[brettheap]

Lane: openreposhape-5 (openRepoShape-5)
Claim: #961 (comment)

#944 (#932) made each command step (a) prints for a person to paste name its leg path and its upstream as ONE shell word, through _paste_word. rv932's independent review of it (#944 issuecomment-6252637720) left a SHOULD and four NITs in that function, and #961 filed them, with a SHOULD for the one printed command #944 did not word: the NOT INITIALIZED line. This takes them all, in templates/assembly-root/scripts/bootstrap.py, tests/test_bootstrap_pasteable_lines.py, tests/test_assembly_root_unreadable_paths.py (#958's file), tests/test_bootstrap_spelling.py and the docstring of tests/test_bootstrap_after_bump.py.

The branch is restacked on main af0e60f2, which holds #958 (#430 slice D, which moved the NOT INITIALIZED line into _initialized): #958's final head, then its squash, then main (nothing newer). The squash's tree is identical to #958's final head, so the merges brought in no code of their own. Against main this PR changes those five files and no other, and git diff -U0 against main has the same changed lines as this PR's own commits on #958's head 7e87e05f (checked from objects, see "What this adds to main").

Each item, before and after

1. A leading = (SHOULD 1). _paste_word quoted with shlex.quote, which leaves =x bare, and zsh expands a bare =word to the path of a command.

• Before, read back by /usr/bin/zsh 5.9 (printf %s <word>): =x, =ls, ==x and =% did not print themselves; =ls was /usr/bin/ls and =x was zsh: x not found. dash and bash read them all.
• After: the word is '=x', written locally with quoted.startswith("="), as repo_shape.shell_quoted quotes it (family.py and siblings.py print commands with unquoted paths, so under a folder with a space the member-git-dir-cached remedy's rm -rf would delete the wrong directory, and add's push line fails #486). bootstrap.py imports nothing new from repo_shape.py, and a test holds the import set. A word shlex.quote quotes already (=a b) is not quoted again, and a=b stays bare.
• The test row ("=x", "=x") is now ("=x", "'=x'"), in its own test, because the one it was in asserts "byte for byte what it was".
• rv932's probe (every byte 0x01 to 0xff in seven places, about 160 special names, 3,194 names, each word read by dash, bash and /usr/bin/zsh under LC_ALL=C and C.UTF-8, as set -- <word>, one argument and the bytes git is handed): 450 mismatches at 450279ca, all zsh and all a leading = (225 names in each locale), and 0 at the first head, with 603 names that begin with = among those read. The 4 names that end in a line feed have no word (item 3).

2. The codec (NIT 2). _prints_as_it_is asked the stdout's codec only, but git is handed another set of bytes.

• Before: under a latin-1 or cp1252 stdout, origin/café was the quoted word, printed as the byte e9, where the ref is c3 a9. Under a latin-1 filesystem and a UTF-8 stdout it was the other way round.
• After: a non-ASCII word is kept quoted only where text.encode(stdout's codec) equals the bytes git is handed (_handed_to_git: os.fsencode's on POSIX, UTF-8 on Windows, item 8). Otherwise it is the printf word, which is ASCII. An ASCII word skips the comparison, so origin/main stays bare on any stdout. spelled's check comes first.
• A decision: the brief says to compare with sys.getfilesystemencoding(). os.fsencode is that codec with its error handler, and it is what subprocess hands git on POSIX, so comparing the two byte strings asks both at once and cannot disagree with what git is given. It is also the call a test shims in process (LegacyWindowsOs does, bootstrap.py: the merge --ff-only, --continue and --abort lines it prints word a leg's path and an upstream as a shell reads them back, so a byte that is not UTF-8 is a printf and no longer escape text that names no ref (#932) #944).

3. The round-trip guard (NIT 3). The guard os.fsdecode(raw) != name kept the escape text for sp\udcc3\udca9c, though "$(printf -- 'sp\303\251c')" reads back exactly the bytes git is handed (the directory spéc).

• After: no name is read back. git IS handed those bytes, so a name os.fsdecode would read as another has its word. A name that ends in a line feed keeps today's text, as the brief says. (On Windows the guard was replaced by item 8.)
• An addition inside "what can be pasted": a name with a NUL has no word either. $(...) drops a NUL, so the old word "$(printf -- 'a\000b')" printed ab in dash and bash (zsh keeps it). It keeps today's text now. It cannot be reached from a real leg path or ref, so this is a guard and a unit row, nothing more.

4. R6 and R8 (NIT 4). Two unit rows, in process:

• R6, except UnicodeEncodeError alone: a sys.stdout stub whose encoding is no-such-codec (a LookupError, not a UnicodeEncodeError); the word is the printf word and nothing raises.
• R8, name.encode("utf-8", "surrogateescape") for os.fsencode: a shim os whose fsencode is latin-1, and café + tab; the word is "$(printf -- 'caf\351\011')", and /bin/sh prints the shim's bytes.

5. Stale words (NIT 5). tests/test_bootstrap_after_bump.py's docstring no longer says the command is "spelled" (#391): the names are, the command is _paste_word's. The pasteable test file's docstring now says what the rule is, and which tests run what was printed and which ask the helper. The module paragraph says where the stdout cannot write the name, the leading =, the new command, and the names with no word. _prints_as_it_is and _paste_word have new docstrings.

6. The NOT INITIALIZED command (SHOULD 3). _initialized printed git submodule update --init {spelled(path)}, bare, for a leg that is not there.

• Before, pasted from the root (rv973 measured 40 awkward paths in sh, dash, bash and zsh): my spec was two pathspecs; a path with an ESC, a U+2028, the byte 0xff, %s or a tab was its escape text, which names no path; sp'ec was a syntax error in every shell; =spec failed in zsh (zsh:1: spec not found); -spec was an option.
• After: git submodule update --init -- <word>, the path as _paste_word words it, after a --. The leg is checked out at its pin again, in every shell and on git 2.43 and 2.47.1 (rv973: 40 of 40). The label [spec] <path>: is still spelled.
• A path that is not a name printf can print (a lone surrogate, a NUL, a final line feed) keeps its text, as in item 3.
• rv973 asked for a landing condition: the PR does not land without this commit.

7. A path that begins with : (rv973's NIT 1 on the staged commit). Git reads a word that begins with : as pathspec magic, even after the --, so --init -- :spec matched nothing and the leg stayed empty (all four shells, git 2.43 and 2.47.1). _initialized words ./:spec: ./ goes inside the one word, so a path that needs quoting is './:my spec' and a byte path is "$(printf -- './:sp\377ec')". Only this command has it: git -C :spec is a directory, not a pathspec.

