diff --git a/.dev-loop/INGEST_REPORT.md b/.dev-loop/INGEST_REPORT.md
index 939e9fb..585ce62 100644
--- a/.dev-loop/INGEST_REPORT.md
+++ b/.dev-loop/INGEST_REPORT.md
@@ -1,149 +1,147 @@
-# Knowledge ingest — WebMCP as the development standard: 2 pages re-verified, 2 new pages, routing widened
+# Knowledge flush — 2 insight(s) (+12 plan-gap rows retired as local-layer)
 
-Trigger: a Korean WebMCP explainer video (2026-09) pasted for evaluation. Its own content
-(declarative vs imperative API, shared page logic, token savings vs browser agents) was already
-covered by the two pages ingested 2026-08-18; adoption advocacy and proposal history were again
-left out. Verifying the video's claims against primary sources found the wiki a month behind its
-sources; the owner then decided (2026-09-28) that the additive WebMCP tool layer is the
-development standard for web UI work, QA, and bug fixes, which changes routing.
+Run id `20260928-191816-52426` (inherited from the auto-flush parent). Claimed 14 rows: 2 general
+candidates from sessions `56be2ab9…` (linkly t175) and `e5d33b40…` (linkly-crew t7), and 12
+`plan-gaps` rows tagged `t175-find-by-lookup-key`.
 
 ## Verified best-practice
 
-### 1. `consequentialHint` / `debugging` annotations, ChatGPT site-tools constraints, DevTools pane → **verified**
-
-- https://webmachinelearning.github.io/webmcp/ — Draft Community Group Report dated 2026-09-26;
-  IDL `partial interface Document { readonly attribute ModelContext modelContext }` (Document
-  only); `dictionary ToolAnnotations { readOnlyHint, untrustedContentHint, consequentialHint,
-  debugging }`; no user-confirmation primitive defined. (fetched 2026-09-28)
-- https://developer.chrome.com/docs/ai/webmcp/imperative-api — page dated 2026-09-21;
-  `document.modelContext.registerTool({ name, description, inputSchema, execute, annotations },
-  { signal, exposedTo })`; `consequentialHint` "allows agents and browsers to enforce mandatory
-  user confirmation prompts before executing high-stakes tools"; `debugging` Chrome 156+; no
-  `requestUserInteraction` mention (the security page's old note on it was removed).
-- https://developer.chrome.com/docs/devtools/application/webmcp — page dated 2026-05-12; the
-  WebMCP pane is in the Application panel; Available Tools (name, description, invocation count),
-  Invoked Tools (status, input, output), Run tool with manual parameters, schema-mismatch errors
-  in the output pane.
-- https://learn.chatgpt.com/docs/webmcp — "Site tools are ChatGPT's implementation of the
-  proposed WebMCP standard"; feature-detects `document.modelContext.registerTool`; declarative
-  API and iframe registrations unsupported; "Each tool invocation receives a safety review before
-  it runs"; GPT-5.6 Sol / GPT-6 Sol only, Luna disabled; desktop app; not in Enterprise/Edu;
-  surfaces: built-in browser, ChatGPT Work, Codex; user toggle under Settings → Browser →
-  Permissions. (help.openai.com's site-tools article was dropped as a source: it returns 403 to
-  fetchers, so its claims could not be verified.)
-- https://developer.chrome.com/docs/ai/webmcp/secure-tools — page dated 2026-09-01; budgets
-  30 / 500 / 150 / 1.5K. Contains no auth-state guidance, so the parity gate's both-auth-states
-  row is derived from security-agent-exposure-in-session-tool-exposure (PII via read tools,
-  server-side authz unchanged), not from this page.
-- https://developer.chrome.com/docs/ai/webmcp — page dated 2026-08-07; origin trial from Chrome
-  149; Model Context Tool Inspector extension; prompts go to `gemini-3-flash-preview`.
-
-### 2. WebMCP-as-standard routing (owner decision) → **policy, not a sourced claim**
-
-The widened triggers (any new or changed user action in a web UI) and the parity gate's
-"every action has a tool unless on the exclusion list" are the owner's development standard,
-stated as such in log.md. Every mechanical directive inside those pages is sourced as above.
-The standard keeps the existing "human UI primary, tool layer additive" directive unchanged.
+### 1. Threading a new parameter through a call chain that crosses an executor (hash `157f9966ef1bfebb`)
+
+**Claim.** When a new argument is threaded through Python helpers and one hop is a
+`ThreadPoolExecutor.submit()`, enumerate every function on the path with a scope scan (names
+referenced but not bound as parameter/local/module) before running tests, and read "the parallel
+block produced no results" as a possible exception stored on a future rather than a logic error.
+
+**Sources checked.**
+- https://docs.python.org/3/library/concurrent.futures.html — `Future.result()`: "If the call raised an
+  exception, this method will raise the same exception"; `Future.exception()` returns the stored
+  exception or `None`; `Executor.map()`: the exception "will be raised when its value is retrieved from
+  the iterator". Nothing surfaces at `submit()` time.
