Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@internal/config/config.go`:
- Around line 353-355: The ephemeral state path generation in
cfg.Hostname/EphemeralStateDir is taking untrusted hostname input directly into
the temp-directory path, so sanitize or reject invalid hostnames before calling
EphemeralStateDir, or enforce the sanitization inside EphemeralStateDir itself.
Update the cfg.StateDir initialization path to ensure TS_HOSTNAME, flag, or
YAML-provided hostnames cannot contain path separators or traversal segments,
and keep the existing cfg.EphemeralState behavior unchanged.

In `@internal/config/merge_test.go`:
- Around line 826-834: The test helpers in unsetStateEnv and the related
os.Setenv/defer os.Unsetenv path are overwriting any pre-existing environment
values without restoring them, which can affect later tests. Update the
setup/teardown around unsetStateEnv and the affected test case to save the prior
value for each TS_* variable, set or unset as needed during the test, and
register t.Cleanup to restore the original state after the test finishes.
- Around line 865-902: The new tests in
TestStateDirDefaultAutoNoInstanceIsPerUser and
TestAutoInstanceEphemeralStateNotRelative only assert that StateDir is absolute,
so they still allow regressions to the wrong absolute path. Tighten both cases
by asserting the exact expected state-dir contract returned by Merge for the
auto-mode default and the auto-mode with Instance "office", using cfg.StateDir
and the existing setup in unsetStateEnv to verify the precise location rather
than any absolute path.

In `@internal/config/statedir.go`:
- Around line 54-55: EphemeralStateDir currently joins hostname directly, so
path separators or “..” can escape the intended temp sandbox. Update
EphemeralStateDir to sanitize hostname into a single path segment before passing
it to filepath.Join with os.TempDir and appDirName, ensuring the returned
directory always stays under the temp-based state root.

In `@specs/STATE-001-fixed-per-user-state-dir/features.json`:
- Around line 45-49: The verification for STATE-001-f7 only checks a subset of
the documented locations, so update the verification entry in features.json to
cover every doc the acceptance criteria mentions. Expand the existing
verification command used by the STATE-001-f7 feature so it also inspects
site/src/content/docs/getting-started.md and
site/src/content/docs/cli-reference.md in addition to error-state-permissions.md
and configuration.md, ensuring the docs claim is actually enforced.

In `@specs/STATE-001-fixed-per-user-state-dir/verification.md`:
- Around line 24-31: The verification summary is overstating test completeness
because it omits required Go checks and skips race coverage. Update the
documented test status to reflect the repo’s required validation by running and
recording golangci-lint 1.62.2 locally, gosec on all Go source files, and go
test -race -v ./... for the test suite. Make sure the evidence in
verification.md clearly distinguishes completed checks from pending/manual smoke
testing and does not call the work fully green until those required symbols are
covered.

---

Nitpick comments:
In `@internal/config/config.go`:
- Around line 56-60: The fallback warning path in the config logging helper
should use structured slog output instead of writing directly to stderr. Update
the warning branch in the logger helper that currently checks logger nil to
route through a slog.TextHandler-based logger when no logger has been set, so
both the normal and fallback paths stay consistent with SetLogger and the
project’s structured logging standard. Keep the existing warning message and
path context, but emit it via slog rather than fmt.Fprintf/os.Stderr.

In `@internal/config/merge_test.go`:
- Around line 839-955: The new STATE-001 coverage in
TestStateDirDefaultIsAbsolutePerUser,
TestStateDirDefaultAutoNoInstanceIsPerUser,
TestAutoInstanceEphemeralStateNotRelative, and
TestStateDirExplicitOverridePreserved should be consolidated into one
table-driven test. Refactor the cases into a single test function that iterates
over a slice of scenarios and uses t.Run subtests for each, while preserving the
assertions for Merge, StateDir, EphemeralState, and the explicit override
behaviors.

In `@internal/config/statedir_test.go`:
- Around line 45-71: The state-dir platform coverage is incomplete and the test
style should use table-driven t.Run subtests. Update
TestStateDirForPlatform_HonorsPlatformBaseEnv to a table-driven structure with
subtests in stateDirFor, and add the missing Linux case that verifies HOME falls
back to ~/.local/state when XDG_STATE_HOME is unset, alongside the existing
platform/env variants.