[Crokily]

Why

A public-release readiness audit (run with Codex) confirmed four gaps that mattered once the plugin went from personal use to public: no LICENSE, an inaccurate AI model/cost claim plus no data disclosure, launchers that could reuse a lazygit pane belonging to a different repository, and layout state that was global while being used as if per-pane. This PR fixes all four; implementation was done by Codex (gpt-5.4) under direction, each workstream independently verified before landing.

What (one commit per workstream)

• b509bc8 — legal + AI honesty: MIT LICENSE (Copyright (c) 2026 Crokily); AI data disclosure sections in both READMEs; honest per-backend model defaults in docs; new AI_GEMINI_MODEL pinned to gemini-2.5-flash (flag verified against gemini --help), settings pane covers it.
• e290e6b — repo-identity launchers: a Git pane is reused only when its foreground_cwd resolves to the SAME git worktree as the launch target (git rev-parse --show-toplevel both sides; non-git dirs compare by path). Different repo / different worktree / any resolution failure → OPEN a new pane, never a wrong reuse. New tests/launcher-decision-test.sh (fake herdr + real repos/worktrees).
• 1d9c5b0 — per-pane layout isolation: LAYOUT_MODE leaves the shared panel.conf; each pane owns a layout-<pid>-<epoch>.yml layer (between generated.yml and lazygit-user.yml), U mutates only its own file, stale layers are cleaned by PID liveness on startup. panel.conf keeps only global prefs. New tests/layout-state-isolation-test.sh.
• dcbe47e — structured staged-diff sampling for AI commit: replaces head-truncation at 8,000 chars. Small diffs pass through unchanged; large diffs send a never-truncated overview of ALL staged files (+/- counts) plus round-robin per-file/per-hunk patch sampling within the same budget; lockfiles/minified/binary bodies are deprioritized; payload ends with a coverage note. New tests/ai-diff-sampling-test.sh and a HERDR_LAZYGIT_TEST_PRINT_AI_INPUT=1 hook.
• 201a01d — chore: release 0.3.0 (manifest + changelog).

Verification (by the directing agent, independently of Codex's own runs)

• All 7 test suites pass locally on the final tree; CI registers the 3 new ones.
• Manual sampler check: a staged 40KB lockfile ordered before two small source files → AI payload names all 3 files, contains both source hunks, zero lockfile body, coverage note sampled 2/3 files, 2/3 hunks. Under the old code this payload was 8,000 chars of lockfile noise.
• Launcher decisions exercised via the TEST_DECISION hook with real temp repos and a real git worktree.

Deferred by owner decision: the git-index race during AI generation (low probability; cheap git write-tree mitigation documented in the audit if ever needed).

[Crokily]

Adversarial review round (Codex, xhigh) found 4 issues; all independently confirmed by the directing agent and fixed in a1b5062:

1. P2 sampler budget violation (confirmed at 3x: 24,521 bytes vs the 8,000 cap with 500 staged files) — payload is now budgeted by construction; overview truncates with a ... N more files not listed marker (lockfile/minified/binary rows dropped first), and assembly hard-fails rather than emit over budget. Re-verified: same repro now produces 7,979 bytes.
2. P2 stale foreground_cwd blocked same-repo reuse — identity resolution now tries foreground_cwd then cwd until one resolves.
3. P2 locale-dependent / bare-repo-blind git identity — stderr-substring parsing removed entirely; identity = --show-toplevel (worktree) → --absolute-git-dir (bare) → normalized dir path (non-git); failures still degrade to OPEN, never wrong reuse.
4. P3 control chars in filenames corrupted the overview — filenames are escaped so each staged file renders as exactly one line.

Regression tests added for all four in the existing suites. All suites green locally.