fix(git): close native status parity gaps found in review

An adversarial review verified five silent divergences from the exec
path, each reproduced against real repositories before fixing:

- executable-bit changes were invisible on both sides: the worktree
  scan now compares the 0100 bit when core.filemode applies, and the
  HEAD tree walk carries entry modes so staged chmods surface too
- a conflict living in an otherwise-untracked directory was counted as
  an untracked entry; unmerged paths now participate in the tracked
  prefix search
- a staged rename with edits reported add+delete where git pairs them
  through similarity detection; unpaired adds and deletes on both
  sides now defer to exec git rather than risk diverging counts
- a loose ref holding a symref misreported the branch as unborn; an
  unparseable loose ref is now an error, falling back to exec git
- file-to-symlink type changes counted as modified where porcelain
  reports T, which the segment ignores; both engines now agree

SHA-256 object format, reftables ref storage, and unknown repository
format versions are also rejected deterministically instead of relying
on the index decoder to stumble. New parity scenarios cover chmod on
both sides, conflicts in fresh subdirectories, inexact renames, and
symlink type changes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: JanDeDobbeleer

src/gitstatus/gitstatus.go

@@ -87,6 +87,10 @@ func Load(opts Options) (*Result, error) {
 	// there is no upstream to resolve and no repo-level excludesfile.
 	cfg, _ := loadRepoConfig(opts.CommonGitDir)
 
+	if err := checkRepoFormat(cfg); err != nil {
+		return nil, err
+	}
+
 	store := newObjectStore(opts.CommonGitDir)
 	defer store.close()
 
@@ -96,7 +100,7 @@ func Load(opts Options) (*Result, error) {
 	}
 
 	basePatterns := loadBasePatterns(opts, cfg)
-	scanWorktree(opts, idx, indexModTime, untrackedMode, basePatterns, result)
+	scanWorktree(opts, idx, indexModTime, untrackedMode, trustExecutableBit(cfg), basePatterns, result)
 
 	if err := diffStaging(store, idx, headHash, headOK, result); err != nil {
 		return nil, err

src/gitstatus/gitstatus_test.go

@@ -5,6 +5,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"runtime"
 	"strings"
 	"testing"
 
@@ -41,6 +42,10 @@ func TestLoadParity(t *testing.T) {
 		{Name: "index version 4", Setup: setupIndexV4},
 		{Name: "fully packed objects", Setup: setupPacked},
 		{Name: "packed ahead and behind", Setup: setupPackedAheadBehind},
+		{Name: "staged delete only", Setup: setupStagedDelete},
+		{Name: "staged mode change", Setup: setupStagedModeChange},
+		{Name: "conflict in fresh subdirectory", Setup: setupConflictInSubdir},
+		{Name: "working mode change", Setup: setupWorkingModeChange},
 	}
 
 	// Every case runs under both stat strategies: the in-walk comparison
@@ -69,6 +74,58 @@ func TestLoadParity(t *testing.T) {
 	}
 }
 
