# PR #23624 proof audit, pass 1: coverage matrix

Head `cfee52fc24`, worktree `~/wt/pr-23624`, git 2.43.0. Read-only audit: I ran no tests and no fixtures.

Test file `T` = `apps/server/src/vcs/GitVcsDriver.test.ts`. Tests cited:

- **INSP**: `checkpoint index inspection handles entries beyond the output cap (index=normal|skip-worktree|assume-unchanged|sparse)`, T:694-765
- **SPARSE2**: `sparse checkpoint preserves two captures (nested, index=sparse|flags|manual-skip|missing|non-cone-missing)`, T:585-692
- **TURNS**: `checkpoint index reuse preserves two turns (nested, index=normal|flags|split)`, T:840-916
- **SPLIT**: `checkpoint capture keeps the shared index a split index still uses`, T:247
- **RESTORE**: `restores empty checkpoints without changing paths outside the workspace`, T:945

`apps/server/src/checkpointing/*.test.ts` has no hits for skip-worktree, assume-unchanged, sparse, update-index, or file modes. It adds nothing to this matrix.

What must hold: **T** = the checkpoint tree matches the working tree for the affected paths. **I** = the real `.git/index` bytes are unchanged. **R** = restoring reproduces the working tree.

General caveats:

1. No test compares the whole checkpoint tree with the working tree. Each one checks only named paths.
2. TURNS `flags` exercises both flag types, but before this PR it passed through the fallback too. It does not count fresh `read-tree` calls, so it does not prove the new path ran. INSP and SPARSE2 are the only tests that do.