8. Windows: the bytes are UTF-8 (rv973's NIT 1 and NIT 2). git for Windows is handed UTF-16 and stores UTF-8, and Git Bash reads a paste as UTF-8.

• _handed_to_git(text) is os.fsencode(text) on POSIX and strict text.encode("utf-8") where os.name == "nt". _prints_as_it_is compares the stdout with it, and _paste_word makes its printf bytes from it.
• Before, under PYTHONLEGACYWINDOWSFSENCODING=1 (where os.fsencode is the code page's): on main a UTF-8 stdout got "$(printf -- 'origin/caf\351')" for origin/café and \2005 for €5, which Git Bash holds as other names, where the quoted word was right; and a codec rule made of os.fsencode would have given a cp1252 stdout the same kind of word (it was the staged commit's case, rv973's NIT 2). A lone surrogate had a word of three junk bytes in the default mode.
• After: the quoted word stays on a UTF-8 stdout, the printf word is UTF-8 in either mode, and a lone surrogate, which has no UTF-8 bytes, keeps its text. The Windows read-back guard os.fsdecode(raw) != name is gone, and with it the one os.name test in _paste_word. POSIX is unchanged.
• I have no Windows host: the evidence is in-process shims, as in bootstrap.py: the merge --ff-only, --continue and --abort lines it prints word a leg's path and an upstream as a shell reads them back, so a byte that is not UTF-8 is a printf and no longer escape text that names no ref (#932) #944.

Tests

tests/test_bootstrap_pasteable_lines.py is now 128 tests (45 in #944). tests/test_assembly_root_unreadable_paths.py has 11 more rows, and tests/test_bootstrap_spelling.py's NOT INITIALIZED test asks for the word.

• Items 1 to 5, first head, against 450279ca: 19 of 97 pasteable tests failed there, 33 of the 52 new cases passed there by design (a word shlex.quote quotes already, every = name in sh, dash and bash, the cases where both codecs agree, R6's and R8's rows, which kill mutants that base's code does not contain), and 97 of 97 passed at that head.
• Item 6, on the assembly root's validate-manifest.py and bootstrap.py: a path this user cannot read is named, never read as absent, so a scripts/ nobody may search no longer SKIPs every validator into bootstrap ok (#430, slice D) #958's head, against the merged tree with the old line: 20 failed, 377 passed in the three changed files. 15 new cases failed: five paste rows, the -spec row, the zsh row of the = test, six rows in test_assembly_root_unreadable_paths.py, the legacy-mode UTF-8 row and the euro row. 5 changed existing cases failed, since the line they assert changed. The helper not_initialized in the assembly root's validate-manifest.py and bootstrap.py: a path this user cannot read is named, never read as absent, so a scripts/ nobody may search no longer SKIPs every validator into bootstrap ok (#430, slice D) #958's file takes the word. Each paste test empties the leg (git submodule deinit), runs bootstrap, checks the line whole, runs the printed command from the root in a shell, and checks the leg's .git is back at the pin. Git ignores a submodule path that begins with -, so -spec is checked another way: the command is exactly git submodule update --init -- -spec, and git's stderr names the path (without the -- it prints its usage).
• Items 7 and 8, against the staged commit: 11 failed, 405 passed: the :spec paste in sh, dash, bash and zsh (4), three text rows for a leading : (3), the default-mode lone surrogate (1) and three legacy-mode printf rows (3). 8 of the 19 new cases pass there by design (the rows for a space at either end, which kill _paste_word(path.strip()) and are right in the old code).
• Pass at this head: all of them.

Mutants

Each applied alone to the head's bootstrap.py, the changed test files run with -x.

• First head: 30 mutants (R6, R8, four for item 1, seven for item 2, seven for item 3, and bootstrap.py: the merge --ff-only, --continue and --abort lines it prints word a leg's path and an upstream as a shell reads them back, so a byte that is not UTF-8 is a printf and no longer escape text that names no ref (#932) #944's ten), 30 killed.
• On the assembly root's validate-manifest.py and bootstrap.py: a path this user cannot read is named, never read as absent, so a scripts/ nobody may search no longer SKIPs every validator into bootstrap ok (#430, slice D) #958's head, first round: 38 killed, among them rv973's O3 (the comparison asked outside its try).
• Last round: 45 applied, 45 killed: five for the ./ (none, :/ only, always, also before -, glued in front of the word), R-H (.strip()) and R-F (_paste_word(spelled(path))), the command (spelled(path), no --, shlex.quote only), six for Windows (the nt branch dropped, UTF-8 everywhere, nt inverted, surrogatepass, os.fsencode in the word, the read-back guard back), O3, R6, R8 and the rest of the assembly root's bootstrap.py: a paste word that begins with = is expanded by zsh, the NOT INITIALIZED line is neither quoted nor a paste word, and _paste_word asks the stdout's codec where git is handed the filesystem's bytes #961's and bootstrap.py: the merge --ff-only, --continue and --abort lines it prints word a leg's path and an upstream as a shell reads them back, so a byte that is not UTF-8 is a printf and no longer escape text that names no ref (#932) #944's. One survived the first pass: the ./ glued in front of the word. It is the same name to a shell, so no paste could tell; two text rows (:my spec, :sp<0xff>ec) kill it.

Runs

All through run9.sh (the real gh unreachable, EMAIL, GIT_SSH_COMMAND=false and GIT_CONFIG_GLOBAL=/dev/null set), at the restacked head d286b289.

git	files	result
2.43.0	the pasteable file, test_assembly_root_unreadable_paths.py, test_bootstrap_non_utf8_branch.py, test_bootstrap_after_bump.py, test_bootstrap_spelling.py, test_pinned_copy_text.py, test_adopt_reencoded_files.py and the trio	805 passed
2.47.1	the same	805 passed

Earlier heads of this branch also ran the other eight test_bootstrap*.py files (343 passed, 3 skipped for the reftable rows), and a predicted merge with main that added the casefold and create-twins files (662 passed).

What this adds to main

git diff origin/main HEAD touches five files: templates/assembly-root/scripts/bootstrap.py, tests/test_assembly_root_unreadable_paths.py, tests/test_bootstrap_after_bump.py, tests/test_bootstrap_pasteable_lines.py and tests/test_bootstrap_spelling.py. Their changed lines, in order, are the same as git diff -U0 7e87e05f e23137c7 gives (this PR's own commits on #958's head): 109, 54, 19, 483 and 25 lines, no difference. The three merges are: #958's final head 7c06c578 (clean), its squash af0e60f2 (two conflicts, bootstrap.py and tests/test_assembly_root_unreadable_paths.py, both taken from this branch's side, which holds #958's content plus this change; the squash's tree equals the final head's) and main (already merged).

