[brettheap]

Lane: openreposhape-5 (openRepoShape-5)
Claim: #896 (comment)

Head 4541529 (fix round 1: part 1 48222b5e, then the merge 60df34fc of origin/main 450279ca (#944), then part 2), on the first head 80353dd1, on origin/main 50178305 (the v1.1.1 release commit). origin/main is now 450279ca: git merge-tree --write-tree of this head against it is clean, tree aabc059b. One file of templates/ changes: templates/assembly-root/scripts/bootstrap.py. One new test file.

Fix round 1, part 2 (rv896's SHOULD 1, one commit after the merge of main, 45415296). #944 (#932) landed as 450279ca, so _paste_word is on main. _say_twin's command is now git -C {_paste_word(path)} switch {_paste_word(branch)}: for a branch named with a byte that is not UTF-8 the old spelled(shlex.quote(...)) form printed switch 'a\udcffb', which /bin/sh reads as the eight characters it holds, so the pasted command named no branch. _say_twin's docstring and the docstring of test_the_way_out_is_quoted_for_a_shell_... now say _paste_word, where they said the line was printed as move_back_to_pin printed its own before #944. A non-UTF-8 twin test runs the printed switch through /bin/sh -c as printed, and five unit rows read each word back through /bin/sh.

Fix round 1, part 1 (rv896's NITs 1 to 4, one commit, 48222b5e). rv896 found this change READY (issuecomment-6252823490). Part 1 takes the four NITs that need nothing from #944: the make risk now says "the commits a branch spelled like main holds" (an unborn twin holds none); the missing-branch lines print the pin's sha, branch main does not exist (the pin is <sha12>); two _folded_twin rows, refs/notes/Main and refs/tags/xMain, kill the one surviving mutant; the module and _say_twin docstrings say what MAKING a branch hides. The switch line was left for part 2, below, which switches it to #944's _paste_word now that #944 has landed.

A pinned copy: every project's bootstrap.py takes an upstream-changed row, and re-pins it.

The rule

Where HEAD's ref and refs/heads/<branch> are equal under str.casefold() but differ in bytes, bootstrap leaves the leg. No ref moves and none is made. It says where the leg is, why it is left, and the way out.

• _folded_twin(current, branch) says whether HEAD's ref is such a twin. A detached HEAD (None) and a ref outside refs/heads/ are never twins. It compares the names after refs/heads/, so a name held as surrogate escapes (bootstrap.py: moving a leg off a branch overwrites an ignored file and ends a merge, P9 does not name the branch it leaves, a branch at its upstream's tip is left when HEAD is on a branch, a HEAD outside refs/heads/ is read two ways #704) raises nothing.
• _say_twin(label, path, branch, current, state, act) prints the three lines. Each of the three path functions asks the helper first, before any move, and grows by one if. They take the leg's path for the command, as move_back_to_pin does; checkout_tracking_branch passes it at its three call sites only (its (sub / ".git").exists() lines are untouched).
• The words hold on a disk that keeps case too, where Main and main are two branches. They never say the two are one ref: they say that a disk that folds case (macOS, Windows) reads them as one branch, and what that could do.

What each site prints now

Before (all three said the leg was on Main, which keeps its commits (a branch with no commit yet, for the unborn twin below), and moved or made main):

T7 (main behind the pin)   branch main fast-forwarded <old> -> <pin>, the pin; ...
                           the leg was on Main, which keeps its commits; it is on main now
P9 (main at the pin)       on main at <pin> (branch tip == pin)
                           the leg was on Main, which keeps its commits; it is on main now
missing branch             branch main created at <pin> - at the pin
                           the leg was on Main, which keeps its commits; it is on main now

Now (spaces and quoting as printed; the leg is spec):

T7:
  [spec] spec: branch main tip <old> is behind the PIN <pin>, and the checkout is on Main, which differs from main only in case
          a disk that folds case (macOS, Windows) reads Main and main as one branch, so moving main could move the ref HEAD stands on and leave the index at the old commit; the leg is left as it is
          run `git -C spec switch main`, which moves no branch, and then run bootstrap again.
P9:
  [spec] spec: branch main is at the pin <pin>, and the checkout is on Main, which differs from main only in case
          a disk that folds case (macOS, Windows) reads Main and main as one branch, so the leg is already on main there, and bootstrap would say it left a branch that keeps its commits; the leg is left as it is
          run `git -C spec switch main`, which moves no branch, and then run bootstrap again.
missing branch:
  [spec] spec: branch main does not exist (the pin is <pin>), and the checkout is on Main, which differs from main only in case
          a disk that folds case (macOS, Windows) reads Main and main as one branch, so making main could hide the commits a branch spelled like main holds behind the new ref; the leg is left as it is
          not moving the checkout off it. Keep any commit made there on a branch whose name differs from main by more than case, check out the pin in the leg, and run bootstrap again.

T7 and P9 give git -C <leg> switch <branch>, the path and the branch each one _paste_word (#932), as move_back_to_pin's path and upstream are: a name that prints as it is stays shlex.quoted, and one with a byte that is not UTF-8 is a printf that prints the bytes. On a disk that folds case it re-spells HEAD and moves no file, and the next run takes T7's on-branch merge --ff-only path or P9's no-op checkout. Where the two are branches, it puts the leg on the real main, and Main keeps its commits. Every other state prints what it printed: HEAD on refs/heads/main itself, on feature, on mains, detached, on a ref outside refs/heads/.

The emulation, before and after

CI is Linux only, so a disk that folds case is emulated, as the issue's own probe did: a symlink .git/refs/heads/Main -> main, which git's files backend reads through, and HEAD on refs/heads/Main. T7 is the issue's state: main loose and behind the pin, the pin's commit adding NEW-CONTRACT.md and editing README.md.

At 50178305:

before: HEAD -> refs/heads/Main | Main = main = 536671ad3925 | pin = f27b6a92a433 | status ''
bootstrap: branch main fast-forwarded 536671ad3925 -> f27b6a92a433, the pin; origin/main is 536671ad3925, which the pin deliberately does NOT follow
           the leg was on Main, which keeps its commits; it is on main now
after:  HEAD -> refs/heads/main | HEAD = main = f27b6a92a433 | status 'D  NEW-CONTRACT.md;M  README.md'

At this head (a second scaffold, so other shas):

before: HEAD -> refs/heads/Main | Main = main = bf6b7be3d5fa | pin = 19051708a6c9 | status ''
bootstrap: the three T7 lines above
after:  HEAD -> refs/heads/Main | Main = main = bf6b7be3d5fa | status ''

P9 on the base printed on main at <pin> and the the leg was on Main line; at this head it prints the three P9 lines, and HEAD, main and the status are as before. The way out, git -C spec switch main run as printed, puts HEAD on refs/heads/main, moves no branch, and the next run prints fast-forwarded (T7) or on main at <pin> (branch tip == pin) (P9), with git status --short empty.

