status: preserve authenticated proofs across owned index writes

b65fc91 (status: retain the identity of an index it rewrites,
2026-08-17) lets status keep a race-proof receipt for an index it
rewrites. Receipt preparation duplicates the writer descriptor so it can
hash the final bytes, and requires the in-memory checksum to match the
configured null trailer.

Two owned write paths can leave an otherwise valid index without a
usable clean proof. A worktree-update repair first writes a checksummed
provisional index, then reopens the lockfile write-only before the final
skipHash write while the index still records the provisional checksum.
Receipt preparation rejects both states, so scoped stash cannot publish
a sidecar for the index it installs.

Similarly, worktree add creates its linked index before the new worktree
has a closed FSMonitor provider epoch. The index has FSMonitor and
untracked-cache extensions, but lacks the authenticated clean-config
proof. Later read-only status processes remain correct, but cannot
persist that proof and repeat the full fallback on every invocation.

Reopen tempfiles read-write on macOS so receipt preparation can read the
final index, and finish provisional writes through a cold helper that
restores the null object ID before the receipt-aware write. After
worktree add checks out a worktree with FSMonitor and the untracked
cache, run one silent status with optional locks enabled to establish
the provider epoch and persist the complete proof. Proof priming is
best-effort; ordinary worktree creation and the status hot path are
unchanged.

Cover receipt publication and adoption after scoped stash, and require a
new linked worktree to have a complete proof before its first read-only
status. The latter must leave the index byte-identical and avoid a
manifest scan.

Author: ttaylorr-oai

Makefile

@@ -2580,6 +2580,8 @@ LIBS = $(filter-out %.o, $(GITLIBS)) $(EXTLIBS)
 
 BASIC_CFLAGS += $(COMPAT_CFLAGS)
 LIB_OBJS += $(COMPAT_OBJS)
+# Keep provisional-index glue after every existing library object.
+LIB_OBJS += clean-status-index-provisional.o
 
 # Quote for C
 

builtin/worktree.c

@@ -9,6 +9,7 @@
 #include "copy.h"
 #include "dir.h"
 #include "environment.h"
+#include "fsmonitor-settings.h"
 #include "gettext.h"
 #include "hex.h"
 #include "object-file.h"
@@ -21,12 +22,14 @@
 #include "refs.h"
 #include "remote.h"
 #include "run-command.h"
+#include "repo-settings.h"
 #include "hook.h"
 #include "sigchain.h"
 #include "submodule.h"
 #include "utf8.h"
 #include "worktree.h"
 #include "quote.h"
+#include "trace2.h"
 
 #define BUILTIN_WORKTREE_ADD_USAGE \
 	N_("git worktree add [-f] [--detach] [--checkout] [--lock [--reason <string>]]\n" \
@@ -409,6 +412,32 @@ static int checkout_worktree(const struct add_opts *opts,
 	return run_command(&cp);
 }
 
+static void prime_worktree_clean_status_proof(const char *path)
+{
+	struct child_process cp = CHILD_PROCESS_INIT;
+	int ret;
+
+	/*
+	 * The checkout creates the linked index before it has a provider epoch
+	 * from which to certify the worktree.  Establish that epoch while this
+	 * writer can still update the index; a later read-only status cannot
+	 * persist the missing proof.
+	 */
+	cp.git_cmd = 1;
+	cp.dir = path;
+	cp.no_stdin = 1;
+	cp.no_stdout = 1;
+	cp.no_stderr = 1;
+	strvec_pushl(&cp.args, "status", "--porcelain=v2",
+		      "--untracked-files=normal", NULL);
+	strvec_push(&cp.env, GIT_DIR_ENVIRONMENT);
+	strvec_push(&cp.env, GIT_WORK_TREE_ENVIRONMENT);
+	strvec_push(&cp.env, "GIT_OPTIONAL_LOCKS=1");
+	ret = run_command(&cp);
+	trace2_data_intmax("worktree", the_repository,
+			   "add/clean-status-primed", !ret);
+}
+
 static int make_worktree_orphan(const char * ref, const struct add_opts *opts,
 				struct strvec *child_env)
 {
@@ -593,6 +622,15 @@ static int add_worktree(const char *path, const char *refname,
 	if (opts->checkout &&
 	    (ret = checkout_worktree(opts, &child_env)))
 		goto done;
+	if (opts->checkout &&
+	    fsm_settings__get_mode(the_repository) == FSMONITOR_MODE_IPC &&
+	    the_repository->settings.core_untracked_cache ==
+		UNTRACKED_CACHE_WRITE &&
+	    !getenv(INDEX_ENVIRONMENT) &&
+	    !getenv(GIT_COMMON_DIR_ENVIRONMENT) &&
+	    !getenv(DB_ENVIRONMENT) &&
+	    !getenv(ALTERNATE_DB_ENVIRONMENT))
+		prime_worktree_clean_status_proof(path);
 
