[brettheap]

What was wrong

#80 item 7: the two record writes carried the template, not the value. Step 4 of skills/handoff/SKILL.md computes why_text (the operator's why, then the kind's word). Then it writes neither record with it:

LANES_LANE="$lane" LANES_SESSION="$uuid" "$L" log PAUSED "lane:$lane" \
  → "$payload" \
  "on <operator>'s word: <sanitized verbatim>"
...
"$L" append-line "PAUSED — lane $lane, session $uuid@$ws, $(date -u +%Y-%m-%dT%H:%M:%SZ), on <operator>'s word \"<sanitized verbatim>\"; <what's open, or NOTHING CLAIMED>; handoff refreshed"

I ran step 4's own block, as main b707bd7 prints it, against a stub lanes-edit.sh with why="a usage reset". These are the two writes it made:

('log', "on <operator>'s word: <sanitized verbatim>")
('append-line', 'PAUSED — lane repoHS-1, session 0a1b2c3d-…@Eagle, 2026-10-19T01:02:03Z, on <operator>\'s word "<sanitized verbatim>"; <what\'s open, or NOTHING CLAIMED>; handoff refreshed')

lane-handoff is the same act from a shell (Amendment 17(a)). It hands both writes its computed $why_text: lane-handoff L2835 (the log PAUSED call) and L2850 (the append-line) on main 55aae16.

#85, the skill's half: a line break in the why. #218 did three things:

• append-line refuses a CR or LF before it writes.
• lane-handoff refuses a why carrying one right after reading its arguments, before anything is renamed or written.
• lane-handoff's sanitize spells every break ; , as the second line of defence.

The skill did none of these:

• Nothing checked $why.
• Step 4's why_text="$why" sanitized nothing. It did not even replace —, which the step's own prose says it does.

So a why with a break reached step 2's top block, where a --- line ends the prompt lane-start hands the next session. Then both step 4 writers refused it, but only after step 2 had refreshed and committed the handoff. The act ended with a top block and no record behind it.

What changed

All in skills/handoff/SKILL.md:

• A check before step 1. A new paragraph and sh block between the preamble's fence and ## 1. refuse a $why carrying a newline or a carriage return. The refusal exits 2, and nothing has been renamed or written at that point. It uses lane-handoff's own door words ("the why is ONE line", "with '; ' where the break was").
• Step 4 sanitizes the why as lane-handoff's sanitize does. CRLF, a lone CR and a lone LF each become one ; , and so does every —. An empty why is written handoff, as lane-handoff writes it. The kind's word follows, as before. This is the second line of defence: where a break arrives anyway, the record is still written, on one line. Step 4's opening prose now says this.
• Both record writes carry $why_text. Write (a)'s free text is "$why_text". Write (b) is lane-handoff's own register line, word for word: PAUSED — lane $lane, session $uuid@$ws, <UTC>, $why_text; handoff refreshed.

Both writes drop two pieces of template wording, to match lane-handoff's own lines:

• the "on 's word" wording, from both (a)'s free text and (b)'s line;
• the <what's open, or NOTHING CLAIMED> segment, from (b).

lane-handoff's lines never carried either, and nothing in the skill computes a value for the second. What is open is for the handoff's state line to say. The independent review checked that no tool reads either piece: lanes-index, lanes-edit.sh's RULE6_AWK, lane-end's NOTHING CLAIMED scrub (which reads the row's state cell only), lane-start, and append-line's lane_from_text. A grep of the tools on this branch agrees. This is a choice about what the record carries; the alternative is to compute a claims summary in both writers.

Main b707bd7, then 55aae16 (#246), is merged in (merges, never a rebase). #260's sread 15(d) arm, its canon-lane read after step 1's rungs and its whole-string window checks are unchanged, and they still sit in front of step 4's writes. #246 does not touch the skill. Its lane-handoff changes moved the lines the tests cut out (sanitize, the kind-word lines and the register-line template), and each is still found exactly once.

Functions and regions edited:

• skills/handoff/SKILL.md: new paragraph and sh block between the preamble's L=/sread fence and "## 1." (≈L120-139 at the head)
• skills/handoff/SKILL.md: step 4's opening prose paragraph (≈L492-499)
• skills/handoff/SKILL.md: step 4 block, the why_text lines after payload="$payload; kind $kind" (≈L688-703)
• skills/handoff/SKILL.md: step 4 block, write (a)'s free-text argument and write (b)'s append-line text (≈L737, ≈L743)
• tests/test_handoff_skill_80_85.py (new file)

Not touched: sread, step 1's block, the step-4 window block (#260's), and lane-handoff.

