status: preserve authenticated proofs across owned index writes

b65fc91 (status: retain the identity of an index it rewrites,
2026-08-17) lets status keep a race-proof receipt for an index it
rewrites. Receipt preparation duplicates the writer descriptor so it can
hash the final bytes, and requires the in-memory checksum to match the
configured null trailer.

Three owned write paths can leave an otherwise valid index without a
usable clean proof. A worktree-update repair first writes a checksummed
provisional index, then reopens the lockfile write-only before the final
skipHash write while the index still records the provisional checksum.
Receipt preparation rejects both states, so scoped stash cannot publish
a sidecar for the index it installs.

Worktree add creates its linked index before the new worktree has a
closed FSMonitor provider epoch. The index has FSMonitor and
untracked-cache extensions, but lacks the authenticated clean-config
proof. Later read-only status processes remain correct, but cannot
persist that proof and repeat the full fallback on every invocation.

A clean non-fast-forward merge repairs its authenticated index proof
before committing, but leaves the existing sidecar bound to the old
index and HEAD tree. The next read-only status rejects it with a
fast-index-mismatch and scans the semantic manifest. Only a later
writable status can replace the stale sidecar.

Add a read-write reopen operation only for the provisional index lock so
receipt preparation can read the final index. Fall back to the original
write-only reopen when read access is unavailable, allowing the write to
succeed without a receipt. Finish provisional writes through a cold
helper that restores the null object ID before the receipt-aware write.

After worktree add successfully runs the post-checkout hook, run one
silent status to establish the provider epoch and persist the complete
proof. Do so only when the caller permits optional locks; never override
an explicit --no-optional-locks request.

Factor the best-effort sidecar reissue used by rebase into wt-status.
After a successful merge commit has installed its final HEAD and index,
use that helper to authenticate the settled state. Sidecar failure still
falls back to ordinary status and never changes the merge result.

Cover receipt publication and adoption after scoped stash, preserve the
generic write-only tempfile contract, and require worktree add to honor
post-checkout index writes and disabled optional locks. Also require a
clean non-fast-forward merge to publish a sidecar that its next
read-only status can consume.

Author: ttaylorr-oai

Makefile

@@ -2580,6 +2580,8 @@ LIBS = $(filter-out %.o, $(GITLIBS)) $(EXTLIBS)
 
 BASIC_CFLAGS += $(COMPAT_CFLAGS)
 LIB_OBJS += $(COMPAT_OBJS)
+# Keep provisional-index glue after every existing library object.
+LIB_OBJS += clean-status-index-provisional.o
 
 # Quote for C
 

builtin/merge.c

@@ -1431,6 +1431,7 @@ int cmd_merge(int argc,
 	struct strbuf buf = STRBUF_INIT;
 	int i, ret = 0, head_subsumed;
 	int best_cnt = -1, merge_was_ok = 0, automerge_was_ok = 0;
+	int merge_committed = 0, reissue_sidecar = 0;
 	int repair_after_merge = 0;
 	struct commit_list *common = NULL;
 	const char *best_strategy = NULL, *wt_strategy = NULL;
@@ -1536,6 +1537,8 @@ int cmd_merge(int argc,
 	    !clean_status_config_read_repository(the_repository, &clean_digest)) {
 		clean_status_enable_external_history(the_repository);
 		clean_status_set_config_digest(the_repository, &clean_digest);
+		reissue_sidecar =
+			wt_status_clean_sidecar_present(the_repository);
 	}
 
 	if (repo_read_index_unmerged(the_repository))
@@ -1800,6 +1803,8 @@ int cmd_merge(int argc,
 					       &remoteheads->item->object.oid)) {
 				ret = merge_trivial(head_commit, remoteheads,
 						    repair_after_merge);
+				if (!ret)
+					merge_committed = 1;
 				goto done;
 			}
 			printf(_("Nope.\n"));
@@ -1909,6 +1914,8 @@ int cmd_merge(int argc,
 		ret = finish_automerge(head_commit, head_subsumed,
 				       common, remoteheads,
 				       &result_tree, wt_strategy);
+		if (!ret)
+			merge_committed = 1;
 		goto done;
 	}
 
