Beagle SCM

DIS-023: be status is non-idempotent — a re-run hides real modifications

Two consecutive be status runs with NO intervening edit or commit report different results: ? 1057 ok, 4 mod then ? 1061 ok. The dirty gate is mtime-only and re-stamps on read, so the first status records the current mtimes and the second sees them as matching → the 4 genuinely-modified tracked files are silently reported clean. The goal: status is idempotent and a modified file stays mod until it is actually committed; equality is confirmed by content hash, not just mtime. Shares its root with DIS-004 (mtime-only gate, no hash double-check). See Sniff.

Issues

The status/dirty check trusts mtime and rewrites the stamp during a read-only status.

• ? 1057 ok, 4 mod → ? 1061 ok across two back-to-back be runs, no commit between — the 4 mod files flip to ok.
• A read-only status must not mutate the stamp-set; today it does, so the second run loses the modification.
• Same mtime-only gate as DIS-004: drift is resolved by re-stamping instead of a content-hash double-check.

Blockers

None; needs the baseline-tree path→sha lookup for the content double-check (the same one DIS-004 needs).

Planned

Make status read-only and confirm modification by content hash, repro-first.

• Repro (rule 17): modify a tracked file, run be (status) TWICE; the file must stay mod on both runs (no flip to ok), no commit.
• Find the status dirty path (sniff status / SNIFFAtKnown(mtime) + stamp write); on mtime drift, hash the on-disk bytes vs the baseline blob sha — equal → clean, differ → mod; do NOT rewrite the stamp during a read-only status.
• Reuse the DIS-004 baseline-tree path→sha helper if present; otherwise factor it shared (CLAUDE.md §13).

Outcome

ALREADY RESOLVED on the current tree — closed without a new commit (2026-06-25).

• Status routes the CLASS_BOTH verdict through CLASSWtState (sniff/CLASS.c:359-374),

  which calls CLEAN only when on-disk bytes hash to the baseline blob via CLASSWtEqBase (content-confirmed, never mtime-only) and writes no stamp; the invocation is opened read-only (sniff/SNIFF.cli.c:102-105). The shared scan SNIFFAtScanDirty does the same double-check.

• Repro test already present + green: sniff/test/idempotent.sh (SNIFFidempotent, registered sniff/test/CMakeLists.txt:38) — modify, status twice, assert files stay mod; incl. the touch -r mtime-restored trap. Live two-run check: 4 ok, 4 mod both runs; wtlog sha256 byte-identical (read-only).
• Reuses the DIS-004 CLASSWtEqBase helper as the ticket asked; already factored shared. No DIS-023-labelled commit in be log; landed with the CLASS content-check work.