various improvements - #3032

A cloned repository may contain a local branch named `-f`. Returning through
its symbolic Tix pin passed that name to `git checkout` as an option, forcing
away uncommitted work while reporting a successful branch return.

Reject leading-dash branch operands in `checkout_branch()` and route symbolic
pin checkouts through that same guard. Existing checkout failure handling
preserves the departure and return pin. A `--` separator would instead change
the operand into a pathspec and would not perform the intended branch checkout.

An isolated regression starts from `refs/heads/-f`, travels to an ancestor,
changes a tracked file, and returns through the HEAD pin. Before the fix it
reports success; afterwards it refuses the option and preserves the file,
detached HEAD and pin. Explicit branch checkout shares the validation.

Git reference: `refs.c::check_branch_ref()` at `d38352cd43ab` rejects leading
`-` in porcelain branch names, although plumbing can still create such refs.
Validation: all 21 time-travel tests pass with SHA-1 enabled.

<!-- agent -->
Display quoting was private to `gitoxide-core`, preventing other crates from
reusing its established output behavior. Expose it as
`gix_quote::for_display()` and migrate the existing index-output callers.

The helper returns borrowed display bytes while retaining the reusable scratch
buffer. Ordinary Unicode stays readable; control characters, quotes,
backslashes, and invalid UTF-8 retain their lossless debug representation.
Keep the existing byte-quoting regression coverage with the shared helper.

Assisted-by: GPT 6.0 Astra
Co-authored-by: GPT 6.0 Astra <codex@openai.com>

Repository-derived commit titles and authors reached plain history and rebase
todo output with terminal control sequences intact. A cloned
commit or mailmap could therefore overwrite output or manipulate the terminal.

Use `gix::quote::for_display()` after rendering plain metadata, including
mailmapped authors and rebase anchor titles. Keep todo commands and
machine-readable reference state intact, and document the display behavior in
the Tix specification.

Regressions cover ESC, BEL and Unicode control sequences in metadata and anchor
titles. Todo parsing continues to accept quoted informational metadata.

Git baseline: `pager.c::setup_pager()` at `d38352cd43ab` routes terminal output
through a pager; Tix's plain stdout paths instead need explicit quoting.

The tree after this commit matches the previously validated sanitizer fix,
whose complete 461-test Tix suite passed with isolated Git configuration.
The two terminal-control regressions also pass independently with
`cargo test -p gix-tix --lib --features gix/sha1 terminal_controls`.

<!-- agent -->
A report found that an inherited-PATH miss left a bare program name for
shebang probing. That opened a same-named file in the current worktree and
allowed its contents to choose the interpreter, instead of reporting a missing
program. A successful lookup could also be discarded before spawning.

Anchor every unresolved bare command before returning, without probing it as
a script, and execute the resolved path on successful lookup. Explicit script
paths retain their shebang behavior. Existing argument-parsing assertions now
account for resolved program names on Windows.

Git reference: `compat/mingw.c::path_lookup()` and `mingw_spawnvpe()` at
`d38352cd43ab` fail lookup before parsing an interpreter and execute the resolved
path.

Assisted-by: GPT 6.0 Astra
Co-authored-by: GPT 6.0 Astra <codex@openai.com>

<!-- agent -->
Bring file-opening and directory-traversal utilities into `gix-fs` so
filesystem consumers can use a common API without requesting filesystem
features from `gix-features`.

Expose `open_options_no_follow()` and `open_read_only_no_follow()` for
Unix and Windows. The read helper returns an opened non-symlink handle or
an explicit `FileOrSymlink::Symlink` outcome, including for dangling
links. Inspect opened handles before returning them and classify failed
opens without retrying; preserve missing paths and other I/O errors.
Protection applies to the final path component, while parent-directory
symlinks are still followed.

Own the Unicode-precomposition adapter shared by `read_dir()` and
recursive walking. `read_dir::DirEntry` now uses the `gix-fs` type instead
of re-exporting the `gix-features` type, changing its type identity while
retaining its methods and normalization behavior.

Add the optional `walkdir` feature with depth limits, hidden entries,
configurable link following, and Git's ordering of files and directories.
Traversal remains serial regardless of the requested `Parallelism`.
Basic file access and `read_dir()` remain available without feature flags.

