Explain the Workspace-Edit Default and Name the Aggregator's Expression Form

.agents/skills/agent-conduct/SKILL.md

@@ -50,7 +50,7 @@ The checks that separate work actually done from work that merely reports succes
 - **Editing CRLF files programmatically: `.` matches `\r` in a regex**, so a captured line keeps its carriage return and rejoining with `\r\n` yields `CRCRLF`. Prefer literal replacement over regex reassembly. In Python the *default* path is a text-mode rewrite, which has the mirror failure. `Path.read_text()` decodes through universal newlines and `write_text()` translates each `\n` back to `os.linesep`. So a read-edit-write round trip rewrites every line ending in the file to the host's own while the edit itself looks correct. Work in bytes, or open the file explicitly with `newline=''` on both the read and the write. That is because a read that preserves the endings still hands them to a write that translates them. Use `open()` rather than `Path.read_text()`, which accepts that argument only on Python 3.13 and newer and raises `TypeError` below it. The corruption is worth naming because it is invisible in a rendered diff.
 - **Scope a check by what the project declares, not by the file that prompted it.** A check written while editing one file tends to cover that file's language and stop. It then reports success on every other surface the rule governs. Read the declared types, or the config that enumerates them, and cover each one. Then assert a floor per surface, so a table that narrows fails loudly instead of passing quietly. A rule about comments means every comment syntax the project ships. A format that carries comments in practice counts even where its specification says otherwise.
 - **Never write source text carrying backslash escapes through a shell construct that interprets them.** A `printf` format string, a `printf` argument consumed by `%b`, `echo -e`, POSIX `sh`'s builtin `echo`, and `$'...'` each consume the escape. Each writes an invisible control character in its place. So a `\b` inside a regex becomes a backspace, and the pattern silently matches nothing while every test still passes. A quoted heredoc, `<<"EOF"`, is not one of those constructs and writes every backslash literally. An unquoted `<<EOF` is one of them, because it collapses `\\` to `\`. So source carrying `"\\bword\\b"` reaches the file as `"\bword\b"`, and the pattern compiles to a backspace. Use a file-editing tool for such text where one is available, and a quoted heredoc where the work has to happen in a shell. When a check inspects text for control characters, use `str.isprintable()` rather than a codepoint floor. That is because DEL and the Unicode format characters sit above 32 and are equally invisible in a diff. That test calls `\n` and `\t` unprintable too. So apply it to the tokens the text is made of, or exempt the whitespace it legitimately carries, rather than running it over whole lines.
-- **An agent never edits a `.code-workspace` file loaded as a VS Code window's workspace while it knows that window hosts a live agent session.** A workspace file rewritten on disk can make VS Code reload that window. A reload destroys the context of an agent session running in it, so the work in flight is lost with nothing to catch it. And the trigger is not fully characterized (an agent's edit has caused the reload where a human's identical edit did not). A bound agent surfaces the needed change for the maintainer to apply by hand. The editing agent's own session counts where it runs in the extension or integrated terminal of a window that has the file loaded. An agent treats any window other than its own as hosting no session unless it knows otherwise. An agent edits the file directly once it can tell that no window with the file loaded hosts a session it knows of. Where it cannot tell, it asks the maintainer. Once told that the rule does not bind it, it edits the file directly rather than handing the edit off. A file no window has loaded is outside the rule. A worktree's copy no window has opened is one, as is the workspace file of a checkout opened only as a folder.
+- **An agent never edits a `.code-workspace` file loaded as a VS Code window's workspace while it knows that window hosts a live agent session.** A workspace file rewritten on disk can make VS Code reload that window. A reload destroys the context of an agent session running in it, so the work in flight is lost with nothing to catch it. And the trigger is not fully characterized (an agent's edit has caused the reload where a human's identical edit did not). A bound agent surfaces the needed change for the maintainer to apply by hand. The editing agent's own session counts where it runs in the extension or integrated terminal of a window that has the file loaded. An agent treats any window other than its own as hosting no session unless it knows otherwise. That is because another window's session state is normally unobservable, so assuming a live one would hand every such edit back to the maintainer. An agent edits the file directly once it can tell that no window with the file loaded hosts a session it knows of. Where it cannot tell, it asks the maintainer. Once told that the rule does not bind it, it edits the file directly rather than handing the edit off. A file no window has loaded is outside the rule. A worktree's copy no window has opened is one, as is the workspace file of a checkout opened only as a folder.
 - **A green check is not evidence the work happened.** A skipped job and a passing job are indistinguishable in the aggregated required check. When a job exists to exercise something, confirm from its log that it ran and produced the output it promises.
 - **A local clone is not the branch it names, it is whatever that clone last fetched.** Reading a checkout on disk answers what that clone last saw, so a finding taken from one carries a date nobody stated. Failures of exactly that shape are on record from one session. A repository was reported as still drifted on a file whose fix had already merged. Another was reported as missing a file it carries, because the checkout sat on an older branch. Read the live ref through the API where the claim will be acted on, or fetch immediately before reading. Name the ref and the commit in any finding a local read produced. A clone stays the right tool for anything needing history or a build, which an API read cannot give.
 - **A checkout already sitting on disk is not yours to trust for being there.** A clone or worktree this session did not create, found while looking around a machine, may belong to another concurrent session's task. It may sit on a stale fetch or a branch nobody expects, or hold uncommitted edits nobody has reviewed. None of that is visible from the directory listing that found it. Running `git status`, `git remote -v`, or `git branch --show-current` against it, or reading a file inside it, answers for whatever that checkout happens to hold at that moment. It does not answer for the repository. And the found checkout is not the "local clone" the bullet above means. That is because this session never fetched it and has no basis for trusting what it last saw. Clone the repository fresh into a location this session controls, or read the live state through the GitHub API. Do not adopt a pre-existing checkout as ground truth.