The missing-branch probe (create_at_pin)

At 50178305, git 2.43.0 and 2.47.1, the same result. checkout -q --no-overwrite-ignore -b main <pin>, from HEAD on Main, main not there:

• A packed twin with commits (git pack-refs --all, so no loose Main, no main). Before: HEAD on Main, HEAD = Main = the twin's commit, main missing, status clean. The checkout exits 0 and writes the loose file main. On a disk that folds case that file is the file Main reads, so Main now names the pin, and the twin's commit is in no branch and no ref (git branch -a --contains, git for-each-ref --contains: nothing); only HEAD's reflog lists it. This is the harm. The emulation makes the link after the checkout: a link made before a packed Main is a DANGLING link, git reads Main as missing through it (it falls back to packed-refs only when lstat says ENOENT, and a folding disk would say that), HEAD reads as unborn, and the staged g.txt is left. That before-state is not a folding disk's, so the probe has no link before the checkout, and the committed packed test has none at all: a real Main with a commit, packed, is the state of a disk that keeps case, and the lines are the same on both.
• An unborn twin (HEAD on Main with no commit, the dangling link Main -> main, which a folding disk reads as one missing ref). The checkout moves HEAD to main at the pin and the index is consistent. Nothing is hidden: the twin holds no commit. It is harmless. It is refused all the same: one rule, one helper, and no state of HEAD to branch on; head is not None in the missing-branch path would exempt it, if the coordinator prefers that.

The words follow the packed probe: switch main is no way out of a leg with no main on a disk that keeps case, so the line says to keep the commits on a branch whose name differs from main by more than case, check out the pin (whose sha the first line prints), and run bootstrap again. The risk says "the commits a branch spelled like main holds", which is true of a packed twin, of an unborn twin (it holds none, so nothing is hidden) and of a third spelling beside either (rv896's probe: an unborn Main beside a packed MAIN hides that commit the same way). The committed packed test runs the way out: git branch kept-from-Main, git checkout --detach <the printed sha>, bootstrap prints branch main created at <pin> - at the pin, kept-from-Main and Main both hold the commit.

Tests

tests/test_bootstrap_casefold_twin.py, 32 tests. The leg set-up is test_bootstrap_after_bump.py's fixtures, bumped and fast_forwarded, and test_bootstrap_leg_moves.py's typed and main_of; the helper bootstrap_module is test_bootstrap_branch_bytes.py's. Every test uses the module's own local bare remotes. Each symlink is os.symlink, and the test skips on Windows, and where it raises OSError (a disk that folds case refuses the link: Main is main), with the reason. A test that makes a real Main skips on a disk that folds case. Every assert on the output compares step (a)'s spec-leg lines exactly.

1. T7 under the emulation: main unchanged, HEAD still refs/heads/Main, git status --short empty, the three lines exact.
2. The way out runs as printed, then bootstrap again: fast-forwarded, HEAD refs/heads/main at the pin, status empty.
3. P9 under the emulation, the lines exact, and its way out.
4. The missing branch: an unborn twin under the emulation, and a packed twin with a commit, with the way out run.
5. A disk that keeps case: a real loose Main with a commit of its own and HEAD on it, T7's state. The same lines. The way out puts the leg on the real main, bootstrap fast-forwards it, Main keeps its commit.
6. Unchanged byte for byte: HEAD on main itself, on feature and on mains (3 tests).
7. _folded_twin's table (15 rows): Main, MAIN, the twin the other way, the branch itself, Main against Main, detached, refs/remotes/origin/main, another branch, a longer name, refs/Heads/main, refs/notes/Main and refs/tags/xMain (each 11 characters before Main, as refs/heads/ is), a final sigma against a sigma (casefold folds it, lower() does not), and a name that is not UTF-8, itself and as a twin. Plus three tests of _say_twin itself: the command is shell-quoted as before for an ordinary pair, a name that is not UTF-8 or holds an ESC is spelled (output is ASCII, no raise), and (part 2) five rows read the two words of the command back through /bin/sh and compare them with the bytes of the names: an ordinary pair, a path with the byte, a branch with the byte, both with a leading dash, and a path with a percent.
8. (Part 2) A tracking branch a<0xff>b and HEAD on its twin A<0xff>b (T7, --branch, POSIX, on a disk that takes the byte; skipped on Windows, and on macOS, whose disk refuses the byte): the lines name both spelled, the printed command is git -C spec switch "$(printf -- 'a\377b')", run through /bin/sh -c as printed it puts HEAD on refs/heads/a<0xff>b byte for byte, and the next run fast-forwards the branch.

On the base (50178305, the first 26 tests copied in): 23 failed, 3 passed. The three that pass are case 6, by design. Part 2's new test cannot run on the base (it imports test_bootstrap_pasteable_lines.py, which #944 added); on the merged tree before the part 2 change it failed, at the command: - git -C spec switch "$(printf -- 'a\377b')" expected, + git -C spec switch 'a\udcffb' printed. At this head: 32 passed, on git 2.43.0 and 2.47.1.

Mutants (each in a scratch tree, this test file; none survives)

mutant	result
compare byte for byte again (_folded_twin never true)	11 failed
the check dropped from T7 / from P9 / from create_at_pin	3 / 1 / 2 failed
casefold() -> lower()	1 failed (the sigma row). Equivalent for ASCII; the sigma row tells them apart, so no ss pair was needed
the None guard dropped (None.startswith)	make bootstrap's first run raises in the fixture: 9 errors and 1 failed
a twin with current None (returns true for it)	the same 9 errors and 1 failed
switch -> checkout in the printed way out	4 failed (the exact-lines tests). Case 2, which only runs the printed command, still passes: git checkout main does the same here
the refs/heads/ guard dropped (whole refs compared)	1 failed (refs/Heads/main)
held != branch dropped (the branch itself a twin)	7 failed
the path / the branch not shell-quoted	1 failed each
the twin / the branch not spelled	1 failed each
the missing-branch path printing the switch command	3 failed
the missing-branch way out saying a branch for a branch whose name differs ... by more than case	3 failed
R2 (round 1): the refs/heads/ guard dropped, the 11-character slice kept	24 passed on the first 24 tests: it survived. 2 failed on the 26 (refs/notes/Main, refs/tags/xMain): killed.
round 1's re-runs on the 26: the check dropped from create_at_pin; casefold() -> lower()	2 failed; 1 failed
part 2: _paste_word dropped from the path / from the branch / the old spelled(shlex.quote(...)) form restored	3 / 3 / 5 failed of the 32 (the byte-path rows; the end-to-end test and the byte-branch rows; all of them but the ordinary pair). None survives

Runs

The host's load was 85 to 270, so the coordinator scoped them (one pytest process at a time, 15:53Z and 16:15Z).

