83 changes landed on main

Adds stable hunk-id resolution and partial index staging through grit-lib, exposed as `grit add --hunks` with dry-run and structured output. It also adds compatibility tests, documentation/schema updates, and a daily 50k-line benchmark scenario.

Adds typed, 1-based new-side line-range selection to the library and exposes it through `grit add --lines`, including mixed hunk/range staging and structured JSON output. The final fix makes range validation consume the exact filtered/symlink-aware bytes used by diff construction, eliminating the dangling-symlink regression.

Adds selective commits from stable hunk IDs, line ranges, or unified patch files while preserving unrelated worktree edits. Patch-scoped commits reuse the existing commit pipeline for change IDs, hooks, amend, dry-run, index persistence, and structured output.

Adds selective discard and unstage operations driven by stable diff hunk IDs or line ranges. Worktree restores reverse-apply clean content and smudge it back to disk; staged restores reverse-apply to the index, with dry-run and validation before writes.

Adds selective unstaged hunk/line folding to history fixup and attempts to preserve same-path staged work after the rewrite. The round-two hunk-id fix succeeds, but its line-range complement calculation is incomplete and can erase staged user data after refs move.

Adds selective stash pushes for stable hunk IDs and line ranges while preserving staged index changes and leaving unselected worktree edits in place. Dry-run previews build the same in-memory stash tree without updating refs or files, and all output modes report the selected paths and ranges.

Adds one atomic replay command exposed as both `grit rebase` and `grit history rebase`, sharing the existing history rewrite planner and renderer. It includes stable human/JSON/Markdown output, system-Git compatibility coverage, command documentation and agent-skill guidance, plus daily synth and git.git performance scenarios.

Adds a non-mutating rebase conflict check and selectable conflict favoritism with Git-compatible ours/theirs semantics. The CLI exposes `rebase --check` and `-X`, including structured human/JSON/Markdown results, while the library owns planning and replay behavior.

This makes a conflicted grit rebase a resumable operation instead of atomically abandoning it. Users and agents can inspect the paused operation in status, resolve and continue it, skip the stopped commit, or abort back to the original branch tip, with equivalent human, JSON, and Markdown guidance.

Adds library and CLI support for running repeatable shell commands against each rewritten rebase commit before the atomic ref update. It also adds rebase documentation, JSON schemas, integration tests, and daily benchmark scenarios, but the reviewed tip does not contain the reported round-two safety fixes.

Adds library-level contains, no-contains, merged, no-merged, and points-at filters for ref queries, including annotated-tag peeling and batched shared-history traversal. It removes old porcelain tag helpers, adds Git-oracle compatibility coverage and Criterion benches, and wires daily benchmark scenarios and baselines.

Adds a library-first tag listing API that filters by reachability and target, sorts by version/date/name, and returns structured annotation metadata. The CLI exposes those capabilities with bounded list output and stable human/JSON/Markdown rendering, while the daily benchmark matrix gains realistic git.git tag scenarios.

Adds a library-first branch inventory/query API and exposes modern branch-list filters plus rich JSON and Markdown output through the thin CLI. The review fixes make upstream display refspec-aware, keep local/remote identities distinct, escape Markdown cells, and lock the generated skill output to its current contract.

Adds typed merge policies and commit modes to grit-lib, wiring fast-forward-only, forced merge commits, squash, no-commit, and message input through the modern CLI. It also adds structured JSON/Markdown outcomes, pending commit-message lookup, compatibility tests, and command documentation.

Adds a typed merge-options API and thin CLI flags for fast-forward policy, squash/no-commit behavior, ours/theirs favoring, conflict-marker style, and unrelated histories. It also makes squash conflict state interoperable and recoverable, preserves custom pending messages, and refreshes the generated agent skill snapshot.

Adds a library replay-sequence engine with Git-compatible stop/resume files and exposes multi-commit/range pick, continuation actions, origin trailers, no-commit, empty policies, structured output, docs, tests, examples, and a benchmark. The core happy paths work, but several recovery and state contracts are incorrect.