@@ -1957,6 +1964,11 @@ int cmd_merge(int argc,
 		printf(_("When finished, apply stashed changes with `git stash pop`\n"));
 
 done:
+	if (!ret && merge_committed && reissue_sidecar &&
+	    repair_after_merge && use_optional_locks() &&
+	    !hook_exists(the_repository, "post-index-change"))
+		wt_status_reissue_clean_sidecar_after_worktree_update(
+			the_repository, repair_after_merge, &clean_digest);
 	if (!automerge_was_ok) {
 		commit_list_free(common);
 		commit_list_free(remoteheads);

builtin/worktree.c

@@ -9,6 +9,7 @@
 #include "copy.h"
 #include "dir.h"
 #include "environment.h"
+#include "fsmonitor-settings.h"
 #include "gettext.h"
 #include "hex.h"
 #include "object-file.h"
@@ -21,12 +22,14 @@
 #include "refs.h"
 #include "remote.h"
 #include "run-command.h"
+#include "repo-settings.h"
 #include "hook.h"
 #include "sigchain.h"
 #include "submodule.h"
 #include "utf8.h"
 #include "worktree.h"
 #include "quote.h"
+#include "trace2.h"
 
 #define BUILTIN_WORKTREE_ADD_USAGE \
 	N_("git worktree add [-f] [--detach] [--checkout] [--lock [--reason <string>]]\n" \
@@ -409,6 +412,31 @@ static int checkout_worktree(const struct add_opts *opts,
 	return run_command(&cp);
 }
 
+static void prime_worktree_clean_status_proof(const char *path)
+{
+	struct child_process cp = CHILD_PROCESS_INIT;
+	int ret;
+
+	/*
+	 * The checkout creates the linked index before it has a provider epoch
+	 * from which to certify the worktree.  Establish that epoch while this
+	 * writer can still update the index; a later read-only status cannot
+	 * persist the missing proof.
+	 */
+	cp.git_cmd = 1;
+	cp.dir = path;
+	cp.no_stdin = 1;
+	cp.no_stdout = 1;
+	cp.no_stderr = 1;
+	strvec_pushl(&cp.args, "status", "--porcelain=v2",
+		      "--untracked-files=normal", NULL);
+	strvec_push(&cp.env, GIT_DIR_ENVIRONMENT);
+	strvec_push(&cp.env, GIT_WORK_TREE_ENVIRONMENT);
+	ret = run_command(&cp);
+	trace2_data_intmax("worktree", the_repository,
+			   "add/clean-status-primed", !ret);
+}
+
 static int make_worktree_orphan(const char * ref, const struct add_opts *opts,
 				struct strvec *child_env)
 {
@@ -593,7 +621,6 @@ static int add_worktree(const char *path, const char *refname,
 	if (opts->checkout &&
 	    (ret = checkout_worktree(opts, &child_env)))
 		goto done;
-
 	is_junk = 0;
 	FREE_AND_NULL(junk_work_tree);
 	FREE_AND_NULL(junk_git_dir);
@@ -622,6 +649,15 @@ static int add_worktree(const char *path, const char *refname,
 
 		ret = run_hooks_opt(the_repository, "post-checkout", &opt);
 	}
+	if (!ret && opts->checkout && use_optional_locks() &&
+	    fsm_settings__get_mode(the_repository) == FSMONITOR_MODE_IPC &&
+	    the_repository->settings.core_untracked_cache ==
+		UNTRACKED_CACHE_WRITE &&
+	    !getenv(INDEX_ENVIRONMENT) &&
+	    !getenv(GIT_COMMON_DIR_ENVIRONMENT) &&
+	    !getenv(DB_ENVIRONMENT) &&
+	    !getenv(ALTERNATE_DB_ENVIRONMENT))
+		prime_worktree_clean_status_proof(path);
 
 	strvec_clear(&child_env);
 	strbuf_release(&sb);

clean-status-index-provisional.c

@@ -0,0 +1,16 @@
+#include "git-compat-util.h"
+#include "clean-status-index.h"
+#include "lockfile.h"
+#include "read-cache-ll.h"
+#include "repository.h"
+
+int clean_status_write_index_after_provisional(
+	struct index_state *istate, struct lock_file *lock, unsigned flags,
+	struct clean_status_index_write_receipt *receipt)
+{
+	/* Let receipt preparation authenticate the final null trailer. */
+	if (istate->repo->settings.index_skip_hash)
+		oidcpy(&istate->oid, istate->repo->hash_algo->null_oid);
+	return write_locked_index_with_receipt(
+		istate, lock, flags, receipt);
+}

clean-status-index.h

@@ -5,6 +5,7 @@
 #include "hash.h"
 
 struct index_state;
+struct lock_file;
 struct repository;
 
 /*
@@ -52,6 +53,11 @@ int clean_status_index_adopt_write_receipt(
 void clean_status_index_write_receipt_release(
 	struct clean_status_index_write_receipt *receipt);
 
+/* Finish a provisional write without widening the ordinary status hot path. */
+int clean_status_write_index_after_provisional(
+	struct index_state *istate, struct lock_file *lock, unsigned flags,
+	struct clean_status_index_write_receipt *receipt);
+
 int clean_status_index_snapshot_open(
 	struct clean_status_index_snapshot *snapshot, const char *path,
 	const struct git_hash_algo *algo);

lockfile.h

@@ -344,6 +344,11 @@ static inline int reopen_lock_file(struct lock_file *lk)
 	return reopen_tempfile(lk->tempfile);
 }
 
