[brettheap]

Goal

The three things rv1090's review of #1090 (#912) left (#1090 issuecomment-6316009648): a row that holds YAML_NOT_TEXT_RE's exponents of two or more digits, a true refusal where a leg with no origin holds a tag without its commit, and no else that nothing reaches. This is #1103. Brett Heap's ruling of 2026-10-21T10:32:04Z held it until the v1.2.0 tag, and it is now on the v1.2.1 milestone.

Three commits: 9d14c29a on main 6da757cb, a merge of main 038dafba (clean), and fix round 1 a4beec9e, which answers rv1131's review (#1131 issuecomment-6321276436, READY with two NITs): see ## Fix round 1. Together they change scripts/bump-leg.py, tests/test_neutral_pin_entry_one_spelling.py and tests/test_bump_leg_reachability_words.py. The sections down to ## Runs are the first commit's, as rv1131 reviewed them.

What held on main

Each claim was measured on main 6da757cb by name; the issue's lines are at d5389eb6. All three held, at the same names.

• The SHOULD held. YAML_NOT_TEXT_RE (scripts/shape_materialize.py:538-543) has two exponent groups, (?:[eE][-+][0-9]+)? and (?:[eE][-+]?[0-9]+)?, and every exponent in YAML_FLOATS (tests/test_neutral_pin_entry_one_spelling.py:92) has one digit.
  • rv1090's R2 changes [0-9]+ to [0-9] in both groups.
  • Applied to main, R2 passes all 208 rows of the spelling file, test_scaffold_pin_and_reuse.py and test_adopt_pins.py that -k "spell or entry or name or rule or stock or every" selects.
  • The head before this change quotes .5e-10, .5E+10, .5_e-10, .5e10 and .05E-12 correctly, so this is a missing row, not a defect.
• NIT 1 held. _unreachable_refusal (scripts/bump-leg.py:1239) was called by the probe on a leg that holds the tag v1's object but not its commit.
  • With has_origin=False and either fetched, it said bump-leg-commit-not-on-remote: <tag> is not in the leg's own object store, and the leg's mount, <leg>, has no remote named origin to fetch it from, .... That is untrue: cat-file -t says tag.
  • With has_origin=True it said opensoft/openGlass has no branch containing <tag>, which is true.
• NIT 2 held. A line trace of peeled_target (scripts/bump-leg.py:979) ran over a commit, a tag, a tag of a tag, a tree, a blob, a tag of either, a tag and a tag of a tag held without their commit, and an id the leg lacks.
  • names a {kind} was reached by the tree and the blob, and is an annotated tag of a {names} by the tag of a tree and the tag of a blob.
  • else: what = "is an annotated tag that names no commit" was reached by nothing.

What changed

• YAML_FLOATS gains .5e-10, .5E+10, .5_e-10 and .5e10, as the issue asks.
  • It also gains .5.5e-10. All four of those reach the second pattern (\.[0-9_]+), so a cut to the first group's exponent alone still passed them. Only the first pattern, YAML 1.1's as written, takes .5.5e-10. Each group is now held on its own (R2a and R2b below).
  • The list's comment no longer says --pin admits every name in it: .e+5, .5e+3 and .5E+10 hold a +, which PIN_ARG_RE refuses, so it says a plain scalar can spell them.
  • Each new name runs through the two rows that take YAML_FLOATS: double-quoted and read back, and double-quoted by the rule alone. That is 10 new rows.
• _unreachable_refusal: where the leg has no origin and object_kind(id) is tag, the refusal keeps its code, bump-leg-commit-not-on-remote. Its words are now:
  • <tag> is an annotated tag the leg's own object store holds without the commit it names, and the leg's mount, <leg>, has no remote named origin to fetch that commit from, so whether a branch of <repository> reaches it is not known
  • Remediation: check the tag -- the commit it names belongs to the LEG, not to the assembly root -- and push that commit to a branch of the leg first if it is not pushed yet; give <leg> back a remote named origin, ... (an em dash in the tool, as in the words beside it).
  • An id the leg does not hold keeps its words, and so does every case with an origin.
  • Fix round 1 gives two rarer held tags this branch caught their own true words: a tag through a tag the leg lacks, and a tag of a tree or a blob.
  • No other text pins the old sentence. grep of tests/, README.md, docs/, the handbook and AGENTS.md finds it only in bump-leg.py, and AGENTS.md's codes table is unchanged.
• peeled_target: the three-way if/elif/else is now one expression: is an annotated tag of a {names} for a tag, names a {kind} otherwise, with a comment saying why nothing else is left. The words for a tree, a blob and a tag of either are unchanged, by the same trace on the head. shape_materialize.not_a_commit, which commit_on_forge uses, still says "an annotated tag that names no commit"; it is not touched.

Rows, failing on main

• tests/test_bump_leg_reachability_words.py, test_a_tag_a_leg_with_no_origin_holds_alone_is_told_it_is_held.
  • The setup: a tag of a commit pushed nowhere is made in a clone of the leg's remote, and only the tag object goes into the leg (git hash-object -t tag -w). The leg's origin is renamed to upstream, then both runs go through assert_one_refusal.
  • It asserts the note and the two lines exactly, through told_no_origin, and that the old sentence is not in stderr.
  • It reuses the file's private_remote, without_origin, runner and origin_back.
• On main's code (the two test files copied onto 6da757cb, git 2.43): 1 failed, 159 passed. The one failure is that row, which got main's REFUSED bump-leg-commit-not-on-remote: <tag> is not in the leg's own object store.
  • The 10 float rows pass on main, as they should, because main's rule is right. They are there to kill R2, below.
• No assert joins conditions with and or or.

Mutants

Each mutant was applied alone to a scratch clone holding this commit's files, then restored and compared with the worktree.

Mutant	Rows run	Result
R2: [0-9]+ to [0-9] in both exponent groups	the spelling file	killed: 10 failed, 115 passed (all 10 new rows)
R2 on main's rows	the 208 rows above	survives: 208 passed
R2a: the first group only	the spelling file	killed: 2 failed (.5.5e-10, both rows)
R2b: the second group only	the spelling file	killed: 4 failed (.5_e-10 and .5e10, both rows)
N1: the held-tag branch removed, so the old words answer	-k "no_origin or held" in the reachability file	killed: 1 failed, 3 passed

Runs

All runs go through lane 5's run9.sh: a stub gh first on PATH, a bogus token, every LANES_* variable cleared, EMAIL=service@opensoft.dev, GIT_SSH_COMMAND=false and GIT_CONFIG_GLOBAL=/dev/null.

• The two changed test files on the head:
  • git 2.43: 160 passed;
  • git 2.47.1 (a git 2.47.1 build first on PATH; git --version printed git version 2.47.1): 160 passed.
• git 2.43, every test file that runs bump-leg.py. The commit changes production code in scripts/bump-leg.py only. scripts/shape_materialize.py is unchanged: only its test rows were added, and those ran on both gits above. So the related-file runs take the test files that name bump-leg or bump_leg, and the files that name only shape_materialize are not needed.
  • The set is grep -rl -E 'bump-leg|bump_leg' tests --include='*.py': 56 files, sorted and split into two halves. It holds tests/test_bump_leg_reachability_words.py again, and tests/test_repo_hygiene.py and tests/test_agents_md_codes.py.
  • shard a, 28 files: 1038 passed, 1 skipped, 0 failed;
  • shard b, 28 files: 2324 passed, 1 skipped, 0 failed;
  • together 3362 passed, 2 skipped, 0 failed. Both skips are rows for another host: one needs a disk that ignores case (macOS, Windows), in tests/test_bump_leg.py, and one is Windows' own stdout default, in tests/test_stdout_encoding.py.
• git 2.43, the trio tests/test_repo_hygiene.py, tests/test_agents_md_codes.py and tests/test_cli_reference.py: 170 passed.

Fix round 1

Commit a4beec9e, on the merge of main 038dafba into the branch (ae830e2b, clean, tree 10c2372fe578). It answers rv1131's review (#1131 issuecomment-6321276436).

