From 6d0e54861e607e76fb5f017723c5a51cbacd378a Mon Sep 17 00:00:00 2001
From: Jaret Arnold <96366172+musharna@users.noreply.github.com>
Date: Wed, 2 Sep 2026 13:24:56 -0400
Subject: [PATCH 1/2] fix: .gitignore and CHANGELOG were appended with literal
 backslash-n

The privacy commit (#129) wrote both files through a script whose "\\n" was
the two characters backslash-n, not a newline. .gitignore therefore had one
line that matched nothing, so config/projects.local.yaml -- the file that
holds the real roots -- was NOT ignored (git check-ignore printed nothing).
CHANGELOG gained a second, broken [Unreleased] header. Found by the ~/jobd
session's cat -A. Both rewritten with real newlines; check-ignore now
resolves to .gitignore:32.
---
 .gitignore   | 4 +++-
 CHANGELOG.md | 6 +++---
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/.gitignore b/.gitignore
index 610f9e0..3c10e50 100644
--- a/.gitignore
+++ b/.gitignore
@@ -27,4 +27,6 @@ htmlcov/
 
 # Subagent-driven-development scratch: per-plan ledgers, briefs, review packages.
 .superpowers/
-\n\n# Machine-specific project roots/names; the tracked projects.yaml stays generic.\nconfig/projects.local.yaml\n
\ No newline at end of file
+
+# Machine-specific project roots/names; the tracked projects.yaml stays generic.
+config/projects.local.yaml
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5d1c474..d695201 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,7 +2,9 @@
 
 All notable changes to jobd. Format roughly follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
-## [Unreleased]\n\n### Privacy — tracked config no longer carries real paths
+## [Unreleased]
+
+### Privacy — tracked config no longer carries real paths
 
 - `config/projects.local.yaml` (gitignored, beside `projects.yaml`) now holds
   machine-specific `roots:` and private project names; each entry replaces the
@@ -13,8 +15,6 @@ All notable changes to jobd. Format roughly follows [Keep a Changelog](https://k
   names). `tests/test_no_private_paths.py` fails the suite if a private path, host,
   address or session trailer is ever tracked again.
 
-## [Unreleased]
-
 ## [0.5.42] — 2026-09-01
 
 ### Added

From 5ac356397676d55fc22170670c99db83f9f3135b Mon Sep 17 00:00:00 2001
From: Jaret Arnold <96366172+musharna@users.noreply.github.com>
Date: Wed, 2 Sep 2026 13:27:54 -0400
Subject: [PATCH 2/2] docs: changelog entry moves to a changelog.d fragment

tests/test_changelog_fragments.py requires [Unreleased] to stay empty; the
broken header from #129 had hidden this entry from that test.
---
 CHANGELOG.md                                  | 11 -----------
 changelog.d/privacy-local-overlay.security.md |  1 +
 2 files changed, 1 insertion(+), 11 deletions(-)
 create mode 100644 changelog.d/privacy-local-overlay.security.md

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d695201..2d0e7a1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,17 +4,6 @@ All notable changes to jobd. Format roughly follows [Keep a Changelog](https://k
 
 ## [Unreleased]
 
-### Privacy — tracked config no longer carries real paths
-
-- `config/projects.local.yaml` (gitignored, beside `projects.yaml`) now holds
-  machine-specific `roots:` and private project names; each entry replaces the
-  same-named tracked entry wholesale. Operators must create it on deploy or lose
-  cwd-derived identity for those roots — see docs/projects-yaml.md.
-- The tracked `projects.yaml`, the replay corpus `tests/data/project_cwd_corpus.csv`,
-  tests, plans and docs are pseudonymised (`/home/user/...`, greek-letter project
-  names). `tests/test_no_private_paths.py` fails the suite if a private path, host,
-  address or session trailer is ever tracked again.
-
 ## [0.5.42] — 2026-09-01
 
 ### Added
diff --git a/changelog.d/privacy-local-overlay.security.md b/changelog.d/privacy-local-overlay.security.md
new file mode 100644
index 0000000..050eabf
--- /dev/null
+++ b/changelog.d/privacy-local-overlay.security.md
@@ -0,0 +1 @@
+- **Tracked config no longer carries real paths or private names.** `config/projects.local.yaml` (gitignored, beside `projects.yaml`) now holds machine-specific `roots:` and private project names; each entry replaces the same-named tracked entry wholesale. Operators must create it on deploy or lose cwd-derived identity for those roots (docs/projects-yaml.md). The tracked `projects.yaml`, the replay corpus, tests, plans and docs are pseudonymised, and `tests/test_no_private_paths.py` fails the suite if a private path, host, address or session trailer is ever tracked again.