I believe it would be Dropbox doing the overwrite. Dropbox will just replace data - it doesn't do anything with respect to the reflog. I suppose it might be safer to work on a local copy and push to a second local copy in dropbox, so your working copy isn't touched by dropbox at all.
Yeah, keeping a local copy outside DB and pushing to a bare repo in DB is what I do. It didn't occur to me that one might work directly in a repository in DB. The hazards there, at least, are quite clear!
