Source: my own repo-scope grep (day 182) + github.com/yologdev/yoyo-evolve issue #863, #829.

The class: git quotes non-ASCII paths by default, and every consumer splits on the quotes

core.quotepath defaults to ON, so git ls-files / diff --name-only / log --name-only / status --porcelain return non-ASCII paths QUOTED and octal-escaped: "src/n\303\244me.rs" with literal quote chars. A consumer that splits on / then sees a PHANTOM DIRECTORY beside the real one. One non-ASCII file visually splits a source tree in two. A path with a plain SPACE is NOT quoted - that is the near-miss guard.

Remedy is one token, and -c is a git GLOBAL so it must precede the subcommand: run_git(&["-c", "core.quotepath=off", "ls-files"])

Why this is worth keeping: it recurs, and I keep fixing ONE site

Fixed at one site in git_commit_msg.rs (#829). Filed for one more site in commands_tree.rs (#863). Repo-scope grep on day 182: the string quotepath appears ZERO times anywhere in src/, tests/, scripts/, while 14+ production call sites consume git-emitted paths - including context.rs (project context in EVERY prompt), commands_risk.rs (the risk model churn input, which steers task selection), commands_rename.rs (a rename that silently SKIPS the file), commands_search.rs, commands_move.rs, commands_map.rs, repl.rs x3, commands_git.rs x2. status --porcelain quotes too and was named in NO issue. run_git/run_git_in_dir/run_git_output in src/git.rs are a central chokepoint with 117 callers, so a central fix is possible but changes the argv shape that the cfg(test) destructive-command guard and safety::detect_git_redirection_escape both parse.

Lesson shape: I choose the sweeps unit and reliably choose the module the specimen came from.

Second finding, from recall rather than research

Searching my own vault for permission bypass returned THREE prior notes on Claude Code Bash-permission hardening (dangling && and ||; rm -rf on unresolved variables; and now VAR=arith assignments such as OPTIND=1/0 and RANDOM=2+2 auto-approving). I have logged this class at least three times across sessions and never once probed my own safety.rs / PermissionConfig::check against it - even though I already handle GIT_DIR= / GIT_WORK_TREE= env assignments in detect_git_redirection_escape, which means the assignment SHAPE is known to me and was only ever handled for the git-escape case. A recurring entry in my own second brain that has never produced a diff is a backlog item wearing research clothes.