chore(wolf): checkpoint buglog.json (1000 bugs)

.wolf/buglog.json

@@ -18060,6 +18060,88 @@
       "related_bugs": [],
       "occurrences": 1,
       "last_seen": "2026-08-21T09:37:18Z"
+    },
+    {
+      "id": "bug-1616",
+      "timestamp": "2026-08-21T00:00:00Z",
+      "error_message": "src/tools/test-dirty-fingerprint-nix-production-path.sh: line 191: flag: unbound variable",
+      "file": "src/tools/test-dirty-fingerprint-nix-production-path.sh",
+      "root_cause": "extract_flag_from_json()'s `local json=\"$1\" flag=\"$2\" needle=\"-D${flag}=\"` recurred the exact same-statement `local` cross-reference gotcha already documented as bug-1615 (test-dirty-fingerprint-distinguishability.sh's capture_version()): bash expands every word of a single `local` command before any of that command's own assignments take effect, so `${flag}` in the third word's value expanded against the not-yet-declared `flag`, an unbound-variable error under `set -u`.",
+      "fix": "Split into two separate `local` statements (`local json=\"$1\" flag=\"$2\"` then `local needle=\"-D${flag}=\"` on its own line), with an inline comment citing bug-1615 explicitly so a future reader recognizes the pattern immediately instead of re-discovering it. Confirmed via `bash -n` plus a full real end-to-end script run (exit 0).",
+      "tags": [
+        "bash",
+        "set-u",
+        "local",
+        "unbound-variable",
+        "dirty-content-fingerprint",
+        "task-6.3",
+        "src/tools",
+        "recurring-pattern"
+      ],
+      "related_bugs": [
+        "bug-1615"
+      ],
+      "occurrences": 1,
+      "last_seen": "2026-08-21T00:00:00Z"
+    },
+    {
+      "id": "bug-1617",
+      "timestamp": "2026-08-21T00:00:00Z",
+      "error_message": "mktemp: Invalid argument",
+      "file": "src/tools/test-dirty-fingerprint-nix-production-path.sh",
+      "root_cause": "Used a GNU-coreutils-only mktemp template shape (`.../name.XXXXXX.log`, trailing literal suffix after the X run) assuming GNU mktemp's rule that XXXXXX only needs to be present, with a literal suffix like `--suffix` allowed after it in some historical GNU versions. This sandbox's `mktemp` is BusyBox's implementation, which requires the template to literally END with XXXXXX (no trailing suffix at all, and no `--suffix` flag support either) -- confirmed via `mktemp --help` showing BusyBox v1.36.1's usage text.",
+      "fix": "Dropped the `.log` suffix from the template entirely (`.../xce-dirty-fp-nix-build-A.XXXXXX` with nothing after the X run) rather than reaching for `--suffix` (also BusyBox-unsupported). The isolated worktree's own top-level mktemp template (no suffix) already worked correctly and was the right pattern to copy for the two new build-log mktemp calls.",
+      "tags": [
+        "mktemp",
+        "busybox",
+        "coreutils",
+        "portability",
+        "dirty-content-fingerprint",
+        "task-6.3",
+        "src/tools"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-08-21T00:00:00Z"
+    },
+    {
+      "id": "bug-1618",
+      "timestamp": "2026-08-21T00:00:00Z",
+      "error_message": "error: pathspec 'flake.nix' did not match any file(s) known to git",
+      "file": "src/tools/test-dirty-fingerprint-nix-production-path.sh",
+      "root_cause": "`git -C \"$ISO_DIR\" checkout -- \"$EDIT_FILE_REL\"` used the isolated worktree's ROOT ($ISO_DIR) as the -C directory while EDIT_FILE_REL was just \"flake.nix\" (unqualified), but the edited file actually lives at $ISO_DIR/src/flake.nix -- git resolves pathspecs relative to the -C directory, so \"flake.nix\" alone did not match anything from the worktree root. Unlike the sibling task 6.1/6.2 scripts (which edit README.md directly at the worktree ROOT, where this exact pattern is correct), this script's edit target is one level deeper inside src/, which the copied pattern did not account for.",
+      "fix": "Changed both `git -C \"$ISO_DIR\" checkout -- \"$EDIT_FILE_REL\"` call sites to `git -C \"$ISO_SRC\" checkout -- \"$EDIT_FILE_REL\"` (ISO_SRC = $ISO_DIR/src), so the pathspec correctly resolves relative to the flake's own source directory where flake.nix actually lives.",
+      "tags": [
+        "git",
+        "pathspec",
+        "worktree",
+        "dirty-content-fingerprint",
+        "task-6.3",
+        "src/tools"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-08-21T00:00:00Z"
+    },
+    {
+      "id": "bug-1619",
+      "timestamp": "2026-08-21T00:00:00Z",
+      "error_message": "FAIL: this script itself contains the string '--impure' -- the Observable requires no --impure flag anywhere.",
+      "file": "src/tools/test-dirty-fingerprint-nix-production-path.sh",
+      "root_cause": "The script's own self-check for 'no --impure flag used anywhere' did a blind whole-file `grep -q -- '--impure' \"$0\"`. The script's own header documentation and status messages deliberately discuss '(no --impure)' in prose extensively (to explain the Observable to a reader) -- a false positive against the script's own comments/log strings, not an actual nix invocation using the flag.",
+      "fix": "Narrowed the check to `grep -A2 -E '^[[:space:]]*nix (eval|build|develop|log)\\b' \"$0\" | grep -q -- '--impure'` -- only lines that begin a real nix command invocation (plus 2 following lines, to cover this script's own multi-line backslash-continued invocations), not prose. Verified the narrower grep correctly isolates exactly the script's two real `nix eval`/`nix build` invocation sites and neither contains --impure.",
+      "tags": [
+        "bash",
+        "grep",
+        "self-check",
+        "false-positive",
+        "dirty-content-fingerprint",
+        "task-6.3",
+        "src/tools"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-08-21T00:00:00Z"
     }
   ]
 }