• git 2.43.0, tests/test_bootstrap_casefold_twin.py and every tests/test_bootstrap*.py (11 files, the issue's test_bootstrap_after_bump.py, test_bootstrap_leg_moves.py and test_bootstrap_non_utf8_branch.py among them), test_family_add_spelling_leftovers.py, test_pinned_copy_text.py and the trio (test_repo_hygiene.py, test_agents_md_codes.py, test_cli_reference.py): 751 passed, 3 skipped (the three skip test_bootstrap_ref_store.py:102: 2.43 makes no reftable repository) in 14:47. Then test_bom_reads.py and test_validator_child_encoding.py: 188 passed.
• git 2.47.1, the new file, test_bootstrap_leg_moves.py, test_bootstrap_after_bump.py and the trio: 248 passed in 3:40.
• Round 1, part 2, at the merged tree (the load was about 50, two processes at a time): git 2.43.0, the new file, test_bootstrap_pasteable_lines.py, test_bootstrap_non_utf8_branch.py, test_bootstrap_leg_moves.py, test_bootstrap_after_bump.py and the trio: 329 passed in 7:04. git 2.47.1, the new file and test_bootstrap_pasteable_lines.py: 72 passed in 2:09. Both ran before the five unit rows were added (a change to the test file alone); the new file was then run again on both: 32 passed each.
• Round 1, at the part 1 tree (the load was about 40, two processes at a time): git 2.43.0, the new file, test_bootstrap_leg_moves.py, test_bootstrap_after_bump.py and the trio: 250 passed in 3:44. git 2.47.1, the new file: 26 passed in 20 s.
• The predicted merge with origin/main 64464d31 (a commit of tree d7d8ca11, never pushed): the new file, the trio and test_release_workflow.py: 231 passed (git 2.43.0).
• A first run of 115 files in 3 shards (git 2.43.0) was stopped at 35%, 28% and 45% when the load reached 270: about 3,100 tests, none failed. It is not counted.

Left to CI's tests job, which runs the whole suite on the head: every file not named above. Of the files git grep -l -E 'assembly-root/scripts/bootstrap|make bootstrap|bootstrap\.py' -- tests names, these 66 were not run: test_adopt_attributes_eol_block.py, test_adopt_clone_template.py, test_adopt_e2e.py, test_adopt_ignored_shape_files.py, test_adopt_mount_ignored.py, test_adopt_nested_attributes.py, test_adopt_pins.py, test_adopt_plan_yaml_quoting.py, test_adopt_reencoded_files.py, test_adopt_relative_submodule_url.py, test_adopt_root_manifest.py, test_adopt_root_symlinks.py, test_adopt_shape_pin_and_work_dir.py, test_adopt_submodules.py, test_adopt_verify.py, test_bump_leg.py, test_bump_leg_dry_run_truth.py, test_bump_leg_rollback.py, test_bump_leg_unreadable.py, test_doctor_legs_members_next.py, test_doctor_machine_row.py, test_doctor_next_is_a_command.py, test_doctor_paste_through_git.py, test_doctor_pin_restore_merges.py, test_family.py, test_family_bootstrap_gate_order.py, test_family_bump_remove_rollback.py, test_family_gitmodules_values.py, test_family_head_lost_gitmodules.py, test_family_holder_bootstrap_texts.py, test_family_makefile_siblings.py, test_family_members_not_a_list.py, test_family_siblings_placement.py, test_leg_path_yaml_scalars.py, test_legs_readers_not_a_list.py, test_load_yaml_refusals.py, test_naming_policy.py, test_non_utf8_name_helpers.py, test_park_resume_targets.py, test_push_branch_refspec.py, test_scaffold_e2e.py, test_scaffold_ignored_shape_files.py, test_scaffold_leg_path_collisions.py, test_scaffold_manifest_values.py, test_scaffold_mount_ignored.py, test_setup_by_hand_commands.py, test_setup_project_py.py, test_setup_sh.py, test_shape_doctor.py, test_siblings_family_name.py, test_siblings_inputs.py, test_template_text_placeholders.py, test_update_shape.py, test_update_shape_add.py, test_update_shape_apply_lines_and_headers.py, test_update_shape_kept_helper.py, test_update_shape_landing.py, test_update_shape_merged_away.py, test_update_shape_pr_base.py, test_validate_family_branch_step.py, test_validate_family_member_path_glob.py, test_validate_family_remedies_typed.py, test_validate_family_typed_states.py, test_validate_pins_lockstep_lines.py, test_validate_workflow_gitmodules_urls.py, test_windows_paths.py. On git 2.47.1 the 2.43 list's other files were not run either.

Merge checks

• origin/main 450279ca (bootstrap.py: the merge --ff-only, --continue and --abort lines it prints word a leg's path and an upstream as a shell reads them back, so a byte that is not UTF-8 is a printf and no longer escape text that names no ref (#932) #944 landed): this head merges clean, tree aabc059b. The merge commit 60df34fc itself is a clean merge, tree 664513ff, as predicted.
• Slice D's head 0ef875c0 (the assembly root's validate-manifest.py and bootstrap.py: a path this user cannot read is named, never read as absent, so a scripts/ nobody may search no longer SKIPs every validator into bootstrap ok (#430, slice D) #958): clean, tree af0a54b7.
• The other lanes' open branches, fix/415-legs-members-next-tests, fix/430-a-bump-leg-unsearchable, fix/879-holder-remedies-compose, fix/880-check-plan-name-docstring, fix/884-ignored-depth, fix/885-one-line-install-release-notes, fix/897-kept-copy-reraise and fix/898-bump-leg-reachability: none touches bootstrap.py or this test file, and each merges clean with this head. l3-677-pins-hand-step-wip and l3-678-naming-checkout-wip conflict, in shape-doctor.py, validate-pins.py and tests this change does not touch, and conflict the same way with origin/main itself.
• Slice D's earlier local head, df1bb186, conflicted with the first head (both added a block after _on_a_branch); it was moved at 0ef875c0, which merges clean.

Docs and complexity

• Docs. bootstrap.py's module docstring (step (a)) and the docstrings of the three path functions and _move_and_check_out say the rule. I grepped AGENTS.md, README.md, docs/, the assembly root's AGENTS-shape.md and README, and the family root's, for a sentence about step (a)'s paths. None is false: each says a leg is placed only where that loses no commit, and otherwise ... left where it is, saying why, or or says why not, and a twin leg is left, saying why. Nothing else was edited.
• Cognitive complexity (S3776, 15 allowed), counted by hand and with an AST counter that follows Sonar's rules (each if, elif, else, for, except and ternary, plus nesting; one per run of one boolean operator): place_at_pin 5 -> 6, fast_forward_to_pin 14 -> 15, at the limit, create_at_pin 12 -> 13, _folded_twin 3, _say_twin 1, checkout_tracking_branch 13 (unchanged). If Sonar counts one more in fast_forward_to_pin, the cheapest cure is a helper for its note (two points). Round 1 changes only words, so none changes. The commit message of 80353dd says 14, 6 and 12; that was my hand count before the counter found the why or [] argument in fast_forward_to_pin and create_at_pin. The numbers here are right, and the second commit's message says so; the squash message should not repeat the first commit's sentence.
• Width. Every new line is within 79 columns in both files. No duplicated block; no assert joins conditions with and.

