[medazizktata25]

Related Issue

None filed.

What

After a commit, reading the database is enough to make the next checkout refuse:

the workspace has uncommitted changes that checkout would overwrite (base/5/1249)

nothing having written to it. A user hits it like this: insert rows, commit, run a SELECT count(*), switch to another branch and back. The switch back is refused on the table's file. postgres_checkout_lifecycle fails at step 06 on main (d5a0e83) for the same reason.

Cause. The first read of a row after its inserting transaction commits sets PostgreSQL hint bits in the row header and dirties the page, which reaches disk at the next checkpoint or shutdown. The dirty check compares size and mtime against the commit's file list, so it reports the page. base/5/1249 is pg_attribute. Measured when the fix was written (see the first commit message): the bytes that change are all the HEAP_XMIN_COMMITTED bit of t_infomask, on page 16; the page LSN and checksum are unchanged.

How

Three commits:

1. fix(checkout): a read after a commit is not uncommitted work.
   • A provider can now say whether a changed file holds the same data as the commit's snapshot copy of it (DatabaseProvider::holds_same_data; the default keeps today's answer).
   • PostgreSQL compares relation main forks page by page. On heap pages only, it disregards exactly what PostgreSQL itself masks as hints when it checks a replayed page (bufmask.c / heap_mask): pd_lsn, pd_checksum, pd_prune_xid, the PD_* hint flags, and the four xmin/xmax hint bits.
   • Index pages, other forks, other files and any other byte are still compared exactly, and an unreadable file still counts as changed.
2. fix(test): assert on what gfs checkout printed, not on what libtest printed.
   • cli_runner::run_gfs captures stdout by redirecting the whole process's stdout, so libtest's "has been running for over 60 seconds" notice could become a checkout's output.
   • The four checkouts in postgres_checkout_lifecycle now run gfs as a subprocess, and their assertions are unconditional.
   • The new run_gfs_subprocess_checked counts only exit 0 as success.
3. fix(branch): drop the unreachable guard #180 left in branch -d, and say why.
   • delete_branch refuses the reserved name detached on its first line, so the guard A branch named 'detached' destroyed every detached working copy #180 added after it is dead code; this removes it.
   • A regression test recreates a repository whose detached branch was made by an older gfs, and asserts the deletion is refused and the detached working copy survives.

Review Guide

1. crates/adapters/db-providers/src/pg_page.rs: the page comparison and its masks, against PostgreSQL's heap_mask.
2. crates/domain/src/usecases/repository/checkout_repo_usecase.rs: where the dirty check asks the provider.
3. crates/domain/src/ports/database_provider.rs and postgresql.rs: the new provider method.
4. Tests: cli/tests/e2e_checkout_after_read.rs (new), cli/tests/common/cli_runner.rs, e2e_checkout_postgres.rs, e2e_checkout.rs.

Testing

On Rust 1.93.1, macOS with Colima for Docker, using gfs-postgres:16/:17 images built from this tree.

• postgres_checkout_lifecycle: all 6 steps pass, 59.6 s. On main it fails at step 06 with the refusal above.
• e2e_checkout_after_read (new): passes.
  • It reads after a commit, then switches branches.
  • It also asserts that a real same-length UPDATE is still refused.
• Calibration: with holds_same_data forced to false, both e2e tests fail. The lifecycle test fails with exactly the original uncommitted changes … (base/5/1249). Restored, both pass.
• pg_page unit tests 6/6, domain checkout tests 10/10, e2e_checkout 11/11 (including the new detached regression test).
• Full cargo test --locked: 888 passed, 1 failed, 3 ignored, across 60 test binaries. The failure is clone_range_and_temporal_hydration_elide, which fails identically on main; its fix is on its own branch.
• cargo fmt --check clean. cargo clippy --locked --all-targets --all-features -- -D warnings clean, run on Linux (rust:1.93.1-bookworm).
• Not verified in this run:
  • The libtest-notice failure that commit 2 fixes needs the test to cross 60 s, and this run took 59.6 s, so the fix wasn't exercised here.
  • The detached regression test was not checked against a deliberately loosened validation.
• Not tested:
  • Docker Desktop, podman, a Linux Docker host, Windows, Kubernetes;
  • providers other than Postgres (they keep the old answer);
  • pages autovacuum changes on its own (pruning, visibility map), which are not hints and are still refused.

Documentation

• Comments on the masks in pg_page.rs name the PostgreSQL source they mirror.

User Impact

• Fixed: reading a database after a commit no longer blocks the next checkout.
• Unchanged: real writes are still refused, and --force still discards them.

Checklist

• Self-review completed
• Tests pass locally (cargo test). One fails, identically on main; see Testing.
• Clippy passes (cargo clippy --all-targets --all-features -- -D warnings), on Linux.
• Format check passes (cargo fmt --check)
• This PR can be safely reverted.