v0.6.0 — a repository can name what git does not carry

A sandbox is built from the index, and that stays. It is what makes a verdict about the change rather than about the desk it was written on — measured at 7 of 8 verdicts moving when a release read the working tree instead.

But some repositories do not build from their index alone. A generated directory the build embeds, generated bindings: on disk, not in git. The sandbox arrives without them, the package that needs them cannot compile, and the red-baseline guard refuses. Correct, and useless.

Added

.ditto.json, at the repository root:

{"generated": ["frontend/dist", "frontend/wailsjs"]}

Those paths are copied from the working tree after the index is materialised.

The guards are the design, not decoration:

• Naming a path git tracks is refused. A tracked path has an index version, and that is the one a staged run measures. Letting the working tree win there is exactly the hole the sandbox exists to close.
• A named path that is not there is refused, not skipped. It was named because the build needs it, so a sandbox quietly missing it produces the failure this setting was added to prevent.
• Every copy is announced. Those are the only bytes in the sandbox that did not come from git, and a reader deciding whether to trust a verdict deserves to know which ones.

Both refusals were watched refusing before being trusted.

Measured, with its control

On a repository whose root package cannot compile from its index:

	result
without .ditto.json	refuses — pattern all:frontend/dist: no matching files found
with it	9 mutants, 8 killed, 1 survived, 0.89

The same verdicts a tracked placeholder produced, and now no placeholder is needed — which matters beyond tidiness, because a tracked file inside a build-output directory is rewritten by every build. docs/experiments/a-placeholder-in-build-output.md prices that and the two alternatives, and declines to choose between them.

Also

internal/filecopy replaces two byte-identical copies of the same function. SonarCloud caught real duplication rather than a style opinion, and both callers need it for the same reason: a sandbox is only a sandbox if what it holds is a copy.

Unchanged, and measured to be

The eight exact counters in perf/baseline.json, and both goldens byte-identical. 363 tests.

What ran

Tagged on de4f233, the exact merged head, after a green run on it: CI (1.27) and CI (latest) both pass on ubuntu-latest, with CodeQL, Analyze (go), OSV-Scanner and SonarCloud.