49 changes landed on main

Adds non-mutating plans for bundle creation and unbundling, exposes dry-run behavior across every GC maintenance subcommand, and previews auth logout without erasing a credential. Human, JSON, and Markdown output plus schemas, docs, public API coverage, and compatibility tests are updated together.

This change gives every command page an explicit exit-status contract and validates documented JSON examples against the committed command schemas. It also enforces real Markdown examples and preserves schema-selecting flags while mapping documented command lines to schemas.

Adds six daily common-path benchmark rows covering diff stats, log stats, JSON filtering, notes listing, and shallow clone over file and HTTP. The benchmark harness records dist-profile wall time and peak RSS and now rejects semantically wrong output, including full clones masquerading as shallow clones.

This change gives commit, merge, pick, revert, annotated tag, notes add, and history message edits one `-m`/`-F` input contract, with shared author parsing where supported. Message cleanup is centralized in grit-lib, while file/stdin reading remains in the CLI, and round 2 restores the positional commit-message conflict that had silently discarded `-m`.

Diff, show, log, and revs now share the trailing pathspec argument group, including file and NUL-delimited inputs. The old log cursor interpretation through --before is gone, while bare-repository and range-diff routing regressions from earlier rounds are fixed.

Rewrites the embedded `grit skill` guidance around five copyable, CI-executed workflows and validates every documented command and flag against clap. The round-2 safety fix makes stale force-with-lease recovery reconcile the newly fetched upstream before retrying and teaches rebase planning to fast-forward a branch that is strictly behind upstream.

Adds typed reflog querying by count, entry timestamp, and message, plus best-effort action extraction and additive JSON metadata. Round 2 fixes zero-count behavior, JSON schema/API snapshots, malformed-line numbering, and removes parsed full-entry materialization, but the loose-file path still allocates the entire reflog.

Adds ref-name resolution as a public library capability and exposes it through modern resolve output modes. Human output can print either the shortest unambiguous or full symbolic ref, while JSON consistently carries short, full, and selected display forms.

Blame results now retain each line’s path in its originating commit and can group adjacent attributions into Git-compatible hunks. JSON callers can opt into compact `hunks[]` output with `--group`, while default JSON and human/Markdown presentation remain line-oriented.

Adds bounded reflog discovery and non-mutating expiry previews to the modern CLI while exposing typed per-ref expiry results from grit-lib. The round-three fixes keep documented result ordering deterministic and refresh the generated grit skill snapshot.

Adds a public library parser/resolver for Git-style blame line ranges, including numeric, relative, BRE, and function-name forms, and resolves them once against the starting blob. The CLI gains an optional positional revision with explicit `--` disambiguation while remaining a thin caller of grit-lib.

Adds strict single-object verification to the library and exposes it through `grit resolve --verify`, with output-free `--quiet` yes/no behavior. It also completes ref-name resolution modes, including detached/unborn HEAD and ambiguous-name handling, with compatibility tests, docs, schemas, snapshots, and benchmark matrix coverage.

Adds bounded ahead/behind commit comparison to grit-lib and exposes shortlog limits, behind listings, stats, and changed-file output through the modern CLI. The follow-up fix restores human log stats and shares Markdown per-commit diff rendering across log and shortlog; round three cleanly rewrites the feature commit message identity without changing the verified behavior.

Blame can now ignore all Git whitespace through the public `BlameOptions` API and `grit blame -w/--ignore-all-space`. Attribution compares normalized line keys but retains original text for output and indentation scoring, including whitespace-aware change compaction across Myers, patience, and histogram algorithms.

Adds typed blame copy-detection levels to the linkable library and exposes repeatable `-C` in the modern CLI. Attribution now matches Git for modified-file copies, creation-time copies, older-source copies, and original paths across one- and two-hop renames.

Adds typed linked-worktree branch selection and exposes force-reset, early locking with reasons, no-checkout, remote tracking, and prune dry-run through the library-first API and thin CLI. The round-two fixes resolve existing branches from their own tip, validate checkout exclusivity before ref writes, roll back later branch mutations on failure, and make implicit-HEAD tracking non-fatal.

