BACK-624 - Make shared cross-branch task loading fast and incremental

[MrLesk]

Summary

• replaces repeated cross-branch fetch, indexing, and hydration with one immutable tip generation and shared commit/blob caches
• keeps working-copy tasks prompt through an exact-content parse cache and cheap warm reconciliation
• routes Web task search and statistics through the shared corpus, and moves MCP task search off it onto a Git-free working-copy index
• coalesces and bounds remote work, while preserving root/config changes, completed lifecycle state, duplicate ambiguity, branch fallbacks, and transient recovery
• adds a correctness-gated Core/MCP/Web benchmark and deterministic semantic-work regressions

Stack

• rebased onto main after BACK-623 - Make common task commands avoid unnecessary cross-branch work #898 (BACK-623) merged as aca8007; this PR now contains only the BACK-624 delta
• backlog task: BACK-624 (included and finalized in this PR)

Benchmark

Synthetic corpus: 80 active tasks, 20 completed tasks, 6 branches × 12 variants, 3 samples. Every sample validates exact counts, IDs, required/forbidden sentinels, and stable digests.

Surface	Baseline cold	This PR cold	Baseline warm	This PR warm
Core	534.49 ms / 394 Git	189.8 ms / 76 Git	554.16 ms / 394 Git	27.7 ms / 3 Git
MCP task search	531.86 ms / 394 Git	13.8 ms / 0 Git	530.65 ms / 394 Git	3.8 ms / 0 Git
Web task list	582.27 ms / 395 Git	185.3 ms / 76 Git	7.71 ms / 1 Git	16.9 ms / 1 Git

The Web warm path intentionally performs exact working-copy reconciliation so missed watcher events remain visible; it still performs no tree, history, or hydration work.

Review fix round

Three defects found in review, each reproduced before the fix and pinned by a regression test in src/test/core-task-corpus-regressions.test.ts:

1. Stale cross-branch data frozen by task creation. A standalone corpus load published the active-branch fingerprint even though its corpus was never installed into the ContentStore. In a watcher-backed (Web/MCP) process, a task creation between a branch-tip move and the next read published the moved refs on the store's behalf, so every later read compared equal fingerprints, concluded it was fresh, and served the older corpus until the next ref or config change. Only the ContentStore corpus loader now advances shared freshness state.
2. Task-ID allocation honoured the 60s remote-refresh window. Allocation could allocate an ID another clone had already published within that window. Allocation now forces a fresh bounded remote snapshot — at least as fresh as before this PR — while ordinary reads keep the coalesced window; the 10s fetch bound and offline degradation are unchanged.
3. Abort was checked after the fetch. A cancelled load (for example a TUI view switch) could wait out the fetch timeout. Cancellation is now checked before the remote refresh starts.

Allocation also reuses the completed tasks its own corpus load already listed instead of listing them a second time.

Rebase note — needs a ruling

BACK-623's post-review fix round added a test asserting the now-default cross-branch /api/tasks list performs zero filesystem.listTasks() calls. That held on main because the working-copy reconciliation only ran inside Core.getTask. This PR moves that reconciliation into the shared refreshTasksForTaskRead path so every cross-branch read — including the browser list — stays correct when a watcher event is missed, which is the behaviour the Web warm benchmark row above already reflects.

The two are deliberate and they collide. The assertion was relaxed from zero working-copy passes to exactly one cache-validated reconciliation pass; the test's intent is untouched (the branch-only task is still present by default and still absent under crossBranch=false, and the local view must still add a scan of its own). If the zero-scan property should win instead, the reconciliation has to move back off the list path and the missed-watcher-event staleness returns.

Testing

• bun run test — 2,245 passed, 6 interactive skips, 0 failures
• bunx tsc --noEmit
• bun run check .
• bun run build
• bun run benchmark:task-loading — correctness and stability gates green on every sample; warm Git process counts unchanged after the fix round (Core 3, Web 1, MCP 0) with identical digests
• all BACK-624 acceptance criteria and Definition of Done items completed

[chatgpt-codex-connector]

You have reached your Codex usage limits for security reviews. Please try again later.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ce4f32fadb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[MrLesk]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 48ecde4dc3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ce14a40243

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[MrLesk]

Ruling on the rebase note: the relaxed cost assertion stands (1 reconciliation scan on the default list path, local view must add its own). The zero-scan pin from #898 predated this PR's per-read working-copy reconciliation, which is intentional so missed watcher events self-heal in the browser; the intent assertions (store-served corpus, branch-only inclusion/exclusion) are unchanged.