Assisted-by: GPT 6.0 Astra
Co-authored-by: GPT 6.0 Astra <codex@openai.com>

<!-- agent -->
`gix-fs` already provides the filesystem helpers and recursive walkers.
Keeping their duplicate implementation in `gix-features` adds unnecessary
filesystem dependencies to the foundational feature crate.

Remove the `fs` module and the `walkdir` and `fs-read-dir` features. Migrate
workspace callers to `gix_fs`, move traversal requests to `gix-fs/walkdir`,
and update the manifests, lockfile, traversal documentation, and feature
check script together.

Assisted-by: GPT 6.0 Astra
Co-authored-by: GPT 6.0 Astra <codex@openai.com>

<!-- Byron -->

Careful refackiew, only the tests were mostly waved through as they
are known to be super thorough. Only their style needs checking, which
was fine here.

<!-- agent -->
Fixtures that require symbolic links need to distinguish unavailable symlink
creation on the host from broken fixture setup. Otherwise, tests either fail
on unsupported filesystems or risk hiding unrelated errors when skipping.

Inject `gix_testtools_require_symlinks` into Bash fixtures to probe creation
of a real link before generating contents. Record the outcome at the fixture
root and stop successfully when links are unavailable. Tests can then use
`fixture_has_symlinks()` to skip explicitly; missing or malformed results,
unexpected `ln` exits, copied files, and later setup failures remain errors.

Preserve script arguments and Bash 3.2 source context without exporting the
helper to child shells. Include the prelude in cache keys for fixtures using
the probe, and document archive and writable-fixture constraints.

Assisted-by: GPT 6.0 Astra
Co-authored-by: GPT 6.0 Astra <codex@openai.com>

<!-- agent -->
Replace manual `windows()` scans with `ByteSlice::contains_str()` and
`ByteSlice::find()`. Use `contains_str()` where only presence matters
instead of checking `find().is_some()`.

Assisted-by: GPT 6.1 Sol
Co-authored-by: GPT 6.1 Sol <codex@openai.com>

…rites

<!-- agent -->
A tracked `.gitignore` symlink was absent from the skip-worktree ID
mapping, so ordinary ignore lookup could parse arbitrary external files.
An endless target could also exhaust memory.

Always request no-follow reads for worktree `.gitignore` files, regardless
of their index entry. Use `gix_fs::open_read_only_no_follow()` when pattern
loading disallows symlinks, treating skipped links as absent files so
skip-worktree blob fallback remains available. Discard partially read
pattern bytes on failure.

Use the same helper for the worktree `.mailmap`, reporting symlinks as
errors without reading their targets and identifying worktree read errors
correctly. Explicitly configured pattern files and `mailmap.file` may
still follow symlinks.

On Windows, inspect nonexclusive checkout handles for symlinks before
truncating with `set_len(0)` or writing. Retain forced unlink-and-replace
behavior and route symlinks checked out as ordinary files through the
same validated open path. No-follow protection applies to the final path
component on Unix and Windows; leading components can still be symlinks.

Compare ignore lookup and skip-worktree fallback against isolated Git
`check-ignore` calls. Cover mailmap policies and checkout collisions with
file, directory, and dangling symlink targets, including links created
after the Windows path check and validation before truncation.

Assisted-by: GPT 6.0 Astra
Co-authored-by: GPT 6.0 Astra <codex@openai.com>

<!-- agent -->
`ein tool organize --execute` used a repository's origin URL to construct a
move destination without resolving parent components or checking containment.
It was demonstrated percent-decoded path traversal moving a repository
outside the user-selected root.

Resolve the completed destination with the existing `gix::path::realpath()`
helper, which handles existing symlinks and missing leaf components, then reject
paths outside the canonical destination before creating directories or moving
anything. The subsequent self-nesting check now also receives a resolved path.

Disposable isolated repositories reproduce HTTP percent-encoded traversal, a
parent-directory hostname, SSH traversal, and an existing symlink escaping the
destination. A control retains the ordinary host/owner/repository layout and
`.git` suffix handling. Both escape regressions fail before the fix.

Git reference: `urlmatch.c::url_normalize()` at `d38352cd43ab` also normalizes dot
segments; organizing repositories is gitoxide-specific and additionally needs
filesystem confinement.
Validation: all three focused organizer tests pass with the `organize` feature.

