…ng skills

Eight traps found across a 15-PR integration-hardening sweep, each written
into the skill that owns it and cross-referenced rather than duplicated.

add-tools
- Reserved param names. The shared transport reads `timeout`, `proxyUrl`, and
  `method` off `params` before `request` sees them; `timeout` is its own HTTP
  deadline in milliseconds, so Daytona's documented 10-second sandbox timeout
  aborts the call after 10ms.
- Path traversal. `encodeURIComponent` does not stop `.`/`..` — they are
  unreserved and the URL parser removes dot segments after decoding. Documents
  when each of the three `tools/url-path.ts` helpers applies, and why
  `params.x?.trim()` guards `undefined` rather than the type.

add-block
- Omitting a key from `tools.config.params` does not drop it; the executor
  merges the patch over the raw inputs, so clearing a key needs an explicit
  `undefined`.
- Renaming a subBlock id orphans saved workflow state. Rename the tool param
  and map it; `_removed_` migrations cover genuine removals.
- Declared `outputs` do not drive variable resolution — the resolver walks the
  runtime object, so changing an output's shape breaks references that were
  never declared.

validate-integration
- Path-safety harness design: enumerate (tool, param) pairs, fuzz one at a time,
  assert named rejection rather than path shape, probe conditional and presence
  branches, and assert the skip ledger is empty.
- Test files are type-checked by nothing — tsconfig excludes them and Vitest
  transpiles without checking.
- Replaces the two checklist lines that taught the now-known-defective
  `${params.id.trim()}` path pattern.

add-integration gets pointers only.

… a succeeding one

The most valuable learning of the sweep, and the one every other check
missed — sixteen PRs' own suites, both review bots, and the author.

Trimming a path identifier looks strictly safer. It is not when the
identifier previously went out through a bare encodeURIComponent and
reaches a destructive endpoint: box_sign_cancel_request went from a 404
no-op to cancelling a real signature request, and delete_r2_bucket from
naming no bucket to destroying prod-data. BigQuery's delete_dataset and
delete_table had the same shape on projectId.

Records the reasoning error that hid it: "trimming is the helper's
contract at all 137 sites" is an average, and the question is an
intersection — parameters whose normalisation actually changed, crossed
with irreversible operations. On that PR the answer was one of 137.
The resolution is strictUrlPathSegment, argued from the values (no
legitimate id carries surrounding whitespace, and the previous behaviour
was already a clean failure), not from consistency.

Two smaller ones folded in:

- safeUrlPath rejects only a truly empty path component, never a
  whitespace-only one. Git tracks a file and a directory named only
  spaces, and the parser never removes %20%20%20.
- A test that calls a function directly can pass while the wrapper does
  the opposite. executeTool catches a postProcess throw and restores the
  submit response, so eleven green Enrow failure-path tests sat over a
  production success: true.

The most-repeated defect of the whole effort — four separate instances on
one PR, each a blanket tolerance that made an assertion unable to fail.
Promoted from a note to a first-class rule in the harness-design step.

A tolerated throw must be tolerated BY NAME, in an explicit allowlist,
with the reason recorded. A blanket `catch { return }` converts every
case it covers from tolerated to untested. The line that keeps the rule
usable: tolerating a failed probe during discovery is legitimate, since
probing a guarded param is meant to throw — tolerating a throw inside an
assertion is the bug.

The fourth instance earns its own paragraph because it fails in the
opposite direction from everything else this sweep was about: swallowing
the throw meant the origin, prefix and inert-probe assertions never ran,
so a guard that OVER-tightened passed silently. A path-safety suite that
only catches under-guarding is half a suite. The resolution shape —
enumerate every pair against every inert value, measure which legitimately
throw, then make a throw a failure unless the param is in an explicit
strictlyValidated list — is written out, with the measured answer of ten
pairs (Supabase table and functionName).

Adds "every new assertion is verified red before it is kept" to the
checklist, which is the practice that would have caught all four.

Also groups the type-check and bypassed-wrapper notes under one
"Your tests can lie to you" heading, and renumbers the path-safety step
to 9 (it collided with Memory Load Safety).

