Fix Windows managed publication and CRLF overlay memory accounting - #205

Summary

Fix two independent managed-publication/readiness blockers encountered while qualifying v1.2.1:

• Windows producer re-observation: authenticate a closed member against its original complete BLAKE3 block proofs and manifest before updating its observed metadata. Keep the native write/delete exclusion guard, exact inventory snapshot, identity, ownership, and producer-state checks. Metadata-only ChangeTime drift is no longer rejected before content authentication; unchanged/restored timestamps are not a content-authentication shortcut.
• Admitted deadlines: authentication uses the existing WorkPermit checks and captured deadline when one is supplied. Only the no-permit path derives a new bounded deadline from current policy.
• CRLF private overlays: account for backing allocations and their lifetimes instead of retaining extraction growth headroom and accumulating fixed per-posting publication charges. Admit old and replacement table storage during growth, release consumed prepared maps, and preallocate controlled clones. Keep actual CRLF bytes and positional/next-byte masks unchanged. Review follow-up tracks allocation watermarks across deletions and removes replaced entries before sizing growth.

Update the managed-lifecycle documentation. The user-requested version-only follow-up, 2f9d21fb964c5816fb4461ace812c7661a856d09, bumps the workspace crates, root/fuzz lock records, and release instructions to 1.2.2. Historical v1.2.1 deprecation references and immutable candidate evidence are preserved. No budget, timeout, watcher-freshness, or host security-policy changes.

Regression evidence

The ordinary-user-EA regression fails against c7b2ab8 with stale-identity / producer-member-modified. It passes with authentication against the original producer seal; no protected kernel EA is set or modified. The kernel component responsible for the observed metadata drift remains unidentified.

The policy-reduction-after-admission regression fails against 2055b93 and passes with the captured permit deadline. Negative coverage remains for same-length tampering with restored timestamps, ownership/identity changes, incomplete/corrupt producer proofs, conflicting native opens/writable mappings, memory pressure, and cancellation.

The new eight-file CRLF regression fails against 0b6e28a with reserved-private-memory-exhausted under the existing 32-MiB test reservation. It now passes through initial readiness, checkpoint capture, and unchanged full refresh. A separate table-growth test covers overlapping allocation charges, genuine admission failure without mutation, overflow, cancellation, and released headroom.

Original generated case: resolved without budget changes

Release/no-test-hooks executable from 0143cc4b7e59e7aa97759c59e1fd98e9b8b238bf; owned synthetic repositories only, 4,096 files of 8,192 bytes each. The original ReFS-backed CRLF fixture and its content inventory were preserved; a separately labeled LF/NTFS-cache control was not substituted for it. These measurements predate the version-only bump and remain attributed to the unchanged candidate.

Both retain the original 32-GiB allocation, 8-GiB private and staging limits, one operation worker/slot, 16-MiB sort buffer, and 10,800,000-ms operation timeout. Effective policy and allocation were checked directly.

CRLF cold and warm attachments fully verified and extracted all 4,097 paths, including the linked-worktree gitfile. Warm attachment reused the published generation with zero Git blob reads. Managed/standalone membership matched all 4,097 paths; managed/local-index/filesystem content results matched for the shared anchor (4,096 paths), a 32-byte substring after the CRLF prefix (one path), and an absent pattern (zero paths). LF preserved 4,096 base reuses with only the gitfile extracted.

The original-case daemon's separately observed native peak private/commit memory was 2,200,727,552 bytes. Namespace admission estimates are not an RSS cap. These are single readiness observations, not a speedup claim: full transformed overlays remain expensive, particularly checkpoint/catalog work.

Both daemon/owner pairs exited normally, leases and root handles drained, and all four disposable worktrees were removed. Generated sources, caches, original failure reports, and new qualification evidence remain available locally.

Qualification scope: full watched real-repository qualification has not passed. The separate watcher-budget/polling-fallback issue is being handled independently and is not fixed by this PR. Successful generated publication/CRLF readiness does not establish full release readiness.

Validation

Correction candidate at 0143cc4, Windows / Rust 1.88: 228 selected tests passed (161 core unit, 24 generation integration, 3 native WAL, 37 lifecycle, 3 real CLI). Native Linux: 225 selected tests passed (165 core unit, 24 generation integration, 36 lifecycle); the ignored subprocess entry point was exercised by its supervisor. Formatting passed. Default Clippy completed with the same 10 pre-existing warnings in untouched files; strict -D warnings remains baseline-blocked.

Windows commands (CARGO_BUILD_JOBS=2, test-build Rust flags unset, MSVC environment initialized):

cargo +1.88.0 fmt --all --check
cargo +1.88.0 test --locked -p tgrep-core --features managed-test-hooks --lib -- managed:: worktrees:: live:: trigram:: shared:: --test-threads=2
cargo +1.88.0 test --locked -p tgrep-core --features managed-test-hooks --test generations --test managed_catalog_windows --test managed_lifecycle -- --test-threads=2
cargo +1.88.0 test --locked -p tgrep-cli --features managed-test-hooks --test shared_daemon -- managed::v2_cli_real_backend_migration_replay_and_idle_shutdown managed::live::concurrent_clients_share_one_new_publication_with_distinct_exact_commits_and_private_views managed::faults::process_crashes_at_generation_and_view_boundaries_recover_the_exact_pin --test-threads=2
cargo +1.88.0 clippy --locked --workspace --all-targets --features tgrep-cli/managed-test-hooks

Native Linux ran the same core selectors and the generations / managed_lifecycle integration targets in a native Linux directory, with two build/test threads.