Tests

tests/test_handoff_skill_80_85.py, new, 41 cases, in the style of tests/test_handoff_skill_72_80.py. It imports tests/test_skill_shell_blocks.py's fence reader and runs the skill's own blocks under bash and zsh -f. The environment is an explicit dict with a stub lanes-edit.sh that records each call's arguments NUL-separated, a tmux that answers nothing and a date that answers one instant.

• Copilot's review of workBenches#91 against the vendored bytes at f98d734: --dir flag swallows -*, lane-handoff's rename-before-commit and permissive window checks, --lane= accepts empty, and two placeholder leaks in handoff/SKILL.md #80 item 7:
  • Both writes carry the computed why.
  • No write argument is a <placeholder>.
  • No shell block carries the three placeholders.
• Parity with lane-handoff: for seven whys, the skill's log free text and register line equal what lane-handoff's own code produces. That code is its sanitize function, its kind-word lines and its register-line template, all cut out of lane-handoff itself. The seven are a plain why, a —, respawn, in-process, an empty why, a\r\nb\rc\nd — e and a trailing LF.
• append-line proves its one line AFTER writing it, so a lane-handoff --why carrying a newline corrupts LANES.md and leaves the checkout dirty #85, step 4: a\r\nb\rc\nd — e is written a; b; c; d; e kind unknown, and no write is handed a CR or LF.
• append-line proves its one line AFTER writing it, so a lane-handoff --why carrying a newline corrupts LANES.md and leaves the checkout dirty #85, the check:
  • LF, CR, CRLF and a trailing LF are refused with exit 2 and the door words, and nothing after the block runs.
  • A one-line why, a —, an empty why and no why pass silently.
  • Under set -u, an unset why passes the check with nothing said, and step 4, run in the same shell, writes it handoff kind unknown in both writes (added in the fix round).
  • The check opens before ## 1. and before every block whose code renames, publishes, commits or writes.
• Step 4's prose names the line break.

Fail-before / pass-after. Every LANES_*, TMUX* and WORKBENCHES_* variable was unset. Each run was a plain flock "${TMPDIR:-/tmp}/openrepotools-pytest.lock" python3 -m pytest -q -p no:cacheprovider …, started detached with setsid -f.

• Before: main b707bd7 exported by git archive, with this test copied in. Result: 39 failed in 8.22s, every case. 18 assertions show on <operator>'s word: <sanitized verbatim> where the computed why belongs, and 17 find no check block (found 0).
• After: this branch. The six skill and hygiene files gave 385 passed, 1 failed at the merge commit: test_handoff_skill_80_85.py, test_handoff_skill_72_80.py, test_skill_shell_blocks.py, test_handoff_skill_commit_block.py, test_handoff_skill_98_99_100.py and test_repo_hygiene.py. The one failure was this file's door-position case, which matched lane-handoff inside a comment The handoff skill's step-1 fence refuses Amendment 15(d)'s exit 2 instead of reading it as no answer, and its window ref is checked as a whole string (#72 item 8, #80 item 4) #260 added to the preamble's fence. Commit c02e267 makes that case read only the lines that run, and the file then gives 39 passed in 20.06s. Commit 9b80eed moves the test onto test_handoff_skill_72_80.py's Sandbox instead of a copy of it, because SonarCloud's gate counted the copied sandbox as 5.9% duplicated new code (3% allowed). No case changed. With the file at head 9b80eed:
  • this branch: 98 passed in 42.01s for this file, test_handoff_skill_72_80.py and test_skill_shell_blocks.py;
  • main b707bd7 with the file copied in: 39 failed in 10.80s, for the same reasons as above.
• Also run: py_compile on the test, and bash -n on every skill shell block through test_skill_shell_blocks.parse_problems (no problems).

I did not run the full suite locally (the AGENTS.md ruling of 2026-09-16; the box is shared). CI's tests job is the suite of record.

