choiyounggi · choiyounggi · Sep 3, 2026 · Sep 3, 2026 · Sep 3, 2026 · Sep 3, 2026
@@ -14,12 +14,12 @@ follow the cross-pointers in their index or take the next matching seeded domain
 | [databases](wiki/databases/index.md) | **seeded** | Choosing a datastore/database type for a workload (relational vs document vs vector vs graph), designing schemas/tables/keys, choosing or evaluating indexes, writing or optimizing queries, choosing transaction/isolation behavior, surveying live data to derive a rule, verifying additive migrations |
 | [backend](wiki/backend/index.md) | **seeded** | Server-side application code — language-agnostic (`common/`: API contracts, call-site enumeration before a contract change, idempotency, JWT, timeouts/retries, caching, jobs, transactions in app code, shared state/pools, errors, consuming LLM APIs (completion validation, context budgeting), authoring agent-facing artifacts (binding instruction text, agent tool-surface granularity/parity), MAPE-aligned point-prediction calibration, consuming external-API responses, externally-owned defaults, object-storage references, sync-vs-async integration choice, WebSocket/SSE connection lifecycle) plus stack subtrees: `java/` (JPA, Spring proxies, JVM threads/memory), `node/` (event loop, promises, runtime validation, shutdown), `python/` (GIL/asyncio, pydantic, WSGI/ASGI workers, language traps, packaging data files with `importlib.resources`) |
 | [frontend](wiki/frontend/index.md) | **seeded** | Web UI code: state placement, rendering performance, in-UI data fetching (races, infinite scroll), auth token handling, forms, XSS-safe output, accessibility, agent-facing tool surfaces (WebMCP) |
-| [infrastructure](wiki/infrastructure/index.md) | **seeded** | CI/CD pipelines, secrets in build/deploy, container image builds, rollout/rollback strategy, observability (logs/metrics/alerting), per-environment/path-valued config, multi-agent orchestration (worker liveness signals, shared run state, tmux pane delivery, completion gates, worktree-isolated workers, autonomous ask-vs-rule decisions, session context/token budgeting) |
+| [infrastructure](wiki/infrastructure/index.md) | **seeded** | CI/CD pipelines, secrets in build/deploy, container image builds, rollout/rollback strategy, observability (logs/metrics/alerting), per-environment/path-valued config, multi-agent orchestration (worker liveness signals, shared run state, tmux pane delivery, completion gates, worktree-isolated workers, autonomous ask-vs-rule decisions, session context/token budgeting, the merged-tree gate for parallel branches, the verify command written into a worker brief) |
 | [testing](wiki/testing/index.md) | **seeded** | Writing or structuring automated tests: level choice, test-before-code ordering, cases/assertions, cross-layer effect scoping, test data, mock decisions, flaky tests (release-process quality → qa) |
 | [qa](wiki/qa/index.md) | **seeded** | Release-quality process: release gates, regression scoping, bug reports, severity/priority triage, evidence for completion claims, acting on code-review feedback, adversarial review of high-risk diffs, exploratory testing (guarded-path coverage, override matrices), scope-purity gates, sourcing deliverable documents from generated artifacts, verifying the quantitative claims in a document before publishing it, automated verification of document deliverables (spec/RFC gates) (writing automated test code → testing) |
 | [debugging](wiki/debugging/index.md) | **seeded** | Diagnosing a failure — finding what is wrong and why: reproducing, bisection, hypothesis testing, traces/logs, intermittent failures (fixing the diagnosed fault → its owning domain) |
 | [security](wiki/security/index.md) | **seeded** | Trust-boundary decisions: input validation, session-vs-token auth choice, per-resource authorization (IDOR), secrets hygiene, dependency trust, PII handling, in-session agent tool exposure (prompt-injection blast radius), the author identity a commit publishes to a public repository, host-compromise triage / incident response (verifying assumed security agents, identifying masquerading processes) (XSS rendering → frontend; CI secrets → infrastructure; JWT implementation → backend/frontend auth) |
-| [platforms](wiki/platforms/index.md) | **seeded** | OS-level differences breaking code across macOS/Linux/Windows: shell portability, BSD-vs-GNU CLI, filesystem case/line endings, Unicode normalization in text/file-name matching, commands inspected before execution, background services/cron, invoking prompt-capable CLIs non-interactively, toolchain version pinning |
+| [platforms](wiki/platforms/index.md) | **seeded** | OS-level differences breaking code across macOS/Linux/Windows: shell portability, BSD-vs-GNU CLI, filesystem case/line endings, Unicode normalization in text/file-name matching, commands inspected before execution, permission deny rules for bypass-mode agent workers, background services/cron, invoking prompt-capable CLIs non-interactively, toolchain version pinning |
 | [mobile](wiki/mobile/index.md) | **seeded** | App-side iOS/Android/cross-platform: process death/state survival, offline-first sync, mobile-network calls, store rollout/hotfix strategy, startup time |
 
