Move conflicted commit detection from headers to commit message markers

The `gitbutler-conflicted` header is stripped when commits are rebased
outside of GitButler, silently losing conflict state. Replace it with
commit message markers — a `[conflict]` prefix for fast detection and
a `GitButler-Conflict: true` footer for verification — which survive
rebasing and are visible to developers in `git log`.

New commits only write message markers (no header). Reading checks the
message first, then falls back to the header for backward compatibility
with existing conflicted commits for a release or two.

Conflicted commit message format:

    [conflict] <original subject>

    <original body>

    GitButler-Conflict: true
    This is a GitButler-managed conflicted commit. Files are auto-resolved
    using the "ours" side. The commit tree contains additional directories:
      .conflict-side-0  — our tree
      .conflict-side-1  — their tree
      .conflict-base-0  — the merge base tree
      .auto-resolution  — the auto-resolved tree
      .conflict-files   — metadata about conflicted files
    To manually resolve, check out this commit, remove the directories
    listed above, resolve the conflicts, and amend the commit.

Markers are added when creating conflicted commits and stripped when
conflicts are resolved (either through the edit-mode flow or when a
previously-conflicted commit rebases cleanly). Reword and squash
operations preserve the markers on still-conflicted commits.

The UI layer strips markers before displaying commit messages, since
it already has a dedicated `has_conflicts` flag.

The CONFLICT-README.txt tree blob is removed since the footer now
serves the same purpose with better visibility.

The conflicted file count (`Option<u64>`) stored in the old header was
only ever used as a boolean — no code path read the actual count — so
the new approach uses a simple presence check with no count.

Author: mtsgrd

crates/but-core/src/commit.rs

@@ -505,8 +505,12 @@ impl<'repo> Commit<'repo> {
     }
 
     /// Return `true` if this commit contains a tree that is conflicted.
+    ///
+    /// Checks the commit message for conflict markers first (new style),
+    /// then falls back to the `gitbutler-conflicted` header (legacy).
     pub fn is_conflicted(&self) -> bool {
-        self.headers().is_some_and(|hdr| hdr.is_conflicted())
+        message_is_conflicted(self.inner.message.as_ref())
+            || self.headers().is_some_and(|hdr| hdr.is_conflicted())
     }
 
     /// If the commit is conflicted, then it returns the auto-resolution tree,
@@ -627,3 +631,82 @@ impl ConflictEntries {
         set.len()
     }
 }
+
+/// The prefix prepended to the commit subject line to mark a conflicted commit.
+pub const CONFLICT_MESSAGE_PREFIX: &str = "[conflict] ";
+
+/// The marker line in the commit message footer that confirms a GitButler-managed conflict.
+pub const CONFLICT_FOOTER_MARKER: &str = "GitButler-Conflict: true";
+
+/// The full footer appended to a conflicted commit message, explaining the conflict state.
+const CONFLICT_FOOTER: &str = "\
+This is a GitButler-managed conflicted commit. Files are auto-resolved
+using the \"ours\" side. The commit tree contains additional directories:
+  .conflict-side-0  — our tree
+  .conflict-side-1  — their tree
+  .conflict-base-0  — the merge base tree
+  .auto-resolution  — the auto-resolved tree
+  .conflict-files   — metadata about conflicted files
+To manually resolve, check out this commit, remove the directories
+listed above, resolve the conflicts, and amend the commit.
+GitButler-Conflict: true";
+
+/// Add conflict markers (prefix and footer) to a commit message.
+///
+/// Uses byte operations to preserve non-UTF8 content in the original message.
+pub fn add_conflict_markers(message: &BStr) -> BString {
+    let trimmed = message
+        .as_bytes()
+        .strip_suffix(b"\n")
+        .unwrap_or(message.as_bytes());
+    let footer_block = format!("\n\n{CONFLICT_FOOTER}\n");
+    let mut result = BString::from(Vec::with_capacity(
+        CONFLICT_MESSAGE_PREFIX.len() + trimmed.len() + footer_block.len(),
+    ));
+    result.extend_from_slice(CONFLICT_MESSAGE_PREFIX.as_bytes());
+    result.extend_from_slice(trimmed);
+    result.extend_from_slice(footer_block.as_bytes());
+    result
+}
+
+/// The exact footer block suffix appended by [`add_conflict_markers`], used for
+/// suffix-based matching to avoid false positives from partial matches in the
+/// commit body.
+fn conflict_footer_block() -> String {
+    format!("\n\n{CONFLICT_FOOTER}\n")
+}
+
+/// Strip conflict markers (prefix and footer) from a commit message, restoring
+/// the original message. Returns the message unchanged if no markers are found.
+///
+/// Only strips when the exact footer block produced by [`add_conflict_markers`]
+/// is present as a suffix, so arbitrary occurrences of the marker text inside
+/// the commit body cannot cause false stripping.
+pub fn strip_conflict_markers(message: &BStr) -> BString {
+    let bytes = message.as_bytes();
+    let footer = conflict_footer_block();
+
+    let Some(without_footer) = bytes.strip_suffix(footer.as_bytes()) else {
+        // Footer not present — return unchanged to avoid stripping a `[conflict] `
+        // prefix from a non-GitButler commit that happens to start with it.
+        return BString::from(bytes);
+    };
+
+    let without_prefix = without_footer
+        .strip_prefix(CONFLICT_MESSAGE_PREFIX.as_bytes())
+        .unwrap_or(without_footer);
+
+    BString::from(without_prefix)
+}
+
+/// Check if a commit message contains GitButler conflict markers.
+///
+/// Requires both the `[conflict] ` prefix and the exact footer block appended
+/// by [`add_conflict_markers`] as a suffix, so arbitrary commits with
+/// `[conflict]` in their subject or `GitButler-Conflict: true` in the body
+/// are not misidentified.
+pub fn message_is_conflicted(message: &BStr) -> bool {
+    let bytes = message.as_bytes();
+    let footer = conflict_footer_block();
+    bytes.starts_with(CONFLICT_MESSAGE_PREFIX.as_bytes()) && bytes.ends_with(footer.as_bytes())
+}

