bump-leg.py: a root on +x is told push -u origin +x (forced), a branch named like a tag passes bump-leg-on-tracking-branch, bump-leg-root-dirty prints C1 controls raw, and committed <sha>: lists paths the commit lacks #672

Goal: bump-leg.py reads the root's branch the way git spells it, prints a push line that cannot force-push or miss the branch, shows file names the way the other tools do, and says what the commit holds.

Filed by lane openRepoShape-5 on Brett Heap's word of 2026-10-16T12:17:02Z ("#458's update-shape/bump-leg (~22)"), from lines on #458: the body (AT-scaffold N9), 6172776355 (N9's other half), 6175499929 (the dry run), 6214544478 (the raw controls), 6214576643 (the push line) and 6214653267 (the validator's environment). Lane 4 judged the comment lines OPEN, or DOUBTFUL for the validator's environment, on main 95780dd (#473 comment 6215386495); N9 was not in its list. Lane 5 re-measured every line on main 879d804 with a scaffolded project and local bare remotes.

Lands after: #647 (fix/647-branch-left-bump-leg-setup, lane 5's own). It edits scripts/bump-leg.py _switch_command, _branch_to_bump_from and the dry run's closing lines in cmd_bump, which this issue's dry-run and push-line changes sit beside.

Lines (path:line at main 879d804; every measurement below was run on that tree, git 2.43.0)

• The NEXT push line can force-push. scripts/bump-leg.py:1709-1710 prints NEXT git -C <root> push -u origin <branch>, and <branch> is current_branch(root) (:1168) used as it is. Measured: a root on a branch named +x (git accepts the name) bumps with exit 0 and prints ... push -u origin +x. Git reads +x as the forced refspec x: with a local x and origin's x at another commit, the pasted line says + 7dde1f2...6cf8d01 x -> x (forced update) and origin's x is overwritten. (Tracking: update-shape.py and bump-leg.py, keeping a project's shape copies and leg pins current #458's 6214576643, first line; R421 O3.)
• A branch with a tag of its own name is read as heads/<branch>. current_branch (:1070-1074) uses git symbolic-ref --quiet --short HEAD, which prints heads/<b> when a tag has that name (measured: branch v1 with tag v1 gives heads/v1). Measured on a scaffolded root: with a tag main beside the tracking branch main, bump-leg.py is NOT refused bump-leg-on-tracking-branch (the compare at :1176 reads heads/main against main), it commits 78951bc6 on main, and prints NEXT ... push -u origin heads/main: a push to the default branch, the thing the refusal exists to stop. The line's own symptom, error: src refspec v1 matches more than one for a bare git push -q -u origin v1, does not reach bump-leg's line, because the heads/ spelling pushes (git-level: push -u origin heads/v1 exits 0). (Tracking: update-shape.py and bump-leg.py, keeping a project's shape copies and leg pins current #458's 6214576643, second line, bump-leg half; the update-shape.py half is in the issue for apply.)
• bump-leg-root-dirty prints C1 controls and bidi overrides raw. _ensure_root_clean (:1098-1133) shows the dirt as dirt.decode("utf-8", "backslashreplace") (:1126). Measured under core.quotePath=false (an operator's setting; the tool does not set it): a tracked, modified file named caf<U+009B><U+202E>evil.yml is listed with both bytes raw on stderr (od -c: 302 233 342 200 256). With the default core.quotePath git quotes them itself. (Tracking: update-shape.py and bump-leg.py, keeping a project's shape copies and leg pins current #458's 6214544478.)
• The committed line names the paths staged, and the repair case reads X -> X. :1702 prints committed <sha>: + the staged list, :1643 and the commit message body (:1685) print {was[:12]} -> {commit[:12]}, and was is the gitlink (_recorded_leg_commit, :1206). Measured: after a person moves the gitlink by hand to commit 79775b0826f5 (committed, so the root is clean) and the pin still names the old one, bump-leg.py --to 79775b0826f5 prints commit 79775b0826f5 -> 79775b0826f5, writes the same X -> X into the commit message, and prints committed 0eadecf07cce: spec, contracts/spec-pin.yaml, while git show --name-only HEAD lists only contracts/spec-pin.yaml. (The body's AT-scaffold N9; update-shape.py's half is in the issue for apply.)
• A dry run over a pin its validators already refuse exits 0. --dry-run returns at :1666-1678 before any validator runs, and its closing paragraph does not say so. Measured: a note: line followed by a tab-indented line appended to contracts/spec-pin.yaml (committed): validate-pins.py exits 2 yaml-unparsable on the tree as it stands, bump-leg.py --dry-run exits 0 and prints the move, and the real run exits 2 bump-leg-validators-red and rolls back. (Tracking: update-shape.py and bump-leg.py, keeping a project's shape copies and leg pins current #458's 6175499929, last line; bump-leg.py: --dry-run gives the real run's answer, so --to an annotated tag's own id is peeled to the commit it names in both runs, and a pin layout the rewrite refuses is refused by the dry run too (#534, #438) #561 closed the split only for layouts rewrite_pin judges.)