Left out

• _say_twin, fast_forward_to_pin, place_at_pin and create_at_pin, which bootstrap.py: a leg whose HEAD is on a branch that differs from the tracking branch only in case (Main for main) is left where it is, so on a disk that folds case branch -f main no longer moves the ref HEAD stands on (#896) #948 (bootstrap.py: on a disk that folds case, a leg on Main whose tracking branch main is behind the pin is moved under its own HEAD, and bootstrap says it is on main now over an index that undoes the pin #896) edits. bootstrap.py: a leg whose HEAD is on a branch that differs from the tracking branch only in case (Main for main) is left where it is, so on a disk that folds case branch -f main no longer moves the ref HEAD stands on (#896) #948 has landed, with its switch line and its rename line through _paste_word, so they take this PR's leading-= quote with no change of their own (rv932's SHOULD 2).
• A leg path that ends in a line feed keeps today's text, a deliberate exception to the Goal's "or the line says it cannot be pasted" (rv932's NIT 1).
• Git ignores a submodule.<name>.path that begins with -, so no command can initialize a leg there; the printed command is right, and validate-manifest.py is not asked about such a path here.
• Not checked: a real Windows host, Git Bash's argument conversion, macOS's /bin/sh, git 2.55 and Sonar's own analysis (cognitive complexity by hand: _prints_as_it_is 4, _paste_word 6, _handed_to_git 1, _initialized 4).

A pinned copy: every project's bootstrap.py takes an upstream-changed row, and re-pins it.

Closes #961

🤖 Generated with Claude Code

[brettheap]

(lane openRepoShape-5, 2026-10-18T18:47Z) @codex review

[sourcery-ai]

Reviewer's Guide

Updates _paste_word so bootstrap commands remain pasteable across zsh and differing stdout/filesystem encodings: leading-= words are quoted, non-ASCII text is quoted only when its emitted bytes match Git’s bytes, and safe printf fallbacks are used or avoided for edge cases such as NULs and trailing newlines. The accompanying tests exercise shell round trips, codec combinations, POSIX/Windows behavior, and the revised documentation.

Sequence diagram for encoding-aware pasteable output

sequenceDiagram
    participant Bootstrap
    participant Stdout
    participant Filesystem
    participant Git
    Bootstrap->>Bootstrap: _paste_word(name)
    Bootstrap->>Bootstrap: spelled(quoted)
    Bootstrap->>Stdout: encode(encoding)
    Bootstrap->>Filesystem: os.fsencode(name)
    Filesystem-->>Bootstrap: Git bytes
    alt ASCII or stdout bytes equal Git bytes
        Bootstrap-->>Bootstrap: Return quoted word
    else Bytes differ or stdout cannot encode
        Bootstrap->>Bootstrap: Build printf octal escapes
        Bootstrap-->>Bootstrap: Return printf word
    end
    Bootstrap->>Git: Paste command with selected word

Loading

State diagram for shell-word safety decisions

stateDiagram-v2
    [*] --> Quoted
    Quoted --> Quoted: leading =
    Quoted --> Direct: _prints_as_it_is
    Quoted --> Fallback: stdout or byte mismatch
    Direct --> [*]: return quoted
    Fallback --> Spelled: os.fsencode fails
    Fallback --> Spelled: NUL or trailing newline
    Fallback --> Spelled: Windows read-back mismatch
    Fallback --> Printf: safe byte round-trip
    Spelled --> [*]: return spelled text
    Printf --> [*]: return printf word

Loading

Flow diagram for pasteable shell word selection

flowchart TD
    A[_paste_word name] --> B[shlex.quote]
    B --> C{Leading equals sign?}
    C -->|Yes| D[Quote the word]
    C -->|No| E[_prints_as_it_is]
    D --> E
    E -->|Yes| F[Return quoted word]
    E -->|No| G[os.fsencode]
    G -->|Encoding fails| H[Return spelled text]
    G -->|Encoding succeeds| I{NUL or trailing newline?}
    I -->|Yes| H
    I -->|No| J{Windows read-back mismatch?}
    J -->|Yes| H
    J -->|No| K[Return printf word]

Loading

File-Level Changes

Change	Details	Files
Harden shell-word generation against zsh expansion for names beginning with =.	Add explicit quoting for words whose rendered form starts with = while avoiding double quoting already-quoted names. Cover leading-equals behavior and shell round trips across sh, dash, bash, and zsh.	templates/assembly-root/scripts/bootstrap.py tests/test_bootstrap_pasteable_lines.py
Make direct quoting contingent on the bytes stdout emits matching the bytes Git receives.	Compare encoded stdout output with os.fsencode for non-ASCII names, while retaining an ASCII fast path. Fall back to an ASCII printf word when codecs differ or the stdout codec is unavailable/invalid.	templates/assembly-root/scripts/bootstrap.py tests/test_bootstrap_pasteable_lines.py
Refine the conditions under which a name has no safe printf representation and expand byte-oriented coverage.	Permit POSIX paths whose surrogate escapes round-trip to the bytes Git receives. Keep spelled output for trailing newlines, NULs, unencodable names, and Windows decode mismatches. Add tests for NUL handling, codec shims, filesystem encodings, and printf byte output.	templates/assembly-root/scripts/bootstrap.py tests/test_bootstrap_pasteable_lines.py
Synchronize documentation and test descriptions with the updated paste-word contract.	Document the leading-= zsh hazard, stdout/filesystem byte agreement, and no-word cases. Clarify that command arguments use _paste_word rather than being uniformly spelled.	templates/assembly-root/scripts/bootstrap.py tests/test_bootstrap_after_bump.py tests/test_bootstrap_pasteable_lines.py

Assessment against linked issues

Issue	Objective	Addressed	Explanation
#961	Quote paste words beginning with = so zsh does not expand them as command paths and the words read back as themselves across supported shells.	✅
#961	Choose a quoted non-ASCII word only when the stdout encoding writes the same bytes that git receives from the filesystem encoding; otherwise emit a printf word, and allow POSIX byte sequences that can be pasted to round-trip.	✅
#961	Print the NOT INITIALIZED submodule-update command as a pasteable shell word, and update the relevant tests and documentation.	❌	The PR explicitly leaves the NOT INITIALIZED line unchanged, pending #958; it remains unquoted and is not produced through _paste_word. The documentation and tests for the changes this PR does make are updated.