.claude-plugin/fleet-skills/.source-digests/agent-conduct

@@ -1 +1 @@
-b27b756b8eae6533
+d7e2cfd01c357e96

.claude-plugin/fleet-skills/skills/agent-conduct/SKILL.md

@@ -50,7 +50,7 @@ The checks that separate work actually done from work that merely reports succes
 - **Editing CRLF files programmatically: `.` matches `\r` in a regex**, so a captured line keeps its carriage return and rejoining with `\r\n` yields `CRCRLF`. Prefer literal replacement over regex reassembly. In Python the *default* path is a text-mode rewrite, which has the mirror failure. `Path.read_text()` decodes through universal newlines and `write_text()` translates each `\n` back to `os.linesep`. So a read-edit-write round trip rewrites every line ending in the file to the host's own while the edit itself looks correct. Work in bytes, or open the file explicitly with `newline=''` on both the read and the write. That is because a read that preserves the endings still hands them to a write that translates them. Use `open()` rather than `Path.read_text()`, which accepts that argument only on Python 3.13 and newer and raises `TypeError` below it. The corruption is worth naming because it is invisible in a rendered diff.
 - **Scope a check by what the project declares, not by the file that prompted it.** A check written while editing one file tends to cover that file's language and stop. It then reports success on every other surface the rule governs. Read the declared types, or the config that enumerates them, and cover each one. Then assert a floor per surface, so a table that narrows fails loudly instead of passing quietly. A rule about comments means every comment syntax the project ships. A format that carries comments in practice counts even where its specification says otherwise.
 - **Never write source text carrying backslash escapes through a shell construct that interprets them.** A `printf` format string, a `printf` argument consumed by `%b`, `echo -e`, POSIX `sh`'s builtin `echo`, and `$'...'` each consume the escape. Each writes an invisible control character in its place. So a `\b` inside a regex becomes a backspace, and the pattern silently matches nothing while every test still passes. A quoted heredoc, `<<"EOF"`, is not one of those constructs and writes every backslash literally. An unquoted `<<EOF` is one of them, because it collapses `\\` to `\`. So source carrying `"\\bword\\b"` reaches the file as `"\bword\b"`, and the pattern compiles to a backspace. Use a file-editing tool for such text where one is available, and a quoted heredoc where the work has to happen in a shell. When a check inspects text for control characters, use `str.isprintable()` rather than a codepoint floor. That is because DEL and the Unicode format characters sit above 32 and are equally invisible in a diff. That test calls `\n` and `\t` unprintable too. So apply it to the tokens the text is made of, or exempt the whitespace it legitimately carries, rather than running it over whole lines.
-- **An agent never edits a `.code-workspace` file loaded as a VS Code window's workspace while it knows that window hosts a live agent session.** A workspace file rewritten on disk can make VS Code reload that window. A reload destroys the context of an agent session running in it, so the work in flight is lost with nothing to catch it. And the trigger is not fully characterized (an agent's edit has caused the reload where a human's identical edit did not). A bound agent surfaces the needed change for the maintainer to apply by hand. The editing agent's own session counts where it runs in the extension or integrated terminal of a window that has the file loaded. An agent treats any window other than its own as hosting no session unless it knows otherwise. An agent edits the file directly once it can tell that no window with the file loaded hosts a session it knows of. Where it cannot tell, it asks the maintainer. Once told that the rule does not bind it, it edits the file directly rather than handing the edit off. A file no window has loaded is outside the rule. A worktree's copy no window has opened is one, as is the workspace file of a checkout opened only as a folder.
