failed-token replay and exact recovered pins before fresh-token attempts. Exercise post-lease SQLite Busy injection, unchanged lease resumption, and bounded exhaustion without changing shipping retry or serialization policy.

Co-authored-by: Copilot App <[email protected]>

* Coalesce already-satisfied managed reconciliation

Preserve ready readers and exact checkpoints when queued background work has already been fulfilled. Keep forced repairs, cancellation and version checks, immutable replay, and the periodic verification clock intact.

Co-authored-by: Copilot App <[email protected]>

* Bound initial managed attachment retries

Keep new attempts limited to authoritative uncommitted catalog contention, preserve absent or pending initial intent and immutable receipts, and continue from the actual consumed sequence. Cover pre-lease transaction failure, persisted-lease resumption, bounded exhaustion, and actual dropped-response replay without altering shipping retry behavior.

Co-authored-by: Copilot App <[email protected]>

* Clarify legacy and managed shared-index scope

Co-authored-by: Copilot App <[email protected]>

* Document bounded managed lifecycle measurements

Co-authored-by: Copilot App <[email protected]>

* Reject oversized managed owner claim files

Read one byte past the claim limit before deserializing so a valid JSON prefix cannot hide oversized whitespace or trailing data. Cover the boundary and preserved owner lifecycle through real CLI clients.

Co-authored-by: Copilot App <[email protected]>

* Bump version to 1.2.0

Co-authored-by: Copilot App <[email protected]>

* Authenticate managed daemon RPCs

Require per-daemon credentials before v2 or compatibility dispatch. Publish and validate native owner-only credential files, bind discovery to the private registration, rotate capabilities at restart, and preserve genuine v1 clients with a separate private instance capability.

Co-authored-by: Copilot App <[email protected]>

* Reserve only managed store and namespace paths

Ordinary index commands rejected any path with an ancestor named like the managed store, so an unrelated project or index beneath a directory that merely shares that name fell back to scanning or could not be indexed. Reserve only the store directory itself and paths beneath its 64-hex repository namespaces, compared lexically and case-insensitively after normalization; managed generation files stay rejected by format.

Co-authored-by: Copilot App <[email protected]>

* Close shared views only for candidate read failures

Snapshot validation, deadline and cancellation failures during a shared content query were treated as candidate read failures, which invalidated a ready view and forced full repair. Only open, stat and read failures of the candidate now close the view; control failures propagate unchanged and the view stays ready.

Co-authored-by: Copilot App <[email protected]>

* Preflight legacy archive file and directory conflicts

Reject archive entries beneath a file entry, including the generated probe path, before creating the destination so extraction cannot fail partway and leave output that blocks a retry.

Co-authored-by: Copilot App <[email protected]>

---------

Co-authored-by: Copilot App <[email protected]>

* Implement managed shared-index lifecycle

Add isolated managed storage, guarded reader and owner lifetimes, atomic explicit and adaptive advancement, reference-aware resumable collection, allocations, and versioned live/offline management. Preserve ordinary and retain-all v1 behavior, document the generic client contract, and add native lifecycle qualification.

Co-authored-by: Copilot App <[email protected]>

* Repair managed publication recovery and bounded retries

Restore authoritative full publications after committed failures, retain adaptive decisions across deferral, and checkpoint WAL before mutations. Correct idle-stop authorization and native ownership portability. Exercise live recovery and record checked measurement cleanup and UTC windows.

Co-authored-by: Copilot App <[email protected]>

* Classify nested Git watcher metadata by its most specific root

Use a bounded metadata-root list and choose the shortest matching relative path. Exercise both root orders against a real linked-worktree view, including HEAD, index, configuration, lock and unrelated-event controls.

Co-authored-by: Copilot App <[email protected]>

* Define the macOS process-group inventory selector locally

Use the documented sys/proc_info.h ABI value because the pinned libc crate exposes proc_listpids without PROC_PGRP_ONLY. Keep the bounded, positively identified zombie-only inventory check unchanged.