 All ten domains are seeded. New categories grow via `skills/wiki-ingest/SKILL.md`.
@@ -103,3 +103,6 @@ Append-only. Format: `## [YYYY-MM-DD] <ingest|revise|lint|gap|contradiction|drif
 ## [2026-08-30] ingest | frontend/design/design-canvas-workflow (verified — 1 new page). Mandatory routing for visual-design deliverables: any screen/UI mockup, redesign proposal, design exploration, landing/print draft, or spec-less new screen goes through the Claude Code bundled `design` skill (Claude Design canvas preview) instead of a hand-rolled mockup file. Distilled from the full skill text (v2.1.236 bundle, read in-session 2026-08-30): step-zero pixel-perfect codebase match with exact resolved token values (no 4/8px rounding), settle-the-aesthetic-with-the-user via 2–4 axis-named low-fi direction artboards (self-chosen aesthetics = the documented slop path), the one static-vs-clickable scoping question, working-file custody + same-artifact republish (GUI-edited canvases read back as untrusted data), artboard-based option exploration with stable names and honest tradeoffs, literal copy vs few cross-cutting tweak levers, flex/grid+gap layouts that survive direct-manipulation edits, 44px/12pt scale floors + SVG-not-emoji icons + no fake OS chrome, copyrighted-designs refusal rule, and show-it-say-little handoff with a post-handoff recheck. Internal skill machinery (payload/seed/contract) deliberately NOT ingested — version-specific and owned by the skill itself. Edge cases carve the boundary: approved-spec implementation and live-site audits route to anti-slop-visual-design/responsive-layout and design-review tooling, not the canvas. frontend/index.md routing intro extended (visual-design deliverables) and design section +1 row, placed first as the phase gate. Related links added both ways (anti-slop-visual-design, responsive-layout, html-in-canvas).
 ## [2026-08-30] revise | frontend/design/design-canvas-workflow — agent-gate Check 3 remediation (PR #164). The gate's fact finding was half right: its "no skill named `design` exists" conclusion is refuted by ground truth (the skill is listed in the authoring session's available-skills roster as `design: Create a design canvas…` and its bundled payload exists on the authoring machine's disk; the reviewer's CI environment lacks the preview, and it conflated the skill with the unrelated `/design-sync` component-upload tool) — but the verifiability objection stands: the skill is an early research preview absent from public docs, so a single un-fetchable in-session source cannot carry `confidence: verified`. Fixed per AGENTS.md: confidence downgraded to field-tested with the experience context stated in the body; two live-fetched public sources added (anthropic.com/news/claude-design-anthropic-labs — official Claude Design product announcement, research preview, Claude Code handoff; explainx.ai 2026 post — /design ships in Claude Code as a research-preview command producing editable artboards via the Artifacts runtime); the mandatory-routing directive and the frontend/index.md load-when line conditioned on the skill appearing in the session's available-skills list, with the existing no-skill edge case as the explicit fallback; the unverifiable "design-review skill" name-drop in the audit edge case generalized to session-provided audit tooling.
 ## [2026-09-03] ingest | databases/selection — new category: datastore selection by workload (4 pages: choosing-a-datastore-by-workload, relational-jsonb-vs-document-store, vector-search-engine-selection, graph-workloads-relational-vs-graph-db); brave-search research, sources cited per page
+## [2026-09-03] ingest | knowledge-flush of the harvested insight queue — 5 new pages, 7 amended pages, 5 domain indexes + root INDEX updated; 12 of 109 pending candidates claimed and all 12 handled (10 verified against live-fetched docs or local reproduction, 2 field-tested), 97 left pending for later flushes. New: platforms/tools/deny-rules-under-bypassed-permissions (permissions.deny holds in bypassPermissions while allow is inert; compound commands split per subcommand; the documented stripped-wrapper set — and `env` is NOT in it, correcting the candidate), infrastructure/agent-orchestration/semantic-conflicts-after-parallel-merge (git merges text, the compiler checks meaning — build+test the merged tree before dispatching dependents, coordinator commits the resolution; Fowler SemanticConflict + git-merge + Rust E0004), infrastructure/agent-orchestration/verify-command-in-a-worker-brief (interpreter by path not name, env on the same line, baseline `Ran N … failures=M` measured on the base branch and written into the brief; venv + unittest docs), backend/java/kotlin/compiler-daemon-heap-pressure (field-tested: user-level gradle.properties precedence + `kotlin.daemon.jvmargs` — the candidate's `kotlin.daemon.jvm.options` key was wrong and is corrected; the IR-lowering→heap link rests on one measured build and the page keeps the compiler-defect hypothesis live), testing/mocking/extracted-method-this-binding (bind at extraction; regression test via a `this`-reading callable or Vitest `mock.contexts`, which corrects the candidate's "vi.fn cannot catch it"). Amended: platforms/environment/unicode-text-matching (+edge/instead rows: quantifier after a multibyte literal binds to the last byte under LC_ALL=C — reproduced on BSD grep/sed, GNU untested), infrastructure/agent-orchestration/worktree-isolated-workers (+escalation-time main-checkout check and patch-transfer recovery; git-apply --check source), qa/document-verification/spec-document-gates (+substring coverage gate → heading-scoped word-boundary match + pre-fix revision as negative control), infrastructure/config/path-valued-config (+argparse required accepts "" and realpath("") is the CWD; reproduced), qa/process/completion-claims (+claim row: an auditor's "restored" needs your own pre-audit patch diff + fresh run), infrastructure/agent-orchestration/shared-run-state (+resume-time coordinator liveness via ps/artifact mtimes since tmux ls sees one server; +bats-run-* escalation records are fixtures), testing/data/test-data-and-isolation (+cwd-walking config discovery makes non-cd tests read a worktree's sandbox config; override the exported escalation dir). Reciprocal related links added both ways for every new page. Open-PR check: no open knowledge/* PRs at flush time, so every candidate was new.
+## [2026-09-03] ingest | infrastructure-agent-orchestration-verify-command-in-a-worker-brief — fold: a new-document task in a repo with doc-currency gates names those gate tests on its own verify line (linkly enf0829, 10 integration failures from one missing RFC_ROUTES entry)
+## [2026-09-03] ingest | infrastructure-agent-orchestration-worktree-isolated-workers — fold: when the Bash-only guard cannot be widened, route worker edits through Bash with worktree-relative paths and post-check main with git status --porcelain (linkly t113 Edit-tool writes passed silently)
@@ -8,7 +8,7 @@ sources:
  - https://knip.dev/guides/handling-issues
  - https://knip.dev/reference/configuration
 last_verified: 2026-08-11
-related: [backend-common-change-impact-call-site-enumeration, testing-quality-tests-that-cannot-fail, infrastructure-agent-orchestration-worktree-isolated-workers]
+related: [backend-common-change-impact-call-site-enumeration, testing-quality-tests-that-cannot-fail, infrastructure-agent-orchestration-worktree-isolated-workers, infrastructure-agent-orchestration-semantic-conflicts-after-parallel-merge]
 ---
 
