test(node): close #135 tree-gate coverage gaps from review

Add the handler- and helper-level cases the code review flagged:
- ipfs_cid_dangling_tree_fails_closed_under_path_rules: a dangling tree via
  git mktree 404s through cid_router for anon AND owner (handler wiring of the
  fail-closed tree arm, not just the helper).
- ipfs_cid_tree_served_when_no_path_scoped_rule: a tree CID serves 200 when no
  path-scoped rule exists (the skip-walk branch is not over-gating trees).
- allowed_tree_set_includes_tree_shared_across_allowed_and_denied_paths: T2
  content-dedup — a tree oid reachable at both an allowed and a withheld path is
  included (allowed-wins).
- allowed_tree_set_includes_root_trees_of_all_reachable_commits: the batched
  root-tree pass returns every reachable commit's root, not just HEAD's.

Author: t

crates/gitlawb-node/src/git/visibility_pack.rs

@@ -892,9 +892,9 @@ mod tests {
             .stdout(Stdio::piped())
             .spawn()
             .unwrap();
-        write!(
+        writeln!(
             child.stdin.as_mut().unwrap(),
-            "100644 blob {secret_oid}\tdangling-only-unreferenced.txt\n"
+            "100644 blob {secret_oid}\tdangling-only-unreferenced.txt"
         )
         .unwrap();
         let out = child.wait_with_output().unwrap();
@@ -911,6 +911,103 @@ mod tests {
         }
     }
 
+    #[test]
+    fn allowed_tree_set_includes_tree_shared_across_allowed_and_denied_paths() {
+        // T2 (content-dedup): the SAME tree oid reachable at both an allowed and a
+        // withheld path is INCLUDED for anon (allowed-wins) — its structure is
+        // visible to the caller at the allowed path. Mirrors the blob analog
+        // `same_blob_at_allowed_and_denied_path_is_not_withheld`.
+        let td = TempDir::new().unwrap();
+        let work = td.path().join("work");
+        std::fs::create_dir_all(work.join("pub/sub")).unwrap();
+        std::fs::create_dir_all(work.join("sec/sub")).unwrap();
+        std::fs::write(work.join("pub/sub/f.txt"), b"same bytes\n").unwrap();
+        std::fs::write(work.join("sec/sub/f.txt"), b"same bytes\n").unwrap();
+        let run = |args: &[&str]| {
+            assert!(
+                Command::new("git")
+                    .args(args)
+                    .current_dir(&work)
+                    .status()
+                    .unwrap()
+                    .success(),
+                "git {args:?}"
+            );
+        };
+        run(&["init", "-q"]);
+        run(&["config", "user.email", "t@t"]);
+        run(&["config", "user.name", "t"]);
+        run(&["add", "."]);
+        run(&["commit", "-qm", "seed"]);
+        let oid = |rev: &str| {
+            let out = Command::new("git")
+                .args(["rev-parse", rev])
+                .current_dir(&work)
+                .output()
+                .unwrap();
+            String::from_utf8_lossy(&out.stdout).trim().to_string()
+        };
+        let pub_sub = oid("HEAD:pub/sub");
+        let sec_sub = oid("HEAD:sec/sub");
+        assert_eq!(pub_sub, sec_sub, "identical content dedups to one tree oid");
+
+        // Withhold /sec from anon; the shared oid is still reachable at /pub/sub.
+        let rules = [rule("/sec/**", &[])];
+        let anon = allowed_tree_set_for_caller(&work, &rules, true, OWNER, None).unwrap();
+        assert!(
+            anon.contains(&pub_sub),
+            "a tree reachable at an allowed path is included even when also at a withheld path"
+        );
+    }
+
+    #[test]
+    fn allowed_tree_set_includes_root_trees_of_all_reachable_commits() {
+        // The batched root-tree pass (root_tree_pairs) must return EVERY reachable
+        // commit's root tree, not just HEAD's — two commits with distinct root trees
+        // both land in the set. Guards the git-log-over-N-commits root derivation.
+        let td = TempDir::new().unwrap();
+        let work = td.path().join("work");
+        std::fs::create_dir_all(&work).unwrap();
+        let run = |args: &[&str]| {
+            assert!(
+                Command::new("git")
+                    .args(args)
+                    .current_dir(&work)
+                    .status()
+                    .unwrap()
+                    .success(),
+                "git {args:?}"
+            );
+        };
+        run(&["init", "-q"]);
+        run(&["config", "user.email", "t@t"]);
+        run(&["config", "user.name", "t"]);
+        let oid = |rev: &str| {
+            let out = Command::new("git")
+                .args(["rev-parse", rev])
+                .current_dir(&work)
+                .output()
+                .unwrap();
+            String::from_utf8_lossy(&out.stdout).trim().to_string()
+        };
+        std::fs::write(work.join("a.txt"), b"one\n").unwrap();
+        run(&["add", "."]);
+        run(&["commit", "-qm", "c1"]);
+        let root1 = oid("HEAD^{tree}");
+        std::fs::write(work.join("b.txt"), b"two\n").unwrap();
+        run(&["add", "."]);
+        run(&["commit", "-qm", "c2"]);
+        let root2 = oid("HEAD^{tree}");
+        assert_ne!(root1, root2, "the two commits have distinct root trees");
+
+        // Public repo, no rules: every reachable tree is allowed for anon.
+        let set = allowed_tree_set_for_caller(&work, &[], true, OWNER, None).unwrap();
+        assert!(
+            set.contains(&root1) && set.contains(&root2),
+            "root trees of BOTH reachable commits are in the set (batched root pass)"
+        );
+    }
+
     #[test]
     fn fail_closed_drops_dangling_private_blob() {
         // #99: a private blob orphaned by a force-push/amend is unreachable but

crates/gitlawb-node/src/test_support.rs

@@ -2487,6 +2487,124 @@ mod tests {
         assert!(!body.contains("DANGLING SECRET"));
     }
 