Co-authored-by: Copilot App <[email protected]>

* Bound managed WAL publication without requiring immediate truncation

Serialize headroom admission with SQLite writer acquisition, account for FULL-sync padding and future sidecars, and bound spill-disabled pager payloads. Preserve durable usage and reject unsafe policy reductions before mutation. Cover actual held-reader CLI service and owner-reaper contention.

Co-authored-by: Copilot App <[email protected]>

* Fix Windows catalog WAL locks and concurrent metadata replay

Use the smallest immutable upstream SQLite correction for canonical Windows paths, cover native read-lock release and real PSOW padding, and serialize metadata execution before deciding whether a receipt is terminal.

Co-authored-by: Copilot App <[email protected]>

* Reject unexercised native WAL rendezvous in regression test

Record bounded rendezvous timeouts inside the callback and assert only after restoring the VFS hook. Exercise the sticky timeout path without native callbacks.

Co-authored-by: Copilot App <[email protected]>

* Qualify installed managed CLI and report its actual shared backend

Exercise the normally installed release binary through owner lifetime, generation reuse, private views, shared-v2 scan parity, exact migration replay and explicit release. Reuse version-aware backend labels for filename search stats.

Co-authored-by: Copilot App <[email protected]>

* Probe native macOS content generations and retained writable mappings

Require supported nonzero content evidence for an unmapped owned fixture, invalidate timestamp-restored writes, and reject reusable evidence while a writable mapping survives its creator descriptor. This native proof does not assert a deletion exclusion fence.

Co-authored-by: Copilot App <[email protected]>

* Seal intended managed producer content and preserve incomplete proof

Add authentication format discrimination, bounded immutable block proof batches, creation-handle ownership snapshots, exact post-commit proof replay, and conservative producer recovery. Charge authentication scratch memory and catalog storage; compact proof rows in bounded units. This is an intermediate producer slice; native authenticated collection remains separate unfinished work.

Co-authored-by: Copilot App <[email protected]>

* Authenticate bounded collection against producer proofs

Retain native continuity observations, authenticate surviving prefixes and deletion intents, preserve ownership changes, and account for volatile verifier resources.

Co-authored-by: Copilot App <[email protected]>

* Correct native lease binding and preserve committed control intent errors

Use the Linux F_SETOWN_EX UAPI with its thread-owner struct, and retain cross-platform final-boundary ownership regressions without losing durable intent state.

Co-authored-by: Copilot App <[email protected]>

* Distinguish native macOS missing ACL evidence from lookup failures

Record the descriptor-backed absent FILESEC_ACL state separately from bounded ACL encodings and add native absence, ACL-change, and restoration controls.

Co-authored-by: Copilot App <[email protected]>

* Keep verifier memory admission ahead of catalog locking

Centralize bounded unreserved admission with memory-first locking and verify the lock order through a deterministic nonhanging fault boundary.

Co-authored-by: Copilot App <[email protected]>

* Preserve verifier lifetime across inventory and bound cached proof reuse

Retain the cross-platform inventory regression and exercise policy/allocation restarts, expiration, cancellation, and active-versus-idle shutdown resources.

Co-authored-by: Copilot App <[email protected]>

* Honor cancellation at collection boundaries and rebind native verifier guards

Invalidate all version-stale proof without conflicting with retained inventory descriptors. Observe cancellation before destructive I/O and atomically in the final saved result.

Co-authored-by: Copilot App <[email protected]>

* Revalidate exact retirement receipts after concurrent native cleanup

Keep missing guards unknown without matching retirement evidence, avoid duplicate control credits, and place the control-removal barrier after confirmed Windows handle release.

Co-authored-by: Copilot App <[email protected]>

* Coordinate native control verification and preserve idle retry receipts

Fence matching control opens without blocking unrelated owner admission. Separate root withdrawal from physical cleanup, serialize protected-reader admission with retirement, and retain accepted idle tokens across admission contention. Preserve deterministic same-control, unrelated-owner and same-token regressions.

