Non-blocking review findings from PR #66 (2)

[twistedmelonman]

Non-blocking concerns raised while reviewing PR #66 (docs: gh JSON/jq guide, and work logs on the dotfiles issue).

None of these blocked the merge. They are batched into one issue so a
review's findings stay one unit of attention rather than 2 separate
tracking issues; tick items off as they are addressed, and close this issue
when the list is done or the remaining items are judged not worth doing.

• Handoff doc records a causal conclusion that the follow-up response doc supersedes (PR content self-conflict (2026-08-25-dotfiles-config-contamination-response.md, Corrections to the handoff), docs/2026-08-24-dotfiles-config-contamination-handoff.md)
  The response document explicitly lists six handoff claims as False, Incomplete, Insufficient, Misleading, or Unsupported — including the worktree timeline and the proposed git -C repair. Both documents are merged side by side with no pointer at the top of the handoff directing a reader to the newer analysis. A future reader who opens only the handoff will act on the superseded conclusion, in particular the git -C "${dir}" remediation that the response shows does not override an inherited GIT_DIR. Suggested action: add a one-line superseded-by banner at the top of the handoff doc linking to the response doc.

• Remediation for dotfiles config contamination is documented but not yet implemented (2026-08-25-dotfiles-config-contamination-response.md (Recommended remediation), general — smartwatermelon/dotfiles, bash/tests/)
  The response doc specifies five remediation items against smartwatermelon/dotfiles: sanitize Git environment variables in fixture tests, add an inherited-GIT_DIR regression test, add the missing core.bare assertion to test-git-config-hygiene.sh, retain the chflags uchg tripwire, and consider a post-suite config integrity check. This PR lands the analysis only; the dotfiles repo is untouched. Until item 1 ships, the contamination can recur and silently disables the local review hooks that would detect it. Suggested action: track these against dotfiles .git/config was contaminated with test-fixture values; cause unknown twistedmelonman/dotfiles#239 so the reopened issue carries the actionable work.

[twistedmelonman]

Triaged both findings. One is fixed in #73; the other is largely already shipped in dotfiles.

67.1 — no superseded-by pointer on the handoff: FIXED in #73. Banner added at the top of docs/2026-08-24-dotfiles-config-contamination-handoff.md, linking to the response doc and calling out the git -C "${dir}" correction specifically.

67.2 — the five dotfiles remediation items: 3 of 5 already shipped. Verified against current smartwatermelon/dotfiles main:

#	Item	Status
1	Sanitize Git env vars in fixture tests	DONE — isolate_git_env is used across the fixture tests (test-gh-wrapper-draft-off-org.sh, test-git-wrapper-init-hook.sh, test-gpush-wrapper-guard.sh, test-install-worktree-guard.sh, test-post-checkout-*.sh, and others)
2	Inherited-GIT_DIR regression test	DONE — bash/tests/test-git-env-isolation.sh
3	core.bare assertion in test-git-config-hygiene.sh	DONE — :165-184
4	Retain the chflags uchg tripwire	not re-verified this session
5	Post-suite config integrity check	still open (was "consider", not a commitment)

Item 2 is worth calling out: test-git-env-isolation.sh includes a control case that deliberately reproduces the contamination first and fails loudly if it stops reproducing —

_fail "control did not contaminate — the injected GIT_DIR condition is no longer reproducing, so the guarded cases below prove nothing"

That is the right shape for this class of test. A green run cannot be vacuous, which is exactly the failure mode that made the original incident hard to catch.

Leaving this issue open for items 4 and 5.