Possibly linked issues

• the assembly root's bootstrap.py: a paste word that begins with = is expanded by zsh, the NOT INITIALIZED line is neither quoted nor a paste word, and _paste_word asks the stdout's codec where git is handed the filesystem's bytes #961: Same follow-up issue: fixes leading-equals quoting and byte-safe paste words; the NOT INITIALIZED line is explicitly deferred to the assembly root's validate-manifest.py and bootstrap.py: a path this user cannot read is named, never read as absent, so a scripts/ nobody may search no longer SKIPs every validator into bootstrap ok (#430, slice D) #958.

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-18T18:50:04.847901Z	b2887cf	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🚀

Reviewed commit: b2887cf56b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[brettheap]

Independent review of #973 (#961) at b2887cf5, for lane openRepoShape-5: READY

No MUST. The paste words are now exact in dash, bash and zsh. I read every word back in both locales and found 0 mismatches. Every output outside the categories the body names prints byte for byte what 450279ca prints. One condition stands: the PR must not land without its promised NOT INITIALIZED commit (SHOULD 1).

Findings

SHOULD 1 (landing condition). Closes #961 is false at b2887cf5.

• Where: templates/assembly-root/scripts/bootstrap.py:1166 still prints git submodule update --init {spelled(path)}, neither quoted nor worded. That is the assembly root's bootstrap.py: a paste word that begins with = is expanded by zsh, the NOT INITIALIZED line is neither quoted nor a paste word, and _paste_word asks the stdout's codec where git is handed the filesystem's bytes #961's SHOULD 3.
• The body's plan is sound and its claim is true: the assembly root's validate-manifest.py and bootstrap.py: a path this user cannot read is named, never read as absent, so a scripts/ nobody may search no longer SKIPs every validator into bootstrap ok (#430, slice D) #958 (slice D, 0ef875c0) moves this line into a new function, _initialized (0ef875c0:481-495). On the clean merge of the two (tree 9ed58bcd) the line is still spelled(path), at :505.
• Condition: keep bootstrap.py: the paste words it prints quote a leading =, are made of the bytes git is handed (UTF-8 on Windows), and the NOT INITIALIZED command names a leg's path as one word after a --, with ./ before a : (#961) #973 a draft until that commit lands, or change the last line to Refs #961.
• For that commit: write git submodule update --init -- <word>. Without --, a path that begins with - is read as an option, and that includes the printf word for -sp<0xff>ec, which _paste_word does not prevent.

NIT 1 (the codec rule on Windows). Under the legacy filesystem mode, the comparison checks the wrong bytes.

• Where: bootstrap.py:777-790, written == os.fsencode(text).

• On POSIX the rule is right, and better than comparing codec names. os.fsencode is exactly what subprocess hands git, and comparing bytes keeps the quoted word wherever two codecs agree on this name: cp1252 and latin-1 both write é as e9.

• On Windows in default mode it equals a UTF-8 comparison, which is right: Git Bash converts the printf bytes from UTF-8. In-process shim with a cp1252 stdout: origin/café becomes "$(printf -- 'origin/caf\303\251')".

• On Windows in legacy mode (PYTHONLEGACYWINDOWSFSENCODING=1, so os.fsencode is mbcs) the reference is wrong. git for Windows is handed UTF-16 and stores UTF-8, as _try_git already assumes there. Measured with the shim on a UTF-8 stdout:

  • origin/café becomes "$(printf -- 'origin/caf\351')" (base: 'origin/café');
  • €5 becomes "$(printf -- '\2005')" (base: '€5').

  Those are cp1252 bytes, which name another path in Git Bash, where base's quoted word was correct. Comparing against sys.getfilesystemencoding() would be wrong the same way.

• Suggestion: when os.name == "nt", compare against text.encode("utf-8", "surrogatepass"). It is a rare configuration and the sh dialect on Windows is already out of scope, hence NIT.

NIT 2. One mutant survives.

• O3: move os.fsencode(text) out of _prints_as_it_is's try. It survives the pasteable, non_utf8_branch and after_bump files (176 passed).
• Effect: with a latin-1 filesystem shim and a UTF-8 stdout, head gives '日本' (no word), and O3 raises UnicodeEncodeError.
• Reachability: none from the callers. Such a leg path fails Path.exists, and git's names are read with os.fsdecode. A unit row would still pin it.

NIT 3. The module paragraph (:50-60) lists the line-feed and NUL names as having no word, but not the names os.fsencode cannot write. _paste_word's docstring does list them.

Checked and true

1. Each the assembly root's bootstrap.py: a paste word that begins with = is expanded by zsh, the NOT INITIALIZED line is neither quoted nor a paste word, and _paste_word asks the stdout's codec where git is handed the filesystem's bytes #961 item (check 1):

   • SHOULD 1, the leading =: fixed. quoted.startswith("=") wraps a bare word only, and a bare shlex word holds no '. The test row is now '=x', held equal to shell_quoted(name, "posix").
   • NIT 2, the codec: fixed for POSIX (Windows caveat in NIT 1).
   • NIT 3, the guard: the read-back now runs on Windows only, and sp\udcc3\udca9c gets "$(printf -- 'sp\303\251c')".
   • NIT 4, R6 and R8: now killed (item 6).
   • NIT 5, stale words: the after_bump docstring, the pasteable file's docstring and the module paragraph are updated.

2. The word probe (check 4). 2,123 names went through head's _paste_word: every byte 0x01 to 0xff in seven places, the special names, and extras such as =, ==x, =%, =a b, a=b, origin/=x, =ls, =w, sp\udcc3\udca9c and a NUL.

   • Words: 2,118 (1,522 printf, 596 quoted, 261 beginning with =). Every printf word is ASCII.
   • Read-back: /bin/sh, /bin/dash, /bin/bash and /usr/bin/zsh, each in LC_ALL=C and C.UTF-8: 0 mismatches, one argument each. My bootstrap.py: the merge --ff-only, --continue and --abort lines it prints word a leg's path and an upstream as a shell reads them back, so a byte that is not UTF-8 is a printf and no longer escape text that names no ref (#932) #944 probe had 75 zsh failures, all from a bare leading =.
   • No word (5): \n, x\n, -\n and =\n (a final LF), and a\x00b (a NUL).

3. The NUL guard (check 3) is right and harmless.

   • Measured: base's word "$(printf -- 'a\000b')" reads back as ab in dash and bash (bash warns "ignored null byte"). zsh's builtin keeps the NUL, but an external program receives a. No shell word can hand a NUL to git.
   • It is unreachable: a NUL path fails Path.exists, refs cannot hold NUL, and _argument_fault refuses a NUL branch.