…counterweight

Nine recorded instances now, not four, and the three newest are each a
different shape that does not look like a catch:

- A namesParam matcher that was a substring scan, so "projectId cannot
  have leading whitespace" satisfied the assertion for param `id` and
  "pathological failure" satisfied `path` — a guard naming the WRONG
  identifier passed the very check meant to catch that.
- An assertion that guarded itself out of existence:
  `if (serialized?.includes('projectId')) { expect(...) }`.
- describe.each over a derived array a rename had silently emptied, so a
  whole block vanished emitting neither tests nor failures.

Adds the counterweight rule: assert exact error text and exact encoded
output, never a bare toThrow(). Three upstream changes to url-path.ts
landed underneath a downstream suite and only the exact assertions
noticed — trimming dropped, !segment.trim() narrowed to !segment, and a
rebase rewording "cannot have" to "must not have".

Review fixes:

- Qualifies the subBlock-rename mapper example. check-block-registry
  narrows to required + user-only params and demands a subBlock key equal
  to the tool param id, which a rename-at-execution mapper does not
  satisfy. (cubic, correct.)
- Settles branch/ref explicitly: GitHub's branches route is greedy on its
  final parameter, so `feature/api` takes safeUrlPath and a %2F would
  404. safeEncodedUrlPathSegment is for a non-greedy single value such as
  a label name. (cubic claimed the opposite; the shipped tools disagree.)
- Adds an availability note and converts every citation into an unlanded
  path-safety file from file:line to module + symbol. Those branches are
  actively rebasing — strict-url-path.ts has already been deleted and its
  symbols folded into url-path.ts — so a line number is stale on arrival.
  Exact file:line is kept for everything that is on staging.

…qualifies

Greptile re-raised at P1 that an author following this section cannot import
the helpers it prescribes. The note existed but sat six paragraphs below the
table, so it read as a footnote rather than a precondition.

It now leads the section, and says what to DO rather than only what is
missing: add the helper to url-path.ts with the semantics specified here,
never hand-roll a local encoder at the call site.

…g assertions

Instances 10 and 11, both with a different CAUSE from the first nine —
which is why auditing catch blocks and filters did not find them:

- Fixture drift. `expect(serialized).not.toContain('  my-project  ')` was
  written when the fixture was padded; a strict guard made padding throw,
  the fixture was unpadded, and the assertion stayed, asserting the
  absence of a string that can no longer occur. Teaches the better fix —
  derive one literal from the other so a test named "agrees" asserts
  agreement rather than two constants that happen to match.
- A globally-mocked dependency. vitest.setup.ts:112 stubs
  @/tools/registry as `{ tools: {} }`, so a guard iterating the registry
  passes over an empty set; four real failures only reproduced after
  vi.unmock.

Review fixes, all four valid and all four my own guidance failing its own
standard:

- Step 9 recommended `toThrow(new RegExp(paramName))` three paragraphs
  above the section documenting the substring-matcher trap. Replaced with
  the capture-and-assert form the reference harness actually uses.
- The exactness rule recommended `toThrow('<message>')`, which Vitest
  treats as a SUBSTRING match — so the rule asserting exactness was
  itself inexact. Now pins with toBe on a captured message.
- The subBlock-rename qualification offered "keep the tool param name and
  clear the reserved key" for a required user-only param, which cannot
  satisfy both rules at once. Rename plus a migration is the only answer.
- The reserved-key checklist item was unconditional, which would forbid a
  block legitimately setting the transport's timeout, proxy, or method.
  Scoped to a collision where the subBlock means something provider-specific.

… list

Two review findings, both valid.

The swallowed postProcess throw does NOT bill on Enrow. Both getCredits
implementations return 0 when the output carries no `qualification`, and
the fall-back submit response has none — deliberately, per the comment in
verify_email.ts. The real consequence is that a stale SUCCESS reaches both
the user and the pricing hook, and whether that charges depends entirely
on the tool's own getCost. Restated as the rule that matters: write
getCost so it cannot charge for a result the poll never produced, and do
not rely on the failure propagating, because it does not.

The Step 3 checklist named all three url-path helpers without the
availability caveat that Step 9 and add-tools carry, so following it
against staging produces an import that will not compile. Gated.