+- https://docs.python.org/3/library/symtable.html — `Function.get_parameters()`, `Function.get_locals()`,
+  `Symbol.is_referenced()`, `Symbol.is_free()`, `SymbolTable.get_children()` — the primitives the scan uses.
+
+**How verified.** Reproduction 2026-09-28 (CPython 3.14.4, macOS) in `.claude/tmp/flush-repro/`
+(deleted after capture): a worker helper referencing an unbound `keys` under a
+`ThreadPoolExecutor(max_workers=4)` whose caller appends `result()` only when `exception()` is `None`
+printed `results: []` with exit code 0 and no traceback; calling `result()` on one future raised
+`NameError: name 'keys' is not defined`. The symtable scan printed exactly one line naming the broken
+helper on the original file (known-bad) and zero lines on the fixed copy (known-good), which then
+returned three results.
+
+**Confidence:** verified.
+
+### 2. A capability-restriction flag in a shared config that only some adapters enforce (hash `2b935d298d7e036e`)
+
+**Claim.** When a restriction flag (`tool_use`, write confinement) lives in a config struct shared
+by several adapters and only one implements it: census which adapters read it, make every
+non-enforcing adapter refuse the flag with an explicit error before spawning, gate the flag at the
+caller on adapter id, pass each adapter's native lock-down switch unconditionally, and test the
+true arm per adapter.
+
+**Sources checked.**
+- https://cwe.mitre.org/data/definitions/636.html — CWE-636 "Not Failing Securely ('Failing Open')":
+  falling "back to a state that is less secure … such as using the most permissive access control
+  restrictions"; "causes administrators to have a false sense of security".
+- https://cheatsheetseries.owasp.org/cheatsheets/Secure_Product_Design_Cheat_Sheet.html — Least
+  Privilege, Fail Securely, Secure by Default, Defense-in-Depth (quoted in the page).
+- https://github.com/badlogic/pi-mono/issues/555 — the closed request that added `--no-tools` to pi;
+  confirmed on the installed CLI 2026-09-28: `pi --help` line 31 `--no-tools, -nt  Disable all tools by
+  default (built-in and extension)`; the package CHANGELOG (fetched via `gh api`) records "`--no-tools`
+  now disables all tools by default rather than only built-ins" (#2835, #3452).
+
+**How verified.** Directive matched against CWE-636 and the OWASP principles (fail closed, least
+privilege, secure defaults); the adapter-native switch the directive names was confirmed on the
+installed binary and in the upstream changelog; the field incident (crew-run `role_harness_cfg` set
+`tool_use` for all harnesses, `pi.rs` ignored it, RED test showed pi spawned with `tool_use=true`) is
+recorded as the field evidence row.
+
+**Confidence:** verified.
 
 ## Existing-layer check
 
-Pages read: frontend-agent-interfaces-agent-facing-tool-surfaces, security-agent-exposure-in-session-tool-exposure, qa-process-release-gates, testing-strategy-differential-testing, testing-strategy-cross-layer-effect-tests, testing-strategy-failing-test-first
-
-Whole-wiki grep `webmcp|modelContext|toolname|agent-friendly|answer engine` → 7 files (the two
-WebMCP pages, their two domain indexes, INDEX.md, log.md, platforms/tools/plugin-mcp-server-
-registration which matches only on a modelcontextprotocol URL). skills/, hooks/, agents/,
-templates/, AGENTS.md → 0 mentions. qa/testing/debugging indexes → no WebMCP routing line (the
-one qa hit is the model-coupled-guidance-aging-detector page, unrelated). `wiki_search` was
-unavailable (dev-loop-wiki MCP server failed to connect this session); the category pages were
-read directly per the skill's fallback.
-
-Merge targets: both existing WebMCP pages were **revised in place** (same trigger, same
-directive, newer sources) — no new page for that material. The two new pages have new triggers
-(a release gate; a test strategy) that no existing qa/testing page covers: release-gates is the
-generic checklist page and is linked, not extended; differential-testing / cross-layer-effect-
-tests / failing-test-first are referenced from the testing page's edge cases.
-
-Related links added both ways: qa-process-release-gates ↔ qa-process-agent-tool-parity-gate;
-testing-strategy-cross-layer-effect-tests ↔ testing-strategy-agent-tool-shared-handler-tests;
-frontend agent-facing-tool-surfaces and security in-session-tool-exposure ↔ both new pages.
+Pages read: backend-python-concurrency-gil-and-concurrency-model, testing-quality-sequential-dispatch-assumption-under-concurrency, debugging-signals-stack-traces, debugging-concurrency-intermittent-failures, backend-common-change-impact-call-site-enumeration, backend-common-errors-async-failure-handling, backend-common-errors-exception-handling, testing-mocking-captured-call-arguments, security-authn-retiring-a-replaced-auth-gate, security-agent-exposure-authorization-scope-persistence, testing-quality-default-values-under-test, backend-common-integrations-consumer-required-fields, backend-common-api-design-unenforced-declarations
+
+Also read: `INDEX.md`, `wiki/debugging/index.md`, `wiki/security/index.md`, `wiki/backend/index.md`,
+`wiki/backend/python/index.md`, the agent-orchestration section of `wiki/infrastructure/index.md`.
