Add opt-in managed shared-index lifecycle - #189

Restore authoritative full publications after committed failures, retain adaptive decisions across deferral, and checkpoint WAL before mutations. Correct idle-stop authorization and native ownership portability. Exercise live recovery and record checked measurement cleanup and UTC windows.

Co-authored-by: Copilot App <[email protected]>

Use a bounded metadata-root list and choose the shortest matching relative path. Exercise both root orders against a real linked-worktree view, including HEAD, index, configuration, lock and unrelated-event controls.

Co-authored-by: Copilot App <[email protected]>

Use the documented sys/proc_info.h ABI value because the pinned libc crate exposes proc_listpids without PROC_PGRP_ONLY. Keep the bounded, positively identified zombie-only inventory check unchanged.

Co-authored-by: Copilot App <[email protected]>

Serialize headroom admission with SQLite writer acquisition, account for FULL-sync padding and future sidecars, and bound spill-disabled pager payloads. Preserve durable usage and reject unsafe policy reductions before mutation. Cover actual held-reader CLI service and owner-reaper contention.

Co-authored-by: Copilot App <[email protected]>

Use the smallest immutable upstream SQLite correction for canonical Windows paths, cover native read-lock release and real PSOW padding, and serialize metadata execution before deciding whether a receipt is terminal.

Co-authored-by: Copilot App <[email protected]>

Record bounded rendezvous timeouts inside the callback and assert only after restoring the VFS hook. Exercise the sticky timeout path without native callbacks.

Co-authored-by: Copilot App <[email protected]>

Exercise the normally installed release binary through owner lifetime, generation reuse, private views, shared-v2 scan parity, exact migration replay and explicit release. Reuse version-aware backend labels for filename search stats.

Co-authored-by: Copilot App <[email protected]>

Require supported nonzero content evidence for an unmapped owned fixture, invalidate timestamp-restored writes, and reject reusable evidence while a writable mapping survives its creator descriptor. This native proof does not assert a deletion exclusion fence.

Co-authored-by: Copilot App <[email protected]>

Add authentication format discrimination, bounded immutable block proof batches, creation-handle ownership snapshots, exact post-commit proof replay, and conservative producer recovery. Charge authentication scratch memory and catalog storage; compact proof rows in bounded units. This is an intermediate producer slice; native authenticated collection remains separate unfinished work.

Co-authored-by: Copilot App <[email protected]>

Retain native continuity observations, authenticate surviving prefixes and deletion intents, preserve ownership changes, and account for volatile verifier resources.

Co-authored-by: Copilot App <[email protected]>

…rors

Use the Linux F_SETOWN_EX UAPI with its thread-owner struct, and retain cross-platform final-boundary ownership regressions without losing durable intent state.

Co-authored-by: Copilot App <[email protected]>

Record the descriptor-backed absent FILESEC_ACL state separately from bounded ACL encodings and add native absence, ACL-change, and restoration controls.

Co-authored-by: Copilot App <[email protected]>

Centralize bounded unreserved admission with memory-first locking and verify the lock order through a deterministic nonhanging fault boundary.

Co-authored-by: Copilot App <[email protected]>

Retain the cross-platform inventory regression and exercise policy/allocation restarts, expiration, cancellation, and active-versus-idle shutdown resources.

Co-authored-by: Copilot App <[email protected]>

…r guards

Invalidate all version-stale proof without conflicting with retained inventory descriptors. Observe cancellation before destructive I/O and atomically in the final saved result.

Co-authored-by: Copilot App <[email protected]>

Keep missing guards unknown without matching retirement evidence, avoid duplicate control credits, and place the control-removal barrier after confirmed Windows handle release.

Co-authored-by: Copilot App <[email protected]>

Fence matching control opens without blocking unrelated owner admission. Separate root withdrawal from physical cleanup, serialize protected-reader admission with retirement, and retain accepted idle tokens across admission contention. Preserve deterministic same-control, unrelated-owner and same-token regressions.

Co-authored-by: Copilot App <[email protected]>

Reread the authoritative receipt after maintenance admission and hold serialization through error publication. Add a deterministic accepted-receipt interleaving that previously replaced a non-stopping decision with a committed stop.

Co-authored-by: Copilot App <[email protected]>

Revalidate terminal recovery state under maintenance serialization before lifetime checks and execution. Retain the exact pending collection object when another bounded control verifier owns admission, exposing the Busy skip without losing continuation or recrediting removed members. Add deterministic completed/failed/cancelled replay and physical-cleanup continuation controls.

Co-authored-by: Copilot App <[email protected]>

Co-authored-by: Copilot App <[email protected]>

Co-authored-by: Copilot App <[email protected]>

…naries

Scope known-operation pause and error hooks before asynchronous admission becomes visible. Preserve causal reconciliation, crash, recovery, native and legacy controls, and capture the exact Cargo-selected measurement CLI and harness as qualification artifacts.

Co-authored-by: Copilot App <[email protected]>

Preserve the pinned SQLite graph and managed backend labels while merging the upstream pattern resolution, smart-case, boundary and multiline fixes. Exercise the actual managed-v2 backend against scanning for both engines, retaining the empty-pattern-set early exit.

Co-authored-by: Copilot App <[email protected]>

Preserve failed-token replay and exact recovered pins before fresh-token attempts. Exercise post-lease SQLite Busy injection, unchanged lease resumption, and bounded exhaustion without changing shipping retry or serialization policy.

Co-authored-by: Copilot App <[email protected]>

Preserve ready readers and exact checkpoints when queued background work has already been fulfilled. Keep forced repairs, cancellation and version checks, immutable replay, and the periodic verification clock intact.

Co-authored-by: Copilot App <[email protected]>

Keep new attempts limited to authoritative uncommitted catalog contention, preserve absent or pending initial intent and immutable receipts, and continue from the actual consumed sequence. Cover pre-lease transaction failure, persisted-lease resumption, bounded exhaustion, and actual dropped-response replay without altering shipping retry behavior.

Co-authored-by: Copilot App <[email protected]>

Co-authored-by: Copilot App <[email protected]>

Co-authored-by: Copilot App <[email protected]>

Snapshot validation, deadline and cancellation failures during a shared content query were treated as candidate read failures, which invalidated a ready view and forced full repair. Only open, stat and read failures of the candidate now close the view; control failures propagate unchanged and the view stays ready.

Co-authored-by: Copilot App <[email protected]>

Reject archive entries beneath a file entry, including the generated probe path, before creating the destination so extraction cannot fail partway and leave output that blocks a retry.

Co-authored-by: Copilot App <[email protected]>