Adds in-memory sequence prediction for pick and revert, then exposes it through `--check` with shared merge favor/conflict-style controls and stable human, JSON, and Markdown results. The round-3 correction advances a synthetic HEAD after clean and kept-empty steps so later sources are evaluated against the same evolving history as real replay.

Adds a benchmark group and campaign rows for clean merge, conflict resolution and continue, a 20-commit pick, and single/mainline revert workflows. Round 3 separates clean and conflicting campaign topology and adds executable coverage proving every row completes with grit and system git.

Adds explicit signed tree-sha256 tag creation and a benchmark suite that measures digest verification, signed creation, and signed verification on git.git- and Chromium-shaped repositories, with optional Linux and reference-tool rows. The round-6 corrections keep preparation out of timed verify commands, preserve tagger metadata, and include submodules in the git-only oracle.

Adds a typed reflog committer signature view in grit-lib and exposes old/new object IDs, offset-preserving RFC 3339 dates, and structured committers in `grit reflog --json` while retaining v1 fields. Round 2 updates the generated skill snapshot to match the newly documented reflog workflow.

Adds typed ignore-revision loading to the blame library and exposes it through repeatable CLI flags and config. Blame output now carries ignored/unblamable attribution markers in human, JSON, and Markdown formats, with system-Git parity coverage.

Shortlog target selection and ahead-walking now live behind a typed `grit-lib` API. The CLI exposes explicit `--target`, adds `grit ahead`, preserves JSON shape, and the campaign matrix measures the new path with an executable scenario.

Adds a test-only CLI contract that classifies every current leaf command and checks shared limit, dry-run, message, pathspec, and force conventions. Adds the corresponding conventions page and links it from the scripting and automation documentation without changing command behavior.

Completes the published JSON-schema index and enforces that every committed schema and every registry command stays covered by a validated CLI snapshot. The round-2 correction replaces invented structured-error fixtures with four real failing command scenarios, preserving coverage while tying goldens to actual rendering and exit behavior.

Merge can now preview up-to-date, fast-forward, merge-commit, and conflict outcomes without mutating repository state. Notes add/remove similarly expose library plans and CLI dry-run reports while preserving existing real-operation human output.

This change replaces stringly JSON error kinds with a serialized enum and routes CLI outcomes through one typed exit-status table and one process-exit site. It also documents the complete exit-code contract and fixes Markdown hunk errors to use the structured stdout renderer.

This standardizes bounded list options around `-n/--limit` across log, revisions, branches, tags, notes, bundles, and hooks, while retaining visible `--max-count` aliases where expected. Limits are represented in grit-lib for notes, bundles, and hooks, and affected JSON list responses expose `truncated`.

Adds a structural compatibility gate for versioned CLI JSON schemas and refuses destructive updates to a frozen contract. Round 3 makes union matching order-independent and closes numeric and additionalProperties false negatives identified in the prior review.

Adds a typed library operation for changing fetch or push remote URLs and exposes raw plus effective remote metadata. The thin CLI adds `remote set-url`, structured JSON, and effective two-line verbose listings while retaining the existing `url` field.

Adds typed blob filters to library fetch/clone, negotiates them over supported Git protocols, marks received packs as promisor packs, persists partial-clone configuration, and reapplies stored filters on later fetches. The round-3 fix extends promisor-aware fsck to index entries, including indexes populated from a blobless tree.

Adds bounded shallow cloning and branch-or-tag selection to the linkable clone API and modern CLI. Branch selection creates and configures a local tracking branch; tag selection peels the tag and leaves HEAD detached, with typed outcomes and stable structured output.

Adds a library-first remote removal operation and exposes it as `grit remote remove`, including dry-run and stable human, JSON, and Markdown output. Removal cleans config, branch tracking, remote refs, and reflogs while preserving refs shared by another remote's fetch mapping.

