validate-pins.py and repo_shape.py after #919: gh's stderr that is not UTF-8 ends in a traceback, a leg's git directory this user cannot read is called an unresolvable pin with no reason, and two gh details still name the repository raw #968

Goal: the assembly root's validate-pins.py names every state of a pin's leg truly, never ends in a traceback over what gh or git says, and spells every outside text.

Filed by lane openRepoShape-5, from rv919's independent review of #952 (#919) at 8a7671b3 (#952 issuecomment-6253282031): its NITs 1, 3 and 4, and its checklist candidates 1 to 3. #952 landed as 2f5cabf5; this is what it leaves.

State at 2f5cabf5 (scripts/repo_shape.py, templates/assembly-root/scripts/validate-pins.py):

• gh's stderr that is not UTF-8. tree_digest_from_gh (repo_shape.py:1281-1288) decodes gh's output strictly, so one bad byte ends validate-pins.py in a UnicodeDecodeError traceback, exit 1. Measured at 5017830 and at validate-pins.py and repo_shape.py: --root and gh's stderr are spelled, what stands in a pin's, the manifest's or a shape copy's place is named, and a leg's .git gitfile this user cannot open is refused by name (#919) #952's head by w919 and rv919.
• A leg's git directory this user cannot read. Both measured at validate-pins.py and repo_shape.py: --root and gh's stderr are spelled, what stands in a pin's, the manifest's or a shape copy's place is named, and a leg's .git gitfile this user cannot open is refused by name (#919) #952's head:
  • With spec/.git a directory at mode 000, git walks up to the root's own repository, and the run ends REFUSED pin-commit-unresolvable: ... exited 1: with an empty reason, under the lockstep remedy.
  • With .git/modules/spec at mode 000 and the gitfile readable, it ends in fatal: not a git repository, under the same remedy.
• contracts replaced by a regular file. Every pin still reads "does not exist", with the lockstep remedy. This is the same family as validate-pins.py and repo_shape.py: --root and gh's stderr are printed raw, a non-file in a pin's place is called absent, and a leg's .git gitfile at mode 000 passes #919's U178.
• Two gh details name the repository raw. gh-response-unreadable (repo_shape.py:1301-1302) and gh-tree-truncated (:1305-1306) still print {repository} unspelled, where validate-pins.py and repo_shape.py: --root and gh's stderr are printed raw, a non-file in a pin's place is called absent, and a leg's .git gitfile at mode 000 passes #919 spelled gh-unreadable's.
• Untested rules (rv919's NIT 1 and NIT 4):
  • the refusal built with no remedy, not an empty one (validate-pins.py:503): mutant r4 survives;
  • a socket in a pin's place: r2 survives. A socket can be made on Linux by binding to a relative path.

Direction.

• Decode gh's stderr with errors="replace", or spell its bytes. The JSON on stdout stays strict (scripts/shape_materialize.py run() decodes every git and gh message with the locale codec, so a push rejection or any other failure that names a non-ASCII path raises UnicodeDecodeError in place of REFUSED and the ruleset hint under a non-UTF-8 locale, after both leg remotes exist #217).
• Refuse an unreadable .git directory, or an unreadable .git/modules/<leg>, by name as pin-submodule-unreadable, with validate-pins.py and repo_shape.py: --root and gh's stderr are printed raw, a non-file in a pin's place is called absent, and a leg's .git gitfile at mode 000 passes #919's _unreadable_file words and _is_a's errno set.
• Name a non-directory contracts with its own remedy.
• Spell the repository in the two gh details.
• Add tests that kill r2 and r4.

Verify. rv919's probes: $Q-free versions of its 164-case scaffold run, at the base and at the head, beside the current and the pre-#370 repo_shape.py. Every output not named above must be byte-identical.

Overlaps.

• Lane 3's repo_shape.py's YAML reader: a key written twice keeps the last without a word, and a block-scalar line indented less than its block loses its first characters #917 edits repo_shape.py's YAML reader, a different region.
• shape-doctor.py says a skip embeds gh's stderr verbatim (:1765-1767) and calls a copy "pinned but absent" (:9300-9301). Both are now true only of roots older than validate-pins.py and repo_shape.py: --root and gh's stderr are printed raw, a non-file in a pin's place is called absent, and a leg's .git gitfile at mode 000 passes #919. That is lane 2's Every Path.is_file() / is_dir() / exists() guard in the shipped tools answers False to any OSError on Python 3.14 (3.12 and 3.13 raise PermissionError), so a directory this user cannot search reads as ABSENT: validate-pins.py skips its workflow @<sha> check, update-shape.py says copy-missing and update-pin-missing ("adopt the project") for files that are there, the doctor says DRIFTED (5 copy-missing), and bump-leg.py's remaining guards, and every other tool's, skip or misreport instead of refusing by name #430 slice C file, so it is noted here, not changed.
• For lane 1's slice Z parity scan: _not_a_file (validate-pins.py:465-466) tests ELOOP and winerror 1921 directly, to NAME a loop, not to decide that nothing is there.
• Both files are pinned copies, so every project re-pins them.

Size: S.

Milestone: none set; lane 3's call.

Lane: openreposhape-5 (openRepoShape-5)