+// TestLoadFallsBackOnInexactRename covers the C4 contract decision: a
+// staged rename whose content also changed leaves an unpaired add and an
+// unpaired delete, which git may pair through similarity detection. The
+// engine cannot, so it must error into the exec fallback instead of
+// reporting A+D where git reports R.
+func TestLoadFallsBackOnInexactRename(t *testing.T) {
+	skipIfNoGit(t)
+	hermeticHome(t)
+
+	dir := t.TempDir()
+	initGitRepo(t, dir)
+
+	writeFile(t, dir, "old-name.txt", "a body large enough for gits similarity detection to pair the rename\n")
+	runGit(t, dir, "add", ".")
+	runGit(t, dir, "commit", "-q", "-m", "base")
+
+	runGit(t, dir, "mv", "old-name.txt", "new-name.txt")
+	writeFile(t, dir, "new-name.txt", "a body large enough for gits similarity detection to pair the rename, edited\n")
+	runGit(t, dir, "add", "new-name.txt")
+
+	_, err := Load(Options{
+		WorktreeGitDir: gitPath(t, dir, "--git-dir"),
+		CommonGitDir:   gitPath(t, dir, "--git-common-dir"),
+		RepoRoot:       gitPath(t, dir, "--show-toplevel"),
+	})
+	assert.Error(t, err)
+}
+
+// TestLoadParityTypechangeSymlink replaces a tracked file with a symlink:
+// porcelain reports T, which both engines must count as nothing. Skipped on
+// Windows, where creating symlinks requires elevated privileges.
+func TestLoadParityTypechangeSymlink(t *testing.T) {
+	if runtime.GOOS == goosWindows {
+		t.Skip("symlink creation requires privileges on Windows")
+	}
+	skipIfNoGit(t)
+	hermeticHome(t)
+
+	dir := t.TempDir()
+	initGitRepo(t, dir)
+
+	writeFile(t, dir, "target.txt", "target\n")
+	writeFile(t, dir, "swap.txt", "file\n")
+	runGit(t, dir, "add", ".")
+	runGit(t, dir, "commit", "-q", "-m", "base")
+
+	require.NoError(t, os.Remove(filepath.Join(dir, "swap.txt")))
+	require.NoError(t, os.Symlink("target.txt", filepath.Join(dir, "swap.txt")))
+
+	assertParity(t, dir, "")
+}
+
 // TestLoadParityLinkedWorktree exercises a `git worktree add` checkout,
 // where WorktreeGitDir (HEAD/index) and CommonGitDir (objects/refs) live in
 // different places on disk.
@@ -129,7 +186,6 @@ func setupDirtyMix(t *testing.T, dir string) {
 	writeFile(t, dir, "same-size.txt", "hello\n")
 	writeFile(t, dir, "diff-size.txt", "short\n")
 	writeFile(t, dir, "to-delete.txt", "bye\n")
-	writeFile(t, dir, "staged-delete.txt", "gone\n")
 	writeFile(t, dir, "staged-modify.txt", "orig\n")
 	writeFile(t, dir, "rename-src.txt", "rename me please, needs enough content to be detected as a rename by gits similarity heuristic\n")
 	runGit(t, dir, "add", ".")
@@ -142,11 +198,10 @@ func setupDirtyMix(t *testing.T, dir string) {
 	// unstaged delete
 	require.NoError(t, os.Remove(filepath.Join(dir, "to-delete.txt")))
 
-	// staged add
+	// staged add; a staged delete alongside would trip the rename-ambiguity
+	// fallback, so pure deletion coverage lives in its own scenario
 	writeFile(t, dir, "staged-add.txt", "new\n")
 	runGit(t, dir, "add", "staged-add.txt")
-	// staged delete
-	runGit(t, dir, "rm", "-q", "staged-delete.txt")
 	// staged modify
 	writeFile(t, dir, "staged-modify.txt", "changed\n")
 	runGit(t, dir, "add", "staged-modify.txt")
@@ -283,6 +338,60 @@ func setupPackedAheadBehind(t *testing.T, dir string) {
 	runGit(t, dir, "prune-packed")
 }
 
