Add shared committed-tree base generation management - #169

Scope

Implements layer 1 of the remaining shared worktree index design, on top of merged #168. This is a usable core generation manager, not worktree synchronization or shared-mode CLI/daemon integration.

• Discover canonical Git common-directory identity (linked worktrees share; independent clones do not), preserving native paths and worktree-specific HEAD resolution.
• Key generations by repository identity, exact committed tree, explicit indexing profile, and index/schema versions. Keep publishing/requested commit IDs for diagnostics.
• Build from raw committed blobs using one Git batch process and existing decoding, binary classification, trigram extraction, spill sorting, and snapshot writing. No staged/dirty/untracked checkout content or checkout filters enter the base.
• Reuse compatible predecessor postings/masks by blob identity, including copies/renames; recompute destination mode/size eligibility. Expose actual read/extraction/reuse counters and tracked membership/content identities.
• Validate complete staged indexes and checksummed metadata before atomic publication; OS file locking deduplicates cross-process starters, and live pins share the same in-process Arc<Generation>/Arc<SharedBase>.
• Retain all published generations explicitly. No unsafe GC, active-session migration, or overwrite of mapped/corrupt generations. Persist exact keys beside overlay checkpoints.

Compatibility and boundaries

Normal single-root CLI, RPC, on-disk index format, and existing SharedBase checkpoint validation/publication are unchanged. The new profile is a tracked regular-file superset, including hidden/ignored/extension-filtered paths. Binary/oversized/symlink/gitlink membership remains distinct from indexed empty/short files.

Raw Git blobs are not a proof of checkout equivalence: CRLF, working-tree encoding, LFS/smudge transformations, freshness and visibility still require layer-2 reconciliation or scanning. The manager reports unsupported/error states rather than silently substituting empty overlays. Storage must be trusted and immutable while in use; file synchronization plus atomic rename is not parent-directory power-loss durability.

Validation

• cargo test -p tgrep-core --quiet — 325 tests passed, including 19 generation integration tests and the staged-publication rejection unit test.
• cargo clippy --workspace --all-targets -- -D warnings — passed.
• cargo fmt --all -- --check — passed.
• git diff --check and staged diff check — passed.

Real temporary Git repositories/worktrees cover same-tree reuse, independent clones, differing profiles/trees, dirty/staged/untracked exclusion, incremental-vs-full snapshot equivalence, masks, renames/copies and mode changes, transformed clean worktrees, SHA-256, native/Unicode paths, thread/process races, killed starters, malformed metadata, missing objects, permission errors, and old reader/checkpoint retention. Tests do not modify the main checkout.

Cross-platform CI evidence

Linux's full workspace suite, including all 19 generation tests, passed in run 37168572044, attempt 2. macOS passed 18 generation tests but exposed a fixture assumption: APFS rejects non-UTF-8 directory names with EILSEQ before generation code runs. Test-only commit c5b70f99b090c48e4d0bbfb4442ec30a7098da00 handles only macOS EILSEQ/92 and asserts explicit discovery I/O failure; other fixture errors still fail. No production/API changes were needed. Local generation tests, all-target Clippy, formatting and diff checks were rerun successfully.

The latest CI run remains blocked before macOS Rust tests by the existing Python test_doctor_exercises_installed_mcp failure (Operation not permitted); matrix fail-fast cancelled Linux/Windows. Merged main also has the same Python EPERM failure class in run 37167713744. No unrelated Python scripts were modified. Full green macOS/Windows CI is not claimed.

Layer-2 handoff

Use generations::{Repository, GenerationManager, IndexingProfile} and retain EnsureResult.generation: Arc<Generation> with each view. key(), entries()/entry(), base(), content_id()/matches_worktree_bytes() expose the exact tree/profile, complete tracked records, shared reader and decoded identity proof. Supply a compatible predecessor to avoid full extraction for a new tree; unchanged trees reuse automatically. Persist GenerationKey with checkpoints and call open(key) before reconciliation. RetentionPolicy::RetainAll is intentional until daemon-level ownership and checkpoint eviction exist.

Do not merge as part of this task; the next dependent layer will branch from this pushed branch.