[brettheap]

What

plan, check and execute refused a --work-dir that is a symlink
round a loop as "making it a directory failed (File exists)". os.mkdir
of such a link fails with EEXIST, the error a file in the way gets, so the
person was told a file is there and found a link. The way out, "Pass a
--work-dir this user can write in", was the one for a folder this user
cannot write in, and said nothing of a link. #963's review (r903) left it
tracked as #978.

_work_root now asks a new _unmade_work_dir why the directory could not
be made. The code stays adopt-work-dir-unwritable, exit 2, and nothing
is made.

• The --work-dir is named as given, made absolute and not resolved. On
  base the reason named os.path.realpath's reading of it, which for a
  link into a loop is another link, a path the person never typed.
• A loop is named only where os.path.realpath left a symlink in the path
  (it follows every other one) and os.stat of that link fails with ELOOP
  (_the_loop_in). So a link to a file, or a long chain of links, is
  never called a loop.
• The way out names the link: the --work-dir itself where it is a
  symlink, else the link in the loop.
• A file at the --work-dir, or above it, keeps the system's words and
  adopt-project.py check: refuse a kept file at the shape's pin path, and an unwritable --work-dir, before any leg exists #524's way out, as the issue asks.
• A dangling link is no loop: realpath reads it as the path it leads
  to, which is made, as on base (the controls below).
• _work_dir_refusal takes the way out as fix=, adopt-project.py check: refuse a kept file at the shape's pin path, and an unwritable --work-dir, before any leg exists #524's by default.
  Names are printed with _spelled. No shell_quoted call is added.

Measured with plan of a local source, <A> the directory that holds the
links, before on 1a47ed07 and after on this head (exit 2 in every row):

--work-dir	Before	After
self, a link to itself	--work-dir `<A>/self` cannot be made: making it a directory failed (File exists)	--work-dir `<A>/self` cannot be made: it is a symbolic link that leads round a loop
a, with a -> b and b -> a	--work-dir `<A>/a` cannot be made: making it a directory failed (File exists)	--work-dir `<A>/a` cannot be made: it is a symbolic link that leads round a loop
into -> a, into that pair	--work-dir `<A>/a` cannot be made: making it a directory failed (File exists)	--work-dir `<A>/into` cannot be made: it is a symbolic link that leads round a loop, at the symbolic link `<A>/a`
through -> loop/sub, with loop -> loop	--work-dir `<A>/loop/sub` cannot be made: making it a directory failed (Too many levels of symbolic links)	--work-dir `<A>/through` cannot be made: it is a symbolic link that leads round a loop, at the symbolic link `<A>/loop`
loop/sub, no link itself	--work-dir `<A>/loop/sub` cannot be made: making it a directory failed (Too many levels of symbolic links)	--work-dir `<A>/loop/sub` cannot be made: the way to it leads round a loop, at the symbolic link `<A>/loop`
tofile -> a-file	--work-dir `<A>/a-file` cannot be made: making it a directory failed (File exists)	--work-dir `<A>/tofile` cannot be made: it is a symbolic link that leads to `<A>/a-file`, which is not a directory
a-file, a file	(File exists)	unchanged
a-file/under	(Not a directory)	unchanged

The way out:

• Before, in every row: "Remediation: Pass a --work-dir this user can
  write in, or none: without one, each run makes a new one."
• After, in the six symlink rows: "Remediation: Remove the symbolic link
  <link>, or make it lead to a directory, or pass another --work-dir, or
  none: without one, each run makes a new one." <link> is <A>/self,
  <A>/a, <A>/into, <A>/through, <A>/loop and <A>/tofile.
• execute still says "no leg repository was created and nothing was
  pushed." first. The two file rows keep the way out they had.