crates/but-rebase/src/cherry_pick.rs

@@ -23,7 +23,7 @@ pub enum EmptyCommit {
 }
 
 pub(crate) mod function {
-    use std::{collections::HashSet, path::PathBuf};
+    use std::path::PathBuf;
 
     use anyhow::{Context as _, bail};
     use bstr::BString;
@@ -168,18 +168,22 @@ pub(crate) mod function {
         }
 
         let headers = to_rebase.headers();
-        let to_rebase_is_conflicted = headers.as_ref().is_some_and(|hdr| hdr.is_conflicted());
+        let was_conflicted = to_rebase.is_conflicted();
         let mut new_commit = to_rebase.inner;
         new_commit.tree = resolved_tree_id.detach();
 
         // Assure the commit isn't thinking it's conflicted.
-        if to_rebase_is_conflicted {
+        if was_conflicted {
+            // Strip the legacy header if present
             if let Some(pos) = new_commit
                 .extra_headers()
                 .find_pos(HEADERS_CONFLICTED_FIELD)
             {
                 new_commit.extra_headers.remove(pos);
             }
+            // Strip conflict markers from the commit message
+            new_commit.message =
+                but_core::commit::strip_conflict_markers(new_commit.message.as_ref());
         } else if headers.is_none() {
             new_commit
                 .extra_headers
@@ -205,10 +209,6 @@ pub(crate) mod function {
         treat_as_unresolved: gix::merge::tree::TreatAsUnresolved,
     ) -> anyhow::Result<gix::Id<'repo>> {
         let repo = resolved_tree_id.repo;
-        // in case someone checks this out with vanilla Git, we should warn why it looks like this
-        let readme_content =
-            b"You have checked out a GitButler Conflicted commit. You probably didn't mean to do this.";
-        let readme_blob = repo.write_blob(readme_content)?;
 
         let conflicted_files =
             extract_conflicted_files(resolved_tree_id, cherry_pick, treat_as_unresolved)?;
@@ -243,15 +243,20 @@ pub(crate) mod function {
             resolved_tree_id,
         )?;
         tree.upsert(".conflict-files", EntryKind::Blob, conflicted_files_blob)?;
-        tree.upsert("CONFLICT-README.txt", EntryKind::Blob, readme_blob)?;
 
         let mut headers = to_rebase
             .headers()
             .unwrap_or_else(|| Headers::from_config(&repo.config_snapshot()));
-        headers.conflicted = conflicted_files.conflicted_header_field();
+        headers.conflicted = None;
         to_rebase.tree = tree.write().context("failed to write tree")?.detach();
         set_parent(&mut to_rebase, head.id.detach())?;
 
+        // Add conflict markers to the commit message
+        if !but_core::commit::message_is_conflicted(to_rebase.inner.message.as_ref()) {
+            to_rebase.inner.message =
+                but_core::commit::add_conflict_markers(to_rebase.inner.message.as_ref());
+        }
+
         to_rebase.set_headers(&headers);
         Ok(crate::commit::create(
             repo,
@@ -342,22 +347,5 @@ pub(crate) mod function {
                 || !self.our_entries.is_empty()
                 || !self.their_entries.is_empty()
         }
-
-        fn total_entries(&self) -> usize {
-            let set = self
-                .ancestor_entries
-                .iter()
-                .chain(self.our_entries.iter())
-                .chain(self.their_entries.iter())
-                .collect::<HashSet<_>>();
-
-            set.len()
-        }
-
-        /// Return the `conflicted` header field value.
-        pub(crate) fn conflicted_header_field(&self) -> Option<u64> {
-            let entries = self.total_entries();
-            Some(if entries > 0 { entries as u64 } else { 1 })
-        }
     }
 }

