debug: stress-test the Windows status -f flake with discriminating diagnostics

Temporary. Adds evidence to the assertion that distinguishes the two
candidate mechanisms — 'git add skipped the file' vs 'git add ran without
the clean filter' — since both produce the same visible symptom of an
index blob identical to HEAD.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TYMP8eH52L6rNdjbukfuyZ

Author: lucatescari

.github/workflows/stress-windows.yml

@@ -0,0 +1,35 @@
+# TEMPORARY debugging workflow — delete once the flake is understood.
+# Reproduces test_status_fix_restages_only_warning_files on Windows by
+# running it repeatedly and stopping at the first failure, so the
+# diagnostics in the test's assertion message get captured.
+name: stress-windows
+
+on:
+  push:
+    branches: [debug/windows-status-fix-flake]
+  workflow_dispatch:
+
+jobs:
+  stress:
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - name: Build test binary once
+        run: cargo test --test integration --no-run
+
+      - name: Run the flaky test until it fails (max 30 attempts)
+        shell: bash
+        run: |
+          for i in $(seq 1 30); do
+            echo "::group::attempt $i"
+            if ! cargo test --test integration test_status_fix_restages_only_warning_files -- --exact --nocapture; then
+              echo "::endgroup::"
+              echo "FAILED ON ATTEMPT $i"
+              exit 1
+            fi
+            echo "::endgroup::"
+          done
+          echo "30/30 attempts passed — no reproduction this run"

tests/integration.rs

@@ -1096,12 +1096,38 @@ fn test_status_fix_restages_only_warning_files() {
          gitveil status -f stderr:\n{}\n\
          git diff --cached --name-only stdout: {:?}\n\
          git diff --cached --name-only stderr: {:?}\n\
-         git status --porcelain:\n{}",
+         git status --porcelain:\n{}\n\
+         --- discriminating evidence ---\n\
+         index entry (git ls-files -s):   {}\
+         HEAD blob  (rev-parse HEAD:..):  {}\
+         index blob first bytes:          {:?}\n\
+         git check-attr filter bad.secret: {}\
+         filter.git-crypt.clean:          {}\
+         filter.git-crypt.required:       {}",
         String::from_utf8_lossy(&out.stdout),
         String::from_utf8_lossy(&out.stderr),
         staged_out,
         String::from_utf8_lossy(&staged.stderr),
         String::from_utf8_lossy(&git(dir.path(), &["status", "--porcelain"]).stdout),
+        String::from_utf8_lossy(&git(dir.path(), &["ls-files", "-s", "bad.secret"]).stdout),
+        String::from_utf8_lossy(&git(dir.path(), &["rev-parse", "HEAD:bad.secret"]).stdout),
+        git(dir.path(), &["show", ":bad.secret"])
+            .stdout
+            .iter()
+            .take(10)
+            .map(|b| format!("{b:02x}"))
+            .collect::<String>(),
+        String::from_utf8_lossy(&git(dir.path(), &["check-attr", "filter", "bad.secret"]).stdout),
+        String::from_utf8_lossy(
+            &git(dir.path(), &["config", "--get", "filter.git-crypt.clean"]).stdout
+        ),
+        String::from_utf8_lossy(
+            &git(
+                dir.path(),
+                &["config", "--get", "filter.git-crypt.required"]
+            )
+            .stdout
+        ),
     );
     assert!(
         !staged_out.contains("new.secret"),