Rides along (backlog; tick it on #458 if the same change covers it)

• run_validator starts the root's own validator with site on and the whole environment. :1000-1018 runs [sys.executable, script] with captured_child_environment() (scripts/shape_materialize.py:256-276: os.environ plus the encoding), where the doctor's children start with -S and without PYTHONPATH (shape-doctor.py:1622-1627, shape-doctor.py: run_validator starts a root's OWN validator under the doctor's interpreter with site processing on, so a .pth in the operator's user site or in a virtualenv's site-packages that names a directory holding repo_shape.py stands in for the copy the root lost, and the manifest row says ok ... passes for a gate that fails in CI on ModuleNotFoundError: the false pass #238 removed and #306 closes for PYTHONPATH alone #342). Measured, so it is not a verdict bug: with the root's scripts/repo_shape.py lost (committed deletion), bump-leg.py reaches the gate (it does not refuse copy-missing first); with PYTHONPATH=<standard>/scripts the gate imports the standard's copy and reports FINDING shape-copy-missing (exit 1), without it the gate dies in ModuleNotFoundError (exit 1): red either way, and validate-pins.py names every pinned copy that is absent, so no shipped validator is let through. The two tools differ in the message only. (Tracking: update-shape.py and bump-leg.py, keeping a project's shape copies and leg pins current #458's 6214653267; lane 4: DOUBTFUL.)

Direction

• Push line and branch read: read HEAD's branch without --short (git symbolic-ref --quiet HEAD, strip refs/heads/), so a tag cannot change the name and the tracking-branch compare sees the real branch, and print the push as a refspec no name can bend: refs/heads/<branch> alone is enough (measured: git push -u origin refs/heads/+x pushes +x unforced and leaves origin's x; refs/heads/v1 pushes beside a tag v1), or R421's refs/heads/<b>:refs/heads/<b> (measured on v1 and x; it sets the upstream). One form for the three tools: update-shape.py has the same line (the apply issue), and family.py's is on Tracking: setup, scaffold, family and the shared helpers, creating projects and families #459. The tests that hold today's form change with it (tests/test_bump_leg.py:235, tests/test_bump_leg_paste_lines.py:279-342), and AGENTS.md:339 and README.md:525 show push -u origin <branch> as a placeholder line, to be kept or matched.
• Raw controls: pass each listed line through spelled from scripts/repo_shape.py (it escapes the C0 and C1 controls, surrogates, line and paragraph separators and the bidi controls and leaves every other character as it is; bump-leg.py already imports from that module).
• committed and X -> X: after the commit, name the paths from git (git show --name-only --format= <sha>) and not the staged list; where the gitlink already holds the new commit, say that and print the pin's own old commit: (read from pin_text) as the old, in the report, the commit message and the commit line. was stays what the rollback restores.
• Dry run: say, in the closing paragraph, that the project's own validators are not run by a dry run and that the real run can still end bump-leg-validators-red, rolled back (recommended; no behaviour changes). Running the validators on the unmodified tree instead would put validate-pins.py's gh api call (make bootstrap, bump-leg.py and update-shape.py apply run the project's own validate-pins.py in the operator's environment, so for a project that pins a neutral product with no local checkout of it each one calls gh api repos/<org>/<product>/git/trees/<sha> with the operator's token, though bump-leg.py says "a project runs its own gate offline" and update-shape.py that "apply is otherwise offline": the three callers #297 named and left #411) into a command whose promise is "fetches into the leg and writes nothing else", and would see only what is already red.
• Validator environment (rides along): one rule with the doctor, -S and no PYTHONPATH, in bump-leg.py's run_validator; or leave it, since no verdict differs.

Overlaps: #647 (above). No open PR touches scripts/bump-leg.py otherwise. update-shape.py's current_branch (:2223) is a copy of this helper under the same name ("named the same as bump-leg.py's own helper"); the apply issue changes that one.

Mark each line → this issue on #458, and tick it there when this closes. The body's AT-scaffold N9 and the --short line carry a second half in the apply issue: tick them when both close.

🤖 Generated with Claude Code