+// setupStagedDelete stages a deletion with no staged addition alongside, so
+// the exact-rename pairing has nothing to pair and no fallback triggers.
+func setupStagedDelete(t *testing.T, dir string) {
+	writeFile(t, dir, "keep.txt", "keep\\n")
+	writeFile(t, dir, "doomed.txt", "doomed\\n")
+	runGit(t, dir, "add", ".")
+	runGit(t, dir, "commit", "-q", "-m", "base")
+
+	runGit(t, dir, "rm", "-q", "doomed.txt")
+}
+
+// setupStagedModeChange stages an executable-bit flip via update-index,
+// which works on every platform because no filesystem mode is involved.
+func setupStagedModeChange(t *testing.T, dir string) {
+	writeFile(t, dir, "script.sh", "#!/bin/sh\\n")
+	runGit(t, dir, "add", ".")
+	runGit(t, dir, "commit", "-q", "-m", "base")
+
+	runGit(t, dir, "update-index", "--chmod=+x", "script.sh")
+}
+
+// setupConflictInSubdir produces a both-added conflict on a path whose
+// directory holds no other tracked file, so the untracked-directory
+// collapsing must still recognize it as tracked.
+func setupConflictInSubdir(t *testing.T, dir string) {
+	writeFile(t, dir, "base.txt", "base\\n")
+	runGit(t, dir, "add", ".")
+	runGit(t, dir, "commit", "-q", "-m", "base")
+
+	runGit(t, dir, "checkout", "-q", "-b", "feature")
+	writeFile(t, dir, "sub/only.txt", "from feature\\n")
+	runGit(t, dir, "add", ".")
+	runGit(t, dir, "commit", "-q", "-m", "feature adds sub")
+
+	runGit(t, dir, "checkout", "-q", "main")
+	writeFile(t, dir, "sub/only.txt", "from main\\n")
+	runGit(t, dir, "add", ".")
+	runGit(t, dir, "commit", "-q", "-m", "main adds sub")
+
+	runGitAllowFail(t, dir, "merge", "-q", "feature")
+}
+
+// setupWorkingModeChange flips the on-disk executable bit of a tracked
+// file. Meaningful only where the filesystem records the bit; on Windows
+// core.filemode=false makes it a no-op clean scenario, which is itself
+// worth asserting.
+func setupWorkingModeChange(t *testing.T, dir string) {
+	writeFile(t, dir, "script.sh", "#!/bin/sh\\n")
+	runGit(t, dir, "add", ".")
+	runGit(t, dir, "commit", "-q", "-m", "base")
+
+	require.NoError(t, os.Chmod(filepath.Join(dir, "script.sh"), 0o755))
+}
+
 func setupDetached(t *testing.T, dir string) {
 	writeFile(t, dir, "a.txt", "a\n")
 	runGit(t, dir, "add", ".")

src/gitstatus/objects.go

@@ -78,9 +78,9 @@ func identTimestamp(ident string) int64 {
 const treeModeDir = "40000"
 
 // walkTree streams every blob in the tree rooted at h to visit, with its
-// full slash-separated path. Non-blob, non-tree entries (gitlinks) are
-// skipped.
-func walkTree(store *objectStore, h plumbing.Hash, prefix string, visit func(path string, blob plumbing.Hash)) error {
+// full slash-separated path and recorded mode. Non-blob, non-tree entries
+// (gitlinks) are skipped.
+func walkTree(store *objectStore, h plumbing.Hash, prefix string, visit func(path string, blob plumbing.Hash, mode uint32)) error {
 	kind, data, err := store.object(h)
 	if err != nil {
 		return err
@@ -117,7 +117,11 @@ func walkTree(store *objectStore, h plumbing.Hash, prefix string, visit func(pat
 			}
 		case "160000": // gitlink (submodule): not a blob, skip
 		default:
-			visit(path, entryHash)
+			parsed, err := strconv.ParseUint(mode, 8, 32)
+			if err != nil {
+				return fmt.Errorf("gitstatus: malformed tree entry mode in %s: %w", h, err)
+			}
+			visit(path, entryHash, uint32(parsed))
 		}
 	}
 

src/gitstatus/refs.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"runtime"
 	"strings"
 