+- **An agent never edits a `.code-workspace` file loaded as a VS Code window's workspace while it knows that window hosts a live agent session.** A workspace file rewritten on disk can make VS Code reload that window. A reload destroys the context of an agent session running in it, so the work in flight is lost with nothing to catch it. And the trigger is not fully characterized (an agent's edit has caused the reload where a human's identical edit did not). A bound agent surfaces the needed change for the maintainer to apply by hand. The editing agent's own session counts where it runs in the extension or integrated terminal of a window that has the file loaded. An agent treats any window other than its own as hosting no session unless it knows otherwise. That is because another window's session state is normally unobservable, so assuming a live one would hand every such edit back to the maintainer. An agent edits the file directly once it can tell that no window with the file loaded hosts a session it knows of. Where it cannot tell, it asks the maintainer. Once told that the rule does not bind it, it edits the file directly rather than handing the edit off. A file no window has loaded is outside the rule. A worktree's copy no window has opened is one, as is the workspace file of a checkout opened only as a folder.
 - **A green check is not evidence the work happened.** A skipped job and a passing job are indistinguishable in the aggregated required check. When a job exists to exercise something, confirm from its log that it ran and produced the output it promises.
 - **A local clone is not the branch it names, it is whatever that clone last fetched.** Reading a checkout on disk answers what that clone last saw, so a finding taken from one carries a date nobody stated. Failures of exactly that shape are on record from one session. A repository was reported as still drifted on a file whose fix had already merged. Another was reported as missing a file it carries, because the checkout sat on an older branch. Read the live ref through the API where the claim will be acted on, or fetch immediately before reading. Name the ref and the commit in any finding a local read produced. A clone stays the right tool for anything needing history or a build, which an API read cannot give.
 - **A checkout already sitting on disk is not yours to trust for being there.** A clone or worktree this session did not create, found while looking around a machine, may belong to another concurrent session's task. It may sit on a stale fetch or a branch nobody expects, or hold uncommitted edits nobody has reviewed. None of that is visible from the directory listing that found it. Running `git status`, `git remote -v`, or `git branch --show-current` against it, or reading a file inside it, answers for whatever that checkout happens to hold at that moment. It does not answer for the repository. And the found checkout is not the "local clone" the bullet above means. That is because this session never fetched it and has no basis for trusting what it last saw. Clone the repository fresh into a location this session controls, or read the live state through the GitHub API. Do not adopt a pre-existing checkout as ground truth.