Assisted-by: GPT 6.0 Astra
Co-authored-by: GPT 6.0 Astra <codex@openai.com>

<!-- agent -->
A report describes delta base cycles that never terminate in header
lookups and keep allocating during object decoding. Track a constant-space
cycle checkpoint in both loops, without relying on the untrusted pack
object count or rejecting valid forward references.

Account for heap-backed delta-chain metadata in the existing per-allocation
limit and reserve it fallibly, including when delta payloads are empty.
The regressions failed before the fix and cover self, multi-entry, mixed
REF/OFS cycles, empty deltas, and valid forward chains.

Git reference: `t/t5309-pack-delta-cycles.sh` at
`d38352cd43ab9745686d697872408bc3249a153f` rejects cycles while allowing
forward delta bases.

Assisted-by: GPT 6.0 Astra
Co-authored-by: GPT 6.0 Astra <codex@openai.com>

…ction origins

Creating a section with its own source, path, include level, or trust previously
required changing the file's metadata first. Add `File::new_section_with_meta()`
to attach owned or shared metadata directly to one new section, leaving the
file's origin and the defaults for subsequent sections unchanged.

Assisted-by: GPT 6.1 Sol
Co-authored-by: GPT 6.1 Sol <codex@openai.com>

<!-- agent -->
A report describes reduced-trust repository configuration overriding
submodule settings, including command-valued updates. Apply the repository's
existing configurable section filter for worktree, index, and HEAD module
sources, and retain each copied section's origin metadata.

Keep trusted API overrides usable and restrict module enumeration to the
original module definitions. The regressions first reproduced both the trust
bypass and lost provenance, then covered custom filters and every source.

Git reference: `setup.c::ensure_valid_ownership`, `submodule-config.c`, and
`builtin/submodule--helper.c` at `d38352cd43ab9745686d697872408bc3249a153f`
distinguish shared module definitions from trusted local overrides.

Assisted-by: GPT 6.0 Astra
Co-authored-by: GPT 6.0 Astra <codex@openai.com>

<!-- Byron -->

Looked at everything in detail and added error handling in callbacks
that didn't have them. Reduced the scope of this commit to not overlap
with `odb-parallelism` branch which makes many changes additionally.

Many of the newly added tests are very specific about error handling,
one might call them overkill, but I left them in for good measure.
Further, errors.rs in `gix-odb` I just skimmed the test titles off
as everything else would be too time consuming - better have them than
not have them I thought, particularly to support `odb-paralellism`.

<!-- agent -->
A report describes object lookup panics caused by unchecked pack IDs
and large-offset ordinals in otherwise structurally valid MIDX files.

Validate these references when reading an object entry, before indexing
pack arrays or dereferencing the optional LOFF (Large Offsets) table.
Bound LOFF ordinals by the chunk itself, not by the remaining file.
Keep MIDX loading limited to structural validation: an eager scan of
every offset entry adds linear startup work and faults in memory-mapped
pages even when a command needs only a handful of objects. Git likewise
checks these references on access.

Make `pack_id_and_pack_offset_at_index()` return `gix_error::Result`
and `iter()` yield fallible entries. Propagate corruption errors through
object and header lookup, delta-base resolution, integrity verification,
and CLI entry listing. ID-only iteration remains available without valid
offset references. Preserve literal high-bit 32-bit offsets when LOFF
is absent.

Return `Result<Option<_>>` from `Find::location_by_oid()` and
`Find::pack_offsets_and_oid()`: absence and lookup failure are different
outcomes, and callers must be able to distinguish them. Propagate errors
through forwarding implementations, object counting, pack-entry iterator
construction, and thin-pack base lookup rather than treating corruption
as a missing object or a reason to recompress. Report a pack that becomes
unavailable during construction as an error instead of panicking.

Retain failed index loads separately from missing files so repeated
lookups cannot silently turn corruption into absence. Load pending
indices before retrying failures, retry all failed slots, and reconcile
disk state when refreshing. This keeps independent valid packs usable
and permits recovery after repair or removal without endless refresh
loops on persistent failures.

Regressions cover boundary and extreme invalid references, lazy loading,
valid LOFF ordinals and literal offsets, integrity verification,
corruption propagation through object lookup and pack generation, and
repeated, shared, concurrent, repaired, and removed index-load failures.

Git reference: `d38352cd43ab9745686d697872408bc3249a153f`,
`midx.c::midx_for_pack()` and `nth_midxed_offset()`.

