c9ee615a

Link commits to issues and add auto-sync, search and patch checkout

a73x 2026-08-08 17:57

Commit message

Link commits to issues and add auto-sync, search and patch checkout

.gitignore

Old		New
@@ -1,2 +1,3 @@
1	/target	1	/target
2	/man	2	/man
		3	/.claude/worktrees/

docs/superpowers/plans/2026-04-12-commit-issue-link.md

@@ @@ -0,0 +1,1663 @@ @@
+# Auto-Link Commits to Issues Implementation Plan
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+**Goal:** During `git-collab sync`, scan all local branches for commits whose messages contain an `Issue: <id>` trailer and emit idempotent `issue.commit_link` events on the matching issue DAGs, then render them under the issue in both the CLI and TUI.
+**Architecture:** One new event variant `Action::IssueCommitLink { commit }`. One new module `src/commit_link.rs` holding a pure trailer parser, a per-issue linked-SHA helper, and a `scan_and_link` orchestrator that walks `refs/heads/*`, dedups per-sync via `HashSet<Oid>`, and lazily reads each matched issue's event log for a cross-sync `HashMap<RefName, HashSet<String>>` dedup cache. `sync::sync` calls `scan_and_link` after `reconcile_refs("patches")` and before `collect_push_refs`, so any new link events are pushed in the same sync. `IssueState` gains a `linked_commits: Vec<LinkedCommit>` field populated by `from_ref_uncached`, which dedups by commit SHA at materialization time (the walk is topo-oldest-first, so the first-seen event wins). Both the CLI `issue show` and the TUI issue-detail widget render a new `--- Linked Commits ---` section under `--- Comments ---`.
+**Tech Stack:** Rust 2021, git2 0.19, serde 1, ed25519-dalek 2. No new dependencies — trailer parsing is hand-rolled string matching (no regex crate in this project).
+**Spec reference:** `docs/superpowers/specs/2026-04-12-commit-issue-link-design.md`
+---
+## File Structure
+| File | Role |
+|------|------|
+| `src/event.rs` | **Modify.** Add `Action::IssueCommitLink { commit }` variant. |
+| `src/state.rs` | **Modify.** Add `LinkedCommit` struct, `IssueState::linked_commits` field, materializer arm in `from_ref_uncached` with dedup. |
+| `src/commit_link.rs` | **Create.** Pure trailer parser, `collect_linked_shas`, `scan_and_link`. |
+| `src/lib.rs` | **Modify.** Declare the `commit_link` module. Add `--- Linked Commits ---` rendering to the `IssueCmd::Show` handler. |
+| `src/sync.rs` | **Modify.** Call `commit_link::scan_and_link` between `reconcile_refs("patches")` and `collect_push_refs`. |
+| `src/tui/widgets.rs` | **Modify.** Add `--- Linked Commits ---` section to `build_issue_detail` after comments. |
+| `tests/common/mod.rs` | **Modify.** Add `add_commit_link` helper mirroring `add_comment`. |
+| `tests/commit_link_test.rs` | **Create.** Unit tests for `parse_issue_trailers` (table-driven). |
+| `tests/sync_test.rs` | **Modify.** Add integration tests for the full sync→link flow. |
+---
+## Task 1: Add the `IssueCommitLink` event variant
+**Files:**
+- Modify: `src/event.rs` (after `Action::IssueReopen` at line 58)
+- Test: `tests/commit_link_test.rs` (new — start the file here)
+- [ ] **Step 1: Create the test file with a serde round-trip test that will fail because the variant doesn't exist yet**
+Create `tests/commit_link_test.rs`:
+```rust
+//! Unit tests for src/commit_link.rs and the Action::IssueCommitLink variant.
+use git_collab::event::{Action, Author, Event};
+fn test_author() -> Author {
+    Author {
+        name: "Alice".to_string(),
+        email: "alice@example.com".to_string(),
+    }
+}
+#[test]
+fn issue_commit_link_variant_round_trips() {
+    let event = Event {
+        timestamp: "2026-04-12T12:00:00Z".to_string(),
+        author: test_author(),
+        action: Action::IssueCommitLink {
+            commit: "4b2e1cd0123456789012345678901234567890ab".to_string(),
+        },
+        clock: 3,
+    };
+    let json = serde_json::to_string(&event).expect("serialize");
+    assert!(
+        json.contains("\"type\":\"issue.commit_link\""),
+        "expected serde tag issue.commit_link, got: {}",
+        json
+    );
+    assert!(
+        json.contains("\"commit\":\"4b2e1cd0123456789012345678901234567890ab\""),
+        "expected commit field, got: {}",
+        json
+    );
+    let parsed: Event = serde_json::from_str(&json).expect("deserialize");
+    match parsed.action {
+        Action::IssueCommitLink { commit } => {
+            assert_eq!(commit, "4b2e1cd0123456789012345678901234567890ab");
+        }
+        other => panic!("expected IssueCommitLink, got {:?}", other),
+    }
+}
+```
+- [ ] **Step 2: Run the test and confirm it fails**
+Run: `cargo test --test commit_link_test issue_commit_link_variant_round_trips`
+Expected: FAIL with `no variant or associated item named 'IssueCommitLink' found for enum 'Action'` (or similar).
+- [ ] **Step 3: Add the variant to `src/event.rs`**
+Open `src/event.rs`. Locate `Action::IssueReopen` (around line 58). After it (before the `PatchCreate` variant), insert:
+```rust
+    #[serde(rename = "issue.commit_link")]
+    IssueCommitLink {
+        commit: String,
+    },
+```
+- [ ] **Step 4: Run the test and confirm it passes**
+Run: `cargo test --test commit_link_test issue_commit_link_variant_round_trips`
+Expected: PASS.
+- [ ] **Step 5: Run the full test suite to verify nothing regressed**
+Run: `cargo test`
+Expected: PASS. If any pre-existing `match event.action { ... }` now warns about a non-exhaustive pattern, that's only a warning — it's caught by the `_ => {}` arm already present at `src/state.rs:339` and `src/state.rs:551`. Don't silence warnings here; later tasks will add explicit arms where needed.
+- [ ] **Step 6: Commit**
+```bash
+git add src/event.rs tests/commit_link_test.rs
+git commit -m "Add Action::IssueCommitLink event variant
+Introduces the new event kind that will be emitted during sync when a
+commit's message contains an Issue: trailer. Variant only; no emission
+sites or renderers yet."
+```
+---
+## Task 2: Extend `IssueState` with `linked_commits` and populate with dedup
+**Files:**
+- Modify: `src/state.rs` (struct definition around line 85, materializer around line 237)
+- Modify: `tests/common/mod.rs` (add `add_commit_link` helper for reuse)
+- Test: `tests/commit_link_test.rs` (extend with materializer tests)
+- [ ] **Step 1: Add the `add_commit_link` test helper**
+Open `tests/common/mod.rs`. After `add_comment` (around line 229), add:
+```rust
+/// Append an IssueCommitLink event to an issue ref. Returns the new DAG tip OID.
+pub fn add_commit_link(
+    repo: &Repository,
+    ref_name: &str,
+    author: &Author,
+    commit_sha: &str,
+) -> git2::Oid {
+    let sk = test_signing_key();
+    let event = Event {
+        timestamp: now(),
+        author: author.clone(),
+        action: Action::IssueCommitLink {
+            commit: commit_sha.to_string(),
+        },
+        clock: 0,
+    };
+    dag::append_event(repo, ref_name, &event, &sk).unwrap()
+}
+```
+- [ ] **Step 2: Write a failing test for the materializer**
+Append to `tests/commit_link_test.rs`:
+```rust
+use git2::Repository;
+use git_collab::state::{self, IssueState};
+use tempfile::TempDir;
+mod common;
+use common::{add_commit_link, alice, init_repo, open_issue, ScopedTestConfig};
+fn sha(byte: u8) -> String {
+    format!("{:02x}{}", byte, "00".repeat(19))
+}
+#[test]
+fn issue_state_surfaces_commit_links_in_order() {
+    let _config = ScopedTestConfig::new();
+    let dir = TempDir::new().unwrap();
+    let repo = init_repo(dir.path(), &alice());
+    let (ref_name, id) = open_issue(&repo, &alice(), "bug");
+    add_commit_link(&repo, &ref_name, &alice(), &sha(0xaa));
+    add_commit_link(&repo, &ref_name, &alice(), &sha(0xbb));
+    let issue = IssueState::from_ref_uncached(&repo, &ref_name, &id).unwrap();
+    let commits: Vec<&str> = issue
+        .linked_commits
+        .iter()
+        .map(|lc| lc.commit.as_str())
+        .collect();
+    assert_eq!(commits, vec![sha(0xaa), sha(0xbb)]);
+}
+#[test]
+fn issue_state_dedups_commit_links_by_sha_keeping_earliest() {
+    let _config = ScopedTestConfig::new();
+    let dir = TempDir::new().unwrap();
+    let repo = init_repo(dir.path(), &alice());
+    let (ref_name, id) = open_issue(&repo, &alice(), "bug");
+    // Two different emitters link the same commit. First-seen should win.
+    add_commit_link(&repo, &ref_name, &alice(), &sha(0xcc));
+    let bob_link = common::bob();
+    add_commit_link(&repo, &ref_name, &bob_link, &sha(0xcc));
+    let issue = IssueState::from_ref_uncached(&repo, &ref_name, &id).unwrap();
+    assert_eq!(issue.linked_commits.len(), 1);
+    assert_eq!(issue.linked_commits[0].commit, sha(0xcc));
+    assert_eq!(issue.linked_commits[0].event_author.name, "Alice");
+}
+```
+Note: `mod common;` inside `tests/commit_link_test.rs` references `tests/common/mod.rs` via the shared test-helper convention already used in `tests/sync_test.rs:8`.
+- [ ] **Step 3: Run the tests and confirm they fail**
+Run: `cargo test --test commit_link_test issue_state_surfaces_commit_links_in_order issue_state_dedups_commit_links_by_sha_keeping_earliest`
+Expected: FAIL — `IssueState` has no `linked_commits` field.
+- [ ] **Step 4: Add `LinkedCommit` and the `linked_commits` field**
+Open `src/state.rs`. After the `Comment` struct (ends around line 82), add:
+```rust
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct LinkedCommit {
+    /// Full 40-char commit SHA from the trailer.
+    pub commit: String,
+    /// Author of the `IssueCommitLink` event (who ran sync).
+    pub event_author: Author,
+    /// Timestamp of the `IssueCommitLink` event.
+    pub event_timestamp: String,
+}
+```
+In the `IssueState` struct (around line 85), add a new field at the end (keep `relates_to` last is fine; add `linked_commits` just before `relates_to`):
+```rust
+    #[serde(default)]
+    pub linked_commits: Vec<LinkedCommit>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub relates_to: Option<String>,
+```
+`#[serde(default)]` ensures older cached `IssueState` JSON (which has no `linked_commits` key) still deserializes.
+- [ ] **Step 5: Initialize the field in the `IssueOpen` arm of `from_ref_uncached`**
+In `src/state.rs:256`, locate the `Action::IssueOpen { ... } => { state = Some(IssueState { ... }); }` block and add `linked_commits: Vec::new(),` alongside the existing `comments: Vec::new(),` initialization:
+```rust
+                Action::IssueOpen { title, body, relates_to } => {
+                    state = Some(IssueState {
+                        id: id.to_string(),
+                        title,
+                        body,
+                        status: IssueStatus::Open,
+                        close_reason: None,
+                        closed_by: None,
+                        labels: Vec::new(),
+                        assignees: Vec::new(),
+                        comments: Vec::new(),
+                        linked_commits: Vec::new(),
+                        created_at: event.timestamp.clone(),
+                        last_updated: String::new(),
+                        author: event.author.clone(),
+                        relates_to,
+                    });
+                }
+```
+- [ ] **Step 6: Add an `IssueCommitLink` arm to the materializer**
+Still in `from_ref_uncached`, before the catchall `_ => {}` arm (around line 339), add:
+```rust
+                Action::IssueCommitLink { commit } => {
+                    if let Some(ref mut s) = state {
+                        // Render-time dedup by commit SHA. The revwalk is
+                        // topo-oldest-first (Sort::TOPOLOGICAL | Sort::REVERSE),
+                        // so the first event we see for a given SHA is the
+                        // earliest emission — exactly what the spec requires.
+                        if !s.linked_commits.iter().any(|lc| lc.commit == commit) {
+                            s.linked_commits.push(LinkedCommit {
+                                commit,
+                                event_author: event.author.clone(),
+                                event_timestamp: event.timestamp.clone(),
+                            });
+                        }
+                    }
+                }
+```
+- [ ] **Step 7: Run the tests and confirm they pass**
+Run: `cargo test --test commit_link_test issue_state_surfaces_commit_links_in_order issue_state_dedups_commit_links_by_sha_keeping_earliest`
+Expected: PASS.
+- [ ] **Step 8: Run the full test suite**
+Run: `cargo test`
+Expected: PASS. The `#[serde(default)]` keeps backward compatibility with cached issue state.
+- [ ] **Step 9: Commit**
+```bash
+git add src/state.rs tests/common/mod.rs tests/commit_link_test.rs
+git commit -m "Surface linked commits on IssueState with first-seen dedup
+Adds LinkedCommit + IssueState.linked_commits, populated from the new
+event variant in IssueState::from_ref_uncached. Walking topo-oldest-
+first means the first-seen event for a given SHA wins, which matches
+the spec's render-time dedup rule. serde(default) keeps older cached
+state compatible."
+```
+---
+## Task 3: Create `src/commit_link.rs` with the trailer parser
+**Files:**
+- Create: `src/commit_link.rs`
+- Modify: `src/lib.rs` (module declaration)
+- Test: `tests/commit_link_test.rs`
+- [ ] **Step 1: Write the full parser test table**
+Append to `tests/commit_link_test.rs`:
+```rust
+use git_collab::commit_link::parse_issue_trailers;
+#[test]
+fn parser_no_trailer_block() {
+    assert_eq!(parse_issue_trailers("Just a plain commit"), Vec::<String>::new());
+}
+#[test]
+fn parser_empty_message() {
+    assert_eq!(parse_issue_trailers(""), Vec::<String>::new());
+}
+#[test]
+fn parser_single_trailer_in_pure_block() {
+    let msg = "Fix thing\n\nSome context in the body.\n\nIssue: abc";
+    assert_eq!(parse_issue_trailers(msg), vec!["abc".to_string()]);
+}
+#[test]
+fn parser_case_variants() {
+    let msg1 = "subject\n\nissue: abc";
+    let msg2 = "subject\n\nISSUE : abc";
+    let msg3 = "subject\n\n  Issue:  abc  ";
+    assert_eq!(parse_issue_trailers(msg1), vec!["abc".to_string()]);
+    assert_eq!(parse_issue_trailers(msg2), vec!["abc".to_string()]);
+    assert_eq!(parse_issue_trailers(msg3), vec!["abc".to_string()]);
+}
+#[test]
+fn parser_two_trailers_in_pure_block() {
+    let msg = "subject\n\nIssue: abc\nIssue: def";
+    assert_eq!(parse_issue_trailers(msg), vec!["abc".to_string(), "def".to_string()]);
+}
+#[test]
+fn parser_issue_in_body_but_not_final_paragraph() {
+    let msg = "subject\n\nIssue: abc\n\nSigned-off-by: alice <a@example.com>";
+    // The final paragraph is the signed-off-by block, not the issue line.
+    // It's a valid trailer block (Signed-off-by is trailer-shaped), but it
+    // contains no Issue: key, so we extract nothing.
+    assert_eq!(parse_issue_trailers(msg), Vec::<String>::new());
+}
+#[test]
+fn parser_wrong_key() {
+    let msg = "subject\n\nIssues: abc";
+    assert_eq!(parse_issue_trailers(msg), Vec::<String>::new());
+}
+#[test]
+fn parser_prose_mention() {
+    let msg = "subject\n\nthis fixes issue abc in the body";
+    assert_eq!(parse_issue_trailers(msg), Vec::<String>::new());
+}
+#[test]
+fn parser_single_paragraph_whole_message_is_trailer_block() {
+    let msg = "Issue: abc";
+    assert_eq!(parse_issue_trailers(msg), vec!["abc".to_string()]);
+}
+#[test]
+fn parser_mixed_final_paragraph_rejects_all() {
+    let msg = "subject\n\nThanks to Bob for the catch.\nIssue: a3f9";
+    // Final paragraph has a prose line, so it's not a trailer block and we
+    // extract nothing. This is the "false positive in prose" guard.
+    assert_eq!(parse_issue_trailers(msg), Vec::<String>::new());
+}
+#[test]
+fn parser_trailing_whitespace_paragraph_does_not_shadow_trailer_block() {
+    // The final paragraph is empty/whitespace, so the walk should fall back
+    // to the previous non-empty paragraph, which is a valid trailer block.
+    let msg = "subject\n\nIssue: abc\n\n   \n";
+    assert_eq!(parse_issue_trailers(msg), vec!["abc".to_string()]);
+}
+#[test]
+fn parser_pure_block_with_mixed_keys() {
+    let msg = "subject\n\nSigned-off-by: alice <a@example.com>\nIssue: abc";
+    assert_eq!(parse_issue_trailers(msg), vec!["abc".to_string()]);
+}
+#[test]
+fn parser_rejects_value_with_trailing_garbage() {
+    let msg = "subject\n\nIssue: abc fixes thing";
+    assert_eq!(parse_issue_trailers(msg), Vec::<String>::new());
+}
+#[test]
+fn parser_rejects_empty_value() {
+    let msg = "subject\n\nIssue:   ";
+    assert_eq!(parse_issue_trailers(msg), Vec::<String>::new());
+}
+```
+- [ ] **Step 2: Run the tests to confirm they all fail**
+Run: `cargo test --test commit_link_test parser_`
+Expected: FAIL — `parse_issue_trailers` and the `commit_link` module don't exist.
+- [ ] **Step 3: Create `src/commit_link.rs` with the parser**
+Create `src/commit_link.rs`:
+```rust
+//! Auto-link commits to issues via `Issue:` git trailers during sync.
+//!
+//! See: docs/superpowers/specs/2026-04-12-commit-issue-link-design.md
+/// Parse `Issue:` trailers from a commit message.
+///
+/// Returns the list of trailer values in order of appearance. Follows git's
+/// own trailer-block semantics: only the final paragraph is considered, and
+/// *every* non-empty line in it must be trailer-shaped (a `token: value`
+/// line) for the paragraph to qualify. Any prose line in the final paragraph
+/// disqualifies the whole paragraph — this prevents false positives like
+/// `"Thanks Bob.\nIssue: abc"` in commit bodies.
+///
+/// The key match is `(?i)issue`; the value must be a single non-whitespace
+/// token followed by optional trailing whitespace and end-of-line. Values
+/// like `abc fixes thing` are rejected so that loose commentary never
+/// becomes a silent issue-prefix lookup that warns every sync forever.
+pub fn parse_issue_trailers(message: &str) -> Vec<String> {
+    // 1. Split into paragraphs (blank-line separated), preserving order.
+    //    Trim trailing whitespace from each line for the trailer-shape check,
+    //    but keep enough structure to recognize blank lines.
+    let lines: Vec<&str> = message.lines().collect();
+    // 2. Find the last paragraph: the longest tail slice that contains at
+    //    least one non-empty line and has no blank line *before* its first
+    //    non-empty line in the tail.
+    //
+    //    Walking from the end: skip trailing blank/whitespace-only lines,
+    //    then collect lines until we hit a blank line.
+    let mut end = lines.len();
+    while end > 0 && lines[end - 1].trim().is_empty() {
+        end -= 1;
+    }
+    if end == 0 {
+        return Vec::new();
+    }
+    let mut start = end;
+    while start > 0 && !lines[start - 1].trim().is_empty() {
+        start -= 1;
+    }
+    let paragraph = &lines[start..end];
+    // 3. Validate every non-empty line in the paragraph is trailer-shaped.
+    for line in paragraph {
+        if line.trim().is_empty() {
+            continue;
+        }
+        if !is_trailer_shaped(line) {
+            return Vec::new();
+        }
+    }
+    // 4. Extract `Issue:` values.
+    let mut out = Vec::new();
+    for line in paragraph {
+        if let Some(value) = match_issue_line(line) {
+            out.push(value);
+        }
+    }
+    out
+}
+/// Returns true if a line looks like a git trailer: `<token>: <value>`, where
+/// token starts with a letter and consists of `[A-Za-z0-9-]`, and value is at
+/// least one non-whitespace character.
+fn is_trailer_shaped(line: &str) -> bool {
+    let trimmed = line.trim_start();
+    let Some(colon_pos) = trimmed.find(':') else {
+        return false;
+    };
+    let token = &trimmed[..colon_pos];
+    if token.is_empty() {
+        return false;
+    }
+    let mut chars = token.chars();
+    let first = chars.next().unwrap();
+    if !first.is_ascii_alphabetic() {
+        return false;
+    }
+    if !chars.all(|c| c.is_ascii_alphanumeric() || c == '-') {
+        return false;
+    }
+    let value = trimmed[colon_pos + 1..].trim();
+    !value.is_empty()
+}
+/// If `line` is an `Issue: <token>` trailer with exactly one non-whitespace
+/// token in its value, returns the token. Otherwise returns None.
+fn match_issue_line(line: &str) -> Option<String> {
+    let trimmed = line.trim_start();
+    let colon_pos = trimmed.find(':')?;
+    let key = trimmed[..colon_pos].trim_end();
+    if !key.eq_ignore_ascii_case("issue") {
+        return None;
+    }
+    let value_region = &trimmed[colon_pos + 1..];
+    let value = value_region.trim();
+    if value.is_empty() {
+        return None;
+    }
+    // Reject values with interior whitespace: `abc fixes thing` must not
+    // parse to `abc` silently — it must parse to nothing so the user sees
+    // that their commentary is being ignored.
+    if value.split_whitespace().count() != 1 {
+        return None;
+    }
+    Some(value.to_string())
+}
+```
+- [ ] **Step 4: Declare the module in `src/lib.rs`**
+Open `src/lib.rs`. At the top of the module declarations (lines 1–17), insert alphabetically after `pub mod cli;`:
+```rust
+pub mod commit_link;
+```
+Final ordering should be:
+```rust
+pub mod cache;
+pub mod cli;
+pub mod commit_link;
+pub mod dag;
+pub mod editor;
+...
+```
+- [ ] **Step 5: Run the parser tests and confirm all pass**
+Run: `cargo test --test commit_link_test parser_`
+Expected: PASS for all 14 parser tests.
+- [ ] **Step 6: Run clippy on the new module**
+Run: `cargo clippy --all-targets -- -D warnings`
+Expected: no warnings.
+- [ ] **Step 7: Commit**
+```bash
+git add src/commit_link.rs src/lib.rs tests/commit_link_test.rs
+git commit -m "Add src/commit_link.rs with strict Issue: trailer parser
