[WarGloom]

What does this PR do?

Fixes #2733. With auto_watch=true, a successful index_repository request from an initialized MCP session now registers the requested project and root for automatic refresh. A client started in a workspace can index a custom-named worktree and keep it fresh while that client remains connected. Previously that target reported watched: false with reason: not_session_project after a successful index.

Track each session's memberships separately from physical watches. Shared projects remain watched until their last owner disconnects. Async completion registers a target only while a requesting session is connected; failed jobs and one-shot CLI requests do not add watches. Preserve the indexed mode and persistence option for watcher refreshes, and remove secondary watches when global auto_watch is disabled.

This uses the existing configuration and tool arguments and retains workspace-root and tool-profile checks. Update the runtime instructions, status hint, README, and configuration reference accordingly. Related: #1429, #1660.

Validation

Rebased onto 3457b21b; preserved the upstream UTF-8 filesystem checks and updated list_projects paging documentation. Only the watcher fix, its tests, and documentation are in this diff.

• CI lint, security audit, and diff-scoped clang-tidy passed on the rebased source (Cppcheck 2.20.0; CC=clang CXX=clang++). Passed ASAN_OPTIONS=detect_leaks=0:detect_stack_use_after_return=0 scripts/test.sh --suites daemon_application,watcher,sqlite_writer,mcp CC=clang CXX=clang++: 567 passed, 4 skipped, exit 0.
• Previous head 9197e801 passed the embedded-UI build, process-level watcher/session checks, 476 focused tests (4 skipped), and the complete ASan/UBSan unit suite: 9,905 passed, 9 skipped. These are previous-head results, not a claim that the rebased full suite has completed.
• The full entry point remains blocked by the upstream Step 0w language-count contract. Reproduced tests/test_language_count_contract.sh on a clean 3457b21b checkout and scripts/test.sh CC=clang CXX=clang++ on the rebased PR: five obsolete surfaces, exit 1. Upstream PR fix(ci): repair language count and Windows CodeQL retrace contracts #2732 fixes that exact issue and is still open. No check is skipped and no unrelated contract or graph-ui changes are bundled here.

Local sanitizer builds retain two pre-existing ObjectScript scanner zero-length memcpy guards; those changes are outside this PR. ASan/UBSan test runs disable LeakSanitizer because of the local ptrace environment.

AI assistance: OpenAI Codex assisted with implementation, regression tests, documentation, and review. The submitting contributor is responsible for this change.

Checklist

• Every commit is signed off (git commit -s)
• Full entry point passes locally (blocked by upstream fix(ci): repair language count and Windows CodeQL retrace contracts #2732; previous-head unit results above)
• Lint passes (make -f Makefile.cbm lint-ci)
• New behavior is covered by tests (the original failure was also observed through MCP)

[github-actions]

Thanks for opening this — it has been seen, and it is queued.

This note is automated, but it is not a brush-off: it exists so you know where your PR stands instead of having to guess from silence.

Current review status: working through a backlog. 0.9.1-rc.1 is out, so the release freeze that held reviews is over — but it left a large queue of open pull requests behind it, and we are reading through them oldest-first. The background is in discussion #1144.

What that means for this PR, concretely:

• It will not be closed for inactivity. No stale bot touches pull requests here.
• It may still sit a while before a human reads it. That is on us, not on you.
• Older PRs are read first, so a recent one is not being skipped — it is behind a queue.

Things that will genuinely speed it up whenever review does happen:

• Keep it rebased on main — the tree is moving quickly right now, and a conflicting branch cannot be reviewed as the diff you intended.
• Get CI green, or say which failures you believe are pre-existing.
• Keep the change to one claim. Bundled features and refactors get split before they get merged, which costs you a round trip.
• Every commit needs a sign-off (git commit -s) — CI enforces DCO.

If this fixes a bug, a reproduction we can run is worth more than a description of the symptom.

Thanks for contributing, and sorry in advance for the wait.

[DeusData]

Thank you for implementing session-owned watches and adding the ownership tests! I added two maintainer commits to finish the agreed behavior and get this onto the current CI baseline:

• b260a4b fixes Windows path-separator matching across watch ownership and callback admission, removes all session watches when global auto_watch is disabled, and preserves the effective doc_candidates choice on later refreshes. It also documents the behavior and adds regressions.
• aa5501d merges the current main baseline so this PR picks up the shared CI fixes while preserving your commits.

Validation: 191 targeted daemon/application/watcher tests passed on macOS arm64 with ASan/UBSan. The five reproduced failures returned when the production fix was reverted with the regression tests unchanged. The baseline merge left the validated production/test files byte-identical. Native Windows verification will come from the fresh required GitHub CI; I have not run a native Windows test locally.

Thanks again for the contribution! I will check the refreshed CI before taking the next merge decision.

[DeusData]

Merged - thank you, @WarGloom! Separating each session's watch memberships from the physical watches was exactly the right shape, and your ownership tests (failed index, one-shot CLI, async requester disconnect, cancelled sync join) made the async lifetime straightforward to verify. With the two follow-up commits on top, CI is green on every platform, including the native Windows leg that exercises the path matching. Thanks again for the careful reproduction in #2733.