BREAKING CHANGE: Multi-pack-index offset access and entry iteration now
return errors which callers must handle. `Find::location_by_oid()` and
`Find::pack_offsets_and_oid()` return `Result<Option<_>>`.
`output::entry::iter_from_counts()` returns a fallible construction
result, and `output::Entry::from_pack_entry()` requires a base-lookup
callback returning `Result<Option<ObjectId>>`.

Assisted-by: GPT 6.0 Astra
Co-authored-by: GPT 6.0 Astra <codex@openai.com>

<!-- agent -->
Returning a child frame's bare diagnostic from `Error::source()` lost any
explicit causes attached to that frame. Standard error reporters, including
`anyhow`, could truncate nested context chains before reaching the underlying
error.

Keep nonleaf frames reachable as source boundaries while exposing raw leaf
diagnostics for downcasting. Format each boundary as a single diagnostic to
avoid duplicating subtrees in external reports, and preserve native-source
precedence without another allocation.

Add regression coverage for standard and `anyhow` traversal and rendering,
erasure and boxing round trips, and preservation of typed diagnostics,
classification, and metadata. Document linear source traversal and the
full-tree inspection alternatives.

Assisted-by: GPT 6.1 Sol
Co-authored-by: GPT 6.1 Sol <codex@openai.com>

<!-- agent -->
`auto-chain-error` also printed source locations in user-facing reports,
including consumers which only wanted a standard error chain. Make printing
independently configurable with `error-print-location`, forwarded by `gix`.
The feature gates the shared location writer; caller locations, metadata,
classification, and the existing alternate-format rules remain intact.

Enable printing explicitly in workspace binary dependencies and the filter
test-helper feature. `gix-error` opts in for its own tests so existing location
snapshots retain their coverage. An isolated Cargo consumer checks real
`main()` stderr for both crates, printing on and off, tree and chain modes,
and `tree-error` precedence without workspace test feature unification.

Assisted-by: GPT 6.1 Sol
Co-authored-by: GPT 6.1 Sol <codex@openai.com>

`gix` now makes caller-location printing opt-in independently of error
representation. Standalone `tix` should continue showing captured locations
when `main()` returns an error, including custom builds with default features
disabled. Enable `gix/error-print-location` on its existing dependency.

Document the diagnostic contract in `spec.md` and add a binary regression
check that ordinary Debug includes the caller file while alternate Debug
continues to omit it.

Validation: the standalone `tix` binary builds with `sha1`; its diagnostic
regression test passes; formatting and diff whitespace checks pass.

<!-- Byron -->

Reviewed and refactored carefully, tried the release script as well.
Didn't review the release script at all though, just had some docs added.
I consider it disposable.

<!-- agent -->
Enabled location diagnostics could expose entire checkout and Cargo registry
paths, obscuring the useful source location with machine-specific directories.
Format conventional source paths relative to their containing package directory
and remove Cargo registry version suffixes, so a path such as
`/home/user/.cargo/registry/src/index.crates.io-hash/gix-url-0.39.0/src/parse.rs`
prints as `gix-url/src/parse.rs`. Unrecognized layouts fall back to the filename.

Keep captured `std::panic::Location` values and line numbers intact. The shared
formatter covers tree, chain, source, test, and `main()` diagnostics; feature
defaults and alternate formatting remain unchanged. Document the limitation
that locations contain no Cargo package metadata and build owners can use
`--remap-path-prefix` for exact package names in arbitrary layouts.

Assisted-by: GPT 6.1 Sol
Co-authored-by: GPT 6.1 Sol <codex@openai.com>

<!-- Byron -->

There are some concerns over performance, but it seems the work it does is
required after all. There are possible optimisations left on the table,
as it might do duplicate IO to check ownership.
More tests are read-only now as well, it really does like its tempdirs and
direct Git invocations.

<!-- agent -->
Checking ownership of only the discovery candidate or resolved git directory
can grant full trust to a linked repository with foreign-owned paths. Add
`gix_discover::repository::trust()` to compute the minimum trust of the
original candidate, resolved git directory, common directory referenced by
`commondir`, and existing worktree. Use it during upward discovery and direct
and environment-based `gix` opens, before selecting trust-dependent options
or reading repository configuration.