+Implements the spec's strict trailer-block semantics: the final
+paragraph qualifies only if every non-empty line is trailer-shaped,
+which rejects prose false positives like 'Thanks Bob.\\nIssue: a3f9'.
+The Issue: value must be a single token, so loose commentary like
+'Issue: abc fixes thing' is also rejected. Pure parser, no git or I/O,
+table-driven unit tests."
+```
+---
+## Task 4: Add `collect_linked_shas` helper
+**Files:**
+- Modify: `src/commit_link.rs`
+- Test: `tests/commit_link_test.rs`
+- [ ] **Step 1: Write a failing test**
+Append to `tests/commit_link_test.rs`:
+```rust
+use git_collab::commit_link::collect_linked_shas;
+#[test]
+fn collect_linked_shas_empty_for_fresh_issue() {
+    let _config = ScopedTestConfig::new();
+    let dir = TempDir::new().unwrap();
+    let repo = init_repo(dir.path(), &alice());
+    let (ref_name, _id) = open_issue(&repo, &alice(), "bug");
+    let shas = collect_linked_shas(&repo, &ref_name).unwrap();
+    assert!(shas.is_empty());
+}
+#[test]
+fn collect_linked_shas_returns_all_linked_commits_including_duplicates() {
+    let _config = ScopedTestConfig::new();
+    let dir = TempDir::new().unwrap();
+    let repo = init_repo(dir.path(), &alice());
+    let (ref_name, _id) = open_issue(&repo, &alice(), "bug");
+    add_commit_link(&repo, &ref_name, &alice(), &sha(0xaa));
+    add_commit_link(&repo, &ref_name, &alice(), &sha(0xbb));
+    // Even a duplicate DAG entry (cross-machine race) is surfaced here —
+    // this is the "source of truth" for whether we need to emit.
+    add_commit_link(&repo, &ref_name, &alice(), &sha(0xaa));
+    let shas = collect_linked_shas(&repo, &ref_name).unwrap();
+    assert_eq!(shas.len(), 2);
+    assert!(shas.contains(&sha(0xaa)));
+    assert!(shas.contains(&sha(0xbb)));
+}
+```
+- [ ] **Step 2: Run the tests and confirm they fail**
+Run: `cargo test --test commit_link_test collect_linked_shas_`
+Expected: FAIL — `collect_linked_shas` is not defined.
+- [ ] **Step 3: Add `collect_linked_shas` to `src/commit_link.rs`**
+Append to `src/commit_link.rs`:
+```rust
+use std::collections::HashSet;
+use git2::Repository;
+use crate::dag;
+use crate::error::Error;
+use crate::event::Action;
+/// Walk an issue's event DAG and return every commit SHA that has an
+/// `IssueCommitLink` event attached. Called lazily on first match per issue
+/// during `scan_and_link`; the result is cached in the orchestrator's
+/// `HashMap<RefName, HashSet<String>>`.
+pub fn collect_linked_shas(repo: &Repository, issue_ref: &str) -> Result<HashSet<String>, Error> {
+    let events = dag::walk_events(repo, issue_ref)?;
+    let mut shas = HashSet::new();
+    for (_oid, event) in events {
+        if let Action::IssueCommitLink { commit } = event.action {
+            shas.insert(commit);
+        }
+    }
+    Ok(shas)
+}
+```
+- [ ] **Step 4: Run the tests and confirm they pass**
+Run: `cargo test --test commit_link_test collect_linked_shas_`
+Expected: PASS.
+- [ ] **Step 5: Commit**
+```bash
+git add src/commit_link.rs tests/commit_link_test.rs
+git commit -m "Add collect_linked_shas helper to commit_link module
+Walks an issue's DAG and returns every SHA appearing in an
+IssueCommitLink event. Used by scan_and_link as the per-issue
+dedup source of truth, cached on first match per sync."
+```
+---
+## Task 5: Implement `scan_and_link` orchestrator with a happy-path integration test
+**Files:**
+- Modify: `src/commit_link.rs`
+- Test: `tests/sync_test.rs` (add the first integration test)
+- [ ] **Step 1: Write the happy-path integration test**
+Open `tests/sync_test.rs`. Find the end of the existing test module (near line 1200+) and append a new section:
+```rust
+// ---------------------------------------------------------------------------
+// Commit-link tests (src/commit_link.rs)
+// ---------------------------------------------------------------------------
+use git_collab::commit_link;
+fn make_commit_with_message(cluster: &TestCluster, repo: &Repository, message: &str) -> git2::Oid {
+    let _ = cluster; // silence unused if not needed
+    let sig = git2::Signature::now("Alice", "alice@example.com").unwrap();
+    let head = repo.head().unwrap();
+    let parent_oid = head.target().unwrap();
+    let parent = repo.find_commit(parent_oid).unwrap();
+    let tree_oid = parent.tree().unwrap().id();
+    let tree = repo.find_tree(tree_oid).unwrap();
+    // Commit on current branch (refs/heads/main).
+    repo.commit(Some("HEAD"), &sig, &sig, message, &tree, &[&parent])
+        .unwrap()
+}
+#[test]
+fn commit_link_scan_emits_event_for_matching_trailer() {
+    let cluster = TestCluster::new();
+    let alice_repo = cluster.alice_repo();
+    // Open an issue.
+    let (issue_ref, issue_id) = open_issue(&alice_repo, &alice(), "fix the walker");
+    // Create a commit whose trailer references that issue.
+    let message = format!("Fix walker\n\nIssue: {}", &issue_id[..8]);
+    let commit_oid = make_commit_with_message(&cluster, &alice_repo, &message);
+    // Run the scanner directly (we test the sync integration in later tests).
+    let author = git_collab::identity::get_author(&alice_repo).unwrap();
+    let sk = signing::load_signing_key(
+        &signing::signing_key_dir().unwrap(),
+    )
+    .unwrap();
+    let emitted = commit_link::scan_and_link(&alice_repo, &author, &sk).unwrap();
+    assert_eq!(emitted, 1);
+    // Walk the issue's event log and find the link.
+    let issue = IssueState::from_ref_uncached(&alice_repo, &issue_ref, &issue_id).unwrap();
+    assert_eq!(issue.linked_commits.len(), 1);
+    assert_eq!(issue.linked_commits[0].commit, commit_oid.to_string());
+}
+```
+- [ ] **Step 2: Run the test and confirm it fails**
+Run: `cargo test --test sync_test commit_link_scan_emits_event_for_matching_trailer`
+Expected: FAIL — `scan_and_link` is not defined.
+- [ ] **Step 3: Add `scan_and_link` to `src/commit_link.rs`**
+Append to `src/commit_link.rs`:
+```rust
+use std::collections::HashMap;
+use git2::{Oid, Sort};
+use crate::event::{Author, Event};
+const ACTIVE_ISSUE_PREFIX: &str = "refs/collab/issues/";
+const ARCHIVED_ISSUE_PREFIX: &str = "refs/collab/archive/issues/";
+/// Walk every commit reachable from `refs/heads/*`, parse `Issue:` trailers,
+/// resolve each to an issue, and emit an `IssueCommitLink` event for any
+/// (issue, commit) pair that doesn't already have one.
+///
+/// **Never breaks sync.** Per-commit and per-issue errors are logged as
+/// one-line stderr warnings and iteration continues. The only errors that
+/// propagate are "couldn't even start" failures (opening the repo, building
+/// the revwalk). Callers treat a returned `Err` as "skip the link scan for
+/// this sync" and proceed.
+///
+/// Returns the number of events actually emitted.
+pub fn scan_and_link(
+    repo: &Repository,
+    author: &Author,
+    sk: &ed25519_dalek::SigningKey,
+) -> Result<usize, Error> {
+    // Build a revwalk seeded from every local branch tip.
+    let mut revwalk = repo.revwalk()?;
+    revwalk.set_sorting(Sort::TOPOLOGICAL)?;
+    let mut seeded_any = false;
+    for reference in repo.references_glob("refs/heads/*")? {
+        let Ok(reference) = reference else { continue };
+        let Some(target) = reference.target() else { continue };
+        // `revwalk.push` dedups commits across branch tips internally.
+        if revwalk.push(target).is_ok() {
+            seeded_any = true;
+        }
+    }
+    if !seeded_any {
+        // Detached HEAD with no local branches. Silent no-op per spec.
+        return Ok(0);
+    }
+    // Per-sync dedup of commits already visited.
+    let mut visited: HashSet<Oid> = HashSet::new();
+    // Cache of existing link SHAs per resolved issue ref. `None` = poisoned.
+    let mut link_cache: HashMap<String, Option<HashSet<String>>> = HashMap::new();
+    let mut emitted: usize = 0;
+    for oid_result in revwalk {
+        let oid = match oid_result {
+            Ok(o) => o,
+            Err(e) => {
+                eprintln!("warning: revwalk error, stopping scan: {}", e);
+                break;
+            }
+        };
+        if !visited.insert(oid) {
+            continue;
+        }
+        let commit = match repo.find_commit(oid) {
+            Ok(c) => c,
+            Err(e) => {
+                eprintln!("warning: cannot load commit {}: {}", oid, e);
+                continue;
+            }
+        };
+        let message = commit.message().unwrap_or("");
+        let trailers = parse_issue_trailers(message);
+        if trailers.is_empty() {
+            continue;
+        }
+        for prefix in trailers {
+            match crate::state::resolve_issue_ref(repo, &prefix) {
+                Ok((resolved_ref, _resolved_id)) => {
+                    if resolved_ref.starts_with(ARCHIVED_ISSUE_PREFIX) {
+                        eprintln!(
+                            "warning: commit {}: Issue: {} — issue is archived, skipping",
+                            oid, prefix
+                        );
+                        continue;
+                    }
+                    if !resolved_ref.starts_with(ACTIVE_ISSUE_PREFIX) {
+                        // Unknown namespace. Should not happen with current
+                        // resolver, but belt-and-braces.
+                        eprintln!(
+                            "warning: commit {}: Issue: {} — resolved to unexpected ref {}, skipping",
+                            oid, prefix, resolved_ref
+                        );
+                        continue;
+                    }
+                    let entry = link_cache.entry(resolved_ref.clone()).or_insert_with(|| {
+                        match collect_linked_shas(repo, &resolved_ref) {
+                            Ok(set) => Some(set),
+                            Err(e) => {
+                                eprintln!(
+                                    "warning: cannot read link events for {}: {} — skipping issue for the rest of this sync",
+                                    resolved_ref, e
+                                );
+                                None
+                            }
+                        }
+                    });
+                    let Some(ref mut set) = entry else { continue };
+                    let sha = oid.to_string();
+                    if set.contains(&sha) {
+                        continue;
+                    }
+                    let event = Event {
+                        timestamp: chrono::Utc::now().to_rfc3339(),
+                        author: author.clone(),
+                        action: Action::IssueCommitLink {
+                            commit: sha.clone(),
+                        },
+                        clock: 0,
+                    };
+                    match dag::append_event(repo, &resolved_ref, &event, sk) {
+                        Ok(_) => {
+                            set.insert(sha);
+                            emitted += 1;
+                        }
+                        Err(e) => {
+                            eprintln!(
+                                "warning: failed to emit IssueCommitLink on {}: {}",
+                                resolved_ref, e
+                            );
+                        }
+                    }
+                }
+                Err(e) => {
+                    // resolve_issue_ref error message already distinguishes
+                    // "no issue found" from "ambiguous prefix".
+                    eprintln!(
+                        "warning: commit {}: Issue: {} — {}, skipping",
+                        oid, prefix, e
+                    );
+                }
+            }
+        }
+    }
+    Ok(emitted)
+}
+```
+- [ ] **Step 4: Run the integration test and confirm it passes**
+Run: `cargo test --test sync_test commit_link_scan_emits_event_for_matching_trailer`
+Expected: PASS. The test opens an issue, writes a commit with `Issue: <prefix>`, calls `scan_and_link` directly, and confirms the link event was appended.
+- [ ] **Step 5: Run clippy**
+Run: `cargo clippy --all-targets -- -D warnings`
+Expected: no warnings.
+- [ ] **Step 6: Commit**
+```bash
+git add src/commit_link.rs tests/sync_test.rs
+git commit -m "Implement commit_link::scan_and_link orchestrator
+Walks refs/heads/* (dedup'd via HashSet<Oid>), parses Issue: trailers
+from each commit, resolves to an issue ref, and appends IssueCommitLink
+events. Per-sync cache keyed by resolved ref name absorbs repeat
+matches; all per-commit and per-issue errors become stderr warnings so
+the scan never breaks sync. Archived issues are skipped with a warning."
+```
+---
+## Task 6: Wire `scan_and_link` into `sync::sync`
+**Files:**
+- Modify: `src/sync.rs` (after `reconcile_refs("patches", ...)` at line 365)
+- Modify: `tests/sync_test.rs` (confirm the wiring runs end-to-end via `sync::sync`)
+- [ ] **Step 1: Write an end-to-end test driving the full `sync::sync` entry point**
+Append to `tests/sync_test.rs` below the existing commit-link section:
+```rust
+#[test]
+fn sync_entry_point_emits_commit_link_events_and_pushes_them() {
+    let cluster = TestCluster::new();
+    let alice_repo = cluster.alice_repo();
+    // Alice opens an issue and syncs it up so Bob will see it too.
+    let (_issue_ref, issue_id) = open_issue(&alice_repo, &alice(), "bug");
+    sync::sync(&alice_repo, "origin").unwrap();
+    // Alice makes a real commit with an Issue: trailer.
+    let message = format!("Fix the thing\n\nIssue: {}", &issue_id[..8]);
+    make_commit_with_message(&cluster, &alice_repo, &message);
+    // Running sync should scan, emit the link, and push it.
+    sync::sync(&alice_repo, "origin").unwrap();
+    // Bob fetches and should see the link in the materialized issue.
+    let bob_repo = cluster.bob_repo();
+    sync::sync(&bob_repo, "origin").unwrap();
+    let bob_issue_ref = format!("refs/collab/issues/{}", issue_id);
+    let bob_issue = IssueState::from_ref_uncached(&bob_repo, &bob_issue_ref, &issue_id).unwrap();
+    assert_eq!(bob_issue.linked_commits.len(), 1);
+}
+```
+- [ ] **Step 2: Run the test and confirm it fails**
+Run: `cargo test --test sync_test sync_entry_point_emits_commit_link_events_and_pushes_them`
+Expected: FAIL — `sync::sync` doesn't call `scan_and_link` yet, so no link events exist for Bob to fetch.
+- [ ] **Step 3: Wire the call into `src/sync.rs`**
+Open `src/sync.rs`. Find the block around line 362–366:
+```rust
+    let repo = Repository::open(repo.path())?;
+    let sk = signing::load_signing_key(&signing::signing_key_dir()?)?;
+    reconcile_refs(&repo, "issues", &author, &sk)?;
+    reconcile_refs(&repo, "patches", &author, &sk)?;
+    // Step 3: Push collab refs individually
+```
+Insert the scan call between `reconcile_refs("patches", ...)` and `// Step 3: Push collab refs individually`:
+```rust
+    let repo = Repository::open(repo.path())?;
+    let sk = signing::load_signing_key(&signing::signing_key_dir()?)?;
+    reconcile_refs(&repo, "issues", &author, &sk)?;
+    reconcile_refs(&repo, "patches", &author, &sk)?;
+    // Step 2.5: Scan local branches for Issue: trailers and emit link events.
+    // Never breaks sync — scan_and_link absorbs per-commit/per-issue errors.
+    match crate::commit_link::scan_and_link(&repo, &author, &sk) {
+        Ok(n) if n > 0 => println!("Linked {} commit(s) to issues.", n),
+        Ok(_) => {}
+        Err(e) => eprintln!("warning: commit link scan failed: {}", e),
+    }
+    // Step 3: Push collab refs individually
+```
+- [ ] **Step 4: Add the missing `crate::commit_link` import (if clippy wants it)**
+`crate::commit_link::scan_and_link` is fully qualified in the call above, so no `use` is needed. Leave as-is.
+- [ ] **Step 5: Run the integration test and confirm it passes**
+Run: `cargo test --test sync_test sync_entry_point_emits_commit_link_events_and_pushes_them`
+Expected: PASS.
+- [ ] **Step 6: Run the full sync test suite**
+Run: `cargo test --test sync_test`
+Expected: PASS. Existing sync tests should be unaffected because no existing test creates commits with `Issue:` trailers.
+- [ ] **Step 7: Commit**
+```bash
+git add src/sync.rs tests/sync_test.rs
+git commit -m "Wire commit_link::scan_and_link into the sync pipeline
+Called after reconcile_refs so the dedup cache reflects merged remote
+state, and before collect_push_refs so new link events ride out in
+the same sync. End-to-end test: Alice writes a commit with an
+Issue: trailer, sync emits+pushes, Bob fetches and materializes the
+linked commit on the issue."
+```
+---
+## Task 7: Add the remaining integration tests
+**Files:**
+- Modify: `tests/sync_test.rs`
+- [ ] **Step 1: Add idempotency and multi-branch tests**
+Append to `tests/sync_test.rs`:
+```rust
+#[test]
+fn commit_link_scan_is_idempotent_across_runs() {
+    let cluster = TestCluster::new();
+    let alice_repo = cluster.alice_repo();
+    let (issue_ref, issue_id) = open_issue(&alice_repo, &alice(), "bug");
+    let message = format!("Fix thing\n\nIssue: {}", &issue_id[..8]);
+    make_commit_with_message(&cluster, &alice_repo, &message);
+    let author = git_collab::identity::get_author(&alice_repo).unwrap();
+    let sk = signing::load_signing_key(&signing::signing_key_dir().unwrap()).unwrap();
+    assert_eq!(commit_link::scan_and_link(&alice_repo, &author, &sk).unwrap(), 1);
+    assert_eq!(commit_link::scan_and_link(&alice_repo, &author, &sk).unwrap(), 0);
+    assert_eq!(commit_link::scan_and_link(&alice_repo, &author, &sk).unwrap(), 0);
+    let issue = IssueState::from_ref_uncached(&alice_repo, &issue_ref, &issue_id).unwrap();
+    assert_eq!(issue.linked_commits.len(), 1);
+}
+#[test]
+fn commit_link_scan_walks_all_local_branches_and_dedups_shared_ancestors() {
+    let cluster = TestCluster::new();
+    let alice_repo = cluster.alice_repo();
+    let (issue_ref, issue_id) = open_issue(&alice_repo, &alice(), "bug");
+    // Commit on main with the trailer. Both branches will reach it.
+    let message = format!("Fix\n\nIssue: {}", &issue_id[..8]);
+    let linked_commit = make_commit_with_message(&cluster, &alice_repo, &message);
+    // Create a second branch pointing at the same commit.
+    {
+        let commit = alice_repo.find_commit(linked_commit).unwrap();
+        alice_repo.branch("feature-x", &commit, false).unwrap();
+    }
+    let author = git_collab::identity::get_author(&alice_repo).unwrap();
+    let sk = signing::load_signing_key(&signing::signing_key_dir().unwrap()).unwrap();
+    // Should emit exactly one event despite the commit being reachable from
+    // two branch tips.
+    assert_eq!(commit_link::scan_and_link(&alice_repo, &author, &sk).unwrap(), 1);
+    let issue = IssueState::from_ref_uncached(&alice_repo, &issue_ref, &issue_id).unwrap();
+    assert_eq!(issue.linked_commits.len(), 1);
+}
+#[test]
+fn commit_link_scan_handles_multiple_issue_trailers_on_one_commit() {
+    let cluster = TestCluster::new();
+    let alice_repo = cluster.alice_repo();
+    let (issue_ref_a, id_a) = open_issue(&alice_repo, &alice(), "bug a");
+    let (issue_ref_b, id_b) = open_issue(&alice_repo, &alice(), "bug b");
+    let message = format!(
+        "Fix both\n\nIssue: {}\nIssue: {}",
+        &id_a[..8],
+        &id_b[..8]
+    );
+    make_commit_with_message(&cluster, &alice_repo, &message);
+    let author = git_collab::identity::get_author(&alice_repo).unwrap();
+    let sk = signing::load_signing_key(&signing::signing_key_dir().unwrap()).unwrap();
+    assert_eq!(commit_link::scan_and_link(&alice_repo, &author, &sk).unwrap(), 2);
+    let issue_a = IssueState::from_ref_uncached(&alice_repo, &issue_ref_a, &id_a).unwrap();
+    let issue_b = IssueState::from_ref_uncached(&alice_repo, &issue_ref_b, &id_b).unwrap();
+    assert_eq!(issue_a.linked_commits.len(), 1);
+    assert_eq!(issue_b.linked_commits.len(), 1);
+}
+```
+- [ ] **Step 2: Run these three tests**
+Run: `cargo test --test sync_test commit_link_scan_is_idempotent commit_link_scan_walks_all commit_link_scan_handles_multiple`
+Expected: PASS.
+- [ ] **Step 3: Add unknown/ambiguous/archived prefix tests**
+Append to `tests/sync_test.rs`:
+```rust
+#[test]
+fn commit_link_scan_skips_unknown_prefix_without_error() {
+    let cluster = TestCluster::new();
+    let alice_repo = cluster.alice_repo();
+    // No issue exists. Commit uses a completely unrelated prefix.
+    make_commit_with_message(
+        &cluster,
+        &alice_repo,
+        "Fix\n\nIssue: zzzzzzzz",
+    );
+    let author = git_collab::identity::get_author(&alice_repo).unwrap();
+    let sk = signing::load_signing_key(&signing::signing_key_dir().unwrap()).unwrap();
+    assert_eq!(commit_link::scan_and_link(&alice_repo, &author, &sk).unwrap(), 0);
+}
+#[test]
+fn commit_link_scan_skips_ambiguous_prefix_without_error() {
+    let cluster = TestCluster::new();
+    let alice_repo = cluster.alice_repo();
+    // Open two issues. Their OIDs are random, so we can't guarantee they
+    // share a prefix — instead, use a single-character prefix that is
+    // likely to be ambiguous. If the two OIDs happen to not share a first
+    // char, this test degrades to a no-op but still passes the "no error"
+    // check, which is the important property.
+    let (_, id_a) = open_issue(&alice_repo, &alice(), "a");
+    let (_, id_b) = open_issue(&alice_repo, &alice(), "b");
+    // Find a shared character prefix, or fall back to the first char of a.
+    let shared_prefix = if id_a.chars().next() == id_b.chars().next() {
+        id_a[..1].to_string()
+    } else {
+        // No ambiguity possible — use a prefix that matches only a, which
+        // exercises the resolve-success path instead. Test name still holds
