* Fix ordered type filters, glob precedence, pattern sources and case flags

Keep global -e/-f patterns given before the search subcommand (#194), let
a positive glob override a conflicting type filter like ripgrep (#195),
apply -t/-T in command-line order (#196) along with --type-add and
--type-clear (#201), make the last of -i/-s/-S win (#197), and accept
repeated -f/--file inputs alongside -e in order (#200). Ordered type
operations reach the server and shared daemon through a type_ops
parameter; clients require an ordered_filters acknowledgement before
trusting a reply whose result depends on that order.

Co-authored-by: Copilot App <[email protected]>

* Render multiline and JSON replacements like ripgrep (#198, #199)

`-U --replace` now rewrites each block of lines joined by matches as a
whole, following ripgrep's multiline printer: the rewritten text is printed
line by line with line numbers counting up from the block's first line, and
context gaps are measured from the source lines. `-o -r` prints each
rewritten match instead of nothing.

`--json --replace` keeps the source `lines`, submatch text and offsets, and
adds `submatches[].replacement`, as ripgrep does.

Clients send `multiline_replace` and `report_replacements` only when the
result depends on them. `tgrep serve` and shared daemons v1 and v2
acknowledge both; a reply without the needed ack makes the client fall back
with a diagnostic instead of printing the old rendering.

Tests cover each reported case on scan, local index, server and shared
views, plus a fake old server. The README documents the ordering rules,
the JSON `replacement` field and multiline `-r` behavior. Also resolves
clippy lints.

Co-authored-by: Copilot App <[email protected]>

* Request replacement rendering only when output depends on it

`-U --replace` now asks for `multiline_replace` only when the pattern can
match a line terminator. Any other pattern prints line by line, which an
older server already does. `--json --replace` no longer asks for
`report_replacements` with `-v` or `-q`, which print no submatches.

The acknowledgement check now reads the request, so it can never require
a field the client did not send. An older server's reply is then used
rather than refused for searches it renders identically.

Co-authored-by: Copilot App <[email protected]>

* Apply glob-over-type precedence only when the client asks for it

A server applied ripgrep's filter order to every request, so a client
that predates it, sending only `glob` and `types`, saw a positive glob
reinclude files its `-t`/`-T` had excluded. The client now sends
`ordered_filters` when its result depends on that order, and the TCP
server and shared daemons keep the old type and glob intersection for
requests without it. The client refuses a reply that does not
acknowledge the request, as before.

Co-authored-by: Copilot App <[email protected]>

* Pin ripgrep separators around hidden rewrite blocks

ripgrep writes a file separator, and a context break before a block that
does not follow on from the last one, before it knows whether a multiline
rewrite leaves any row to print. A block the rewrite hides therefore keeps
its `--` (and its path with --heading), even at the end of the output.
tgrep already matches this on every backend; pin it with ripgrep 15.2.0's
output.

Co-authored-by: Copilot App <[email protected]>

* Omit type definitions from server requests without type selections

Without a -t/-T, --type-add/--type-clear definitions cannot change which
files are searched, yet a definition-only invocation still sent type_ops
and ordered_filters, so an older server's reply was refused and the client
fell back. Leave the definitions, type_ops and ordered_filters out of the
request unless a selection consumes them. Validate the definitions before
asking any backend, as ripgrep does, so an invalid --type-add fails the
same way with or without a server instead of reporting a server failure.

Co-authored-by: Copilot App <[email protected]>

* Separate files with hidden rewrites as ripgrep's parallel search does

ripgrep writes the `--` between files in one of two ways. Searching one
file at a time (under --sort, -j1 or on a single CPU), its printer writes
it as soon as a file reports a line, even if the rewrite then hides it.
Searching in parallel, it buffers each file's output and writes the
separator only before a buffer that holds something, so a file whose
-U -r rewrites print nothing adds no `--`. tgrep always did the former.

Hold a file boundary's `--` until the next file prints something, unless
ripgrep would search sequentially.

Co-authored-by: Copilot App <[email protected]>

* Ask servers for no replacement rendering under -m0

`-m0` prints no lines, so `-U --replace` has no block to rewrite and
`--json --replace` has no submatch to report. Requesting either capability
anyway made a search fall back from an older server or shared view that
lacked it, for output that could not differ.

Also pin that an empty file reports no match under `-U --replace`, with or
without context, as ripgrep does: there is no zero-width match to keep.