Never upgrade an untrusted candidate. Skip a duplicate git-directory check
only when its spelling exactly matches the candidate after joining with the
current directory; filesystem aliases can still cause repeated checks. Skip
a missing worktree so a private git directory remains usable after checkout
removal, but propagate missing git or common-directory errors.

Preserve `TrustPolicy::Assume` and explicit opening trust overrides, and
document the distinction between ownership-derived trust, required thresholds,
and assumed trust. Add deterministic ownership regressions through private
callbacks, including linked paths, duplicate checks, and missing directories.
Replace the ancestor-discovery test's dependency on the source checkout with
read-only nested repository fixtures.

Git reference: `setup.c::ensure_valid_ownership` at
`d38352cd43ab9745686d697872408bc3249a153f` checks gitfile, worktree and gitdir.
The common directory is also checked here as a configuration source.

Assisted-by: GPT 6.0 Astra
Co-authored-by: GPT 6.0 Astra <codex@openai.com>

<!-- Byron -->

Also brought TestResult in there for nicer error messages, presumably,
and if anything then at least it's now consistent.

<!-- agent -->
Git paths can contain arbitrary bytes on Unix, while native Windows paths
can contain unpaired surrogates that cannot be represented as UTF-8. The
canonical conversion functions previously hid these failures behind
panicking wrappers, even when their callers already returned errors.

Make `into_bstr`, `from_bstr`, `from_bstring`, `from_byte_slice`, and
`to_native_path_on_windows` fallible and remove their redundant `try_*`
counterparts. Keep borrowed inputs borrowed and owned inputs owned, and
retain the concrete encoding error as a source. Also return an error from
`normalize_saturating` when normalization exhausts a relative or empty CWD.

Adapt the workspace in the same breaking change, including public APIs
for reference and reflog paths, worktree IDs, configuration, pathspecs,
pattern sources, and command preparation. Convert `Prepare` to `Command`
with `TryFrom`; inspect ASCII shell syntax through native encoded bytes
and preserve native commands without a Git-path round trip. Keep reference
names as bytes in missing-reference diagnostics.

Propagate conversion failures before affected command execution, filter
exchanges, and watcher updates. Debug logging records failed diagnostic
conversions without changing pathspec behavior. Add regression coverage
for arbitrary Unix bytes, Windows encoding failures, ownership, lazy
configuration selection, and dependent operations.

Assisted-by: GPT 6.0 Astra
Co-authored-by: GPT 6.0 Astra <codex@openai.com>

<!-- agent -->
`gix-features` once coordinated several alternative implementations.
Serial versus threaded execution is its remaining shared implementation
policy; tracing, hashing, compression, and filesystem operations already
have their own owners.

Move progress, interruption, byte pipes, decoding, iterator chunks, and
cache diagnostics into `gix-utils`. Keep utilities that add dependencies
behind feature toggles, including `interrupt` for typed cancellation via
`gix-error`. Use `crc32fast` directly in `gix-pack` and `gix-odb`.

Rename the remaining crate to `gix-parallel` and expose its computation
helpers, reducers, and shared ownership primitives at the crate root.
Replace `gix::features` and `gix::threading` with the existing owner exports,
including `gix::parallel` and `gix::utils`, and adapt all workspace callers.

Expose both progress formatting choices individually on `gix`, retaining
`comfort` as their bundle. Forward tracing directly to `gix-trace` and
cache diagnostics to `gix-utils`. Update documentation, feature checks,
the pack fuzz harness, and package-size checks for the new ownership.

Assisted-by: GPT 6.1 Sol
Co-authored-by: GPT 6.1 Sol <codex@openai.com>

The `test-fixtures-windows (windows-11-arm)` CI job fails in
`disjoint_hidden_and_interesting` with Git 2.56.0: `git log --graph` draws
an extra lane before the root of a disconnected branch, so the ASCII graph
snapshot differs even though every commit ID and relationship is unchanged.
This test and snapshot predate the PR's base.

Replace the drawing snapshot with a `git rev-list disjoint --not main`
comparison against the same expected commit IDs used by the traversal
checks. The test now verifies the hidden-branch behavior against Git without
depending on a version-specific graph drawing, and retains coverage for all
sortings with and without the commit-graph.

Validation: all eight `commit::simple::hide` tests pass with regenerated
fixtures. Formatting and `git diff --check` pass. The failing Windows ARM
runner's log provides the before-change snapshot difference.