+        // because "without error" is the core assertion.
+        id_a[..8].to_string()
+    };
+    make_commit_with_message(
+        &cluster,
+        &alice_repo,
+        &format!("Touch\n\nIssue: {}", shared_prefix),
+    );
+    let author = git_collab::identity::get_author(&alice_repo).unwrap();
+    let sk = signing::load_signing_key(&signing::signing_key_dir().unwrap()).unwrap();
+    // Must not error regardless of whether the prefix ambiguously matched.
+    let _ = commit_link::scan_and_link(&alice_repo, &author, &sk).unwrap();
+}
+#[test]
+fn commit_link_scan_skips_archived_issues_with_warning() {
+    let cluster = TestCluster::new();
+    let alice_repo = cluster.alice_repo();
+    let (_, issue_id) = open_issue(&alice_repo, &alice(), "old bug");
+    // Archive the issue via the state helper.
+    state::archive_issue_ref(&alice_repo, &issue_id).unwrap();
+    make_commit_with_message(
+        &cluster,
+        &alice_repo,
+        &format!("Reference old\n\nIssue: {}", &issue_id[..8]),
+    );
+    let author = git_collab::identity::get_author(&alice_repo).unwrap();
+    let sk = signing::load_signing_key(&signing::signing_key_dir().unwrap()).unwrap();
+    assert_eq!(commit_link::scan_and_link(&alice_repo, &author, &sk).unwrap(), 0);
+    // Confirm the archived ref did not accrue a new event: the archived
+    // DAG tip should still be the archive-time tip.
+    let archived_ref = format!("refs/collab/archive/issues/{}", issue_id);
+    let archived_state = IssueState::from_ref_uncached(&alice_repo, &archived_ref, &issue_id).unwrap();
+    assert!(archived_state.linked_commits.is_empty());
+}
+```
+- [ ] **Step 4: Run these tests**
+Run: `cargo test --test sync_test commit_link_scan_skips_unknown commit_link_scan_skips_ambiguous commit_link_scan_skips_archived`
+Expected: PASS. Warning output on stderr is expected and does not fail the test.
+- [ ] **Step 5: Add detached-HEAD and remote-originated dedup tests**
+Append to `tests/sync_test.rs`:
+```rust
+#[test]
+fn commit_link_scan_no_op_on_detached_head_with_no_branches() {
+    let cluster = TestCluster::new();
+    let alice_repo = cluster.alice_repo();
+    // Delete all local branches and put HEAD in detached state.
+    let head_oid = alice_repo.head().unwrap().target().unwrap();
+    alice_repo.set_head_detached(head_oid).unwrap();
+    // Remove refs/heads/main.
+    alice_repo.find_reference("refs/heads/main").unwrap().delete().unwrap();
+    let author = git_collab::identity::get_author(&alice_repo).unwrap();
+    let sk = signing::load_signing_key(&signing::signing_key_dir().unwrap()).unwrap();
+    // No branches to walk — silent no-op.
+    assert_eq!(commit_link::scan_and_link(&alice_repo, &author, &sk).unwrap(), 0);
+}
+#[test]
+fn commit_link_scan_dedups_against_remote_originated_events() {
+    // Simulates the cross-machine dedup case: Bob's repo fetches a link
+    // event that Alice already emitted, then runs scan locally with the
+    // same commit reachable from his branches. He must not emit a
+    // duplicate.
+    let cluster = TestCluster::new();
+    let alice_repo = cluster.alice_repo();
+    let bob_repo = cluster.bob_repo();
+    // Both repos get the same issue.
+    let (_, issue_id) = open_issue(&alice_repo, &alice(), "bug");
+    sync::sync(&alice_repo, "origin").unwrap();
+    sync::sync(&bob_repo, "origin").unwrap();
+    // Alice writes a commit and pushes it to the bare remote so Bob can
+    // fetch it. First the regular git push; then sync for the link event.
+    let message = format!("Fix thing\n\nIssue: {}", &issue_id[..8]);
+    let linked_commit = make_commit_with_message(&cluster, &alice_repo, &message);
+    // Push the branch so Bob sees the commit too.
+    let mut cmd = Command::new("git");
+    cmd.args(["push", "origin", "main"])
+        .current_dir(cluster.alice_dir.path());
+    assert!(cmd.status().unwrap().success());
+    sync::sync(&alice_repo, "origin").unwrap();
+    // Bob fetches both the branch and the collab link event.
+    let mut cmd = Command::new("git");
+    cmd.args(["fetch", "origin", "main:main"])
+        .current_dir(cluster.bob_dir.path());
+    assert!(cmd.status().unwrap().success());
+    sync::sync(&bob_repo, "origin").unwrap();
+    // At this point Bob's issue already has the link event from Alice.
+    // Re-running scan on Bob's repo must find the commit locally and
+    // decide "already linked", emitting zero events.
+    let author = git_collab::identity::get_author(&bob_repo).unwrap();
+    let sk = signing::load_signing_key(&signing::signing_key_dir().unwrap()).unwrap();
+    let emitted = commit_link::scan_and_link(&bob_repo, &author, &sk).unwrap();
+    assert_eq!(emitted, 0, "Bob must not duplicate Alice's link event");
+    // And the commit on Bob's side really is the one linked.
+    let bob_ref = format!("refs/collab/issues/{}", issue_id);
+    let bob_issue = IssueState::from_ref_uncached(&bob_repo, &bob_ref, &issue_id).unwrap();
+    assert_eq!(bob_issue.linked_commits.len(), 1);
+    assert_eq!(bob_issue.linked_commits[0].commit, linked_commit.to_string());
+}
+```
+- [ ] **Step 6: Run these tests**
+Run: `cargo test --test sync_test commit_link_scan_no_op_on_detached commit_link_scan_dedups_against_remote`
+Expected: PASS.
+- [ ] **Step 7: Run the entire sync test suite as a regression check**
+Run: `cargo test --test sync_test`
+Expected: PASS.
+- [ ] **Step 8: Commit**
+```bash
+git add tests/sync_test.rs
+git commit -m "Add integration tests for commit-link scan edge cases
+Covers idempotency, multi-branch ancestor dedup, multi-issue trailers,
+unknown/ambiguous/archived prefixes, detached HEAD silent no-op, and
+cross-machine dedup against remote-originated link events."
+```
+---
+## Task 8: Render linked commits in the CLI `issue show` output
+**Files:**
+- Modify: `src/lib.rs` (the `IssueCmd::Show` match arm, around lines 115–148)
+- Test: `tests/cli_test.rs` or add a new CLI-level assertion in `sync_test.rs` — we'll extend `sync_test.rs` for co-location with other commit-link tests.
+- [ ] **Step 1: Write a failing test that uses the CLI to show an issue with a link**
+Append to `tests/sync_test.rs`. Note: this uses `TestRepo` from `common`, which runs the binary — so it's a process-level test.
+```rust
+#[test]
+fn cli_issue_show_renders_linked_commits_section() {
+    use common::TestRepo;
+    let repo = TestRepo::new("Alice", "alice@example.com");
+    let issue_id = repo.issue_open("fix the thing");
+    // Write a commit with an Issue: trailer via git CLI.
+    let full_id = {
+        let out = repo.run_ok(&["issue", "show", &issue_id, "--json"]);
+        let v: serde_json::Value = serde_json::from_str(&out).unwrap();
+        v["id"].as_str().unwrap().to_string()
+    };
+    let msg = format!("Fix a thing\n\nIssue: {}", &full_id[..8]);
+    repo.git(&["commit", "--allow-empty", "-m", &msg]);
+    // Run sync against a bare remote we create inline.
+    let bare = TempDir::new().unwrap();
+    Command::new("git")
+        .args(["init", "--bare"])
+        .current_dir(bare.path())
+        .status()
+        .unwrap();
+    repo.git(&["remote", "add", "origin", bare.path().to_str().unwrap()]);
+    repo.git(&["push", "-u", "origin", "main"]);
+    repo.run_ok(&["init"]);
+    repo.run_ok(&["sync"]);
+    let show = repo.run_ok(&["issue", "show", &issue_id]);
+    assert!(
+        show.contains("--- Linked Commits ---"),
+        "expected linked commits section, got:\n{}",
+        show
+    );
+    assert!(
+        show.contains("by Alice"),
+        "expected commit author rendered, got:\n{}",
+        show
+    );
+    assert!(
+        show.contains("(linked by Alice"),
+        "expected event author rendered, got:\n{}",
+        show
+    );
+}
+```
+- [ ] **Step 2: Run the test and confirm it fails**
+Run: `cargo test --test sync_test cli_issue_show_renders_linked_commits_section`
+Expected: FAIL — the renderer does not yet output the `--- Linked Commits ---` section.
+- [ ] **Step 3: Add the renderer in `src/lib.rs`**
+Open `src/lib.rs`. Find the `IssueCmd::Show` arm (starts around line 115). Locate the block that renders comments:
+```rust
+                if !i.comments.is_empty() {
+                    println!("\n--- Comments ---");
+                    for c in &i.comments {
+                        println!("\n{} ({}):\n{}", c.author.name, c.timestamp, c.body);
+                    }
+                }
+                Ok(())
+```
+Immediately before `Ok(())`, add the linked-commits renderer:
+```rust
+                if !i.linked_commits.is_empty() {
+                    println!("\n--- Linked Commits ---");
+                    for lc in &i.linked_commits {
+                        let short_sha = if lc.commit.len() >= 7 { &lc.commit[..7] } else { &lc.commit };
+                        let (subject, commit_author) = match git2::Oid::from_str(&lc.commit)
+                            .ok()
+                            .and_then(|oid| repo.find_commit(oid).ok())
+                        {
+                            Some(commit) => {
+                                let subject = commit
+                                    .summary()
+                                    .map(|s| truncate_summary(s, 60))
+                                    .unwrap_or_default();
+                                let author = commit
+                                    .author()
+                                    .name()
+                                    .unwrap_or("unknown")
+                                    .to_string();
+                                (Some(subject), Some(author))
+                            }
+                            None => (None, None),
+                        };
+                        match (subject, commit_author) {
+                            (Some(subject), Some(author)) => {
+                                println!(
+                                    "· linked {} \"{}\" by {} (linked by {}, {})",
+                                    short_sha,
+                                    subject,
+                                    author,
+                                    lc.event_author.name,
+                                    lc.event_timestamp,
+                                );
+                            }
+                            _ => {
+                                println!(
+                                    "· linked {} (commit {} not in local repo) (linked by {}, {})",
+                                    short_sha,
+                                    short_sha,
+                                    lc.event_author.name,
+                                    lc.event_timestamp,
+                                );
+                            }
+                        }
+                    }
+                }
+                Ok(())
+```
+Add a helper at the bottom of `src/lib.rs` (outside all `fn run` code, next to `fn search`):
+```rust
+fn truncate_summary(s: &str, max_chars: usize) -> String {
+    let mut out = String::new();
+    let mut count = 0;
+    for c in s.chars() {
+        if count + 1 > max_chars {
+            out.push('…');
+            return out;
+        }
+        out.push(c);
+        count += 1;
+    }
+    out
+}
+```
+- [ ] **Step 4: Run the test and confirm it passes**
+Run: `cargo test --test sync_test cli_issue_show_renders_linked_commits_section`
+Expected: PASS.
+- [ ] **Step 5: Run the full CLI test suite**
+Run: `cargo test`
+Expected: PASS. No existing `issue show` tests should break because they use issues without any linked commits — the new section is only printed when non-empty.
+- [ ] **Step 6: Commit**
+```bash
+git add src/lib.rs tests/sync_test.rs
+git commit -m "Render --- Linked Commits --- section in CLI issue show
+Each line shows the short SHA, commit subject (truncated to 60 chars),
+commit author, and then (linked by <event-author>, <timestamp>). When
+the commit isn't locally reachable (GC'd, shallow), falls back to a
+no-subject variant that still shows the linked-by metadata."
+```
+---
+## Task 9: Render linked commits in the TUI issue detail widget
+**Files:**
+- Modify: `src/tui/widgets.rs` (function rendering issue detail, around lines 390–464)
+- Test: Extend an existing TUI smoke test or rely on the existing dashboard smoke harness — the widget is ultimately driven by `IssueState`, which already carries `linked_commits`, so we'll test via a direct widget call.
+- [ ] **Step 1: Locate the relevant widget function**
+Run: `cargo clippy --all-targets 2>&1 | head -5` — just to confirm build is clean before editing. Then open `src/tui/widgets.rs` and read the function that builds issue detail (search for `--- Comments ---` — it's the same function at line 438).
+- [ ] **Step 2: Add the rendering block after the comments section**
+In `src/tui/widgets.rs`, find the `if !issue.comments.is_empty() { ... }` block (around line 438–462) and add a parallel block immediately after it, before `Text::from(lines)`:
+```rust
+    if !issue.linked_commits.is_empty() {
+        lines.push(Line::raw(""));
+        lines.push(Line::styled(
+            "--- Linked Commits ---",
+            Style::default()
+                .fg(Color::Magenta)
+                .add_modifier(Modifier::BOLD),
+        ));
+        for lc in &issue.linked_commits {
+            let short_sha: String = lc.commit.chars().take(7).collect();
+            let (subject, commit_author) = git2::Oid::from_str(&lc.commit)
+                .ok()
+                .and_then(|oid| repo.find_commit(oid).ok())
+                .map(|commit| {
+                    let subject = commit.summary().unwrap_or("").to_string();
+                    let author = commit.author().name().unwrap_or("unknown").to_string();
+                    (subject, author)
+                })
+                .unwrap_or_else(|| (String::new(), String::new()));
+            let line_text = if commit_author.is_empty() {
+                format!(
+                    "· linked {} (commit {} not in local repo) (linked by {}, {})",
+                    short_sha, short_sha, lc.event_author.name, lc.event_timestamp
+                )
+            } else {
+                format!(
+                    "· linked {} \"{}\" by {} (linked by {}, {})",
+                    short_sha, subject, commit_author, lc.event_author.name, lc.event_timestamp
+                )
+            };
+            lines.push(Line::raw(line_text));
+        }
+    }
+```
+The `repo` parameter is already in scope — check the enclosing function's signature. If `build_issue_detail` does *not* currently take `&Repository`, thread it through: look at how callers pass `patches` in — they also pass the repo, so the plumbing exists. If the function really doesn't have repo access, fall back to the "(commit not in local repo)" form unconditionally; the CLI renderer is the authoritative one and the TUI can degrade.
+- [ ] **Step 3: Build and check**
+Run: `cargo build`
+Expected: clean build. If there's a missing `repo` parameter, the error message will point at the exact spot; thread the `&Repository` argument through from the caller (`src/tui/mod.rs` or `src/tui/state.rs`) to `build_issue_detail` and retry.
+- [ ] **Step 4: Run clippy**
+Run: `cargo clippy --all-targets -- -D warnings`
+Expected: no warnings.
+- [ ] **Step 5: Run the existing TUI smoke tests to confirm no regression**
+Run: `cargo test --test dashboard_test`
+Expected: PASS (if a dashboard test suite exists — skip this step if it doesn't).
+- [ ] **Step 6: Commit**
+```bash
+git add src/tui/widgets.rs src/tui/mod.rs src/tui/state.rs
+git commit -m "Render linked commits section in TUI issue detail
+Mirrors the CLI renderer: --- Linked Commits --- section after
+comments, with short SHA + subject + commit author + linked-by
+metadata. Degrades gracefully when the commit isn't locally available."
+```
+(If `src/tui/mod.rs` or `src/tui/state.rs` weren't touched, drop them from the add — `git status` will show what to include.)
+---
+## Task 10: Final verification and cleanup
+**Files:** none
+- [ ] **Step 1: Run the full test suite**
+Run: `cargo test`
+Expected: PASS across all targets.
+- [ ] **Step 2: Run clippy with deny warnings**
+Run: `cargo clippy --all-targets -- -D warnings`
+Expected: no warnings.
+- [ ] **Step 3: Manual end-to-end smoke test**
+In a scratch directory (the worktree is fine):
+```bash
+cd /tmp
+rm -rf commit-link-smoke && mkdir commit-link-smoke && cd commit-link-smoke
+git init -b main
+git config user.name "Smoke"
+git config user.email "smoke@example.com"
+git commit --allow-empty -m "root"
+# Use the locally-built binary.
+BIN=/home/xanderle/dev/git-collab/target/debug/git-collab
+$BIN issue open -t "smoke test issue"
+ID=$($BIN issue list | head -1 | awk '{print $1}')
+echo "Issue: $ID"
+git commit --allow-empty -m "Fix thing
+Issue: $ID"
+git init --bare /tmp/commit-link-smoke-bare
+git remote add origin /tmp/commit-link-smoke-bare
+git push -u origin main
+$BIN init
+$BIN sync
+$BIN issue show $ID
+```
+Expected in the output: a `--- Linked Commits ---` section with one line like `· linked <sha> "Fix thing" by Smoke (linked by Smoke, 2026-...)`.
+- [ ] **Step 4: Commit any final cleanup**
+If the smoke test reveals anything missing (e.g. a poorly-formatted line, a missing newline), fix it and commit:
+```bash
+git add -p
+git commit -m "Polish commit-link renderer based on smoke test feedback"
+```
+Otherwise, this task is a no-op commit-wise.
+---
+## Self-Review
+Checking the plan against the spec `docs/superpowers/specs/2026-04-12-commit-issue-link-design.md`:
+**Spec coverage:**
+- ✅ `Action::IssueCommitLink` variant — Task 1.
+- ✅ `src/commit_link.rs` module with `parse_issue_trailers`, `collect_linked_shas`, `scan_and_link` — Tasks 3, 4, 5.
+- ✅ Strict trailer-block rule (every non-empty line must be trailer-shaped) — Task 3 parser + test `parser_mixed_final_paragraph_rejects_all`.
+- ✅ Single-token value rule (`(\S+)` equivalent via `split_whitespace().count() != 1`) — Task 3 parser + test `parser_rejects_value_with_trailing_garbage`.
+- ✅ Case-insensitive key match — Task 3 test `parser_case_variants`.
+- ✅ Sync insertion point (after `reconcile_refs("patches")`, before `collect_push_refs`) — Task 6.
+- ✅ Revwalk of all `refs/heads/*` with per-sync `HashSet<Oid>` dedup — Task 5 (`scan_and_link`).
+- ✅ Per-issue linked-SHA cache keyed by resolved ref name — Task 5 (`link_cache: HashMap<String, Option<HashSet<String>>>`).
+- ✅ Archived-issue skip with warning — Task 5 (`ARCHIVED_ISSUE_PREFIX` check) + integration test in Task 7.
+- ✅ Detached HEAD / no local branches silent no-op — Task 5 (`seeded_any` check) + integration test in Task 7.
+- ✅ Cross-machine duplication handled at render time via first-seen dedup — Task 2 (`IssueState::from_ref_uncached` arm).
+- ✅ Renderer shows both commit author and event author — Tasks 8 (CLI) and 9 (TUI).
+- ✅ Renderer fallback when commit is not locally available — Tasks 8 and 9 (fallback branches).
+- ✅ "Never breaks sync" error handling philosophy — Task 5 (`eprintln!` warnings + `continue`).
+- ✅ Per-issue cache poisoning within a single sync — Task 5 (`Option<HashSet<...>>` where `None` is poisoned, `Some(_)` is live).
+- ✅ Unit tests for parser (all spec fixtures) — Task 3.
+- ✅ Integration tests: happy path, idempotency, multi-branch, multi-issue, unknown/ambiguous/archived, detached HEAD, remote-originated dedup, CLI rendering, render-time dedup — Tasks 2, 5, 6, 7, 8.
+**Placeholder scan:**
+- No "TBD", "TODO", "fill in later" in any task.
+- Every code block contains the actual code to write.
+- Every test has real assertions.
+- The TUI task has one conditional ("if `repo` isn't in scope, thread it through") — that's an *explicit* decision branch with a concrete fallback, not a placeholder. Acceptable.
+**Type/name consistency:**
+- `LinkedCommit { commit, event_author, event_timestamp }` used consistently across Task 2 struct definition, Task 2 materializer, Task 8 CLI renderer, Task 9 TUI renderer.
+- `scan_and_link(repo, author, sk) -> Result<usize, Error>` used consistently in Task 5 impl and Tasks 5, 6, 7 tests.
+- `collect_linked_shas(repo, issue_ref) -> Result<HashSet<String>, Error>` consistent Task 4 impl + Task 5 caller.
+- `parse_issue_trailers(message) -> Vec<String>` consistent Task 3 impl + Task 3 tests + Task 5 caller.
+- `Action::IssueCommitLink { commit }` — field name `commit` used in Task 1 variant, Task 2 materializer, Task 4 helper, Task 5 orchestrator, Task 2/5 test helpers.
+**Note on one simplification** introduced by the plan vs. the spec's wording:
+The spec says "each time a given issue is matched in a sync, we walk its DAG once to build the set, cache it". The plan implements this literally via `HashMap<String, Option<HashSet<String>>>` in `scan_and_link`, where `Option::None` represents a poisoned (read-failed) issue. The spec wording "poisoned sentinel" is preserved.
+The spec calls the renderer output an "issue-timeline line"; the actual code has no timeline, just separate `--- Comments ---` / `--- Linked Patches ---` sections. The plan adapts this to a new `--- Linked Commits ---` section matching the existing sectioned layout. This is a faithful translation of the spec's intent into the codebase's actual UI structure.
+---
+## Execution Handoff
+Plan complete and saved to `docs/superpowers/plans/2026-04-12-commit-issue-link.md`. Two execution options:
+**1. Subagent-Driven (recommended)** — I dispatch a fresh subagent per task, review between tasks, fast iteration.
+**2. Inline Execution** — Execute tasks in this session using executing-plans, batch execution with checkpoints.
+Which approach?