+    /// #135: a DANGLING tree (in the ODB, referenced by no commit) 404s under
+    /// path-scoped rules for anon AND owner — the reachable-only allowed-tree-set
+    /// never enumerates it. Handler-level companion to the helper test
+    /// `allowed_tree_set_excludes_dangling_tree`, proving the `get_by_cid` tree arm
+    /// (memo insert + `!in_allowed` continue) fails closed on the dangling case.
+    #[sqlx::test]
+    async fn ipfs_cid_dangling_tree_fails_closed_under_path_rules(pool: PgPool) {
+        use crate::db::VisibilityMode;
+        use gitlawb_core::identity::Keypair;
+
+        let owner = Keypair::generate();
+        let owner_did = owner.did().to_string();
+        let slug = owner_did.replace([':', '/'], "_");
+        let short = owner_did.split(':').next_back().unwrap().to_string();
+        let state = test_state(pool).await;
+
+        let fx = seed_cid_repos(&slug, &short, &["dangtree"]);
+        let bare = std::path::PathBuf::from("/tmp")
+            .join(&slug)
+            .join("dangtree.git");
+
+        // Dangling tree via `git mktree`: a UNIQUE entry name so its oid is
+        // content-distinct from every reachable tree (a content-identical tree would
+        // dedup to a reachable oid — that is T2, not danglingness).
+        let mut child = std::process::Command::new("git")
+            .args(["mktree"])
+            .current_dir(&bare)
+            .stdin(std::process::Stdio::piped())
+            .stdout(std::process::Stdio::piped())
+            .spawn()
+            .expect("spawn git mktree");
+        {
+            use std::io::Write;
+            writeln!(
+                child.stdin.as_mut().unwrap(),
+                "100644 blob {}\tdangling-only-unreferenced.txt",
+                fx.secret_oid
+            )
+            .unwrap();
+        }
+        let out = child.wait_with_output().expect("mktree output");
+        assert!(
+            out.status.success(),
+            "git mktree: {}",
+            String::from_utf8_lossy(&out.stderr)
+        );
+        let dangling_tree_oid = String::from_utf8_lossy(&out.stdout).trim().to_string();
+        assert_eq!(dangling_tree_oid.len(), 64, "expected sha256 oid");
+        let dangling_cid = cid_for_oid(&dangling_tree_oid);
+
+        state
+            .db
+            .create_repo(&seed_repo(&owner_did, "dangtree"))
+            .await
+            .expect("seed repo");
+        let rec = state
+            .db
+            .get_repo(&owner_did, "dangtree")
+            .await
+            .unwrap()
+            .unwrap();
+        state
+            .db
+            .set_visibility_rule(&rec.id, "/secret/**", VisibilityMode::B, &[], &owner_did)
+            .await
+            .expect("deny rule");
+
+        for req in [cid_anon(&dangling_cid), cid_signed(&owner, &dangling_cid)] {
+            let (st, _) = cid_parts(cid_router(&state).oneshot(req).await.unwrap()).await;
+            assert_eq!(
+                st,
+                StatusCode::NOT_FOUND,
+                "dangling tree must 404 under path-scoped rules (anon + owner)"
+            );
+        }
+    }
+
+    /// #135: with NO path-scoped rule the per-object gate is skipped, so a tree CID
+    /// is served (the `"/"` gate is the whole story). Guards against over-gating
+    /// trees — the tree analog of the blob skip-walk branch.
+    #[sqlx::test]
+    async fn ipfs_cid_tree_served_when_no_path_scoped_rule(pool: PgPool) {
+        use gitlawb_core::identity::Keypair;
+
+        let owner = Keypair::generate();
+        let owner_did = owner.did().to_string();
+        let slug = owner_did.replace([':', '/'], "_");
+        let short = owner_did.split(':').next_back().unwrap().to_string();
+        let state = test_state(pool).await;
+
+        let fx = seed_cid_repos(&slug, &short, &["nopathrule"]);
+        let tree_cid = cid_for_oid(&fx.secret_tree_oid);
+
+        // Public repo, no visibility rules → has_path_scoped_rule is false.
+        state
+            .db
+            .create_repo(&seed_repo(&owner_did, "nopathrule"))
+            .await
+            .expect("seed repo");
+
+        let (st, body) = cid_bytes(
+            cid_router(&state)
+                .oneshot(cid_anon(&tree_cid))
+                .await
+                .unwrap(),
+        )
+        .await;
+        assert_eq!(
+            st,
+            StatusCode::OK,
+            "tree served to anon when no path-scoped rule exists"
+        );
+        assert!(
+            bytes_contain(&body, b"b.txt"),
+            "served tree carries its child structure"
+        );
+    }
+
     // ---------------------------------------------------------------------------
     // Issue #120 — repo-scoped read surfaces visibility gate
     // ---------------------------------------------------------------------------