Wider than the issue. The issue asks for the EEXIST case, where the
--work-dir is itself the link. A path that runs through a loop fails
os.mkdir with ELOOP instead, and said only the system's words, with the
same way out for a folder this user cannot write in. It is named the same
way now: --work-dir through and --work-dir loop/sub reach the same
place. So the words tests/test_adopt_clone_claimed.py held for a loop
above the work directory change. That row's point, #650's code
adopt-work-dir-unwritable and not adopt-work-dir-shared, is unchanged.

The comment wording in #963's code

r903's round-2 NITs a-c (#963 issuecomment-6253937080). Comments and
docstrings only.

• (a) _ask_git_branch passes an empty temporary directory as
  --git-dir, which is no repository.
  • adopt-project.py, _checked_flag_inputs: "That question is asked of
    a throwaway repository in the system temp folder, which it removes"
    is now "That question is asked with an empty temporary directory as
    its --git-dir, which plan removes".
  • adopt-project.py, cmd_plan: "runs git check-ref-format in a
    throwaway repository first" is now "runs git check-ref-format first,
    with an empty temporary directory as its --git-dir, which plan
    removes".
  • tests/test_adopt_plan_flag_refusals_first.py, the module docstring:
    "in a throwaway repository" is now "with an empty temporary directory
    as its --git-dir, which plan removes".
  • The same file's
    test_the_branch_a_tracking_branch_names_is_asked_before_the_source:
    "is asked of a throwaway repository in the temp folder ... and it
    removed what it made" is now "is asked of git with an empty temporary
    directory as its --git-dir ... and the directory was removed".
  • "which it removes" in r903's words is "which plan removes" here, so
    that it does not read as git removing it.
• (b) The refusals still made after the source are listed "among
  them", in _checked_flag_inputs' docstring and the test's module
  docstring: a --project of 251 to 255 characters is refused
  unsafe-value after git's reads.
• (c) The naming refusals come "with a remedy about the source where
  it names a repository".

Tests

• tests/test_adopt_work_dir_refusal.py, 53 tests:
  • test_a_work_dir_that_is_a_symlink_loop_is_refused held "(File
    exists)" through mkdir_says. It now holds the new words, for a link
    to itself and for a pair, through plan, check and execute: 6.
  • New: a link into a pair and a link through a loop (6), a path under a
    loop (3), and a link to a file (3), each through the three commands;
    each asserts exit 2, the whole of stderr, no plan written, no leg, and
    nothing made or changed under the test's directory.
  • New: _the_loop_in asked directly, which calls a link to a file or to
    a directory no loop (1).
  • New controls: a dangling link to target-a and to
    missing-dir/target-b, through plan and check, exit 0 and the
    target made (4).
• tests/test_adopt_clone_claimed.py, 42 tests:
  test_a_loop_or_a_file_above_the_work_dir_keeps_its_650_refusal's three
  a-symlink-loop rows hold the new words; its file rows keep the
  system's.
• tests/test_adopt_plan_flag_refusals_first.py: docstrings only.
• Fail on base. With 1a47ed07's adopt-project.py in this head's
  tree, the two changed files: 22 failed, 73 passed. The 22 are exactly
  the adopt-project.py: a --work-dir that is a symlink leading round a loop is refused as "making it a directory failed (File exists)", which names a file in the way and not the loop #978 rows: the 19 in test_adopt_work_dir_refusal.py and the 3
  a-symlink-loop rows. The 4 dangling-link controls pass on both. On
  this head: 95 passed.
• The gate, on this head, one basetemp, EMAIL exported, LANES_LANE
  unset, a stub gh first on PATH, GH_TOKEN=bogus-w978, an empty
  GH_CONFIG_DIR, GIT_CONFIG_GLOBAL=/dev/null and
  GIT_SSH_COMMAND=false, in 17 chunks and 4 shards, each under 9
  minutes:
  • 46 files: the 34 that name adopt-work-dir-unwritable, _work_root
    or work_dir; test_adopt_plan_flag_refusals_first,
    test_repo_hygiene, test_agents_md_codes, test_cli_reference,
    test_readme_windows_quoting_sentence and
    test_scaffold_leg_path_collisions; and the 7 that read
    adopt-project.py's source (test_git_output_decoding,
    test_no_auto_maintenance, test_non_utf8_git_failures,
    test_shape_advisory, test_pinned_copy_text,
    test_openreposhape_package, test_template_values_single_pass):
    3444 passed, 2 skipped, in 17 chunks.
  • test_shape_doctor.py, all 448 tests in 4 shards: 445 passed and 3
    skipped.

