Prepare v1.2.3 with native watcher, reclamation, and query fixes - #207

Reuse the existing WorkPermit deadline and checks for admitted Windows verification. Bound only unreserved observations with current policy, and cover a policy timeout reduction after admission.

Co-authored-by: Copilot App <[email protected]>

Copilot-Session: cff18193-91c7-4186-9e2d-7dfa8433e29d

Release extraction headroom and consumed input tables instead of retaining cumulative per-posting estimates. Admit hash-table growth with old and replacement capacity both charged, preserve content and mask semantics, and cover CRLF checkpoint/refresh under the existing budget.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: cff18193-91c7-4186-9e2d-7dfa8433e29d

Use bounded recursive-root subscriptions on Windows and macOS while retaining per-directory accounting elsewhere. Preserve native coverage after kernel-initiated watch retirement, expose subscription counts, and cover default-budget multi-worktree events, metadata, fallback, and cleanup.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: d2a0130e-af45-49cc-ac06-2c1da73d9d13

Update both first-party lockfiles and release instructions; preserve historical v1.2.1 deprecation and candidate evidence.

Co-authored-by: Copilot App <[email protected]>

Copilot-Session: cff18193-91c7-4186-9e2d-7dfa8433e29d
Cherry-picked-from: 2f9d21f
Co-authored-by: Copilot App <[email protected]>
Copilot-Session: d2a0130e-af45-49cc-ac06-2c1da73d9d13

Size replacement growth after removing old entries from the unpublished clone. Track backing-capacity watermarks for retained maps, posting sets, and bookkeeping instead of releasing tombstone storage. Add deterministic red/green replacement and deletion regressions, rehash/pressure coverage, and changed-CRLF checkpoint parity.

Co-authored-by: Copilot App <[email protected]>

Copilot-Session: cff18193-91c7-4186-9e2d-7dfa8433e29d
Cherry-picked-from: 6627cef
Copilot-Session: d2a0130e-af45-49cc-ac06-2c1da73d9d13

Resume collection only from an evidenced bounded continuation, preserving exact reclamation accounting and native sharing assertions. Discard epoch-proven CLI fallback scans and wait within the existing managed busy budget before comparing indexed results. Add deterministic deadline and real native Git-exclude controls, and clarify the lifecycle contracts. Production code and the sealed 4e2a2a8 candidate are unchanged.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: d2a0130e-af45-49cc-ac06-2c1da73d9d13

Discard cached member authentication only after other shutdown blockers are clear. Preserve natural expiry, active verifier protection, and existing resource limits. Cover bounded stage reclamation, unchanged-cap readmission, restart persistence, and generated-store cleanup.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: 23051c7b-9d3c-4f54-9d4e-72897ee5a82a

Amortize rooted ancestor opens across consecutive sibling candidates without reordering results. Reuse reconciliation readers while preserving snapshot validation, generation and root pins, final ancestor checks, query deadlines, and response limits. Keep singleton candidates on the direct rooted path.

Add local, legacy, and managed scan-parity coverage plus containment, failure-classification, and pin-lifetime regressions.

Co-authored-by: Copilot App <[email protected]>

Copilot-Session: 417710f4-d898-45a9-ade1-dd8f33592373

Send the effective line-count mode to servers and omit unused matching-line payloads for both count modes. Preserve original match statistics, binary visibility, multiline line-count semantics, legacy ordinary-server rendering, and existing response limits.

Validate projected rows before scope filtering or output, and cover malformed replies, exact byte budgets, dense counts, and local/ordinary/shared route parity.

Co-authored-by: Copilot App <[email protected]>

Copilot-Session: 417710f4-d898-45a9-ade1-dd8f33592373

Integrate current main without rewriting the exact native watcher, reclamation, rooted query batching, count projection and qualification commits. Upstream's Windows publication/CRLF corrections are already present. Bump the workspace and first-party lock versions and release examples; apply rustfmt-only layout to the supplied reclamation tests. No production reimplementation, release workflow or freshness policy change.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: d2a0130e-af45-49cc-ac06-2c1da73d9d13

Preserve full-content response-cap rejection and compare fallback output byte-for-byte with a scan. Assert compact count replies stay on the shared daemon and preserve filename/count parity.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: d2a0130e-af45-49cc-ac06-2c1da73d9d13

macOS deliberately discards verified prefixes after each truncation. Use smaller temporary stages and adjust pinned generations only on macOS, preserving pressure/recovery assertions, the 128-pass bound, all per-pass/resource limits, and the original Windows/Linux fixture inputs. A conservative-prefix model reproduces the old failure and the corrected fixture still fails against the pre-fix idle behavior.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: d2a0130e-af45-49cc-ac06-2c1da73d9d13

An external on-access reader that opens a verified member breaks or refuses
the collection's exclusive F_WRLCK lease. Reproduce both variants in-process
on Linux, isolated in a child test process, and assert the observed
fail-closed signatures followed by recovery once the reader is gone.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: d2a0130e-af45-49cc-ac06-2c1da73d9d13

A typed OwnerGuard::claim failure in `tgrep shared owner-hold` was flattened
to exit 2 plus stderr text, so a supervising client could not distinguish
retryable not-committed catalog contention from an unknown failure.