Co-authored-by: Copilot App <[email protected]>

* Preserve terminal idle decisions across concurrent token replays

Reread the authoritative receipt after maintenance admission and hold serialization through error publication. Add a deterministic accepted-receipt interleaving that previously replaced a non-stopping decision with a committed stop.

Co-authored-by: Copilot App <[email protected]>

* Preserve recovery receipts and resume deferred control cleanup

Revalidate terminal recovery state under maintenance serialization before lifetime checks and execution. Retain the exact pending collection object when another bounded control verifier owns admission, exposing the Busy skip without losing continuation or recrediting removed members. Add deterministic completed/failed/cancelled replay and physical-cleanup continuation controls.

Co-authored-by: Copilot App <[email protected]>

* Decouple logical owner release from physical root-control cleanup

Co-authored-by: Copilot App <[email protected]>

* Prepare a stable read mark for native WAL overlap qualification

Co-authored-by: Copilot App <[email protected]>

* Bind lifecycle fault hooks to exact operations and retain measured binaries

Scope known-operation pause and error hooks before asynchronous admission becomes visible. Preserve causal reconciliation, crash, recovery, native and legacy controls, and capture the exact Cargo-selected measurement CLI and harness as qualification artifacts.

Co-authored-by: Copilot App <[email protected]>

* Bound crash reconnect retries to terminal catalog contention

Preserve failed-token replay and exact recovered pins before fresh-token attempts. Exercise post-lease SQLite Busy injection, unchanged lease resumption, and bounded exhaustion without changing shipping retry or serialization policy.

Co-authored-by: Copilot App <[email protected]>

* Coalesce already-satisfied managed reconciliation

Preserve ready readers and exact checkpoints when queued background work has already been fulfilled. Keep forced repairs, cancellation and version checks, immutable replay, and the periodic verification clock intact.

Co-authored-by: Copilot App <[email protected]>

* Bound initial managed attachment retries

Keep new attempts limited to authoritative uncommitted catalog contention, preserve absent or pending initial intent and immutable receipts, and continue from the actual consumed sequence. Cover pre-lease transaction failure, persisted-lease resumption, bounded exhaustion, and actual dropped-response replay without altering shipping retry behavior.

Co-authored-by: Copilot App <[email protected]>

* Clarify legacy and managed shared-index scope

Co-authored-by: Copilot App <[email protected]>

* Document bounded managed lifecycle measurements

Co-authored-by: Copilot App <[email protected]>

* Reject oversized managed owner claim files

Read one byte past the claim limit before deserializing so a valid JSON prefix cannot hide oversized whitespace or trailing data. Cover the boundary and preserved owner lifecycle through real CLI clients.

Co-authored-by: Copilot App <[email protected]>

* Bump version to 1.2.0

Co-authored-by: Copilot App <[email protected]>

* Authenticate managed daemon RPCs

Require per-daemon credentials before v2 or compatibility dispatch. Publish and validate native owner-only credential files, bind discovery to the private registration, rotate capabilities at restart, and preserve genuine v1 clients with a separate private instance capability.

Co-authored-by: Copilot App <[email protected]>

* Reserve only managed store and namespace paths

Ordinary index commands rejected any path with an ancestor named like the managed store, so an unrelated project or index beneath a directory that merely shares that name fell back to scanning or could not be indexed. Reserve only the store directory itself and paths beneath its 64-hex repository namespaces, compared lexically and case-insensitively after normalization; managed generation files stay rejected by format.

Co-authored-by: Copilot App <[email protected]>

* Close shared views only for candidate read failures

Snapshot validation, deadline and cancellation failures during a shared content query were treated as candidate read failures, which invalidated a ready view and forced full repair. Only open, stat and read failures of the candidate now close the view; control failures propagate unchanged and the view stays ready.

Co-authored-by: Copilot App <[email protected]>

* Preflight legacy archive file and directory conflicts

Reject archive entries beneath a file entry, including the generated probe path, before creating the destination so extraction cannot fail partway and leave output that blocks a retry.