What changed

• NIT 1: the no-origin words for a held tag were untrue in two rarer cases. The branch keyed on object_kind(id) == "tag" alone, so every held tag peeled_target cannot peel was told the leg holds it "without the commit it names". Each case now reads the tag chain from the tags' own headers, git cat-file tag's type and object lines, one tag at a time while the leg holds the next (tag_chain_end, new). The peel (<id>^{}) says nothing where the leg lacks an object on the way.
  • (a) A tag through a tag the leg lacks, with the commit at the end held or not: still bump-leg-commit-not-on-remote, now in these words:
    • <tag> is an annotated tag the leg's own object store holds without a tag it leads through, <inner tag>, and the leg's mount, <leg>, has no remote named origin to fetch that tag from, so what that tag names, and whether a branch of <repository> reaches it, are not known
    • Remediation: check the tag -- the tags it leads through, and what they name, belong to the LEG, not to the assembly root -- and push them to the leg first if they are not pushed yet, and any commit they name to a branch of it; give <leg> back a remote named origin, ... (an em dash in the tool, as in the words beside it).
  • (b) A tag, or a tag of a tag, of a tree or a blob the leg lacks names no commit, so peeled_target now refuses it bump-leg-target-not-a-commit, in the words a tag of a held tree or blob already had: --to <tag> is an annotated tag of a tree in the leg (<repository>), not a commit. That is with or without an origin, since no fetch makes a tree a commit.
    • Measured first: for the same tag with its tree or blob held, main and 9d14c29a both refuse it bump-leg-target-not-a-commit in those words. The new refusal is byte for byte the same as main's for the same tag id held with its tree or blob, in all 6 (leg, id) pairs of (b) below.
    • With an origin, such a tag was refused bump-leg-commit-not-on-remote, " has no branch containing ", with "check the commit". That is the one with-origin answer this round changes.
  • The issue's own case is as it was: a tag held without its commit, and a tag of a tag with both tags held, keep the head's words, byte for byte.
  • Neither code is added or removed. Neither code, nor any changed sentence, appears in README.md, docs/, the handbook or AGENTS.md; tests/test_agents_md_codes.py and tests/test_cli_reference.py pass.
  • peeled_target and _unreachable_refusal keep their docstrings' accounts true: the adopt-project.py and shape_materialize.py: a tag whose target the clone lacks is called a tag that names no commit, a recorded tag id is asked only of a clone still in place, and a pinned product only PyYAML misreads is written bare #912 paragraph now says a tag held without THE COMMIT it names, and each function says what (a) and (b) are now told.
  • A cycle of tags made with refs/replace/ is never walked: git's own peel never leaves one (measured, git 2.43: rev-parse <tag>^{} was still running at a 10 s timeout), and the walk is reached only where the peel failed.
• NIT 2: mutant M5 survived. .5.5E-10 is added to YAML_FLOATS: only the first exponent group takes it, and only with its E. The list's comment says so.

Words compared with main's and the head's tool

The probe called peeled_target and _unreachable_refusal from main 038dafba, the head 9d14c29a and this head on 15 legs x 10 ids x 4 (has_origin, fetched), as rv1131's did, with legs for (a) and (b) added. Each id was asked as typed (raw) and, where peeled_target returned, as it returned (flow). That is 1578 answers from main and the head, and 1554 from this head, where 6 (leg, id) pairs are refused before the verdict.

Pair	The same	Differ
9d14c29a vs this head	1532 of 1578	46: (a) 16, (b) 30, and nothing else
main vs this head	1492 of 1578	86: those 46, the issue's case (12) and 28 raw asks

• (a): 4 legs, has_origin=False only. Each holds the outer tag without the inner one: a tag of a tag of a commit, with the commit or without it, and a tag of a tag of a tree, with the tree or without it.
• (b): 6 (leg, id) pairs, peeled_target and the four verdicts each: a tag of a tree and a tag of a blob, each alone and under a held tag of it, and those two tags of a tag, all held without the tree or blob.
• The 28 raw asks ask _unreachable_refusal directly about a held tag of a tree or blob, which the flow never does: peeled_target refuses it first, with the tree or blob held or not. They keep the head's words.
• Every other answer, every id with an origin but (b)'s, every missing id and every held commit keeps main's words.

Rows, failing on 9d14c29a and on main

In tests/test_bump_leg_reachability_words.py, in the file's style, through assert_one_refusal (both runs, exit 2, the same words, nothing written). They reuse private_remote, without_origin, runner, told_no_origin, refusal and origin_back. Two helpers, pushed_nowhere and written_into_the_leg, are split out of held_without_its_commit, which keeps what it did.

• test_a_tag_through_a_tag_the_leg_lacks_is_told_which_tag_it_lacks[commit-held, commit-missing]: (a). The leg holds only the outer tag; the commit is the leg's own pin, or one pushed nowhere. The note and the two lines are asserted exactly, and "without the commit it names" is not in stderr.
• test_a_tag_of_a_tree_or_a_blob_the_leg_lacks_is_refused_by_name[...]: (b), 6 rows. The kinds are a tag of a tree, a tag of a blob, and a tag of a tag of a tree with both tags held. Each runs with the leg's origin and without it. The tree and the blob are pushed nowhere, so no fetch brings them, and the row checks that afterwards. The two lines are asserted exactly, with the note where there is no origin.
• On 9d14c29a's bump-leg.py: 8 failed, 59 passed (git 2.43; the rows of tests/test_bump_leg_reachability_words.py and tests/test_bump_leg_dry_run_truth.py). The 8 are exactly the 8 new rows: the 2 of (a) and the 6 of (b). The old file was put back by sha256 afterwards.
• On main 038dafba's bump-leg.py: 9 failed, 58 passed (the same two files, git 2.43). The 9 are those 8 and the issue's row, test_a_tag_a_leg_with_no_origin_holds_alone_is_told_it_is_held. The old file was put back by sha256 afterwards.
• .5.5E-10 adds 2 rows, one to each test that takes YAML_FLOATS. They pass on main and on the head, as they should: the rule is right, and they are there to kill M5.
• No assert joins conditions with and or or. Added lines are at most 79 characters wide. The only non-ASCII character is the em dash in the tool's own words.

Mutants

Each was applied alone in the worktree, at this commit. Its rows were run, then the file was restored and checked against the commit by sha256. For bump-leg.py the rows are tests/test_bump_leg_reachability_words.py and tests/test_bump_leg_dry_run_truth.py; for shape_materialize.py, the spelling file.

Mutant	Result	Rows that failed
M5: shape_materialize.py, the first exponent group's [eE] cut to [e]	killed: 2 failed, 125 passed	.5.5E-10, in test_a_name_yaml_takes_for_no_text_is_double_quoted and test_the_rule_quotes_it_whatever_the_projects_reader_reads
NM1: names = names or tag_chain_end(submodule, target)[0] cut to names = names, so the header is never read where the peel says nothing	killed: 6 failed, 61 passed	the 6 rows of (b)
NM2: the walk's tag = named step replaced by a second return, so the chain is never followed past its first tag	killed: 2 failed, 65 passed	the 2 tag of a tag of a tree rows of (b)
NM3: (a)'s branch made dead, if names == "tag": to "tags"	killed: 2 failed, 65 passed	the 2 rows of (a)
NM4: a blob not refused, ("tree", "blob") to ("tree",)	killed: 4 failed, 63 passed	the 2 tag of a blob rows of (b), and tag of a blob for local-remote-dir and origin in test_a_tree_a_blob_or_a_tag_of_either_is_refused_by_name_in_both_runs
NM5: (a)'s note names the outer tag, {named} to {commit}	killed: 2 failed, 65 passed	the 2 rows of (a)
NM6: the held-tag words given with an origin too, not has_origin and cut	killed: 2 failed, 65 passed	test_a_tag_the_leg_holds_without_its_commit_is_not_on_the_remote, for local-remote-dir and origin
NM7: the header key read is tag, not type	killed: 8 failed, 59 passed	the 8 new rows

No mutant survived. After each, scripts/shape_materialize.py and scripts/bump-leg.py were restored from the commit and their sha256 checked: a37e3d83fbcda475... and d6822093b1aa4b0e... both matched, with the worktree clean.