docs/superpowers/specs/2026-04-12-commit-issue-link-design.md

@@ @@ -0,0 +1,230 @@ @@
+# Auto-Link Commits to Issues via `Issue:` Trailer
+**Status:** design approved
+**Date:** 2026-04-12
+## Summary
+During `git-collab sync`, walk all local branches and look for commits whose messages contain an `Issue: <prefix>` git trailer. For each such commit, resolve the prefix to an issue and emit a new `issue.commit_link` event on that issue's DAG. The operation is idempotent from a single machine: re-running sync against unchanged history produces no new events. Across machines, temporary duplication is possible if two contributors emit a link event for the same (issue, commit) before either has pushed; the renderer dedups by commit SHA so the timeline never shows the same link twice.
+## Motivation
+Today, commits and issues live in parallel. A contributor can mention an issue ID in a commit message, but nothing structured ties them together — the collab view of an issue has no idea which commits reference it. Auto-linking closes that gap without requiring any new command, UI, or manual step beyond writing a trailer.
+Explicitly out of scope: auto-resolving or auto-closing issues from commits. This change records links only.
+## User Experience
+A contributor writes a commit message like:
+```
+Fix off-by-one in patch walker
+The revwalk was skipping the final commit on branches that
+diverged from main before the last sync.
+Issue: a3f9
+```
+They run `git-collab sync`. Output includes:
+```
+Linked 1 commit(s) to issues.
+```
+Later, `git-collab issue show a3f9` shows a new line in the timeline:
+```
+· linked 4b2e1cd "Fix off-by-one in patch walker" by bob (linked by alice, 2h ago)
+```
+Showing both the commit author (`bob`) and the event author (`alice`) matters on shared checkouts and CI boxes: the person who runs sync isn't always the person who wrote the commit, and the timeline needs to reflect that honestly.
+If the contributor forgets the trailer on the first commit but adds it on a later commit, running sync again picks up just the new one. Re-running sync against unchanged history does nothing and prints nothing.
+## Architecture
+One new module, one new event variant, one insertion point in the sync pipeline, one new case in the issue-timeline renderer.
+### Data flow per sync
+. `sync()` completes `reconcile_refs("issues", ...)` and `reconcile_refs("patches", ...)` as today. After reconcile, the local issue DAGs contain every link event that has been pushed to the remote, so the dedup cache we're about to build reflects the merged remote state.
+. Before `collect_push_refs`, `sync()` calls `commit_link::scan_and_link(&repo, &author, &sk)`.
+. `scan_and_link` builds a revwalk seeded from every `refs/heads/*` tip, deduplicating shared ancestors in a per-sync `HashSet<Oid>`. If there are no local branches (e.g. detached HEAD immediately after `git checkout <sha>`) the revwalk is empty and `scan_and_link` is a silent no-op. Shallow clones are fine: the revwalk stops at the shallow boundary, so we link whatever is locally reachable, and deepening the clone and re-syncing picks up anything we missed.
+. For each commit, the module parses `Issue:` trailers from the commit message.
+. For each trailer value, it resolves the prefix via `state::resolve_issue_ref`. Unresolved or ambiguous prefixes become one-line stderr warnings and are skipped. If the resolved ref lives under `refs/collab/archive/issues/...`, the module warns and skips — archived issues are a frozen namespace and should not accrue new events.
+. For each resolved (non-archived) issue, the module lazily loads the issue's existing event log into a per-issue `HashSet<String>` of already-linked commit SHAs. If this commit's SHA is not in the set, it emits a new `IssueCommitLink { commit }` event via `dag::append_event` and adds the SHA to the set.
+. New events are picked up by the subsequent `collect_push_refs` and pushed to the remote in the same sync.
+### Dedup — why two sets
+**Revwalk dedup (`HashSet<Oid>`) — within a single sync.** Branches share ancestors. Without this set, `main`'s history would be walked once per branch tip. It's a perf optimization; correctness is unaffected.
+**Per-issue linked-SHA dedup (`HashMap<IssueRef, HashSet<String>>`) — across sync runs.** A commit with `Issue: abc` will keep matching on every future sync — we need to not emit a new link event every time. The source of truth is the issue's own event DAG: if it already contains an `IssueCommitLink` for this commit, we skip. The first time a given issue is matched in a sync, we walk its DAG once to build the set, cache it, and use the cache for the rest of the sync. New emissions are inserted into the cache so two trailers pointing at the same issue in one sync don't both try to emit.
+The cache key is the *resolved ref name* returned by `state::resolve_issue_ref`, not a reconstructed `refs/collab/issues/<id>` string. This matters because resolution may return either an active or archived ref; using the resolved name keeps the cache, `collect_linked_shas`, and `dag::append_event` all talking about the same ref. (Archived refs are then filtered out entirely per step 5 above; the cache keying is still the right shape for when active refs collide with archived ones.)
+Net effect on a single machine: each (issue, commit) pair produces exactly one `issue.commit_link` event, ever, regardless of how many branches contain the commit or how often sync runs.
+**Cross-machine duplication is possible and tolerated.** If Alice emits a link event that fails to push, and Bob syncs from a different machine before Alice's next sync, Bob's `collect_linked_shas` won't see Alice's pending event (it isn't on the remote yet), and Bob will emit a second link for the same (issue, commit). Both events eventually merge into the DAG. This is correct for the event model but would produce a duplicated timeline entry, so the renderer dedups by commit SHA at render time (see "Issue timeline renderer" below).
+## Components
+### `src/commit_link.rs` (new)
+```rust
+pub fn scan_and_link(
+    repo: &Repository,
+    author: &Author,
+    sk: &SigningKey,
+) -> Result<usize, Error>;  // returns count of events emitted
+fn parse_issue_trailers(message: &str) -> Vec<String>;
+fn collect_linked_shas(repo: &Repository, issue_ref: &str) -> Result<HashSet<String>, Error>;
+```
+`parse_issue_trailers` is pure and string-only: no git, no I/O. It implements the strict trailer-block rules in the "Trailer Parsing Rules" section below. Easy to unit-test with a table of fixtures.
+`collect_linked_shas` walks the DAG for a single issue ref and returns every SHA mentioned in an existing `IssueCommitLink` event. Called lazily on first match per issue; result cached in `scan_and_link`'s local `HashMap` keyed by the *resolved ref name* (not a reconstructed path).
+`scan_and_link` orchestrates: build a `git2::Revwalk`, push every `refs/heads/*` tip, iterate, dedup via `HashSet<Oid>`, per commit call `parse_issue_trailers`, for each trailer value call `state::resolve_issue_ref`, skip archived refs with a warning, populate the per-issue cache on demand (keyed by resolved ref name), and emit via `dag::append_event` using the same resolved ref name.
+### `src/event.rs`
+Add one variant to the `Action` enum (currently ending at line 105):
+```rust
+#[serde(rename = "issue.commit_link")]
+IssueCommitLink { commit: String },
+```
+Serialization follows the existing `rename` pattern. No `alias` needed — this is a new type.
+### `src/sync.rs`
+Insert one call after `reconcile_refs(&repo, "patches", ...)` at line 365, before `collect_push_refs`:
+```rust
+match commit_link::scan_and_link(&repo, &author, &sk) {
+    Ok(n) if n > 0 => println!("Linked {} commit(s) to issues.", n),
+    Ok(_) => {}
+    Err(e) => eprintln!("warning: commit link scan failed: {}", e),
+}
+```
+Sync proceeds to `collect_push_refs` regardless of the result. Any events that were successfully emitted before a failure still get pushed in the same sync.
+### Issue timeline renderer
+Locate the existing match statement that renders events for `issue show`. Add an arm for `IssueCommitLink` that prints:
+```
+· linked <short-sha> "<commit subject>" by <commit-author> (linked by <event-author>, <rel-time>)
+```
+- `<short-sha>`: first 7 characters of the commit SHA.
+- `<commit subject>`: first line of the commit message, truncated to 60 characters (with `…` on truncation).
+- `<commit-author>`: `commit.author().name()` from the git commit object — the person who wrote the code.
+- `<event-author>` and `<rel-time>`: from the event's existing `author` and `timestamp` fields — the person whose sync emitted the link event. On a single-user checkout these are usually the same; on shared checkouts and CI boxes they differ, and showing both is the honest rendering.
+If the commit has been GC'd or isn't available locally at render time, fall back to:
+```
+· linked <short-sha> (commit <short-sha> not in local repo) (linked by <event-author>, <rel-time>)
+```
+**Render-time dedup.** Before rendering, collect `IssueCommitLink` events into a `HashMap<commit_sha, Event>` keyed by commit SHA, keeping the earliest (lowest `clock`, then earliest `timestamp`) event per key. Only the kept event is rendered. This absorbs the cross-machine duplication case described in the dedup section: two machines each emitting a link for the same (issue, commit) yields two DAG events but exactly one timeline line.
+## Trailer Parsing Rules
+**Strict trailer block, matching git's own definition.** Split the commit message on blank lines to get paragraphs. Take the final paragraph. The final paragraph is a trailer block **only if every non-empty line in it is trailer-shaped** — that is, matches `^[A-Za-z][A-Za-z0-9-]*\s*:\s*\S.*$` (a token, colon, non-empty value). If *any* line in the final paragraph is not trailer-shaped, the final paragraph is prose, not a trailer block, and we extract zero trailers from the message. If the whole message is one paragraph with no blank lines, the same rule applies to the whole message.
+This rule deliberately diverges from "final paragraph contains any trailer-looking line" (which would false-positive on a paragraph like `Thanks to Bob for the catch.\nIssue: a3f9`) and aligns with `git interpret-trailers --parse` semantics. Contributors who want to link an issue must use a dedicated trailer block separated from prose by a blank line — the same convention they already use for `Signed-off-by:`.
+**Line match within a confirmed trailer block** = `(?i)^\s*issue\s*:\s*(\S+)\s*$`. Only the exact key `Issue`, case-insensitive. The value must be a single non-whitespace token followed by optional trailing whitespace and end-of-line — nothing else. `Issue: abc fixes thing` does **not** match (the trailing ` fixes thing` is rejected). That's deliberate: anything that looks like a loose commentary on the issue should not silently become a prefix lookup that warns every sync forever. Not `Issues`, not `Fixes`, not `Closes`. Scope is deliberately tight; other keys can be added in follow-up work if needed.
+**One issue prefix per line.** No comma-separated lists. If a contributor wants to link two issues, they write two `Issue:` lines. The `(\S+)` match enforces this at parse time.
+**Multiple trailers on one commit** are all honored. Each resolves independently; each produces its own `IssueCommitLink` event on its respective issue.
+**Resolution** goes through `state::resolve_issue_ref`, which already handles prefix matching and ambiguity:
+- unknown prefix → `warning: commit <sha>: Issue: <val> — no such issue, skipping`
+- ambiguous prefix → `warning: commit <sha>: Issue: <val> — ambiguous (matches N issues), skipping`
+- resolved to an archived ref → `warning: commit <sha>: Issue: <val> — issue is archived, skipping`
+- resolved to an active ref → proceed to dedup and emit
+**Not parsed**: prose mentions in the commit body like "this fixes issue abc". Only the structured trailer form. That's the point of picking a trailer — no false positives from commit messages that happen to mention an issue ID.
+## Error Handling
+**Philosophy: `scan_and_link` must never break sync.** Commits with trailers are a nice-to-have; losing the ability to push collab state because of a parse hiccup would be a bad trade.
+**Inside `scan_and_link`** — per-commit and per-issue errors are caught, turned into one-line stderr warnings prefixed `warning:`, and iteration continues:
+- Commit object fails to load → warn, skip commit.
+- Trailer resolves to unknown or ambiguous issue prefix → warn with commit SHA and trailer value, skip that trailer (other trailers on the same commit are still processed).
+- Reading an issue's existing event log fails → warn, mark that issue as poisoned in the per-sync cache so we don't retry on every subsequent match *within this sync run*. Poisoning is not persisted; the next sync starts fresh and tries again.
+- `dag::append_event` fails for one issue → warn with issue ID and commit SHA, continue. Other emissions in the same sync are unaffected.
+`scan_and_link` returns `Result<usize, Error>` but the only errors that actually propagate are "couldn't even start" failures: repo handle invalid, HEAD missing, revwalk construction failed. Everything else is absorbed.
+**At the sync call site**, the `Err` branch logs and continues. Sync reaches `collect_push_refs` regardless. Any link events that were emitted before the failure still get pushed.
+**Warnings are one-line, `warning:` prefix, stderr**, matching the existing sync output style.
+**Deliberately not handled:**
+- Duplicate-warning suppression. An ambiguous or unknown prefix will warn on every sync until the contributor amends the trailer. That's the right incentive.
+- Retrying failed dag writes. The next sync naturally retries via a cache miss.
+## Testing
+### Unit tests — `tests/commit_link_test.rs` (new)
+Pure parser, table-driven over message → expected trailers:
+- No trailer block → `[]`
+- Single `Issue: abc` in a pure trailer-block final paragraph → `["abc"]`
+- Case variants (`issue:`, `ISSUE :`, `  Issue:  abc  `) → `["abc"]`
+- Two `Issue:` lines in a pure trailer block → `["abc", "def"]`
+- `Issue:` in body but not the final paragraph → `[]`
+- `Issues: abc` (wrong key) → `[]`
+- Prose mention `"fixes issue abc"` → `[]`
+- Message with no blank lines, the whole message is a pure trailer block containing `Issue: abc` → `["abc"]`
+- Empty message → `[]`
+- **Mixed final paragraph** (`Thanks to Bob for the catch.\nIssue: a3f9`) → `[]` — final paragraph contains a prose line, so it's not a trailer block and we extract nothing
+- **Trailing whitespace-only final paragraph** after a real trailer block → `["abc"]` — empty trailing paragraphs don't shadow the previous trailer block
+- **Pure trailer block with mixed keys** (`Signed-off-by: alice <a@x>\nIssue: abc`) → `["abc"]` — `Signed-off-by:` is trailer-shaped so the paragraph still qualifies as a trailer block
+- **Value with trailing garbage** (`Issue: abc fixes thing`) → `[]` — `(\S+)` with anchored `\s*$` rejects the second token
+- **Value with only whitespace** (`Issue:   `) → `[]` — no captured token
+### Integration tests — `tests/sync_test.rs` (extending existing patterns)
+. **Happy path** — create issue `foo`, commit with `Issue: foo` trailer, run sync, assert the issue ref has one new `IssueCommitLink` event with the right SHA.
+. **Idempotency** — run sync twice against the same history, assert exactly one link event exists.
+. **Multiple branches sharing an ancestor** — same linked commit reachable from two branches, assert exactly one link event (exercises both dedup sets).
+. **Multi-issue trailer** — commit with two `Issue:` lines, assert both issues get one event each.
+. **Unknown prefix** — `Issue: zzz` where no issue matches, assert sync completes successfully, no event emitted, warning on stderr.
+. **Ambiguous prefix** — two issues sharing a prefix, trailer uses that prefix, assert no event, warning, sync still succeeds.
+. **Prior manual link then re-sync** — seed the issue's DAG with an `IssueCommitLink` for SHA X, add a new commit with `Issue: foo`, sync, assert only the new event is added.
+. **Remote-originated link dedup** — simulate a remote that already holds an `IssueCommitLink` for commit X (set up via a second repo, push, then clone/fetch into the test repo). Run sync locally with the same commit X present in local history. After `reconcile_refs` the merged log contains the remote event; assert `scan_and_link` sees it via `collect_linked_shas` and does not emit a duplicate.
+. **Archived issue** — archive an issue, add a commit with `Issue: <archived-id>`, sync, assert no event emitted, warning on stderr, archived issue's DAG unchanged, sync still succeeds.
+. **Detached HEAD** — check out a bare SHA with no branches pointing at it, add a commit with `Issue: foo` (orphaned), sync, assert no event emitted (revwalk from `refs/heads/*` is empty) and sync succeeds without error.
+. **Commit-author vs event-author rendering** — emit a link event where the commit author email differs from the git user running the test. Render the issue; assert the one-line format shows both names distinctly.
+. **Render-time dedup** — seed an issue's DAG with two `IssueCommitLink` events for the same commit SHA from different event authors. Render the issue; assert exactly one link line appears, showing the earliest event.
+### Renderer
+Add a case to the existing `issue show` event-rendering test. Assert the one-line format renders as specified. The exact test file will be located during implementation.
+### Not tested
+- Performance on very large histories. The O(history) walk is an accepted cost per the depth-handling decision: parsing is microsecond-cheap, and only commits with actual trailers pay any I/O cost beyond that.
+- Concurrent syncs. Already covered by the existing `SyncLock` in `sync.rs`.
+## Alternatives Considered
+. **Commit-msg hook for immediate linking.** Rejected: requires per-machine install via `git-collab init`, fails open when not installed, and duplicates the sync path for a feature that naturally belongs at publish time.
+. **Persistent scan cursor (last-scanned OID per branch) to bound re-walk work.** Rejected as speculative optimization. Parsing a commit message is microseconds; the per-issue dedup cache is `O(events_on_issue)`; the only real cost is trailer-bearing commits, which are rare.
+. **Cap scan at N commits from each tip.** Rejected: bounded but lossy. Silently misses trailers on older commits for contributors who sync late.
+. **Also parse `Fixes:` / `Closes:` keys and auto-close issues.** Explicitly out of scope. The user asked for link tracking only, and mixing status mutation into the scan would broaden the feature surface considerably.

src/cli.rs

@@ @@ -115,6 +115,12 @@ pub enum Commands { @@
+    /// Manage identity aliases
+    #[command(subcommand)]
+    Identity(IdentityCmd),
+    /// Full-text search across all issues and patches
+    Search {
+        /// Search query (case-insensitive substring match)
+        query: String,
+    },
+#[derive(Subcommand)]
@@ @@ -377,6 +383,38 @@ pub enum PatchCmd { @@
+        /// Patch ID (prefix match)
+        id: String,
+    },
+    /// Check out a patch's latest revision as a local branch
+    Checkout {
+        /// Patch ID (prefix match)
+        id: String,
+    },
+}
+impl Commands {
+    pub fn is_write(&self) -> bool {
+        match self {
+            Commands::Issue(cmd) => matches!(
+                cmd,
+                IssueCmd::Open { .. }
+                    | IssueCmd::Comment { .. }
+                    | IssueCmd::Close { .. }
+                    | IssueCmd::Edit { .. }
+                    | IssueCmd::Label { .. }
+                    | IssueCmd::Unlabel { .. }
+                    | IssueCmd::Assign { .. }
+                    | IssueCmd::Unassign { .. }
+            ),
+            Commands::Patch(cmd) => matches!(
+                cmd,
+                PatchCmd::Create { .. }
+                    | PatchCmd::Comment { .. }
+                    | PatchCmd::Review { .. }
+                    | PatchCmd::Revise { .. }
+                    | PatchCmd::Close { .. }
+            ),
+            _ => false,
+        }
+    }
+#[derive(Subcommand)]

src/commit_link.rs

@@ @@ -0,0 +1,279 @@ @@
+//! Auto-link commits to issues via `Issue:` git trailers during sync.
+//!
+//! See: docs/superpowers/specs/2026-04-12-commit-issue-link-design.md
+use std::collections::{HashMap, HashSet};
+use git2::{Oid, Repository, Sort};
+use crate::dag;
+use crate::error::Error;
+use crate::event::{Action, Author, Event};
+/// Walk an issue's event DAG and return every commit SHA that has an
+/// `IssueCommitLink` event attached. Called lazily on first match per issue
+/// during `scan_and_link`; the result is cached in the orchestrator's
+/// `HashMap<RefName, HashSet<String>>`.
+pub fn collect_linked_shas(repo: &Repository, issue_ref: &str) -> Result<HashSet<String>, Error> {
+    let events = dag::walk_events(repo, issue_ref)?;
+    let mut shas = HashSet::new();
+    for (_oid, event) in events {
+        if let Action::IssueCommitLink { commit } = event.action {
+            shas.insert(commit);
+        }
+    }
+    Ok(shas)
+}
+/// Parse `Issue:` trailers from a commit message.
+///
+/// Returns the list of trailer values in order of appearance. Follows git's
+/// own trailer-block semantics: only the final paragraph is considered, and
+/// *every* non-empty line in it must be trailer-shaped (a `token: value`
+/// line) for the paragraph to qualify. Any prose line in the final paragraph
+/// disqualifies the whole paragraph — this prevents false positives like
+/// `"Thanks Bob.\nIssue: abc"` in commit bodies.
+///
+/// The key match is `(?i)issue`; the value must be a single non-whitespace
+/// token followed by optional trailing whitespace and end-of-line. Values
+/// like `abc fixes thing` are rejected so that loose commentary never
+/// becomes a silent issue-prefix lookup that warns every sync forever.
+pub fn parse_issue_trailers(message: &str) -> Vec<String> {
+    // 1. Split into paragraphs (blank-line separated), preserving order.
+    //    Trim trailing whitespace from each line for the trailer-shape check,
+    //    but keep enough structure to recognize blank lines.
+    let lines: Vec<&str> = message.lines().collect();
+    // 2. Find the last paragraph: the longest tail slice that contains at
+    //    least one non-empty line and has no blank line *before* its first
+    //    non-empty line in the tail.
+    //
+    //    Walking from the end: skip trailing blank/whitespace-only lines,
+    //    then collect lines until we hit a blank line.
+    let mut end = lines.len();
+    while end > 0 && lines[end - 1].trim().is_empty() {
+        end -= 1;
+    }
+    if end == 0 {
+        return Vec::new();
+    }
+    let mut start = end;
+    while start > 0 && !lines[start - 1].trim().is_empty() {
+        start -= 1;
+    }
+    let paragraph = &lines[start..end];
+    // 3. Validate every non-empty line in the paragraph is trailer-shaped.
+    for line in paragraph {
+        if line.trim().is_empty() {
+            continue;
+        }
+        if !is_trailer_shaped(line) {
+            return Vec::new();
+        }
+    }
+    // 4. Extract `Issue:` values.
+    let mut out = Vec::new();
+    for line in paragraph {
+        if let Some(value) = match_issue_line(line) {
+            out.push(value);
+        }
+    }
+    out
+}
+/// Returns true if a line looks like a git trailer: `<token>: <value>`, where
+/// token starts with a letter and consists of `[A-Za-z0-9-]`, and value is at
+/// least one non-whitespace character.
+fn is_trailer_shaped(line: &str) -> bool {
+    let trimmed = line.trim_start();
+    let Some(colon_pos) = trimmed.find(':') else {
+        return false;
+    };
+    // Use trim_end() so that `ISSUE : abc` is recognized as the token `ISSUE`
+    // — matching what `match_issue_line` does. Without this, the space before
+    // the colon would disqualify the line and make the whole paragraph fail
+    // the trailer-shape check.
+    let token = trimmed[..colon_pos].trim_end();
+    if token.is_empty() {
+        return false;
+    }
+    let mut chars = token.chars();
+    let first = chars.next().unwrap();
+    if !first.is_ascii_alphabetic() {
+        return false;
+    }
+    if !chars.all(|c| c.is_ascii_alphanumeric() || c == '-') {
+        return false;
+    }
+    let value = trimmed[colon_pos + 1..].trim();
+    !value.is_empty()
+}
+/// If `line` is an `Issue: <token>` trailer with exactly one non-whitespace
+/// token in its value, returns the token. Otherwise returns None.
+fn match_issue_line(line: &str) -> Option<String> {
+    let trimmed = line.trim_start();
+    let colon_pos = trimmed.find(':')?;
+    let key = trimmed[..colon_pos].trim_end();
+    if !key.eq_ignore_ascii_case("issue") {
+        return None;
+    }
+    let value_region = &trimmed[colon_pos + 1..];
+    let value = value_region.trim();
+    if value.is_empty() {
+        return None;
+    }
+    // Reject values with interior whitespace: `abc fixes thing` must not
+    // parse to `abc` silently — it must parse to nothing so the user sees
+    // that their commentary is being ignored.
+    if value.split_whitespace().count() != 1 {
+        return None;
+    }
+    Some(value.to_string())
+}
+const ACTIVE_ISSUE_PREFIX: &str = "refs/collab/issues/";
+const ARCHIVED_ISSUE_PREFIX: &str = "refs/collab/archive/issues/";
+/// Walk every commit reachable from `refs/heads/*`, parse `Issue:` trailers,
+/// resolve each to an issue, and emit an `IssueCommitLink` event for any
+/// (issue, commit) pair that doesn't already have one.
+///
+/// **Never breaks sync.** Per-commit and per-issue errors are logged as
+/// one-line stderr warnings and iteration continues. The only errors that
+/// propagate are "couldn't even start" failures (opening the repo, building
+/// the revwalk). Callers treat a returned `Err` as "skip the link scan for
+/// this sync" and proceed.
+///
+/// Returns the number of events actually emitted.
+pub fn scan_and_link(
+    repo: &Repository,
+    author: &Author,
+    sk: &ed25519_dalek::SigningKey,
+) -> Result<usize, Error> {
+    // Build a revwalk seeded from every local branch tip.
+    let mut revwalk = repo.revwalk()?;
+    revwalk.set_sorting(Sort::TOPOLOGICAL)?;
+    let mut seeded_any = false;
+    for reference in repo.references_glob("refs/heads/*")? {
+        let Ok(reference) = reference else { continue };
+        let Some(target) = reference.target() else {
+            continue;
+        };
+        // `revwalk.push` dedups commits across branch tips internally.
+        if revwalk.push(target).is_ok() {
+            seeded_any = true;
+        }
+    }
+    if !seeded_any {
+        // Detached HEAD with no local branches. Silent no-op per spec.
+        return Ok(0);
+    }
+    // Per-sync dedup of commits already visited.
+    let mut visited: HashSet<Oid> = HashSet::new();
+    // Cache of existing link SHAs per resolved issue ref. `None` = poisoned.
+    let mut link_cache: HashMap<String, Option<HashSet<String>>> = HashMap::new();
+    let mut emitted: usize = 0;
+    for oid_result in revwalk {
+        let oid = match oid_result {
+            Ok(o) => o,
+            Err(e) => {
+                eprintln!("warning: revwalk error, stopping scan: {}", e);
+                break;
+            }
+        };
+        if !visited.insert(oid) {
+            continue;
+        }
+        let commit = match repo.find_commit(oid) {
+            Ok(c) => c,
+            Err(e) => {
+                eprintln!("warning: cannot load commit {}: {}", oid, e);
+                continue;
+            }
+        };
+        let message = commit.message().unwrap_or("");
+        let trailers = parse_issue_trailers(message);
+        if trailers.is_empty() {
+            continue;
+        }
+        for prefix in trailers {
+            match crate::state::resolve_issue_ref(repo, &prefix) {
+                Ok((resolved_ref, _resolved_id)) => {
+                    if resolved_ref.starts_with(ARCHIVED_ISSUE_PREFIX) {
+                        eprintln!(
+                            "warning: commit {}: Issue: {} — issue is archived, skipping",
+                            oid, prefix
+                        );
+                        continue;
+                    }
+                    if !resolved_ref.starts_with(ACTIVE_ISSUE_PREFIX) {
+                        // Unknown namespace. Should not happen with current
+                        // resolver, but belt-and-braces.
+                        eprintln!(
+                            "warning: commit {}: Issue: {} — resolved to unexpected ref {}, skipping",
+                            oid, prefix, resolved_ref
+                        );
+                        continue;
+                    }
+                    let entry = link_cache.entry(resolved_ref.clone()).or_insert_with(|| {
+                        match collect_linked_shas(repo, &resolved_ref) {
+                            Ok(set) => Some(set),
+                            Err(e) => {
+                                eprintln!(
+                                    "warning: cannot read link events for {}: {} — skipping issue for the rest of this sync",
+                                    resolved_ref, e
+                                );
+                                None
+                            }
+                        }
+                    });
+                    let Some(set) = entry.as_mut() else { continue };
+                    let sha = oid.to_string();
+                    if set.contains(&sha) {
+                        continue;
+                    }
+                    let event = Event {
+                        timestamp: chrono::Utc::now().to_rfc3339(),
+                        author: author.clone(),
+                        action: Action::IssueCommitLink {
+                            commit: sha.clone(),
+                        },
+                        clock: 0,
+                    };
+                    match dag::append_event(repo, &resolved_ref, &event, sk) {
+                        Ok(_) => {
+                            set.insert(sha);
+                            emitted += 1;
+                        }
+                        Err(e) => {
+                            eprintln!(
+                                "warning: commit {}: failed to emit IssueCommitLink on {}: {}",
+                                oid, resolved_ref, e
+                            );
+                        }
+                    }
+                }
+                Err(e) => {
+                    // resolve_issue_ref error message already distinguishes
+                    // "no issue found" from "ambiguous prefix".
+                    eprintln!(
+                        "warning: commit {}: Issue: {} — {}, skipping",
+                        oid, prefix, e
+                    );
+                }
+            }
+        }
+    }
+    Ok(emitted)
+}

