fix(host-service): stop rescan() from desyncing interest on a transient gap

rescan()'s cleanup dropped this.interest entries for any workspace missing
from its non-archived scan — but a workspace can be transiently absent
without any client losing interest in it (e.g. archived-then-restored via
the tombstone delete flow). A client that already sent one git:watch has no
reason to send it again, and won't unless it remounts or its socket
reconnects. Once interest was wiped, the retry loop (which only walks
interest.keys()) could never bring the workspace back on its own — the
watcher stayed unattached until an unrelated remount/reconnect, silently.

interest is now touched exclusively by watchWorkspace()/unwatchWorkspace().
rescan() still tears down the live watcher (the real resource) for a gone
workspace via stopWatching(), but leaves interest alone — a stale entry for
a workspace gone for good costs one Map entry, bounded by the per-client
git:watch cap, until the holding client unwatches or its socket closes.

New regression test: hold interest, archive the workspace (rescan tears
down the watcher, interest survives), restore it (rescan re-attaches via
the retry loop, no second watchGit needed). Confirmed failing against the
prior code, passing after.

Found via a second-pass review of #6848.

Claude-Session: https://claude.ai/code/session_01NmLFihnhebmL9bbbojGYCR

Author: AviPeltz

packages/host-service/src/events/git-watcher.ts

@@ -572,14 +572,26 @@ export class GitWatcher {
 		// debounce timer/batch for the removed workspace can't fire a stale
 		// git:changed later — it also clears those, this loop used to leave
 		// them dangling.
+		//
+		// Deliberately does NOT touch `interest` here. A workspace can be
+		// transiently absent from this scan without any client ever losing
+		// interest in it (e.g. archived-then-restored via the tombstone
+		// delete flow) — a client that already sent one `git:watch` has no
+		// reason to send it again, and won't unless it remounts or the
+		// socket reconnects. Deleting `interest` for a merely-transient gap
+		// would desync GitWatcher's bookkeeping from what the client (and
+		// its socket's `gitSubscriptions`) still believes is watched, with
+		// nothing left to ever resync it — the retry loop below only walks
+		// `interest.keys()`, so a wrongly-cleared entry can never come back
+		// on its own. `interest` is owned exclusively by
+		// watchWorkspace()/unwatchWorkspace(); a stale entry for a
+		// workspace gone for good costs one Map entry (bounded by the
+		// per-client `git:watch` cap in event-bus.ts) until the holding
+		// client unwatches or its socket closes — self-healing, unlike a
+		// leaked live watcher.
 		for (const id of [...this.watched.keys()]) {
 			if (!existingIds.has(id)) this.stopWatching(id);
 		}
-		// Interest in a workspace that's gone is stale — drop it too, rather
-		// than leaking a refcount nobody will ever unwatch.
-		for (const id of this.interest.keys()) {
-			if (!existingIds.has(id)) this.interest.delete(id);
-		}
 
 		// Retry attaching for still-interested workspaces that never attached.
 		for (const id of this.interest.keys()) {

packages/host-service/test/integration/git-watcher-lazy-registration.integration.test.ts

@@ -242,6 +242,47 @@ describe("GitWatcher lazy registration (regression coverage for #6729)", () => {
 		expect(events).not.toContain(id);
 	});
 
+	test("interest survives a workspace transiently disappearing from a rescan — self-heals without a new watchGit", async () => {
+		const scenario = await createScenario(1);
+		scenarios.push(scenario);
+		scenario.gitWatcher.start();
+
+		const id = scenario.workspaceIds[0] as string;
+
+		// A single watchWorkspace() call, same as one client sending one
+		// git:watch — nothing calls it again for the rest of this test.
+		scenario.gitWatcher.watchWorkspace(id);
+		await waitFor(() => internals(scenario.gitWatcher).watched.has(id), {
+			timeoutMs: 10_000,
+		});
+
+		// Simulate a transient disappearance (e.g. archive-then-restore via
+		// the tombstone delete flow) spanning one rescan tick.
+		scenario.host.db
+			.update(workspaces)
+			.set({ archivedAt: Date.now() })
+			.where(eq(workspaces.id, id))
+			.run();
+		await internals(scenario.gitWatcher).rescan();
+
+		// The live watcher is torn down (real resource, correctly reclaimed)...
+		expect(internals(scenario.gitWatcher).watched.has(id)).toBe(false);
+		// ...but interest — which nothing but watchWorkspace/unwatchWorkspace
+		// should ever touch — must survive the gap.
+		expect(internals(scenario.gitWatcher).interest.has(id)).toBe(true);
+
+		// The workspace reappears (restored) before the next rescan tick.
+		scenario.host.db
+			.update(workspaces)
+			.set({ archivedAt: null })
+			.where(eq(workspaces.id, id))
+			.run();
+		await internals(scenario.gitWatcher).rescan();
+
+		// Self-healed via the retry loop, with no second watchWorkspace() call.
+		expect(internals(scenario.gitWatcher).watched.has(id)).toBe(true);
+	});
+
 	test("registration cost is paid only for workspaces someone actually watches, regardless of how many exist", async () => {
 		const N = 30;
 		const scenario = await createScenario(N);