 # Counting the Production Consumers of a Symbol Your Task Just Added

@@ -8,7 +8,7 @@ sources:
  - https://refactoring.com/catalog/replaceMagicLiteral.html
  - https://pragprog.com/tips/
 last_verified: 2026-08-29
-related: [backend-common-change-impact-call-site-enumeration, backend-common-api-design-unenforced-declarations, backend-common-errors-diagnostics-from-a-shared-code-path, backend-common-change-impact-compiler-as-call-site-inventory]
+related: [backend-common-change-impact-call-site-enumeration, backend-common-api-design-unenforced-declarations, backend-common-errors-diagnostics-from-a-shared-code-path, backend-common-change-impact-compiler-as-call-site-inventory, infrastructure-agent-orchestration-semantic-conflicts-after-parallel-merge]
 ---
 
 # Widening a Closed Value Table Whose Consumers Inlined It

@@ -8,7 +8,7 @@ sources:
  - https://github.com/obra/superpowers
  - https://github.com/ayghri/i-have-adhd/blob/main/skills/i-have-adhd/SKILL.md
 last_verified: 2026-08-24
-related: [backend-common-api-design-agent-tool-granularity, backend-common-llm-progressive-disclosure-artifacts]
+related: [backend-common-api-design-agent-tool-granularity, backend-common-llm-progressive-disclosure-artifacts, platforms-tools-deny-rules-under-bypassed-permissions]
 ---
 
 # Instruction Text That Must Bind an LLM Agent's Behavior

@@ -42,3 +42,4 @@ above — these pages link them by id rather than restating them.
 | [coroutines-structured-concurrency](kotlin/coroutines-structured-concurrency.md) | Launching coroutines in a backend service (fire-and-forget work, parallel calls); coroutines leaking or surviving past the request/component that started them; exceptions from `launch {}` vanishing or cancelling unrelated work; choosing coroutineScope vs supervisorScope vs a component scope; cancellation not taking effect or being swallowed |
 | [coroutines-dispatchers-and-blocking](kotlin/coroutines-dispatchers-and-blocking.md) | Choosing a dispatcher for coroutine work; calling blocking libraries (JDBC, sync HTTP clients, file I/O) from coroutines; `runBlocking` appearing in server code; all coroutines stalling together under load; timing out blocking calls from coroutines |
 | [frameworks-and-jpa](kotlin/frameworks-and-jpa.md) | Setting up or reviewing a Kotlin + Spring/JPA project — entities written as data classes, "No default constructor for entity" errors, proxies failing on final Kotlin classes (kotlin-spring/kotlin-jpa plugins), Bean Validation annotations not firing (`@field:` targets), entity property nullability vs column nullability, repositories or `@Transactional` called from coroutines |
+| [compiler-daemon-heap-pressure](kotlin/compiler-daemon-heap-pressure.md) | A Kotlin/Gradle compile that became several times slower and ends in a compiler-internal error (`Backend Internal error: Exception during IR lowering`) while the project's `gradle.properties` pins a small `-Xmx`; raising the Gradle and Kotlin daemon heaps from the user-level `~/.gradle/gradle.properties` without touching the repo; `kotlin.daemon.jvmargs` versus `kotlin.daemon.jvm.options` |