+
+`wiki_search` top-5 for candidate 1: testing-quality-sequential-dispatch-assumption-under-concurrency
+(0.751), backend-python-concurrency-gil-and-concurrency-model (0.748),
+backend-common-errors-async-failure-handling (0.738), backend-java-kotlin-coroutines-dispatchers-and-blocking
+(×2, 0.738/0.735). For candidate 2: infrastructure-deploy-rollout-and-rollback (0.748),
+platforms-filesystems-paths-case-and-line-endings (0.726), testing-mocking-captured-call-arguments (0.723),
+infrastructure-agent-orchestration-semantic-conflicts-after-parallel-merge (0.722),
+platforms-toolchains-compiler-sysroot-on-macos (0.721). Repo-wide grep for the candidates' keywords
+(`ThreadPoolExecutor|NameError|as_completed|future.result`; `capability flag|least.privilege|deny.by.default|silently ignor|adapter`)
+ran with a positive control (`asyncio` → 3 files) and every hit was opened.
+
+**Overlaps and verdicts.**
+- Candidate 1 — no page has the trigger. `backend-common-change-impact-call-site-enumeration` enumerates
+  *callers* of a changed callee; this case is the *intermediate* hop that is a caller of nothing new, so
+  it is adjacent, not a duplicate. `backend-common-errors-async-failure-handling` has the edge row
+  "Future stored but never consumed"; the new case (a collection loop that records only OK futures) is
+  a sibling shape — added as a new edge row there pointing at the new page, not merged, because the
+  new page's directive (the pre-test scope scan) is a change-impact step that page does not own.
+  `testing-quality-sequential-dispatch-assumption-under-concurrency` covers exact-count assertions
+  under a parallelized loop — linked as related. No conflicting directive found.
+- Candidate 2 — no page has the trigger. `backend-common-api-design-unenforced-declarations` is the
+  nearest principle (recognized-but-unenforced declaration → accept-and-warn); the new page sharpens it
+  for a security restriction shared across adapters (refuse, not warn) and is linked both ways with an
+  edge row. `security-agent-exposure-authorization-scope-persistence` (force flag must not bypass the
+  gate) and `security-authn-retiring-a-replaced-auth-gate` (deny default) are adjacent principles, not
+  duplicates. `testing-mocking-captured-call-arguments` owns the "assert the spawn carries the
+  confinement argument" test shape — linked one-way from the new page only, because open PR #223
+  rewrites that file.
+
+**Created:** `wiki/backend/common/change-impact/threading-a-parameter-through-executor-hops.md`,
+`wiki/security/agent-exposure/capability-flag-across-adapters.md`.
+**Amended (related link + one edge row each):** call-site-enumeration, async-failure-handling,
+authorization-scope-persistence, unenforced-declarations. **Index rows:** `wiki/backend/index.md`
+(change-impact), `wiki/security/index.md` (agent-exposure), `INDEX.md` security route line (the
+backend route line is left untouched because open PR #225 rewrites it; the domain index row carries the
+route). **Conflicts flagged:** none.
 
 ## Open-PR check
 
-`gh pr list --state open` (2026-09-28): one open PR, #223 (knowledge/choiyounggi-20260927-220735,
-15 insights). Its file list contains none of the four WebMCP-related pages; the only overlap is
-appended log.md entries (union merge).
+Open `knowledge/*` heads listed 2026-09-28 19:19 KST: #223 (`knowledge/choiyounggi-20260927-220735`),
+#225 (`…-20260928-082803`), #226 (`…-092831`), #227 (`…-103056`), #228 (`…-134840`),
+#229 (`…-145025`), #230 (`…-155239`). Each head fetched; `git diff origin/main origin/<head> -- wiki/`
+grepped for both candidates' keywords (positive control: `gitignore` in #223 → 13 hits) and each
+head's added/modified page list read.
+
+| Candidate | Overlapping open head | Verdict |
+|-----------|----------------------|---------|
+| 1 (`157f9966ef1bfebb`) executor-hop parameter threading | none — no open head adds or edits a page about executors, futures, or parameter threading | **new** |
+| 2 (`2b935d298d7e036e`) capability flag across adapters | none — #223 edits `security/agent-exposure/in-session-tool-exposure.md` and `testing/mocking/captured-call-arguments.md` (WebMCP tool surfaces), which is why those two files receive no back-link edit here | **new** |
+| 12 `plan-gaps` rows (t175-find-by-lookup-key) | #230 retired 8 t175 plan-gaps as local-layer; these 12 are a different hash set and were still `pending` | **drop** (local-layer, see below) |
 
 ## Routing decision
 
-- frontend/agent-interfaces/agent-facing-tool-surfaces — revised (owning artifact: the UI code).
