…ag (#215)

GitHubRelease@1 (action: edit) creates the tag when no release exists for it. ReleaseTag defaulted to `main`, so publishing without overriding it created a lightweight `main` tag that shadows the `main` branch: `git pull origin main` fetched the stale tag and silently did nothing.

- Default ReleaseTag to `unreleased`; outside publishing it only names the artifacts.
- When PublishToGitHub is enabled, validate ReleaseTag as v<major>.<minor>.<patch>[-pre] in the first step of both jobs, before any build or signing work.
- Document the requirement in CONTRIBUTING.md.

The stray remote tag itself (0b3b528, the same commit as v0.1.11) was deleted separately.

Fixes #213

Co-authored-by: Copilot App <[email protected]>

…; bump to 1.2.5 (#217)

* Prioritize managed work, bound WAL checkpoints, cut scoped query cost

Addresses #212, #214 and #216.

#212: scheduling and starvation
- Replace the managed daemon's FIFO job dispatch with a bounded, aged
  job queue with foreground, maintenance (collection) and background
  (serving verification, automatic advancement) classes. A free worker
  runs the job whose queue time plus class delay (0 s, 5 s, 10 min) is
  earliest, so catch-up reconciliation no longer waits behind background
  work and no class starves. When a view loses readiness, its queued
  work moves to the foreground class and keeps its queue time.
- Back off exponentially when recovery or collection continuations make
  no progress, instead of counting verification-only activity as
  productive.
- Report queued and running jobs, collection activity and each view's
  queued work in status, distinguishing accepted, queued and running
  work.
- Run each parallel query window on a dedicated rayon pool
  (tgrep-search-N), so long reconciliation jobs on the global pool no
  longer stall searches.

#214: WAL growth
- Trigger the pre-mutation catalog checkpoint at min(metadata_bytes / 4,
  64 MiB). Only the trigger changes; the checkpoint itself,
  synchronization and crash-credit ordering are unchanged. The trigger
  does not cap WAL size while readers pin frames.
- Document resumable collection verification and how to tune collection
  budgets safely.

#216: scoped queries, verification cost and readiness churn
- Restrict indexed candidates to the queried scope before processing
  paths, check overlay precedence once per selected file, and walk only
  the matching prefix of the ordered membership set for shared --files
  listings.
- Filter --files listings by glob and type in the daemon.
- Let managed v2 clients derive their attachment from the gitfile,
  commondir and markers without running Git. The derived identity must
  match the registration bound to the owner-only credential; any
  mismatch falls back to Git discovery. Discover once per worktree per
  invocation and revalidate further paths with lookup. The managed
  accept loop blocks in accept() instead of polling every 10 ms; a waker
  connection unblocks it at shutdown.
- Open sibling candidates through the group's pinned handles, and size
  sibling groups from the sibling count and query threads, capped at 64
  files, so small directories spread across query threads. Containment
  is still verified when each batch finishes and against the query's
  final snapshot.
- Carry trusted unchanged metadata through reconciliation without
  content opens or parent verification batches, including for untracked
  overlay files. Use tree-only invalidation where possible, keep the
  original hints when a pass fails, coarsen hints that overflow their
  bound to ancestor directories, and keep the evidence of an unchanged
  verification that a newer event superseded. An explicit refresh still
  rereads every file.
- Pace native verification in two tiers: metadata checks after at least
  one poll interval and content rereads after at least 15, each also
  waiting 19 times its previous admitted cost. Status reports the tier,
  the delays and metadata reuse, plus tree and Git event counters.
- Ignore modifications of the Git metadata root and remote-tracking or
  prefetch ref updates. Index, HEAD, local branch and directory changes
  keep tree checks instead of forcing full rereads.