Before `holding:true`, write exactly one newline-terminated
`{"ok":false,"error":...}` stdout line carrying the managed failure as
returned, then keep the existing exit status and stderr diagnostic.
Claim-file read/size/parse errors stay unclassified and unframed, and no
failure after the handshake is framed. The success handshake, guard
lifetime and SQLite writer/busy limits are unchanged.

Add CLI-boundary regressions: a held catalog writer yields a busy/catalog-io
retryable not-committed frame, and the same claim then holds and exits on
stdin EOF; a live holder yields owner-guard-already-held; an ended lifetime
yields a non-retryable stale-identity frame; malformed claims emit no frame.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: d2a0130e-af45-49cc-ac06-2c1da73d9d13

Healthy native-watched managed views had no periodic full verification,
so a silently missed watcher notification could leave results stale
indefinitely. Once the existing --poll-interval has elapsed since a
view's last completed full pass, the scheduler now queues one ordinary
reconcile operation with verify: true, without invalidating the view.

The verification runs under the unchanged operation deadline and
CPU/input/handle budgets, reads and hashes every admitted file, and
compares membership and visibility with the published snapshot while
queries keep using it. If nothing differs it publishes nothing. The
first detected difference marks the view stale, closing readiness, and
the pass publishes a full repair. Deadline or cancellation leaves the
view ready but unverified until the next interval; other errors,
watcher uncertainty, explicit invalidation, concurrent events and stale
policy keep their fail-closed semantics.

Status adds last_verification and native verification policy fields,
and hello advertises serving-native-periodic-verification. Docs are
updated. Core tests cover unchanged availability, missed-change repair,
concurrent invalidation, read failures, cancellation and policy races.
CLI tests cover the interval boundary, mid-verification serving and
missed nested-directory repair with scan parity.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: d2a0130e-af45-49cc-ac06-2c1da73d9d13

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: d2a0130e-af45-49cc-ac06-2c1da73d9d13

Cancellation, deadline and resource pressure keep a serving verification
ready only when it observed no difference. Add a managed regression for
both interleavings: a membership difference observed by discovery before
cancellation at a paused batch, and a content difference observed by the
full read before cancellation at publication. Both must leave the view
not ready with a full refresh required.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: d2a0130e-af45-49cc-ac06-2c1da73d9d13

Managed v2 indexes can opt out of the binary-extension filename heuristic,
so text such as an ASCII RTF .doc is indexed and searched like ripgrep. NUL
classification, ignore, hidden, size and filename rules are unchanged.

- IndexingProfile gains an optional eligibility ("content-only"); the default
  is omitted, so default keys, storage names and hello.profile are unchanged.
- Worktree verification applies the extension rule only for the default.
- Daemons advertise content-eligibility-profile; v1 leases reject it.
- `--content-eligibility content` searches use only a matching managed view.
  The client and server refuse mismatches in either direction, and the client
  scans with the requested rule. Ordinary servers and local indexes are
  bypassed. index/serve reject the flag.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: d2a0130e-af45-49cc-ac06-2c1da73d9d13

Invalidation schedules automatic reconciliation even with --no-watch, so
the explicit refresh may legitimately run a full pass after the hints are
consumed; assert the preserved content-only profile instead (hint-only
processing stays covered in tgrep-core). Housekeeping can remove a
released owner record before re-hold, which reports owner-retired; both
reason codes remain stale-identity, non-retryable and not-committed.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: d2a0130e-af45-49cc-ac06-2c1da73d9d13

Capture the original failed operation and one best-effort view status within its existing wait budget. Report stop-request, observed acceptance, and post-accept exit timing without changing the shared shutdown deadline. Add deterministic diagnostic-output and loopback controls; no production changes or whole-test retries.