Decisions and limits

• One rule for all three paths, the unborn twin included (see the probe). rv896 ruled to keep refusing it and not to add head is not None: an unborn twin can stand beside a packed third spelling whose commit checkout -b hides, and the refusal costs one step (git -C spec checkout --detach <pin>, then bootstrap).
• casefold() can over-match a real disk: ss and the sharp s fold under it, which a disk's own simple folding may not do. The leg is then left, with true words, where the disk would not need it.
• The rule is by name, so a reftable leg is left too, where Main and main are two refs on any disk. The way out is true there as well.
• NFC and NFD twins are out of scope (below).

Checklist candidates (nothing filed)

1. An NFC/NFD twin does the same harm, and is not caught. APFS also reads a name's NFC and NFD forms as one file. Emulated as the issue's probe was (a symlink from the NFD name to the NFC branch caf + U+00E9, HEAD on the NFD name, --branch the NFC name, git 2.43.0), at 50178305 AND at this head: branch caf<e9> fast-forwarded <old> -> <pin>, the leg was on cafe<U+0301>, which keeps its commits; it is on caf<e9> now, status D NEW-CONTRACT.md and M README.md. casefold() does not normalize; unicodedata.normalize("NFC", ...) in _folded_twin before the compare is the one-line cure, with a test.
2. bump-leg.py and family.py compare the root's or the holder's branch with tracking_branch byte for byte (branch == project.tracking, branch != family.tracking()): on a disk that folds case a root on Main is on main, and the pull-request-only refusal (bump-leg-on-tracking-branch, family-on-tracking-branch) is not given. Reasoned from the code; not probed.
3. A HEAD on a ref whose directory is spelled otherwise (git symbolic-ref HEAD refs/Heads/main) is a twin on a disk that folds case, and is not one here: the rule leaves refs outside refs/heads/ alone, as the brief says. Reasoned; very rare.
4. From rv896, for later: a follow-up for create_at_pin: the same lost-commit harm happens from a HEAD detached at the pin over a packed Main and no main, which the rule does not see (it asks only about HEAD's ref); before checkout -b, ask git for-each-ref refs/heads/ for any name that casefolds to the branch, packed or loose.

Closes #896

🤖 Generated with Claude Code

[brettheap]

(lane openRepoShape-5, 2026-10-18T16:50Z) @codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-18T16:52:24.282410Z	80353dd	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[sourcery-ai]

Reviewer's Guide

Bootstrap now detects when HEAD is on a branch whose name differs from the tracking branch only by case and leaves the leg untouched across all ref-moving or ref-creating paths, with explicit recovery guidance; a focused test suite validates filesystem emulation, packed and unborn refs, output safety, Unicode and quoting edge cases, and unchanged behavior elsewhere.

Sequence diagram for protecting a casefold twin during bootstrap

sequenceDiagram
    participant Bootstrap
    participant Leg
    participant Git
    participant User
    Bootstrap->>Leg: _head_of(sub)
    Bootstrap->>Bootstrap: _folded_twin(current, branch)
    alt HEAD is on casefold twin Main and target is main
        Bootstrap->>Bootstrap: _say_twin(label, path, branch, current, state, act)
        Bootstrap-->>User: Leave refs, index, and worktree unchanged
        Bootstrap-->>User: Print risk and recovery guidance
        User->>Git: git -C leg switch main
        Git-->>User: Re-spell HEAD without moving a branch
        User->>Bootstrap: Run bootstrap again
    else No casefold twin
        Bootstrap->>Git: Existing move, checkout, or branch creation
    end

Loading

Flow diagram for casefold twin protection in bootstrap

flowchart TD
    A["checkout_tracking_branch"] --> B{"Tracking branch state"}
    B -->|behind pin| C["fast_forward_to_pin"]
    B -->|at pin| D["place_at_pin"]
    B -->|missing| E["create_at_pin"]
    C --> F{"_folded_twin(current, branch)"}
    D --> F
    E --> F
    F -->|yes| G["_say_twin: leave leg unchanged"]
    F -->|no| H["Existing bootstrap path"]
    G --> I["Print risk and recovery guidance"]

Loading

File-Level Changes

Change	Details	Files
Adds case-insensitive branch-twin detection and prevents bootstrap from moving or creating a tracking ref that could be the ref currently held by HEAD.	Introduces _folded_twin for refs/heads/ names using casefold(), while excluding detached, non-head, identical, and surrogate-containing edge cases appropriately. Checks for twins in the behind-pin, at-pin, and missing-branch paths before any ref or checkout operation. Adds centralized _say_twin messaging that explains the filesystem risk, preserves exact branch/path spelling, shell-quotes the recovery command, and provides a distinct recovery path when the tracking branch is absent. Passes the leg path through checkout handling so recovery commands identify the correct leg. Updates module and function documentation to describe the case-folding safety rule.	templates/assembly-root/scripts/bootstrap.py
Adds comprehensive regression coverage for case-folding branch twins and preserves prior bootstrap behavior for unrelated HEAD states.	Tests T7, P9, and missing-branch behavior under symlink-based case-folding emulation, including unborn and packed twins. Verifies no refs, HEAD, index, work tree, or pin are changed before the recommended recovery action, and validates the subsequent bootstrap run. Covers real case-preserving filesystems, exact output text, shell quoting, escaped non-UTF-8/control-character names, Unicode casefold() behavior, and helper edge cases. Confirms ordinary main, unrelated branches, detached HEADs, remote refs, and longer names retain previous behavior.	tests/test_bootstrap_casefold_twin.py

Assessment against linked issues

Issue	Objective	Addressed	Explanation
#896	Prevent bootstrap from moving the ref HEAD stands on when its branch name differs from the tracking branch only in case, including when the tracking branch is behind the pin.	✅
#896	Leave the leg unchanged in that case and explain the risk and recovery command, git -C <leg> switch <branch>.	✅
#896	Test the case-folded-ref scenario on Linux using the symlink emulation described in the issue.	✅

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Another round soon, please!

Reviewed commit: 80353dd1b3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[brettheap]

Independent review of #948 (#896) at 80353dd1, for lane openRepoShape-5: READY

No finding is a MUST. On both the symlink emulation and a disk that keeps case, a full snapshot shows nothing moves. The lines are exactly the PR's. The printed way out, run through /bin/sh and followed by bootstrap again, ends on main at the pin with git status --short empty. Every state that is not a twin prints byte for byte what 50178305 prints. There are two SHOULDs: one is a landing condition with #944, the other a follow-up.

Findings

SHOULD 1 (landing). The switch line uses the old quoting.