crates/but-rebase/src/graph_rebase/cherry_pick.rs

@@ -305,18 +305,21 @@ fn commit_from_unconflicted_tree<'repo>(
     let repo = to_rebase.id.repo;
 
     let headers = to_rebase.headers();
-    let to_rebase_is_conflicted = headers.as_ref().is_some_and(|hdr| hdr.is_conflicted());
+    let was_conflicted = to_rebase.is_conflicted();
     let mut new_commit = to_rebase.inner;
     new_commit.tree = resolved_tree_id.detach();
 
     // Ensure the commit isn't thinking it's conflicted.
-    if to_rebase_is_conflicted {
+    if was_conflicted {
+        // Strip the legacy header if present
         if let Some(pos) = new_commit
             .extra_headers()
             .find_pos(HEADERS_CONFLICTED_FIELD)
         {
             new_commit.extra_headers.remove(pos);
         }
+        // Strip conflict markers from the commit message
+        new_commit.message = but_core::commit::strip_conflict_markers(new_commit.message.as_ref());
     } else if headers.is_none() {
         new_commit
             .extra_headers
@@ -348,10 +351,6 @@ fn commit_from_conflicted_tree<'repo>(
     sign_commit: SignCommit,
 ) -> anyhow::Result<gix::Id<'repo>> {
     let repo = resolved_tree_id.repo;
-    // in case someone checks this out with vanilla Git, we should warn why it looks like this
-    let readme_content =
-        b"You have checked out a GitButler Conflicted commit. You probably didn't mean to do this.";
-    let readme_blob = repo.write_blob(readme_content)?;
 
     let conflicted_files =
         extract_conflicted_files(resolved_tree_id, cherry_pick, treat_as_unresolved)?;
@@ -383,15 +382,20 @@ fn commit_from_conflicted_tree<'repo>(
         resolved_tree_id,
     )?;
     tree.upsert(".conflict-files", EntryKind::Blob, conflicted_files_blob)?;
-    tree.upsert("CONFLICT-README.txt", EntryKind::Blob, readme_blob)?;
 
     let mut headers = to_rebase
         .headers()
         .unwrap_or_else(|| Headers::from_config(&repo.config_snapshot()));
-    headers.conflicted = conflicted_files.conflicted_header_field();
+    headers.conflicted = None;
     to_rebase.tree = tree.write().context("failed to write tree")?.detach();
     to_rebase.parents = parents.into();
 
+    // Add conflict markers to the commit message
+    if !but_core::commit::message_is_conflicted(to_rebase.inner.message.as_ref()) {
+        to_rebase.inner.message =
+            but_core::commit::add_conflict_markers(to_rebase.inner.message.as_ref());
+    }
+
     to_rebase.set_headers(&headers);
     Ok(crate::commit::create(
         repo,

crates/but-rebase/src/lib.rs

@@ -328,7 +328,16 @@ fn rebase(
                 let mut new_commit = repo.find_commit(new_commit)?.decode()?.to_owned()?;
                 new_commit.parents = base_commit.parent_ids().map(|id| id.detach()).collect();
                 if let Some(new_message) = new_message {
-                    new_commit.message = new_message;
+                    // Preserve conflict markers if the commit is conflicted,
+                    // but avoid duplicating markers if the new message already has them.
+                    new_commit.message =
+                        if but_core::commit::message_is_conflicted(new_commit.message.as_ref())
+                            && !but_core::commit::message_is_conflicted(new_message.as_ref())
+                        {
+                            but_core::commit::add_conflict_markers(new_message.as_ref())
+                        } else {
+                            new_message
+                        };
                 }
                 *cursor = commit::create(
                     repo,
@@ -374,7 +383,15 @@ fn reword_commit(
     new_message: BString,
 ) -> Result<gix::ObjectId> {
     let mut new_commit = repo.find_commit(oid)?.decode()?.to_owned()?;
-    new_commit.message = new_message;
+    // Preserve conflict markers if the commit was conflicted,
+    // but avoid duplicating markers if the new message already has them.
+    let was_conflicted = but_core::commit::message_is_conflicted(new_commit.message.as_ref());
+    new_commit.message =
+        if was_conflicted && !but_core::commit::message_is_conflicted(new_message.as_ref()) {
+            but_core::commit::add_conflict_markers(new_message.as_ref())
+        } else {
+            new_message
+        };
     Ok(commit::create(
         repo,
         new_commit,