Fix round, after the independent review (LAND at 9b80eed)

• The check now reads ${why-}. case "$why" in stopped a shell running under set -u when the operator gave no why: bash said why: unbound variable and zsh said parameter not set. The paragraph above the block now says that an unset why passes and step 4 writes it handoff, under set -u too. The test's marker for the block is now its refusal text, so the fail-before run finds the old block and shows the real error.
• A new case runs the check and then step 4 under set -u, in bash and zsh -f, with why unset.
• The test docstrings say "RED at b707bd7", where the red run was measured, instead of 5e88a2c.
• This body cites lane-handoff L2835/L2850 on 55aae16, says both writes drop the "on 's word" wording as well as the claims segment, and carries a squash message.
• Main 55aae16 (Make the lane tools look inside a triad's legs and paired feature trees, so the sweep, lane-end's gate, lane-handoff, lane-reconcile and the daily report can see a lane's work there, and change nothing a checkout with no project.yaml does #246) is merged in.

Fix-round runs, each a plain locked pytest started with setsid -f, with every seam unset:

• Before, at the pre-fix head f040eaa (9b80eed with main 55aae16 merged in), exported with this round's test copied in: 2 failed, 39 passed in 19.66s. The two failures are the new case: bash exits 127 with line 9: why: unbound variable, and zsh says why: parameter not set.
• Before, at b707bd7: 41 failed in 11.66s.
• After, at head a7c87c5: 388 passed in 81.90s for test_handoff_skill_80_85.py, test_handoff_skill_72_80.py, test_skill_shell_blocks.py, test_handoff_skill_commit_block.py, test_handoff_skill_98_99_100.py and test_repo_hygiene.py.

Squash message

Title:

The handoff skill's two PAUSED writes carry the why it computed, sanitized as lane-handoff's sanitize does, and a why carrying a line break is refused before step 1 (#80 item 7, #85)

Body:

#80 item 7: step 4 of skills/handoff/SKILL.md computed why_text and wrote
neither record with it. The object log's PAUSED free text was the literal
"on <operator>'s word: <sanitized verbatim>", and the register line carried
that and "<what's open, or NOTHING CLAIMED>". Both writes now carry
$why_text, and the register line is lane-handoff's own line word for word.
So both drop the "on <operator>'s word" wording, and the register line drops
the "<what's open, or NOTHING CLAIMED>" segment, which lane-handoff's line
never carried. No tool reads either: lanes-index, RULE6_AWK, lane-end's
NOTHING CLAIMED scrub (the row state cell only), lane-start and
append-line's lane_from_text.

#85, the skill's half: the skill refuses a why carrying CR or LF before
step 1, with lane-handoff's door words, and reads it as ${why-} so an unset
why passes under set -u. Step 4 sanitizes the why as lane-handoff's
sanitize does: CRLF, CR and LF each become "; ", and so does " — ". An
empty or unset why is written "handoff".

tests/test_handoff_skill_80_85.py runs the check and step 4 under bash and
zsh -f against a stub helper, in test_handoff_skill_72_80.py's sandbox. It
compares both writes with lane-handoff's own sanitize, kind-word lines and
register-line template, cut out of lane-handoff.

Closes #80
Closes #85

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

#80: every item, and what did it

By lane 5's triage, checked against gh issue view 80 --comments (eleven findings: seven in the body, two in each later comment, no others):

item	finding	done by
1	lane --dir swallows a following -*	#220 (be0743b)
2	lane-handoff renames the window before its fallible record writes	#220 (be0743b)
3	lane-handoff's window-id checks are prefix globs	#220 (be0743b)
4	the same prefix glob in the skill's step-4 block	#260 (add5c15)
5	no runtime suite exercises lane-handoff	fcccbe0 (#47): the Amendment 17 section of tests/test_lane_helpers.sh runs $HANDOFF_CMD; recorded in #220
6	lane-handoff --lane= accepts an empty value	#220 (be0743b)
7	the skill's record writes carry placeholders	this PR
8	lane-handoff --writers-file= accepts an empty value	#220 (be0743b)
9	the handoff file write is not atomic	#121 (00971b9): publish-handoff stages beside the target and installs with mv -f; recorded in #220
10	have_tmux does not check the process is inside tmux	#220 (be0743b)
11	a failed tmux rename-window is swallowed	#220 (be0743b)

#85: every part, and what did it

part	done by
append_text_line (and the append-line verb) refuses CR/LF before it writes	#218 (01eff2c)
lane-handoff refuses a why carrying CR/LF at the door; its sanitize flattens CR/LF	#218 (01eff2c)
the issue's test: lane-handoff with a newline in the why leaves the register clean; append-line refuses with nothing written	#218 (01eff2c)
the /handoff skill's copy: refused before step 1, sanitized in step 4 as lane-handoff's sanitize does	this PR

#218 listed the skill's half as the one part remaining for #85, and #85's comments hold only claims.

