Release Release v3.7.6 - ACL re-check on rematch + UI signals · pacnpal/compressatorium

v3.7.6 - ACL enforcement on post-sync rematch + UI signals

Follow-up point release addressing two issues flagged in the v3.7.5 review.

Post-sync rematch now re-validates every path against CONFIGURED_VOLUMES. v3.7.5's rematch hook snapshotted paths from DATMatch and handed them to schedule_match_job unchanged. Those paths were ACL-approved at write time, but a later tightening of CONFIGURED_VOLUMES (a mount unmounted, a library removed) or a retargeted symlink would slip through undetected. schedule_match_job now runs every incoming path through os.path.realpath + is_within_configured_volumes and drops denied entries with a WARNING log. The HTTP /dat/match-batch/job handler still pre-filters, so duplicate filtering is a no-op on the HTTP path.
_background_match_tasks invariant is now self-checking. schedule_match_job logs a warning if the strong-ref set is non-empty when a new task is scheduled — the concurrency guard should make that impossible, so surfacing it catches any future guard-bypass regression that would otherwise be silent.

Sync status payload carries rematch_status + rematch_job_id. GET /dat/sync/status now reports scheduled (with a job_id the UI can poll), deferred (another match job holds the lock), failed (scheduling raised; DAT import still succeeded), or None (sync had errors; no rematch attempted). Previously the UI had to infer rematch progress from log-tailing.

313 tests pass (+5 new):

ACL filter tests (all-denied, mixed allow/deny).
Rematch-status plumbing tests (scheduled / deferred / failed branches).
Task-lifecycle assertion tightened to cover _background_match_tasks membership.

No action required. The ACL re-check is idempotent on already-admitted paths. Frontend consumers see two new optional keys in progress — old clients that ignore unknown keys keep working.