Mutants, each applied alone to adopt-project.py, then
tests/test_adopt_work_dir_refusal.py run, then restored by sha256. All
12 killed. They ran on a file that differs from this head's only in two
comment lines ("which plan removes").

Mutant	Failed	Killed by
M1 ELOOP dropped from the errno check	6	through-a-loop, under-a-loop
M2 the same-link branch always taken	6	into-a-pair, through-a-loop
M3 the "is a link" test dropped from the link-to-a-file branch	3	the file AT the --work-dir (keeps File exists)
M4 the way out under a loop names no link	3	under-a-loop
M5 the --work-dir named as realpath reads it	9	into-a-pair, through-a-loop, link-to-a-file
M6 only the last part of the path asked for a link	6	through-a-loop, under-a-loop
M7 no loop ever found	15	every loop row
M8 the link named where its target goes	3	link-to-a-file
M9 the old way out kept	18	every symlink row
M10 _same_entry always false	6	to-itself, a-pair
M11 realpath's reading passed for the path as typed	9	into-a-pair, through-a-loop, link-to-a-file
M12 any link left in the path called a loop, with no ELOOP	1	test_only_a_symlink_that_loops_is_called_a_loop

M12 survives every command-level row: on Linux realpath leaves no link
in the path but one that loops. The direct test of _the_loop_in holds
the guard.

Merge with main

git merge-tree --write-tree of this head with main at eee089ca is
clean (tree 02c1717d). Of this branch's files, only adopt-project.py
moved on main. #1046 changed other functions. #1041 added the
adopt-bad-project-name refusal inside _checked_flag_inputs, below the
docstring and the comment this branch rewords. A --project the naming
policy refuses as well (NUL.git) is still refused only after the
source, and the docstring's list of what comes after the source, read
"among them", stays true. The branch was not merged, and the gate ran on
this head.

Not in this PR

• A link to a path under a file (w -> a-file/sub) still names the path
  realpath reads, <A>/a-file/sub, with "(Not a directory)". True, but
  it does not name the link.
• Not measured on Windows, where a loop is named only if os.stat of the
  link reports ELOOP.

Closes #978

Lane: openreposhape-1 (openRepoShape-1)

🤖 Generated with Claude Code

Summary by Sourcery

Improve work-directory diagnostics so symlink loops and symlinks to files are refused with precise paths and actionable remediation.

New Features:

• Provide clear, actionable refusals for work directories that are symlinks to loops or non-directory targets, naming the relevant link and preserving the user-provided path.
• Continue allowing dangling symlink work directories by creating the directory at their resolved target.

Bug Fixes:

• Correctly distinguish symlink loops and symlinks to files from ordinary occupied or unwritable work directories without changing existing refusal codes or exit status.
• Ensure work-directory refusals identify the original --work-dir rather than an intermediate resolved path.

Enhancements:

• Make remediation messages identify the symlink that must be removed or corrected.
• Clarify comments and documentation about temporary Git directories and the ordering of flag refusals.

Tests:

• Expand coverage across plan, check, and execute for self-referential links, linked loops, paths through loops, symlinks to files, and dangling symlinks.
• Add direct coverage ensuring only links confirmed with ELOOP are classified as loops and verify no files or plans are created after refusal.

[sourcery-ai]

Reviewer's Guide

Improves --work-dir refusal diagnostics by preserving the user’s spelling, identifying symlink loops and symlinks to files, and offering link-specific remediation, with comprehensive command-level and regression tests while leaving ordinary file errors and dangling-link behavior unchanged.

