fix(tooling): isolate git children from ambient GIT_*, and make a shared core.bare flip loud

package.json

@@ -16,7 +16,7 @@
     "clean": "turbo run clean && rm -rf dist",
     "setup": "pnpm install && pnpm --filter @objectstack/spec build",
     "prepare": "node scripts/setup-git-hooks.mjs",
-    "check:merge-driver": "node scripts/git-merge-regen.mjs --self-test && node scripts/check-regen-pending.mjs --self-test",
+    "check:merge-driver": "node scripts/git-env.mjs --self-test && node scripts/git-merge-regen.mjs --self-test && node scripts/check-regen-pending.mjs --self-test",
     "version": "changeset version && node scripts/sync-protocol-version.mjs && node scripts/sync-template-versions.mjs && node scripts/sync-docs-image-tags.mjs && node scripts/sync-release-index-currency.mjs",
     "release": "pnpm run build && bash scripts/build-console.sh && bash scripts/release-publish.sh",
     "docs:dev": "pnpm --filter @objectstack/docs dev",

scripts/check-adr-symbol-anchors.mjs

@@ -83,6 +83,7 @@ import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync
 import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 
+import { gitFreeEnv } from './git-env.mjs';
 import { isEntrypoint } from './invoked-as.mjs';
 import { ANCHOR_GRAMMAR, defineCorpus, sweepCorpus } from './symbol-anchors.mjs';
 
@@ -239,9 +240,15 @@ export function selfTest() {
       'A bogus exemption `src/thing.ts:99` <!-- anchor-exempt: NOPE --> must be found.',
     ].join('\n'));
     write('docs/adr/0003-exempt.md', 'An excused anchor `src/gone.ts:7` <!-- anchor-exempt: HISTORICAL --> is silent.');
-    // the sweep reads `git ls-files`, so the fixture needs to be a repo
-    execFileSync('git', ['init', '-q'], { cwd: tmp });
-    execFileSync('git', ['add', '-A'], { cwd: tmp });
+    /* The sweep reads `git ls-files`, so the fixture needs to be a repo — and
+     * both children get an EXPLICIT, GIT_*-stripped environment (#16624). A
+     * hook exports `GIT_DIR` into everything it runs and that outranks `cwd`,
+     * so an inheriting `git init` here creates nothing and the inheriting
+     * `git add -A` writes THE REPOSITORY's index instead. Measured on this
+     * repo, from `pre-commit`: 8,190 paths staged as deleted, and `core.bare`
+     * written into the SHARED `.git/config`, by a self-test that printed `ok`. */
+    execFileSync('git', ['init', '-q'], { cwd: tmp, env: gitFreeEnv() });
+    execFileSync('git', ['add', '-A'], { cwd: tmp, env: gitFreeEnv() });
 
     const { findings, counts } = sweepCorpus(CORPUS, tmp);
     const kinds = findings.map((f) => f.kind);

scripts/check-scripts-symbol-anchors.mjs

@@ -125,6 +125,7 @@ import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync
 import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 
+import { gitFreeEnv } from './git-env.mjs';
 import { isEntrypoint } from './invoked-as.mjs';
 import { ANCHOR_GRAMMAR, commentProse, defineCorpus, sweepCorpus } from './symbol-anchors.mjs';
 
@@ -362,9 +363,15 @@ export function selfTest() {
       '// A bare path code span `some/abbreviated/spelling.ts` is NOT judged here.',
     ].join('\n'));
     write('scripts/exempt.mjs', '// An excused anchor `src/gone.ts:7` <!-- anchor-exempt: HISTORICAL --> is silent.');
-    // the sweep reads `git ls-files`, so the fixture needs to be a repo
-    execFileSync('git', ['init', '-q'], { cwd: tmp });
-    execFileSync('git', ['add', '-A'], { cwd: tmp });
+    /* The sweep reads `git ls-files`, so the fixture needs to be a repo — and
+     * both children get an EXPLICIT, GIT_*-stripped environment (#16624). A
+     * hook exports `GIT_DIR` into everything it runs and that outranks `cwd`,
+     * so an inheriting `git init` here creates nothing and the inheriting
+     * `git add -A` writes THE REPOSITORY's index instead. Measured on this
+     * repo, from `pre-commit`: 8,190 paths staged as deleted, and `core.bare`
+     * written into the SHARED `.git/config`, by a self-test that printed `ok`. */
+    execFileSync('git', ['init', '-q'], { cwd: tmp, env: gitFreeEnv() });
+    execFileSync('git', ['add', '-A'], { cwd: tmp, env: gitFreeEnv() });
 
     const { findings, counts, declined } = sweepCorpus(CORPUS, tmp);
     const kinds = findings.map((f) => f.kind);

scripts/check-system-context-census.mjs

@@ -213,6 +213,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
+import { gitFreeEnv } from './git-env.mjs';
 import { isEntrypoint } from './invoked-as.mjs';
 import { CORPUS_ROOTS, runCensus, symbolPopulation } from './isystem-census.mjs';
 import {
@@ -1688,15 +1689,14 @@ function fixturePage({ anchor = 'pkg/a.ts#handler', helper = 'pkg/a.ts#isSystemO
  * stripped for the duration of the self-test AND passed stripped to each child
  * here, rather than relying on either one alone.
  *
+ * ⭐ The strip itself now lives in `scripts/git-env.mjs`, so the rule this gate
+ * discovered has ONE spelling for the whole repo rather than a copy per gate
+ * that learns it (#16624). The local copy that used to sit here is gone; what
+ * stays here is the pin below, because the pin is about THIS gate's children.
+ *
  * @param {{ symbol?: string, pad?: number }} shape
  * @returns {{ dir: string, sourceLine: number }}
  */
-function gitFreeEnv() {
-  const env = { ...process.env };
-  for (const key of Object.keys(env)) if (key.startsWith('GIT_')) delete env[key];
-  return env;
-}
-
 function buildRedFirstCorpus({ symbol = 'handler', pad = 0 } = {}) {
   const dir = mkdtempSync(join(tmpdir(), 'system-context-corpus-'));
   mkdirSync(join(dir, 'content', 'docs', 'permissions'), { recursive: true });