-- security/agent-exposure/in-session-tool-exposure — revised (confirmation gating).
-- **qa/process/agent-tool-parity-gate** — new page in the existing `process` category beside
-  release-gates: it is a release-decision checklist for one surface, so it belongs where
-  release-gates and regression-scope live; no new category.
-- **testing/strategy/agent-tool-shared-handler-tests** — new page in the existing `strategy`
-  category beside test-level-choice / cross-layer-effect-tests: it decides what to test and at
-  which level for a two-entry-point action; no new category.
-- AGENTS.md routing step 7 — one row added (web UI user action → frontend agent-interfaces,
-  then the qa parity gate); tests/review-routing.bats pin 6 → 7 rows in the same commit.
-- INDEX.md frontend / qa / testing route lines and the three domain indexes updated; log.md
-  gained two ingest entries and two revise entries.
-
-## Verification
-
-- `node scripts/wiki-lint-prohibitions.js wiki` → directives 79, violations 0 (pin unchanged).
-- `node scripts/wiki-structure-checks.js wiki --layer bundled` → pages 353, findings 0.
-- bats: tests/wiki-*.bats + tests/review-routing.bats + tests/orchestrate-review-pass.bats →
-  273/273 ok (one earlier `Recall@5` flake re-ran green; baseline on an untouched HEAD worktree
-  measured the same 0.87).
-- Body lines: frontend 110, security 76, qa 70, testing 66 (limit 120).
-
-## Independent review (before commit)
-
-- General reviewer (feature-dev:code-reviewer, fresh context): FAIL → 2 major + 4 minor, all
-  applied: `consequentialHint` scope aligned with the security page's class table; gate edge row
-  for a vanished runtime (human-UI release not blocked); logout added to the AbortSignal edge
-  row and the Registration test; step 2/3 of the testing page conditioned on imperative vs
-  declarative; AGENTS.md step-7 row admits the exclusion list; qa index clause matched to the
-  page trigger.
-- Adversarial fact-checker (fresh context, every source re-fetched): 8/8 targeted claims
-  confirmed; FAIL on 2 unsupported sentences + 8 imprecisions, all applied: dropped the
-  `navigator.modelContext` history (no cited source has it); Run tool no longer claimed to write
-  Invoked Tools (that log is agent↔page); `consequentialHint` quote re-attributed (draft: "client
-  or agent"; Chrome: "agents and browsers"); secure-tools' stale `requestUserInteraction()`
-  mention recorded; `readOnlyHint` "requested" → "in its read-only example"; budgets labelled
-  as Chrome's recommendations applied as limits, parameter names included; cross-origin edge
-  row now names `allow="tools"` + `exposedTo` + `getTools({ fromOrigins })`; origin trial and
-  local flag separated; `SubmitEvent.agentInvoked` / `respondWith()` added to the declarative
-  test directive.
-
-## CI agent gate (run 36329841491) — blocker refuted, advisories applied
-
-- Blocker claimed the CG draft has no "client or agent … selectively enforce" language. Ground
-  truth (`curl -sL https://webmachinelearning.github.io/webmcp/`, 504,537 bytes, tags stripped,
-  2026-09-28): the phrase occurs once, in §6 Security considerations under the mitigation for
-  "Misrepresentation of Intent": "A boolean consequentialHint annotation acts as a signal to the
-  client or agent that the tool performs a consequential action … This way they can selectively
-  enforce mandatory user confirmation prompts before executing high-stakes tools". The gate's
-  fetch read a truncated page. The page now names the section beside the quote.
-- Advisory (chromestatus unverifiable from CI): confirmed via the JSON API — stage 150
-  desktop/Android 149–156; Firefox and Safari "No signal". The source line now records the API
-  path.
-- Advisory (Run tool vs Invoked Tools): Do 8 no longer implies manual runs are excluded from the
-  log; it states only what the DevTools page states.
-- Advisory (cross-link gap): qa parity gate ↔ backend-common-api-design-agent-tool-granularity
-  linked both ways, with one sentence placing the parity table as the release-time reading of
-  that page's design-time capability map.
-
-## CI agent gate, second run (36330523418) — blocker applied, quote advisory stands
-
-- Blocker: the frontend page stated "the development standard is an additive WebMCP tool per
-  action" as unconditional fact under confidence: verified. Applied: the trigger, the frontend
-  domain description and load-when line, and the INDEX.md frontend row now condition on "this
-  wiki's development standard (owner decision, log.md 2026-09-28, a policy rather than a sourced
-  fact)". Routing width is unchanged; the sentence is a policy the wiki declares, not a claim about
-  the world.