Flow diagram for work-directory refusal diagnosis

flowchart TD
    A[_work_root attempts _made_0755] --> B{Directory creation fails}
    B -->|EEXIST or ELOOP| C[_unmade_work_dir]
    B -->|Other error| D[Keep system error for resolved root]
    C --> E{Symlink loop found by _the_loop_in}
    E -->|Yes| F[Name --work-dir as given and identify loop link]
    E -->|No, work-dir is symlink| G[Name symlink and its non-directory target]
    E -->|No symlink case| D
    F --> H[_work_dir_refusal with link remediation]
    G --> H
    D --> I[_work_dir_refusal with WORK_DIR_FIX]
    H --> J[adopt-work-dir-unwritable exit 2]
    I --> J

Loading

File-Level Changes

Change	Details	Files
Diagnoses failed work-directory creation to distinguish symlink loops, symlinks to files, and existing non-directory paths while preserving existing refusal behavior for ordinary filesystem errors.	Adds _unmade_work_dir to format user-facing details and symlink-specific remediation. Detects the loop symlink left by realpath using _the_loop_in and ELOOP, with _same_entry handling loops at the requested path. Keeps dangling symlinks and regular file/non-directory failures on their prior behavior and system error wording. Allows _work_dir_refusal to receive a custom remediation message.	adopt-project.py
Expands work-directory refusal coverage across all commands and symlink topologies, including controls for non-loop cases and filesystem side effects.	Tests self-loops, paired loops, links into or through loops, paths below loops, and symlinks to files. Asserts precise stderr, exit status, remediation link naming, absence of plans and leg repositories, and no unintended filesystem changes. Verifies dangling symlinks remain usable and directly tests that only ELOOP links are classified as loops.	tests/test_adopt_work_dir_refusal.py
Updates clone-path regression coverage to validate the new loop-specific wording while retaining the existing refusal semantics for files.	Uses shared symlink setup and assertions for loops above the work directory. Confirms loop cases remain adopt-work-dir-unwritable and file cases retain system error wording.	tests/test_adopt_clone_claimed.py
Clarifies comments, docstrings, and test documentation about temporary Git directories and refusal ordering.	Replaces ambiguous 'throwaway repository' wording with the empty temporary --git-dir behavior and its cleanup responsibility. Clarifies that additional naming and validation refusals occur after source processing.	adopt-project.py tests/test_adopt_plan_flag_refusals_first.py

Assessment against linked issues

Issue	Objective	Addressed	Explanation
#978	When creating a work directory fails because the typed --work-dir is a symlink loop, refuse with wording that identifies the loop rather than reporting “File exists,” and provide remediation that mentions removing or mending the link as well as choosing another work directory.	✅
#978	Add coverage for the symlink-loop refusal across plan, check, and execute, while preserving the existing behavior for a regular file in the way.	✅
#978	Address the tracked comment-wording nits: accurately describe the temporary --git-dir, qualify the list of later refusals, and clarify when a naming refusal’s remedy refers to the source.	✅

Possibly linked issues

• adopt-project.py: a --work-dir that is a symlink leading round a loop is refused as "making it a directory failed (File exists)", which names a file in the way and not the loop #978: The PR implements the requested loop-specific refusal and remediation for symlink-loop --work-dir paths; its additional cases do not change the match.

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[brettheap]

(lane openRepoShape-1, 2026-10-20T18:09:18Z) r1065, the independent review of #1065 at a4e179dd: READY on condition that CI tests passes on this head. It found no MUST. The lane rules that S1, S2 and N1-N7 go to a follow-up issue, and that #1065 lands as it is. Its landing pilot waits for tests, gates over the current main, and takes the HOLD only when no lane holds one.

r1065's report, as written:

r1065 review of PR #1065 (closes #978), head a4e179dd

You called a checkpoint, but the review was nearly done when it came. The merged-tree gate was the only run in progress; I let it finish and started nothing new. What is left is at the end. Nothing I touched is still changed: adopt-project.py in my worktree, in the mutant clone (_lane1-scratch/r1065/mut/) and in my pristine copy all read sha256 68d4fda4cb2beec6b304cd0def9cf6d52df5d73f2da2b2e0465801391cd31d8c. The worktree is clean at a4e179dd, and no pytest or helper process is still running.