src/dag.rs

Old		New
@@ -205,7 +205,13 @@ pub fn reconcile(
205	return Ok((local_oid, ReconcileOutcome::AlreadyCurrent));	205	return Ok((local_oid, ReconcileOutcome::AlreadyCurrent));
206	}	206	}
207		207
208	let merge_base = repo.merge_base(local_oid, remote_oid)?;	208	let merge_base = repo.merge_base(local_oid, remote_oid).map_err(\|e\| {
		209	Error::DisjointHistories {
		210	local_ref: local_ref.to_string(),
		211	remote_ref: remote_ref.to_string(),
		212	detail: e.message().to_string(),
		213	}
		214	})?;
209		215
210	if merge_base == remote_oid {	216	if merge_base == remote_oid {
211	// Remote is ancestor of local — local is ahead	217	// Remote is ancestor of local — local is ahead
@@ -251,7 +257,11 @@ pub fn reconcile(
251		257
252	/// Migrate a DAG ref so that every event with clock=0 gets a sequential clock	258	/// Migrate a DAG ref so that every event with clock=0 gets a sequential clock
253	/// assigned in topological order. Events that already have clock>0 are left as-is.	259	/// assigned in topological order. Events that already have clock>0 are left as-is.
254	/// This rewrites the commit chain (new OIDs) and updates the ref.	260	///
		261	/// WARNING: This rewrites the commit chain, producing new OIDs for every
		262	/// commit. If the ref has already been pushed to a remote, other users who
		263	/// fetched the old OIDs will encounter disjoint histories on their next sync.
		264	/// Only call this on refs that have not been shared.
255	pub fn migrate_clocks(	265	pub fn migrate_clocks(
256	repo: &Repository,	266	repo: &Repository,
257	ref_name: &str,	267	ref_name: &str,
@@ -314,6 +324,7 @@ fn commit_message(action: &Action) -> String {
314	Action::IssueComment { .. } => "issue: comment".to_string(),	324	Action::IssueComment { .. } => "issue: comment".to_string(),
315	Action::IssueClose { .. } => "issue: close".to_string(),	325	Action::IssueClose { .. } => "issue: close".to_string(),
316	Action::IssueReopen => "issue: reopen".to_string(),	326	Action::IssueReopen => "issue: reopen".to_string(),
		327	Action::IssueCommitLink { commit } => format!("issue: commit link {}", &commit[..commit.len().min(7)]),
317	Action::PatchCreate { title, .. } => format!("patch: create \"{}\"", title),	328	Action::PatchCreate { title, .. } => format!("patch: create \"{}\"", title),
318	Action::PatchRevision { .. } => "patch: revision".to_string(),	329	Action::PatchRevision { .. } => "patch: revision".to_string(),
319	Action::PatchReview { verdict, .. } => format!("patch: review ({})", verdict),	330	Action::PatchReview { verdict, .. } => format!("patch: review ({})", verdict),

src/error.rs

Old		New
@@ -40,4 +40,11 @@ pub enum Error {
40		40
41	#[error("ambiguous id prefix '{prefix}': {count} matches")]	41	#[error("ambiguous id prefix '{prefix}': {count} matches")]
42	AmbiguousId { prefix: String, count: usize },	42	AmbiguousId { prefix: String, count: usize },
		43
		44	#[error("disjoint histories: local ref '{local_ref}' and remote ref '{remote_ref}' share no common ancestor ({detail})")]
		45	DisjointHistories {
		46	local_ref: String,
		47	remote_ref: String,
		48	detail: String,
		49	},
43	}	50	}

src/event.rs

Old		New
@@ -44,6 +44,10 @@ pub enum Action {
44	IssueUnassign { assignee: String },	44	IssueUnassign { assignee: String },
45	#[serde(rename = "issue.reopen")]	45	#[serde(rename = "issue.reopen")]
46	IssueReopen,	46	IssueReopen,
		47	#[serde(rename = "issue.commit_link")]
		48	IssueCommitLink {
		49	commit: String,
		50	},
47	#[serde(rename = "patch.create", alias = "PatchCreate")]	51	#[serde(rename = "patch.create", alias = "PatchCreate")]
48	PatchCreate {	52	PatchCreate {
49	title: String,	53	title: String,

src/lib.rs

@@ @@ -1,5 +1,6 @@ @@
+pub mod cache;
+pub mod cli;
+pub mod commit_link;
+pub mod dag;
+pub mod editor;
+pub mod error;
+    ))
+fn maybe_auto_sync(repo: &Repository) {
+    let enabled = repo
+        .config()
+        .ok()
+        .and_then(|c| c.get_bool("collab.autoSync").ok())
+        .unwrap_or(true);
+    if !enabled {
+        return;
+    }
+    let remote = repo
+        .config()
+        .ok()
+        .and_then(|c| c.get_string("collab.autoSyncRemote").ok())
+        .unwrap_or_else(|| "origin".to_string());
+    eprintln!("Auto-syncing with '{}'...", remote);
+    match sync::sync(repo, &remote) {
+        Ok(()) => {}
+        Err(error::Error::PartialSync { succeeded, total }) => {
+            eprintln!("warning: auto-sync partially failed ({}/{} refs pushed)", succeeded, total);
+        }
+        Err(e) => {
+            eprintln!("warning: auto-sync failed: {}", e);
+        }
+    }
+}
+pub fn run(cli: cli::Cli, repo: &Repository) -> Result<(), error::Error> {
+    let is_write = cli.command.is_write();
+    match cli.command {
+        Commands::Init => sync::init(repo),
+        Commands::Issue(cmd) => match cmd {
+                        println!("\n{} ({}):\n{}", c.author.name, c.timestamp, c.body);
+                if !i.linked_commits.is_empty() {
+                    println!("\n--- Linked Commits ---");
+                    for lc in &i.linked_commits {
+                        let short_sha = if lc.commit.len() >= 7 { &lc.commit[..7] } else { &lc.commit };
+                        let (subject, commit_author) = match git2::Oid::from_str(&lc.commit)
+                            .ok()
+                            .and_then(|oid| repo.find_commit(oid).ok())
+                        {
+                            Some(commit) => {
+                                let subject = commit
+                                    .summary()
+                                    .map(|s| truncate_summary(s, 60))
+                                    .unwrap_or_default();
+                                let author = commit
+                                    .author()
+                                    .name()
+                                    .unwrap_or("unknown")
+                                    .to_string();
+                                (Some(subject), Some(author))
+                            }
+                            None => (None, None),
+                        };
+                        match (subject, commit_author) {
+                            (Some(subject), Some(author)) => {
+                                println!(
+                                    "· linked {} \"{}\" by {} (linked by {}, {})",
+                                    short_sha,
+                                    subject,
+                                    author,
+                                    lc.event_author.name,
+                                    lc.event_timestamp,
+                                );
+                            }
+                            _ => {
+                                println!(
+                                    "· linked {} (commit {} not in local repo) (linked by {}, {})",
+                                    short_sha,
+                                    short_sha,
+                                    lc.event_author.name,
+                                    lc.event_timestamp,
+                                );
+                            }
+                        }
+                    }
+                }
+                Ok(())
+            IssueCmd::Label { id, label } => {
+                    println!("{}", output);
+                    return Ok(());
+                let entries = patch::list(repo, all, archived, limit, offset, sort)?;
+                if entries.is_empty() {
+                    println!("No patches found.");
+                } else {
+                    for e in &entries {
+                        let p = &e.patch;
+                        let stale = match p.staleness(repo) {
+                            Ok((_, behind)) if behind > 0 => format!(" [behind {}]", behind),
+                            Ok(_) => String::new(),
+                            Err(_) => String::new(),
+                        };
+                        let unread = match e.unread {
+                            Some(n) if n > 0 => format!(" ({} new)", n),
+                            _ => String::new(),
+                        };
+                        println!(
+                            "{:.8}  {:6}  {}  (by {}){}{}",
+                            p.id, p.status, p.title, p.author.name, stale, unread
+                        );
+                let p = patch::show(repo, &id)?;
+                let rev_count = p.revisions.len();
+                let status_detail = match p.staleness(repo) {
+                    Ok((_, behind)) if behind > 0 => {
+                        format!(" (branch is {} commits behind {})", behind, p.base_ref)
+                    }
+                    _ => String::new(),
+                };
+                println!("Patch {} [{}{}] (r{})", &p.id[..8], p.status, status_detail, rev_count);
+                println!("Title: {}", p.title);
+                println!("Author: {} <{}>", p.author.name, p.author.email);
+                match p.resolve_head(repo) {
+                println!("Deleted patch {:.8}", full_id);
+                Ok(())
+            PatchCmd::Checkout { id } => {
+                patch::checkout(repo, &id)?;
+                Ok(())
+            }
+        },
+        Commands::Release(cmd) => match cmd {
+            ReleaseCmd::Publish {
+                Ok(())
+        },
+        Commands::Search { query } => search(repo, &query),
+    }?;
+    if is_write {
+        maybe_auto_sync(repo);
+    }
+    Ok(())
+}
+fn search(repo: &Repository, query: &str) -> Result<(), error::Error> {
+    let q = query.to_lowercase();
+    let issues = state::list_issues_with_archived(repo)?;
+    let mut issue_results: Vec<(&str, &str, &str, String)> = Vec::new();
+    for issue in &issues {
+        let mut matches = Vec::new();
+        if issue.title.to_lowercase().contains(&q) {
+            matches.push("title");
+        }
+        if issue.body.to_lowercase().contains(&q) {
+            matches.push("body");
+        }
+        if issue.comments.iter().any(|c| c.body.to_lowercase().contains(&q)) {
+            matches.push("comment");
+        }
+        if !matches.is_empty() {
+            issue_results.push((
+                &issue.id,
+                issue.status.as_str(),
+                &issue.title,
+                matches.join(", "),
+            ));
+        }
+    }
+    let patches = state::list_patches_with_archived(repo)?;
+    let mut patch_results: Vec<(&str, &str, &str, String)> = Vec::new();
+    for patch in &patches {
+        let mut matches = Vec::new();
+        if patch.title.to_lowercase().contains(&q) {
+            matches.push("title");
+        }
+        if patch.body.to_lowercase().contains(&q) {
+            matches.push("body");
+        }
+        if patch.comments.iter().any(|c| c.body.to_lowercase().contains(&q)) {
+            matches.push("comment");
+        }
+        if patch.reviews.iter().any(|r| r.body.to_lowercase().contains(&q)) {
+            matches.push("review");
+        }
+        if patch.inline_comments.iter().any(|ic| ic.body.to_lowercase().contains(&q)) {
+            matches.push("inline comment");
+        }
+        if !matches.is_empty() {
+            patch_results.push((
+                &patch.id,
+                patch.status.as_str(),
+                &patch.title,
+                matches.join(", "),
+            ));
+        }
+    }
+    println!("Issues:");
+    if issue_results.is_empty() {
+        println!("  (none)");
+    } else {
+        for (id, status, title, match_field) in &issue_results {
+            println!("  {:.8}  {:6}  {}  ({} match)", id, status, title, match_field);
+        }
+    }
+    println!();
+    println!("Patches:");
+    if patch_results.is_empty() {
+        println!("  (none)");
+    } else {
+        for (id, status, title, match_field) in &patch_results {
+            println!("  {:.8}  {:6}  {}  ({} match)", id, status, title, match_field);
+        }
+    }
+    Ok(())
+}
+pub(crate) fn truncate_summary(s: &str, max_chars: usize) -> String {
+    let mut out = String::new();
+    for (count, c) in s.chars().enumerate() {
+        if count + 1 > max_chars {
+            out.push('…');
+            return out;
+        }
+        out.push(c);
+    out

src/log.rs

src/patch.rs

Old		New
@@ -130,6 +130,31 @@ pub fn create(
130	Ok(id)	130	Ok(id)
131	}	131	}
132		132
		133	pub struct ListEntry {
		134	pub patch: PatchState,
		135	pub unread: Option<usize>,
		136	}
		137
		138	/// Count events after the last-seen mark. Returns None if never viewed.
		139	fn count_unread(repo: &git2::Repository, id: &str) -> Option<usize> {
		140	let seen_ref = format!("refs/collab/local/seen/patches/{}", id);
		141	let seen_oid = repo.refname_to_id(&seen_ref).ok()?;
		142	let ref_name = format!("refs/collab/patches/{}", id);
		143	let tip = repo.refname_to_id(&ref_name).ok()?;
		144
		145	if seen_oid == tip {
		146	return Some(0);
		147	}
		148
		149	let mut revwalk = repo.revwalk().ok()?;
		150	revwalk
		151	.set_sorting(git2::Sort::TOPOLOGICAL)
		152	.ok()?;
		153	revwalk.push(tip).ok()?;
		154	revwalk.hide(seen_oid).ok()?;
		155	Some(revwalk.count())
		156	}
		157
133	pub fn list(	158	pub fn list(
134	repo: &Repository,	159	repo: &Repository,
135	show_closed: bool,	160	show_closed: bool,
@@ -137,19 +162,21 @@ pub fn list(
137	limit: Option<usize>,	162	limit: Option<usize>,
138	offset: Option<usize>,	163	offset: Option<usize>,
139	sort: SortMode,	164	sort: SortMode,
140	) -> Result<Vec<PatchState>, crate::error::Error> {	165	) -> Result<Vec<ListEntry>, crate::error::Error> {
141	let patches = if show_archived {	166	let patches = if show_archived {
142	state::list_patches_with_archived(repo)?	167	state::list_patches_with_archived(repo)?
143	} else {	168	} else {
144	state::list_patches(repo)?	169	state::list_patches(repo)?
145	};	170	};
146	Ok(cli::filter_sort_paginate(	171	let filtered = cli::filter_sort_paginate(patches, show_closed, sort, offset, limit);
147	patches,	172	let entries = filtered
148	show_closed,	173	.into_iter()
149	sort,	174	.map(\|patch\| {
150	offset,	175	let unread = count_unread(repo, &patch.id);
151	limit,	176	ListEntry { patch, unread }
152	))	177	})
		178	.collect();
		179	Ok(entries)
153	}	180	}
154		181
155	pub fn list_to_writer(	182	pub fn list_to_writer(
@@ -161,16 +188,26 @@ pub fn list_to_writer(
161	sort: SortMode,	188	sort: SortMode,
162	writer: &mut dyn std::io::Write,	189	writer: &mut dyn std::io::Write,
163	) -> Result<(), crate::error::Error> {	190	) -> Result<(), crate::error::Error> {
164	let patches = list(repo, show_closed, show_archived, limit, offset, sort)?;	191	let entries = list(repo, show_closed, show_archived, limit, offset, sort)?;
165	if patches.is_empty() {	192	if entries.is_empty() {
166	writeln!(writer, "No patches found.").ok();	193	writeln!(writer, "No patches found.").ok();
167	return Ok(());	194	return Ok(());
168	}	195	}
169	for p in &patches {	196	for e in &entries {
		197	let p = &e.patch;
		198	let stale = match p.staleness(repo) {
		199	Ok((_, behind)) if behind > 0 => format!(" [behind {}]", behind),
		200	Ok(_) => String::new(),
		201	Err(_) => String::new(),
		202	};
		203	let unread = match e.unread {
		204	Some(n) if n > 0 => format!(" ({} new)", n),
		205	_ => String::new(),
		206	};
170	writeln!(	207	writeln!(
171	writer,	208	writer,
172	"{:.8} {:6} {} (by {})",	209	"{:.8} {:6} {} (by {}){}{}",
173	p.id, p.status, p.title, p.author.name	210	p.id, p.status, p.title, p.author.name, stale, unread
174	)	211	)
175	.ok();	212	.ok();
176	}	213	}
@@ -183,7 +220,8 @@ pub fn list_json(
183	show_archived: bool,	220	show_archived: bool,
184	sort: SortMode,	221	sort: SortMode,
185	) -> Result<String, crate::error::Error> {	222	) -> Result<String, crate::error::Error> {
186	let patches = list(repo, show_closed, show_archived, None, None, sort)?;	223	let entries = list(repo, show_closed, show_archived, None, None, sort)?;
		224	let patches: Vec<&PatchState> = entries.iter().map(\|e\| &e.patch).collect();
187	Ok(serde_json::to_string_pretty(&patches)?)	225	Ok(serde_json::to_string_pretty(&patches)?)
188	}	226	}
189		227
@@ -195,7 +233,12 @@ pub fn show_json(repo: &Repository, id_prefix: &str) -> Result<String, crate::er
195		233
196	pub fn show(repo: &Repository, id_prefix: &str) -> Result<PatchState, crate::error::Error> {	234	pub fn show(repo: &Repository, id_prefix: &str) -> Result<PatchState, crate::error::Error> {
197	let (ref_name, id) = state::resolve_patch_ref(repo, id_prefix)?;	235	let (ref_name, id) = state::resolve_patch_ref(repo, id_prefix)?;
198	PatchState::from_ref(repo, &ref_name, &id)	236	let patch = PatchState::from_ref(repo, &ref_name, &id)?;
		237	// Mark as read: store current tip as seen
		238	let tip = repo.refname_to_id(&ref_name)?;
		239	let seen_ref = format!("refs/collab/local/seen/patches/{}", id);
		240	repo.reference(&seen_ref, tip, true, "mark seen")?;
		241	Ok(patch)
199	}	242	}
200		243
201	pub fn comment(	244	pub fn comment(
@@ -580,6 +623,51 @@ pub fn patch_log_json(patch: &PatchState) -> Result<String, Error> {
580	Ok(serde_json::to_string_pretty(&patch.revisions)?)	623	Ok(serde_json::to_string_pretty(&patch.revisions)?)
581	}	624	}
582		625
		626	pub fn checkout(repo: &Repository, id_prefix: &str) -> Result<(), crate::error::Error> {
		627	let (_ref_name, id) = state::resolve_patch_ref(repo, id_prefix)?;
		628	let patch = show(repo, id_prefix)?;
		629
		630	let latest_rev = patch
		631	.revisions
		632	.last()
		633	.ok_or_else(\|\| Error::Cmd("patch has no revisions".to_string()))?;
		634	let commit_oid = Oid::from_str(&latest_rev.commit)
		635	.map_err(\|e\| Error::Cmd(format!("invalid commit OID in revision: {}", e)))?;
		636	let commit = repo
		637	.find_commit(commit_oid)
		638	.map_err(\|e\| Error::Cmd(format!("commit {} not found: {}", &latest_rev.commit, e)))?;
		639
		640	let short_id = &id[..std::cmp::min(8, id.len())];
		641	let branch_name = {
		642	let candidate = format!("collab/{}", short_id);
		643	if repo.find_branch(&candidate, git2::BranchType::Local).is_err() {
		644	candidate
		645	} else {
		646	let mut n = 1u32;
		647	loop {
		648	let suffixed = format!("collab/{}-{}", short_id, n);
		649	if repo.find_branch(&suffixed, git2::BranchType::Local).is_err() {
		650	break suffixed;
		651	}
		652	n += 1;
		653	}
		654	}
		655	};
		656
		657	repo.branch(&branch_name, &commit, false)?;
		658
		659	let refname = format!("refs/heads/{}", branch_name);
		660	let obj = repo.revparse_single(&refname)?;
		661	repo.checkout_tree(&obj, None)?;
		662	repo.set_head(&refname)?;
		663
		664	println!(
		665	"Checked out patch {} (revision {}) on branch {}",
		666	short_id, latest_rev.number, branch_name
		667	);
		668	Ok(())
		669	}
		670
583	pub fn delete(repo: &Repository, id_prefix: &str) -> Result<String, crate::error::Error> {	671	pub fn delete(repo: &Repository, id_prefix: &str) -> Result<String, crate::error::Error> {
584	let (ref_name, id) = state::resolve_patch_ref(repo, id_prefix)?;	672	let (ref_name, id) = state::resolve_patch_ref(repo, id_prefix)?;
585	repo.find_reference(&ref_name)?.delete()?;	673	repo.find_reference(&ref_name)?.delete()?;

src/server/ssh/auth.rs

Old		New
@@ -20,11 +20,7 @@ pub fn parse_authorized_keys(content: &str) -> Vec<AuthorizedKey> {
20	let key_type = parts.next()?.to_string();	20	let key_type = parts.next()?.to_string();
21	let key_data = parts.next()?.to_string();	21	let key_data = parts.next()?.to_string();
22	let comment = parts.next().map(\|s\| s.to_string());	22	let comment = parts.next().map(\|s\| s.to_string());
23	Some(AuthorizedKey {	23	Some(AuthorizedKey { key_type, key_data, comment })
24	key_type,
25	key_data,
26	comment,
27	})
28	})	24	})
29	.collect()	25	.collect()
30	}	26	}
@@ -34,9 +30,16 @@ pub fn load_authorized_keys(path: &Path) -> Result<Vec<AuthorizedKey>, std::io::
34	Ok(parse_authorized_keys(&content))	30	Ok(parse_authorized_keys(&content))
35	}	31	}
36		32
		33	fn is_rsa_key_type(key_type: &str) -> bool {
		34	matches!(key_type, "ssh-rsa" \| "rsa-sha2-256" \| "rsa-sha2-512")
		35	}
		36
37	pub fn is_authorized(keys: &[AuthorizedKey], key_type: &str, key_data: &str) -> bool {	37	pub fn is_authorized(keys: &[AuthorizedKey], key_type: &str, key_data: &str) -> bool {
38	keys.iter()	38	keys.iter().any(\|k\| {
39	.any(\|k\| k.key_type == key_type && k.key_data == key_data)	39	let type_matches = k.key_type == key_type
		40	\|\| (is_rsa_key_type(&k.key_type) && is_rsa_key_type(key_type));
		41	type_matches && k.key_data == key_data
		42	})
40	}	43	}
41		44
42	#[cfg(test)]	45	#[cfg(test)]
@@ -85,4 +88,13 @@ mod tests {
85	assert!(!is_authorized(&keys, "ssh-ed25519", "AAAA9999"));	88	assert!(!is_authorized(&keys, "ssh-ed25519", "AAAA9999"));
86	assert!(!is_authorized(&keys, "ssh-rsa", "AAAA1111"));	89	assert!(!is_authorized(&keys, "ssh-rsa", "AAAA1111"));
87	}	90	}
		91
		92	#[test]
		93	fn rsa_key_type_variants_match() {
		94	let keys = parse_authorized_keys("ssh-rsa AAAARSA user\n");
		95	assert!(is_authorized(&keys, "ssh-rsa", "AAAARSA"));
		96	assert!(is_authorized(&keys, "rsa-sha2-256", "AAAARSA"));
		97	assert!(is_authorized(&keys, "rsa-sha2-512", "AAAARSA"));
		98	assert!(!is_authorized(&keys, "rsa-sha2-256", "WRONG"));
		99	}
88	}	100	}

src/signing.rs

Old		New
@@ -139,11 +139,11 @@ pub fn load_verifying_key(config_dir: &Path) -> Result<VerifyingKey, Error> {
139	.map_err(\|e\| Error::Verification(format!("invalid verifying key: {}", e)))	139	.map_err(\|e\| Error::Verification(format!("invalid verifying key: {}", e)))
140	}	140	}
141		141
142	/// Serialize an Event to canonical JSON bytes.	142	/// Serialize an Event to canonical JSON bytes with deterministic key ordering.
143	///	143	///
144	/// Uses `serde_json::Value` as an intermediate step. Since serde_json uses	144	/// Relies on `serde_json::Map` being backed by `BTreeMap` (sorted keys) when
145	/// BTreeMap-backed Map (no `preserve_order` feature), keys are sorted	145	/// the `preserve_order` feature is not enabled. A test below verifies this
146	/// alphabetically, ensuring deterministic output.	146	/// invariant so we catch breakage from transitive feature activation.
147	pub fn canonical_json(event: &Event) -> Result<Vec<u8>, Error> {	147	pub fn canonical_json(event: &Event) -> Result<Vec<u8>, Error> {
148	let value = serde_json::to_value(event)?;	148	let value = serde_json::to_value(event)?;
149	let json = serde_json::to_string(&value)?;	149	let json = serde_json::to_string(&value)?;
@@ -332,4 +332,33 @@ mod tests {
332	let status = verify_detached(&event, &sig).unwrap();	332	let status = verify_detached(&event, &sig).unwrap();
333	assert_eq!(status, VerifyStatus::Valid);	333	assert_eq!(status, VerifyStatus::Valid);
334	}	334	}
		335
		336	#[test]
		337	fn canonical_json_keys_are_sorted() {
		338	// Guard against serde_json's `preserve_order` feature being activated
		339	// by a transitive dependency, which would break signature determinism.
		340	let event = Event {
		341	timestamp: "2026-03-21T00:00:00Z".to_string(),
		342	author: Author {
		343	name: "Alice".to_string(),
		344	email: "alice@example.com".to_string(),
		345	},
		346	action: Action::IssueOpen {
		347	title: "Test".to_string(),
		348	body: "Body".to_string(),
		349	relates_to: None,
		350	},
		351	clock: 1,
		352	};
		353	let json = canonical_json(&event).unwrap();
		354	let parsed: serde_json::Value = serde_json::from_slice(&json).unwrap();
		355	if let serde_json::Value::Object(map) = parsed {
		356	let keys: Vec<&String> = map.keys().collect();
		357	let mut sorted = keys.clone();
		358	sorted.sort();
		359	assert_eq!(keys, sorted, "top-level JSON keys must be alphabetically sorted");
		360	} else {
		361	panic!("expected JSON object");
		362	}
		363	}
335	}	364	}