Adds a library-first remote inspection API and exposes it as `grit remote show`, with bounded human, Markdown, and stable JSON output. It reports rewritten fetch/push URLs, advertised or local HEAD, tracked/new/stale branch state, and branch pull configuration.

Adds configurable initial branches, separate Git directories, and SHA-256 repository initialization through a library-first API and thin CLI flags. Reinitialization now reports and preserves the actual existing HEAD/layout/object format, including SHA-256, gitfiles, and detached HEADs.

Adds path-limited stash creation that preserves unrelated staged and unstaged work, including matching untracked files, and adds index restoration to stash apply/pop. The CLI exposes shared pathspec inputs and `--index`, with stable JSON fields, docs, schemas, and Git-interoperability coverage.

Adds a non-destructive reset preview, Git-compatible keep resets, and bounded reporting of commits that a reset would make unreachable. The round-three correction ensures keep dry-runs enumerate both dirty tracked paths and colliding untracked paths together, without changing apply behavior.

Adds library-first dry-run and selection behavior for rm, batched multi-source mv with structured outcomes, and clean scope/exclude/files-only filtering, then exposes these through thin CLI flags and versioned JSON. Round-two and round-three commits add Git-compat clean cases and forced-move rollback machinery, but one rollback-failure path still destroys source bytes.

Worktree listing now identifies the repository’s current worktree and exposes complete lock/prune metadata through the public library API and every CLI output mode. The round-three fix removes the prior list hot-path regression by retaining the old marker/existence checks and parsing gitdir metadata only for missing worktrees.

Adds typed stash push modes for saving only staged changes or keeping the index, plus a side-effect-free preview API and CLI dry-run output. It exposes the modes through the modern CLI, updates stable JSON schemas/docs, and cross-checks stash trees and post-push state against system Git.

Adds typed config locations and library-owned read/write helpers, exposes winning config values with scope/file/line origin, and wires `grit config --local` plus `-f/--file`. It also publishes config v2 JSON where missing keys return `value: null` with exit 1 and updates CLI documentation and snapshots.

This change makes branch tracking build the upstream's hidden ancestor region once and use constant-time membership checks while walking local commits. It also adds a deep-history regression that calls the exact ahead/behind API used by status and bounds parent lookups.

Commit message validation is made side-effect free by removing CLI-side auto-staging from the missing-message error path. Successful default commits retain their existing behavior because staging remains owned by grit-lib's `commit_with_scope` / `commit_worktree` path.

Date parsing now uses the existing Git-compatible approxidate engine when strict parsing cannot interpret a value. This makes log cutoffs and commit author-date overrides accept everyday forms such as date-only values, “yesterday,” dotted relative dates, slash dates, and month-name dates while preserving strict and raw-epoch behavior.

Adds bounded local/remote/all branch discovery to `grit branch`, with stable JSON metadata and matching human/Markdown output. The review fixes also correct scope-specific empty states and prevent the expanded clap tree from overflowing default test-thread stacks.

Dry-run fetches now end with a truthful pending-update summary instead of saying the remote is already up to date. The correction covers normal, Markdown, and multi-remote rendering while preserving JSON’s distinction between refs written (`updated`) and proposed updates.

This adjusts clap parsing so quoted commit messages beginning with `-` are accepted through both positional and `-m` forms. It extends the convention across other user-authored message, author, trailer, message-file, and pathspec-file inputs, with focused CLI regression coverage and a commit documentation note.

This change makes local clone and fetch summaries describe only the objects and bytes installed by that operation. It handles mixed linked-pack plus newly packed transfers while preserving null object-type reporting when a linked pack contains more objects than the individually tracked set.

Detached HEAD commits and amendments now advance only HEAD while leaving branch tips unchanged. The CLI reports `detached HEAD`, dry-run amend reuses the current subject, and both files and reftable ref backends follow the corrected path.

Normal status now reports ignored directories nested under untracked parents as one directory entry rather than every ignored file. The round-2 adjustment preserves full path enumeration specifically for UNTR check-only cache probes, avoiding the cache-reuse regression identified in the first review.