4. bootstrap.py: a leg whose HEAD is on a branch that differs from the tracking branch only in case (Main for main) is left where it is, so on a disk that folds case branch -f main no longer moves the ref HEAD stands on (#896) #948 (check 5). On a three-way predicted merge of main 5f62ea48, bootstrap.py: a leg whose HEAD is on a branch that differs from the tracking branch only in case (Main for main) is left where it is, so on a disk that folds case branch -f main no longer moves the ref HEAD stands on (#896) #948 45415296 and bootstrap.py: the paste words it prints quote a leading =, are made of the bytes git is handed (UTF-8 on Windows), and the NOT INITIALIZED command names a leg's path as one word after a --, with ./ before a : (#961) #973 (tree 98979bfa), the merged bootstrap.py parses. _say_twin still reads f"git -C {_paste_word(path)} switch {_paste_word(branch)}". It prints git -C '=spec' switch main, git -C spec switch '=x' and git -C '=ls' switch '=w', and zsh reads each back exactly. The casefold and pasteable files pass on that tree: 129 passed.

5. Unchanged output (check 6). I drove every caller over 2,126 names: _say_in_progress for 7 rows, and move_back_to_pin for 4 outcomes with the name as path and as upstream, 31,890 line sets in all. 31,054 are byte-identical to 450279ca. The other 836 all fall in a named category (a leading =, a NUL, escapes that os.fsdecode reads as another name); none changed otherwise.

6. Mutants (check 7):

   Mutant	Result
   w961's R6	killed by the no-such-codec row
   w961's R8	killed by 2 rows
   w961's I3a (POSIX guard kept)	killed by 3 rows
   O1: = quoted anywhere in the word	killed (a=b and origin/=x rows)
   O2: the ASCII short-cut joined with and	killed (9 failures)
   O4: NUL guard only for a leading NUL	killed (the NUL row)
   O5: the = quote after the printable check	killed (11 failures)
   O3	survives (NIT 2)

7. Base check: the new pasteable file against 450279ca's bootstrap.py: 19 failed and 78 passed, as the body says.

8. Runs at b2887cf5 (check 8):

   • git 2.43.0: the pasteable file, test_bootstrap_non_utf8_branch.py, test_bootstrap_after_bump.py, test_pinned_copy_text.py and the trio: 414 passed, 0 skipped, in 138 s.
   • git 2.47.1: the pasteable file: 97 passed, 0 skipped.

9. Merges (check 9): origin/main has moved to 5f62ea48, re-fetched; it is a standard.py and conftest.py change.

   • with 5f62ea48: clean, tree 25a08498;
   • with 0ef875c0 (the assembly root's validate-manifest.py and bootstrap.py: a path this user cannot read is named, never read as absent, so a scripts/ nobody may search no longer SKIPs every validator into bootstrap ok (#430, slice D) #958): 9ed58bcd;
   • with 45415296 (bootstrap.py: a leg whose HEAD is on a branch that differs from the tracking branch only in case (Main for main) is left where it is, so on a disk that folds case branch -f main no longer moves the ref HEAD stands on (#896) #948): 7d438493, the same trees w961 reported;
   • the three-way merge of main, bootstrap.py: a leg whose HEAD is on a branch that differs from the tracking branch only in case (Main for main) is left where it is, so on a disk that folds case branch -f main no longer moves the ref HEAD stands on (#896) #948 and bootstrap.py: the paste words it prints quote a leading =, are made of the bytes git is handed (UTF-8 on Windows), and the NOT INITIALIZED command names a leg's path as one word after a --, with ./ before a : (#961) #973: clean, as in item 4.

10. Sonar-style checks and the pinned copy (check 10):

    • Complexity by hand: _prints_as_it_is 4, _paste_word 7.
    • Duplication: no repeated run of 4 or more lines in the pasteable file. The after_bump change is a docstring only.
    • Asserts: none added that joins conditions with and.
    • Line length: added lines are at most 78 columns.
    • Import set: the repo_shape import list is unchanged, and test_pinned_copy_text.py passes.

Could not verify

• A real Windows host (only the in-process shims), Git Bash's MSYS argv conversion, and macOS /bin/sh.
• git 2.55 (CI's version), and Sonar's own analyser.
• The body's own probe numbers (3,194 names, 450 mismatches at base, 603 = names). My set differs (2,123 names, 261 = words), with the same 0-mismatch result at head.

Checklist candidates

1. The NOT INITIALIZED line after the assembly root's validate-manifest.py and bootstrap.py: a path this user cannot read is named, never read as absent, so a scripts/ nobody may search no longer SKIPs every validator into bootstrap ok (#430, slice D) #958: git submodule update --init -- {_paste_word(path)}, with tests for my spec, =spec, -spec and sp<0xff>ec.
2. On Windows, compare the stdout bytes with UTF-8, not os.fsencode (NIT 1).
3. A unit row for a filesystem codec that cannot write a printable name, to kill O3.
4. zsh rows skip where /bin/zsh is absent (CI may lack it); the quoted-word test still pins the word.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[brettheap]

Re-check of #973 (#961)'s NOT INITIALIZED change at 2a2bc8f9 (staged on #958), for lane openRepoShape-5: READY

The staged commit meets the condition of my READY on b2887cf5: the NOT INITIALIZED line now prints git submodule update --init -- {_paste_word(path)}. In real scaffolds with local bare remotes I pasted that line through sh, dash, bash and zsh. For every awkward path I tried, it re-initializes the leg at its pin. At the merged base cc779c9c the same paste failed for most of them. The partial fix of my NIT 1 is acceptable. I found no MUST and no SHOULD; there are four NITs.

MUST

None.

SHOULD

None.

NIT

1. A leg path that begins with : still names nothing.

   • Git reads a word starting with : as pathspec magic, and the -- does not stop that. So git submodule update --init -- :spec fails with error: pathspec ':spec' did not match any file(s) known to git (exit 1), and the leg stays empty.
   • I measured it in all four shells, on git 2.43.0 and 2.47.1.
   • It is the same at cc779c9c, so it is not a regression.
   • Each of these re-initializes the leg (exit 0, .git back): -- ./:spec, -- ':(literal):spec', and git --literal-pathspecs submodule update --init -- :spec.
   • The smallest fix would put ./ in front of only a path that begins with :. A follow-up, or a checklist line beside the writer's leading-- candidate, is enough. I did not check what validate-manifest.py says of such a path.

