update-shape.py rewrite_shape_pin and bump-leg.py rewrite_pin find tree_sha256: by exactly two leading spaces and replace whole lines, so a contracts/<role>-pin.yaml whose digests: child is indented four is refused as hand-edited, and a trailing comment on a commit: or tree_sha256: line is dropped by every pin rewrite, rewrite_manifest included #323

Lane: openreposhape-3 (openRepoShape-3)

What happens. Two symptoms of one assumption, that the scaffold's exact line layout is the only one. Measured on be2790e by calling the three functions:

1. A pin whose digests: child is indented four spaces reads fine (repo_shape.parse_yaml gives {'tree_sha256': 'b'}), and both pin rewrites refuse it:

update-shape.py rewrite_shape_pin  ->  REFUSED update-pin-unrecognised: contracts/shape-pin.yaml has 0 `tree` line(s) where exactly one was expected
bump-leg.py     rewrite_pin        ->  REFUSED bump-leg-pin-unrecognised: the pin file has 0 `tree_sha256` line(s) where exactly one was expected

PR #224 measured the apply outcome for a four-space shape-pin.yaml as update-pin-unrecognised, rolled back.

2. Input commit: "a" # the cut we reviewed and tree_sha256: "b" # recomputed by hand: all three of rewrite_shape_pin, rewrite_pin and rewrite_manifest write the line back as commit: "<sha>" and tree_sha256: "<digest>"; the comment is gone. Identical before update-shape.py: apply keeps each of the manifest's shape: pin lines at the indentation it already has and reads the rewrite back, so a project.yaml indented four spaces takes the update instead of being rolled back under the validators' lockstep remedy (#208) #224.

Where. update-shape.py:rewrite_shape_pin (:837; startswith(" tree_sha256:") at :856), rewrite_manifest (:879; lines[index] = f'{indent}commit: ...' at :908 and the tree_sha256 one at :911); scripts/bump-leg.py:rewrite_pin (:194; :222).

Why it matters. #208's body named the pin rewrites as "same root cause, louder outcome". #224 fixed the manifest side (keep each line's indentation, read the rewrite back) and left these. The pin files are scaffold-written and say not to hand-edit them, so the realistic case is rare; the open decision is whether the pin rewrites should keep each line's own indentation and the text after the value, as rewrite_manifest now keeps its indentation, or keep refusing. The comment loss is in the project's own manifest as well.

Source. PR #224, ## Left out, both bullets. Related: #208 (closed).