flagon-io/g1t

Closes #319.

These are the last loose ends in how a push's answer is read, from #307's review. None of them overcharged anyone.

What changes

• One parser (land.rs read_answer). It replaces report_lines and returns one of:

  • Report (unpacked or unpack failed, the ok refs and the ng refs);
  • Fatal (a side-band channel-3 packet or an ERR packet);
  • Unread.

  It reads report-status v1 and v2 (skipping option lines), plain and side-band, and reports split across packets. verdict, refused_whole and the push path all read it, so the two readings of ok lines no longer disagree. For single-ref writes it reads the same as before, so normal writes still settle as Moved.

• A 200 with a fatal error ends for staff (push_settlement), with the refs it asked for. It is no longer counted, because a fatal most likely took nothing. A 200 with no readable report is still counted, as before.

• A push records only the refs its report didn't refuse. A ref the report lists as ng, or every ref when the unpack failed, fires no git.push event, webhook, workflow, rule or About refresh. Refs the report doesn't mention, and answers that are fatal or unread, are still checked in the store by record_push, as before. A ref that moved is never dropped. A reserved push refused whole builds no PushDone. Storage is unchanged: every git push is reserved, so this filter never touches stored_bytes.

• g1t's own copies say why they aren't counted (comments at each site, and in the docs):

  • test_merge.rs (refs/pull/N/merge and the head copy): the head's objects come either from the working copy, whose pushes were already counted to this repository as its root, or from a branch of someone's own fork, whose pushes were counted to that fork. Either way, the target's owner didn't push them.
  • forks.rs keep_head and revive: these bytes were already counted to the working copy's root, and stored_bytes only grows.

  The runbook's drift list now includes a pull request's head copied in from someone's fork.

• A D1 round-trip test wasn't added. Registry holds a concrete D1 binding, and the store is called over Fetch, so faking it would mean a trait across the crate. The SQL is already round-tripped on the migrated schema by the conformance suite.

• Docs: architecture/git, usage and billing, and the storage holds runbook.

Verified

Independent review: ready to merge. Nothing undercounts billing, and no moved ref is dropped. Its two should-fixes (the fork case in the test-merge justification, and dropping only refused refs) and the visible-escapes nit are applied in 4cfe6ba5. The remaining parser follow-ups are #332. The branch merges cleanly with #326's.