Runs

All go through lane 5's run9.sh, as above, at a4beec9e.

• The two changed test files (tests/test_neutral_pin_entry_one_spelling.py and tests/test_bump_leg_reachability_words.py): 170 passed, which is the first commit's 160 and this round's 10 new rows.
  • git 2.43: 170 passed;
  • git 2.47.1 (a git 2.47.1 build first on PATH; git --version printed git version 2.47.1): 170 passed.
• git 2.43, the path guard and the trio: tests/test_path_guard_hygiene.py, tests/test_repo_hygiene.py, tests/test_agents_md_codes.py and tests/test_cli_reference.py: 219 passed.
• git 2.43, every test file that runs bump-leg.py, picked as above (grep -rl -E 'bump-leg|bump_leg' tests --include='*.py'): 57 files, which are the 56 files of the first commit's set and tests/test_path_guard_hygiene.py, which main gained since. Sorted and split in two:
  • shard a, 29 files: 1094 passed, 1 skipped, 0 failed;
  • shard b, 28 files: 2325 passed, 1 skipped, 0 failed;
  • together 3419 passed, 2 skipped, 0 failed. The two skips are the same two rows for another host as before: tests/test_bump_leg.py (a disk that ignores case) and tests/test_stdout_encoding.py (Windows' own stdout default).
• Every run in this section was on a4beec9e itself, committed, with the worktree clean (dirty=0 in each log's START line).

Merge-trees

Refreshed for fix round 1 (rv1131's body NIT). git merge-tree --write-tree of the head a4beec9e was run against origin/main, re-fetched (-c gc.auto=0 -c maintenance.auto=false), and against each open PR that touches these files:

Against	Head	Result
origin/main, re-fetched at 15:16Z on 2026-10-22	038dafba9dbe	clean, tree f571322318b1, the head's own tree: the head holds main by its merge
#1107 fix/1019-points-at-row (DRAFT)	ee48b5fe9693	clean, tree 7383abd73770
#1157 fix/1100-refspec-followups (DRAFT)	a35a97ea52f4	clean, tree de32065b7371

• tests: the bump-leg.py and family.py reachability rows tag a descendant of the commit --to names, so a tag above it reads as one that reaches it and a tag below it keeps the plain words, and --points-at for --contains no longer survives (#1019) #1107 touches tests/test_bump_leg_reachability_words.py. It gives made_in_the_leg an optional on= and adds rows after test_a_tag_of_a_tag_the_two_share_reaches_it.
  • The rows here call neither made_in_the_leg nor anything tests: the bump-leg.py and family.py reachability rows tag a descendant of the commit --to names, so a tag above it reads as one that reaches it and a tag below it keeps the plain words, and --points-at for --contains no longer survives (#1019) #1107 changes. The merged file parses, and no name in it is defined twice.
• shape_materialize.py and bump-leg.py: the fetch for a branch's answer leaves out a pattern like refs/heads* that puts a branch under another name, its clauses move into _left_out, and the docstrings name the clashes left and the way back (#1100) #1157 touches scripts/bump-leg.py, scripts/shape_materialize.py and two refspec test files, so it shares only scripts/bump-leg.py with this PR.
  • Its two hunks there are inside _leg_fetch_refspecs, at lines 1109 to 1146 of main's file. This PR's hunks in that file are at main's lines 976 to 1043 (tag_chain_end, new, and peeled_target) and 1250 to 1289 (_unreachable_refusal), so the two do not meet and the merge is clean.
• None of the other 34 of the 37 open PRs touches these three files.
• The branch is no longer behind main: the merge ae830e2b brought in every file main gained since 6da757cb (among them tests/test_path_guard_hygiene.py and shape-doctor.py: a bare is_file/is_dir/exists guard in a shipped tool fails by file and line unless its _is_a or a reasoned allowlist covers it, and a project.yaml linked into an unsearchable folder is yaml-unreadable (#430) #1111's tests/test_path_guard_hygiene.py). None of them is one of these three files, and the runs above stand on the head's own tree.

NIT round

rc1131 re-checked fix round 1 at a4beec9e and found it READY with four NITs (#1131, issuecomment-6347256815). The commit 55c30f20f005 mends the first three, in scripts/bump-leg.py and tests/test_bump_leg_reachability_words.py. NIT 4, the title, is not in a commit. Nothing the tool does changes: the production edit is a comprehension that gives the same dict and a longer docstring.

What changed

• NIT 1, SonarCloud python:S7494 at bump-leg.py:999. In tag_chain_end, dict(line.split(" ", 1) for line in lines if " " in line) is now {key: value for key, sep, value in (line.partition(" ") for line in lines) if sep}, the form rc1131 gave.
  • Same dict: tools/equiv2.py compares the two on every list of up to two lines of up to five characters, and every list of up to three lines of up to three characters, over a, b, a space and a tab (2478716 distinct lists: the script runs the two ranges one after the other, and the 7311 lists of up to two lines of up to three characters sit in both, so it makes 2486027 comparisons, as rc1131's count of the union shows), and on a real tag header with a continuation line, a line with no space and a type line with a trailing space: equal in all. The commit message says "every list of up to three lines"; the coverage is the one in this sentence (equiv.py's first pass, 3864591 lists, drew its three-line lists from a prefix of the strings).
  • The rule: SonarQube's local analysis of a standalone file holding both forms (project opensoft_openRepoShape, python, MAIN) reports one issue, python:S7494 MINOR, at the line of the old dict(...) form, and none at the comprehension.
  • SonarCloud's own analysis, read through the SonarQube API (rc1131's reading, issuecomment-6352247887, posted 2026-10-22T22:00:11Z; lane 5 read the same two answers again between 12:05Z and 12:08Z on 2026-10-23): for PR 1131 the API lists exactly one issue, python:S7494 at scripts/bump-leg.py:999 (MINOR, created 2026-10-22T13:31:04Z), and its status is CLOSED, so there are 0 open issues. The quality gate is OK on all five conditions (new reliability, security and maintainability ratings 1, new duplicated lines density 0.0, new security hotspots reviewed 100.0). The API gives no commit, so it does not say which analysis it read: it shows the issue closed, not that the analysis was of 55c30f20.
• NIT 2, the walk of two headers. TAGS_OF_NO_COMMIT has a fourth kind, tag of a tag of a tag of a tree: three tags, all held, and the tree pushed nowhere, run with and without an origin like the other kinds. Its values are now (what, depth), and the row makes depth - 1 tags over the first one (outer1-w1131, outer2-w1131) where it made the one outer-w1131 for the second kind; no other row reads the dict.
• NIT 3, tag_chain_end's docstring. It now says ("tag", <id>) is also what it returns "through a tag whose header misstates what it names (type tag over an <id> the leg holds as something else, which only a malformed tag has)".

Rows, failing on main

Both rows of the new kind (test_a_tag_of_a_tree_or_a_blob_the_leg_lacks_is_refused_by_name[tag of a tag of a tag of a tree-origin] and [...-no-origin]) fail on main's bump-leg.py (961640c6) and pass on the head's before this commit (a4beec9e's). The two test files that hold rows for peeled_target (tests/test_bump_leg_reachability_words.py and tests/test_bump_leg_dry_run_truth.py) run 69 rows:

bump-leg.py from	Result	Failing rows
main 961640c6	11 failed, 58 passed	the 9 rows of fix round 1, and the 2 new rows
a4beec9e (this PR before the commit)	69 passed	none: the new rows hold on the code as it was
55c30f20	69 passed	none

With main's file the new rows fail on the code of the refusal, as the other rows of the kind do: the row expects REFUSED bump-leg-target-not-a-commit, and the run with an origin prints bump-leg-commit-not-on-remote: testorg/Atlas-spec has no branch containing <the tag> (main's peeled_target returns the tag as typed where its peel cannot be read, because the leg lacks the tree, and the run goes on to the reachability verdict), and the run without one prints the git fetch origin ... has no remote named origin note and goes the same way.

