family.py init: --created-by and GIT_AUTHOR_NAME are never asked whether the manifest can hold them, a whitespace-only GIT_AUTHOR_NAME fails after the remote exists, and a --family a Windows disk cannot hold exactly is accepted #688

Goal: init refuses, before any remote or folder exists and under --dry-run alike, every identity or name it cannot write down or lay out, whichever flag or variable supplied it.

Filed by lane openRepoShape-5 on Brett Heap's word of 2026-10-16T12:17:02Z ("#459's family lines (~38)"), from checklist lines on #459 (comment 6214533776, R423 (a) and (b); comment 6192725913, the Windows family-name line). Lane 4 judged the first two OPEN on 95780dd (cluster T9); re-read and probed on d4a7fab.

Lines (line numbers at d4a7fab)

• R423 (a), init asks unwritable_reason of the creator only when git config user.name supplied it. _creator_name (scripts/family.py:1551-1602) calls it only in the if not created_by: branch's else (:1584); --created-by and GIT_AUTHOR_NAME go unasked. Probed on main: init --created-by $'Ada\nLovelace' --dry-run exits 0 and the plan prints created by Ada and then Lovelace on 2026-10-16 on the next line; --created-by holding U+202E exits 0. The scaffold asks its elector whatever the source (_identity, then _refuse_unwritable_values(_elector_named(args), ...)). Direction: ask the creator once, whatever answered, in _creator_name or beside refuse_unholdable_manifest (scripts/family.py:2345), with a remedy that names the flag or the variable that supplied it (CREATOR_UNWRITABLE_REMEDIATION, :1538, speaks of git config user.name alone).
• R423 (b), a whitespace-only GIT_AUTHOR_NAME fails after the remote exists. _creator_name strips the variable (:1575) and goes on to git config user.name, so the manifest is written from a good name, but git commit reads the variable: probed with GIT_AUTHOR_NAME=' ', GIT_COMMITTER_NAME=' ' and a good user.name, a real init exits 2 with fatal: name consists only of disallowed characters after <remote>/Orbit.git and the work directory exist. It predates bump-leg.py, scaffold-project.py and family.py: git status --porcelain and git config user.name are read as bytes, so a file name that is not UTF-8 is bump-leg-root-dirty or the DIRTY warning and a user.name that is not UTF-8 is refused family-unwritable-value naming --created-by, where each ended in a UnicodeDecodeError traceback (#423, #426) #641; scaffold-project.py writes --elected-by, --reference and --name between literal double quotes with no escaping and asks none of them whether a file can hold it, so a line break leaves a project.yaml its own validators refuse, a backslash is recorded as another character (CORP\nick as CORP, a line feed, ick), and a byte that is not UTF-8 dies in write_lf after the legs are pushed #282's body names the scaffold's twin. Direction: refuse it up front, before anything exists, by asking git for the identity the commit will use (GIT_AUTHOR_NAME=' ' GIT_AUTHOR_EMAIL=t@t git var GIT_AUTHOR_IDENT exits 128 with the same fatal: name consists only of disallowed characters, probed) or by naming a blank GIT_AUTHOR_NAME / GIT_COMMITTER_NAME as the cause, as the creator refusal does. The scaffold's twin is a separate line (scaffold-project.py writes --elected-by, --reference and --name between literal double quotes with no escaping and asks none of them whether a file can hold it, so a line break leaves a project.yaml its own validators refuse, a backslash is recorded as another character (CORP\nick as CORP, a line feed, ick), and a byte that is not UTF-8 dies in write_lf after the legs are pushed #282).
• A family name a Windows disk cannot hold exactly is accepted, and then never passes the folder test there. _checked_family_identity (scripts/family.py:1505-1530) takes --family through checked_value (SAFE_ARG_RE, scripts/repo_shape.py:106, which allows a trailing .) and nothing else asks whether the name is a folder Windows can make: a trailing . or space, which Windows drops, and CON, NUL and the other device names. make siblings compares folder.name == family (templates/family-root/scripts/siblings.py:969), and siblings.py and family.py: make siblings asks about the family folder before it clones, clones each member on its tracking branch, and family.py siblings runs the holder's own copy (#543) #578's stop then repeats on every run. shape_materialize._unmountable_reason (scripts/shape_materialize.py:3677) already holds these rules for a leg's mount path. Reasoned, not run on Windows: this host cannot create such a folder. Direction: refuse the --family at init (before anything exists, --dry-run too) with the leg path rule's reason, exposing or calling _unmountable_reason for a single segment; one test row per rule.

Overlaps: none with an open PR. scripts/family.py is not a pinned copy. The existing family-unwritable-value rows are in tests/test_non_utf8_git_reads.py (#426) and tests/test_clone_url_bytes.py (#433); the new rows go beside them.

Mark the three lines → this issue on #459, and tick them there when this closes.

🤖 Generated with Claude Code