Adds a complete modern stash inspection/branch/clear surface backed by grit-lib: optional untracked-file display, branch creation from a stash base with index restoration, and force-gated clearing. Round-2 corrections close the no-reflog deletion edge case and a subtle Git parity gap where an untracked parent path overlaps the base tree, while synchronizing schemas and generated skill output.

Adds eight daily benchmark comparisons for common workspace operations and makes the executable daily matrix discoverable with `grit-bench daily --list`. It also corrects reset/keep’s fixture so the timed operation preserves a real unrelated tracked edit, and records the smoke baseline in the docs benchmark inventory.

Adds advanced, scoped configuration operations to grit-lib and exposes them through the thin `grit config` command: system/worktree scopes, typed values, multi-value actions, section operations, prefix listing, defaults, and dry-run previews. Round-3 fixes align worktree reads with Git's extension gate and reject inapplicable CLI flag combinations instead of silently ignoring them.

Adds linked-worktree move and repair to grit-lib, thin CLI commands with human/JSON/Markdown output, schemas, docs, and system-Git compatibility coverage. Follow-up commits fix destination handling and preserve symlinks during Unix cross-device copy, but the attempted Windows directory-link fix still selects the wrong symlink API.

Adds deliberate clone controls for branch scope, tag handling, and custom remote names across grit-lib and the thin CLI. Round 3 synchronizes the generated skill snapshot with the already-reviewed command documentation, resolving the previous review failure.

Adds repository-scoped, on-demand retrieval of objects promised by partial clones and batches missing checkout blobs into one fetch. The CLI installs the default fetcher so diff, show, switch, restore, and clone checkout transparently work in blobless repositories, while ordinary repositories retain their inline ODB read fast path.

Adds a library-first remote rename operation that moves remote-tracking refs in one transaction, preserves reflogs and symrefs, then updates local configuration. Exposes it through `grit remote rename` with human, JSON, and Markdown output, compatibility coverage, schemas/docs, and a many-ref benchmark scenario.

Clone now supports bare repositories and fetch-without-checkout while making grit-lib responsible for normal worktree population and checkout statistics. The round-3 fixes preserve typed hostile-path rejection at the new clone boundary and ensure checkout obeys the caller's thread policy.

Adds modern remote maintenance operations: prune stale tracking refs with dry-run, manage a remote HEAD automatically/by branch/by deletion, and optionally fetch when adding a remote. The round-three update refreshes generated skill output after prior fixes aligned negative refspec pruning, dangling HEAD deletion, and set-head usage reporting with expected behavior.

Adds `grit clone --blobs none|SIZE` as a Git-compatible promisor partial clone with stable JSON fields and distinct human wording for blobless versus size-limited clones. It also adds system-git round trips, documentation, and a daily git.git comparison whose correctness and timing path now uses the intended sidecar destination.

Adds a generated performance overview to the documentation site, backed by committed daily benchmark reports and the command-area matrix. The stacked benchmark work captures and compares stable daily time/RSS rows, while the round-3 fix refreshes the two stale CLI snapshots and cleans commit metadata.

This changes the Windows tracked-file scan to consume metadata already returned by directory enumeration instead of opening every listed path again. A fallback path stat remains for names absent from the listing, directory-entry errors, and directory-stat/index disagreement.

Blame now respects Git's compacted diff boundaries for ambiguous equal-text moves instead of relocating inserted lines deep into history. The review follow-up preserves the existing `-CCC` copy-source path by attempting copy attribution before the new xdiff hard stop.

This change makes checkout find nested `.gitattributes` entries using Git's slash-separated index paths, preventing binary files from being CRLF-smudged under `core.autocrlf=true`. It also preserves the checkout fast path when attributes do not change and adds clone-populate, bulk, and switch compatibility coverage.

This change stops merge and replay machinery from writing an empty tree merely to obtain its object ID. It makes the virtual empty-tree object readable for both SHA-1 and SHA-256 repositories, preserving clean object stores while retaining normal materialization when an empty tree is actually persisted.

Absent remote delete targets now become a typed library rejection rather than an up-to-date success. The CLI renders that rejection in all output modes, exits 1, and short names resolve to a surviving local tag when the remote tag is already gone.