Co-authored-by: Copilot App <[email protected]>

Copilot-Session: d2a0130e-af45-49cc-ac06-2c1da73d9d13

ripgrep records each file's bytes_printed before writing its end message,
and the summary sums those per-file stats. tgrep added the end line to the
running file total after serializing it, so summary.bytes_printed exceeded
the sum of end records by every end line on scan, local-index, server and
managed v2 routes. Stop counting the end line and keep bytes_printed in the
JSON parity comparisons; only elapsed timing remains volatile.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: d2a0130e-af45-49cc-ac06-2c1da73d9d13

Carry per-candidate work receipts from the server matching boundary, including candidates that emit no rows. Populate JSON summary searches/bytes_searched and each file's bytes without extra reads or scan-equivalent guesses. Validate receipts before output and charge them to existing shared response budgets. Keep elapsed conventions unchanged and document backend-work versus result counters.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: d2a0130e-af45-49cc-ac06-2c1da73d9d13

…ttach

The native watcher test assumed every initial views.attach succeeds on its
first operation. The managed contract documents a terminal failed result with
both commitment fields not-committed, category busy, reason
view-preparation-invalidated and retryable=true; the sealed 272c059 run hit it.

Factor the managed_faults exact-state recovery helper into managed_attach.rs
with an explicit per-call-site allowance. Catalog callers keep the unchanged
catalog-io allowance and messages. The watcher call site alone permits the
exact preparation-invalidation outcome: it inspects the old operation, replays
the old token unchanged, recovers the same root/profile/pending identity, uses
a fresh token only after the old terminal result is resolved, keeps the
original 30-second deadline shared across attempts and the existing 8-attempt
ceiling, and requires one lease bound to the first operation. Any other
outcome still fails with view diagnostics. No product code changes.

Scripted controls cover recovery, rewritten replays, extra leases, exhaustion,
deadline, rejected outcomes/identity/responses and the unchanged classifier.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: d2a0130e-af45-49cc-ac06-2c1da73d9d13

Add a managed-test-hooks-only fault at the post-checkpoint preparation
boundary. Its bounded invalidation action advances and invalidates the real
view slot for each of three preparation attempts, producing the actual
retryable, not-committed view-preparation-invalidated operation receipt.
Production builds do not compile the action or its preparation handling.

Exercise the watcher recovery helper against a real managed daemon: verify the
failed receipt and three fault hits, then require token 2 to complete against
the same pending view and original lease, with native readiness, one lease,
indexed search, scan parity, and normal cleanup.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: d2a0130e-af45-49cc-ac06-2c1da73d9d13

Linux procfs can report ESRCH when a task exits after its stat file is opened. Treat that observation as task disappearance in the test-only assert_dead helper while preserving live-state deadlines and unrelated errors. Cover the real open/exit/read boundary and scripted live/error observations.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: d2a0130e-af45-49cc-ac06-2c1da73d9d13

Drive the real on-disk indexed CLI route with pipe backpressure so the
search is held inside the first sibling while the test replaces their
parent. The former batch loop printed the next sibling through the
replaced parent before failing ancestor verification; the streaming
route resolves it again and prints only the replacement.

Unix-only: Windows pins an open parent against replacement.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: d2a0130e-af45-49cc-ac06-2c1da73d9d13

Add a hooks-gated daemon integration test that pauses a real
collections.start operation at object-withdrawn, object-pending-deletion,
member-intent-saved, member-before-io and collection-before-complete,
services operations.cancel while the worker is parked, and then releases it.

The cancelled receipt must be terminal with no delete credit after the
cancel point, unchanged checkpoint members for pre-IO points, a discarded
verification context, namespace retained memory back at its pre-collection
baseline, and an idempotent replay. Fresh operations then resume from the
saved cursor and finish collection with scan parity.

Removing the cancellation recheck after MemberBeforeIo makes the test fail
with 1475 bytes credited after cancellation at member-intent-saved.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: d2a0130e-af45-49cc-ac06-2c1da73d9d13

A bounded collection pass may complete before an armed member/object
barrier: an escaped reader of the object skips it without error, or the
pass exhausts its elapsed budget and returns a resumable cursor. Windows CI
run 39092617708 hit this in the member-before-io iteration of
collection_crash_boundaries_preserve_live_views_and_resumable_progress
(hook armed with 0 hits, one completed pass, 0 errors, 0 verification
pages). The log cannot distinguish the two causes.

Fault tests now start continuation passes with fresh tokens only after a
classifier accepts the short pass (completed, uncancelled, errorless, no
omitted details, target detail limited to object-readers-active, or an
exceeded budget with a cursor). Pass completion is observed through the
in-memory maintenance counters so the poller never reads the catalog
while a pass may hold it at the credit barrier. Recovery assertions keep
their committed expectations, accepting an interrupted, uncommitted
continuation only at removal barriers after earlier passes deleted every
member. Adds a classifier unit test and a witness that drives both
legitimate paths deterministically. No production or budget changes.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: d2a0130e-af45-49cc-ac06-2c1da73d9d13