Co-authored-by: Copilot App <[email protected]>

* Work out once per search whether a pattern can match a line terminator

`-U --replace` only rewrites a file's matches as blocks when the pattern
can match `\n`. FileMatches::find answered that by parsing the pattern
into HIR again for every matching file, on the client and on the
server, so the cost grew with the number of `-f` patterns times the
number of matching files.

The linear-time matcher now works the answer out the first time it is
asked and keeps it, so a search parses its pattern once, whichever
thread gets there first. The `--multiline-dotall` flag the regex was
compiled with lives beside it, which retires the per-file
MatchOptions.dotall and the server's SearchOpts.dotall copies.

Co-authored-by: Copilot App <[email protected]>

* Keep ordered flags in argument order under every subcommand

Clap keeps only the deepest scope's values of a global flag, so the
reparse that rebuilds -e/-f, the type flags and the case flags in
command-line order has to cover every subcommand, not just `search`.
`--type-list` is honored under any subcommand, so
`--type-clear rust index --type-add rust:*.txt --type-list` listed an
empty rust type instead of `rust: *.txt` as rg does.

The reparse now makes those flags local at every level, nested `shared`
commands included, and reads each level of the subcommand chain in
order. It runs only when a subcommand is present and an ordered flag
was used.

Co-authored-by: Copilot App <[email protected]>

* Find lines for zero-length matches such as `\b`

The line prescan from #102 assumed every match was non-empty and took
`end - 1` as the match's last byte. Patterns like `\b` and `\<` match
empty at a word's edge without matching `""` on their own, so they
reached it. An empty match at offset 0 underflowed, which panicked in
debug builds and printed lines twice in release builds, and one at a
later line's start gave a reversed range that dropped the line.

Each match now covers the lines from its start through its end offset.
That also covers the line after a match ending at a `\n`, where
`find_iter` skips an empty match at the previous match's end, like the
`\<` before `bbb` in `x\nbbb` for `\s|\<`.

Co-authored-by: Copilot App <[email protected]>

---------

Co-authored-by: Copilot App <[email protected]>

Keep no-policy shared startup on v1, with a single stderr deprecation warning. Recommend explicit-policy managed v2 without changing legacy clients, protocols, formats, or retain-all storage. Prepare workspace package versions and add focused startup and output-isolation coverage.

Co-authored-by: Copilot App <[email protected]>

* Bound and instrument managed worktree reconciliation

Cache versioned work controls with bounded authorization refresh; verify files in shared CPU, input and parent-handle budgets while preserving rooted reads, epoch checks and full repair fallback.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: 9776b17f-6a2d-4c47-9e89-0f8113d14b95

* Document the measured RC2 reconciliation speedup

Record the sanitized same-binary Windows/ReFS comparison, phase accounting, bounded resource peaks, correctness gates, and exact provenance. Keep the unchanged periodic full-repair limitation explicit.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: 9776b17f-6a2d-4c47-9e89-0f8113d14b95

* Clarify reconciliation read and memory accounting

Describe full-reconciliation read operations without claiming EOF consumption. Distinguish the 64 MiB searchable cap from the extra probe byte and describe the conservative read/decode charge rather than physical buffers.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: 9776b17f-6a2d-4c47-9e89-0f8113d14b95

* Classify blob-boundary file growth as unstable

Check growth past the opened length before the managed blob limit. Add deterministic regressions for one-byte growth at the boundary and stable initially oversized files. Keep benchmark timings attributed to the immutable measured source rather than this follow-up.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: 9776b17f-6a2d-4c47-9e89-0f8113d14b95

* Remove periodic safety repair for native managed views

Honor the requested event-driven staleness tradeoff for healthy native managed views. Preserve chosen and fallback polling, strict initial/restore verification, explicit refresh and error recovery. Report configured and effective update modes separately, cover the former timer boundary deterministically, and retain the original benchmark attribution.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: 9776b17f-6a2d-4c47-9e89-0f8113d14b95

* Make managed timer tests independent of clock epoch

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: 9776b17f-6a2d-4c47-9e89-0f8113d14b95

* Clarify bounded ancestor observations and publication checks

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: 9776b17f-6a2d-4c47-9e89-0f8113d14b95

---------

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: 9776b17f-6a2d-4c47-9e89-0f8113d14b95