Routes simple log walks with limits through the resumable bounded walker so a recent `--since` window stops at its date frontier instead of scanning all reachable history. The follow-up preserves one-shot `-n` JSON semantics and prevents a continuation cursor when every pending commit is below the since cutoff.

User-facing repository and checked-out-branch errors now strip Windows extended-length path prefixes and render slash-normalized paths. Deleting HEAD's branch gets a dedicated typed error and clearer wording instead of pretending the branch is checked out in another worktree.

Windows directory-grouped worktree scans use metadata from the matched directory entry first, avoiding an unconditional second path stat for every indexed file. A gated 49,152-file nested fixture covers clean staging, 100-file diff, and no-op add probe budgets.

This standardizes identity dates emitted by commit and tag-list JSON on the same RFC 3339 Person shape already used by log and show. Tag JSON advances to v2 while preserving frozen v1, and documentation, schemas, skill snapshots, and regression coverage move together.

This change stops Windows switch/checkout from creating worker pools unless `checkout.workers` is explicitly configured, while preserving Git-compatible explicit zero as automatic CPU selection. It also restores the normal checkout threshold and carries small post-rebase fixes needed for the current main test expectations.

This change prevents default auto-stage commits from collapsing unmerged index entries while parseable conflict markers remain. The round-3 update restricts marker-byte reads to regular files so symlink and gitlink resolutions continue through their existing staging paths.

Unresolved merge markers can no longer be silently staged by explicit `grit add`, falsely advertised by `--dry-run`, or collapsed by commit auto-staging. Marker detection respects each path’s `conflict-marker-size` attribute and leaves symlink/gitlink handling unchanged.

Restores CI bookkeeping and CLI wiring after remote-remove and list-limit work landed incompletely. It indexes the remote-remove schema/snapshot, registers canonical modules and the missing benchmark scenario count, and makes hooks/notes limits parse and dispatch correctly at both accepted command positions.

Adds scoped config locations and origin metadata to grit-lib, exposes them through grit config --local/-f and structured outputs, and returns a JSON null with exit 1 for missing keys. The follow-up hot path preserves existing human performance, honors GIT_DIR for get/set/unset, propagates the shared process environment, and rejects invalid --unset key value invocations before mutation.

Adds bounded, filterable reflog queries to grit-lib and exposes them through the modern grit reflog command, including stable action metadata and truncation reporting. The follow-up fixes ensure malformed records do not shift Git-compatible selectors, zero-entry limits do no work, and omitted actions stay omitted in both JSON and schema.

Adds safe, previewable path removal and movement plus scoped cleaning while closing the remaining rollback data-loss edge case. Forced multi-source move rollback now keeps moved destination content whenever a reverse directory rename fails, and clean respects nested excludes before deleting collapsed directories.

Revert commit selection now lives behind a documented grit-lib API instead of being implemented inside the CLI. The change also deletes two orphaned revert helpers and adds public-API compatibility tests against system Git for range spellings, ordering, and invalid commit specs.

Adds stable hunk ids and selective `grit add --hunks`/`--lines` staging through a library-first diff/apply path, with JSON output, docs, compatibility tests, and a registered large-file benchmark. At the reviewed tip, the feature still mis-stages tracked empty files as deletions and does not meet its required performance, test, or clippy gates.

Adds linked-worktree move and repair APIs and exposes them through the modern worktree CLI, including dry-run and structured outputs. Follow-up commits preserve symlinks during cross-device copies, locate manually moved worktrees, and keep each registered admin directory authoritative during no-path repair.

Adds a generated performance-overview page backed by the committed daily census, grouped against MATRIX.md with time and peak-memory ratios. It also dispatches benchmark JSON by schema so daily reports never enter the legacy hyperfine parser, including daily-common-paths.json, daily-workspace-extras.json, and daily/latest.json.

This change removes repeated packed-ref indexing, redundant tag-object reads, and zero-filled inflate buffers from tag operations. It also fixes listed tags so only commit targets populate the documented peeled-commit field, while preserving Git-compatible packed/loose ref behavior.

Pick and revert now retain the parsed index cache-tree and pass the cleanliness-check snapshot directly into replay. This avoids a second index parse and prevents the staged-change check from flattening a 100k-entry HEAD tree, while preserving Git-compatible TREE/UNTR/FSMN extensions on the resulting index.