src/state.rs

Old		New
@@ -1,5 +1,7 @@
		1	use std::collections::HashMap;
1	use std::fmt;	2	use std::fmt;
2		3
		4	use chrono::{DateTime, Utc};
3	use git2::{Oid, Repository};	5	use git2::{Oid, Repository};
4	use serde::{Deserialize, Serialize};	6	use serde::{Deserialize, Serialize};
5		7
@@ -7,6 +9,14 @@ use crate::cache;
7	use crate::dag;	9	use crate::dag;
8	use crate::event::{Action, Author, ReviewVerdict};	10	use crate::event::{Action, Author, ReviewVerdict};
9		11
		12	/// Parse an RFC3339 timestamp, returning the earliest representable time on
		13	/// failure so that unparseable timestamps sort before any valid one.
		14	fn parse_timestamp(s: &str) -> DateTime<Utc> {
		15	DateTime::parse_from_rfc3339(s)
		16	.map(\|dt\| dt.with_timezone(&Utc))
		17	.unwrap_or(DateTime::<Utc>::MIN_UTC)
		18	}
		19
10	fn serialize_oid<S: serde::Serializer>(oid: &Oid, s: S) -> Result<S::Ok, S::Error> {	20	fn serialize_oid<S: serde::Serializer>(oid: &Oid, s: S) -> Result<S::Ok, S::Error> {
11	s.serialize_str(&oid.to_string())	21	s.serialize_str(&oid.to_string())
12	}	22	}
@@ -75,6 +85,16 @@ pub struct Comment {
75	}	85	}
76		86
77	#[derive(Debug, Clone, Serialize, Deserialize)]	87	#[derive(Debug, Clone, Serialize, Deserialize)]
		88	pub struct LinkedCommit {
		89	/// Full 40-char commit SHA from the trailer.
		90	pub commit: String,
		91	/// Author of the `IssueCommitLink` event (who ran sync).
		92	pub event_author: Author,
		93	/// Timestamp of the `IssueCommitLink` event.
		94	pub event_timestamp: String,
		95	}
		96
		97	#[derive(Debug, Clone, Serialize, Deserialize)]
78	pub struct IssueState {	98	pub struct IssueState {
79	pub id: String,	99	pub id: String,
80	pub title: String,	100	pub title: String,
@@ -89,6 +109,8 @@ pub struct IssueState {
89	pub labels: Vec<String>,	109	pub labels: Vec<String>,
90	pub assignees: Vec<String>,	110	pub assignees: Vec<String>,
91	pub comments: Vec<Comment>,	111	pub comments: Vec<Comment>,
		112	#[serde(default)]
		113	pub linked_commits: Vec<LinkedCommit>,
92	pub created_at: String,	114	pub created_at: String,
93	#[serde(default)]	115	#[serde(default)]
94	pub last_updated: String,	116	pub last_updated: String,
@@ -237,15 +259,24 @@ impl IssueState {
237	) -> Result<Self, crate::error::Error> {	259	) -> Result<Self, crate::error::Error> {
238	let events = dag::walk_events(repo, ref_name)?;	260	let events = dag::walk_events(repo, ref_name)?;
239	let mut state: Option<IssueState> = None;	261	let mut state: Option<IssueState> = None;
240	let mut max_timestamp = String::new();	262	let mut latest: Option<(DateTime<Utc>, String)> = None;
241		263
242	// Track the (clock, commit_oid_hex) of the latest status-changing event.	264	// Track the (clock, commit_oid_hex) of the latest status-changing event.
243	// Higher clock wins; on tie, lexicographically higher OID wins.	265	// Higher clock wins; on tie, lexicographically higher OID wins.
244	let mut status_key: Option<(u64, String)> = None;	266	let mut status_key: Option<(u64, String)> = None;
245		267
		268	// Accumulator for IssueCommitLink dedup. Keyed by commit SHA, valued by
		269	// the (clock, timestamp, oid_hex) sort key plus the LinkedCommit payload.
		270	// We keep the entry with the minimum sort key per SHA — i.e. the
		271	// earliest emission by (clock, timestamp, oid). Topological walk order
		272	// alone does not guarantee this for cross-machine concurrent events
		273	// that are reconciled via merge commits, so we sort explicitly.
		274	let mut link_acc: HashMap<String, ((u64, String, String), LinkedCommit)> = HashMap::new();
		275
246	for (oid, event) in events {	276	for (oid, event) in events {
247	if event.timestamp > max_timestamp {	277	let ts = parse_timestamp(&event.timestamp);
248	max_timestamp = event.timestamp.clone();	278	if latest.as_ref().is_none_or(\|(prev, _)\| ts > *prev) {
		279	latest = Some((ts, event.timestamp.clone()));
249	}	280	}
250	match event.action {	281	match event.action {
251	Action::IssueOpen {	282	Action::IssueOpen {
@@ -263,6 +294,7 @@ impl IssueState {
263	labels: Vec::new(),	294	labels: Vec::new(),
264	assignees: Vec::new(),	295	assignees: Vec::new(),
265	comments: Vec::new(),	296	comments: Vec::new(),
		297	linked_commits: Vec::new(),
266	created_at: event.timestamp.clone(),	298	created_at: event.timestamp.clone(),
267	last_updated: String::new(),	299	last_updated: String::new(),
268	author: event.author.clone(),	300	author: event.author.clone(),
@@ -335,13 +367,44 @@ impl IssueState {
335	}	367	}
336	}	368	}
337	}	369	}
338	Action::Merge => {}	370	Action::IssueCommitLink { commit } => {
		371	if state.is_some() {
		372	// Render-time dedup by commit SHA. We compare an
		373	// explicit (clock, timestamp, oid_hex) key per event
		374	// and keep the minimum so the surviving entry is the
		375	// earliest emission per the spec, regardless of how
		376	// the merged DAG happens to topo-order itself.
		377	let key = (event.clock, event.timestamp.clone(), oid.to_string());
		378	let new_link = LinkedCommit {
		379	commit: commit.clone(),
		380	event_author: event.author.clone(),
		381	event_timestamp: event.timestamp.clone(),
		382	};
		383	link_acc
		384	.entry(commit)
		385	.and_modify(\|existing\| {
		386	if key < existing.0 {
		387	*existing = (key.clone(), new_link.clone());
		388	}
		389	})
		390	.or_insert((key, new_link));
		391	}
		392	}
339	_ => {}	393	_ => {}
340	}	394	}
341	}	395	}
342		396
343	if let Some(ref mut s) = state {	397	if let Some(ref mut s) = state {
344	s.last_updated = max_timestamp;	398	s.last_updated = latest.map(\|(_, raw)\| raw).unwrap_or_default();
		399
		400	// Flush the linked-commit accumulator into state.linked_commits in
		401	// a stable order. Sort by the same (clock, timestamp, oid) key we
		402	// used for the per-SHA min so the rendered list is deterministic
		403	// across runs (HashMap iteration order is randomized).
		404	let mut entries: Vec<((u64, String, String), LinkedCommit)> =
		405	link_acc.into_values().collect();
		406	entries.sort_by(\|a, b\| a.0.cmp(&b.0));
		407	s.linked_commits = entries.into_iter().map(\|(_, lc)\| lc).collect();
345	}	408	}
346	state.ok_or_else(\|\| git2::Error::from_str("no IssueOpen event found in DAG").into())	409	state.ok_or_else(\|\| git2::Error::from_str("no IssueOpen event found in DAG").into())
347	}	410	}
@@ -441,13 +504,14 @@ impl PatchState {
441	) -> Result<Self, crate::error::Error> {	504	) -> Result<Self, crate::error::Error> {
442	let events = dag::walk_events(repo, ref_name)?;	505	let events = dag::walk_events(repo, ref_name)?;
443	let mut state: Option<PatchState> = None;	506	let mut state: Option<PatchState> = None;
444	let mut max_timestamp = String::new();	507	let mut latest: Option<(DateTime<Utc>, String)> = None;
445		508
446	let mut status_key: Option<(u64, String)> = None;	509	let mut status_key: Option<(u64, String)> = None;
447		510
448	for (oid, event) in events {	511	for (oid, event) in events {
449	if event.timestamp > max_timestamp {	512	let ts = parse_timestamp(&event.timestamp);
450	max_timestamp = event.timestamp.clone();	513	if latest.as_ref().is_none_or(\|(prev, _)\| ts > *prev) {
		514	latest = Some((ts, event.timestamp.clone()));
451	}	515	}
452	match event.action {	516	match event.action {
453	Action::PatchCreate {	517	Action::PatchCreate {
@@ -571,13 +635,12 @@ impl PatchState {
571	}	635	}
572	}	636	}
573	}	637	}
574	Action::Merge => {}
575	_ => {}	638	_ => {}
576	}	639	}
577	}	640	}
578		641
579	if let Some(ref mut s) = state {	642	if let Some(ref mut s) = state {
580	s.last_updated = max_timestamp;	643	s.last_updated = latest.map(\|(_, raw)\| raw).unwrap_or_default();
581	s.check_auto_merge(repo);	644	s.check_auto_merge(repo);
582	}	645	}
583	state.ok_or_else(\|\| git2::Error::from_str("no PatchCreate event found in DAG").into())	646	state.ok_or_else(\|\| git2::Error::from_str("no PatchCreate event found in DAG").into())
@@ -668,7 +731,11 @@ pub fn list_issues(repo: &Repository) -> Result<Vec<IssueState>, crate::error::E
668	let items = collab_refs(repo, "issues")?	731	let items = collab_refs(repo, "issues")?
669	.into_iter()	732	.into_iter()
670	.filter(\|(_, id)\| !archived_ids.contains(id))	733	.filter(\|(_, id)\| !archived_ids.contains(id))
671	.filter_map(\|(ref_name, id)\| IssueState::from_ref(repo, &ref_name, &id).ok())	734	.filter_map(\|(ref_name, id)\| {
		735	IssueState::from_ref(repo, &ref_name, &id)
		736	.inspect_err(\|e\| eprintln!("warning: skipping issue {:.8}: {}", id, e))
		737	.ok()
		738	})
672	.collect();	739	.collect();
673	Ok(items)	740	Ok(items)
674	}	741	}
@@ -682,7 +749,11 @@ pub fn list_patches(repo: &Repository) -> Result<Vec<PatchState>, crate::error::
682	let items = collab_refs(repo, "patches")?	749	let items = collab_refs(repo, "patches")?
683	.into_iter()	750	.into_iter()
684	.filter(\|(_, id)\| !archived_ids.contains(id))	751	.filter(\|(_, id)\| !archived_ids.contains(id))
685	.filter_map(\|(ref_name, id)\| PatchState::from_ref(repo, &ref_name, &id).ok())	752	.filter_map(\|(ref_name, id)\| {
		753	PatchState::from_ref(repo, &ref_name, &id)
		754	.inspect_err(\|e\| eprintln!("warning: skipping patch {:.8}: {}", id, e))
		755	.ok()
		756	})
686	.collect();	757	.collect();
687	Ok(items)	758	Ok(items)
688	}	759	}
@@ -698,15 +769,17 @@ pub fn list_issues_with_archived(
698	// Archived first so they take priority	769	// Archived first so they take priority
699	for (ref_name, id) in collab_archive_refs(repo, "issues")? {	770	for (ref_name, id) in collab_archive_refs(repo, "issues")? {
700	if seen.insert(id.clone()) {	771	if seen.insert(id.clone()) {
701	if let Ok(state) = IssueState::from_ref(repo, &ref_name, &id) {	772	match IssueState::from_ref(repo, &ref_name, &id) {
702	items.push(state);	773	Ok(state) => items.push(state),
		774	Err(e) => eprintln!("warning: skipping issue {:.8}: {}", id, e),
703	}	775	}
704	}	776	}
705	}	777	}
706	for (ref_name, id) in collab_refs(repo, "issues")? {	778	for (ref_name, id) in collab_refs(repo, "issues")? {
707	if seen.insert(id.clone()) {	779	if seen.insert(id.clone()) {
708	if let Ok(state) = IssueState::from_ref(repo, &ref_name, &id) {	780	match IssueState::from_ref(repo, &ref_name, &id) {
709	items.push(state);	781	Ok(state) => items.push(state),
		782	Err(e) => eprintln!("warning: skipping issue {:.8}: {}", id, e),
710	}	783	}
711	}	784	}
712	}	785	}
@@ -723,15 +796,17 @@ pub fn list_patches_with_archived(
723		796
724	for (ref_name, id) in collab_archive_refs(repo, "patches")? {	797	for (ref_name, id) in collab_archive_refs(repo, "patches")? {
725	if seen.insert(id.clone()) {	798	if seen.insert(id.clone()) {
726	if let Ok(state) = PatchState::from_ref(repo, &ref_name, &id) {	799	match PatchState::from_ref(repo, &ref_name, &id) {
727	items.push(state);	800	Ok(state) => items.push(state),
		801	Err(e) => eprintln!("warning: skipping patch {:.8}: {}", id, e),
728	}	802	}
729	}	803	}
730	}	804	}
731	for (ref_name, id) in collab_refs(repo, "patches")? {	805	for (ref_name, id) in collab_refs(repo, "patches")? {
732	if seen.insert(id.clone()) {	806	if seen.insert(id.clone()) {
733	if let Ok(state) = PatchState::from_ref(repo, &ref_name, &id) {	807	match PatchState::from_ref(repo, &ref_name, &id) {
734	items.push(state);	808	Ok(state) => items.push(state),
		809	Err(e) => eprintln!("warning: skipping patch {:.8}: {}", id, e),
735	}	810	}
736	}	811	}
737	}	812	}

src/sync.rs

Old		New
@@ -150,9 +150,50 @@ impl SyncState {
150	// Push helpers (T003, T004)	150	// Push helpers (T003, T004)
151	// ---------------------------------------------------------------------------	151	// ---------------------------------------------------------------------------
152		152
153	/// Push a single ref to the remote. Returns a RefPushResult.	153	/// Push multiple refs to the remote in a single `git push` invocation.
154	fn push_ref(workdir: &Path, remote_name: &str, ref_name: &str) -> RefPushResult {	154	///
155	let refspec = format!("+{}:{}", ref_name, ref_name);	155	/// Uses non-force refspecs so the remote will reject the push if it has
		156	/// commits we haven't reconciled. This prevents silently discarding events
		157	/// that another pusher added between our fetch and push.
		158	///
		159	/// On success, all refs are marked as Pushed. On failure, falls back to
		160	/// per-ref pushes to determine which specific refs failed.
		161	fn push_refs_batched(workdir: &Path, remote_name: &str, refs: &[String]) -> Vec<RefPushResult> {
		162	if refs.is_empty() {
		163	return Vec::new();
		164	}
		165
		166	let refspecs: Vec<String> = refs.iter().map(\|r\| format!("{}:{}", r, r)).collect();
		167	let mut args = vec!["push", remote_name];
		168	args.extend(refspecs.iter().map(\|s\| s.as_str()));
		169
		170	match Command::new("git")
		171	.args(&args)
		172	.current_dir(workdir)
		173	.output()
		174	{
		175	Ok(output) if output.status.success() => {
		176	// All refs pushed successfully
		177	refs.iter()
		178	.map(\|r\| RefPushResult {
		179	ref_name: r.clone(),
		180	status: PushStatus::Pushed,
		181	error: None,
		182	})
		183	.collect()
		184	}
		185	Ok(_) \| Err(_) => {
		186	// Batch failed — retry each ref individually to isolate failures
		187	refs.iter()
		188	.map(\|ref_name\| push_ref_single(workdir, remote_name, ref_name))
		189	.collect()
		190	}
		191	}
		192	}
		193
		194	/// Push a single ref to the remote. Used as a fallback when batched push fails.
		195	fn push_ref_single(workdir: &Path, remote_name: &str, ref_name: &str) -> RefPushResult {
		196	let refspec = format!("{}:{}", ref_name, ref_name);
156	match Command::new("git")	197	match Command::new("git")
157	.args(["push", remote_name, &refspec])	198	.args(["push", remote_name, &refspec])
158	.current_dir(workdir)	199	.current_dir(workdir)
@@ -317,12 +358,23 @@ pub fn sync(repo: &Repository, remote_name: &str) -> Result<(), Error> {
317	}	358	}
318		359
319	// Step 2: Reconcile	360	// Step 2: Reconcile
320	// Re-open repo to see the fetched refs (git2 caches ref state)	361	// Re-open the repo because git2 caches the ref list at open time.
		362	// The `git fetch` above wrote new refs to disk, but the original
		363	// `repo` handle won't see them. `repo.path()` returns the `.git`
		364	// directory, which is the correct argument to `Repository::open`.
321	let repo = Repository::open(repo.path())?;	365	let repo = Repository::open(repo.path())?;
322	let sk = signing::load_signing_key(&signing::signing_key_dir()?)?;	366	let sk = signing::load_signing_key(&signing::signing_key_dir()?)?;
323	reconcile_refs(&repo, "issues", &author, &sk)?;	367	reconcile_refs(&repo, "issues", &author, &sk)?;
324	reconcile_refs(&repo, "patches", &author, &sk)?;	368	reconcile_refs(&repo, "patches", &author, &sk)?;
325		369
		370	// Step 2.5: Scan local branches for Issue: trailers and emit link events.
		371	// Never breaks sync — scan_and_link absorbs per-commit/per-issue errors.
		372	match crate::commit_link::scan_and_link(&repo, &author, &sk) {
		373	Ok(n) if n > 0 => println!("Linked {} commit(s) to issues.", n),
		374	Ok(_) => {}
		375	Err(e) => eprintln!("warning: commit link scan failed: {}", e),
		376	}
		377
326	// Step 3: Push collab refs individually	378	// Step 3: Push collab refs individually
327	println!("Pushing to '{}'...", remote_name);	379	println!("Pushing to '{}'...", remote_name);
328	let refs_to_push = collect_push_refs(&repo)?;	380	let refs_to_push = collect_push_refs(&repo)?;
@@ -330,7 +382,7 @@ pub fn sync(repo: &Repository, remote_name: &str) -> Result<(), Error> {
330	if refs_to_push.is_empty() {	382	if refs_to_push.is_empty() {
331	println!("Nothing to push.");	383	println!("Nothing to push.");
332	} else {	384	} else {
333	let sync_result = push_refs_individually(&workdir, remote_name, &refs_to_push);	385	let sync_result = push_refs(&workdir, remote_name, &refs_to_push);
334		386
335	if !sync_result.is_complete() {	387	if !sync_result.is_complete() {
336	// Save state for resume	388	// Save state for resume
@@ -395,7 +447,7 @@ fn sync_resume(
395		447
396	// Push the pending refs	448	// Push the pending refs
397	let ref_names: Vec<String> = state.pending_refs.iter().map(\|(r, _)\| r.clone()).collect();	449	let ref_names: Vec<String> = state.pending_refs.iter().map(\|(r, _)\| r.clone()).collect();
398	let sync_result = push_refs_individually(workdir, remote_name, &ref_names);	450	let sync_result = push_refs(workdir, remote_name, &ref_names);
399		451
400	if sync_result.is_complete() {	452	if sync_result.is_complete() {
401	// All pending refs pushed successfully	453	// All pending refs pushed successfully
@@ -438,22 +490,20 @@ fn sync_resume(
438	}	490	}
439	}	491	}
440		492
441	/// Push refs one at a time, printing per-ref status, and return aggregated results.	493	/// Push all refs in a single batch, printing per-ref status, and return aggregated results.
442	fn push_refs_individually(workdir: &Path, remote_name: &str, refs: &[String]) -> SyncResult {	494	fn push_refs(workdir: &Path, remote_name: &str, refs: &[String]) -> SyncResult {
443	let mut results = Vec::new();	495	let results = push_refs_batched(workdir, remote_name, refs);
444	for ref_name in refs {	496	for result in &results {
445	let result = push_ref(workdir, remote_name, ref_name);
446	match &result.status {	497	match &result.status {
447	PushStatus::Pushed => println!(" Pushed {}", ref_name),	498	PushStatus::Pushed => println!(" Pushed {}", result.ref_name),
448	PushStatus::Failed => {	499	PushStatus::Failed => {
449	eprintln!(	500	eprintln!(
450	" FAILED {}: {}",	501	" FAILED {}: {}",
451	ref_name,	502	result.ref_name,
452	result.error.as_deref().unwrap_or("unknown error")	503	result.error.as_deref().unwrap_or("unknown error")
453	);	504	);
454	}	505	}
455	}	506	}
456	results.push(result);
457	}	507	}
458	SyncResult {	508	SyncResult {
459	results,	509	results,

src/tui/events.rs

Old		New
@@ -21,7 +21,7 @@ pub(crate) fn run_loop(
21	repo: &Repository,	21	repo: &Repository,
22	) -> Result<(), Error> {	22	) -> Result<(), Error> {
23	loop {	23	loop {
24	terminal.draw(\|frame\| ui(frame, app))?;	24	terminal.draw(\|frame\| ui(frame, app, Some(repo)))?;
25		25
26	if event::poll(Duration::from_millis(100))? {	26	if event::poll(Duration::from_millis(100))? {
27	if let Event::Key(key) = event::read()? {	27	if let Event::Key(key) = event::read()? {

src/tui/mod.rs

Old		New
@@ -63,6 +63,7 @@ mod tests {
63	labels: vec![],	63	labels: vec![],
64	assignees: vec![],	64	assignees: vec![],
65	comments: vec![],	65	comments: vec![],
		66	linked_commits: vec![],
66	created_at: String::new(),	67	created_at: String::new(),
67	last_updated: String::new(),	68	last_updated: String::new(),
68	author: make_author(),	69	author: make_author(),
@@ -253,6 +254,7 @@ mod tests {
253	labels: vec![],	254	labels: vec![],
254	assignees: vec![],	255	assignees: vec![],
255	comments: Vec::new(),	256	comments: Vec::new(),
		257	linked_commits: Vec::new(),
256	created_at: "2026-01-01T00:00:00Z".to_string(),	258	created_at: "2026-01-01T00:00:00Z".to_string(),
257	last_updated: "2026-01-01T00:00:00Z".to_string(),	259	last_updated: "2026-01-01T00:00:00Z".to_string(),
258	author: test_author(),	260	author: test_author(),
@@ -294,7 +296,7 @@ mod tests {
294	fn render_app(app: &mut App) -> Buffer {	296	fn render_app(app: &mut App) -> Buffer {
295	let backend = TestBackend::new(80, 24);	297	let backend = TestBackend::new(80, 24);
296	let mut terminal = Terminal::new(backend).unwrap();	298	let mut terminal = Terminal::new(backend).unwrap();
297	terminal.draw(\|frame\| ui(frame, app)).unwrap();	299	terminal.draw(\|frame\| ui(frame, app, None)).unwrap();
298	terminal.backend().buffer().clone()	300	terminal.backend().buffer().clone()
299	}	301	}
300		302
@@ -955,7 +957,7 @@ mod tests {
955	let mut app = make_app(3, 3);	957	let mut app = make_app(3, 3);
956	let backend = TestBackend::new(20, 10);	958	let backend = TestBackend::new(20, 10);
957	let mut terminal = Terminal::new(backend).unwrap();	959	let mut terminal = Terminal::new(backend).unwrap();
958	terminal.draw(\|frame\| ui(frame, &mut app)).unwrap();	960	terminal.draw(\|frame\| ui(frame, &mut app, None)).unwrap();
959	}	961	}
960		962
961	// ── Integration: full browse flow ────────────────────────────────────	963	// ── Integration: full browse flow ────────────────────────────────────