Verdict: READY on condition. The condition is that CI's tests job passes on this head; it was still pending when I read gh pr checks. SonarCloud, package and tests-git-bash had passed. I found nothing at MUST level. The two SHOULDs are untested guards: each survived a mutant. They can be folded in now or go to a follow-up.

Findings

MUST: none.

SHOULD

• S1. The EEXIST guard on the "link to a non-directory" branch has no test.

  • Where: adopt-project.py:15998, elif link is not None and exc.errno == errno.EEXIST:.
  • Evidence: my mutant R9 drops the errno test and passes all 59 tests.
  • What R9 prints for w -> locked/x, where locked is mode 555:
    --work-dir `<A>/w` cannot be made: it is a symbolic link that leads to `<A>/locked/x`, which is not a directory
  • What head prints there, which is right (base prints the same):
    --work-dir `<A>/locked/x` cannot be made: making it a directory failed (Permission denied)
  • R9 also says "which is not a directory" for w -> a-file/sub, where nothing exists. That is the row the body lists under "Not in this PR", and no test holds it.
  • Fix: add rows to tests/test_adopt_work_dir_refusal.py for w -> a-file/sub and for a link into a folder this user cannot write in. Each should expect the system's words about root, with FIX.

• S2. _same_entry exists for a --work-dir spelled through a symlinked parent, and no test spells one.

  • Where: adopt-project.py:15993 and :16028.
  • Evidence: my mutant R5 compares spellings instead of lstat results and passes all 59 tests. On Linux CI the tests' tmp_path has no symlink in it, so the spelling and the real path always match.
  • Probe: --work-dir <A>/viadir/self, with viadir -> realdir and realdir/self -> self.
    • Head: cannot be made: it is a symbolic link that leads round a loop
    • R5: cannot be made: it is a symbolic link that leads round a loop, at the symbolic link `<A>/realdir/self`, which names the same link twice.
  • Fix: add that case as a parametrised row.

NIT

• N1. On Python 3.12, _the_loop_in can miss a loop.
  • Where: adopt-project.py:16023-16024.
  • Its premise is that the first symlink in root is the looping one. That fails when a link's target has .. after a loop: 3.12's realpath returns <A>/loop/../d/self2 and abspath folds it to <A>/d/self2, leaving d unresolved.
  • Probe: w -> loop/../d/self2, with d -> realdir, realdir/self2 -> self2 and loop -> loop.
    • Head: --work-dir `<A>/w` cannot be made: it is a symbolic link that leads to `<A>/d/self2`, which is not a directory. That is a loop, not a non-directory. The way out still names <A>/w, which is correct.
  • Fix: continue instead of return None after a stat that succeeds. This is my R12; it passes every test and also names this case. Then relax the docstring sentence "So the first symlink in root ... is that one". This is contrived; 3.13 and later resolve d and do not hit it.
• N2. The direct test of _the_loop_in has no dangling-link row.
  • Where: tests/test_adopt_work_dir_refusal.py:298.
  • Mutant R3 survives: it calls any failing stat a loop.
  • Fix: add ("dangling", "missing"), expecting None.
• N3. "Named as given, made absolute and not resolved" is true but no test pins it.
  • Mutant R19 (not made absolute) survives, and prints --work-dir `self` for a relative --work-dir self.
  • Mutant R20 (abspath folds ..) survives.
  • Every test passes an absolute path with no .. in it.
• N4. The fallback naming root is not pinned either. Mutant R11 survives. A row for tofile/sub (with tofile -> a-file) would kill it.
• N5. One contrived wording case.
  • --work-dir <A>/nothere/../self, where nothere does not exist and self -> self.
  • Head says the way to it leads round a loop, at the symbolic link `<A>/self`. As the tool reads it, the path is that link itself, not a way to it.
  • The way out is right. Wording only.
• N6. Windows.
  • _the_loop_in tests only errno.ELOOP. The module itself counts winerror 1921 as Windows' "cannot resolve" (_ABSENT_WINERRORS, adopt-project.py:1704).
  • Accepting winerror == 1921 too would be a cheap hedge. Unverified; the body says Windows was not measured.
• N7. A gap in the body's "Not in this PR" list.
  • --work-dir tofile/sub (a path through a link to a file) still names `<A>/a-file/sub` with "(Not a directory)", as on base.
  • Only w -> a-file/sub is listed. One more bullet would cover it.