Closes #80
Closes #85

🤖 Generated with Claude Code

[sourcery-ai]

Reviewer's Guide

The PR fixes the handoff skill’s PAUSED records to carry the actual sanitized why, adds lane-handoff-compatible handling for empty and separator-containing values, and rejects multiline whys before any side effects; a new isolated 39-case test suite validates behavior and parity across supported shells.

Sequence diagram for safe handoff why handling

sequenceDiagram
    participant Operator
    participant HandoffSkill
    participant LaneHandoff as lane-handoff
    participant HandoffState as Handoff state
    participant Records as PAUSED records

    Operator->>HandoffSkill: /handoff [why]
    HandoffSkill->>HandoffSkill: Check $why for CR or LF
    alt multiline why
        HandoffSkill-->>Operator: Refuse with exit 2
        Note over HandoffSkill: No rename or write occurs
    else one-line why
        HandoffSkill->>HandoffState: Refresh and commit handoff
        HandoffSkill->>HandoffSkill: Sanitize why and append kind
        HandoffSkill->>Records: log PAUSED with $why_text
        HandoffSkill->>Records: append-line with $why_text
    end

Loading

Flow diagram for handoff why sanitization

flowchart TD
    A[Read operator why] --> B{Contains CR or LF?}
    B -->|Yes| C[Refuse before step 1]
    B -->|No| D[Replace every  —  with ; ]
    D --> E{Why is empty?}
    E -->|Yes| F[Use handoff]
    E -->|No| G[Keep sanitized why]
    F --> H[Append kind word]
    G --> H
    H --> I[Write PAUSED object log]
    I --> J[Write PAUSED register line]

Loading

File-Level Changes

Change	Details	Files
Adds an early validation gate that rejects multiline or carriage-return-containing whys before any handoff side effects occur.	Checks $why for LF or CR and exits 2 with guidance before step 1. Places the validation before renames, publishes, commits, and record writes. Adds coverage for LF, CR, CRLF, trailing breaks, accepted one-line values, and ordering.	skills/handoff/SKILL.md tests/test_handoff_skill_80_85.py
Aligns step 4's why sanitization and empty-value behavior with lane-handoff.	Flattens CRLF, CR, LF, and — to ; . Uses handoff for an empty why and appends the computed kind word. Tests parity across representative why and handoff-kind combinations under Bash and zsh.	skills/handoff/SKILL.md tests/test_handoff_skill_80_85.py
Replaces record templates with the computed sanitized why in both PAUSED writes.	Passes $why_text to the object-log PAUSED write. Uses the matching lane-handoff register-line format for append-line. Removes unsupported open-work and placeholder fields from the register line. Verifies no write contains template placeholders and compares outputs with lane-handoff.	skills/handoff/SKILL.md tests/test_handoff_skill_80_85.py
Introduces isolated shell-block regression tests for issues #80 item 7 and #85.	Extracts the skill's fenced shell blocks and executes them under Bash and optional zsh. Uses a controlled environment with stubbed helper, tmux, and date commands. Adds 39 regression cases covering writes, sanitization, refusal behavior, prose, and block ordering.	tests/test_handoff_skill_80_85.py

Assessment against linked issues

Issue	Objective	Addressed	Explanation
#80	Make lane flag parsing reject malformed values: prevent lane --dir from swallowing a following spaced -* option and reject an empty lane-handoff --lane= value.	✅
#80	Make the lane-handoff executable safe on failure and validate window identifiers as full matches; add runtime regression coverage for its stateful behavior.	✅
#80	Bring the handoff skill’s copy-pasteable procedure into line with the executable: use full-match window validation, write the computed reason rather than placeholders, and refuse or sanitize line breaks in the reason.	✅
#85	Make append-line reject CR/LF in its text before appending, so a failed validation cannot leave LANES.md modified or dirty.	✅
#85	Make lane-handoff --why handle line breaks without corrupting the register or leaving the checkout dirty.	✅

Possibly linked issues

• Copilot's review of workBenches#91 against the vendored bytes at f98d734: --dir flag swallows -*, lane-handoff's rename-before-commit and permissive window checks, --lane= accepts empty, and two placeholder leaks in handoff/SKILL.md #80: The PR fixes finding 7 by passing computed $why_text to both PAUSED record writes instead of template placeholders.

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sourcery-ai]

Sorry @brettheap, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 1 day and 20 hours by commenting @sourcery-ai review. Upgrade to get a review now.