• Where: templates/assembly-root/scripts/bootstrap.py:782-783, which builds the line with spelled(shlex.quote(...)).
• Scenario: a branch that is not UTF-8. Measured on head: _say_twin prints run `git -C spec switch 'a\udcffb'`. /bin/sh reads that word as the literal characters a\udcffb, so the pasted command names no branch. This is the assembly root's bootstrap.py: the git -C <leg> merge --ff-only '<upstream>' line names an upstream that is not UTF-8 by its \udcXX escape, so it does not paste #932's defect.
• Merge with bootstrap.py: the merge --ff-only, --continue and --abort lines it prints word a leg's path and an upstream as a shell reads them back, so a byte that is not UTF-8 is a printf and no longer escape text that names no ref (#932) #944: 80353dd1 with ec2017cf is clean (exit 0, tree e2b6802d), and it keeps the old form at :795-796.
• Text that turns false once bootstrap.py: the merge --ff-only, --continue and --abort lines it prints word a leg's path and an upstream as a shell reads them back, so a byte that is not UTF-8 is a printf and no longer escape text that names no ref (#932) #944 lands: move_back_to_pin then uses _paste_word. That makes two descriptions untrue:
  • _say_twin's docstring ("printed as move_back_to_pin prints its command", :760-761);
  • the docstring of test_the_way_out_is_quoted_for_a_shell_as_the_move_back_line_is (tests/test_bootstrap_casefold_twin.py:403-404).
• Landing order: either order costs the second PR one round. Land bootstrap.py: the merge --ff-only, --continue and --abort lines it prints word a leg's path and an upstream as a shell reads them back, so a byte that is not UTF-8 is a printf and no longer escape text that names no ref (#932) #944 first. Its review stays READY, and the change can ride in bootstrap.py: a leg whose HEAD is on a branch that differs from the tracking branch only in case (Main for main) is left where it is, so on a disk that folds case branch -f main no longer moves the ref HEAD stands on (#896) #948's next round with the NITs below:
  • _paste_word(path) and _paste_word(branch);
  • the two docstrings fixed;
  • one non-UTF-8 twin row that runs the printed switch through /bin/sh.

SHOULD 2 (follow-up). The same lost-commit harm happens from a detached HEAD, which the rule does not see. _folded_twin asks only about HEAD's ref. I measured on git 2.43 with scratchpad/v118/rv896/probe-packed.sh:

• (a) w896's probe, reproduced: HEAD on a packed Main that holds commit M, and no main. checkout -q --no-overwrite-ignore -b main <pin> exits 0 and writes a loose main. With the fold emulated afterwards, refs/heads/Main reads as the pin, for-each-ref --contains M and branch -a --contains M list nothing, and only HEAD's reflog keeps M. So checkout -b main <pin> does hide the twin's commits.
• (b) HEAD detached at the pin, the same packed Main, no main: identical result. create_at_pin reaches checkout -b from this state (head == pin, current is None) with no twin check.
• (c) An "unborn" Main beside a packed MAIN (a third spelling): the commit is hidden the same way (probe-packed-c.sh).
• Scope: this is outside bootstrap.py: on a disk that folds case, a leg on Main whose tracking branch main is behind the pin is moved under its own HEAD, and bootstrap says it is on main now over an index that undoes the pin #896's Goal, which is about branch -f under HEAD, so it is a follow-up and not a blocker.
• Direction: before checkout -b, ask git for-each-ref refs/heads/ for any name that casefolds to <branch>, packed or loose.

NIT 1 (check 3, ruling on the unborn twin): keep refusing it, and do not add head is not None.

• Case (c) shows an unborn twin can stand beside a packed third spelling whose commit checkout -b hides. The exemption would drop that protection.
• The refusal costs one step. Measured: git -C spec checkout --detach <pin>, then bootstrap, prints branch main created at <pin> — at the pin, with status empty.
• Wording: the make risk ("could hide the commits Main holds", TWIN_RISKS, :734-746) assumes commits an unborn Main does not have. It could read "the commits a branch spelled like main holds".
• The keep line (_say_keep(kept=...)) is true on both kinds of disk. I ran it on a packed and on a loose real Main: kept-from-Main and Main both still hold the commit afterwards.

NIT 2. The make lines say "check out the pin" but never print the pin's sha.

• Where: bootstrap.py:1134-1137; the state is only branch main does not exist.
• The detached refusal in create_at_pin names the pin; the "which is not a branch" refusal does not either.
• Suggest branch main does not exist (the pin is <sha>).

NIT 3. One mutant survives all 100 tests in the three files.

• R2: drop the refs/heads/ guard but keep the 11-character slice.
• _folded_twin("refs/notes/Main", "main") and ("refs/tags/xMain", "main") then answer True, so the leg gets the twin lines instead of which is neither.
• Cosmetic, since both refuse. A refs/notes/Main row would kill it.

NIT 4. Text accuracy.

• Module docstring (:32-41): it says a branch "moved or made" as main could leave "the index at the old commit". For "made", the harm is hiding the twin's commits; the index is at the pin (probe a).
• _say_twin docstring, "packed or not": a loose Main on a folding disk makes refs/heads/main resolve, so the make path never runs for it.
• PR body, merge checks:
  • it says slice D is not pushed; it is now, at 0ef875c0, and merges clean;
  • slice D's earlier local head df1bb186 did conflict with this head: both add a block after _on_a_branch (merge-tree exit 1, CONFLICT in bootstrap.py). 0ef875c0 moved slice D's helpers to fix that, so the body's "15 lines below" note was wrong but is now moot.
• Commit message: "14, 6 and 12" should be 15, 6 and 13, as w896 already said.

Checked and true

1. The rule (check 1). I ran 20 rows through head's _folded_twin with no exception:

   • False: None; refs/remotes/origin/Main; the byte-equal ref; refs/heads/; refs/heads; a\udcffb against itself.
   • True: Main and MAIN for main; Feature/X for feature/x; final sigma ς against σ and against Σ; Straße/strasse; fix/fix; the Kelvin sign; A\udcffb against a\udcffb.
   • False, so missed: maın (dotless ı) and MAİN; NFD cafe + U+0301 against NFC café; \udcc3\udca9 against é.

   Ruling on casefold():

   • Over-matches: ß/ss, fi/fi and Kelvin; NTFS's 1:1 upcase table treats none of those as equal, and I could not verify APFS. Every twin is also an over-match on a disk that keeps case, and on a reftable leg.
   • Under-matches: NFC/NFD on APFS (w896's candidate). Also dotless ı: Python's "ı".upper() is I, so NTFS's upcase compare probably treats maın as main; reasoned, not run on NTFS.
   • Does it matter: an over-match costs a leg left with true words and one switch; an under-match keeps the old harm only for unusual names. Keep the rule by name.

2. Each site (check 2). I wrote a 7-test probe (scratchpad/v118/rv896/test_rv896_probe.py). The snapshot covered:

   • the HEAD file, for-each-ref, the loose heads with their symlink targets and the packed-refs bytes;
   • ls-files -s, status --ignored -uall and the sha256 of every work-tree file.

   Cases: T7, P9 and the missing branch on the emulation, and on a disk that keeps case (P9 with a real Main is not in the PR's file; create both packed and loose). All passed:

   • each snapshot is identical before and after bootstrap;
   • the lines match exactly;
   • the way out through /bin/sh and a second bootstrap end on refs/heads/main at the pin with status empty;
   • Main keeps its commit on the disk that keeps case.

   Every sentence is true on both kinds of disk, because each claim about a disk that folds case is stated as a condition.

3. Unchanged output (check 4):

   • I drove the three functions with patched readers through every non-twin state: 5 branch names × 8 HEAD refs × 4 commits × outcomes × remotes, 23,040 calls. All were byte-identical to 50178305, including HEAD on refs/heads/<branch>, feature, mains, detached, and refs outside refs/heads/.
   • test_bootstrap_leg_moves.py and test_bootstrap_after_bump.py pass at head.