Co-authored-by: Copilot App <[email protected]>

* Publish eventual verification differences found alongside newer hints

A serving verification that found a difference while a newer invalidation
arrived returned ChangedDuringReconcile, and its stale guard then forced a
full reread. On an eventual view, an edit made during a content pass
therefore cost a second full pass: on a 184,065-file dotnet checkout the
operation read 5.6 GB in 802.6 s, and the edit stayed unsearchable for
797 s after the write.

An eventual (stale_reads) view now publishes the verified state at a fresh
epoch without restoring readiness and returns
Verification::PublishedSuperseded. A verification starts only with an empty
queue, so everything still queued is newer than the verified state; the
same operation's ordinary hinted refresh then processes only those hints.
The receipt reports verification "superseded" with changed: true. Strict
(v1) views still return ChangedDuringReconcile, and a failed publication
still fails closed.

Tests:
- eventual_verification_publishes_a_difference_and_leaves_only_newer_hints
  (core): the difference is published and searchable while the view stays
  unready but serving with one pending path; the follow-up reads one file
  without a full pass and restores readiness.
- superseded_native_content_verification_publishes_edits_without_a_second_full_pass
  (shared_daemon): the completed receipt reports superseded and changed,
  full=false, files_read=1, metadata_reused=2; the view serves throughout
  and the content timer advances.

On the same checkout, a forced content pass with an edit 3 s in is now one
operation with outcome superseded: one content pass plus a 1-read hinted
pass, 2.84 GB of job reads (was 5.64 GB) and 301 CPU-s (was 739). The edit
was searchable at the first publish, before the hinted pass; serving held
for all 122 polls, and the next content delay is the 1,800 s floor.

Co-authored-by: Copilot App <[email protected]>

* Bump version to 1.2.5

Co-authored-by: Copilot App <[email protected]>

* Apply cost backoff to failed content verification attempts

Track terminal content attempts separately from successful rereads so failures and cancellations restart retry backoff without resetting content freshness. Preserve metadata checks and the successful-pass cadence, expose attempt age and retry delay, and cover the behavior with scheduler-boundary and daemon fault-injection regressions.

Co-authored-by: Copilot App <[email protected]>

* Make worktree verification tests honor complete file versions

Account for Unix ctime changes after size-preserving writes that restore mtime. Assert metadata repair when the complete version changes, content-tier repair otherwise, and the corresponding short-circuit hint-lookup count.

Co-authored-by: Copilot App <[email protected]>

* Wait for the requested verification tier in managed tests

Do not mistake an earlier metadata result for a content retry while the new operation is queued or just starting. Wait for an empty work queue and the expected tier as well as the terminal outcome.

Co-authored-by: Copilot App <[email protected]>

* Bound managed queue aging by operation lifetime

Cap class offsets at one quarter of remaining operation lifetime, sharing the durable acceptance clock with work admission. Consider shorter-lived jobs within each class and preserve queue age during promotion.

Co-authored-by: Copilot App <[email protected]>

* Allow transient inherited guard locks in lifecycle tests

Keep the live-reader protection assertions immediate, but bound release checks while concurrent subprocesses may still hold inherited descriptors before exec.

Co-authored-by: Copilot App <[email protected]>

* Back off failed polling reconciliations by terminal attempt cost

Record polling failures and cancellations, gate retained work by its retry delay, and allow newer input epochs to request prompt repair. Keep running receipts pending until retry accounting completes and cover both configured polling and native fallback.

Co-authored-by: Copilot App <[email protected]>

* Retain coarsened hints that fit the configured capacity

Treat half capacity as a compaction target rather than a hard limit. Cover mixed root and nested hints at even and odd capacities while retaining genuine overflow fallback.

Co-authored-by: Copilot App <[email protected]>

* Wait for attach reservations before injecting catalog contention

A ready publication can precede permit teardown. Drain its reserved slots before taking the test's writer lock so the fixture does not strand a reservation during cleanup.

Co-authored-by: Copilot App <[email protected]>

---------

Co-authored-by: Copilot App <[email protected]>