-- Advisory (§6 quote unverifiable from CI): the gate's fetch truncates before §6.3.2 and curl is
-  blocked in its sandbox; it records the quote as unverifiable, not refuted. Ground-truth grep is in
-  the PR comment; the two sources lines name the section.
-- Advisory (duplication with test-level-choice's extract-and-wire edge row): linked both ways and
-  named in step 1 as the general rule applied to two entry points.
+| Insight | Layer | Target | Why this category |
+|---------|-------|--------|-------------------|
+| 1 | bundled wiki | `backend/common/change-impact/threading-a-parameter-through-executor-hops` | The directive is a pre-edit enumeration step for a parameter change (change-impact's remit, sibling of call-site-enumeration); the harvested `debugging` hint is served by the edge row and related link from `async-failure-handling`, the page an agent debugging "side effects silently never happen" already loads |
+| 2 | bundled wiki | `security/agent-exposure/capability-flag-across-adapters` | The flag confines an LLM agent harness's executable tools — the agent-exposure category's subject (in-session-tool-exposure, authorization-scope-persistence); no new category needed |
+
+No new category was created.
+
+## Local-layer candidates
+
+All 12 `plan-gaps` rows belong to the linkly compiler repository (`seagrass`); each directive names
+`lower.py` line numbers, `RepositoryCall` nodes, `RFC-0052`, `RFC_ROUTES`, `LOOKUP_SUBJECT`, and
+`_resolve_lookup_key`, and would be wrong in any other codebase. Excluded from this PR; run
+`wiki-ingest` inside that project.
+
+| Hash | Decision | wiki-local target (project: linkly / seagrass) |
+|------|----------|-----------------------------------------------|
+| `3d731255ec8e39e0` | Grammar surface for `by <ref>` on read/update/delete | `wiki-local/backend/compiler/by-ref-trailing-clause-grammar.md` |
+| `d5c058373a04ea49` | Static ref-category split + order-blind admission rule | `wiki-local/backend/compiler/lookup-ref-category-admission.md` |
+| `fc8c4977a204266d` | Derived/Password refusal wording for a `binding.field` lookup key | `wiki-local/backend/compiler/lookup-key-derived-password-refusal.md` |
+| `e4ea213f6d9df04f` | Runtime key derivation | `wiki-local/backend/runtime/lookup-key-derivation.md` |
+| `be4216dd01e49bae` | Runtime key derivation + trace/collector attrs (re-plan) | same target as `e4ea213f6d9df04f` (revision of the same decision) |
+| `c207e65da923f1a0` | Persisting a `set` under the lookup key | `wiki-local/backend/runtime/persist-set-under-lookup-key.md` |
+| `672134c2e2a71817` | `update`/`delete … by <ref>` execute key | `wiki-local/backend/runtime/update-delete-by-lookup-key.md` |
+| `f5ba6ac93a2aedca` | Seed-key rule for `input.<field>` first reads | `wiki-local/backend/runtime/seed-key-rule-input-field.md` |
+| `caf95ea8520a2931` | Seed-key rule + missing-field handling (re-plan) | same target as `f5ba6ac93a2aedca` (revision of the same decision) |
+| `4bf5070e2b5086fd` | Bare-ref and bound-ref seeding scope (documented limitation) | `wiki-local/backend/runtime/bound-ref-seeding-scope.md` |
+| `d4fa24759b67ba37` | RFC-0052 authoring shape and Updates chain | `wiki-local/qa/rfc-process/rfc-0052-updates-chain.md` |
+| `4d689bc1190fc357` | Registries + docs: RFC_ROUTES, generated references, enforcement matrix | `wiki-local/qa/registries/rfc-registry-and-generated-reference-gates.md` |
diff --git a/INDEX.md b/INDEX.md
index e947472..9cc73f2 100644
--- a/INDEX.md
+++ b/INDEX.md
@@ -18,7 +18,7 @@ follow the cross-pointers in their index or take the next matching seeded domain
 | [testing](wiki/testing/index.md) | **seeded** | Writing or structuring automated tests: level choice, test-before-code ordering, a UI action that is also a registered agent tool, cases/assertions, cross-layer effect scoping, test data, mock decisions, flaky tests, test-infrastructure containers (Testcontainers) failing on the dev host, testing a SwiftPM executable target (release-process quality → qa) |
 | [qa](wiki/qa/index.md) | **seeded** | Release-quality process: release gates, regression scoping, bug reports, severity/priority triage, evidence for completion claims, the agent-tool parity gate for a web UI release, acting on code-review feedback, adversarial review of high-risk diffs, exploratory testing (guarded-path coverage, override matrices), scope-purity gates, sourcing deliverable documents from generated artifacts, verifying the quantitative claims in a document before publishing it, a documented claim about a third-party tool's side effects, an obligation row in a tier/policy table that another contract also pins, rationale prose left behind by a config-value change, automated verification of document deliverables (spec/RFC gates), an aging detector for model-coupled agent guidance, capturing an app's own screen content without Screen Recording permission (writing automated test code → testing) |