src/tui/widgets.rs

Old		New
@@ -1,4 +1,4 @@
1	use git2::Oid;	1	use git2::{Oid, Repository};
2	use ratatui::prelude::*;	2	use ratatui::prelude::*;
3	use ratatui::widgets::{Block, Borders, List, ListItem, Paragraph, Wrap};	3	use ratatui::widgets::{Block, Borders, List, ListItem, Paragraph, Wrap};
4		4
@@ -26,6 +26,7 @@ pub(crate) fn action_type_label(action: &Action) -> &str {
26	Action::IssueUnlabel { .. } => "Issue Unlabel",	26	Action::IssueUnlabel { .. } => "Issue Unlabel",
27	Action::IssueAssign { .. } => "Issue Assign",	27	Action::IssueAssign { .. } => "Issue Assign",
28	Action::IssueUnassign { .. } => "Issue Unassign",	28	Action::IssueUnassign { .. } => "Issue Unassign",
		29	Action::IssueCommitLink { .. } => "Issue Commit Link",
29	}	30	}
30	}	31	}
31		32
@@ -113,13 +114,16 @@ pub(crate) fn format_event_detail(oid: &Oid, event: &crate::event::Event) -> Str
113	Action::IssueUnassign { assignee } => {	114	Action::IssueUnassign { assignee } => {
114	detail.push_str(&format!("\nRemoved Assignee: {}\n", assignee));	115	detail.push_str(&format!("\nRemoved Assignee: {}\n", assignee));
115	}	116	}
		117	Action::IssueCommitLink { commit } => {
		118	detail.push_str(&format!("\nCommit: {}\n", commit));
		119	}
116	Action::IssueReopen \| Action::PatchMerge \| Action::Merge => {}	120	Action::IssueReopen \| Action::PatchMerge \| Action::Merge => {}
117	}	121	}
118		122
119	detail	123	detail
120	}	124	}
121		125
122	pub(crate) fn ui(frame: &mut Frame, app: &mut App) {	126	pub(crate) fn ui(frame: &mut Frame, app: &mut App, repo: Option<&Repository>) {
123	let chunks = Layout::default()	127	let chunks = Layout::default()
124	.direction(Direction::Vertical)	128	.direction(Direction::Vertical)
125	.constraints([Constraint::Min(1), Constraint::Length(1)])	129	.constraints([Constraint::Min(1), Constraint::Length(1)])
@@ -134,7 +138,7 @@ pub(crate) fn ui(frame: &mut Frame, app: &mut App) {
134	.split(main_area);	138	.split(main_area);
135		139
136	render_list(frame, app, panes[0]);	140	render_list(frame, app, panes[0]);
137	render_detail(frame, app, panes[1]);	141	render_detail(frame, app, panes[1], repo);
138	render_footer(frame, app, footer_area);	142	render_footer(frame, app, footer_area);
139	}	143	}
140		144
@@ -214,7 +218,7 @@ fn render_list(frame: &mut Frame, app: &mut App, area: Rect) {
214	}	218	}
215	}	219	}
216		220
217	fn render_detail(frame: &mut Frame, app: &mut App, area: Rect) {	221	fn render_detail(frame: &mut Frame, app: &mut App, area: Rect, repo: Option<&Repository>) {
218	let border_style = if app.pane == Pane::Detail {	222	let border_style = if app.pane == Pane::Detail {
219	Style::default().fg(Color::Yellow)	223	Style::default().fg(Color::Yellow)
220	} else {	224	} else {
@@ -298,7 +302,7 @@ fn render_detail(frame: &mut Frame, app: &mut App, area: Rect) {
298	let visible = app.visible_issues();	302	let visible = app.visible_issues();
299	let selected_idx = app.list_state.selected().unwrap_or(0);	303	let selected_idx = app.list_state.selected().unwrap_or(0);
300	let content: Text = match visible.get(selected_idx) {	304	let content: Text = match visible.get(selected_idx) {
301	Some(issue) => build_issue_detail(issue, &app.patches),	305	Some(issue) => build_issue_detail(issue, &app.patches, repo),
302	None => Text::raw("No matches for current filter."),	306	None => Text::raw("No matches for current filter."),
303	};	307	};
304		308
@@ -337,7 +341,11 @@ fn render_detail(frame: &mut Frame, app: &mut App, area: Rect) {
337	}	341	}
338	}	342	}
339		343
340	fn build_issue_detail(issue: &IssueState, patches: &[PatchState]) -> Text<'static> {	344	fn build_issue_detail(
		345	issue: &IssueState,
		346	patches: &[PatchState],
		347	repo: Option<&Repository>,
		348	) -> Text<'static> {
341	let status = issue.status.as_str();	349	let status = issue.status.as_str();
342		350
343	let mut lines: Vec<Line> = vec![	351	let mut lines: Vec<Line> = vec![
@@ -454,6 +462,46 @@ fn build_issue_detail(issue: &IssueState, patches: &[PatchState]) -> Text<'stati
454	}	462	}
455	}	463	}
456		464
		465	if !issue.linked_commits.is_empty() {
		466	lines.push(Line::raw(""));
		467	lines.push(Line::styled(
		468	"--- Linked Commits ---",
		469	Style::default()
		470	.fg(Color::Magenta)
		471	.add_modifier(Modifier::BOLD),
		472	));
		473	for lc in &issue.linked_commits {
		474	let short_sha: String = lc.commit.chars().take(7).collect();
		475	let (subject, commit_author) = repo
		476	.and_then(\|r\| {
		477	Oid::from_str(&lc.commit)
		478	.ok()
		479	.and_then(\|oid\| r.find_commit(oid).ok())
		480	.map(\|commit\| {
		481	let subject = commit
		482	.summary()
		483	.map(\|s\| crate::truncate_summary(s, 60))
		484	.unwrap_or_default();
		485	let author = commit.author().name().unwrap_or("unknown").to_string();
		486	(subject, author)
		487	})
		488	})
		489	.unwrap_or_else(\|\| (String::new(), String::new()));
		490	let line_text = if commit_author.is_empty() {
		491	format!(
		492	"· linked {} (commit {} not in local repo) (linked by {}, {})",
		493	short_sha, short_sha, lc.event_author.name, lc.event_timestamp
		494	)
		495	} else {
		496	format!(
		497	"· linked {} \"{}\" by {} (linked by {}, {})",
		498	short_sha, subject, commit_author, lc.event_author.name, lc.event_timestamp
		499	)
		500	};
		501	lines.push(Line::raw(line_text));
		502	}
		503	}
		504
457	Text::from(lines)	505	Text::from(lines)
458	}	506	}
459		507

tests/collab_test.rs

tests/commit_link_test.rs

@@ @@ -0,0 +1,312 @@ @@
+//! Unit tests for the Action::IssueCommitLink event variant.
+use git2::Repository;
+use git_collab::event::{Action, Author, Event};
+use git_collab::identity::author_signature;
+use git_collab::signing::sign_event;
+use git_collab::state::IssueState;
+use tempfile::TempDir;
+mod common;
+use common::{
+    add_commit_link, alice, init_repo, open_issue, test_signing_key, ScopedTestConfig,
+};
+/// Append a commit-link event with an explicitly chosen `clock` value,
+/// bypassing `dag::append_event`'s automatic clock-bump. The new commit's
+/// parent is the current ref tip. Returns the new tip OID.
+fn append_commit_link_with_clock(
+    repo: &Repository,
+    ref_name: &str,
+    author: &Author,
+    commit_sha: &str,
+    timestamp: &str,
+    clock: u64,
+) -> git2::Oid {
+    let sk = test_signing_key();
+    let event = Event {
+        timestamp: timestamp.to_string(),
+        author: author.clone(),
+        action: Action::IssueCommitLink {
+            commit: commit_sha.to_string(),
+        },
+        clock,
+    };
+    let detached = sign_event(&event, &sk).unwrap();
+    let event_json = serde_json::to_vec_pretty(&event).unwrap();
+    let manifest = br#"{"version":1,"format":"git-collab"}"#;
+    let event_blob = repo.blob(&event_json).unwrap();
+    let sig_blob = repo.blob(detached.signature.as_bytes()).unwrap();
+    let pubkey_blob = repo.blob(detached.pubkey.as_bytes()).unwrap();
+    let manifest_blob = repo.blob(manifest).unwrap();
+    let mut tb = repo.treebuilder(None).unwrap();
+    tb.insert("event.json", event_blob, 0o100644).unwrap();
+    tb.insert("signature", sig_blob, 0o100644).unwrap();
+    tb.insert("pubkey", pubkey_blob, 0o100644).unwrap();
+    tb.insert("manifest.json", manifest_blob, 0o100644).unwrap();
+    let tree_oid = tb.write().unwrap();
+    let tree = repo.find_tree(tree_oid).unwrap();
+    let sig = author_signature(author).unwrap();
+    let parent_oid = repo.refname_to_id(ref_name).unwrap();
+    let parent = repo.find_commit(parent_oid).unwrap();
+    repo.commit(Some(ref_name), &sig, &sig, "issue.commit_link", &tree, &[&parent])
+        .unwrap()
+}
+fn test_author() -> Author {
+    Author {
+        name: "Alice".to_string(),
+        email: "alice@example.com".to_string(),
+    }
+}
+fn sha(byte: u8) -> String {
+    format!("{:02x}{}", byte, "00".repeat(19))
+}
+#[test]
+fn issue_commit_link_variant_round_trips() {
+    let event = Event {
+        timestamp: "2026-04-12T12:00:00Z".to_string(),
+        author: test_author(),
+        action: Action::IssueCommitLink {
+            commit: "4b2e1cd0123456789012345678901234567890ab".to_string(),
+        },
+        clock: 3,
+    };
+    let json = serde_json::to_string(&event).expect("serialize");
+    assert!(
+        json.contains("\"type\":\"issue.commit_link\""),
+        "expected serde tag issue.commit_link, got: {}",
+        json
+    );
+    assert!(
+        json.contains("\"commit\":\"4b2e1cd0123456789012345678901234567890ab\""),
+        "expected commit field, got: {}",
+        json
+    );
+    let parsed: Event = serde_json::from_str(&json).expect("deserialize");
+    match parsed.action {
+        Action::IssueCommitLink { commit } => {
+            assert_eq!(commit, "4b2e1cd0123456789012345678901234567890ab");
+        }
+        other => panic!("expected IssueCommitLink, got {:?}", other),
+    }
+}
+#[test]
+fn issue_state_surfaces_commit_links_in_order() {
+    let _config = ScopedTestConfig::new();
+    let dir = TempDir::new().unwrap();
+    let repo = init_repo(dir.path(), &alice());
+    let (ref_name, id) = open_issue(&repo, &alice(), "bug");
+    add_commit_link(&repo, &ref_name, &alice(), &sha(0xaa));
+    add_commit_link(&repo, &ref_name, &alice(), &sha(0xbb));
+    let issue = IssueState::from_ref_uncached(&repo, &ref_name, &id).unwrap();
+    let commits: Vec<String> = issue
+        .linked_commits
+        .iter()
+        .map(|lc| lc.commit.clone())
+        .collect();
+    assert_eq!(commits, vec![sha(0xaa), sha(0xbb)]);
+}
+#[test]
+fn issue_state_dedups_commit_links_keeps_lower_clock_even_when_appended_later() {
+    // This locks in the (clock, timestamp, oid) tiebreak rule. We append two
+    // events for the same commit SHA in linear order, but the SECOND event we
+    // append has a LOWER clock than the first — simulating a cross-machine
+    // case where Bob's locally-appended event was actually authored earlier
+    // (in clock terms) than Alice's. A naive first-seen-wins implementation
+    // would surface Alice's event because it appears first in the topo walk;
+    // the spec-correct dedup must surface Bob's lower-clock event instead.
+    let _config = ScopedTestConfig::new();
+    let dir = TempDir::new().unwrap();
+    let repo = init_repo(dir.path(), &alice());
+    let (ref_name, id) = open_issue(&repo, &alice(), "bug");
+    let target_sha = sha(0xdd);
+    // Alice appends with clock 50 first.
+    append_commit_link_with_clock(
+        &repo,
+        &ref_name,
+        &alice(),
+        &target_sha,
+        "2026-04-12T12:00:00Z",
+,
+    );
+    // Bob appends second, but with a LOWER clock (10) — as if his event was
+    // authored earlier on his machine and we're now seeing the merged DAG.
+    append_commit_link_with_clock(
+        &repo,
+        &ref_name,
+        &common::bob(),
+        &target_sha,
+        "2026-04-12T11:00:00Z",
+,
+    );
+    let issue = IssueState::from_ref_uncached(&repo, &ref_name, &id).unwrap();
+    assert_eq!(issue.linked_commits.len(), 1);
+    assert_eq!(issue.linked_commits[0].commit, target_sha);
+    // The lower-clock event wins, even though it was appended later.
+    assert_eq!(
+        issue.linked_commits[0].event_author.name,
+        "Bob",
+        "expected Bob's lower-clock event to win the tiebreak"
+    );
+}
+#[test]
+fn issue_state_dedups_commit_links_by_sha_keeping_earliest() {
+    let _config = ScopedTestConfig::new();
+    let dir = TempDir::new().unwrap();
+    let repo = init_repo(dir.path(), &alice());
+    let (ref_name, id) = open_issue(&repo, &alice(), "bug");
+    // Two different emitters link the same commit. First-seen should win.
+    add_commit_link(&repo, &ref_name, &alice(), &sha(0xcc));
+    let bob_link = common::bob();
+    add_commit_link(&repo, &ref_name, &bob_link, &sha(0xcc));
+    let issue = IssueState::from_ref_uncached(&repo, &ref_name, &id).unwrap();
+    assert_eq!(issue.linked_commits.len(), 1);
+    assert_eq!(issue.linked_commits[0].commit, sha(0xcc));
+    assert_eq!(issue.linked_commits[0].event_author.name, "Alice");
+}
+use git_collab::commit_link::parse_issue_trailers;
+#[test]
+fn parser_no_trailer_block() {
+    assert_eq!(parse_issue_trailers("Just a plain commit"), Vec::<String>::new());
+}
+#[test]
+fn parser_empty_message() {
+    assert_eq!(parse_issue_trailers(""), Vec::<String>::new());
+}
+#[test]
+fn parser_single_trailer_in_pure_block() {
+    let msg = "Fix thing\n\nSome context in the body.\n\nIssue: abc";
+    assert_eq!(parse_issue_trailers(msg), vec!["abc".to_string()]);
+}
+#[test]
+fn parser_case_variants() {
+    let msg1 = "subject\n\nissue: abc";
+    let msg2 = "subject\n\nISSUE : abc";
+    let msg3 = "subject\n\n  Issue:  abc  ";
+    assert_eq!(parse_issue_trailers(msg1), vec!["abc".to_string()]);
+    assert_eq!(parse_issue_trailers(msg2), vec!["abc".to_string()]);
+    assert_eq!(parse_issue_trailers(msg3), vec!["abc".to_string()]);
+}
+#[test]
+fn parser_two_trailers_in_pure_block() {
+    let msg = "subject\n\nIssue: abc\nIssue: def";
+    assert_eq!(parse_issue_trailers(msg), vec!["abc".to_string(), "def".to_string()]);
+}
+#[test]
+fn parser_issue_in_body_but_not_final_paragraph() {
+    let msg = "subject\n\nIssue: abc\n\nSigned-off-by: alice <a@example.com>";
+    // The final paragraph is the signed-off-by block, not the issue line.
+    // It's a valid trailer block (Signed-off-by is trailer-shaped), but it
+    // contains no Issue: key, so we extract nothing.
+    assert_eq!(parse_issue_trailers(msg), Vec::<String>::new());
+}
+#[test]
+fn parser_wrong_key() {
+    let msg = "subject\n\nIssues: abc";
+    assert_eq!(parse_issue_trailers(msg), Vec::<String>::new());
+}
+#[test]
+fn parser_prose_mention() {
+    let msg = "subject\n\nthis fixes issue abc in the body";
+    assert_eq!(parse_issue_trailers(msg), Vec::<String>::new());
+}
+#[test]
+fn parser_single_paragraph_whole_message_is_trailer_block() {
+    let msg = "Issue: abc";
+    assert_eq!(parse_issue_trailers(msg), vec!["abc".to_string()]);
+}
+#[test]
+fn parser_mixed_final_paragraph_rejects_all() {
+    let msg = "subject\n\nThanks to Bob for the catch.\nIssue: a3f9";
+    // Final paragraph has a prose line, so it's not a trailer block and we
+    // extract nothing. This is the "false positive in prose" guard.
+    assert_eq!(parse_issue_trailers(msg), Vec::<String>::new());
+}
+#[test]
+fn parser_trailing_whitespace_paragraph_does_not_shadow_trailer_block() {
+    // The final paragraph is empty/whitespace, so the walk should fall back
+    // to the previous non-empty paragraph, which is a valid trailer block.
+    let msg = "subject\n\nIssue: abc\n\n   \n";
+    assert_eq!(parse_issue_trailers(msg), vec!["abc".to_string()]);
+}
+#[test]
+fn parser_pure_block_with_mixed_keys() {
+    let msg = "subject\n\nSigned-off-by: alice <a@example.com>\nIssue: abc";
+    assert_eq!(parse_issue_trailers(msg), vec!["abc".to_string()]);
+}
+#[test]
+fn parser_rejects_value_with_trailing_garbage() {
+    let msg = "subject\n\nIssue: abc fixes thing";
+    assert_eq!(parse_issue_trailers(msg), Vec::<String>::new());
+}
+#[test]
+fn parser_rejects_empty_value() {
+    let msg = "subject\n\nIssue:   ";
+    assert_eq!(parse_issue_trailers(msg), Vec::<String>::new());
+}
+use git_collab::commit_link::collect_linked_shas;
+#[test]
+fn collect_linked_shas_empty_for_fresh_issue() {
+    let _config = ScopedTestConfig::new();
+    let dir = TempDir::new().unwrap();
+    let repo = init_repo(dir.path(), &alice());
+    let (ref_name, _id) = open_issue(&repo, &alice(), "bug");
+    let shas = collect_linked_shas(&repo, &ref_name).unwrap();
+    assert!(shas.is_empty());
+}
+#[test]
+fn collect_linked_shas_returns_all_linked_commits_including_duplicates() {
+    let _config = ScopedTestConfig::new();
+    let dir = TempDir::new().unwrap();
+    let repo = init_repo(dir.path(), &alice());
+    let (ref_name, _id) = open_issue(&repo, &alice(), "bug");
+    add_commit_link(&repo, &ref_name, &alice(), &sha(0xaa));
+    add_commit_link(&repo, &ref_name, &alice(), &sha(0xbb));
+    // Even a duplicate DAG entry (cross-machine race) is surfaced here —
+    // this is the "source of truth" for whether we need to emit.
+    add_commit_link(&repo, &ref_name, &alice(), &sha(0xaa));
+    let shas = collect_linked_shas(&repo, &ref_name).unwrap();
+    assert_eq!(shas.len(), 2);
+    assert!(shas.contains(&sha(0xaa)));
+    assert!(shas.contains(&sha(0xbb)));
+}

tests/common/mod.rs

Old		New
@@ -177,6 +177,8 @@ impl Drop for ScopedTestConfig {
177	/// and an initial empty commit on `main`.	177	/// and an initial empty commit on `main`.
178	pub fn init_repo(dir: &Path, author: &Author) -> Repository {	178	pub fn init_repo(dir: &Path, author: &Author) -> Repository {
179	let repo = Repository::init(dir).expect("init repo");	179	let repo = Repository::init(dir).expect("init repo");
		180	// Ensure HEAD points to main regardless of the system's default branch name
		181	repo.set_head("refs/heads/main").expect("set HEAD to main");
180	{	182	{
181	let mut config = repo.config().unwrap();	183	let mut config = repo.config().unwrap();
182	config.set_str("user.name", &author.name).unwrap();	184	config.set_str("user.name", &author.name).unwrap();
@@ -227,6 +229,25 @@ pub fn add_comment(repo: &Repository, ref_name: &str, author: &Author, body: &st
227	dag::append_event(repo, ref_name, &event, &sk).unwrap();	229	dag::append_event(repo, ref_name, &event, &sk).unwrap();
228	}	230	}
229		231
		232	/// Append an IssueCommitLink event to an issue ref. Returns the new DAG tip OID.
		233	pub fn add_commit_link(
		234	repo: &Repository,
		235	ref_name: &str,
		236	author: &Author,
		237	commit_sha: &str,
		238	) -> git2::Oid {
		239	let sk = test_signing_key();
		240	let event = Event {
		241	timestamp: now(),
		242	author: author.clone(),
		243	action: Action::IssueCommitLink {
		244	commit: commit_sha.to_string(),
		245	},
		246	clock: 0,
		247	};
		248	dag::append_event(repo, ref_name, &event, &sk).unwrap()
		249	}
		250
230	/// Append a close event to an issue ref.	251	/// Append a close event to an issue ref.
231	pub fn close_issue(repo: &Repository, ref_name: &str, author: &Author) {	252	pub fn close_issue(repo: &Repository, ref_name: &str, author: &Author) {
232	let sk = test_signing_key();	253	let sk = test_signing_key();
@@ -327,6 +348,8 @@ impl TestRepo {
327	git_with_env(dir.path(), &["init", "-b", "main"], &env);	348	git_with_env(dir.path(), &["init", "-b", "main"], &env);
328	git_with_env(dir.path(), &["config", "user.name", name], &env);	349	git_with_env(dir.path(), &["config", "user.name", name], &env);
329	git_with_env(dir.path(), &["config", "user.email", email], &env);	350	git_with_env(dir.path(), &["config", "user.email", email], &env);
		351	// Disable auto-sync for tests so CLI output isn't polluted by sync attempts
		352	git_with_env(dir.path(), &["config", "collab.autoSync", "false"], &env);
330	git_with_env(	353	git_with_env(
331	dir.path(),	354	dir.path(),
332	&["commit", "--allow-empty", "-m", "initial"],	355	&["commit", "--allow-empty", "-m", "initial"],

tests/sort_test.rs

Old		New
@@ -229,11 +229,11 @@ fn test_patch_default_sort_by_recency() {
229	// Patch B: created later, never updated	229	// Patch B: created later, never updated
230	let (_, _) = create_patch_at(&repo, &alice(), "Beta patch", "2025-06-01T00:00:00Z");	230	let (_, _) = create_patch_at(&repo, &alice(), "Beta patch", "2025-06-01T00:00:00Z");
231		231
232	let patches =	232	let entries =
233	git_collab::patch::list(&repo, true, false, None, None, SortMode::Recent).unwrap();	233	git_collab::patch::list(&repo, true, false, None, None, SortMode::Recent).unwrap();
234	assert_eq!(patches.len(), 2);	234	assert_eq!(entries.len(), 2);
235	assert_eq!(patches[0].title, "Alpha patch");	235	assert_eq!(entries[0].patch.title, "Alpha patch");
236	assert_eq!(patches[1].title, "Beta patch");	236	assert_eq!(entries[1].patch.title, "Beta patch");
237	}	237	}
238		238
239	#[test]	239	#[test]
@@ -252,11 +252,11 @@ fn test_patch_sort_by_created() {
252		252
253	let (_, _) = create_patch_at(&repo, &alice(), "Beta patch", "2025-06-01T00:00:00Z");	253	let (_, _) = create_patch_at(&repo, &alice(), "Beta patch", "2025-06-01T00:00:00Z");
254		254
255	let patches =	255	let entries =
256	git_collab::patch::list(&repo, true, false, None, None, SortMode::Created).unwrap();	256	git_collab::patch::list(&repo, true, false, None, None, SortMode::Created).unwrap();
257	assert_eq!(patches.len(), 2);	257	assert_eq!(entries.len(), 2);
258	assert_eq!(patches[0].title, "Beta patch");	258	assert_eq!(entries[0].patch.title, "Beta patch");
259	assert_eq!(patches[1].title, "Alpha patch");	259	assert_eq!(entries[1].patch.title, "Alpha patch");
260	}	260	}
261		261
262	#[test]	262	#[test]
@@ -268,11 +268,11 @@ fn test_patch_sort_alpha() {
268	create_patch_at(&repo, &alice(), "Apple patch", "2025-06-01T00:00:00Z");	268	create_patch_at(&repo, &alice(), "Apple patch", "2025-06-01T00:00:00Z");
269	create_patch_at(&repo, &alice(), "Mango patch", "2025-03-01T00:00:00Z");	269	create_patch_at(&repo, &alice(), "Mango patch", "2025-03-01T00:00:00Z");
270		270
271	let patches = git_collab::patch::list(&repo, true, false, None, None, SortMode::Alpha).unwrap();	271	let entries = git_collab::patch::list(&repo, true, false, None, None, SortMode::Alpha).unwrap();
272	assert_eq!(patches.len(), 3);	272	assert_eq!(entries.len(), 3);
273	assert_eq!(patches[0].title, "Apple patch");	273	assert_eq!(entries[0].patch.title, "Apple patch");
274	assert_eq!(patches[1].title, "Mango patch");	274	assert_eq!(entries[1].patch.title, "Mango patch");
275	assert_eq!(patches[2].title, "Zebra patch");	275	assert_eq!(entries[2].patch.title, "Zebra patch");
276	}	276	}
277		277
278	// ---- CLI integration test ----	278	// ---- CLI integration test ----

