LU-20649 reads an MDT changelog into a struct llapi_scan_rec. This is what
reaches a user: two spellings of lfs find that search one, and the mount-side
call the first of them needs.

The one-line difference between them: --since answers as it is now —
every candidate from the log is verified against the live object — and
--changelog answers as it was recorded. That is why -name under
--changelog matches the name in the event and not the object's current
name, and why an unlinked object appears under --changelog and cannot
under --since.

Three pieces

• llapi_scan_fid() — fill a record for one FID through a mount, the way a walk fills one. Written; see the note below.
• lfs find --since — the changelog as a candidate set, each candidate verified. The result is a strict subset of an ordinary find: narrowed, never wrong.
• lfs find --changelog — the changelog as the whole source, with the three rules below.

Why --since is a composition and not a scanner flag

A walk cannot skip to the changed objects. --since inside
llapi_scan_namespace() would read the log and then walk everything anyway,
so it lives above the scanners: candidates from llapi_scan_changelog() in
object mode, each filled by llapi_scan_fid(), each judged by the existing
find_decide(). No new predicates and no second copy of the vocabulary.

The three rules that keep the two flags apart

1. A predicate the changelog cannot answer is refused, not approximated, unless -resolve is given. -type is the one that straddles: a creation records it and nothing else does, so without -resolve it matches creations and counts the rest undecided.
2. Under --changelog the path argument means the mount, not a subtree, because a changelog is per-MDT and knows nothing about where an object sits.
3. Output is a pathname where one exists and a FID where one does not. An unlinked object has no pathname, and printing its FID is the whole point of asking.

Resolution fills, and never removes or overrides: adding --resolve must not
make the answer smaller.

What --since takes

• --since TIME — the first record at or after it, per MDT. The human spelling, and the only one that means the same thing on every MDT.
• -since INDEX — only with an explicit single -changelog MDT, or on a single-MDT filesystem. Refused otherwise, naming the ambiguity, because cr_index is per-MDT.
• --since-cookie FILE — per-MDT indexes written by a previous run, rewritten at the end. The machine spelling, and what a repeated job should use.

A bare number is never guessed between an index and an epoch second.

Acceptance

• lfs find --since returns a subset of what the same predicates return without it, on the same filesystem, with no predicate answering differently.
• A predicate --changelog cannot answer is refused with the predicate named, or counted undecided where rule 1 says so.
• An object unlinked during the window appears under -changelog and not under -since.
• sanity cases for both, and for the refusals.