 | [debugging](wiki/debugging/index.md) | **seeded** | Diagnosing a failure — finding what is wrong and why: reproducing, bisection, hypothesis testing, traces/logs, intermittent failures (fixing the diagnosed fault → its owning domain) |
-| [security](wiki/security/index.md) | **seeded** | Trust-boundary decisions: input validation, session-vs-token auth choice, per-resource authorization (IDOR), secrets hygiene (including ciphertext orphaned by a regenerated encryption key), dependency trust, PII handling, in-session agent tool exposure (prompt-injection blast radius), the author identity a commit publishes to a public repository, host-compromise triage / incident response (verifying assumed security agents, identifying masquerading processes) (XSS rendering → frontend; CI secrets → infrastructure; JWT implementation → backend/frontend auth) |
+| [security](wiki/security/index.md) | **seeded** | Trust-boundary decisions: input validation, session-vs-token auth choice, per-resource authorization (IDOR), secrets hygiene (including ciphertext orphaned by a regenerated encryption key), dependency trust, PII handling, in-session agent tool exposure (prompt-injection blast radius), a restriction flag in a config shared by several adapters that only some enforce, the author identity a commit publishes to a public repository, host-compromise triage / incident response (verifying assumed security agents, identifying masquerading processes) (XSS rendering → frontend; CI secrets → infrastructure; JWT implementation → backend/frontend auth) |
 | [platforms](wiki/platforms/index.md) | **seeded** | OS-level differences breaking code across macOS/Linux/Windows: shell portability, BSD-vs-GNU CLI, filesystem case/line endings, Unicode normalization in text/file-name matching, commands inspected before execution, permission deny rules for bypass-mode agent workers, background services/cron, invoking prompt-capable CLIs non-interactively, toolchain version pinning |
 | [mobile](wiki/mobile/index.md) | **seeded** | App-side iOS/Android/cross-platform: process death/state survival, offline-first sync, mobile-network calls, store rollout/hotfix strategy, startup time, modal presentation (several sheets/covers on one host, screen-level error sheets) |
 
diff --git a/log.md b/log.md
index 72b6053..88a21fc 100644
--- a/log.md
+++ b/log.md
@@ -208,3 +208,7 @@ Append-only. Format: `## [YYYY-MM-DD] <ingest|revise|lint|gap|contradiction|drif
 ## [2026-09-28] ingest | testing-strategy-agent-tool-shared-handler-tests — a UI action that is also a registered tool is tested once at the shared function plus two entry-point tests per tool (Registration incl. AbortSignal teardown, Wiring via spy) against a `document.modelContext` stub; a bug fix that changes the handler's contract changes the `inputSchema` assertion in the same commit; one DevTools Run-tool pass per release.
 
 ## [2026-09-28] revise | WebMCP adopted as the development standard (owner decision 2026-09-28): frontend/agent-interfaces/agent-facing-tool-surfaces trigger widened to any new or changed user action in a web UI + bug-fix and exclusion-list edge cases; AGENTS.md routing step 7 gains a web-UI-action row → frontend agent-interfaces then qa parity gate; INDEX.md frontend/qa/testing route lines and the frontend/qa/testing domain indexes updated; related links added both ways (release-gates, cross-layer-effect-tests, in-session-tool-exposure). The standard keeps the human UI primary and the tool layer additive (CG draft; Chrome origin trial + ChatGPT desktop runtimes).
+
+## [2026-09-28] ingest | backend-common-change-impact-threading-a-parameter-through-executor-hops — threading a new parameter through a call chain with an executor hop: scan each function on the path (symtable: referenced but not parameter/local/module-bound) before tests; an exception raised inside a worker is stored on the future and a caller that records only `exception() is None` futures reports empty results with exit 0. Back-links from call-site-enumeration and async-failure-handling.
+
+## [2026-09-28] ingest | security-agent-exposure-capability-flag-across-adapters — a restriction flag in a config shared by several adapters that only some enforce: census the readers, refuse the flag in non-enforcing adapters before spawning (CWE-636 fail-closed), gate it at the caller on adapter id, pass each adapter's native lock-down switch (pi `--no-tools`) unconditionally, test the true arm per adapter. Back-links from authorization-scope-persistence and unenforced-declarations.