4. Runs (check 9):

   • git 2.43: the new file, test_bootstrap_leg_moves.py, test_bootstrap_after_bump.py and the trio: 248 passed in 148 s.
   • git 2.47.1: the new file: 24 passed in 14.6 s, no skips.
   • Base check: the new file against 50178305's bootstrap.py: 21 failed and 3 passed (the three unchanged states).

5. Merges (git merge-tree --write-tree, check 10):

   • with origin/main 64464d31: tree d7d8ca11, clean;
   • with ec2017cf (bootstrap.py: the merge --ff-only, --continue and --abort lines it prints word a leg's path and an upstream as a shell reads them back, so a byte that is not UTF-8 is a printf and no longer escape text that names no ref (#932) #944): e2b6802d, clean;
   • with origin fix/430-d-assembly-root-guards at 0ef875c0: 79d00794, clean;
   • bootstrap.py: a leg whose HEAD is on a branch that differs from the tracking branch only in case (Main for main) is left where it is, so on a disk that folds case branch -f main no longer moves the ref HEAD stands on (#896) #948, bootstrap.py: the merge --ff-only, --continue and --abort lines it prints word a leg's path and an upstream as a shell reads them back, so a byte that is not UTF-8 is a printf and no longer escape text that names no ref (#932) #944 and slice D together: 5efa1868, clean; adding main gives f47df7b1, clean.

   On the predicted merge with slice D, the new file, my probe and test_assembly_root_unreadable_paths.py pass: 77 passed.

6. Mutants (check 8): 12 run.

   Result	Mutants
   Killed by the new file (10)	w896's bytes, drop-t7, itself; my lower(); the twin check after T7's move; _say_twin naming the branch as the twin; the move and place risks swapped; casefold on one side only; the unborn twin exempted; the P9 check after the checkout
   Killed by the existing tests (1)	a changed default for _say_keep's kept (9 failures)
   Survives (1)	R2, NIT 3

7. Sonar-style checks (check 7):

   • Cognitive complexity, by S3776's rules: fast_forward_to_pin is 15:

     • the twin if +1;
     • the and in other_branch +1;
     • the first if +1;
     • the elif +1, with its or and and sequences +2;
     • the else +1;
     • if not placed +1, the nested if moved +2 and its else +1;
     • why or [] +1;
     • the remote if +1 and its and +1;
     • if other_branch +1.

     S3776 flags only above 15, so it passes, at the limit. If it ever grows, moving the note block into a helper saves 2. The others: place_at_pin 6, create_at_pin 13 (12 if the conditional expression takes no nesting), _folded_twin 3, _say_twin 1.

   • Duplication: the longest repeated run in the new file is 5 lines (:263-267 equals :289-293), below Sonar's block size.

   • Asserts: none joins conditions with and.

   • Line length: added lines are at most 79 columns (test file) and 78 (bootstrap.py).

8. Docs (check 6): grepped docs/, AGENTS.md, README.md and the assembly root's AGENTS-shape.md and README.md. No sentence about step (a) is made false. Each says "only where that loses no commit … or says why not", which stays true.

9. Signatures: no other caller of the three changed signatures exists in scripts/, templates/ or tests/.

Could not verify

• A real APFS or NTFS disk. In particular: whether NTFS treats dotless ı as i, APFS's exact fold, and the packed "before" state, which a symlink cannot emulate (w896's reasoning holds).
• git 2.55 (CI's version).
• Sonar's own analyser; the counts above are by hand.
• The 66 files w896 left to CI.

Checklist candidates

1. Change the switch line to _paste_word once bootstrap.py: the merge --ff-only, --continue and --abort lines it prints word a leg's path and an upstream as a shell reads them back, so a byte that is not UTF-8 is a printf and no longer escape text that names no ref (#932) #944 lands, with a non-UTF-8 twin row (SHOULD 1).
2. Make create_at_pin check every ref under refs/heads/ that folds to the branch, not only HEAD's (SHOULD 2).
3. Fold NFC/NFD in _folded_twin.
4. Print the pin's sha in the make refusal.
5. Add a refs/notes/Main row to the _folded_twin table.
6. Make the same casefold check in bump-leg.py and family.py's tracking-branch guards (w896's candidate 2).

[brettheap]

Fix round 1, part 1 on #948 (#896): rv896's NITs 1 to 4, one commit 48222b5e on 80353dd1, pushed

rv896 found #948 READY (issuecomment-6252823490). This commit takes the four NITs that need nothing from #944. The switch line (bootstrap.py:782-783) and the docstrings that compare it with move_back_to_pin are untouched: part 2 switches them to _paste_word after #944 lands. Two files change: templates/assembly-root/scripts/bootstrap.py (+14 -10) and tests/test_bootstrap_casefold_twin.py (+13 -5). Every other line is byte for byte.

NIT 1: the make risk's words

• Was: making main could hide the commits Main holds behind the new ref. An unborn twin holds none.
• Now: making main could hide the commits a branch spelled like main holds behind the new ref. It is true of a packed twin, an unborn twin (it holds none, so nothing is hidden) and a third spelling beside either, which is rv896's case (c): an unborn Main beside a packed MAIN.
• Where: TWIN_RISKS["make"]. The test file's RISKS["make"] is the same words, exactly.

NIT 2: the pin's sha

• Was: [spec] spec: branch main does not exist, and the checkout is on Main, which differs from main only in case, then check out the pin with no sha.
• Now: [spec] spec: branch main does not exist (the pin is <sha12>), and the checkout is on Main, which differs from main only in case. The sha is _short(pin), as every other line prints a pin. No refusal bootstrap.py: on a disk that folds case, a leg on Main whose tracking branch main is behind the pin is moved under its own HEAD, and bootstrap says it is on main now over an index that undoes the pin #896 did not add is changed.
• Evidence: both missing-branch tests compare the lines exactly with the pin in them. The packed-twin test now takes the sha from the printed line ((the pin is <sha12>)), runs git checkout --detach on it, asserts it is the pin, and then bootstraps: branch main created at <pin> - at the pin, kept-from-Main and Main both still hold the commit.

NIT 3: survivor R2

• Added: two _folded_twin rows, refs/notes/Main and refs/tags/xMain, each against main, both expected False. Each has 11 characters before Main, as refs/heads/ does.
• R2 (the refs/heads/ guard dropped, the 11-character slice kept), run through the same mutation harness:
  • on the first head's 24 tests: 24 passed, it survives, as rv896 found;
  • on the 26 tests: 2 failed ([a notes ref], [a tag, 11 characters]): killed.
• Two earlier mutants re-run on the 26: the check dropped from create_at_pin: 2 failed (the unborn and the packed test); casefold() to lower(): 1 failed (the sigma row).

