fix(storage): keep store inventory off the resolve path

Author: ScriptedAlchemy

src/storage.rs

@@ -447,13 +447,11 @@ pub(crate) fn matching_legacy_profile_layouts(
     project_root: &Path,
     profile_root: &Path,
     excluded_project_id: Option<&str>,
-    selected_layout_is_authoritative: bool,
 ) -> Result<(Vec<StoreLayout>, bool)> {
     matching_legacy_profile_layouts_with_git_resolver(
         project_root,
         profile_root,
         excluded_project_id,
-        selected_layout_is_authoritative,
         crate::worktree::is_detached_linked_worktree,
         crate::worktree::git_common_dir,
     )
@@ -463,7 +461,6 @@ fn matching_legacy_profile_layouts_with_git_resolver<D, G>(
     project_root: &Path,
     profile_root: &Path,
     excluded_project_id: Option<&str>,
-    selected_layout_is_authoritative: bool,
     mut is_detached_linked_worktree: D,
     mut git_common_dir: G,
 ) -> Result<(Vec<StoreLayout>, bool)>
@@ -503,17 +500,12 @@ where
 
     // A linked worktree may have its own profile shard while sharing a Git
     // common directory with every sibling checkout. A non-excluded exact
-    // manifest overrides the selected identity. A healthy and populated
-    // marker/registry-selected layout is authoritative only when its manifest
-    // names this exact checkout; a sibling-root selection must retain the
-    // shared-Git recovery path.
+    // manifest overrides the selected identity. Otherwise the shared-Git
+    // recovery path still runs, and the caller decides whether a selected
+    // identity naming this exact checkout outranks what it finds.
     let selected_is_sole_exact_root =
         selected_manifest_matches_exact_root && exact_manifests.is_empty();
-    let matching_manifests = if !exact_manifests.is_empty()
-        || (selected_layout_is_authoritative && selected_manifest_matches_exact_root)
-    {
-        exact_manifests
-    } else {
+    let matching_manifests = if exact_manifests.is_empty() {
         let project_git_common_dir = (!is_detached_linked_worktree(project_root))
             .then(|| git_common_dir(project_root))
             .flatten();
@@ -536,6 +528,8 @@ where
                 })
             })
             .collect()
+    } else {
+        exact_manifests
     };
     let mut layouts = Vec::new();
     for (manifest_path, manifest) in matching_manifests {
@@ -1321,7 +1315,7 @@ mod tests {
     use std::sync::{Arc, Barrier};
 
     #[test]
-    fn exact_root_authority_controls_shared_git_discovery() {
+    fn exact_root_manifest_overrides_shared_git_discovery() {
         fn write_manifest(profile_root: &Path, project_id: &str, project_root: &Path) {
             let data_root = profile_root.join("projects").join(project_id);
             fs::create_dir_all(&data_root).unwrap();
@@ -1357,7 +1351,6 @@ mod tests {
                 &project_root,
                 &profile_root,
                 None,
-                false,
                 |_| false,
                 |root| {
                     resolver_calls.borrow_mut().push(root.to_path_buf());
@@ -1382,28 +1375,6 @@ mod tests {
                 &project_root,
                 &profile_root,
                 Some("proj_exact"),
-                true,
-                |_| false,
-                |root| {
-                    resolver_calls.borrow_mut().push(root.to_path_buf());
-                    Some(dir.path().join("shared.git"))
-                },
-            )
-            .unwrap();
-        assert!(layouts.is_empty());
-        assert!(selected_is_sole_exact_root);
-        assert!(
-            resolver_calls.borrow().is_empty(),
-            "an authoritative selected exact root must not invoke shared-Git discovery"
-        );
-
-        resolver_calls.borrow_mut().clear();
-        let (layouts, selected_is_sole_exact_root) =
-            matching_legacy_profile_layouts_with_git_resolver(
-                &project_root,
-                &profile_root,
-                Some("proj_exact"),
-                false,
                 |_| false,
                 |root| {
                     resolver_calls.borrow_mut().push(root.to_path_buf());
@@ -1416,11 +1387,14 @@ mod tests {
             layouts[0].identity.project_id.as_deref(),
             Some("proj_unrelated")
         );
-        assert!(selected_is_sole_exact_root);
+        assert!(
+            selected_is_sole_exact_root,
+            "the caller decides whether the selected exact root outranks recovery"
+        );
         assert_eq!(
             resolver_calls.borrow().as_slice(),
             [project_root, unrelated_root],
-            "a non-authoritative selected exact root must retain shared-Git recovery"
+            "an excluded selected exact root must retain shared-Git recovery"
         );
     }
 