Mutants

Each was applied alone to scripts/bump-leg.py, the 69 rows run on git 2.43.0, and the file restored from HEAD; all 11 restores matched (bl=1a7a69d38f737dce, dirty=0). The mutants are in tools/mutate.py.

Mutant	Result	Rows that failed
NX1 (rc1131's): the walk reads at most two headers, while True: as for _ in range(2):	killed: 2 failed, 67 passed	the 2 rows of the new kind: the walk stops at tag, and the refusal is bump-leg-commit-not-on-remote, not bump-leg-target-not-a-commit
NX0: the walk reads one header	killed: 4 failed	the 2 rows of the third kind and the 2 of the new one
NM2 (fix round 1's): tag = named replaced by a return	killed: 4 failed	the same 4 rows
NX2 (rc1131's): no check that the leg holds the next tag	killed: 2 failed	the 2 rows of test_a_tag_through_a_tag_the_leg_lacks_is_told_which_tag_it_lacks
C3: the comprehension's key: value as value: key	killed: 10 failed	the rows that read a tag's header
C6: the comprehension keeps the lines with no space (if not sep)	killed: 10 failed	the same 10 rows
NX3: the walk reads at most three headers	survives: 69 passed	none
C1: the if sep filter dropped	survives: 69 passed	none
C2: rpartition for partition	survives: 69 passed	none

• NX3 survives by construction. A walk bounded at three headers gives the code's answer on every chain of up to three tags, and the longest chain the rows hold is three. Any bound survives a chain of that length, so a row of four tags would only move the survivor to a bound of four. NX1 is the mutant the review named, and it is killed.
• C1 and C2 are equivalent for every header git writes. The type and object lines each carry exactly one space and each appears once, and nothing reads another key. C1 keeps a line with no space as a key with an empty value, which .get("type", "") and .get("object", "") already say of a missing key. C2 splits at the last space, which for a line with one space is the first. Where they could differ is a hand-forged header that repeats a bare type line after type tag; no row forges one.

Runs

Every run went through run9.sh with EMAIL=service@opensoft.dev, on 55c30f20 itself, committed, with the worktree clean (dirty=0 in each log's START line). Logs are in $Q/v124/n1131/, where $Q is the lane's scratchpad.

Run	git	Result
tests/test_bump_leg_reachability_words.py, tests/test_neutral_pin_entry_one_spelling.py, tests/test_bump_leg_dry_run_truth.py, tests/test_path_guard_hygiene.py, tests/test_agents_md_codes.py, tests/test_cli_reference.py, tests/test_pinned_copy_text.py (g243.log)	2.43.0 (/usr/bin/git)	402 passed
the first three of those files (g247.log)	2.47.1 (first on PATH; git --version printed git version 2.47.1)	196 passed

• The 57 files that run bump-leg.py, which fix round 1 ran in two shards (3419 passed), were not run again: the edit is inside tag_chain_end, and the rows that reach it are the two files above, which ran in full. CI's tests job on the pushed head is the full-suite run.
• tests/test_path_guard_hygiene.py passes: the commit adds no is_file, is_dir, exists, is_symlink or os.path guard.
• No added line is wider than 79 characters, none is non-ASCII, and no added assert joins conditions with and or or.

Merge-trees at 55c30f20

git merge-tree --write-tree of the head against origin/main, re-fetched (-c gc.auto=0 -c maintenance.auto=false), and against each open PR that touches one of this PR's three files. Of the 41 open PRs listed at 20:09Z (gh pr list --json number,headRefName,headRefOid,files), only #1157 and #1107, besides this one, touch them.

Against	Head	Result
origin/main, re-fetched before the push	961640c681b5	clean, tree 4d7968be5547: the head's tree and docs/release-notes/v1.2.0.md, the one file main gained since 038dafba (#1155)
#1157 fix/1100-refspec-followups (DRAFT)	368b87e9be87 (re-measured at 2026-10-23T12:06:38Z, after #1157's NIT round, which changes only tests/test_family_bump_fetch_refspecs.py; baa19972a271 gave the same clean merge with tree bd6ebc5cd3af, and a35a97ea52f4 when this round began)	clean, tree e036c02d6a12
#1107 fix/1019-points-at-row (DRAFT)	ee48b5fe9693	clean, tree a72145c05633

• This commit's hunks in scripts/bump-leg.py are at lines 979 to 1003, in tag_chain_end; shape_materialize.py and bump-leg.py: the fetch for a branch's answer leaves out a pattern like refs/heads* that puts a branch under another name, its clauses move into _left_out, and the docstrings name the clashes left and the way back (#1100) #1157's against main are in _leg_fetch_refspecs, from line 1105. They do not meet.
• The other 38 of the 41 touch none of the three files.

After the second re-check

rc1131 found this round READY at 55c30f20f (#1131, issuecomment-6352247887), with two NITs of its own, both in this body and neither in the code. This body now answers both: the count of lists in NIT 1's equivalence check (2478716 distinct lists, 2486027 comparisons), and SonarCloud's own analysis (python:S7494 CLOSED, 0 open issues, gate OK, no commit named by the API). The one other change is the #1157 row of the merge-trees table, which moved when #1157's NIT round added a commit. The head 55c30f20f is unchanged.

Closes #1103

Claim: #1103 (comment)

Lane: openreposhape-5 (openRepoShape-5)

🤖 Generated with Claude Code

Summary by Sourcery

Improve bump-leg validation and diagnostics for incomplete annotated tags while expanding coverage for YAML float spellings with multi-digit exponents.

Bug Fixes:

• Correct bump-leg diagnostics for tags held without their commits, tags that lead through missing tags, and tags of unavailable trees or blobs.
• Reject tags of trees or blobs by name instead of treating them as unreachable commits.

Enhancements:

• Clarify tag-chain handling and refusal messages for missing objects and malformed or nested annotated tags.

Tests:

• Expand reachability tests for missing commits, nested tag chains, and tags of trees or blobs.
• Add YAML spelling cases with multi-digit exponents to cover both float-matching patterns.

[sourcery-ai]

Reviewer's Guide

Implementation

Trace tag headers when peeling is unavailable so refusals distinguish missing commits, missing intermediate tags, and tags of trees or blobs, while simplifying the unreachable else branch.

• scripts/bump-leg.py L979-1009, L1043-1058, L1376-1402 (+3 small edits)

Tests

Add regression coverage for the corrected no-origin tag diagnostics, missing links and non-commit tag targets, and exercise the YAML exponent patterns with multi-digit exponents.

• tests/test_bump_leg_reachability_words.py L20-23, L45, L541-722
• tests/test_neutral_pin_entry_one_spelling.py L87-102

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[brettheap]

Independent review of #1131 (#1103) at 9d14c29a, for lane openRepoShape-5: READY

The PR does what #1103 asks. It changes no refusal code, no output moved that should not have, every number I re-ran matches, and every merge is clean against current main 4ed7c7bf. I found two NITs and one stale passage in the body. None blocks.

Findings

NIT 1: the new no-origin words are still untrue in two rarer cases the same branch catches. scripts/bump-leg.py:1292

• Why: the branch is chosen on object_kind(id) == "tag" alone. So every held tag object that peeled_target cannot peel gets "holds without the commit it names", not only a tag of a missing commit.
• I ran both cases end to end through bump-leg.py, both the dry run and the real run, exit 2, in a leg whose origin was renamed ($Q/v118/rv1131/e2e-head/):
  • Outer tag held, inner tag missing, commit held: the leg holds the outer tag and the commit, but not the tag in between. The head says the store holds the tag "without the commit it names". That is false: the commit is there, and what is missing is the inner tag.
  • A tag of a tree or a blob, held without the tree or blob (also a tag of a tag of a tree): the head says "without the commit it names" and "push that commit". That is false: the tag names a tree or a blob, not a commit.
• No regression: main said "is not in the leg's own object store" in both cases, which was also false. The issue's own case is now true.
• Possible fix: word it from the tag's own header (git cat-file tag <id> shows type, and you can walk on while each named object is held). Or use a sentence that is true in all four cases, such as "an object it names, through every tag, is not held there". It could also go on a checklist as a known limit.

