Entire-Checkpoint: dc4592acaadf

Entire-Checkpoint: fb6dc8f73ee0

Entire-Checkpoint: 80a4babf00ee

This allows to "sign" the conversion.

Entire-Checkpoint: 1857d92ce8c7

golangci-lint v2.11.4 was unhappy across errcheck, exhaustive,
gocritic, inamedparam, ireturn, maintidx, noctx, perfsprint, revive,
and wrapcheck. Mostly mechanical:

- Test helpers (initSHA1, initSHA256, mustTranslator) collapse the
  '_ :=' patterns into t.Fatalf-on-error wrappers.
- exec.Command -> exec.CommandContext(ctx, ...); ctx threaded into
  runChecks and signBranchTips.
- refs.ForEach return value checked instead of discarded.
- if/else chain in runChecks rewritten as switch.
- ireturn for openSource/normalizeAuth annotated, since both return
  shared transport interfaces by design.
- maintidx on Run annotated; the function is a phase orchestrator,
  splitting it would obscure the pipeline.
- exhaustive switches on plumbing.ObjectType annotated; the
  unhandled cases (OFSDelta/REFDelta/AnyObject/InvalidObject) can't
  reach a resolved storer.
- Errors from io.ReadAll/MemoryObject.Reader/bufio.Flush/fmt.Fprintln/
  auth.Method.Authorizer wrapped with fmt.Errorf.
- Constant 'max' renamed to package-level 'previewMax' to stop
  shadowing the builtin in two places.
- Named parameter added to interface methods that lint flagged.
- Two fmt.Sprintf calls replaced with string concatenation.

Entire-Checkpoint: 43bf90985cc5

Substring-matching "error" against the full fsck output could
false-positive on benign dangling/warning lines that happened
to contain that word (e.g. a branch or path with "error" in
it). Scan line-by-line for "error:" / "fatal:" / "missing "
/ "broken link" / "bad " prefixes, which is what git itself
uses to signal real problems.

Entire-Checkpoint: f16d85f433d8

translate() is the single recursive entry point invoked from
the tree-entry, commit-parent, tag-target, and message-ref
loops. Check ctx.Err() at the top so Ctrl-C during a
kernel-scale conversion returns promptly instead of running
the whole DFS to completion. ctx is plumbed through
newTranslator and stored on the translator (signatures of the
many translateX helpers stay untouched).

Entire-Checkpoint: 354e2e640545

Some HTTP v1 servers don't return HEAD in their info/refs.
Previously HEAD was left at PlainInit's default refs/heads/master,
which then fails the --check HEAD step on any main-default repo.
pickHEAD now selects in order: server-advertised HEAD (resolved via
the matched DesiredRef.TargetRef so user-supplied ref mappings are
honored), refs/heads/main, refs/heads/master, then the
lexicographically first branch. Tags-only conversions still leave
HEAD at the PlainInit default since there's no sensible branch to
point at.

Entire-Checkpoint: 161329c78d89

- signBranchTips: explain the os.Stderr departure from req.Out;
  TTY inheritance is required for gpg/ssh-agent prompts.
- Don't double-count when a commit/tag has both Signature and
  SignatureSHA256 (two encodings of the same signature). Relabel
  the warning to "signature(s) / mergetag header(s)" so the count
  matches what it actually represents.
- writeOriginNotes now honors SOURCE_DATE_EPOCH and otherwise
  pins the wrapper-commit timestamp to the Unix epoch, so the
  notes-ref hash is reproducible across runs over identical
  source state. The timestamp is bookkeeping; it carries no
  information about the underlying SHA1 history.
- writeLoose uses zlib level 1, matching git's
  core.looseCompression default — loose objects are short-lived
  before gc packs them, so write speed > size.
- Clarify encodeBody's "scratch MemoryObject" comment so the
  unused format argument is no longer mystifying on re-read.

Entire-Checkpoint: cabf3e19b5f2

The convert-sha256 docs promise that every branch and tag is
always converted, since dropping any of them risks stranding
cross-branch SHA1 references in commit and tag messages — the
exact invariant the message-rewrite pass exists to maintain.
The previous code piped req.ExcludeRefPrefixes straight into
planner.BuildDesiredRefs, which applies it to branch and tag
selection too, so the flag silently broke the promise.

Validate at the top of Run: refuse any prefix that, under the
planner's HasPrefix matching, would catch a refs/heads/* or
refs/tags/* name. The check covers bare "", "refs/", partial
"refs/h", whole "refs/heads/" / "refs/tags/", and any sub-
namespace under either. Help text on convert-sha256 now also
calls the rejection out.

Entire-Checkpoint: ec9a87c6c8f1

writeRefs lands the source ref set on the target, then
writeOriginNotes and signBranchTips publish their own refs on
top. A source repo that already advertised refs/notes/sha1-origin
(under --all-refs) or any refs/tags/converted/* (always, since
tags are mandatory) would have those refs silently clobbered.

Add checkSideOutputCollision: run after planner.BuildDesiredRefs
and before any object work, refusing with an actionable message
that names the offending ref(s) and points at --no-origin-notes
/ --exclude-ref-prefix / dropping --sign as escapes.