Co-authored-by: Copilot App <[email protected]>

* Wait for descendant lifetime guards in process cleanup tests

Co-authored-by: Copilot App <[email protected]>

* Create release tags from the manual GitHub workflow

Co-authored-by: Copilot App <[email protected]>

* Clean stale build output and preflight index disk space

Coordinate ordinary index and serve writers with serve.lock, clean only recognized startup artifacts, and preserve mapped readers and recovery state. Check destination free space before extraction and staged writes, propagate storage failures without heap fallback, and expose failed initial builds in status.

Co-authored-by: Copilot App <[email protected]>

* Use the trusted event SHA for release checkouts

The preparation step already validates HEAD against GITHUB_SHA. Build and publication jobs can use that immutable event identity directly instead of treating a job output as a checkout ref, preserving the captured snapshot and avoiding the CodeQL untrusted-checkout findings.

Co-authored-by: Copilot App <[email protected]>

* Make server index builds CPU-bounded and resumable

Reuse bounded external sorting for partial checkpoints and recover interrupted publications before startup cleanup. Keep search parallelism independent, preserve low-space status and scan fallback, and cover restart recovery with owned subprocess tests.

Co-authored-by: Copilot App <[email protected]>

* Peel annotated release snapshots before verification

Resolve full captured Git object IDs to commits without consulting mutable tag refs. Cover raw annotated-tag SHAs in shallow checkouts, both preparation and publish verification, mismatched snapshots, and invalid object inputs.

Co-authored-by: Copilot App <[email protected]>

* Reject unsafe fixed staging paths before starting writers

Fail preparation on linked, unremovable, or invalid fixed staging entries and on incomplete scratch enumeration. Keep spill cleanup best-effort because spill names are freshly allocated, and cover both real CLI writer commands and mapped-file retry.

Co-authored-by: Copilot App <[email protected]>

* Confirm Darwin process-group disappearance after signal errors

Handle transient zombie-only group EPERM by reaping the owned child and polling with signal zero for ESRCH under a three-second deadline. Persistent permission errors remain fatal. Add deterministic error-path tests and native macOS descendant-state checks instead of relying on missing procfs.

Co-authored-by: Copilot App <[email protected]>

* Block index publication after failed rollback

Latch recovery-required state under the publication lock, reject every later publisher and reload, and expose restart diagnostics. Exercise move, validation, and commit failures with preserved readers and journal recovery.

Co-authored-by: Copilot App <[email protected]>

* Retry safe catalog contention in owner fixtures

Retry only bounded, explicitly uncommitted catalog-busy owner claims without replacing the claim. Cover a real SQLite writer lock and nonretryable, committed, unknown, and expired outcomes.

Co-authored-by: Copilot App <[email protected]>

* Stop heap fallback after output I/O errors

Mark destination and spill I/O at ordinary builder boundaries, including JSON writes and delta builds, while preserving native causes and managed commitment/retry states. Keep storage failures out of the cold-start heap fallback and verify recovery after the obstruction is removed.

Co-authored-by: Copilot App <[email protected]>

* Make restart recovery fixtures release their writer lock

Run the fixture without a nonexistent watcher so reload finishes its catch-up synchronously. Retain a duplicate lock handle to model a fork-inherited file description, assert active writer exclusion, and explicitly unlock before the simulated restart instead of assuming that dropping one descriptor releases it.

Co-authored-by: Copilot App <[email protected]>

---------

Co-authored-by: Copilot App <[email protected]>

* Fix multiline match counting across search backends

Count original per-file regex matches before clipping spans into output lines. Carry authoritative totals through ordinary and shared server responses without requiring --stats, and reject incomplete count metadata before output.

Co-authored-by: Copilot App <[email protected]>

* Avoid unused row detail in count-match RPCs

Co-authored-by: Copilot App <[email protected]>

---------

Co-authored-by: Copilot App <[email protected]>

Advance the rusqlite Git pin to the compatible development-line revision while retaining native Windows WAL fixes and upgrading bundled SQLite to 3.53.4. Declare and exercise the workspace MSRV, use compatible atomic updates, and preserve OneBranch release hardening and publication behavior.

Co-authored-by: Copilot App <[email protected]>