fix(maestro): honour the project cache TTL in the background rescan (#75)

Merges two milestones. Spawn v2 (#53-#68) replaced the spawn modal with
an inline draft pane, added project scanning, branch pickers and name
generation across the web and TUI clients.

Worktree lifecycle (#77-#89) then redesigned what the daemon does with a
worktree it created, which is what Spawn v2's reviews kept getting wrong:

- The daemon never adopts a directory it finds. A path collision is
  sidestepped with a numeric suffix instead of resolved.
- A kill is refused when the worktree holds unsaved work; ignored files
  never count. --force ends the session and RETAINS the tree.
- A session that exits on its own applies the same predicate, from the
  same function, so the two paths cannot drift.
- Retained trees are persisted in state_dir, listed by GET /api/worktrees,
  and reclaimed explicitly. Reclaim removes the directory, never the branch.
- cleanup_on_kill is gone from the wire; what survives is decided by what
  is in the tree, not by what the spawn asked for.

docs/WORKTREES.md is the written contract, with the reasoning for each
non-obvious rule.

crates/maestro-daemon/src/projects.rs

@@ -261,17 +261,13 @@ impl ProjectScanner {
     }
 
     /// Cached snapshot, rescanning (off-thread) when the TTL has lapsed.
+    /// Also the background timer's entry point: a tick inside the TTL is a
+    /// no-op (#75).
     pub async fn repos(&self) -> std::sync::Arc<Vec<DiscoveredRepo>> {
-        self.repos_inner(false).await
-    }
-
-    async fn repos_inner(&self, force: bool) -> std::sync::Arc<Vec<DiscoveredRepo>> {
         let mut cache = self.cache.lock().await;
-        if !force {
+        if let Some((at, repos)) = cache.as_ref() {
-            if let Some((at, repos)) = cache.as_ref() {
+            if at.elapsed() < self.ttl {
-                if at.elapsed() < self.ttl {
+                return repos.clone();
-                    return repos.clone();
-                }
             }
         }
         let roots = self.roots.clone();
@@ -287,11 +283,11 @@ impl ProjectScanner {
         repos
     }
 
-    /// Rescan now, ignoring the TTL. Called by the background timer — going
+    /// One background-refresh tick: rescan only if the cached snapshot has
-    /// through `repos()` would hit the cache and make most ticks no-ops,
+    /// passed its TTL (#75) — the timer used to bypass it and re-walk the
-    /// leaving requests to pay for the rescan instead (#54 review).
+    /// roots every [`REFRESH_INTERVAL`].
     async fn refresh(&self) {
-        self.repos_inner(true).await;
+        self.repos().await;
     }
 
     /// Spawn the slow background refresh task. Drop the returned handle to
@@ -544,6 +540,32 @@ mod tests {
         assert_eq!(fresh[0].name, "late");
     }
 
+    #[tokio::test]
+    async fn background_refresh_honours_the_ttl() {
+        let tmp = tempfile::tempdir().unwrap();
+        let mut scanner = ProjectScanner::new(
+            vec![tmp.path().to_path_buf()],
+            3,
+            PathBuf::from("/nonexistent"),
+        );
+
+        let empty = scanner.repos().await;
+        assert!(empty.is_empty());
+
+        make_repo(tmp.path(), "late");
+        // A background tick inside the TTL must not re-walk the filesystem:
+        // the new repo stays invisible until the cache expires.
+        scanner.refresh().await;
+        assert!(scanner.repos().await.is_empty());
+
+        // Once the TTL lapses, the next tick picks it up.
+        scanner.ttl = Duration::ZERO;
+        scanner.refresh().await;
+        let fresh = scanner.repos().await;
+        assert_eq!(fresh.len(), 1);
+        assert_eq!(fresh[0].name, "late");
+    }
+
     #[test]
     fn disabled_scanner_always_serves_empty() {
         let scanner = ProjectScanner::disabled();