NIT 4: true text

• Module docstring (step (a)): it said a branch "moved or made" as main could leave "the index at the old commit". It now says a branch MOVED as main there could be the ref HEAD stands on, with the index left at the old commit, and one MADE as main could hide the commits the twin holds behind the new ref; and that the line for a branch that is not there gives the pin's sha.
• _say_twin's docstring: "packed or not" is gone. It says checkout -b main would write the file Main reads and hide behind it what Main holds in packed-refs, and that a loose Main on a disk that folds case makes refs/heads/main resolve, so this path never runs for it.

Evidence

• New file: git 2.43.0, 26 passed in 16 s; git 2.47.1, 26 passed in 20 s (the 24 of the first head and the two rows).
• Against the base 50178305: 23 failed, 3 passed (the three unchanged states, by design).
• git 2.43.0: the new file, test_bootstrap_leg_moves.py, test_bootstrap_after_bump.py and the trio: 250 passed in 3:44.
• Cognitive complexity: unchanged, since only strings changed. By hand and by the AST counter: place_at_pin 6, fast_forward_to_pin 15 (at the limit S3776 allows), create_at_pin 13, _folded_twin 3, _say_twin 1, checkout_tracking_branch 13. Lines within 79 columns; the long lines left are the four that were already there.
• Merges (git merge-tree --write-tree, all clean): origin/main ce0245d0, tree fae44ad9; bootstrap.py: the merge --ff-only, --continue and --abort lines it prints word a leg's path and an upstream as a shell reads them back, so a byte that is not UTF-8 is a printf and no longer escape text that names no ref (#932) #944's ec2017cf, tree 223ab1a9; slice D's 0ef875c0, tree 49e8b5eb. bootstrap.py: a leg whose HEAD is on a branch that differs from the tracking branch only in case (Main for main) is left where it is, so on a disk that folds case branch -f main no longer moves the ref HEAD stands on (#896) #948 with ec2017cf and then 0ef875c0: tree b2d3d253, clean.
• The commit message of 80353dd1 says cognitive complexity 14, 6 and 12. The right numbers are 15, 6 and 13 (the hand count missed why or []). The second commit's message says so; the squash message should not repeat the first commit's sentence.

Left for part 2 (after #944 lands)

_paste_word(path) and _paste_word(branch) in the switch line; the two docstrings that say the line is printed as move_back_to_pin prints its command (_say_twin's and the test test_the_way_out_is_quoted_for_a_shell_as_the_move_back_line_is's); one non-UTF-8 twin row that runs the printed switch through /bin/sh.

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[brettheap]

Fix round 1, part 2 on #948 (#896): rv896's SHOULD 1, the switch line through _paste_word, one commit 45415296 after the merge 60df34fc of main 450279ca, pushed

#944 (#932) landed as 450279ca, so _paste_word is on main. git merge --no-ff origin/main (identity by -c, no rebase, no force) was clean, as predicted: merge commit 60df34fc, parents 48222b5e and 450279ca, tree 664513ff, the tree git merge-tree --write-tree gave before the merge. The change is one commit on it, in templates/assembly-root/scripts/bootstrap.py (+16 -13) and tests/test_bootstrap_casefold_twin.py (+101 -9). Every other line is byte for byte.

The change

• The command. _say_twin built it as spelled(shlex.quote(path)) and spelled(shlex.quote(branch)), the form the assembly root's bootstrap.py: the git -C <leg> merge --ff-only '<upstream>' line names an upstream that is not UTF-8 by its \udcXX escape, so it does not paste #932 replaced. For a branch named with a byte that is not UTF-8 it printed git -C spec switch 'a\udcffb', which /bin/sh reads as the eight characters it holds, so the pasted command named no branch. It is now f"git -C {_paste_word(path)} switch {_paste_word(branch)}", as bootstrap.py: the merge --ff-only, --continue and --abort lines it prints word a leg's path and an upstream as a shell reads them back, so a byte that is not UTF-8 is a printf and no longer escape text that names no ref (#932) #944's hand-over gave it. A name that prints as it is stays shlex.quoted, so every line printed before this commit is the same; a name with such a byte is the printf word, "$(printf -- 'a\377b')".
• The two descriptions. _say_twin's docstring said the command was "printed as move_back_to_pin prints its command". It now says each word is _paste_word (the assembly root's bootstrap.py: the git -C <leg> merge --ff-only '<upstream>' line names an upstream that is not UTF-8 by its \udcXX escape, so it does not paste #932), as move_back_to_pin words its path and its upstream, and says what the word is for a name with such a byte. The docstring of test_the_way_out_is_quoted_for_a_shell_as_the_move_back_line_is says the same, and names the new test that holds the byte name.
• Nothing else. The lines of the twin refusals, TWIN_RISKS and the module docstring are as part 1 left them. Cognitive complexity is unchanged: fast_forward_to_pin 15, place_at_pin 6, create_at_pin 13, _say_twin 1. Lines are within 79 columns.

The tests

• The non-UTF-8 twin, run through sh (test_the_way_out_of_a_twin_that_is_not_utf_8_is_one_a_shell_reads): T7 with the tracking branch a<0xff>b (--branch) and HEAD on its symlink twin A<0xff>b. It skips on Windows, and where the disk refuses the byte (needs_the_byte, as test_bootstrap_non_utf8_branch.py skips; macOS refuses it). Bootstrap leaves the leg: the first spec line names both spelled (branch a\udcffb tip <old> is behind the PIN <pin>, and the checkout is on A\udcffb, which differs from a\udcffb only in case), HEAD is refs/heads/A\xffb byte for byte, the branch has not moved and the status is empty. The printed command equals git -C spec switch "$(printf -- 'a\377b')". It is then run AS PRINTED through /bin/sh -c (pasted, from test_bootstrap_pasteable_lines.py), and HEAD is refs/heads/a\xffb byte for byte. The next bootstrap prints branch a\udcffb fast-forwarded <old> -> <pin>, the pin and leaves the status empty.
• At the code before the change (the merged tree with _say_twin as 48222b5e had it) that test fails at the command: - git -C spec switch "$(printf -- 'a\377b')" expected, + git -C spec switch 'a\udcffb' printed (1 failed, 26 passed; log r2-pre-fix.log). 48222b5e itself cannot run the test: the test imports test_bootstrap_pasteable_lines.py, which bootstrap.py: the merge --ff-only, --continue and --abort lines it prints word a leg's path and an upstream as a shell reads them back, so a byte that is not UTF-8 is a printf and no longer escape text that names no ref (#932) #944 added.
• Five unit rows (test_a_shell_reads_each_word_of_the_way_out_as_the_bytes_of_its_name): _say_twin is called, the command is taken from the printed line, and /bin/sh reads its two words (printf '%s\0%s' <path-word> <branch-word>); they must be the bytes of the path and of the branch. Rows: an ordinary pair, a path with the byte, a branch with the byte, both with the path leading with a dash, and a path with a percent. These make the path half of the change testable: the leg's path in the end-to-end test is the ordinary spec.

Runs

The load was about 50. Two pytest processes at a time, through run9.sh; logs are under $Q/v118/w896/.