 	is_junk = 0;
 	FREE_AND_NULL(junk_work_tree);

clean-status-index-provisional.c

@@ -0,0 +1,16 @@
+#include "git-compat-util.h"
+#include "clean-status-index.h"
+#include "lockfile.h"
+#include "read-cache-ll.h"
+#include "repository.h"
+
+int clean_status_write_index_after_provisional(
+	struct index_state *istate, struct lock_file *lock, unsigned flags,
+	struct clean_status_index_write_receipt *receipt)
+{
+	/* Let receipt preparation authenticate the final null trailer. */
+	if (istate->repo->settings.index_skip_hash)
+		oidcpy(&istate->oid, istate->repo->hash_algo->null_oid);
+	return write_locked_index_with_receipt(
+		istate, lock, flags, receipt);
+}

clean-status-index.h

@@ -5,6 +5,7 @@
 #include "hash.h"
 
 struct index_state;
+struct lock_file;
 struct repository;
 
 /*
@@ -52,6 +53,11 @@ int clean_status_index_adopt_write_receipt(
 void clean_status_index_write_receipt_release(
 	struct clean_status_index_write_receipt *receipt);
 
+/* Finish a provisional write without widening the ordinary status hot path. */
+int clean_status_write_index_after_provisional(
+	struct index_state *istate, struct lock_file *lock, unsigned flags,
+	struct clean_status_index_write_receipt *receipt);
+
 int clean_status_index_snapshot_open(
 	struct clean_status_index_snapshot *snapshot, const char *path,
 	const struct git_hash_algo *algo);

meson.build

@@ -340,6 +340,7 @@ libgit_sources = [
   'clean-status-history.c',
   'clean-status-identity.c',
   'clean-status-index.c',
+  'clean-status-index-provisional.c',
   'clean-status-manifest.c',
   'clean-status-sidecar.c',
   'clean-status-fast.c',

t/t7519-status-fsmonitor.sh

@@ -8164,6 +8164,42 @@ test_expect_success LINUX_SCOPED_HISTORY,UNTRACKED_CACHE,SEMANTIC_VERIFY_ANCHORE
 	)
 '
 
