Summary

muse blame <file> --range attributes lines to a commit whose own files_modified list does not include that file, and whose blobs for the file are byte-identical to its parent — i.e. the blamed commit provably never touched the file.

Repro

cd ~/ecosystem/musehub
muse blame src/scss/_layout.scss --range 38-41 --json

Returns attribution to sha256:659f09b2a6570076b0ec01897c95ce391467b1a11fb8fa6d3c12e88b2e0e1c77 ("fix: update all list_domains/list_repos callers to cursor pagination API").

muse read sha256:659f09b2a6570076b0ec01897c95ce391467b1a11fb8fa6d3c12e88b2e0e1c77 --json \
  | jq '.files_modified'

[
  "musehub/api/routes/musehub/ui_domains.py",
  "musehub/mcp/dispatcher.py",
  "musehub/mcp/resources.py",
  "musehub/services/musehub_mcp_executor.py"
]

src/scss/_layout.scss is not in that list. Confirming the file content is identical between the blamed commit and its parent:

diff <(muse cat src/scss/_layout.scss --at sha256:659f09b2a6570076b0ec01897c95ce391467b1a11fb8fa6d3c12e88b2e0e1c77) \
     <(muse cat src/scss/_layout.scss --at sha256:9a6e44e84b66174d5e1a275f1d011bb9b100a3bbafc102f7620b36e8db53d1df)
# zero output — byte-identical

Expected

muse blame should attribute each line to the nearest ancestor commit that actually changed it (per its manifest / diff), never a commit whose files_modified excludes the file entirely.

Impact

Blame output cannot be trusted for archaeology (e.g. "why does this rule exist, when was it introduced") — it silently returns plausible-looking but false commit history, which is worse than an error since it's not obviously wrong without independent verification.