fix(watch): an arriving directory re-decides the worktrees beneath it

[atlas-from-plumb]

What

PLAN-558, the residual of #700's review. The watcher's worktree skip (internal/fswatch/worktrees.go) cached a "worktree" verdict at X/wt, and that verdict outlived X. So did a stale git record for X/wt. Remove X, then move an ordinary tree into its place (mv), and the arrival's expansion treated the ordinary wt as a worktree, silencing every edit inside it.

• Arrival keyed on directory identity (arrivalLocked). An event at P is an arrival only if a directory now stands at P. A worktree verdict or record at or beneath P is dropped (or superseded) only where its directory still exists and is a different one (dev+inode, taken when the belief was formed).
  • A directory being removed keeps its belief, and so does one moved away and back. The first version keyed on the event op, and review round 1 measured a BLOCKING leak on Linux: inotify reports a move AWAY as Remove|Rename.
  • Identity is dirID: device, inode and birth time (statx STATX_BTIME on Linux, Birthtimespec on darwin; os.SameFile alone elsewhere). Linux CI caught inode reuse: on ext4 a tree made right after rm -rf reuses the freed inodes, which the container's overlayfs hid. The birth time tells a reused inode apart.
• Verdicts are kept in separate worktree and ordinary sets, so the arrival scan covers only the few worktrees. A directory that becomes a worktree loses its stale ordinary verdict. A full worktree set drops only the directories that no longer exist.
• Unchanged from fix(watch): the shared file watcher leaves linked git worktrees out #700:
  • a directory's own Remove re-decides nothing;
  • positive verdicts stay sticky through a removal;
  • loss is lazy.

Verification

• Unit tests (fake directory identities):
  • a parent's arrival re-decides beneath it (cached-verdict and stale-record shapes, plus a real-worktree control);
  • a move is not an arrival (moved away; moved away and back, warm and cold);
  • a moved-back verdict and a moved-back record each keep their identity;
  • only its own subtree; a stale ordinary verdict; the cap.
• Real backend: an ordinary tree mv'd over a worktree's parent is watched. Rename away and back, then rm -rf, stays quiet: in the gate's Linux image it fails 7/10 on the previous head and passes 10/10 here. The whole fswatch package passes 10/10 under -race in that image.
• Mutation: 17 mutants. All KILLED except two equivalent ones (the exists check, which replacedLocked's gone-keeps rule makes redundant, and the re-remember guard, which is perf-only).

Closes PLAN-558 (ops board).

🤖 Generated with Claude Code