TIN-1620: dev-env zero-diff fingerprint for the repo-roam ladder

[Jesssullivan]

What

Adds the one missing precision layer the large-workdir research identified for Gate G5 / TIN-1620 (one expendable live repo): a git-aware dev-env zero-diff fingerprint that asserts a roamed ~/git repo is byte-and-semantically identical across hosts (committed + uncommitted + staged + untracked + branch/HEAD + stash), with no mid-reconcile .git corruption.

This is not new scope. Repo-roam == Phase 2 "single live repo" in large-workdir-onboarding-design-2026-05-25.md == Gate G5 in large-workdir-daily-driver-sequencing-2026-05-30.md == TIN-1620 (live-execution child TIN-1908). The fingerprint is a tighter assertion layered ON TOP of the existing QA-matrix rows (T2/T3, T8/T9+M3/M6, T10/T11+M5/M5-R, T12, T13) — not a new matrix, not a new sync engine.

[PR] vs [LIVE] — what a green bar in THIS PR does and does NOT prove

A green self-test / task lazy:test-dev-env-fingerprint is NOT proof of roaming. It proves only that the assertion engine is internally consistent on one host: it captures deterministically (same tree -> identical fingerprint) and its negative control trips (a mutated tree -> compare fails). Specifically, a green [PR] run is NOT proof of:

• flip-flop zero-diff in either direction (neo->honey or honey->neo) — delegated to the [LIVE] R2/R3 steps, which run capture/compare across two real hosts;
• live .git corruption catching — the self-test repos are never torn mid-reconcile, so fsck=clean there proves nothing about concurrent-write corruption. Delegated to the [LIVE] R2/R5 steps and the Facet-6 harness (scripts/git-dotgit-fsck-conflict-harness.sh, PR FACET 6: .git-as-files conflict/corruption safety for G5/TIN-1620 #506), whose G5-git-5 row is expected to fail until .git-aware conflict resolution lands.

[PR] green == the assertion engine works. [LIVE] green == the fleet actually roams with zero diff and no corruption. Do not conflate them. The gate-bearing dev-env-zero-diff=pass comes from the [LIVE] cross-host compare, not from the self-test. The runbook §6 carries the same callout.

Files

• scripts/repo-roam-fingerprint.sh — capture / compare (exit nonzero on any diff, fsck-clean required both sides) / seed-canary / self-test. Honors the fail-closed reconcile deny-set (.env*/secret/live-WAL recorded DENIED, never hashed). seed-canary refuses $HOME / ~/git / fs-root.
• scripts/test-repo-roam-fingerprint.sh — regression suite (deterministic match, drift detection, deny-set, safety refusals).
• docs/ops/repo-roam-test-plan-2026-06-08.md — the canary runbook, mapping each step R0-R5 to the existing T/M rows + TIN-1620 G5 acceptance, with [LIVE] markers for fleet-only steps (out of scope here).
• Taskfile.yaml — lazy:dev-env-fingerprint + lazy:test-dev-env-fingerprint.

Reuses vs adds

Reuses (does not duplicate): git-repo-canary.sh -> home-canary-linux-xr-shadow.sh (shadow/push, .git-as-plain-files), git-repo-restore-proof.sh (rollback), large-workdir-inventory.py, the neo-honey / TIN-1620 flip-flop lifecycle harnesses, and the docs/release/evidence/<run-id>/ packet convention. Adds exactly one new evidence subtree (dev-env-fingerprint/) and one gate line (dev-env-zero-diff=pass).

Key findings documented in the runbook

• Enrollment works as-is with NO Rust change (Facet 4): .git-as-files is config-scoped via a per-repo -c config (sync_git_dirs=true + git_sync_mode="raw") on the scheduled tcfs reconcile --path --prefix --execute unit. The global flip is forbidden (fleet-wide blast radius). An additive --sync-git-dirs flag is a nice-to-have, not required.
• Zero-diff caveats (Facet 5): the mtime/index trap (no source-mtime in SyncManifest; restored .git/index smudges on first git status) needs a git update-index --refresh mitigation; the symlink drop (reconcile.rs:1120 preserve_symlinks:false) fails T12. The fingerprint makes both visible.
• Concurrent .git corruption gate (Facet 6): raw-mode per-file .git conflict resolution can produce half-applied refs (git fsck: invalid sha1 pointer); G5-git-5 is expected-fail until resolution is .git-aware.
• Operator-review items: .git-as-files vs git-bundle tension (R4 acceptance currently bundle-based); stash as an explicit precision assertion (not a new ticket).

Validation

• shellcheck clean on both scripts.
• task lazy:test-dev-env-fingerprint passes; self-test (disposable /tmp seed -> capture -> capture -> compare + drift negative control) passes. Scope of this green: assertion-engine consistency on one host only — see the [PR] vs [LIVE] section above.
• capture is strictly read-only (must-fix): it no longer runs git write-tree (which previously wrote tree objects into <repo>/.git/objects and touched the index). Proven on a scratch /tmp repo with a staged change present — the entire .git tree is byte-for-byte identical and git status + object count are unchanged before/after capture.
• fsck gate tightened (must-fix): the corruption grep now matches genuine signals only (^error: / ^fatal: / invalid sha1 pointer / broken link) and drops broad missing / dangling.*commit matches that false-positived on healthy repos with gc'd / expired reflogs. Verified: a healthy repo emitting a lone dangling commit <sha> notice now reports fsck=clean (the old pattern flipped it dirty); a repo with an invalid sha1 pointer still reports fsck=dirty.
• No live fleet touched. READ-ONLY research + docs/scripts only.