NIT 2: a regex mutant of my own survives. It is the same kind of gap the issue's SHOULD closes. tests/test_neutral_pin_entry_one_spelling.py:97-100

• Mutant M5: change [eE] to [e] in YAML_NOT_TEXT_RE's first exponent group. All 125 rows of the spelling file pass.
• Why it survives: every row with a capital E is also taken by the second pattern. No row holds a capital-E exponent that only the first pattern takes, such as .5.5E-10 or .E+5.
• What it would ship: .5.5E-10 written bare.
• Impact is low: only a reader that follows YAML 1.1's pattern as written reads that as a float. PyYAML 6.0.3 already reads .5.5e-10 as text.
• Fix: add .5.5E-10 to YAML_FLOATS. I did not run that fix.

NIT (body, for the coordinator): main moved after the body was written.

• The merge-tree table names 823624d9. Against 4ed7c7bf the head is clean, tree 887b41404f77.
• "the nine files that main gained since" is now 12: adopt-project.py: check names what the clone's .git holds as git keeps refs, and asks a pin's file through the links the root keeps, so a link into .git or onto a pin's file is refused before any leg or adopted with the copy beside it (#904) #1091 adds adopt-project.py, tests/test_adopt_root_shape_paths.py and tests/test_adopt_root_symlinks.py.
• "the other 19 of the 20 open PRs" is now 21 of 22. It is still true that only tests: the bump-leg.py and family.py reachability rows tag a descendant of the commit --to names, so a tag above it reads as one that reaches it and a tag below it keeps the plain words, and --points-at for --contains no longer survives (#1019) #1107 touches these three files.

Checked and found true

Head and files

• The head is 9d14c29a, one commit on 6da757cb, three files.
• bump-leg.py's sha256 is 6a54d9f177ce2834..., as the writer's notes say.
• None of the three files, nor shape_materialize.py, differs between 6da757cb and 4ed7c7bf.

NIT 1 (brief item 1)

• Words compared with main's tool: I called peeled_target and _unreachable_refusal on main and on the head, over 9 legs x 9 ids x 4 combinations of (has_origin, fetched). 726 of 764 answers are byte for byte the same.
• Every one of the 38 differences has has_origin=False and an id that is a tag object the leg cannot peel. Every case with an origin, every missing id, and every held commit keeps main's words.
• fetched: the new branch gives the same words for fetched True and False. Through fetch_leg, has_origin=False only happens after a failed fetch, so fetched=True never reaches it.
• The code: it stays bump-leg-commit-not-on-remote.
• Cases that do not reach the branch:
  • A lightweight tag name (--to rv-lw) is refused earlier, bump-leg-target-not-a-commit ... is not a 40-hex commit, the same on main and the head.
  • A tag whose commit the leg holds is peeled and gets the unchanged bump-leg-commit-local-only words.
• The two true cases, end to end: a tag held without its commit, and a tag of a tag with both tags held but not the commit. Both get the new words, as the PR intends.
• Old sentence: git grep finds it only for the missing-id case (bump-leg.py:1306, the existing row at tests/test_bump_leg_reachability_words.py:439) and in the new row's docstring and negative assert. Nothing in README, docs/, the handbook, AGENTS.md or the templates pins it.

NIT 2 (brief item 2)

• All 72 peeled_target answers are the same on main and the head.
• The writer's line trace, re-run on main: names a {kind} is reached by the tree and the blob, the tag-of line by the tag of a tree and the tag of a blob, and the else by nothing.
• shape_materialize.not_a_commit is untouched.
• Cognitive complexity by S3776 (limit 15): peeled_target is 12, was 14 (rv1090 also counted 14). _unreachable_refusal is 10, was 8.

The SHOULD (brief item 3)

• Patterns: .5.5e-10 is taken only by the first pattern. .5e-10, .5E+10, .5_e-10 and .5e10 are all taken by the second; .5_e-10 and .5e10 only by the second.
• The --pin claim: PIN_ARG_RE refuses exactly .e+5, .5e+3 and .5E+10, the three names with a +. PLAIN_SCALAR_RE takes all 25 names, so the list's new comment is true.
• Mutants: each was applied alone, then restored and checked by sha256 (a37e3d83... and 6a54d9f1..., clean every time).

Mutant	Result	Rows that failed
R2 (both groups)	killed: 10 failed, 115 passed	all 5 new names
R2a (first group)	killed: 2 failed	.5.5e-10
R2b (second group)	killed: 4 failed	.5_e-10, .5e10
M2 (first group's sign - only)	killed: 2 failed	.e+5
M3 (second group's sign required)	killed: 6 failed	.5e3, .5E3, .5e10
M5 (first group lower-case e only)	survives: 125 passed	none (NIT 2)
M6 (second group lower-case e only)	killed: 2 failed	.5E3
R2 on main's own rows	survives: 208 passed, 132 deselected	matches the body
NB1 (new branch made dead)	killed: 1 failed, 58 passed	the new row
NB2 (new branch taken with an origin too)	killed: 2 failed	the held-tag rows with an origin
NB3 (peeled_target's condition flipped)	killed: 8 failed	the NOT_COMMITS rows
NB4 ("that commit" changed to "it")	killed: 1 failed	the new row

All runs went through run9.sh with EMAIL set.

Runs (brief item 4)

Run	git	Result
The two changed files at the head	2.43	160 passed
The two changed files at the head	2.47.1 (checked: the build is first on PATH inside the run)	160 passed
The two files on the predicted merge with main 4ed7c7bf (tree 887b4140)	2.43	160 passed
The two files on the predicted merge of main, the head and #1107 (tree 6c4791d1)	2.43	168 passed (#1107 adds 8 rows)
The trio at the head	2.43	170 passed
The writer's shard a, 28 files, re-run	2.43	1038 passed, 1 skipped (the case-insensitive-disk row, test_bump_leg.py:697)
The head's two test files on main's code	2.43	1 failed, 159 passed; the failure is the new row, with main's old words

Merges

• The writer's trees are reproduced: 50267208 with 823624d9, and 391a4c89 with tests: the bump-leg.py and family.py reachability rows tag a descendant of the commit --to names, so a tag above it reads as one that reaches it and a tag below it keeps the plain words, and --points-at for --contains no longer survives (#1019) #1107 ee48b5fe.
• Against current main 4ed7c7bf the head is clean, tree 887b4140.
• shape_materialize.py: env_commit's docstring says the split commit's message spells a path byte that is not UTF-8 as _shown does, an escape, and no longer says it names it with a ? in its place, which #900 replaced (#1018) #1104, shape_materialize.py and the pinned AGENTS-shape.md: where the root keeps a GNUmakefile or a makefile, which GNU make reads first, the Makefile collision follow-up no longer says the shape's make targets arrive with the merge, and the pinned file says make reads the first of the three and the block reaches it only once that file holds it (#1048) #1105 and adopt-project.py, shape_materialize.py and tests: a named bad link left out of the copy and pin findings takes no other path's finding with it, and the docstrings and the materializer's refusal name the #979 exception and what helps it (#1089) #1118 change shape_materialize.py. Each merges clean with the head, and none changes YAML_NOT_TEXT_RE, PLAIN_SCALAR_RE, PIN_ARG_RE or an exponent group.

Sonar-style checks

• No added assert joins conditions with and or or.
• Added lines are at most 79 characters wide. The only non-ASCII character is the em dash the tool's words beside it already use.
• SonarCloud on PR 1131: quality gate OK, new duplication 0.0%, no open issues.

Title and body (brief item 5)

• The title is 224 characters and true.
• closingIssuesReferences is [1103], and the only closing keyword is Closes #1103.
• The bump-leg test set has 56 files, the same list as the writer's two shards.
• Other body claims re-measured and true: the 10 new rows, the N1-style kill, the line numbers 538-543, :92, :979 and :1239 on main, and the head quoting all five long-exponent names.