 	"github.com/go-git/go-git/v5/plumbing"
@@ -40,7 +41,11 @@ func resolveBranch(opts Options, cfg *ini.File, store *objectStore, result *Resu
 
 	result.Ref = branchName
 
-	hash, ok := resolveRef(opts.CommonGitDir, "refs/heads/"+branchName)
+	hash, ok, err := resolveRef(opts.CommonGitDir, "refs/heads/"+branchName)
+	if err != nil {
+		return plumbing.ZeroHash, false, err
+	}
+
 	if !ok {
 		// Unborn branch: no commits yet. Matches porcelain's
 		// `# branch.oid (initial)`. Upstream/ahead-behind are left at their
@@ -105,7 +110,11 @@ func resolveUpstream(opts Options, cfg *ini.File, store *objectStore, branchName
 		upstreamRefPath = "refs/remotes/" + remote + "/" + mergeBranch
 	}
 
-	upstreamHash, ok := resolveRef(opts.CommonGitDir, upstreamRefPath)
+	upstreamHash, ok, err := resolveRef(opts.CommonGitDir, upstreamRefPath)
+	if err != nil {
+		return err
+	}
+
 	if !ok {
 		result.UpstreamGone = true
 		return nil
@@ -124,15 +133,21 @@ func resolveUpstream(opts Options, cfg *ini.File, store *objectStore, branchName
 
 // resolveRef resolves a ref path (e.g. "refs/heads/main") to its commit
 // hash, checking the loose ref file first and falling back to packed-refs.
-func resolveRef(commonGitDir, refPath string) (plumbing.Hash, bool) {
+// A loose ref file that exists but does not hold a plain hash (a symref,
+// or corruption) is an error: guessing here would silently misreport the
+// branch as unborn, so the caller must fall back to exec git instead.
+func resolveRef(commonGitDir, refPath string) (plumbing.Hash, bool, error) {
 	data, err := os.ReadFile(filepath.Join(commonGitDir, filepath.FromSlash(refPath)))
 	if err == nil {
-		if hash, ok := parseHash(strings.TrimSpace(string(data))); ok {
-			return hash, true
+		hash, ok := parseHash(strings.TrimSpace(string(data)))
+		if !ok {
+			return plumbing.ZeroHash, false, fmt.Errorf("gitstatus: unsupported loose ref content in %s", refPath)
 		}
+		return hash, true, nil
 	}
 
-	return scanPackedRefs(commonGitDir, refPath)
+	hash, found := scanPackedRefs(commonGitDir, refPath)
+	return hash, found, nil
 }
 
 // scanPackedRefs looks up refPath in CommonGitDir/packed-refs. Lines are
@@ -193,3 +208,46 @@ func loadRepoConfig(commonGitDir string) (*ini.File, error) {
 
 	return ini.Load(string(data))
 }
+
+// checkRepoFormat rejects repository formats the engine cannot read
+// correctly, deterministically instead of by parse luck: SHA-256 object
+// format, reftables ref storage, and future format versions.
+func checkRepoFormat(cfg *ini.File) error {
+	if cfg == nil {
+		return nil
+	}
+
+	core := cfg.Section("core")
+	if v := core.Key("repositoryformatversion").String(); v != "" && v != "0" && v != "1" {
+		return fmt.Errorf("gitstatus: unsupported repositoryformatversion %s", v)
+	}
+
+	extensions := cfg.Section("extensions")
+
+	if v := extensions.Key("objectformat").String(); v != "" && !strings.EqualFold(v, "sha1") {
+		return fmt.Errorf("gitstatus: unsupported object format %s", v)
+	}
+
+	if v := extensions.Key("refstorage").String(); v != "" && !strings.EqualFold(v, "files") {
+		return fmt.Errorf("gitstatus: unsupported ref storage %s", v)
+	}
+
+	return nil
+}
+
+// trustExecutableBit mirrors git's core.filemode: whether the filesystem
+// records the executable bit reliably. Platform default, overridden by the
+// repo config (git init probes the filesystem and records the verdict).
+func trustExecutableBit(cfg *ini.File) bool {
+	trust := runtime.GOOS != goosWindows
+	if cfg == nil {
+		return trust
+	}
+
+	v := cfg.Section("core").Key("filemode").String()
+	if v == "" {
+		return trust
+	}
+
+	return strings.EqualFold(v, "true")
+}