Finding #9: resolve included-file roots for Clean Stale Archives; conservative on any unproven attribution

[bcourbage]

Finding #9 — "Clean Stale Archives" now attributes an archive correctly when a profile's roots come from an included file, and stays conservative (never preselecting a destructive cleanup) whenever attribution can't be proven.

Problem

Profile collection read only the direct root = lines. A profile whose roots live in an include/source file therefore looked rootless, so an archive it actively uses could be classified as a local orphan and start checked for deletion.

Design

• ProfileRootResolver (pure) resolves a profile's effective roots recursively through include / source / include? / source?, replicating upstream prefs.ml semantics: resolved relative to the Unison directory; include appends .prf only when the exact file is absent; source never appends; ? variants skip a proven-absent file. It is conservative — any ambiguity it cannot prove past marks the resolution reliable == false: a missing required target, an unreadable/unparseable target, a cycle, a malformed/.raw line Unison would itself reject, or exceeding a hard traversal bound (cycle detection + maxFiles/maxDepth guarantee termination that upstream lacks).
• CleanStaleArchivesWindowController feeds the resolved roots to the matcher and folds reliable into attributionReliable, so an unreliably-resolved profile's archives stay uncertain and never start checked.

Safety properties

• Unreadable ≠ absent. An existing-but-unreadable target (invalid UTF-8 that Unison would still read as bytes, or a non-regular object) is never treated as absent, even for an optional include?/source? — it marks the resolution unreliable. Only a proven-.missing optional is skipped.
• Precise filesystemRead. A directory, or a non-regular object (FIFO/device/socket), classifies as .unreadable (not .missing): for include its existence correctly suppresses the .prf fallback, and a FIFO/device is classified via stat without being opened (no blocking). A leading UTF-8 BOM is stripped so the first line never mis-parses.
• Enumeration failure → global uncertainty. If the Unison directory can't be enumerated, the controller does not return an empty profile set (which would make every archive a certain orphan and preselect the local-only ones). It propagates global uncertainty: every row becomes uncertain and none are preselected.
• Uncertainty is surfaced. An orange banner (pure, tested attributionWarning) explains an unreadable directory and names profiles with unresolved/unreadable includes; the per-row tooltip lists the includes case too.

Coverage

Pure-logic tests: direct/nested/diamond/cyclic includes; required-vs-optional missing; source no-.prf; relative-to-Unison-dir + escaped names; malformed .raw; rootalias surfaced; bounded traversal; optional invalid-UTF-8 → unreliable; exact-path directory alongside a valid <name>.prf → no fallback + unreliable; FIFO → .unreadable without hanging; directory/missing/regular classification; BOM parity; global uncertainty forces no destructive preselect; warning-text content (no em-dash). Full suite green.

Scope note

The enumeration-failure → no-preselect invariant is proven at the unit level via the pure rowUncertain/defaultsToChecked composition and attributionWarning; the controller's private profileScan()/window wiring is a straight-line application of those. End-to-end window behavior against a live .unison directory remains manual (no UI harness).

Untouched

Swift + tests only. vendor/, patches/, and the vendored blob (a57f5c4e) are untouched.