The durable sandbox/acl-session event carried a workspace binding that
always equals the session cwd and a random temp path that only needed
to be stable per session. Both are now derived: the temp subdirectory
is sha256(session id + workspace), created exclusively and removed on
provider dispose, so fork/resume semantics fall out of the derivation
and the record, its fold/provision/tamper validation, the immediate
flush kick, and the session-store dependency all disappear.
The battery self-exclusion widens from references/ to the whole skill
directory (SKILL.md quotes the same leaked shapes), and the invocation
rules name the owning note's evidence self-hits; natural-language
battery lines gain -i so sentence-initial capitals hit; the actually/
wait false-positive family states that no committed line probes it.
The one test now says resolvability clears only this skill's bar —
current-state surfaces still reject resolvable change stories; the
never-deletion-alone rule is scoped to passages that carry factual
clauses. The first few-shot Fixed example links the real web
input-machine note path. The citations note's Verification exemption
(+zh, pair re-recorded) names the skill's files and the note's own
quoted evidence, making the claim mechanically honest.
SKILL.md carries the resolvability test, the 8-class taxonomy, the
sanctioned-keeps list, and the owner-first fix workflow; references/
carry 24 few-shot calibration blocks (both citation-boundary directions
plus the four overcorrection traps caught in the purge's review rounds)
and the EN+zh recall batteries with their false-positive families.
dsh-doc-standards' inline leakage probes collapse into a link to the
new skill; dsh-prose-standard gains the sibling pointer; the
committed-artifact-citations note (+zh, pair re-recorded) records the
skill as the operational workflow and exempts its calibration examples
from the battery expectation.
Delete the three §-citation residuals (web-app cordis.patch.yml, two
client design.md §-headers); recast the two CSS used-to narrations and
hmr's four v1 labels as current-state prose; narrow the zh exemption
example to 'this cut' (「本版本」 legitimately renders 'This version');
extend the candidate gate list with the post-battery shapes (§\d with a
committed-owner carve-out, 'used to', bare v1) on both sides and
re-record; honor the over-target ceiling freeze — docs/AGENTS.md
condensed to 1320 and the ceiling restored to 1320.
Restore the ReactNode seats' pending-migration obligation the earlier
rewrite had flipped into a permanent exception; state the merged-PR/issue
evidence allowance in docs/AGENTS.md itself so the citations note defers
to the standard instead of overriding it; rewrite the one current-state
'first cut' fact and record the historical-stage-name exemption (with
indexical stamps still banned); pairs re-recorded.
Purge the residual task/phase ordinals review caught ((T2), (queue cut 1)
×3, T6, P-I, 'this cut' ×6 including battery-expansion finds in two
untouched notes and a workflow JSDoc); drop the 'externally logged as
Decision 21' parenthetical and rename the remaining bare decision-21
mentions; mark the gui-layering IPC bridge row as a hypothetical example;
restore the GATE_NOTICE doc-typecheck clause and the py-types 'measured'
provenance; say subprocess-backed in filesystem.md; add the picker note
path. Amend the citations note: merged-PR evidence anchors in Agent Notes
are sanctioned, and the candidate gate patterns gain the four shapes the
sweep missed. All nine touched pairs re-recorded.
Delete design-session citations (decision/audit/plan ordinals, stack
positions), change narration, review choreography, and reviewer-addressed
justification from comments, JSDoc, docs, READMEs, Agent Notes, tests, and
generator templates; restate every affected fact as current-state contract
prose. Fix generated docs at their sources and regenerate the catalogs and
cordis-surface regions; re-paste type-equiv blocks; update every bilingual
counterpart and re-record the pairs. Record the citation rule in the
committed-artifact-citations Agent Note.
Under read-only and workspace-write the Windows ACL sandbox leaves
programs unable to open named pipes, so a piped-stdio spawn fails with
EPERM. State that boundary in the pwsh tool description next to the
ConstrainedLanguage contract, pin it in the tool tests, and bring the
package README and both implemented Agent Notes current with it.
Huanqi Cao