Reject hidden Git index states and finish POSIX timeout cleanup

ARCHITECTURE.md

@@ -22,6 +22,8 @@ check discovery → target qualification → per-target observation
 - `src/report/` renders terminal, self-contained HTML, and bounded GitHub job-summary reports from the same typed report object. The GitHub renderer is a presentation projection only and cannot add evidence.
 - `src/analyze.ts` orchestrates the pipeline and exposes the public API.
 
+Before diff extraction, `src/git.ts` validates a bounded NUL-delimited index inventory, including merge stages and cached-stat flags. Unresolved merges and `assume-unchanged`/`skip-worktree` entries abort all selection modes rather than allowing Git to hide inputs consumed by filesystem-backed analysis. The index is never rewritten. On POSIX, a timeout waits through the one-second TERM-to-KILL grace period even if the parent closes first, so descendants with redirected output cannot cancel process-group escalation. Windows retains its separate `taskkill /T /F` completion boundary.
+
 ## Design decisions
 
 ### Local static relationships, not runtime coverage

CHANGELOG.md

@@ -6,6 +6,8 @@ All notable changes are documented here. This project follows Semantic Versionin
 
 ### Fixed
 
+- Rejected unresolved merge stages and `assume-unchanged`/`skip-worktree` index entries before diff evidence or repository checks in every selection mode. Hidden modifications and sparse-checkout omissions now produce actionable errors instead of misleading empty or snapshot-aligned reports; the index is never modified.
+- Preserved POSIX timeout escalation after a parent exits, preventing descendants with redirected output and a TERM handler from surviving cancellation of the KILL timer. Windows process-tree termination remains unchanged.
 - Repaired the dogfood gate by moving test preparation into npm's `pretest` lifecycle and retaining a direct serial `node --test` command. It now requires positive observations for every related compiled target while correctly retaining partial evidence for filename-mapped TypeScript source. Added a self-discovery regression and a PR CI dogfood step; shell-chain recognition and compiled-source confidence remain conservative.
 - Unified static Git execution so immutable workspace checks and test-map snapshot reads receive the same helper suppression as diff inspection. Driver discovery now includes worktree configuration, refreshes on each operation, uses NUL-delimited names, and fails closed when incomplete.
 - Rejected truncated, timed-out, or failed Git reads instead of treating partial paths or patches as complete evidence. Per-file patch failures now stop analysis with exit code 2.

README.md

@@ -109,6 +109,8 @@ The released composite Action is available at `hzw0813/proofdiff@v0.5.3`. Use th
 
 For immutable `--base`, `--range`, and `--staged` analysis, v0.5.3 conservatively binds filesystem-backed analysis to the selected Git state instead of mixing snapshots. Base/range analysis requires the selected target to be the checked-out `HEAD`; staged analysis requires tracked worktree content to match the index. Git-visible untracked inputs and ignored metadata/test inputs that could affect static discovery fail closed. With `--run-checks`, ignored repository-local runtime inputs are rejected more broadly because repository commands could consume them; bounded dependency/cache directories remain environment inputs. An explicitly supplied LCOV file can be accepted as that exact data artifact under its separate commit-binding checks, but it does not authorize sibling files.
 
+All diff modes also require a resolved index without `assume-unchanged` or `skip-worktree` entries. These flags can hide modified or missing source, configuration, and tests from Git while ProofDiff reads the filesystem. Unresolved merges and sparse checkouts therefore stop with an actionable error (CLI exit 2, even with `--fail-on never`) before checks run or a report is written. Resolve and stage conflicts, use a full checkout (`git sparse-checkout disable`), or clear manually set flags with `git update-index --no-assume-unchanged --no-skip-worktree -- <path>`. ProofDiff never clears flags or expands the checkout itself.
+
 The released Action writes a concise, bounded **ProofDiff · Change Evidence** job summary by default, so reviewers can see changed-file evidence without opening logs. It uses the same report as terminal/JSON/HTML output, requires no write token, and does not create PR comments. Full provenance remains in the log and optional HTML artifact.
 
 ## Useful commands

SECURITY.md

@@ -42,6 +42,10 @@ Runner qualification is static and data-only. pytest configuration reads are bou
 
 These measures are defense in depth, **not a sandbox**. A command can still read accessible files, use the network, spawn processes, exploit installed tools, or persist outside the repository. Use a disposable VM/container with network and secrets removed when executing checks from untrusted contributions. On pull requests from forks, keep `run-checks: false` unless the code has been reviewed.
 
+POSIX timeout cleanup sends TERM to the process group and preserves the one-second KILL escalation even after the direct child exits and its output pipes close. This covers ordinary descendants with redirected output; descendants that deliberately leave the process group remain outside that mechanism. Windows uses its existing native process-tree termination. These mechanisms do not promise containment of arbitrary programs.
+
+All selections reject unresolved index merge stages and `assume-unchanged`/`skip-worktree` entries before check execution. Otherwise Git can report an aligned snapshot while filesystem-backed discovery reads different or missing code. Sparse checkouts must be expanded by the user or analyzed in a full separate checkout; static inspection never modifies the user's index flags.
+
 ## Data handling
 
 Terminal, JSON, and HTML reports can contain repository paths, symbol names, relationships, target-qualification reasons, per-target counts, check commands, and bounded check output. Owned inline observer source is abbreviated in the HTML command display but remains present in machine-readable JSON for reproducibility. Treat reports as repository-sensitive artifacts. The HTML report is self-contained, loads no remote resources, and has a restrictive Content Security Policy, but anyone receiving it can read its contents. The shorter GitHub job summary still contains changed and test-target paths; users with access to the workflow run can read them.