diff --git a/wiki/backend/common/api-design/unenforced-declarations.md b/wiki/backend/common/api-design/unenforced-declarations.md
index c191368..ad77061 100644
--- a/wiki/backend/common/api-design/unenforced-declarations.md
+++ b/wiki/backend/common/api-design/unenforced-declarations.md
@@ -9,7 +9,7 @@ sources:
   - https://kubernetes.io/blog/2023/04/24/openapi-v3-field-validation-ga/
   - https://json-schema.org/draft/2020-12/json-schema-validation
 last_verified: 2026-08-05
-related: [security-input-validation-at-trust-boundaries, infrastructure-config-environment-config, backend-common-api-design-error-responses, qa-process-acceptance-criteria, backend-common-change-impact-widening-a-closed-value-table, platforms-processes-tool-diagnostics-without-a-failing-exit-code, backend-common-errors-diagnostics-from-a-shared-code-path]
+related: [security-input-validation-at-trust-boundaries, infrastructure-config-environment-config, backend-common-api-design-error-responses, qa-process-acceptance-criteria, backend-common-change-impact-widening-a-closed-value-table, platforms-processes-tool-diagnostics-without-a-failing-exit-code, backend-common-errors-diagnostics-from-a-shared-code-path, security-agent-exposure-capability-flag-across-adapters]
 ---
 
 # Accepting a Declaration the System Does Not Enforce
@@ -58,6 +58,7 @@ happened", or a feature was "configured" in an environment where it never ran.
 | Case | Then |
 |------|------|
 | A newer client sends a field this older server has not learned yet | Warn rather than reject on the server, and let the *client's* strict mode catch it at author time; rejecting forward-compatible traffic breaks rolling upgrades |
+| The declaration is a security restriction in a config shared by several adapters, and only some adapters implement it | Refuse it in every adapter that does not enforce it, before the adapter spawns anything — accept-and-warn is too weak when downstream automation trusts the flag ([security-agent-exposure-capability-flag-across-adapters]) |
 | The declaration is enforced on one execution path but not another | Report it as unenforced on the path that ignores it, keyed by path — a single global status makes one of the two paths lie |
 | The vocabulary is generated (parsed from a schema or enum) | Assert the parsed table is non-empty before using it to validate; an empty table accepts everything and turns strict mode into a no-op |
 | Enforcement is measured but not applied (a budget reported, never imposed) | Say so in the diagnostic's wording — "measured, not enforced" — so a reader does not infer a guarantee from the value appearing in output |
diff --git a/wiki/backend/common/change-impact/call-site-enumeration.md b/wiki/backend/common/change-impact/call-site-enumeration.md
index e43c71c..3f2433e 100644
--- a/wiki/backend/common/change-impact/call-site-enumeration.md
+++ b/wiki/backend/common/change-impact/call-site-enumeration.md
@@ -9,7 +9,7 @@ sources:
   - https://docs.python.org/3/library/ast.html
   - https://peps.python.org/pep-0570/
 last_verified: 2026-08-05
-related: [qa-process-regression-scope, backend-python-language-mutable-state-traps, testing-data-test-data-and-isolation, testing-quality-policy-at-several-return-sites, backend-common-change-impact-widening-a-closed-value-table, backend-common-change-impact-corpus-sweep-before-a-rejection-rule, backend-common-errors-diagnostics-from-a-shared-code-path, backend-common-change-impact-inserting-a-guard-before-an-existing-side-effect, backend-common-change-impact-sibling-validators-on-a-shared-node, security-data-masking-verification]
+related: [qa-process-regression-scope, backend-python-language-mutable-state-traps, testing-data-test-data-and-isolation, testing-quality-policy-at-several-return-sites, backend-common-change-impact-widening-a-closed-value-table, backend-common-change-impact-corpus-sweep-before-a-rejection-rule, backend-common-errors-diagnostics-from-a-shared-code-path, backend-common-change-impact-inserting-a-guard-before-an-existing-side-effect, backend-common-change-impact-sibling-validators-on-a-shared-node, security-data-masking-verification, backend-common-change-impact-threading-a-parameter-through-executor-hops]
 ---
 
 # Enumerating Call Sites Before Changing a Callee's Contract
@@ -67,6 +67,7 @@ the search never listed.