Adds a single `--all` path for creating a complete repository bundle. The library writes HEAD and every ref under `refs/` into the bundle header, while the CLI remains a thin argument-forwarding layer.

Improves blame’s hot path by caching path/blob results across Bloom-filter skips, fast-forwarding unchanged first-parent history, and avoiding unnecessary middle diffs when a requested range lies wholly in an unchanged affix. The round-2 fix removes an unsafe focused sub-window optimization that could misattribute equal-length shifted edits, while adding deterministic Bloom and system-git compatibility coverage plus a cargo-shaped benchmark scenario.

This change reduces redundant metadata work in Windows dense worktree scans while preserving files that directory enumeration found but an indexed-path probe could not resolve. It adds a no-op add benchmark scenario and regression/performance coverage for the 50k-file layout.

This change keeps dense path-history walks from accumulating inflated/parsed tree bodies while retaining bounded component lookup memoization. It also restores decoded commit subjects during commit-graph population and adds daily no-commit-graph git.git scenarios so the remaining path-walk gap stays visible.

Adds stable, typed hunk identifiers to grit-lib and emits them for staged/unstaged JSON patch output. The review fixes constrain opposite-side peer work to JSON, matching paths, and available worktrees while preserving human diff behavior.

Removes orphaned grit-lib APIs and test instrumentation across fetch, pack/ODB, worktree, porcelain, revwalk, cache, and fixture code. The only runtime edit collapses a never-used polymorphic fetch sink to the TempPackReceive implementation it always constructed; the net diff is 14 additions and 654 deletions.

Updates the rebase-session integration test to construct the current ApplyOptions shape and removes one unused test binding. This restores compilation of the workspace test targets without changing production behavior.

Removes an invalid rustdoc field link from the `HunkSelectError::StaleId` documentation and keeps the same meaning as plain prose. This is a documentation-only CI repair with no runtime or API behavior change.

Records the complete generated public API surface of `BundleCreateOptions`, including its constructor and derived trait implementations. This is snapshot metadata only; runtime library and CLI behavior are unchanged.

Expands GitHub-hosted runner cleanup and reduces debug-test artifact size so large workspace test links do not exhaust disk. The change is confined to CI workflow configuration and the runner cleanup script.

Partial commits now validate many path arguments with cheap worktree stats and at most one shared index/HEAD scan. Their temporary HEAD-derived index reuses safe stat data and a primed cache-tree, so unchanged files are not rehashed and unaffected directories are not rebuilt.

Push argument classification, destination opening, and advertisement-derived planning now live in grit-lib, leaving the CLI as wiring and rendering. Literal path/URL destinations and configured push URLs are planned from the actual push destination, and local sends reuse those advertised tips so the correctness fix does not duplicate a full ref scan.

This consolidates annotated-tag peeling behind Odb APIs and routes revision tips, show, commit-graph reachability, bitmap writing, index tree resolution, ref listing, and local remote advertisement through them. The round-2 amendment deduplicates repeated raw ref and reflog object IDs before peeling, removing the only measured regression while preserving post-peel commit deduplication and sorted output.

This change prevents a message-less `grit commit` from staging worktree changes before reporting its validation error. It also tightens the local-branch JSON regression test to enforce omission of the false `is_remote` field.

This change avoids materializing and re-peeling packed refs that cannot decorate the requested log page, cheaply rejects ordinary revision names before compiling the describe regex, and buffers non-interactive CLI output. It retains strict packed-refs parsing and adds Git-backed coverage for all packed-refs peel-header variants.

Removes the dormant core.whitespace parsing/check/fix engine while keeping the two ASCII whitespace predicates used by diff. It also removes only the corresponding public-surface snapshot entries and API coverage tests, replacing coverage for the retained helpers.

This change removes the staged-diff regression by making wide cache-tree lookup near-linear, releasing index memory before patch construction, avoiding unnecessary copies, and loading changed blobs in parallel. It also adds compatibility and Criterion coverage and fixes benchmark reports so they identify the commit that produced the timed grit binary.