2. The partial NIT 1 fix: acceptable, but the account's "no worse than the base" is not true in every case. I called _paste_word under the account's Windows shims, at cc779c9c and at 2a2bc8f9:

   case	cc779c9c	2a2bc8f9
   default mode, all 6 rows (UTF-8 and cp1252 stdout; café, €5, 日本)	same	same
   legacy mode, UTF-8 stdout, origin/café	"$(printf -- 'origin/caf\351')"	'origin/café'
   legacy mode, UTF-8 stdout, €5	"$(printf -- '\2005')"	'€5'
   legacy mode, cp1252 stdout, origin/café	'origin/café'	"$(printf -- 'origin/caf\351')"
   legacy mode, cp1252 stdout, €5	'€5'	"$(printf -- '\2005')"

   • The two legacy-mode UTF-8 rows are the fix.
   • The two legacy-mode cp1252 rows go the other way. In Git Bash the printf word names another path. The old quoted text pasted correctly from a console that decodes cp1252; it was only wrong where the terminal reads that output as UTF-8 (mintty reading a cp1252 pipe).
   • This case is narrow: it needs PYTHONLEGACYWINDOWSFSENCODING=1 and a stdout that is cp1252, which a Windows console has not been since PEP 528 unless PYTHONLEGACYWINDOWSSTDIO is also set.
   • Keeping it as a checklist candidate is fine. The consistent fix is small: in _paste_word, take the bytes from _handed_to_git(name) instead of os.fsencode(name), and replace the Windows read-back guard with a strict UTF-8 encode.
   • Until then, the module paragraph's "a printf that prints those bytes again" is not true for legacy mode, and the account's "no worse" should read "no worse where the terminal reads the output as UTF-8".

3. Test strength.

   • My mutant R-H, _paste_word(path.strip()), passes all 397 tests of the three changed files: no row has a path with a leading or trailing space. A "spec " row would pin it.
   • The writer edited test_a_legs_path_is_spelled_where_it_is_not_initialized, which keeps an older assert code == 0 and "Traceback" not in err. It could be split while the test is open.
   • None of the added asserts joins conditions with and or or.

4. The account misattributes a commit. It says bootstrap.py: a leg whose HEAD is on a branch that differs from the tracking branch only in case (Main for main) is left where it is, so on a disk that folds case branch -f main no longer moves the ref HEAD stands on (#896) #948 landed as 39694097. 39694097 is bootstrap.py: the name the rename line gives a twin skips one with a branch stored under it, Main-kept over Main-kept/x, which git refuses, so the pasted line works and the next run makes the tracking branch (#1000) #1006 (bootstrap.py: _kept_name skips a -kept name with a branch stored under it, and a test row for a twin with a slash (follow-up of #962) #1000); bootstrap.py: a leg whose HEAD is on a branch that differs from the tracking branch only in case (Main for main) is left where it is, so on a disk that folds case branch -f main no longer moves the ref HEAD stands on (#896) #948 landed as ebbd9fa4. This is in the account only.

What I checked

1. The paste, before and after.

   • Paths: my spec, =spec, ESC, U+2028, the byte 0xff, sp\udcc3\udca9c, sp%s\udcffec, sp'ec, a tab and sp*ec, plus :spec and -spec.
   • Method: the spec leg is moved to the path, emptied with submodule deinit -f, and the printed command is run from the root through each shell.
   • At 2a2bc8f9, 40 of 40 pastes work on 2.43.0 and 40 of 40 on 2.47.1: exit 0, the leg's .git is back, and its HEAD is the gitlink the root's index records.
   • At cc779c9c, the line was --init <spelled>:
     • my spec became two pathspecs;
     • ESC, U+2028, the 0xff byte, the UTF-8-as-bytes path, %s and the tab each named their escape text;
     • sp'ec was a syntax error in every shell;
     • =spec failed in zsh only (zsh:1: spec not found);
     • sp*ec worked only because the shell's glob matched the directory itself.
   • -spec: git ignores that submodule, so deinit did not empty it. The writer's test covers it, and checks that git's stderr names path '-spec'.

2. The rest of the account's NIT 1–3 claims.

   • _handed_to_git is used only in _prints_as_it_is, inside its try. My O3 is killed by the CJK row (NIT 2).
   • The module paragraph names the new command and the names os.fsencode cannot write (NIT 3).

3. Mutants.

   mutant	failed
   N2, no -- (writer's)	17
   W1, the Windows branch dropped (writer's)	2
   O3, the comparison outside the try (writer's)	1
   R-F, _paste_word(spelled(path)) (mine)	8
   R-H, _paste_word(path.strip()) (mine)	survives (NIT 3)

4. Gates at 2a2bc8f9. The account's nine-file set, with the gh stub, GH_TOKEN=bogus, an empty GH_CONFIG_DIR, GIT_SSH_COMMAND=false, GIT_CONFIG_GLOBAL=/dev/null and EMAIL set: 733 passed on 2.43.0 and 733 on 2.47.1.

5. Merges.

   • Clean against the assembly root's validate-manifest.py and bootstrap.py: a path this user cannot read is named, never read as absent, so a scripts/ nobody may search no longer SKIPs every validator into bootstrap ok (#430, slice D) #958's head 5aaeac64 (tree a51964ab, the account's).
   • Clean against current main dbf12e05 (tree 1db338fc). Main has moved past the account's 2d6f928b and now holds bootstrap.py: the name the rename line gives a twin skips one with a branch stored under it, Main-kept over Main-kept/x, which git refuses, so the pasted line works and the next run makes the tracking branch (#1000) #1006.
   • On a predicted merge commit of that tree, the pasteable, unreadable-paths, spelling, create-twins, casefold and pinned-copy files gave 560 passed.

6. Sonar-style checks.

   • Cognitive complexity: _handed_to_git 1, _prints_as_it_is 4, _paste_word 7 and _initialized 2, the last three unchanged.
   • Every added line is at most 79 characters. The changed bootstrap.py lines are ASCII except the em dash that was already in the NOT INITIALIZED sentence.
   • The repo_shape import set is unchanged, and test_pinned_copy_text.py passes.

Reviewer: rv973, lane 5's independent reviewer, not the writer (w961).

Lane: openreposhape-5 (openRepoShape-5)

[brettheap]

Delta check of #973's round 2 at e23137c7 (2a2bc8f9..e23137c7), for lane openRepoShape-5: READY

All four NITs from my re-check are dealt with, and I found nothing new. A leg path that begins with : now pastes and re-initializes the leg in all four shells on both gits. The Windows change regresses nothing in any shim I tried and changes nothing on POSIX. The space rows kill R-H.

MUST

None.

SHOULD

None.

NIT

None.

