[Tyrie Vella (tyrielv)]

Problem and Context

Linked worktrees store their index in a per-worktree Git directory. DotGitRoot points to shared Git state instead.

Several index callers still used DotGitRoot. A linked-worktree operation can therefore read, replace, repair, or back up the primary index.

Full dehydrate assumes that .git is a directory. It temporarily moves and restores the shared Git directory, which linked worktrees still need.

Worktree backups used the primary enlistment root. Separate worktrees can select the same backup path or require a move across volumes.

Changes

• Use GitIndexPath for index generation, repair, FastFetch, and dehydrate backups.
• Store temporary indexes beside the active index. Record IndexPath and IsWorktree in the local CreateFromHeadTree activity trace.
• Back up lock files from the active worktree Git directory.
• Reject full dehydrate from a linked worktree or a primary enlistment with known linked worktrees.
• Block full dehydrate when reverse gitdir pointers are unreadable or malformed. Missing or empty pointers also block if other administrative metadata remains.
• Ignore empty extra directories and entries containing only an empty gitdir file. Keep nondestructive discovery unchanged.
• Resolve relative registration paths against their registration directory. Preserve the existing hook behavior.
• List known worktree paths and explain remove, prune, and unlock commands, with a reminder to preserve user work.
• Store worktree backups at <worktree-parent>\dehydrate_backup\<worktree-name>\<timestamp> on the same volume. Trim trailing separators so backups stay outside the worktree.
• Change timestamps from yyyyMMdd_HHmmss to yyyyMMdd_HHmmss_fffffff to distinguish sub-second inputs.
• Build backup destinations from file names. Preserve both paths and the underlying error for failed index, lock, and database transfers.
• Return a nonzero exit code after a backup failure. Retain the full-dehydrate remount attempt and keep exception stacks in diagnostic logs.
• Add unit tests for registration policies, path selection, trace metadata, backup errors, and distinct sub-second timestamps. Use mock://repo URLs.
• Add functional tests that create real worktrees and resolve index paths through Git.
  The tests verify a byte-identical primary index and the correct worktree-index backup, including CLI paths with trailing separators.
• Add functional tests that verify full-dehydrate rejection before mutation and a nonzero exit code after a locked-index backup failure.
• Add functional tests for missing, empty, and unreadable reverse pointers. The tests prove that Git omits a usable worktree, then verify rejection before index mutation.

Known gaps and deliberate decisions

• Registration visibility - A linked worktree can remain usable when git worktree list omits it.
  The destructive guard therefore blocks unverifiable metadata instead of using the listing as a safety signal.
• Conservative guard - Known unmounted worktrees also block full dehydrate. Mounted-only handling remains outside this change.
• Backup location - Backups remain beside each worktree for same-volume moves. A shared location redesign remains outside this change.
• Concurrency and replacement - This change does not serialize concurrent Git commands or replace the existing delete-then-move index sequence.
  Those mechanisms need separate changes. No follow-up PR is linked.

[Nathan Baird (ShiningMassXAcc)]

Review pass over this PR. 7 comment(s).

[Nathan Baird (ShiningMassXAcc)]

Re-reviewed the registration-guard fixes and their regression cases. No new correctness issues found in the delta.

Medium (nonblocking): The new missing, empty, and unreadable-registration functional cases pass, and the guard now fails closed. I could not find a changed-line coverage report for this delta. Please link one if available, or record the unavailable differential coverage in the PR validation notes. This is nonblocking.