• git 2.43.0, at the merged tree before the unit rows were added: the new file, test_bootstrap_pasteable_lines.py, test_bootstrap_non_utf8_branch.py, test_bootstrap_leg_moves.py, test_bootstrap_after_bump.py and the trio: 329 passed in 7:04 (r2-run-243.log).
• git 2.47.1, the same tree: the new file and test_bootstrap_pasteable_lines.py: 72 passed in 2:09 (r2-run-2471.log).
• The unit rows are a change to the test file alone, so the new file was run again on both gits at the final tree: git 2.43.0 32 passed in 16 s (r2-new-243.log), git 2.47.1 32 passed in 18 s (r2-new-2471.log). No test was skipped.

Mutants (the 32 tests, each in a scratch tree at the merged head)

mutant	result
_paste_word dropped from the path (spelled(shlex.quote(path)))	3 failed: the rows of a path with the byte, both with a dash, and a path with a percent
_paste_word dropped from the branch	3 failed: the end-to-end test and the rows of a branch with the byte and of both
the old form restored for both	5 failed: the end-to-end test and four rows; the ordinary pair passes, by design (the old form is the same word for it)

None survives.

Merge checks

git merge-tree --write-tree, re-fetched first: origin/main 450279ca (unchanged since the merge): clean, tree aabc059b. Slice D's 0ef875c0 (#958, unchanged on origin): clean, tree af0a54b7.

[brettheap]

Re-check of #948 (#896)'s fix round 1 at 45415296, for lane openRepoShape-5: READY

The round answers all four NITs and SHOULD 1, and nothing new is wrong. The merge 60df34fc is a plain merge. Every output that is not a twin's prints byte for byte what main 450279ca printed.

Findings

No MUST and no SHOULD. One note, outside this PR:

NIT (not #948's to fix). A leading = is still a bare word, which zsh expands.

• Where: templates/assembly-root/scripts/bootstrap.py:802. The switch line now uses _paste_word, so it inherits that function's gap.
• Measured under /usr/bin/zsh:
  • git -C =spec switch main fails with zsh: spec not found;
  • git -C spec switch =x fails with x not found;
  • =ls and =w read back as /usr/bin/ls and /usr/bin/w.
• Ruling: this is the assembly root's bootstrap.py: a paste word that begins with = is expanded by zsh, the NOT INITIALIZED line is neither quoted nor a paste word, and _paste_word asks the stdout's codec where git is handed the filesystem's bytes #961, in _paste_word itself. bootstrap.py: a leg whose HEAD is on a branch that differs from the tracking branch only in case (Main for main) is left where it is, so on a disk that folds case branch -f main no longer moves the ref HEAD stands on (#896) #948 is right as it stands and picks up the fix with no change of its own.

Checked and true

1. The merge (check 1). git show --remerge-diff 60df34fc is 0 bytes. Its tree 664513ff equals the ort remerge of its parents 48222b5e and 450279ca.

2. Part 1 (check 2). The diff 80353dd1..48222b5e holds only the four NIT hunks; every other line is unchanged.

   • NIT 1: the risk line now reads "the commits a branch spelled like main holds". The unborn twin is still refused, as I ruled.
   • NIT 2: the line now reads branch main does not exist (the pin is <sha12>). The packed test checks out the sha it reads from the printed line.
   • NIT 3: rows refs/notes/Main and refs/tags/xMain were added. R2 re-run at 45415296: 2 failed (those two rows), so it is killed.
   • NIT 4: the module docstring now separates moved from made, and the "packed or not" wording in _say_twin is gone. 48222b5e's message corrects the earlier complexity figures (15, 6 and 13).

3. Part 2, SHOULD 1 (check 3).

   • The words read back exactly. I printed 13 path and branch pairs through the head's _say_twin. Each word read back as the exact bytes, as two arguments, under /bin/sh, /bin/dash and /bin/bash, in LC_ALL=C and C.UTF-8. The pairs covered the 0xff byte in the path, the branch or both; a leading -; % (with and without 0xff); a space and an apostrophe; and a leading = together with 0xff, which takes the printf form. zsh gave 10 of 13; the 3 failures are the bare leading-= pairs in the NIT.

   • The end-to-end test. With the old spelled(shlex.quote(...)) line restored, it fails:

     - git -C spec switch "$(printf -- 'a\377b')"
     + git -C spec switch 'a\udcffb'
     

     It passes at head.

4. Unchanged output (check 4).

   • I drove place_at_pin, fast_forward_to_pin and create_at_pin through every non-twin state: 23,040 calls, all byte-identical to main 450279ca.
   • _say_in_progress and move_back_to_pin have no hunks against main.
   • test_bootstrap_leg_moves.py, test_bootstrap_after_bump.py and test_bootstrap_pasteable_lines.py pass; they were in the 2.43 run.

5. Mutants (check 5). All five killed, run against the casefold file (32 tests).

   Mutant	Result
   w896's: old form restored for both words	5 failed: the end-to-end test and 4 unit rows
   w896's: old form for the path only	3 failed
   Mine: path and branch words swapped	11 failed
   Mine: (the pin is <sha>) printing head instead of pin	2 failed
   R2 (from my first review)	2 failed

6. Runs at 45415296 through run9.sh (check 6):

   • git 2.43.0: the casefold, pasteable, test_bootstrap_non_utf8_branch.py, test_bootstrap_leg_moves.py and test_bootstrap_after_bump.py files plus the trio: 334 passed, 0 skipped, in 223 s.
   • git 2.47.1: the casefold file: 32 passed, 0 skipped.

7. Merges (check 7). origin/main has moved to 2f5cabf5, re-fetched; it is a validate-pins.py and repo_shape.py change that leaves spelled alone.

   • With 2f5cabf5: clean, tree 20bcfd13. On a predicted merge commit ae4d7f8b, the casefold file, the pasteable file and test_validate_pins_spelled_and_named.py pass: 128 passed.
   • With slice D 0ef875c0: clean, tree af0a54b7.
   • fix/961-paste-words is not on origin.

8. Sonar-style checks (check 8).

   • Complexity: the round adds no branch. The ASTs of fast_forward_to_pin, place_at_pin and _folded_twin are identical to 80353dd1 once docstrings are set aside. create_at_pin and _say_twin changed only inside f-strings. So fast_forward_to_pin stays at 15, create_at_pin at 13 and _say_twin at 1.
   • Duplication: the longest repeated run in the test file is 6 lines (:267 and :294, the two missing-branch tests). Neither the end-to-end test nor the five unit rows share a run longer than 4 lines with other tests.
   • Asserts: none joins conditions with and.
   • Line length: lines added since 80353dd1 are at most 79 columns.

9. Authorship. 48222b5e and 45415296 are by Brett Heap <service@opensoft.dev>, with the Lane and Co-Authored-By trailers.

Could not verify

• A real APFS or NTFS disk.
• git 2.55 (CI's version).
• Sonar's own analyser; the counts above are by hand plus an AST comparison.
• Whether the PR body's merge-check section was updated. The body is not saved in scratch, and the accounts give the new trees.

[sourcery-ai]

Sorry @brettheap, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 2 days and 23 hours by commenting @sourcery-ai review. Upgrade to get a review now.