The shipped-document walk strips every GIT_TRACE* variable (improvise-2iws)

GIT_TRACE, GIT_TRACE2_EVENT and GIT_TRACE_PERFORMANCE are process-wide,
so --local-env-vars lists none of them. Pointed at /dev/stdout, git
wrote trace lines into the ls-files -z output, and the walk read them
as paths. git() now builds on untraced_git(), which removes every
variable starting with GIT_TRACE: a prefix, because the family is
open-ended. The rev-parse --local-env-vars call goes through it too,
since its stdout is parsed as well.

the_walk_ignores_a_git_trace_sent_to_stdout reruns the gzip shape test
and every_shipped_document_loads in children with all three set to
/dev/stdout. It failed at #269's head. Rivals, each of which fails it:
- no strip;
- the exact name only;
- keep GIT_TRACE_PERFORMANCE;
- keep GIT_TRACE2_EVENT.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VdfEGXA7aJ6ftMsCc9PJze

context/test-evidence/tui.md

@@ -655,6 +655,34 @@ Rivals, each dropping one name from `PATHSPEC_AND_ATTRIBUTE_SETTINGS`:
 
 ## `tests/web_demo_model.rs`
 
+### the_walk_ignores_a_git_trace_sent_to_stdout
+
+improvise-2iws. The `GIT_TRACE*` family is process-wide, like improvise-a0i3's
+settings, so `--local-env-vars` lists none of them either. Pointed at
+`/dev/stdout`, git writes trace lines into the `ls-files -z` output the walk
+parses, and they are read as paths. `every_shipped_document_loads` panicked on
+"Cannot open <root>/17:39:40… git.c:502 trace: built-in: git ls-files …".
+`git()` now builds on `untraced_git()`, which removes every variable whose name
+starts with `GIT_TRACE`. It is a prefix match because the family is open-ended.
+The `rev-parse --local-env-vars` call goes through it too, since its stdout is
+parsed as well.
+
+The test re-runs `a_gzipped_document_is_walked` and
+`every_shipped_document_loads` in child processes, with `GIT_TRACE`,
+`GIT_TRACE2_EVENT` and `GIT_TRACE_PERFORMANCE` all set to `/dev/stdout`: one
+child per test, not one per variable, to keep this binary's child count down.
+It failed at #269's head 4cef40c9 for both tests.
+
+Rivals, each injected into `untraced_git` and restored:
+- **no strip**: fails;
+- **strip the exact name `GIT_TRACE` only**: fails. The other two remain, so the
+  prefix is what the test pins;
+- **strip all but `GIT_TRACE_PERFORMANCE`**: fails;
+- **strip all but `GIT_TRACE2_EVENT`**: fails.
+
+The last two show that each variable alone breaks the walk, which is why one
+child per test is enough.
+
 ### every_web_demo_cell_is_settable_except_the_column_a_formula_owns
 
 improvise-bck. The demo document the standalone page opens must be one a visitor

tests/shipped_documents_load.rs

@@ -60,11 +60,11 @@ const PATHSPEC_AND_ATTRIBUTE_SETTINGS: [&str; 5] = [
 /// `git -C root`, with every repo-local variable a caller exported removed,
 /// since `GIT_DIR` and friends override `-C` (improvise-53zz).
 fn git(root: &Path) -> std::process::Command {
-    let names = std::process::Command::new("git")
+    let names = untraced_git()
         .args(["rev-parse", "--local-env-vars"])
         .output()
         .expect("git runs");
-    let mut git = std::process::Command::new("git");
+    let mut git = untraced_git();
     for name in String::from_utf8(names.stdout).expect("UTF-8").lines() {
         git.env_remove(name);
     }
@@ -76,6 +76,18 @@ fn git(root: &Path) -> std::process::Command {
     git
 }
 
+/// `git` with every `GIT_TRACE*` variable removed: one pointed at stdout writes
+/// into what we parse. A prefix, since the family is open-ended (improvise-2iws).
+fn untraced_git() -> std::process::Command {
+    let mut git = std::process::Command::new("git");
+    for (name, _) in std::env::vars_os() {
+        if name.to_string_lossy().starts_with("GIT_TRACE") {
+            git.env_remove(name);
+        }
+    }
+    git
+}
+
 /// A scratch repository, so each way of shipping a document is set up for real.
 fn scratch_repo() -> tempfile::TempDir {
     let dir = tempfile::tempdir().expect("a temp dir");
@@ -305,3 +317,28 @@ fn the_walk_ignores_the_users_pathspec_and_attribute_settings() {
     }
     assert!(failed.is_empty(), "{}", failed.join("\n"));
 }
+
+/// improvise-2iws: a git trace sent to stdout lands in `ls-files -z`'s output
+/// and is read as paths. Evidence: `context/test-evidence/tui.md`.
+#[test]
+fn the_walk_ignores_a_git_trace_sent_to_stdout() {
+    // All three at once, one child per test: each alone breaks the walk, and a
+    // strip of one exact name leaves the other two (the prefix is the point).
+    let stdout = Path::new("/dev/stdout");
+    let traces = [
+        ("GIT_TRACE", stdout),
+        ("GIT_TRACE2_EVENT", stdout),
+        ("GIT_TRACE_PERFORMANCE", stdout),
+    ];
+    for test in [
+        "a_gzipped_document_is_walked",
+        "every_shipped_document_loads",
+    ] {
+        let out = rerun_with_env(test, &traces);
+        assert!(
+            out.status.success(),
+            "{test} under a trace to stdout: {}",
+            told(&out)
+        );
+    }
+}