What I checked

1. The : paste, in real scaffolds with local bare remotes.

   • Method: the spec leg is moved to the path, emptied, and the printed command is run from the root through /bin/sh, dash, bash and zsh.
   • Paths: :spec, :my spec, :sp<0xff>ec, ::spec, :=spec, :-spec, spec , spec, my spec, =spec, sp<0xff>ec and ESC.
   • At e23137c7: 48 of 48 on git 2.43.0 and 48 of 48 on 2.47.1. Each exits 0, the leg's .git is back, and its HEAD is the gitlink the root's index records.
   • The printed words put ./ inside the one word:
     • ./:spec
     • './:my spec'
     • "$(printf -- './:sp\377ec')"
     • ./::spec, ./:=spec and ./:-spec
   • At 2a2bc8f9 (2.43.0), all six : paths failed in every shell, 0 of 24:
     • pathspec ':spec' did not match (and the same for :my spec, :sp\xffec and ::spec);
     • fatal: Unimplemented pathspec magic '=' for :=spec, and '-' for :-spec.
   • The other rows passed there, as designed.
   • Only _initialized takes the ./. The git -C <path> lines name a directory, not a pathspec, so they need none.

2. The Windows change, by in-process shims. I compared _paste_word at 2a2bc8f9 and at e23137c7.

   • POSIX. 143,560 calls, identical at both commits. That covers the real os and a latin-1 filesystem encoding; stdouts in UTF-8, latin-1, cp1252, ascii and an unknown codec; 20 hand-picked names; and every code point from U+0000 to U+2FFF plus every surrogate, each inside a name.
   • Windows default mode (UTF-8 with surrogatepass): only names with a lone surrogate change. They go from a printf word of junk UTF-8 bytes (a\355\263\277b), which named another path, to their spelled text. Everything else is unchanged.
   • Legacy mode (cp1252 with replace): every change goes from a wrong word to the UTF-8 bytes Git Bash reads a paste as.
     • origin/café and €5: the code page's bytes (\351, \2005) become \303\251 and \342\202\254.
     • 日本, U+2028, U+202E and NFD café: these were kept as escape or unwritable text, and now get a correct UTF-8 printf word.
   • bootstrap.py: the merge --ff-only, --continue and --abort lines it prints word a leg's path and an upstream as a shell reads them back, so a byte that is not UTF-8 is a printf and no longer escape text that names no ref (#932) #944's LegacyWindowsOs: the same pattern.
   • Across all three shims, three stdouts and the full sweep, no call at e23137c7 raises.

3. The space rows kill R-H. _paste_word(path.strip()) fails 4 tests: the trailing-space and leading-space rows of the paste test, and of the unreadable-paths test.

4. Mutants: all killed.

   mutant	failed
   the writer's C5, ./ glued in front of the quoted word	2 (leading-colon-and-space, leading-colon-and-byte-0xff)
   no ./	7 (4 shell rows, 3 text rows)
   errors="replace" in the Windows branch of _handed_to_git (mine)	3 (the lone-surrogate rows)
   errors="surrogateescape" there (mine)	3 (the same rows)

   The surrogateescape mutant is only killed because the row's name a\udcffb uses a surrogate in the U+DC80–U+DCFF range, which surrogateescape maps to a byte.

5. Gates at e23137c7. The nine-file set, with the gh stub, GH_TOKEN=bogus, an empty GH_CONFIG_DIR, GIT_SSH_COMMAND=false, GIT_CONFIG_GLOBAL=/dev/null and EMAIL set: 752 passed on 2.43.0 and 752 on 2.47.1.

6. Merges. Clean against main e076e3e8 (tree 2ba475e7) and against the assembly root's validate-manifest.py and bootstrap.py: a path this user cannot read is named, never read as absent, so a scripts/ nobody may search no longer SKIPs every validator into bootstrap ok (#430, slice D) #958's head 5aaeac64 (tree 95d79984); both match the account.

7. Style and Sonar-style checks.

   • No added assert joins conditions with and or or, and the old composite assert is split.
   • No added line is over 79 characters. The two non-ASCII added bootstrap.py lines are older text re-wrapped: the em dash and spéc.
   • Cognitive complexity: _initialized 4, _handed_to_git 1, _prints_as_it_is 4, and _paste_word 6 (down from 7, since the read-back guard is gone).
   • The repo_shape imports are unchanged.

8. Docstrings and account. The module paragraph, _paste_word, _handed_to_git and _initialized now say what the code does, including the ./ and the UTF-8 printf bytes on Windows. NIT 4 is corrected in the account.

Could not verify

The Windows behaviour rests on in-process shims, which is the writer's checklist item 3. A real Windows host, Git Bash's argument conversion and legacy mode itself are unmeasured.

Reviewer: rv973, lane 5's independent reviewer, not the writer (w961).

Lane: openreposhape-5 (openRepoShape-5)

[brettheap]

Restack account: #973 (#961) on #958's landing

Writer w961, lane openRepoShape-5, 2026-10-20. ASCII only.

What was pushed

ref	before	after
fix/961-paste-words (#973's head, origin)	b2887cf5	d286b289f0fa341a50a4779e342dcdb832239a28
wip/l5-961-on-958-20261019 (origin)	e23137c7	unchanged
stage/961-on-958 (local, the worktree's branch)	e23137c7	d286b289

The push was git push origin HEAD:refs/heads/fix/961-paste-words, a fast-forward (b2887cf5 is an ancestor of the new head; the output reads b2887cf56..d286b289f), no force. Read back with git ls-remote: d286b289f0fa341a50a4779e342dcdb832239a28 refs/heads/fix/961-paste-words.

The three merges (each merge --no-ff, identity Brett Heap service@opensoft.dev)

State at the start: origin/main was af0e60f2, the squash of #958, whose parent is 051176ce; fix/430-d-assembly-root-guards was gone from origin (a fetch naming it fails), and my local remote-tracking ref for it was 7c06c578, #958's final head. Both objects were in the repository.

1. the assembly root's validate-manifest.py and bootstrap.py: a path this user cannot read is named, never read as absent, so a scripts/ nobody may search no longer SKIPs every validator into bootstrap ok (#430, slice D) #958's final head 7c06c578 into e23137c7: 42804af0. Clean, no conflict. It is 7e87e05f (which this branch already held) plus two merges of main.
2. the assembly root's validate-manifest.py and bootstrap.py: a path this user cannot read is named, never read as absent, so a scripts/ nobody may search no longer SKIPs every validator into bootstrap ok (#430, slice D) #958's squash af0e60f2: d286b289. Two conflicts, both in the assembly root's validate-manifest.py and bootstrap.py: a path this user cannot read is named, never read as absent, so a scripts/ nobody may search no longer SKIPs every validator into bootstrap ok (#430, slice D) #958's own files, both taken from this branch's side with git checkout --ours:
   • templates/assembly-root/scripts/bootstrap.py (content conflict);
   • tests/test_assembly_root_unreadable_paths.py (add/add: both sides added the file).
     Why --ours is exact: git diff 7c06c578 af0e60f2 is EMPTY. The squash's tree is identical to the assembly root's validate-manifest.py and bootstrap.py: a path this user cannot read is named, never read as absent, so a scripts/ nobody may search no longer SKIPs every validator into bootstrap ok (#430, slice D) #958's final head, and the final head was merged in step 1, so this branch's side holds all of the assembly root's validate-manifest.py and bootstrap.py: a path this user cannot read is named, never read as absent, so a scripts/ nobody may search no longer SKIPs every validator into bootstrap ok (#430, slice D) #958's content plus the assembly root's bootstrap.py: a paste word that begins with = is expanded by zsh, the NOT INITIALIZED line is neither quoted nor a paste word, and _paste_word asks the stdout's codec where git is handed the filesystem's bytes #961's change. The staged result of the merge was checked to be identical to its first parent's tree (git diff --cached --quiet HEAD), and the committed merge's tree equals 42804af0's. The merge message names both paths.
3. origin/main: Already up to date. Main's tip IS the squash af0e60f2 (nothing has landed since; git merge-base --is-ancestor origin/main HEAD is true), so step 2 had already brought in everything main has. No commit was made, and no conflict arose to abort.

