[Bug] /opsx:update guardrails contradict the new glob-artifact file creation #2068

Summary

The guardrails of /opsx:update contradict the new behavior for filling a missing file under a partly written glob artifact. Step 4 now allows creating a confirmed concrete path, but the first guardrail still says to edit only files already listed in existingOutputPaths, and a new file is by definition not in that list. An agent that applies the stricter blanket rule refuses the new-file operation, so the flow added for partly written glob artifacts can fail to fill the missing spec.

Version

@fission-ai/openspec 1.14.1, Claude Code delivery (skills + commands), spec-driven schema.

Where

.claude/commands/opsx/update.md, Guardrails:

• "Edit only the concrete files in existingOutputPaths; never write to a glob resolvedOutputPath."
• followed two bullets later by "... The only new-file scope is a confirmed concrete path under a glob artifact whose existingOutputPaths is non-empty."

The same wording is in .claude/skills/openspec-update-change/SKILL.md.

Suggested fix

State the exception on the first bullet, where an agent applying the stricter rule will read it: for example "Edit only the concrete files in existingOutputPaths, plus the one confirmed concrete path allowed under a partly populated glob artifact (step 4); never write to a glob resolvedOutputPath." Apply it to both the command and the skill.