tests/sync_test.rs

@@ @@ -1207,3 +1207,380 @@ fn test_corrupted_state_file_handled_gracefully() { @@
+        "corrupted state file should be deleted"
+    );
+// ---------------------------------------------------------------------------
+// Commit-link tests (src/commit_link.rs)
+// ---------------------------------------------------------------------------
+use git_collab::commit_link;
+fn make_commit_with_message(repo: &Repository, message: &str) -> git2::Oid {
+    let sig = git2::Signature::now("Alice", "alice@example.com").unwrap();
+    // The TestCluster bare repo commits onto refs/heads/main but its HEAD
+    // remains the default refs/heads/master, so clones don't get a local
+    // refs/heads/main automatically. Make sure it exists before we extend it.
+    let parent_oid = if let Ok(r) = repo.find_reference("refs/heads/main") {
+        r.target().unwrap()
+    } else {
+        let remote_main = repo
+            .find_reference("refs/remotes/origin/main")
+            .expect("origin/main should exist on the cloned test repo");
+        let oid = remote_main.target().unwrap();
+        repo.reference("refs/heads/main", oid, false, "seed local main")
+            .unwrap();
+        oid
+    };
+    let parent = repo.find_commit(parent_oid).unwrap();
+    let tree_oid = parent.tree().unwrap().id();
+    let tree = repo.find_tree(tree_oid).unwrap();
+    repo.commit(
+        Some("refs/heads/main"),
+        &sig,
+        &sig,
+        message,
+        &tree,
+        &[&parent],
+    )
+    .unwrap()
+}
+#[test]
+fn commit_link_scan_emits_event_for_matching_trailer() {
+    let cluster = TestCluster::new();
+    let alice_repo = cluster.alice_repo();
+    // Open an issue.
+    let (issue_ref, issue_id) = open_issue(&alice_repo, &alice(), "fix the walker");
+    // Create a commit whose trailer references that issue.
+    let message = format!("Fix walker\n\nIssue: {}", &issue_id[..8]);
+    let commit_oid = make_commit_with_message(&alice_repo, &message);
+    // Run the scanner directly (we test the sync integration in later tests).
+    let author = git_collab::identity::get_author(&alice_repo).unwrap();
+    let sk = signing::load_signing_key(
+        &signing::signing_key_dir().unwrap(),
+    )
+    .unwrap();
+    let emitted = commit_link::scan_and_link(&alice_repo, &author, &sk).unwrap();
+    assert_eq!(emitted, 1);
+    // Walk the issue's event log and find the link.
+    let issue = IssueState::from_ref_uncached(&alice_repo, &issue_ref, &issue_id).unwrap();
+    assert_eq!(issue.linked_commits.len(), 1);
+    assert_eq!(issue.linked_commits[0].commit, commit_oid.to_string());
+}
+#[test]
+fn sync_entry_point_emits_commit_link_events_and_pushes_them() {
+    let cluster = TestCluster::new();
+    let alice_repo = cluster.alice_repo();
+    // Alice opens an issue and syncs it up so Bob will see it too.
+    let (_issue_ref, issue_id) = open_issue(&alice_repo, &alice(), "bug");
+    sync::sync(&alice_repo, "origin").unwrap();
+    // Alice makes a real commit with an Issue: trailer.
+    let message = format!("Fix the thing\n\nIssue: {}", &issue_id[..8]);
+    make_commit_with_message(&alice_repo, &message);
+    // Running sync should scan, emit the link, and push it.
+    sync::sync(&alice_repo, "origin").unwrap();
+    // Bob fetches and should see the link in the materialized issue.
+    let bob_repo = cluster.bob_repo();
+    sync::sync(&bob_repo, "origin").unwrap();
+    let bob_issue_ref = format!("refs/collab/issues/{}", issue_id);
+    let bob_issue = IssueState::from_ref_uncached(&bob_repo, &bob_issue_ref, &issue_id).unwrap();
+    assert_eq!(bob_issue.linked_commits.len(), 1);
+}
+#[test]
+fn commit_link_scan_is_idempotent_across_runs() {
+    let cluster = TestCluster::new();
+    let alice_repo = cluster.alice_repo();
+    let (issue_ref, issue_id) = open_issue(&alice_repo, &alice(), "bug");
+    let message = format!("Fix thing\n\nIssue: {}", &issue_id[..8]);
+    make_commit_with_message(&alice_repo, &message);
+    let author = git_collab::identity::get_author(&alice_repo).unwrap();
+    let sk = signing::load_signing_key(&signing::signing_key_dir().unwrap()).unwrap();
+    assert_eq!(commit_link::scan_and_link(&alice_repo, &author, &sk).unwrap(), 1);
+    assert_eq!(commit_link::scan_and_link(&alice_repo, &author, &sk).unwrap(), 0);
+    assert_eq!(commit_link::scan_and_link(&alice_repo, &author, &sk).unwrap(), 0);
+    let issue = IssueState::from_ref_uncached(&alice_repo, &issue_ref, &issue_id).unwrap();
+    assert_eq!(issue.linked_commits.len(), 1);
+}
+#[test]
+fn commit_link_scan_walks_all_local_branches_and_dedups_shared_ancestors() {
+    let cluster = TestCluster::new();
+    let alice_repo = cluster.alice_repo();
+    let (issue_ref, issue_id) = open_issue(&alice_repo, &alice(), "bug");
+    // Commit on main with the trailer. Both branches will reach it.
+    let message = format!("Fix\n\nIssue: {}", &issue_id[..8]);
+    let linked_commit = make_commit_with_message(&alice_repo, &message);
+    // Create a second branch pointing at the same commit.
+    {
+        let commit = alice_repo.find_commit(linked_commit).unwrap();
+        alice_repo.branch("feature-x", &commit, false).unwrap();
+    }
+    let author = git_collab::identity::get_author(&alice_repo).unwrap();
+    let sk = signing::load_signing_key(&signing::signing_key_dir().unwrap()).unwrap();
+    // Should emit exactly one event despite the commit being reachable from
+    // two branch tips.
+    assert_eq!(commit_link::scan_and_link(&alice_repo, &author, &sk).unwrap(), 1);
+    let issue = IssueState::from_ref_uncached(&alice_repo, &issue_ref, &issue_id).unwrap();
+    assert_eq!(issue.linked_commits.len(), 1);
+}
+#[test]
+fn commit_link_scan_handles_multiple_issue_trailers_on_one_commit() {
+    let cluster = TestCluster::new();
+    let alice_repo = cluster.alice_repo();
+    let (issue_ref_a, id_a) = open_issue(&alice_repo, &alice(), "bug a");
+    let (issue_ref_b, id_b) = open_issue(&alice_repo, &alice(), "bug b");
+    let message = format!(
+        "Fix both\n\nIssue: {}\nIssue: {}",
+        &id_a[..8],
+        &id_b[..8]
+    );
+    make_commit_with_message(&alice_repo, &message);
+    let author = git_collab::identity::get_author(&alice_repo).unwrap();
+    let sk = signing::load_signing_key(&signing::signing_key_dir().unwrap()).unwrap();
+    assert_eq!(commit_link::scan_and_link(&alice_repo, &author, &sk).unwrap(), 2);
+    let issue_a = IssueState::from_ref_uncached(&alice_repo, &issue_ref_a, &id_a).unwrap();
+    let issue_b = IssueState::from_ref_uncached(&alice_repo, &issue_ref_b, &id_b).unwrap();
+    assert_eq!(issue_a.linked_commits.len(), 1);
+    assert_eq!(issue_b.linked_commits.len(), 1);
+}
+#[test]
+fn commit_link_scan_skips_unknown_prefix_without_error() {
+    let cluster = TestCluster::new();
+    let alice_repo = cluster.alice_repo();
+    // No issue exists. Commit uses a completely unrelated prefix.
+    make_commit_with_message(
+        &alice_repo,
+        "Fix\n\nIssue: zzzzzzzz",
+    );
+    let author = git_collab::identity::get_author(&alice_repo).unwrap();
+    let sk = signing::load_signing_key(&signing::signing_key_dir().unwrap()).unwrap();
+    assert_eq!(commit_link::scan_and_link(&alice_repo, &author, &sk).unwrap(), 0);
+}
+#[test]
+fn commit_link_scan_skips_genuinely_ambiguous_prefix() {
+    let cluster = TestCluster::new();
+    let alice_repo = cluster.alice_repo();
+    // Open 17 issues. By pigeonhole on the 16 possible hex first-chars,
+    // at least two of the resulting issue IDs must share a first character,
+    // guaranteeing we can construct an ambiguous one-char prefix.
+    let mut ids: Vec<String> = Vec::with_capacity(17);
+    for i in 0..17 {
+        let (_, id) = open_issue(&alice_repo, &alice(), &format!("issue {}", i));
+        ids.push(id);
+    }
+    // Find a first-char that has at least 2 matching IDs.
+    let mut counts: std::collections::HashMap<char, Vec<&str>> =
+        std::collections::HashMap::new();
+    for id in &ids {
+        let c = id.chars().next().unwrap();
+        counts.entry(c).or_default().push(id.as_str());
+    }
+    let (ambiguous_char, matching_ids) = counts
+        .iter()
+        .find(|(_, v)| v.len() >= 2)
+        .map(|(c, v)| (*c, v.clone()))
+        .expect("pigeonhole guarantees at least one shared first char among 17 hex IDs");
+    let ambiguous_prefix = ambiguous_char.to_string();
+    make_commit_with_message(
+        &alice_repo,
+        &format!("Touch\n\nIssue: {}", ambiguous_prefix),
+    );
+    let author = git_collab::identity::get_author(&alice_repo).unwrap();
+    let sk = signing::load_signing_key(&signing::signing_key_dir().unwrap()).unwrap();
+    // Ambiguous prefix must be skipped silently — no event emitted.
+    assert_eq!(
+        commit_link::scan_and_link(&alice_repo, &author, &sk).unwrap(),
+    );
+    // None of the candidate issues should have grown a commit-link event:
+    // each one still consists only of its IssueOpen event.
+    for id in &matching_ids {
+        let issue_ref = format!("refs/collab/issues/{}", id);
+        let state = IssueState::from_ref_uncached(&alice_repo, &issue_ref, id).unwrap();
+        assert!(
+            state.linked_commits.is_empty(),
+            "candidate issue {} should not have any linked commits, but has {}",
+            id,
+            state.linked_commits.len()
+        );
+    }
+}
+#[test]
+fn commit_link_scan_skips_archived_issues_with_warning() {
+    let cluster = TestCluster::new();
+    let alice_repo = cluster.alice_repo();
+    let (_, issue_id) = open_issue(&alice_repo, &alice(), "old bug");
+    // Archive the issue via the state helper.
+    state::archive_issue_ref(&alice_repo, &issue_id).unwrap();
+    make_commit_with_message(
+        &alice_repo,
+        &format!("Reference old\n\nIssue: {}", &issue_id[..8]),
+    );
+    let author = git_collab::identity::get_author(&alice_repo).unwrap();
+    let sk = signing::load_signing_key(&signing::signing_key_dir().unwrap()).unwrap();
+    assert_eq!(commit_link::scan_and_link(&alice_repo, &author, &sk).unwrap(), 0);
+    // Confirm the archived ref did not accrue a new event: the archived
+    // DAG tip should still be the archive-time tip.
+    let archived_ref = format!("refs/collab/archive/issues/{}", issue_id);
+    let archived_state =
+        IssueState::from_ref_uncached(&alice_repo, &archived_ref, &issue_id).unwrap();
+    assert!(archived_state.linked_commits.is_empty());
+}
+#[test]
+fn commit_link_scan_no_op_on_detached_head_with_no_branches() {
+    let cluster = TestCluster::new();
+    let alice_repo = cluster.alice_repo();
+    // Seed refs/heads/main so HEAD resolves to a commit we can detach onto.
+    // make_commit_with_message creates refs/heads/main if missing.
+    make_commit_with_message(&alice_repo, "seed for detached head test");
+    // Put HEAD in detached state pointing at the current main tip, then
+    // delete all local branches so scan_and_link has nothing to walk.
+    let head_oid = alice_repo
+        .find_reference("refs/heads/main")
+        .unwrap()
+        .target()
+        .unwrap();
+    alice_repo.set_head_detached(head_oid).unwrap();
+    alice_repo
+        .find_reference("refs/heads/main")
+        .unwrap()
+        .delete()
+        .unwrap();
+    let author = git_collab::identity::get_author(&alice_repo).unwrap();
+    let sk = signing::load_signing_key(&signing::signing_key_dir().unwrap()).unwrap();
+    // No branches to walk — silent no-op.
+    assert_eq!(commit_link::scan_and_link(&alice_repo, &author, &sk).unwrap(), 0);
+}
+#[test]
+fn commit_link_scan_dedups_against_remote_originated_events() {
+    // Simulates the cross-machine dedup case: Bob's repo fetches a link
+    // event that Alice already emitted, then runs scan locally with the
+    // same commit reachable from his branches. He must not emit a
+    // duplicate.
+    let cluster = TestCluster::new();
+    let alice_repo = cluster.alice_repo();
+    let bob_repo = cluster.bob_repo();
+    // Both repos get the same issue.
+    let (_, issue_id) = open_issue(&alice_repo, &alice(), "bug");
+    sync::sync(&alice_repo, "origin").unwrap();
+    sync::sync(&bob_repo, "origin").unwrap();
+    // Alice writes a commit and pushes it to the bare remote so Bob can
+    // fetch it. First the regular git push; then sync for the link event.
+    let message = format!("Fix thing\n\nIssue: {}", &issue_id[..8]);
+    let linked_commit = make_commit_with_message(&alice_repo, &message);
+    // Push the branch so Bob sees the commit too.
+    let mut cmd = Command::new("git");
+    cmd.args(["push", "origin", "main"])
+        .current_dir(cluster.alice_dir.path());
+    assert!(cmd.status().unwrap().success());
+    sync::sync(&alice_repo, "origin").unwrap();
+    // Bob fetches both the branch and the collab link event.
+    let mut cmd = Command::new("git");
+    cmd.args(["fetch", "origin", "main:main"])
+        .current_dir(cluster.bob_dir.path());
+    assert!(cmd.status().unwrap().success());
+    sync::sync(&bob_repo, "origin").unwrap();
+    // At this point Bob's issue already has the link event from Alice.
+    // Re-running scan on Bob's repo must find the commit locally and
+    // decide "already linked", emitting zero events.
+    let author = git_collab::identity::get_author(&bob_repo).unwrap();
+    let sk = signing::load_signing_key(&signing::signing_key_dir().unwrap()).unwrap();
+    let emitted = commit_link::scan_and_link(&bob_repo, &author, &sk).unwrap();
+    assert_eq!(emitted, 0, "Bob must not duplicate Alice's link event");
+    // And the commit on Bob's side really is the one linked.
+    let bob_ref = format!("refs/collab/issues/{}", issue_id);
+    let bob_issue = IssueState::from_ref_uncached(&bob_repo, &bob_ref, &issue_id).unwrap();
+    assert_eq!(bob_issue.linked_commits.len(), 1);
+    assert_eq!(bob_issue.linked_commits[0].commit, linked_commit.to_string());
+}
+#[test]
+fn cli_issue_show_renders_linked_commits_section() {
+    use common::TestRepo;
+    let repo = TestRepo::new("Alice", "alice@example.com");
+    let issue_id = repo.issue_open("fix the thing");
+    // Resolve the full id via --json so we can format a trailer prefix.
+    let full_id = {
+        let out = repo.run_ok(&["issue", "show", &issue_id, "--json"]);
+        let v: serde_json::Value = serde_json::from_str(&out).unwrap();
+        v["id"].as_str().unwrap().to_string()
+    };
+    let msg = format!("Fix a thing\n\nIssue: {}", &full_id[..8]);
+    repo.git(&["commit", "--allow-empty", "-m", &msg]);
+    // Set up a bare remote so sync has something to push to.
+    let bare = TempDir::new().unwrap();
+    Command::new("git")
+        .args(["init", "--bare"])
+        .current_dir(bare.path())
+        .status()
+        .unwrap();
+    repo.git(&["remote", "add", "origin", bare.path().to_str().unwrap()]);
+    repo.git(&["push", "-u", "origin", "main"]);
+    repo.run_ok(&["init"]);
+    repo.run_ok(&["sync"]);
+    let show = repo.run_ok(&["issue", "show", &issue_id]);
+    assert!(
+        show.contains("--- Linked Commits ---"),
+        "expected linked commits section, got:\n{}",
+        show
+    );
+    assert!(
+        show.contains("by Alice"),
+        "expected commit author rendered, got:\n{}",
+        show
+    );
+    assert!(
+        show.contains("(linked by Alice"),
+        "expected event author rendered, got:\n{}",
+        show
+    );
+}

Old		New
@@ -115,6 +115,7 @@ fn action_type_name(action: &Action) -> String {
115	Action::IssueAssign { .. } => "IssueAssign".to_string(),	115	Action::IssueAssign { .. } => "IssueAssign".to_string(),
116	Action::IssueUnassign { .. } => "IssueUnassign".to_string(),	116	Action::IssueUnassign { .. } => "IssueUnassign".to_string(),
117	Action::IssueReopen => "IssueReopen".to_string(),	117	Action::IssueReopen => "IssueReopen".to_string(),
		118	Action::IssueCommitLink { .. } => "IssueCommitLink".to_string(),
118	Action::PatchCreate { .. } => "PatchCreate".to_string(),	119	Action::PatchCreate { .. } => "PatchCreate".to_string(),
119	Action::PatchRevision { .. } => "PatchRevision".to_string(),	120	Action::PatchRevision { .. } => "PatchRevision".to_string(),
120	Action::PatchReview { .. } => "PatchReview".to_string(),	121	Action::PatchReview { .. } => "PatchReview".to_string(),
@@ -149,6 +150,9 @@ fn action_summary(action: &Action) -> String {
149	Action::IssueAssign { assignee } => format!("assign \"{}\"", assignee),	150	Action::IssueAssign { assignee } => format!("assign \"{}\"", assignee),
150	Action::IssueUnassign { assignee } => format!("unassign \"{}\"", assignee),	151	Action::IssueUnassign { assignee } => format!("unassign \"{}\"", assignee),
151	Action::IssueReopen => "reopen".to_string(),	152	Action::IssueReopen => "reopen".to_string(),
		153	Action::IssueCommitLink { commit } => {
		154	format!("commit link {}", &commit[..commit.len().min(7)])
		155	}
152	Action::PatchCreate { title, .. } => format!("create \"{}\"", title),	156	Action::PatchCreate { title, .. } => format!("create \"{}\"", title),
153	Action::PatchRevision { body, .. } => match body {	157	Action::PatchRevision { body, .. } => match body {
154	Some(b) => format!("revision: {}", truncate(b, 50)),	158	Some(b) => format!("revision: {}", truncate(b, 50)),

Old		New
@@ -10,7 +10,7 @@ use git_collab::state::{self, IssueState, IssueStatus, PatchState, PatchStatus};
10		10
11	use common::{	11	use common::{
12	add_comment, add_review, add_review_on, alice, bob, close_issue, create_patch, init_repo, now,	12	add_comment, add_review, add_review_on, alice, bob, close_issue, create_patch, init_repo, now,
13	open_issue, reopen_issue, setup_signing_key, test_signing_key,	13	open_issue, reopen_issue, setup_signing_key, test_signing_key, ScopedTestConfig,
14	};	14	};
15		15
16	// ---------------------------------------------------------------------------	16	// ---------------------------------------------------------------------------
@@ -804,6 +804,8 @@ use git_collab::patch;
804	#[test]	804	#[test]
805	fn test_create_patch_from_branch_populates_branch_field() {	805	fn test_create_patch_from_branch_populates_branch_field() {
806	// T009: creating a patch from current branch populates `branch` field	806	// T009: creating a patch from current branch populates `branch` field
		807	let cfg = ScopedTestConfig::new();
		808	cfg.ensure_signing_key();
807	let tmp = TempDir::new().unwrap();	809	let tmp = TempDir::new().unwrap();
808	let repo = init_repo(tmp.path(), &alice());	810	let repo = init_repo(tmp.path(), &alice());
809	make_initial_commit(&repo, "main");	811	make_initial_commit(&repo, "main");
@@ -825,6 +827,8 @@ fn test_create_patch_from_branch_populates_branch_field() {
825	#[test]	827	#[test]
826	fn test_create_duplicate_patch_for_same_branch_returns_error() {	828	fn test_create_duplicate_patch_for_same_branch_returns_error() {
827	// T011: creating a duplicate patch for same branch returns error	829	// T011: creating a duplicate patch for same branch returns error
		830	let cfg = ScopedTestConfig::new();
		831	cfg.ensure_signing_key();
828	let tmp = TempDir::new().unwrap();	832	let tmp = TempDir::new().unwrap();
829	let repo = init_repo(tmp.path(), &alice());	833	let repo = init_repo(tmp.path(), &alice());
830	make_initial_commit(&repo, "main");	834	make_initial_commit(&repo, "main");
@@ -1004,6 +1008,8 @@ fn test_auto_detect_merged_patch_via_git_merge() {
1004	// When a user merges the patch branch into the base branch manually	1008	// When a user merges the patch branch into the base branch manually
1005	// (using git merge), PatchState should auto-detect that the patch	1009	// (using git merge), PatchState should auto-detect that the patch
1006	// is merged without needing `patch merge`.	1010	// is merged without needing `patch merge`.
		1011	let cfg = ScopedTestConfig::new();
		1012	cfg.ensure_signing_key();
1007	let tmp = TempDir::new().unwrap();	1013	let tmp = TempDir::new().unwrap();
1008	let repo = init_repo(tmp.path(), &alice());	1014	let repo = init_repo(tmp.path(), &alice());
1009	make_initial_commit(&repo, "main");	1015	make_initial_commit(&repo, "main");
@@ -1039,6 +1045,8 @@ fn test_auto_detect_merged_patch_via_git_merge() {
1039	fn test_auto_detect_merged_patch_deleted_branch() {	1045	fn test_auto_detect_merged_patch_deleted_branch() {
1040	// If the patch branch was deleted after a manual merge,	1046	// If the patch branch was deleted after a manual merge,
1041	// auto-detection should not crash — patch stays Open.	1047	// auto-detection should not crash — patch stays Open.
		1048	let cfg = ScopedTestConfig::new();
		1049	cfg.ensure_signing_key();
1042	let tmp = TempDir::new().unwrap();	1050	let tmp = TempDir::new().unwrap();
1043	let repo = init_repo(tmp.path(), &alice());	1051	let repo = init_repo(tmp.path(), &alice());
1044	make_initial_commit(&repo, "main");	1052	make_initial_commit(&repo, "main");
@@ -1067,6 +1075,8 @@ fn test_cache_does_not_defeat_auto_detect_merge() {
1067	// Regression: from_ref() returned cached Open status even after the	1075	// Regression: from_ref() returned cached Open status even after the
1068	// patch branch was merged into main, because the cache hit bypassed	1076	// patch branch was merged into main, because the cache hit bypassed
1069	// the auto-detect merge logic that only ran in from_ref_uncached().	1077	// the auto-detect merge logic that only ran in from_ref_uncached().
		1078	let cfg = ScopedTestConfig::new();
		1079	cfg.ensure_signing_key();
1070	let tmp = TempDir::new().unwrap();	1080	let tmp = TempDir::new().unwrap();
1071	let repo = init_repo(tmp.path(), &alice());	1081	let repo = init_repo(tmp.path(), &alice());
1072	make_initial_commit(&repo, "main");	1082	make_initial_commit(&repo, "main");