docs: empty-repo hardening notes + verification item

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit d771dbf03575bb60e692ede44110ff17c3043f39)

docs/open.md

@@ -76,6 +76,13 @@ zugleich der erste Test dieser Annahme: schlägt einer davon mit einem Deseriali
 
 ## Offene Verifikation (2026-07-27)
 
+- **Empty-Repo-Hardening (2026-07-30)** — Worker/App neu starten (laufende Instanz hat den
+  Fix noch nicht), dann auf dem Task „HEy this is a Test" (Test List → `C:\Dev\TestRepo`,
+  aktuell 0 Commits) „Open ConPTY session" klicken: muss jetzt starten und in `C:\Dev\TestRepo`
+  genau einen leeren Commit „chore: initialize repository (ClaudeDo)" hinterlassen. Idealerweise
+  auch einmal auf dem Zweit-PC gegentesten (dort zusätzlich: Task-Run auf einem PC ohne
+  `git config user.name/email` — Auto-Commit darf nicht mehr scheitern).
+
 - **List handler (2026-07-27)** — visual pass: the Broom button is gone from the lists footer,
   the context-menu item appears only on lists with a working dir, and the selection dialog has no
   LIST column. (Der real-Claude-Smoke-Run der fünf Phasen ist am 2026-07-29 gelaufen — 6/6 sauber

src/ClaudeDo.Data/CLAUDE.md

@@ -80,10 +80,15 @@ dir(s) via an optional `AttachmentStore` ctor param (defaults to the production
 - Merge: ff-only, no-ff, abort, mid-merge detection (`MERGE_HEAD`), conflicted files
 - Revert: `RevertMergeCommitAsync` (`git revert --no-edit -m 1 <sha>`), `RevertAbortAsync`, `IsMidRevertAsync` (`REVERT_HEAD`, mirrors `IsMidMergeAsync`)
 - `PreviewMergeAsync` (non-destructive check via `git merge-tree --write-tree`), `CountChangedFilesAsync`, rev-parse, is-git-repo
+- Empty repos: `HasHeadCommitAsync` (HEAD resolves to a real commit) and `EnsureHeadCommitAsync` — a fresh `git init` repo (unborn HEAD) gets an empty bootstrap commit via plumbing only (mktree/commit-tree/update-ref), so the user's index and working tree stay untouched; identity is passed inline, so it also works with no git config, and a broken HEAD throws instead of guessing
+- Identity fallback: `CommitAsync` retries once as the ClaudeDo identity when the machine has none configured
 
 ⚠️ **Revert never resets or rewrites** — it always produces a new commit, because the working
 directory it operates on is shared with other concurrent sessions.
 
+⚠️ **Git stdin is BOM-less UTF-8** — `Encoding.UTF8` writes a BOM preamble, which git rejects
+as input (`mktree` fails with "input format error", and commit messages would carry it).
+
 ## Schema
 
 Tables (one per line so parallel migrations don't collide on the same line):