Not verified

• Shard b (2324 passed, 1 skipped) and so the 3362 total: not re-run, because the host load was 50-70 and the 30-minute budget was spent.
• The writer's 391a4c89 tree itself: I ran the two files on the three-way merge with current main, not on that tree.
• The tests CI job: it was still IN_PROGRESS when I read the checks. tests-git-bash, package and SonarCloud were green.
• A refs/replace object that changes a peeled object's type: not probed.
• The .5.5E-10 fix proposed in NIT 2: not run.

Checklist candidates

• peeled_target and _unreachable_refusal: read a held tag's type header, so a tag of a tree or blob held without its target is refused bump-leg-target-not-a-commit by name, and a missing inner tag is named as such (NIT 1).
• YAML_FLOATS: add a capital-E exponent that only the first pattern takes (NIT 2, mutant M5).

Scratch left

• Worktrees: all five rv1131-* worktrees were removed with git worktree remove; --force only on head and main, for my untracked probe file.
• Refs: all five refs/l5rv/rv1131-* were deleted.
• Objects: three unreferenced commit objects for the predicted merges (a86903b2, 01850969, 1e9bfc3d) remain in the shared object store, with no refs.
• Notes, logs, fixtures and probe tools: /tmp/claude-1000/-workspace-projects-openRepoShape/50cede29-ab82-4ca3-9f67-d98e1a58c8d2/scratchpad/v118/rv1131/
• Basetemps (10 directories):
  • /tmp/claude-1000/-workspace-projects-openRepoShape/50cede29-ab82-4ca3-9f67-d98e1a58c8d2/scratchpad/v110/bt/rv1131-basefail
  • /tmp/claude-1000/-workspace-projects-openRepoShape/50cede29-ab82-4ca3-9f67-d98e1a58c8d2/scratchpad/v110/bt/rv1131-e2e
  • /tmp/claude-1000/-workspace-projects-openRepoShape/50cede29-ab82-4ca3-9f67-d98e1a58c8d2/scratchpad/v110/bt/rv1131-mut
  • /tmp/claude-1000/-workspace-projects-openRepoShape/50cede29-ab82-4ca3-9f67-d98e1a58c8d2/scratchpad/v110/bt/rv1131-own243
  • /tmp/claude-1000/-workspace-projects-openRepoShape/50cede29-ab82-4ca3-9f67-d98e1a58c8d2/scratchpad/v110/bt/rv1131-own247
  • /tmp/claude-1000/-workspace-projects-openRepoShape/50cede29-ab82-4ca3-9f67-d98e1a58c8d2/scratchpad/v110/bt/rv1131-pm
  • /tmp/claude-1000/-workspace-projects-openRepoShape/50cede29-ab82-4ca3-9f67-d98e1a58c8d2/scratchpad/v110/bt/rv1131-pm3
  • /tmp/claude-1000/-workspace-projects-openRepoShape/50cede29-ab82-4ca3-9f67-d98e1a58c8d2/scratchpad/v110/bt/rv1131-r2main
  • /tmp/claude-1000/-workspace-projects-openRepoShape/50cede29-ab82-4ca3-9f67-d98e1a58c8d2/scratchpad/v110/bt/rv1131-sharda
  • /tmp/claude-1000/-workspace-projects-openRepoShape/50cede29-ab82-4ca3-9f67-d98e1a58c8d2/scratchpad/v110/bt/rv1131-trio
• Running: nothing of mine. Every background run and monitor has ended.

Lane: openreposhape-5 (openRepoShape-5)

[brettheap]

Re-check of #1131 (#1103) for lane openRepoShape-5

READY at a4beec9e, fix round 1. It sits on ae830e2b, the merge of main 038dafba into the reviewed head 9d14c29a.

Both of rv1131's NITs are met, and I measured each:

• (a) and (b) now print true sentences, by name.
• The 8 new rows fail on 9d14c29a's bump-leg.py, and 9 rows fail on main's.
• The three body mutants I re-ran are all killed.
• My re-run of the three-way probe matches the body's counts exactly.

I found four NITs. None blocks. Two are worth a small commit: the new SonarCloud issue, and a mutant of mine that survives because no row holds a chain of three tags.

Findings

NIT 1: the round adds one open SonarCloud issue, python:S7494, at scripts/bump-leg.py:999.

• The line: header = dict(line.split(" ", 1) for line in lines if " " in line), in the new tag_chain_end. Sonar says "Replace dict constructor call with a dictionary comprehension." It is MINOR, created 2026-10-22T13:31:04Z, the fix commit's time.
• Measured:
  • The SonarQube API for PR 1131 lists exactly one OPEN issue, this one. The bot's comment (issuecomment-6342383079) says "1 New issue".
  • The quality gate is OK.
  • rv1131 found no open issues at 9d14c29a.
• Fix: header = {key: value for key, sep, value in (line.partition(" ") for line in lines) if sep}. I checked it gives the same dict as the current line on a header with a continuation line and a line with no space. I did not run the rows on it.

NIT 2: no row holds a chain of three tags, so a walk cut to two headers survives.

• Mutant NX1 (mine): while True: becomes for _ in range(2):, with return names, named after the loop, so tag_chain_end reads at most two headers.
  • I ran the rows of tests/test_bump_leg_reachability_words.py and tests/test_bump_leg_dry_run_truth.py on git 2.43: 67 passed, so the mutant survives.
  • The file was then restored, and its sha256 checked (d6822093b1aa4b0e..., dirty=0).
• NX1 is not equivalent. I built a leg that holds three tags of a tree, r3 -> r2 -> r1 -> tree, without the tree, and asked peeled_target, then _unreachable_refusal, in fetch_leg's order (probe2.py):
  • The head refuses --to <r3> with bump-leg-target-not-a-commit: --to <r3> is an annotated tag of a tree in the leg (opensoft/openGlass), not a commit.
  • NX1, with no origin, says <r3> is an annotated tag the leg's own object store holds without a tag it leads through, <r1>, .... That is false: the leg holds r1.
  • NX1, with an origin, says opensoft/openGlass has no branch containing <r3>.
• The code itself is right on chains of three tags, by the same probe:
  • With t3 and t2 held and t1 lacked, the head names t1, with the commit held or not.
  • With t3 and t1 held and t2 lacked, it names t2.
  • The tree chain above is refused by name.
  • Main and 9d14c29a gave the old words in all five cases.
• Fix: add a fourth kind to TAGS_OF_NO_COMMIT, "tag of a tag of a tag of a tree", with all three tags held and the tree pushed nowhere. Under NX1 it would get bump-leg-commit-not-on-remote instead of bump-leg-target-not-a-commit.

NIT 3: tag_chain_end returns ("tag", <id>) for an <id> the leg holds as something other than a tag. Its docstring does not say so. Only a malformed tag gets there.

• Reproduction: a tag object whose header says type tag but names a commit the leg holds, written with git hash-object -t tag -w --stdin. Git 2.43 accepts it, and git fsck says bad tag pointer.
• Measured ($Q/v123/rc1131/forged/):
  • The peel fails: object ... is a tag, not a commit, then missing object referenced by.
  • tag_chain_end returns ('tag', <commit>), and object_kind of that commit is commit.
  • The no-origin refusal then says the leg holds the tag "without a tag it leads through, ". The leg holds that commit.
• No regression: main says "is not in the leg's own object store", and 9d14c29a says "without the commit it names". Both are untrue here too.
• Optional fix: the docstring could add "or a tag whose header misstates what it names". Or (a)'s branch could require object_kind(submodule, named) is None.

NIT 4 (for the coordinator): the PR's title on GitHub is still the first commit's.

• gh pr view 1131 --json title at 17:29Z returns the 224-character title, which ends "... is told it is held, peeled_target loses the else nothing reaches, and rows hold shape_materialize.py's YAML_NOT_TEXT_RE exponents of two digits (shape_materialize.py and bump-leg.py: a row holds YAML_NOT_TEXT_RE's exponents of two or more digits, the no-origin refusal for a tag the leg holds is true, and an else nothing reaches is gone (#1090's review follow-ups) #1103)".
• It says nothing of (a). Nor does it mention (b)'s new refusal, which is the one answer with an origin that this round changes.
• The writer's title for this round, $Q/v121/f1131c/title.txt (228 characters), was not applied.