+test_expect_success MACOS,FSMONITOR_DAEMON,UNTRACKED_CACHE,SEMANTIC_VERIFY_ANCHORED_OPEN,PERL_TEST_HELPERS \
+	'worktree add primes a read-only clean status proof' '
+	test_when_finished "rm -rf worktree-add-proof worktree-add-proof-linked" &&
+	test_when_finished \
+		"git -C worktree-add-proof-linked fsmonitor--daemon stop 2>/dev/null || :" &&
+	test_create_repo worktree-add-proof &&
+	(
+		cd worktree-add-proof &&
+		sane_unset GIT_TEST_SPLIT_INDEX &&
+		test_write_lines tracked >tracked &&
+		git add tracked &&
+		git commit -qm base &&
+		git config core.fsmonitor true &&
+		git config core.untrackedCache true &&
+		GIT_TRACE2_EVENT="$PWD/.git/worktree-add.trace" \
+			git worktree add --detach \
+				../worktree-add-proof-linked HEAD &&
+		worktree="$PWD/../worktree-add-proof-linked" &&
+		gitdir=$(git -C "$worktree" rev-parse --absolute-git-dir) &&
+		test_trace2_data worktree add/clean-status-primed 1 \
+			<.git/worktree-add.trace &&
+		test_fsmonitor_full_proof "$gitdir/index" paired &&
+		cp "$gitdir/index" "$gitdir/before.index" &&
+		GIT_OPTIONAL_LOCKS=0 \
+		GIT_TRACE2_EVENT="$gitdir/status.trace" \
+			git -C "$worktree" status --porcelain=v2 \
+				>"$gitdir/status.actual" &&
+		test_must_be_empty "$gitdir/status.actual" &&
+		test_cmp_bin "$gitdir/before.index" "$gitdir/index" &&
+		test_trace2_data fsmonitor config/coherent 1 \
+			<"$gitdir/status.trace" &&
+		! test_trace2_data fsmonitor semantic/manifest-scan-count 1 \
+			<"$gitdir/status.trace"
+	)
+'
+
 test_expect_success UNTRACKED_CACHE,SEMANTIC_VERIFY_ANCHORED_OPEN \
 	'repeated provider resets fall back before an unclosable rescan' '
 	test_when_finished "rm -rf builtin-closure-terminal-reset" &&

t/t7530-status-clean-sidecar.sh

@@ -3632,16 +3632,23 @@ test_expect_success PERL_TEST_HELPERS \
 '
 
 test_expect_success DURABLE_FSMONITOR \
-	'scoped stash publishes a sidecar for its final clean index' '
+	'scoped stash authenticates its final skipHash index' '
 	test_when_finished "stop_daemon sidecar-scoped-stash" &&
 	setup_repo sidecar-scoped-stash &&
 	git -C sidecar-scoped-stash config core.autocrlf false &&
+	git -C sidecar-scoped-stash config feature.manyFiles true &&
 	issue_sidecar sidecar-scoped-stash &&
 	assert_clean_sidecar_hit sidecar-scoped-stash \
 		sidecar-scoped-stash scoped-stash-before &&
 	test_write_lines changed >sidecar-scoped-stash/tracked &&
 	GIT_TRACE2_EVENT="$PWD/scoped-stash.trace" \
 		git -C sidecar-scoped-stash stash push -q -- tracked &&
+	test_trace2_data fsmonitor history/own-write-source-recorded 1 \
+		<scoped-stash.trace &&
+	test_trace2_data fsmonitor history/own-write-source-adopted 1 \
+		<scoped-stash.trace &&
+	test_trace2_data status clean-proof/writer-sidecar 1 \
+		<scoped-stash.trace &&
 	test_path_is_file sidecar-scoped-stash/.git/index.csts &&
 	assert_clean_sidecar_hit sidecar-scoped-stash \
 		sidecar-scoped-stash scoped-stash-after

tempfile.c

@@ -328,7 +328,11 @@ int reopen_tempfile(struct tempfile *tempfile)
 		BUG("reopen_tempfile called for an inactive object");
 	if (0 <= tempfile->fd)
 		BUG("reopen_tempfile called for an open object");
+#ifdef __APPLE__
+	tempfile->fd = open(tempfile->filename.buf, O_RDWR|O_TRUNC);
+#else
 	tempfile->fd = open(tempfile->filename.buf, O_WRONLY|O_TRUNC);
+#endif
 	return tempfile->fd;
 }
 

wt-status.c

@@ -2769,7 +2769,7 @@ int wt_status_repair_fsmonitor_proof_after_update_with_sidecar(
 
 	if (repaired <= 0)
 		return repaired;
-	if (write_locked_index_with_receipt(
+	if (clean_status_write_index_after_provisional(
 		    repo->index, lock, COMMIT_LOCK | SKIP_IF_UNCHANGED,
 		    &written_index)) {
 		clean_status_index_write_receipt_release(&written_index);