tests: the non-UTF-8 name and branch tests: one skip helper for a filesystem that refuses probe\udcff, Windows guards on make_file and the --branch a\udcffb case, and the UTF-8 promise and the leg finding's role pinned #663

Goal: a test that needs a file name or a branch holding a byte that is not UTF-8 asks one helper whether this system can carry it, and every claim these tests make is held by an assertion that fails when the code is changed.

Filed by lane openRepoShape-5 on Brett Heap's word of 2026-10-16T12:17:02Z ("#461's test/CI/doc lines (~27)"), from five lines on #461: lane 2's L2-52 (comment) and four lines of lane 4's (R423, two lines; R455, two lines).

Lands after: nothing is needed. If #645's pull request (fix/645-fixture-copy-maintenance-race, tests/conftest.py) is still open when this starts, put the helper in a hunk away from :85 and :137.

Lines (path:line at main 879d8047)

• L2-52, two helpers with one body. skip_where_a_name_cannot_be_not_utf_8 (tests/test_adopt_pins.py:858-871, called at :891) and skip_where_no_file_name_is_not_utf_8 (tests/test_pin_source_unreadable.py:595-608, called at :621) each make probe\udcff under a directory, skip only on EILSEQ, re-raise any other OSError and remove the probe. A change to one will miss the other. Direction: one helper in tests/conftest.py, used by both. It is also what the next two lines call.
• make_file relies on the filesystem refusing caf\udce9.yml (lane 4's R423 N1; lane 4 marks it DOUBTFUL, not run on Windows). tests/test_non_utf8_git_reads.py:86-93 writes the file and skips only on OSError or UnicodeError, while the comment at :71-74 says make_file "skips" there (on Windows). Read, not run: CPython hands a str path to CreateFileW as UTF-16 and NTFS stores a lone surrogate unchecked, so the file is most likely created on Windows, and git for Windows then sees the name through its own UTF-16 conversion. Direction: skip first where os.fsencode makes no single byte of the surrogate (len(os.fsencode("\udce9")) != 1, the test tests/test_bootstrap_branch_bytes.py:388-389 already uses), as POSIX_NAMES (tests/test_adopt_pins.py:818-821) and this file's own POSIX_ENVIRONMENT_ONLY (:390) do; keep the try/except for APFS. Put that first test inside the shared helper.
• The UTF-8 promise is unpinned (R423 N2, mutant R1). scripts/bump-leg.py:1126 reads the dirt as dirt.decode("utf-8", "backslashreplace"); if that were "ascii", every non-ASCII UTF-8 name would print as escapes (café.yml as caf\xc3\xa9.yml) and R423 measured all 47 tests of tests/test_non_utf8_git_reads.py still passing, because test_a_name_that_is_utf8_under_quote_path_false_is_still_refused (:202-217) matches the name's ASCII ends only (:215, for a locale reason that is sound). Direction: add the locale-independent assertion R423 gives: take the stderr line that starts M .github/workflows/caf and assert it holds no literal \x. A locale decode of UTF-8 é never produces one, so the ASCII-ends caution stays. Run the mutant once and see it fail.
• test_a_name_that_is_not_utf8_is_still_carried_and_the_branch_made skips on the disk alone (R455 F1; lane 4 marks it DOUBTFUL, not run on Windows). tests/test_bootstrap_branch_bytes.py:346-357 asks only whether the disk takes probe-\udcff; on NTFS it does, the child gets --branch a\udcffb through CreateProcessW, and _argument_fault rightly refuses U+DCFF there because os.fsencode writes three bytes, so the expected branch a\udcffb created ... line is absent. Direction: call the shared helper first (the os.fsencode test); the file's own emulated test_where_a_surrogate_is_three_bytes_and_no_byte_it_is_refused keeps the Windows half.
• The leg finding's NAME is unpinned (R455 F3, mutant R2: 54 passed). templates/assembly-root/scripts/validate-manifest.py:562-573 names the leg by leg.get('role'); if it named path nothing fails, because the templates' roles equal their paths and tests/test_bootstrap_branch_bytes.py:147-165 only runs spec and code. Direction: a unit test that validator._leg_branch_findings([{"role": "spec", "path": "contracts", "branch": "a\x00b"}]) starts with FINDING manifest-leg-branch: leg 'spec': branch is 'a\x00b', on the module the file's last test loads with load_without_bytecode. Test only: validate-manifest.py is a pinned copy and is not touched.

How to check the Windows guards without a Windows run: the helper takes os.fsencode as a parameter or is called under monkeypatch.setattr(os, "fsencode", ...) with a function that returns three bytes for U+DCFF, as the emulated test above does. Say on the pull request that no Windows run was made (CI is Linux only since #597).

Lane 4's triage. Lane 4 had its four lines here as riders, L4-117 and L4-118 on its T6 and L4-128 and L4-129 on its T2, and has dropped every #461 line from its proposal for lane 5 (#473 comment).

Overlaps. Open PRs: none of the seven open PRs (#621, #627, #628, #630, #634, #639, #656) touches these files. Lane 1's l1-v11-651-adopt-annotated-tag-pin edits tests/test_adopt_pins.py at :116-142 and :649-667 (the helper is at :858-871, no overlap). Lane 5: fix/645-fixture-copy-maintenance-race edits tests/conftest.py.

Mark each line → this issue on #461, and tick it there when this closes.

🤖 Generated with Claude Code