Theo says unveil(2) is supposed to traverse exec(2) (though this seems to be broken or not implemented at present). In which case the commmit message editor would find itself without access to files it needs (startup config files, shared libs, user's home dir, etc.) Apply unveil after the log message has been written.

The previous code only worked if EDITOR contained an absolute path.

this is much easier on the eyes when moving through diffs