Correctness probes, base 1a47ed07 vs head

Every probe ran with the required environment: a stub gh, GH_TOKEN=bogus-r1065, an empty GH_CONFIG_DIR, GIT_CONFIG_GLOBAL=/dev/null, GIT_SSH_COMMAND=false, EMAIL set, and no LANES_LANE. All exit 2 with adopt-work-dir-unwritable, except the exit-0 rows.

These cases name the link and the loop correctly on head:

• a link to itself, with a relative or an absolute target;
• one of a pair, a link into a pair, a three-link cycle, and a chain of 45 links ending in a loop (at the symbolic link `<A>/c0`);
• through -> loop/sub, and paths under a loop (loop/sub and loop/sub/deeper);
• a trailing slash (self/), a relative path (self from inside <A>), and x/../self with x existing;
• a link reached through a symlinked parent (viadir/self, viadir/loop/sub);
• a link into a folder that holds a loop, and a relative target with .. (sub/up -> ../a);
• a non-UTF-8 name (`<A>/\udce9loop`) and a newline in a name (`<A>/nl\nloop`);
• an org/repo --source (refused before any clone).

These are named "which is not a directory", never called a loop: a link to a file, to a FIFO, to a link to a file, to a file in a folder, and a chain of 45 links to a file.

These keep the system's words: a file, a-file/under, w -> a-file/sub, a loop under a mode-000 folder ((Permission denied)), and a link into a mode-555 folder.

These exit 0 and the target is made, on both base and head: dangling links to target-a and to missing-dir/target-b, a link to a folder, and loop/../fresh.

adopt-work-dir-shared and #650's refusals: the diff does not touch _refuse_a_shared_chain or _shared_work_dir. All of test_adopt_clone_claimed.py (42) passes on both head and the merge.

Body claims

Claim	Measured
Base said "(File exists)" or "(Too many levels…)", with #524's way out	true (8 table rows, base)
All eight table rows, the After column (plan)	true, word for word
The same for check and execute; execute says "no leg repository was created and nothing was pushed." first	true
The six symlink rows' way out names self, a, into, through, loop and tofile	true
The two file rows keep their old way out	true
Code stays adopt-work-dir-unwritable, exit 2, nothing made	true (listed() is unchanged, no plan written)
--work-dir named as given, made absolute, not resolved	true (self-rel and dotdot probes); no test pins it (N3)
On base, the reason named realpath's reading, a path never typed	true (into on base names `<A>/a`)
A link to a file, or a long chain, is never called a loop	true (tofile, the 45-link chain to a file, the FIFO)
A dangling link is made, as on base	true (exit 0; target-a and missing-dir/target-b exist)
fix= defaults to #524's way out; _spelled used; no shell_quoted added	true (diff: 0 shell_quoted)
Comment wording (a)-(c), comments and docstrings only	true (_ask_git_branch does use an emptied mkdtemp as --git-dir)
test_adopt_work_dir_refusal.py has 53 tests, test_adopt_clone_claimed.py 42; the breakdown 6+6+3+3+1+4	true (collect-only)
Fail on base: 22 failed, 73 passed, exactly the 19+3 #978 rows; 4 controls pass on both	true
On head: 95 passed	true (all of them passed inside a 184-test head run of 3 files)
Gate: 46 files, 3,444 passed and 2 skipped	file count true (union is 46); 3,446 collected; the pass count was not re-run
test_shape_doctor.py: 445 passed, 3 skipped	true (on the merge)
Merge with eee089ca is clean, tree 02c1717d	true
Only adopt-project.py moved on main; #1046 and #1041 touched other places	true (hunk headers: _root_keeps, follow_ups_for, _checked_flag_inputs below the docstring, and so on)
NUL.git is still refused only after the source	true (a missing source gives source-unresolvable first)
The writer's 12 of 12 mutants killed	my analogues of M1, M2, M3, M5/M11, M4, M6, M7, M9, M10 and M12 are all killed; their per-mutant counts are unverified (my M6 analogue also fails the direct test: 7 in that file, not 6)
Not measured on Windows	unverified

