CODE-058: fsw cache: a failed armDir leaves the tree armed and rev() lies

Now: OPEN
Sev: MED
Rep: ///bee
Ask: gritzko
Rev: ///bee#8cb69a0
See: BEE-027
See: BEE-048
See: BEE-009

Input

Context

index/cache.js:119:_S-126 armDir returns silently when fsw.dir fails and :144-170 armTree reports over only for MAXDIRS, so arm() records the tree as armed and :219 rev() hands back a real rev for a tree with unwatched subdirs. Confirmed: a chmod 000 subdir, later edited, never bumps the rev. The same path fires on inotify ENOSPC — arming ~/src/linux alone takes 6203 of 122563 watches. That is the missed-event-read-as-truth the file's own ruling forbids, and it feeds wtstat's memo and index.js's TIPS/LANES ctx cache under bee http. Also :191 S.owner is single-valued, so the second of two linked worktrees sharing a gitdir overwrites the lane dir's owner and a seal bumps only one root. Found in the 2026-09-18 index review.

Goals

armTree returns false on any armDir failure so the tree goes to S.big and hands out a token; S.owner holds a Set of roots per dir.

WIP

TODOs

[v] repro: unreadable subdir, edit inside, rev unchanged
[v] partial arm = big
[v] owner set per dir

Design decisions

A failed armDir is the MAXDIRS fact: armTree says false, the tree lands in S.big and rev() owes a token, so a dir fsw refused is never read as a clean tree.
That verdict holds for the run, as MAXDIRS already did: a dir that vanished mid-walk blinds its tree till the process ends. Say the word if a partly armed tree should retry.
S.owner is a Set per dir, filled by owners(); bump stamps every root in it, so one lane dir speaks for every linked worktree sharing it.

Blockers and bummers

A linked worktree's REF moves stay unwitnessed: armRepo walks <gitdir>/refs, empty for a linked tree, while its branch lives in the COMMON .git/refs. The Set now carries such a dir to every root that armed it, but no linked worktree arms one at all. Wants a ticket of its own (BEE-048 scope).