Git browser: cache list_status by index mtime

- New process-global `RwLock<HashMap<RepoRoot, CachedStatus>>` in `status.rs`. One full-repo `git status --porcelain=v2 -z --untracked-files=normal` per `.git/index` mtime change. Subsequent calls slice the cached map by `dir_in_worktree` in memory.
- Watcher invalidates the snapshot in `recompute_and_emit` (any `.git/*` mutation drops the cache; the next call repopulates) and on the last unsubscribe so unwatched repos don't pin a snapshot forever.
- Always run with `--untracked-files=normal`. Decision noted in `CLAUDE.md`: with the cache, the untracked walk is amortized; the earlier "skip outside root" sketch buys nothing.
- Tests: 4 slice tests (root, descendants, lookalikes, self-dir), 4 cache tests (hit, mtime invalidate, explicit invalidate, slice-from-cache).
- Bench split into cold + warm paths. On the 50k-file fixture: cold p50=84 ms / p95=99 ms, warm p50=15 µs / p95=18 µs (~5500× faster on cache hits).

Author: vdavid

apps/desktop/src-tauri/src/file_system/git/CLAUDE.md

@@ -29,7 +29,7 @@ three new error variants (`ShallowBoundary`, `MissingObject`,
 | `submodules.rs` | `list_submodules` – gix `Repository::submodules()`. Each entry sets `redirect_to_path` to `<repo_root>/<rel-path>` |
 | `tree.rs` | `list_tree`, `get_tree_entry`, `lookup_blob_id`, `read_blob` – gix tree walks. Permissions reflect `EntryKind::BlobExecutable` so cross-volume copy preserves the executable bit |
 | `read_blob.rs` | `GitBlobReadStream` – owns the full `Vec<u8>` and yields 256 KB chunks. See *Honest blob streaming* below |
-| `status.rs` | `list_status(repo, dir)` shells out to `git status --porcelain=v2 -z`. Parses the output into a `Vec<EntryStatus>` |
+| `status.rs` | `list_status(repo, dir)` runs a full-repo `git status --porcelain=v2 -z` once per `.git/index` mtime, caches the result in a process-global `RwLock<HashMap<RepoRoot, CachedStatus>>`, and slices it by `dir`. The watcher invalidates the snapshot whenever `.git/*` changes. Parses porcelain v2 in `parse_porcelain_v2`. |
 | `watcher.rs` | `GitWatcherRegistry` – per-repo notify-rs debouncer. `subscribe(app, root)` returns the current `RepoInfo` synchronously and emits `git-state-changed` on relevant `.git/*` mutations. 200 ms debounce. M2: also calls `notify_directory_changed(.., FullRefresh)` for any cached `.git/{branches,tags}/` listings on the local volume |
 | `friendly.rs` | `FriendlyGitError`, `FriendlyGitErrorKind` – ten variants (M1's six, `BlobTooLarge` from M2, plus M4's `ShallowBoundary`, `MissingObject`, `GitDirPermissionDenied`). Active-voice copy, no "error" / "failed". `to_friendly_error()` builds a `volume::FriendlyError` for `ErrorPane`; `encode_for_volume_error()` + `try_decode_git_friendly()` carry the structured payload through `VolumeError::IoError` so the streaming pipeline rebuilds it on the way out |
 | `column_meta.rs` | Per-row column-population helpers shared across `virtual_listing`, `log`, `tree`, etc. — `pluralize`, `ahead_behind_for_branch`, `commit_meta`, `files_changed_count`, `recursive_tree_size`, plus newest-of-set helpers for category-level Modified dates |
@@ -146,6 +146,29 @@ The frontend reads `display_size` / `display_size_tooltip` from `FileEntry`; the
 