| ID | Case | Flag | Repo mode | Must hold | Status | Evidence |
|---|---|---|---|---|---|---|
| R1 | Same-size, same-mtime content edit of a flagged file | skip-worktree, assume-unchanged | non-sparse | T, I | **COVERED** | INSP: utimes T:717 and T:730, edit T:728, `show` assert T:755, index assert T:763, `freshReadTrees==0` T:761 |
| R1b | Same as R1 | assume-unchanged (`h`), in-cone skip-worktree (`S`) | cone sparse with sparse index | T, I | UNCOVERED (partial) | SPARSE2 `flags` and `manual-skip` flag only `scope/in/delete`, which is deleted. No flagged edit is tested on sparse. |
| R2a | Mode change (`chmod +x`) on a flagged file | both | non-sparse | T (mode 100755 in tree), I | **UNCOVERED** | No test anywhere uses chmod or checks a 100755 tree mode. |
| R2b | Mode change on an unflagged file while a flagged entry exists | both | non-sparse | T, I | **UNCOVERED** | Same as R2a. |
| R3 | Deletion of a flagged file | both | non-sparse | T (path absent), I | **COVERED** | INSP: flag T:722, delete T:724, `notInclude` T:759, index T:763 |
| R3b | Deletion of a flagged file | `h` and in-cone `S` | cone sparse with sparse index | T, I | **COVERED** | SPARSE2 `flags`/`manual-skip`: T:631-634, T:640, `notInclude` T:678, index T:680-683, `freshReadTrees==0` T:690 |
| R4 | Rename of a flagged file (old path deleted, new path untracked) | both | non-sparse | T (old path gone, new path present), I | **UNCOVERED** | Deletion (R3) and untracked add (TURNS `scope/new`) are tested separately, never as one rename of a flagged path. |
| R5 | Flagged entry staged differently from HEAD (index OID differs from HEAD, working tree differs again) | both | non-sparse | T (working content, not the staged or HEAD blob), I | **CLAIMED-ONLY** | Body: "reviewers checked by hand". TURNS flags `scope/assumed` and `scope/skipped` *after* `add .`, but their staged blob equals HEAD (T:865-873). Only unflagged `scope/staged` differs from HEAD. |
| R6 | Untracked file next to flagged entries | both | non-sparse | T (untracked file included), I | **COVERED** (weak) | TURNS `flags`: `scope/new` T:882, `include` T:899, index T:914. It does not prove the new path ran (caveat 2). |
| R7 | Unflagged edit while a flagged entry exists | both | non-sparse | T, I, unflagged files not rehashed | **COVERED** | TURNS `flags`: `scope/staged` and `outside` T:879-895. INSP: no rehash of `stable` via `.git/reads==""` T:762 |
| R8 | Real index byte-identity after a flagged capture | both | non-sparse, cone sparse | I | **COVERED** | INSP T:763, SPARSE2 T:680, TURNS T:914 |
| R9 | Split index combined with a flagged entry | both | split index | T, I, sharedindex survives | **CLAIMED-ONLY** | SPLIT (T:247) and TURNS `split` (T:875) have no flags. The flagged split case is only claimed in the body. |
| R10 | Cone sparse with sparse index plus a manual flag | `h`, in-cone `S` | cone + sparse index | T, I, no fresh `read-tree` | **COVERED** (deletion only) | SPARSE2 `flags`/`manual-skip` (`--sparse-index` T:625). Edit content is not covered (see R1b). The body also lists this as hand-checked. |
| R11 | Cone sparse **without** sparse index plus a manual flag | `h`, in-cone `S` | cone, `index.sparse=false` | T, I | **CLAIMED-ONLY** | Every sparse fixture uses `--sparse-index` (T:625, T:727). |
| R12 | Non-cone sparse plus a manual flag (index present) | `h`, `S` | non-cone | T, I | **CLAIMED-ONLY** | The only non-cone test is `non-cone-missing` (T:626, T:656-662), with no index and an expected failure. `check-rules` in non-cone mode is never exercised. |
| R13 | Flagged gitlink (submodule), fallback | both | non-sparse | T (gitlink OID), I, fresh-index fallback taken | **CLAIMED-ONLY** | The code bails at `startsWith("160000 ")`. No test does this. |
| R14 | Flagged odd paths: newline, tab, double quote, non-ASCII | both | non-sparse | T, I | **CLAIMED-ONLY** | Every path in the tests is plain ASCII. The `indexOf("\t")` split and the `-z` round-trip are not exercised with a tab in the path. |
| R15 | Flagged invalid-UTF-8 path, fallback | both | non-sparse | T, I, fallback taken | **CLAIMED-ONLY** | `isUtf8` path → `fallback`. Not tested, and it was not tested before this PR either. |
| R16 | Flagged records over 1 MiB, fallback | both | non-sparse | T, I, fallback taken | **UNCOVERED** | `FLAGGED_INDEX_ENTRIES_MAX_BYTES`. Not tested and not claimed. |
| R17 | Lowercase `s` tag (skip-worktree + assume-unchanged) on a sparse checkout, fallback | `s` | cone sparse | T, I, fallback taken | **UNCOVERED** | Not tested and not claimed. A related case is also uncovered: `s` on a non-sparse checkout should go through the new path. |
| R18 | `core.ignorestat=true` | both | non-sparse | T (flagged edit captured), I | **COVERED** | INSP T:723. The body says it fails without the `-c core.ignorestat=false` override. Not covered on sparse. |
| R19 | Restore from a checkpoint captured through the new path | both | non-sparse, cone sparse | R, I after restore | **UNCOVERED** | RESTORE (T:945) uses empty checkpoints with no flags. No checkpointing test restores a flagged capture. |
| R20 | Large fixture (25k files) timing: none / skip-worktree / assume-unchanged | none, both | non-sparse | capture < 30 s timeout, rehash count | **COVERED-BY-TABLE** | Body table: 417 / 523 / 731 ms on the branch, versus timeouts on `main`. No script or log is attached. The assume-unchanged row reports "2 files rehashed" against 1 for the others, which needs explaining. |
| R21 | Racy timestamp restored after `update-index` | both | non-sparse | T for a racy unflagged edit, index mtime | **UNCOVERED** (flag combination) | The racy tests (T:767, T:797) have no flags, so the `utimes` added after `--index-info` is not exercised. |

UNCOVERED_ROWS: R1b, R2a, R2b, R4, R5, R9, R11, R12, R13, R14, R15, R16, R17, R19, R20, R21

(R5, R9, R11, R12, R13, R14 and R15 are CLAIMED-ONLY with no recorded artifact. R20 rests on a table with no artifact, so a rerun is worthwhile. R10 is covered for deletion only; its edit gap is R1b.)