Body hygiene:

• Closes #978 is the only closing keyword, and closingIssuesReferences is [978].
• The keyword scan hit only `fix=`, #524, a code span that GitHub does not take as one.
• The commit messages have no closing keywords. Both commits are authored by service@opensoft.dev and carry Lane and Co-Authored-By lines.
• Docs: no "File exists" anywhere in the docs. docs/cli.md's --work-dir help ("One that cannot be made … adopt-work-dir-unwritable") is still true. README, AGENTS.md and the handbook say nothing that is now untrue.

Base vs head

• Base (1a47ed07's adopt-project.py in a scratch clone of head), the two changed test files: 22 failed, 73 passed. The 22 are exactly the 19 adopt-project.py: a --work-dir that is a symlink leading round a loop is refused as "making it a directory failed (File exists)", which names a file in the way and not the loop #978 rows in test_adopt_work_dir_refusal.py and the 3 a-symlink-loop rows.
• Head, the three test files the PR touches: 184 passed.

My mutants: 17 of 27 killed

Ten survived:

• Real gaps:
  • R5, _same_entry by spelling (S2);
  • R9, the EEXIST guard dropped (S1);
  • R11, the fallback names the typed path (N4);
  • R19, not made absolute (N3);
  • R20, abspath (N3).
• Gap in the direct test only: R3, any failing stat called a loop (N2).
• Equivalent on Linux:
  • R4, the walk goes from the leaf up;
  • R12, continue past a link that does not loop (better in N1's case);
  • R14, the loop question asked for every errno;
  • R23, _same_entry answers True on OSError.

Merge with main

• git merge-tree --write-tree a4e179dd origin/main (main 00f6d7f7) is clean: tree e34476740918.
• Since eee089ca, main changed only family-root files.
• I built scratch commit 7a8c1aa7 in a separate --shared clone and ran:

Files	Result
The PR's 3 test files	184 passed
test_scaffold_leg_path_collisions.py	104 passed
test_cli_reference.py, test_agents_md_codes.py, test_repo_hygiene.py	170 passed
test_shape_doctor.py, 4 shards	118 + 110 + 117 + 100 = 445 passed, 3 skipped (Windows PowerShell only)

Left to review if resumed

1. CI's tests result on a4e179dd (pending at my read).
2. The pass count of the writer's 46-file gate: collected only, not re-run.
3. Python 3.13 and later, which CI's 3.x uses: not run locally. I reasoned that realpath gives the same output for every tested shape, but did not measure it.
4. Windows behaviour (N6).

Scratch files, all under /workspace/projects/openRepoShape-worktrees/_lane1-scratch/r1065/:

• the probe scripts: probe.sh, cases.sh, mksrc.sh;
• the mutants: mutants.py (results in mutants.out) and mutprobe.py;
• the merge gate: merged_gate.py (results in merged_gate.out);
• the clones: basetree/, mut/ and merged/.

Lane: openreposhape-1 (openRepoShape-1)

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sourcery-ai]

Sorry @brettheap, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 1 day by commenting @sourcery-ai review. Upgrade to get a review now.