fix(phi-scan): the all-mode sweep reads the bytes git carries, as a union with the walk

[NSchatz]

pnpm phi-scan with no arguments (the sweep CI runs) enumerated the working tree and nothing else. Where the working tree and the index disagree the walk had the only voice, so the gate could print OK, no hits at exit 0 over tracked content it never opened.

Four states reproduced on dbdf84d

Each at exit 0 with OK, no hits, over a TRACKED file holding a whole synthetic patient identity (name, DOB, SSN by OID, bare-numeric MRN, street, city, postal code, non-555 telecom):

1. The path is occupied by a DIRECTORY. git ls-files still names the path, so a path-set reconciliation cannot see it either. Only reading the object can.
2. The path is under a WALK_SKIP_DIRS NAME, matched at any depth (dist, coverage, .cache, ...).
3. 137 of 140 tracked files absent from the working tree. The floor-of-one only asks that SOMETHING was observed, and a count counts the files that DID exist.
4. A GITLINK whose working tree is absent.

ccda had NO real unscanned corpus

That is the honest finding rather than a sibling's. Measured on dbdf84d: 140 tracked, 140 enumerated by the walk, the only tracked path no sweeping route opens is the one declared literal exclusion, and all 140 index blobs are byte-identical to the working tree. The four states were reproduced, not found. The sibling "tracked files outside every walk root" shape cannot exist here: this walk has been rooted at the repo root throughout.

What changed

all mode now also scans the stage-0 blob of every tracked path whose bytes the walk did not already read. Deduplication is by CONTENT (git's own blob <len>\0 framing, under the repository's object format), so a clean checkout reads nothing twice and never invokes git cat-file; its one fixed cost is a single git rev-parse --show-object-format per run, two git calls before and three after. Where the two copies of a path differ, BOTH are scanned. That is the EOL axis: with a text attribute or core.autocrlf the index carries LF and the working tree CRLF, and neither form stands in for the other. This repo has no .gitattributes and no core.autocrlf, measured, so the union is free today.

Three refusals, all exit 2, none of which ever prints a link target: a tracked path recorded as a symbolic link or a gitlink, an unmerged path (no single merged blob), and a sweep git cannot give an index for. scripts/check-agent-notes-contract.mjs already refuses the last two states; the shape is taken from that in-repo precedent and goes one step further by naming the OBJECT rather than re-reading the path.

The positive control

The suite copies every tracked file into a throwaway repository, reproduces the clean result over it, then proves the same sweep fires on that corpus with one synthetic marker planted, once on disk (the walk half) and once committed and removed from disk so only the index can reach it (the union half). Without it, OK, no hits is indistinguishable from a scanner that stopped reading.

Review gate

conformance-refuter, two passes, REFUTED then NOT REFUTED.

Pass 1 found one INTRODUCED major inside acceptance criterion 1's own gitlink/non-blob axis: the unmerged axis did not port. --staged spots that state from --raw's status U and a destination mode of 000000, but git ls-files -s reports the path only at stages 1, 2 and/or 3, its records normally at ordinary blob modes. A draft took the first record per path and never read the stage digit it was already capturing, so it scanned stage 1, the merge base, and labelled it as the bytes git carries, and printed OK, no hits at exit 0 over a marker living only in stage 3. The union now keys on the absence of stage 0, which is shape-independent.

This slice wrote a count into prose and had it falsified three times (the routes EXCLUDED_PATHS is consulted on, the functions that consult it, and the number of records an unmerged path carries). Every one was a claim defect and none was a code defect, which is this item class's whole history. refuseUnscannable's "two groups is the ceiling" line went the same way once the union added a third group under it.

CLAUDE.md was at 6 bytes of headroom, so three passages were relocated, not deleted: two were already verbatim under the exact anchor their own bullet points at, and the third was a stale count its own neighbouring imperative forbids.

scripts/verify.sh ccda green, plus pnpm check:agent-notes (which that ladder does not know about) run by hand.

PRE-EXISTING, filed not fixed: in a submodule checkout .git is a FILE, so the walk enumerates and scans it (harmless, and more scanning than claimed); and stages 2 and 3 of an unmerged entry are read by no route, with base identically silent.