Checked and found true

$Q is /tmp/claude-1000/-workspace-projects-openRepoShape/50cede29-ab82-4ca3-9f67-d98e1a58c8d2/scratchpad. Every run went through run9.sh with EMAIL set.

Head and main

• origin fix/1103-exponent-row = refs/pull/1131/head = a4beec9ef3da (ls-remote at 17:23Z). origin/main is 038dafba (17:23Z).
• The tree of ae830e2b, 10c2372fe578, equals git merge-tree --write-tree 9d14c29a 038dafba. So the merge is clean and adds nothing of its own.
• The fix commit changes only the three files.

rv1131's NIT 1: (a) and (b), by name

• End to end, both runs (the new rows, through assert_one_refusal):
  • On 9d14c29a's file, both (a) rows got REFUSED bump-leg-commit-not-on-remote: <id> is an annotated tag the leg's own object store holds without the commit it names.
  • On main's file, (a) got ... is not in the leg's own object store.
  • On the same two files, the (b) rows with an origin got REFUSED bump-leg-commit-not-on-remote: testorg/Atlas-spec has no branch containing <tag>.
  • Every (b) row on either file still exited 2 in both runs. So no case that main applies is now refused: main refused these too, under the other code.
  • On the head, all 8 rows pass with the new words.
• The three-way probe, re-run. I used the writer's probe_drive3.py and probe_one.py, copied unchanged (sha256 checked against the writer's), on git 2.43.
  • It gave 1578 answers from main and from 9d14c29a, and 1554 from the head.
  • Head vs 9d14c29a: 1532 are the same and 46 differ.
    • (a) accounts for 16: 4 legs, has_origin=False only, raw and flow.
    • (b) accounts for 30: 6 (leg, id) pairs, each with peeled_target and 4 flow verdicts.
  • Main vs head: 1492 are the same and 86 differ.
    • 46 are those above.
    • The other 40 are the issue's case (12) and 28 raw asks.
    • All 40 have has_origin=False, and in all 40 the head gives 9d14c29a's answer.
  • My classified file is the writer's, line for line, but for the tag ids.
• (b)'s new refusal is byte for byte main's for the same id on the leg that holds everything (full), in all 6 pairs.
• A refs/replace/ cycle (tag A replaced by a tag of A): git rev-parse -q --verify A^{} was still running at 10 s on git 2.43 and on git 2.47.1. So the peel never fails on a cycle, and the walk, which runs only after a failed peel, never meets one. The body measured 2.43 only.
• No pinned text: git grep finds neither code, nor leads through, without the commit it names or is an annotated tag of a, in README.md, docs/, AGENTS.md or templates/.

Rows

• On 9d14c29a's bump-leg.py: 8 failed, 59 passed. The 8 are exactly the new rows.
• On main's bump-leg.py: 9 failed, 58 passed. The 9 are those 8 and test_a_tag_a_leg_with_no_origin_holds_alone_is_told_it_is_held.
• Both ran the rows of the two files above on git 2.43. Each old file was swapped in alone, then restored by sha256.
• .5.5E-10:
  • Only the first exponent group of YAML_NOT_TEXT_RE takes it (first True, second False).
  • PIN_ARG_RE refuses it and PLAIN_SCALAR_RE takes it, as the list's comment says.
• The added lines: 218 in all, at most 78 characters wide. The only non-ASCII character is U+2014, in the tool's own words. No added assert joins conditions with and or or.

Mutants. Each was applied alone in my scratch worktree. The file was then restored, and checked by sha256 (bump-leg.py d6822093b1aa4b0e..., shape_materialize.py a37e3d83fbcda475..., dirty=0 every time).

Mutant	Rows run	Result	Rows that failed
M5 (body): first exponent group [eE] to [e]	the spelling file	killed: 2 failed, 125 passed	.5.5E-10, in both tests that take YAML_FLOATS
NM2 (body): the walk's tag = named replaced by a return	the two files above	killed: 2 failed, 65 passed	the 2 tag of a tag of a tree rows of (b)
NM5 (body): (a) names the outer tag, {named} to {commit}	the two files above	killed: 2 failed, 65 passed	the 2 rows of (a)
NX2 (mine): the walk steps on without asking whether the leg holds the next tag	the two files above	killed: 2 failed, 65 passed	the 2 rows of (a)
NX1 (mine): the walk reads at most two headers	the two files above	survives: 67 passed	none (NIT 2)

The three body mutants killed the same rows, in the same counts, as the body says.

Gates at a4beec9e, committed and clean (dirty=0 in each START line):

Run	git	Result
tests/test_bump_leg_reachability_words.py, tests/test_neutral_pin_entry_one_spelling.py, tests/test_path_guard_hygiene.py	2.43	219 passed
the two changed test files	2.47.1 (first on PATH; no other git on run9's PATH)	170 passed

• CI on a4beec9e: tests (Linux, 1h7m53s), tests-git-bash, package and SonarCloud Code Analysis all succeeded.

Merges

• Against origin/main 038dafba: clean, tree f571322318b1, which is the head's own tree.
• Against tests: the bump-leg.py and family.py reachability rows tag a descendant of the commit --to names, so a tag above it reads as one that reaches it and a tag below it keeps the plain words, and --points-at for --contains no longer survives (#1019) #1107 ee48b5fe: clean, tree 7383abd73770.
• Against shape_materialize.py and bump-leg.py: the fetch for a branch's answer leaves out a pattern like refs/heads* that puts a branch under another name, its clauses move into _left_out, and the docstrings name the clashes left and the way back (#1100) #1157 a35a97ea: clean, tree de32065b7371.
• Open PRs: 37 were open at 17:31Z, and only tests: the bump-leg.py and family.py reachability rows tag a descendant of the commit --to names, so a tag above it reads as one that reaches it and a tag below it keeps the plain words, and --points-at for --contains no longer survives (#1019) #1107 and shape_materialize.py and bump-leg.py: the fetch for a branch's answer leaves out a pattern like refs/heads* that puts a branch under another name, its clauses move into _left_out, and the docstrings name the clashes left and the way back (#1100) #1157 (besides bump-leg.py: a tag a leg with no origin holds without its commit, or through a tag it lacks, is told so, a tag of a tree or a blob it lacks is refused by name, and rows hold YAML_NOT_TEXT_RE's exponents of two digits (#1103) #1131) touch these three files. validate-manifest.py and validate-family.py: PROJECT_ID_RE, DATE_RE and QUALIFIED_RE end in $, so an id:, a date or a repository: that ends in a line break passes as well formed (#1126 follow-up) #1139's new branch, fix/1139-anchored-patterns at 2593952c (no PR yet), touches none of them.

The body as posted (17:25:48Z)

• It is $Q/v121/f1131c/body.md, byte for byte, through the Lane line. After that come the attribution line and Sourcery's summary.
• body-guard exits 0 on the source. The only closing keyword is Closes #1103, and closingIssuesReferences is [1103].
• Claims I re-measured and found true:
  • the tree 10c2372fe578;
  • every probe count, and (b)'s byte equality;
  • the 8 and 9 failing rows;
  • the M5, NM2 and NM5 kills;
  • the 170 rows passing on both gits;
  • the three merge trees, and "the other 34 of the 37";
  • the hunk ranges: git diff -U0 puts them at main's lines 978-1040 and 1252-1286, inside the body's 976-1043 and 1250-1289.

Not verified

• The 57-file shards (the writer's 1094 and 2325 passed) were not re-run. CI's full Linux tests job passed at this head.
• Chains of three tags and the malformed tag were asked of peeled_target and _unreachable_refusal in fetch_leg's order, not through the command line.
• NM1, NM3, NM4, NM6 and NM7 were not re-run. Their numbers are the writer's.