Also tighten --check to skip *only* the side-output refs we
actually wrote: pass the {origin notes, signed tags} set into
runChecks instead of pattern-matching by prefix, so a legitimate
source ref that happened to share a namespace is not silently
hidden from the resolved/expected fraction.

Entire-Checkpoint: 250149a84f90

CI-blocking gofmt diff on the refs/notes/sha1-origin row.

Entire-Checkpoint: 0ae6b701b541

The previous code assigned args[0] to SourceURL and args[1] to
TargetDir unconditionally, so `--source-url <url> <dir>` left
TargetDir empty (len(args) == 1, so args[1] was never read) and
failed the "requires a source URL and a target directory" check.

Consume positionals left-to-right against fields the user has
not yet supplied via flags. The four flag/positional shapes
(zero/one/two flags) now all yield the correct assignment.
Extracted into resolveConvertSHA256Args for a unit test that
covers every shape including the regression case.

Entire-Checkpoint: 60184126410a

These are project-wide transport/auth interfaces, the same
shape as the auth.Method entry that's already on the ireturn
allowlist. Without the entries, mise run lint (which runs
golangci-lint --fix) was racing: nolintlint stripped the
//nolint:ireturn directives on openSource / normalizeAuth /
newConn before ireturn flagged the functions, leaving lint red
on every run. With the types allowed by policy, the directives
become dead weight — drop them so the source documents intent
once, in .golangci.yaml.

Entire-Checkpoint: 9fa947bf886d

5. discoverReachable now takes ctx and checks ctx.Err() at the
   top of every visit. Without it, Ctrl-C during the multi-minute
   discovery phase on kernel-scale repos was ignored — exactly
   the case the per-translate() check was added for.

6. writeLoose: document the durability tradeoff. No fsync, by
   design — convert-sha256 is a one-shot bulk operation, not
   incremental, processes millions of objects, and Run wipes the
   target on error so the only supported recovery is rerunning
   from clean state.

7. Target directory cleanup on error. ensureEmptyTarget refuses
   to write into a non-empty dir; without this fix, any failure
   after PlainInit left config/HEAD/refs behind and blocked a
   retry with no recovery hint. New deferred cleanup arms after
   PlainInit, disarms on success, and is suppressed by
   --keep-source-objects so users can inspect partial state.
   A --check failure also disarms cleanup since the conversion
   itself finished and the partial target is what the user needs
   to inspect.

8. hashPattern is now case-insensitive ((?i) prepended), and
   resolveMessageRef lowercases the input before lookup. An
   uppercase/mixed-case SHA1 reference in a commit or tag
   message is now rewritten the same as a lowercase one.

9. Check gained a Skipped bool. Skipped implies OK so callers
   gating on OK still treat it as non-fatal; callers needing a
   stricter audit signal can branch on Skipped first. Applied
   to the fsck-when-git-missing and HEAD-on-tags-only paths,
   with a "○" glyph in the progress output to distinguish from
   real passes.

Tests cover discovery cancellation, fsck skipped, uppercase
hash rewrite, and the existing tag-only HEAD check rewritten
against the Skipped field.

Entire-Checkpoint: 248018a9dd16

…ose, memoization

10. fsckHasError used bufio.Scanner with the default 64 KiB buffer,
    so a single long line (paths in repository-scale fsck output)
    would silently truncate and we'd miss whatever followed it.
    Switch to bytes.Split on raw newlines.

11. discoverReachable was recursive, which on long linear chains
    (kernel-scale: ~70k commits on the deepest single-parent path)
    grew the goroutine stack into the tens of MiB. Iterativize
    with an explicit work stack — memory now scales with the
    in-flight frontier, not the longest chain. translate() stays
    recursive: its edges are dynamic (tree entries + commit parents
    + tag targets + message-reference edges resolved against the
    in-progress mapping), and rewriting it would risk silent
    corruption of message rewrites. Documented the rationale and
    the depth math.

12. translator.dst was set in newTranslator but never read — a
    landmine inviting a future contributor to call go-git's
    SHA1-hardcoded SetEncodedObject. Field removed; the type
    assertion stays (with `_`) so a memory-backed dst is still
    refused with a clear error.

13. fsckHasError's error-line matcher was prefix-only and case-
    sensitive ("error:" / "fatal:"). Broaden to any line whose
    first token starts with "error" or "fatal" (case-insensitive),
    keep the "missing "/"broken link"/"bad " object reports for
    older git. Closer to the previous substring match's coverage
    without the path-substring false positive.

14. writeMappingFile dropped Close errors via a deferred Close.
    On NFS or quota-bound filesystems write failures surface at
    close time, not flush time, so the caller would think the
    mapping landed when it hadn't. Explicit Close on the success
    path, with the deferred Close kept as a best-effort net for
    the failure path.

15. resolveMessageRef ran a full O(len(reachable)) scan for every
    short hash prefix, hit twice per token (once by
    extractMessageReferences, once by rewriteHashesInMessage).
    reachable is frozen before translation starts, so the
    (prefix → matchResult) mapping is stable; memoize it on the
    translator. Halves the documented quadratic ceiling on
    message-token resolution.

Tests cover the long-line + case-insensitive fsck path and the
resolveMessageRef cache (second call returns the cached answer
even after reachable is mutated).

Entire-Checkpoint: bc9f9981f089