init: reinit with different --object-format silently succeeds (Git refuses), exit-code drift on repo-state errors, --separate-git-dir undocumented rejection; t0001-init coverage gaps

[genedna]

Summary

Comparing libra init flag-by-flag against git init (Git 2.55, source tree at the repo used for reference), the parameter surface is mostly aligned (--bare, -b/--initial-branch, --template, -q, --shared=, --object-format=, --ref-format=), but there are gaps worth recording.

Behavior differences found (libra 0.22.5 vs git 2.55)

1. --separate-git-dir is not implemented — libra rejects it as unexpected argument '--separate-git-dir' (LBR-CLI-002). Git creates a .git file pointing at the real dir. libra's test suite (tests/command/init_separate_libra_dir_test.rs) asserts this rejection on purpose, but there is no migration story documented for users coming from Git repos using that layout. COMPATIBILITY.md does not list it as "intentionally different".

2. Reinitialize with different hash does not fail closed — Git: git init --object-format=sha256 . on a sha1 repo → fatal: attempt to reinitialize repository with different hash (exit 128). libra: re-running libra init --object-format=sha256 inside an existing sha1 repo silently succeeds (exit 0, reinit banner, hash unchanged, no warning). A user believing they "converted" the repo will later be surprised. Git refuses loudly; libra should at least warn.

3. Exit code drift on argument/reinit errors — libra init --object-format=sha999 exits 129 (clap-style usage error); Git exits 128 (fatal: unknown hash algorithm). Likewise libra init -b 'bad..name' → exit 129 vs git exit 128. Per docs/error-codes.md conventions coarse 128 vs usage 129 may be deliberate, but for repo state failures (not CLI parsing) Git consistently uses 128; scripts keying on exit codes will misbehave.

4. init --shared=group sets mode 2775 correctly on .libra (matches Git's 2775 on .git) — verified OK.

5. Nested init behavior matches Git (a new independent repo is created in the subdirectory) — verified OK.

6. Template copy semantics match Git's "top-up, don't overwrite" (verified in copy_template, src/command/init.rs:1022), and libra additionally refuses to write through symlinked destinations — an intentional security hardening beyond Git.

Test gaps vs Git

• t/t0001-init.sh has 87 test cases; libra's tests/command/init_test.rs has 17 tests. Uncovered Git scenarios include: reinit with different --object-format (see fix compilation #2), --shared value variants (umask, all, numeric octal round-trips), template directory inheritance via GIT_TEMPLATE_DIR-style env, init --recurse-submodules-class edge cases are N/A but undocumented, and verifying that --separate-git-dir from Git repos is handled by libra init --from-git-repository.
• tests/command/clone_test.rs depth tests (test_clone_with_depth) only assert .libra exists and HEAD branch name; they do NOT verify the shallow boundary was actually respected (see the clone issue for the reproducible data-loss-adjacent breakage found there).

Evidence (commands run in /run/media/genedna/data/tmp/cmp)

$ git init -q . && git init --object-format=sha256 .
fatal: attempt to reinitialize repository with different hash   # exit 128
$ libra init --object-format=sha256 .                            # on sha1 repo
Reinitialized existing Libra repository ...                      # exit 0, no warning

$ git init -b 'bad..name' gbn
fatal: invalid initial branch name: 'bad..name'                  # exit 128
$ libra init -b 'bad..name' .
error: branch name cannot contain '..' (LBR-CLI-002)             # exit 129

$ libra init --separate-git-dir X .
error: unexpected argument '--separate-git-dir' found            # git: creates gitdir pointer file