Scratch left

• Worktree: /workspace/projects/openRepoShape-worktrees/rc1131-recheck, detached at a4beec9e, clean. Left in place.
• Objects: tree objects from my merge-trees are in the shared object store, with no refs.
• Notes, logs, probes, fixtures and tools: /tmp/claude-1000/-workspace-projects-openRepoShape/50cede29-ab82-4ca3-9f67-d98e1a58c8d2/scratchpad/v123/rc1131/
• Basetemps:
  • /tmp/claude-1000/-workspace-projects-openRepoShape/50cede29-ab82-4ca3-9f67-d98e1a58c8d2/scratchpad/v110/bt/rc1131-g243
  • /tmp/claude-1000/-workspace-projects-openRepoShape/50cede29-ab82-4ca3-9f67-d98e1a58c8d2/scratchpad/v110/bt/rc1131-g247
  • /tmp/claude-1000/-workspace-projects-openRepoShape/50cede29-ab82-4ca3-9f67-d98e1a58c8d2/scratchpad/v110/bt/rc1131-mut
• Running: nothing of mine.

Lane: openreposhape-5 (openRepoShape-5)

[brettheap]

Re-check of #1131 (#1103) NIT round for lane openRepoShape-5

READY at 55c30f20f (parent a4beec9e). The commit changes scripts/bump-leg.py and tests/test_bump_leg_reachability_words.py and nothing else. rc1131's NITs 1 to 3 (issuecomment-6347256815) are met. NIT 4, the title, is met too: the live title is the 228-character one the writer proposed. I found two NITs of my own. Neither blocks.

Findings

NIT 1: the body's "(2486027 lists)" counts comparisons, not lists.

• The body says tools/equiv2.py compares the old and new header dict "on every list of up to two lines of up to five characters, and every list of up to three lines of up to three characters ... (2486027 lists)". The script counts 7311 of those lists twice, because the lists of up to two lines of up to three characters sit in both passes.
• I counted the union: 2478716 distinct lists. 2478716 plus 7311 is 2486027.
• The claim "equal in all" is true (see "Checked and true"). Only the number is off.
• Ask: say "2478716 distinct lists", or "2486027 comparisons".

NIT 2: the body's "Not yet measured: SonarCloud's own analysis" can now be replaced.

• The SonarQube API for PR 1131 lists python:S7494 at scripts/bump-leg.py:999 (created 2026-10-22T13:31:04Z) as CLOSED. It lists 0 open issues, and the quality gate is OK.
• The API gives no commit, so I cannot say which analysis I read.

Checked and true

NIT 1 (the comprehension)

• git diff a4beec9e 55c30f20f -- scripts/bump-leg.py shows the dict constructor replaced by {key: value for key, sep, value in (line.partition(" ") for line in lines) if sep}, plus the docstring.
• My own probe (tools/equiv_rc.py, not the writer's) found the old and new header dicts equal on:
  • 3820909 distinct lists (up to 3 lines of up to 3 characters, over a, b, space, tab and an accented letter);
  • the writer's stated domain, 2478716 distinct lists;
  • 1000000 random lists with longer strings and the separators splitlines() cuts on.
• It also ran the real tag_chain_end of a4beec9e and of 55c30f20f on 26 real and forged tag objects in a scratch repo: 0 differ. They include a continuation line, a line with no space, a trailing-space type, duplicate keys, CRLF, upper-case ids, and tags of trees, blobs and missing objects at depth 1 to 3.

The commit message's overclaim

• The commit says the dict is the same "on every list of up to three lines made of two letters, a space and a tab". The body names that sentence and gives the real coverage.
• That coverage is right. equiv.py's three-line lists came from strings[:200], cut by islice at 2,000,000. 1864591 plus 2,000,000 is its 3864591.

NIT 3 (the docstring)

• A forged tag whose header says type tag over a commit or a tree the leg holds makes tag_chain_end return ("tag", <that id>), in both versions. That is what the new docstring says.
• Plain git hash-object -t tag -w (no --literally) accepts it. git fsck then reports bad tag pointer.

NIT 2 (the three-tag row)

• The new kind is tag of a tag of a tag of a tree, run with and without an origin. It makes outer2 -> outer1 -> named -> tree, all three tags held.
• The values are (what, depth), and git grep shows no other reader of TAGS_OF_NO_COMMIT.
• Each run put one bump-leg.py under the head's two test files, tests/test_bump_leg_reachability_words.py and tests/test_bump_leg_dry_run_truth.py (69 rows), on git 2.43.0. The file was restored and sha-checked each time.

bump-leg.py	Result	Failing rows
main 961640c68	11 failed, 58 passed	the 9 rows of fix round 1 and the 2 new rows
a4beec9e	69 passed	none
NX1 (while True: as for _ in range(2):, return names, named after the loop)	killed: 2 failed, 67 passed	the 2 rows of the new kind
NX0 (range(1))	killed: 4 failed, 65 passed	the 2 rows of tag of a tag of a tree and the 2 of the new kind
NX3 (range(3))	survives: 69 passed	none, as the body says

• On main the new rows fail on the refusal. With an origin the run prints REFUSED bump-leg-commit-not-on-remote: testorg/Atlas-spec has no branch containing <tag>. Without one it prints the git fetch origin ... has no remote named origin note. Neither contains REFUSED bump-leg-target-not-a-commit. This is as the body says.
• NX1 fails the same two rows with the same words.

Runs (run9.sh, EMAIL set, dirty=0 in each START line, committed head)

git	Files	Result
2.43.0	tests/test_bump_leg_reachability_words.py, tests/test_neutral_pin_entry_one_spelling.py, tests/test_bump_leg_dry_run_truth.py, tests/test_path_guard_hygiene.py	245 passed
2.47.1 (printed in the log)	the same four	245 passed

• The hygiene file has 49 rows. So the first three files give 196 on 2.47.1, which is the body's figure. I derived that by subtraction and did not run the three alone.

Added lines and merges

• The 26 added lines are at most 77 characters wide and all ASCII. No assert in the test file joins conditions with and or or.
• Merge-trees at 55c30f20f all exit 0:
  • main 961640c68: tree 4d7968be5547, which is the head's tree plus docs/release-notes/v1.2.0.md;
  • shape_materialize.py and bump-leg.py: the fetch for a branch's answer leaves out a pattern like refs/heads* that puts a branch under another name, its clauses move into _left_out, and the docstrings name the clashes left and the way back (#1100) #1157 baa19972a: bd6ebc5cd3af;
  • tests: the bump-leg.py and family.py reachability rows tag a descendant of the commit --to names, so a tag above it reads as one that reaches it and a tag below it keeps the plain words, and --points-at for --contains no longer survives (#1019) #1107 ee48b5fe9: a72145c05633.
• 44 PRs are open now, against the body's 41. Besides bump-leg.py: a tag a leg with no origin holds without its commit, or through a tag it lacks, is told so, a tag of a tree or a blob it lacks is refused by name, and rows hold YAML_NOT_TEXT_RE's exponents of two digits (#1103) #1131, only shape_materialize.py and bump-leg.py: the fetch for a branch's answer leaves out a pattern like refs/heads* that puts a branch under another name, its clauses move into _left_out, and the docstrings name the clashes left and the way back (#1100) #1157 (bump-leg.py) and tests: the bump-leg.py and family.py reachability rows tag a descendant of the commit --to names, so a tag above it reads as one that reaches it and a tag below it keeps the plain words, and --points-at for --contains no longer survives (#1019) #1107 (the reachability test) touch these files, as before.

Body and commit

• The live body equals the writer's body-post.md.
• body-guard exits 0 through the Lane line.
• closingIssuesReferences is [1103].
• The title is 228 characters and the commit subject 248, both ASCII.

Not measured

• Mutants C1, C2, C3, C6, NM2 and NX2. C3 was running when the LAST STEP stopped me, and C6 never started.
• The body's 402 passed (7 files) on git 2.43. I ran 4 of the 7.
• The 57-file shards.
• CI on the head.
• Which commit SonarCloud analysed.

Lane: openreposhape-5 (openRepoShape-5)

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sourcery-ai]

Sorry @brettheap, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 6 days and 6 hours by commenting @sourcery-ai review. Upgrade to get a review now.