[santoshkumarradha]

Summary

Materializing a snapshot containing a Unix socket (for example Git's fsmonitor socket) fails because the deliberately omitted socket looks like a concurrent edit. Even after accepting its absence during verification, the same snapshot produces a false restore plan, making an unchanged received workspace appear to contain local edits.

 missing expected socket marker
- fail restore verification and offer a socket restore
+ accept its absence and omit the nonportable restore

The plan also omits an empty parent-directory replacement when all its metadata matches. Existing Windows timestamp handling remains unchanged. Regular files, symlinks, directory metadata differences, I/O errors and parent-path safety checks retain their checks.

Evidence

• Before: Public CLI watch --no-daemon → materialize fails on v0.3.5 with workspace path changed during rewind: .git/fsmonitor--daemon.ipc. After the initial verification fix, same-head rewind --dry-run still reports the omitted socket and its unchanged parent.
  After: Materialization succeeds and the same-head plan is empty, including after watching and sealing the unchanged destination.
• The regression also verifies that ordinary edits and regular-file/symlink occupants at the socket path remain visible and untouched by preview.
• Existing concurrent-writer precondition and rollback tests pass unchanged (2 tests); the existing symlink-parent escape test passes unchanged.
• Core library tests: 174 passed, 1 existing ignored. Formatting and diff checks pass.

Merge Danger

Door: two-way

Blast Radius: restore

Only a missing current entry with an expected socket marker is omitted from recursive comparison. Empty parent pruning requires matching metadata; actual child changes still retain the parent's restore. No release or downstream dependency update is included.

[santoshkumarradha]

@AbirAbbas please review and merge this socket portability fix when satisfied. Linux, macOS and Windows CI pass. The public CLI regression covers materialization and an empty same-head restore plan; existing concurrent-writer and symlink-parent protections pass unchanged.

The fixed candidate also restored a real chat workspace through repeated public-internet transfers and allowed actual read/edit/publish and readback on the receiving device. The follow-up does not demonstrate an end-to-end latency improvement in the balanced comparison; its justification is correctness. Integration evidence.

Release order for CodeAF #2162: review/merge this PR, publish a release through the normal pipeline, then update CodeAF's currently unchanged 0.3.5 pin and verify the normally installed engine before merging CodeAF. Candidate-binary testing does not replace that final release check.

[AbirAbbas]

Verified on 25beda1 before merging; this is the furrow fix CodeAF#2162 waits on.

• Built furrow from this head and from v0.3.5, then ran a git repo with a live .git/fsmonitor--daemon.ipc socket through watch --no-daemon → seal → materialize with each. v0.3.5 fails with workspace path changed during rewind: .git/fsmonitor--daemon.ipc and restores the pre-rewind state. This head materializes. The same-head rewind --dry-run plan is empty right after materializing, after watch, and after sealing the destination.
• Nothing else got looser. A regular file or a symlink at the socket's path is still reported and left untouched by preview. Directory metadata (an xattr) is still a change, a directory read error still fails, and safe_join/ensure_safe_parent still run first. Only an absent current entry against a SocketMarker target is skipped, and only NotFound is accepted.
• Two-way: v0.3.5 opens, seals and previews a workspace this build materialized.
• cargo fmt --check, cargo clippy -D warnings, socket_materialize 3/3, furrow-core --lib, the cli interference and symlink-parent-escape tests all pass. CI is green on macOS, Linux and Windows.

Next: furrow 0.3.6 gets cut with this fix.