Files can change between a bulk content check and the final filesystem-monitor query.
Keep the scanned file descriptors and metadata available until the final filesystem-monitor check. Accept the results only after confirming that no concurrent worktree change invalidated the scan.
Document an optional .csts file that records a known-clean git status --porcelain=v2 result.
On a main APFS worktree, reuse the result only after checking the index, HEAD, configuration, attributes, ignore rules, and filesystem-monitor history. Missing, stale, or malformed cache files always fall back to ordinary status.