Bundle opening now parses only the textual header through a 64 KiB buffered reader and records the embedded pack offset without loading the pack. This removes a 22 MB read from verify and every other Bundle::open caller while preserving the public API and pack handling behavior.

Replay startup now rejects an invalid first pick/revert step before creating sequencer state. If another first-step apply error occurs before any commit advances HEAD, the startup path removes the just-created replay files, and the compatibility test now locks in that cleanup.

Replaces message-text inspection in mailmap loading, config discovery, branch compare-and-swap, and tree-path diagnosis with typed data and existing typed error variants. It also removes the unused public raw-mailmap loader, updates warning rendering and rustdoc, and adds regression tests for non-blob mailmaps and stale branch tips.

This change restores uniqueness in the daily benchmark registry. It removes duplicated add scenario descriptors and assigns the non-headline merged-ref query a distinct ID while preserving the existing headline row.

Adds reliable `history fixup` selection by hunk or line range while preserving pre-existing staged and nearby unselected worktree edits. The round-3 correction fixes inverse-patch construction when selected and unselected replacements share one structured hunk, and keeps restoration failure-safe after refs move.

Fsck findings now describe their object, location, and detail through one grit-lib implementation. The CLI only maps those typed values into output, while the legacy maintenance wrapper reuses the same severity and line mapping instead of maintaining copies.

This change removes duplicate merge-conflict recovery guidance, refreshes the generated skill snapshot, and documents the uniquely named merged-ref benchmark scenario. The focused changes are already present on current main as clean rebased commits and remain correct under round-two verification.

Corrects the history conflict regression fixture so the commit being rewritten remains non-empty. That lets descendant replay execute and verifies the intended typed Conflict error includes conflict.txt, instead of aborting earlier with BecameEmpty.

This change removes repeated object reads from tag listing, reuses per-thread loose-object inflate scratch, narrows filtered pack lookup passes, and replaces a BTreeMap collection path with a sorted Vec. It substantially accelerates tag listing and other many-ref reads, but currently trusts packed peel data too far when the source tag object is missing.

This follow-up persists replay checkpoints and source/created-record pairing across multi-commit pick sequences, sanitizes continued conflict messages, fixes no-commit empty comparisons, and reduces allocations in replay index/worktree handling. The correctness work is validated, but the performance acceptance criterion is still not achieved.

Removes a signed-push certificate module that no transport uses, drops unused pack.islandCore bookkeeping, and deletes bitmap-config helper gates that no pack path calls. The reachable delta-island and pack bitmap behavior is unchanged, while grit-lib loses 388 source/test lines plus 44 public-API snapshot lines.

On a failed `rebase --exec`, grit now restores every tracked path to the saved pre-rebase HEAD tree, including files the command dirtied whose blob did not otherwise change during replay. Regression coverage exercises the real shell runner and the CLI, and also locks in single-emission error reporting.

This branch adds guarded fast paths for one-tip bounded revision pages, retains parsed commits for revs JSON rendering, and restores encoding-aware lazy subject extraction. It also strengthens regressions for encoded subjects, merge and non-commit tips, disconnected merge-base histories, and truly missing commit-graph fallback.

This change preserves a split commit whose tree intentionally matches the newly inserted parent, fixing partial file-to-directory splits. It scopes that exception to SplitBefore and updates the checked-in public API inventory.

This changes the history rewrite merge-call instrumentation from one process-wide atomic counter to one counter per test thread. Parallel tests can no longer alter another test’s measurement, while production history planning remains unchanged.

Large index files are now read through a short-lived mmap, and indexes over 256 KiB overlap trailer hashing with parsing while preserving checksum-first error precedence. The default worktree diff also reuses one loaded index and one WorktreeRules instance for entry detection and content rendering instead of loading both twice.

Adds explicit hygiene reasons to two existing history thread-local blocks. This restores the coverage ratchet under `unstable-bench-helpers` while leaving compiled behavior unchanged.