+static inline int reopen_lock_file_for_readwrite(struct lock_file *lk)
+{
+	return reopen_tempfile_for_readwrite(lk->tempfile);
+}
+
 /*
  * Commit the change represented by `lk`: close the file descriptor
  * and/or file pointer if they are still open and rename the lockfile

meson.build

@@ -340,6 +340,7 @@ libgit_sources = [
   'clean-status-history.c',
   'clean-status-identity.c',
   'clean-status-index.c',
+  'clean-status-index-provisional.c',
   'clean-status-manifest.c',
   'clean-status-sidecar.c',
   'clean-status-fast.c',

sequencer.c

@@ -5616,46 +5616,6 @@ static int commit_staged_changes(struct repository *r,
 	return ret;
 }
 
-static void reissue_clean_sidecar_after_rebase(
-	struct repository *r, int had_full_proof,
-	const struct clean_status_config_digest *config)
-{
-	struct lock_file lock = LOCK_INIT;
-	int repaired;
-
-	/* The rebase has completed; a missing sidecar safely falls back. */
-	if (repo_hold_locked_index(r, &lock, 0) < 0) {
-		trace2_data_string("status", r,
-				   "clean-proof/writer-sidecar-skip",
-				   "index-lock");
-		return;
-	}
-	/* A replayed commit may have replaced the index in a child process. */
-	discard_index(r->index);
-	if (repo_read_index(r) < 0) {
-		rollback_lock_file(&lock);
-		trace2_data_string("status", r,
-				   "clean-proof/writer-sidecar-skip",
-				   "index-read");
-		return;
-	}
-	if (!r->index->fsmonitor_token_valid) {
-		r->index->fsmonitor_has_run_once = 0;
-		refresh_fsmonitor(r->index);
-	}
-	repaired = wt_status_repair_fsmonitor_proof_after_update_with_sidecar(
-		r, &lock, had_full_proof, config);
-	if (repaired < 0) {
-		rollback_lock_file(&lock);
-		trace2_data_string("status", r,
-				   "clean-proof/writer-sidecar-skip",
-				   "proof-repair");
-		return;
-	}
-	if (!repaired)
-		rollback_lock_file(&lock);
-}
-
 int sequencer_continue(struct repository *r, struct replay_opts *opts)
 {
 	struct todo_list todo_list = TODO_LIST_INIT;
@@ -5727,7 +5687,7 @@ int sequencer_continue(struct repository *r, struct replay_opts *opts)
 		struct clean_status_config_digest digest;
 
 		if (!clean_status_config_read_repository(r, &digest))
-			reissue_clean_sidecar_after_rebase(
+			wt_status_reissue_clean_sidecar_after_worktree_update(
 				r, had_full_proof, &digest);
 	}
 release_todo_list:

t/helper/test-mktemp.c

@@ -3,11 +3,28 @@
  */
 #include "test-tool.h"
 #include "git-compat-util.h"
+#include "tempfile.h"
 
 int cmd__mktemp(int argc, const char **argv)
 {
 	char *template;
 	int fd;
+	struct tempfile *tempfile;
+
+	if (argc == 3 && !strcmp(argv[1], "--reopen-write-only")) {
+		tempfile = mks_tempfile_m(argv[2], 0200);
+		if (!tempfile)
+			die_errno("unable to create tempfile");
+		if (close_tempfile_gently(tempfile))
+			die_errno("unable to close tempfile");
+		if (reopen_tempfile_for_readwrite(tempfile) >= 0)
+			die("unexpectedly reopened write-only tempfile for reading");
+		if (reopen_tempfile(tempfile) < 0)
+			die_errno("unable to reopen write-only tempfile");
+		if (delete_tempfile(&tempfile))
+			die_errno("unable to delete tempfile");
+		return 0;
+	}
 
 	if (argc != 2)
 		usage("Expected 1 parameter defining the temporary file template");

t/t0070-fundamental.sh

@@ -21,6 +21,11 @@ test_expect_success POSIXPERM,SANITY 'mktemp to unwritable directory prints file
 	test_grep "cannotwrite/test" err
 '
 
+test_expect_success POSIXPERM,SANITY \
+	'reopen tempfile retains its write-only contract' '
+	test-tool mktemp --reopen-write-only write-only-XXXXXX
+'
+
 test_expect_success 'git_mkstemps_mode does not fail if fd 0 is not open' '
 	git commit --allow-empty -m message <&-
 '