[forhappy]

Shallow clones on the indexed-read stack reject ISO dates before fetch selection, while a future numeric cutoff or excluding the requested branch incorrectly succeeds with a one-commit checkout. Normalize helper dates with Git's own parser and reject empty selections in the shared upload-pack planner before producing or installing a pack.

Stacked correction to #584. Focused real RustFS qualification passed. Draft while the broader CLI smoke and initiative release gates remain pending; no merge requested.

Change

• Decode Git's C-quoted option values through the same helper used for ref leases. Keep normalized epoch timestamps at the semantic request boundary; cancel date-parser children when the option future is abandoned.
• Apply date/ref selectors to requested commit tips before selecting their trees. Authorization does not bypass a requested history bound. Reject an empty commit selection through the existing operation finalization path.
• Replace the obsolete unsupported-selector smoke with deterministic dated commits and native file:// Git comparisons: exact selected OIDs, exact shallow boundary, visible file contents, and explicit rejection of empty selections.

Evidence

• Before-fix ISO-date regression: fails at the real classic-helper fetch seam with invalid deepen-since value.
• Before-fix real RustFS probes: future numeric cutoff and --shallow-exclude main both incorrectly succeed and install a one-commit shallow checkout.
• Native Git oracle: date cutoff and archive exclusion retain exactly the latest two commits; future cutoff and excluding main fail with no checked-out file.
• Patched shallow regression selection: 50 passed; quote/ref-lease sibling selection: 6 passed; helper option selection: 23 passed (overlaps the shallow selection).
• Python source/fixture harness tests: 11 passed.
• Strict all-target Clippy for crab-read and crab-remote-git, no default features, -D warnings: passed.
• CLI build at 433bba8e553, minimal NFS/SIMD/pathmatch features: passed. Binary SHA-256 1571029a817d09c53ae32e3c899651886c9b2545eb0b33675fd5ce339f7d4010.
• Real RustFS focused run: 51 commands / 37 checks passed. Native Git, explicit protocol-v2 and explicit classic-helper selectors agree on exact OIDs, boundary and contents; empty selectors reject; raw ancestor policy, deepen and unshallow pass. Report SHA-256 684d08749e30eb7ad504b39a18d326d44f711dfcf2beb9fc727d27c39d9818fd.
• The initial new fixture advertised the raw-policy probe via its archive tag. Keep the existing raw-SHA denial assertion and tag a side tip instead: its exclusion closure still includes the ancestor, without advertising that SHA. The negative run is retained; the complete focused rerun passed. This fixture-only follow-up leaves the compiled Rust source unchanged.
• Broader ordinary-Git plus native/Git managed-file CLI smoke: failed during fault setup after 191 commands / 84 checks. missing-pack-fixture-object-found expects standalone .pack/.idx keys, but the current v2 format embeds both inside a capsule. Selector, deepen/unshallow and raw-SHA checks passed before that failure. A separate fixture follow-up must qualify current physical faults; this is not a green full-smoke claim.

Review evidence

Boundary	Evidence
Changed surface / entry point	read_batch -> handle_option -> normalized FetchOptions; shared plan_with_operation
Owner / callee	Helper owns Git option decoding; crab-read owns selector enforcement before enqueue_children; remote Git operation finalization closes locator sessions on errors
Siblings	Classic helper, protocol-v2 materialized/catalog/tip-bound planning, and HTTP fetch use the shared planner; protocol-v2 maps planning errors before pack response bytes
Existing tests	Classic since/excluded-ref boundaries, relative deepen/unshallow; quote/ref-lease parsing; real smoke native oracles
Current main	Explicitly rejects date/ref selectors; the parent indexed-read stack adds selector support but retains the parsing and requested-tip bugs

Is this the best fix? Keep Git's date grammar at its adapter boundary and one selection rule in the shared planner. A helper-only empty-selection check would leave protocol-v2 and HTTP behavior inconsistent; accepting either success or a generic failure in the smoke would hide the reproduced bug.

Git's primary source confirms that fetch-pack and rev-parse --since both use approxidate: fetch-pack, rev-parse. Transport helper C-quotes option strings before sending them.

The broader initiative remains incomplete: final integrated 10 GiB pattern/order/failure qualification, bounded history/ref opening, lifecycle/migration, fuller blame, and representative S3 latency/scaling evidence are separate gates. Two cold captured-index GC regressions were replayed and still fail; their unchanged marking/sweep functions match this branch. They are not fixed by this correction. Parent CI also reports a rusqlite source-policy mismatch against its SQLite WAL runtime upgrade; this correction does not alter that guardrail or dependency versions.