@@ -1452,7 +1426,6 @@ mod tests {
             &project_root,
             &profile_root,
             None,
-            false,
             |_| false,
             |_| None,
         )
@@ -1461,7 +1434,7 @@ mod tests {
     }
 
     #[test]
-    fn authoritative_non_exact_identity_retains_historical_git_discovery() {
+    fn non_exact_identity_retains_historical_git_discovery() {
         fn write_manifest(profile_root: &Path, project_id: &str, project_root: &Path) {
             let data_root = profile_root.join("projects").join(project_id);
             fs::create_dir_all(&data_root).unwrap();
@@ -1499,7 +1472,6 @@ mod tests {
                 &worktree_root,
                 &profile_root,
                 Some("proj_selected"),
-                true,
                 |_| false,
                 |root| {
                     resolver_calls.borrow_mut().push(root.to_path_buf());
@@ -1510,30 +1482,10 @@ mod tests {
 
         assert_eq!(layouts.len(), 1);
         assert!(!selected_is_sole_exact_root);
-        assert_eq!(
-            resolver_calls.borrow().as_slice(),
-            [worktree_root.clone(), historical_root.clone()],
-            "a healthy selected identity from a sibling root must retain shared-Git recovery"
-        );
-
-        resolver_calls.borrow_mut().clear();
-        let (layouts, _) = matching_legacy_profile_layouts_with_git_resolver(
-            &worktree_root,
-            &profile_root,
-            Some("proj_selected"),
-            false,
-            |_| false,
-            |root| {
-                resolver_calls.borrow_mut().push(root.to_path_buf());
-                Some(dir.path().join("shared.git"))
-            },
-        )
-        .unwrap();
-        assert_eq!(layouts.len(), 1);
         assert_eq!(
             resolver_calls.borrow().as_slice(),
             [worktree_root, historical_root],
-            "an unhealthy or pristine selection must retain shared-Git recovery"
+            "a selected identity from a sibling root must retain shared-Git recovery"
         );
     }
 

src/tracedecay/lifecycle.rs

@@ -205,18 +205,12 @@ impl TraceDecay {
         let selected_id = selected
             .as_ref()
             .and_then(|layout| layout.identity.project_id.as_deref());
-        let selected_layout_is_authoritative = if let Some(selected) = selected.as_ref() {
-            let inventory = store_identity_inventory(selected).await;
-            inventory.is_healthy() && !inventory.is_pristine()
-        } else {
-            false
-        };
-        let (candidates, selected_is_sole_exact_root) = storage::matching_legacy_profile_layouts(
-            project_root,
-            &profile_root,
-            selected_id,
-            selected_layout_is_authoritative,
-        )?;
+        // Store inventory opens the graph and sessions databases, so it must
+        // stay behind the rare paths that actually compare stores. Resolving a
+        // layout is on every open, including fail-closed clients that must not
+        // touch the store at all.
+        let (candidates, selected_is_sole_exact_root) =
+            storage::matching_legacy_profile_layouts(project_root, &profile_root, selected_id)?;
         Self::choose_identity_layout(
             project_root,
             selected,
@@ -238,7 +232,12 @@ impl TraceDecay {
         selected_is_sole_exact_root: bool,
         allow_repair: bool,
     ) -> Result<Option<StoreLayout>> {
-        if selected_is_sole_exact_root && let Some(selected) = selected.as_ref() {
+        // With no competing candidate the selected layout wins regardless, so
+        // skip the inventory rather than opening the store to confirm it.
+        if selected_is_sole_exact_root
+            && !candidates.is_empty()
+            && let Some(selected) = selected.as_ref()
+        {
             let selected_inventory = store_identity_inventory(selected).await;
             if selected_inventory.is_healthy() && !selected_inventory.is_pristine() {
                 return Ok(Some(selected.clone()));