 ## Decisions
 
+**Decision (M4 follow-up)**: Cache `list_status` results keyed by `.git/index` mtime
+**Why**: Status used to walk the worktree on every `listing-complete` (every nav,
+every diff). On a 50k-file repo that's ~75 ms per nav. We now run one full-repo
+walk per index change, store the result in a process-global
+`RwLock<HashMap<RepoRoot, CachedStatus>>`, and slice by `dir_in_worktree` on
+each call. Cached calls land sub-millisecond on the same fixture (warm p95 in
+the bench is bounded by an arbitrary 5 ms ceiling so a busy CI doesn't flake).
+The watcher (`watcher.rs::recompute_and_emit`) drops the cache entry on every
+`.git/*` mutation it observes, so the next call repopulates. The
+`unsubscribe`-on-last-pane path also drops the entry so an unwatched repo
+doesn't pin a full-repo-sized snapshot.
+
+**Decision (M4 follow-up)**: Always run with `--untracked-files=normal`, no
+"skip untracked outside the worktree root" trick
+**Why**: An earlier sketch had us pass `--untracked-files=no` when the caller
+scoped to a sub-path inside the worktree, on the theory that listing a deep
+subdir doesn't need the full untracked walk. With the cache above, the
+untracked walk runs once per index change anyway and the cost is amortized
+across every subsequent listing — the extra complexity (two code paths,
+mismatched cache keys for the same repo) buys nothing measurable. We always
+walk the full worktree with `--untracked-files=normal` and let the cache do
+the work.
+
 **Decision (M4)**: Live-toggleable portal via a process-global `AtomicBool`
 **Why**: `try_route_listing` / `try_route_metadata` / `try_open_blob_stream`
 each early-return `None` when the toggle is off, falling through to the

apps/desktop/src-tauri/src/file_system/git/bench.rs

@@ -117,27 +117,44 @@ fn bench_50k_files_discover_and_repo_info_under_budget() {
 #[test]
 #[ignore = "Builds a 50k-file fixture – opt-in via `cargo test -- --ignored`"]
 fn bench_50k_files_list_status_under_budget() {
+    use super::status::invalidate_status_cache;
     let dir = fixture_dir();
     ensure_fixture(&dir);
 
-    let (handle, _root) = discover_repo(&dir).expect("discover");
-    // Warm-up: gix's caches and the OS page cache.
-    let _ = list_status(&handle, &dir);
+    let (handle, root) = discover_repo(&dir).expect("discover");
 
-    let mut samples_us = Vec::with_capacity(RUNS);
+    // ── Cold path: invalidate before each run so we measure a real walk.
+    let mut cold_us = Vec::with_capacity(RUNS);
     for _ in 0..RUNS {
+        invalidate_status_cache(&root);
         let start = Instant::now();
         let _entries = list_status(&handle, &dir).expect("status");
-        samples_us.push(start.elapsed().as_micros());
+        cold_us.push(start.elapsed().as_micros());
     }
-    let p95_us = percentile(samples_us.clone(), 95.0);
-    let p50_us = percentile(samples_us.clone(), 50.0);
+    let cold_p95 = percentile(cold_us.clone(), 95.0);
+    let cold_p50 = percentile(cold_us.clone(), 50.0);
     eprintln!(
-        "list_status: p50={}ms p95={}ms (budget 100 ms)",
-        p50_us / 1000,
-        p95_us / 1000
+        "list_status (cold, full walk): p50={}ms p95={}ms (budget 100 ms)",
+        cold_p50 / 1000,
+        cold_p95 / 1000
     );
-    assert!(p95_us / 1000 <= 100, "p95 over budget: {}ms", p95_us / 1000);
+    assert!(cold_p95 / 1000 <= 100, "cold p95 over budget: {}ms", cold_p95 / 1000);
+
+    // ── Warm path: walk once, then time cache hits. Should be sub-millisecond.
+    invalidate_status_cache(&root);
+    let _ = list_status(&handle, &dir).expect("warmup");
+    let mut warm_us = Vec::with_capacity(RUNS);
+    for _ in 0..RUNS {
+        let start = Instant::now();
+        let _entries = list_status(&handle, &dir).expect("status");
+        warm_us.push(start.elapsed().as_micros());
+    }
+    let warm_p95 = percentile(warm_us.clone(), 95.0);
+    let warm_p50 = percentile(warm_us.clone(), 50.0);
+    eprintln!("list_status (warm, cached): p50={}µs p95={}µs", warm_p50, warm_p95);
+    // Warm path is in-memory slice + mtime stat. Allow generous 5 ms ceiling
+    // so a busy CI box doesn't flake; in practice this lands under 1 ms.
+    assert!(warm_p95 <= 5_000, "warm p95 over 5ms: {}µs", warm_p95);
 }
 
 // ── Modified + Size column population bench (M4 follow-up) ──────────