The diff check, from objects

git diff origin/main HEAD touches exactly five files, and no other:

• templates/assembly-root/scripts/bootstrap.py
• tests/test_assembly_root_unreadable_paths.py
• tests/test_bootstrap_after_bump.py
• tests/test_bootstrap_pasteable_lines.py
• tests/test_bootstrap_spelling.py

I compared it with git diff 7e87e05f e23137c7, which is this PR's own change on top of #958's head: the commits b2887cf5, 2a2bc8f9 and e23137c7, with cc779c9c's clean merge of #958. (The brief's wording was a base of 450279ca minus #958's part; 7e87e05f is that, exactly, since 7e87e05f is #958's head and nothing of #958 is left in the difference.) The method: both diffs with -U0, the + and - lines kept in file order, hunk headers dropped, since main's line numbers moved.

file	changed lines, S = 7e87e05f..e23137c7	R = origin/main..HEAD	identical, in order
bootstrap.py	109	109	yes
tests/test_assembly_root_unreadable_paths.py	54	54	yes
tests/test_bootstrap_after_bump.py	19	19	yes
tests/test_bootstrap_pasteable_lines.py	483	483	yes
tests/test_bootstrap_spelling.py	25	25	yes

No difference. The file sets are equal, and so are the changed lines of each file. So the restack carries only #973's own change: #958's work on main is not in it, and none of #948's lines (which e23137c7 did not hold and main does) shows up as a change.

The runs

Through run9.sh, with EMAIL=service@opensoft.dev, GIT_SSH_COMMAND=false, GIT_CONFIG_GLOBAL=/dev/null, the gh stub, at d286b289. Files: the pasteable file, test_assembly_root_unreadable_paths.py, test_bootstrap_non_utf8_branch.py, test_bootstrap_after_bump.py, test_bootstrap_spelling.py, test_pinned_copy_text.py, the trio (test_repo_hygiene.py, test_agents_md_codes.py, test_cli_reference.py) and test_adopt_reencoded_files.py.

git	result	log
2.43.0 (/usr/bin/git)	805 passed, 177 s	restack-gate-243.log
2.47.1 ($Q/v115/w764/git247/bin/git)	805 passed, 175 s	restack-gate-247.log

(The nine-file set had 752 at round 2. This run adds test_adopt_reencoded_files.py, and main's changes since then add tests to the files of the set; I did not split the difference.)

What the two rounds did (full account: round-on-958.md, same directory)

• Round 1, 2a2bc8f9: the NOT INITIALIZED line, in _initialized, is git submodule update --init -- <_paste_word(path)>: one shell word after a --, so my spec, =spec, a byte that is not UTF-8 and -spec no longer break. The codec comparison asks _handed_to_git (os.fsencode on POSIX, UTF-8 on Windows). Tests: not_initialized in the assembly root's validate-manifest.py and bootstrap.py: a path this user cannot read is named, never read as absent, so a scripts/ nobody may search no longer SKIPs every validator into bootstrap ok (#430, slice D) #958's file takes the word and six rows run bootstrap; the pasteable file empties a leg with git submodule deinit and pastes the printed command into a shell.
• Round 2, e23137c7: a path that begins with : is printed ./:spec, as git reads a leading : as pathspec magic even after the -- (the paste test runs in sh, dash, bash and zsh). On Windows _paste_word takes its bytes from _handed_to_git too, which is strict UTF-8, so a legacy code page no longer prints another path and a lone surrogate keeps its text; the read-back guard is gone. A path with a space at either end has rows (they kill .strip()), the composite assert in the spelling test is split, and bootstrap.py: a leg whose HEAD is on a branch that differs from the tracking branch only in case (Main for main) is left where it is, so on a disk that folds case branch -f main no longer moves the ref HEAD stands on (#896) #948's landing sha is ebbd9fa4 in the account.
• 45 mutants in round 2, all killed (one, the ./ glued in front of the word, needed two text rows); rv973 found both rounds READY.

The PR body

body-973.md, same directory, is written from my body draft body.md (the version in that directory, which already held the coordinator's edit to its "Left out" section), not from gh pr view 973: I did not run gh at all. It adds items 6 to 8 (the NOT INITIALIZED command, the ./ for :, the Windows bytes), the new test, mutant and run numbers, the restack and the diff check, and "Left out" no longer says the line waits for #958. Its title ends (#961) and is 223 characters; it ends with the pinned-copy sentence and Closes #961. body-guard.py passes on it. It has no Lane or Claim line and no footer.

Left on disk, nothing running

• Worktree /workspace/projects/openRepoShape-worktrees/l5-961-paste-words: clean, on the LOCAL branch stage/961-on-958 at d286b289.
• Scratch clones under /workspace/projects/openRepoShape-worktrees/_lane5-scratch/: w961-base, w961-mut1, w961-mut2, w961-stg.
• Basetemps $Q/v110/bt/w961-rs-*; the logs above under $Q/v118/w961/.
• Local remote-tracking refs for main and fix/430-d-assembly-root-guards (the branch is gone from origin).

Lane 5's check of the restack, from objects: the -U0 changed lines of git diff af0e60f2 d286b289 (over #958's squash) hash the same as those of git diff 7e87e05f e23137c7 (the staged change rv973 found READY, above), and d286b289 is a fast-forward from b2887cf5. So rv973's READY at e23137c7 stands at d286b289, the head that lands.

Lane: openreposhape-5 (openRepoShape-5)

[sourcery-ai]

Sorry @brettheap, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 3 days and 16 hours by commenting @sourcery-ai review. Upgrade to get a review now.