Version-only follow-up at 2f9d21f: both locked graphs resolve tgrep-core/tgrep-cli to 1.2.2 without dependency upgrades. A fresh hardened Windows release build without test-hook features passed; --version, -V, and Windows FileVersion/ProductVersion all report 1.2.2. The 17 existing isolated release-script tests, formatting, and diff checks passed. The earlier generated campaign was not rerun or relabeled for this metadata-only change.

cargo +1.88.0 tree --offline --locked --workspace --depth 0
cargo +1.88.0 tree --offline --locked --manifest-path fuzz\Cargo.toml -p tgrep-core --depth 0
cargo +1.88.0 build --release --locked -p tgrep-cli --bin tgrep --target x86_64-pc-windows-msvc --no-default-features --target-dir target\publication-release
python -B -m unittest discover -s scripts -p test_prepare_release.py -q

Review corrections at 6627cefa439f3b0fed1d07aa8814b9c9b53fda52

Both review findings have deterministic red/green coverage against 2f9d21f:

• A replacement with only 320 bytes of spare admission previously failed with reserved-private-memory-exhausted. Removing its old entries before sizing growth lets the same-size replacement fit. A truly oversized replacement still fails without changing the published view.
• Deletion previously reduced a retained charge to 4,726 bytes instead of the required 10,390 while backing storage remained allocated. Persistent allocation watermarks now cover every retained table, nested posting set, and the bookkeeping map. Single/batch deletion tests verify unchanged surviving storage and actual retained namespace accounting; rehash, rebuild, real pressure, clear, and drop paths are covered.

The CRLF regression additionally covers an equal-length content edit, refresh, result parity, and another checkpoint under the original 32-MiB test reservation.

Windows: 261 selected tests passed (164 core unit, 24 generation, 3 native WAL, 37 lifecycle, 30 shared-worktree, 3 real CLI). Native Linux: 257 selected tests passed (168 core unit, 24 generation, 36 lifecycle, 29 shared-worktree); the supervised subprocess entry point is not double-counted. Formatting and a hardened release build pass. Default Clippy still reports only the same 10 pre-existing warnings; strict lint is not claimed to pass.

The review follow-up extends the earlier commands with these core/integration selectors; the three real CLI selectors and Clippy command above were also rerun:

cargo +1.88.0 test --locked -p tgrep-core --features managed-test-hooks --lib -- managed:: worktrees:: live:: trigram:: shared:: hybrid:: --test-threads=2
cargo +1.88.0 test --locked -p tgrep-core --features managed-test-hooks --test generations --test shared_worktrees --test managed_catalog_windows --test managed_lifecycle -- --test-threads=2

Native Linux uses the same core selectors and generations, shared_worktrees, and managed_lifecycle integration targets. Its archived source tree is exactly the committed tree 5fe12555fba5e141c57683ef4fa1f52ac9eb3e89.

A fresh local 1.2.2 release/no-hooks validation build also passed the original CRLF/ReFS cold/warm readiness and exact membership/content parity, without changing policy or allocation: 456.042 s cold, 409.739 s warm, 7,645,982,280 bytes peak private-work admission. Both passes fully read/extracted 4,097 paths; warm reused the generation with zero Git blob reads. Its SHA256 is ee70cf0c948009d49fb26d5bb9610ec05e650d6275635d5b2746822711613c7a.

Teardown caveat: after successful readiness/parity and both lease/root-handle drains, the benchmark harness hit operation-token-conflict while changing stop tokens without advancing the sequence, then forcibly terminated its own daemon. The failure report is preserved. The same executable subsequently recovered the retained cache and completed an atomic idle stop normally. The two new disposable worktrees and native Linux build directories were removed; the source inventory, caches, and evidence remain. This is not an all-clean first-run teardown or watched real-repository qualification. No existing immutable candidate was replaced.

Separately identified candidate

The retained read-only local candidate is not the official v1.2.1 artifact and was not replaced or relabeled by the 1.2.2 source bump or review corrections. Its CLI version remains tgrep 1.2.1; Cargo records show empty tgrep-core/tgrep-cli feature sets and a release, non-test profile. Both generated runs verified that testing.status is unavailable. No executable is committed or attached here.

Source: 0143cc4b7e59e7aa97759c59e1fd98e9b8b238bf
SHA256: fb46b6aa8dc9ccd56f6bf816f9c71c1e4ee79218688d6d9e6cc8264fa537e3ae
Build: cargo +1.88.0 build --release --locked -p tgrep-cli --bin tgrep --target x86_64-pc-windows-msvc --no-default-features --target-dir target\publication-release --message-format=json-render-diagnostics
RUSTFLAGS: -Ccontrol-flow-guard -Ctarget-feature=+crt-static -Clink-arg=/DYNAMICBASE -Clink-arg=/CETCOMPAT

Source diff and build provenance are retained beside the immutable candidate. Earlier candidates and the independent runtime qualification were not changed. This PR does not create a release/tag or merge either change.