 | A test helper wraps the callee or rebuilds its data shape (a fixture builder feeding it) | Read every helper definition the enumeration surfaces and enumerate the helper's own call sites too — the helper appears once in the callee enumeration while supplying the old contract to every one of its callers ([testing-data-test-data-and-isolation]) |
 | A parameter is renamed but keeps its position and type | Keyword callers break loudly; positional callers keep working silently with the new meaning — the callee enumeration is the only search that lists them |
 | Parameters of the same type are reordered | The most dangerous shape change: every positional caller still type-checks and silently swaps values. Rename the callee or change a parameter type so the mismatch surfaces at every stale site |
+| The new parameter's value must travel through intermediate helpers (a retry wrapper, a dispatcher) before reaching the callee, and one hop is an executor `submit` | The intermediates are not callers of the changed callee — scan each function on the path for a reference to the new name it does not bind, and read an empty parallel result as a possible stored exception ([backend-common-change-impact-threading-a-parameter-through-executor-hops]) |
 | Callers forward through `*args` / `**kwargs` / a dict spread | The call site names nothing the search can match — enumerate the forwarding wrapper's definition and treat its callers as a second enumeration pass |
 | The change adds a parameter with a default | Every caller keeps compiling while silently receiving the default — enumerate and decide per site anyway, or the default becomes permanent behavior nobody chose |
 | The change reshapes a data structure rather than the parameter list | Also enumerate the structure's producers (fixtures, factories, seed files) by its field names — they are call sites of the shape, not of the function |
diff --git a/wiki/backend/common/change-impact/threading-a-parameter-through-executor-hops.md b/wiki/backend/common/change-impact/threading-a-parameter-through-executor-hops.md
new file mode 100644
index 0000000..7f0af0b
--- /dev/null
+++ b/wiki/backend/common/change-impact/threading-a-parameter-through-executor-hops.md
@@ -0,0 +1,103 @@
+---
+id: backend-common-change-impact-threading-a-parameter-through-executor-hops
+domain: backend
+category: change-impact
+applies_to: [general, python]
+confidence: verified
+sources:
+  - https://docs.python.org/3/library/concurrent.futures.html
+  - https://docs.python.org/3/library/symtable.html
+last_verified: 2026-09-28
+related: [backend-common-change-impact-call-site-enumeration, backend-common-errors-async-failure-handling, testing-quality-sequential-dispatch-assumption-under-concurrency, debugging-signals-stack-traces]
+---
+
+# Threading a New Parameter Through a Call Chain That Crosses an Executor
+
+## When this applies
+
+You are adding a parameter to a callee and threading its value from the function
+that has it, through one or more intermediate helpers, to the function that
+consumes it — and one hop on that path is an `Executor.submit()` / `Executor.map()`
+boundary (`ThreadPoolExecutor` or equivalent). Also when, after such a change, a
+parallel section "produced no results" — an empty list, zero recorded outcomes —
+with no traceback in the output and a green exit code.
+
+Enumerating the *callers* of the callee whose signature changed →
+[backend-common-change-impact-call-site-enumeration].
+
+## Do this
+
+1. **Enumerate the path by the new value's name, not by the callee's name.** The
+   callee enumeration lists who calls the changed function; an intermediate
+   helper that forgot the parameter is not a caller of anything new — it is a
+   function that *references* the new name without *binding* it. Run a scope
+   scan over the file before running tests:
+
+   ```python
+   import symtable, builtins
+   top = symtable.symtable(src, path, "exec")
+   module_names = {s.get_name() for s in top.get_symbols() if s.is_assigned() or s.is_imported()}
+   def walk(t):
+       if t.get_type() == "function":
+           bound = set(t.get_parameters()) | set(t.get_locals())
+           for s in t.get_symbols():
+               n = s.get_name()
+               if s.is_referenced() and n not in bound and (s.is_global() or s.is_free()) \
+                  and n not in module_names and not hasattr(builtins, n):
+                   print(f"{t.get_name()}: uses {n!r} but does not bind it")
+       for c in t.get_children(): walk(c)
+   walk(top)
+   ```
+
+   `symtable` exposes the two facts the scan needs — `Function.get_parameters()`
+   "Return a tuple containing names of parameters to this function" and
+   `Symbol.is_referenced()` "Return `True` if the symbol is used in its block". A
+   referenced name that is neither parameter, local, module binding nor builtin
+   is a `NameError` waiting for the first call.
+
+2. **Read the executor boundary as an exception sink.** `Future.result()`: "If
+   the call raised an exception, this method will raise the same exception";
+   `Executor.map()`: the exception "will be raised when its value is retrieved
+   from the iterator". Nothing raises at `submit()` time. A caller that records
+   only futures whose `exception()` is `None` — or appends `result()` inside a
+   `try` that continues — converts every worker failure into missing work.
+
+3. **Decide the surfacing policy per collection loop:**
+
+| Collection loop | Do |
+|-----------------|----|
+| Records `result()` only for futures that finished OK | Log or re-raise `future.exception()` for every other future — each per-future failure must leave a trace with its item id |
+| Iterates `Executor.map()` | The first failed item raises at retrieval and skips the remaining retrievals — decide whether that abort is wanted, and catch per item if not |
+| `as_completed` with `except Exception: continue` | Record `repr(exc)` against the item before continuing; an empty `except` here is the silent mode |
+
+4. **Treat "block produced no results" in executor code as a possible swallowed
+   exception before treating it as a logic error.** Print `future.exception()`
+   for each future, or call `result()` on one, before reading the business logic.
+
+5. **Re-run the scan after the edit and require zero unbound names on the path,
+   then run the tests** — the re-run turns the scan into a completion check.
+
+## Edge cases
+
+| Case | Then |
+|------|------|
+| The path crosses a `functools.partial`, a lambda, or a bound method handed to `submit` | The argument list lives at the `submit`/`partial` site — include those sites in the path enumeration |
+| A retry wrapper sits between caller and callee | The wrapper is a function on the path and needs the parameter as much as the callee — the field incident's missing hop was the retry helper |
+| The new name shadows a module-level or builtin name (`keys`, `id`, `input`) | The scan's module/builtin exclusions hide it; grep the name as well — a same-named module binding turns the `NameError` into wrong-value behaviour with no exception at all |
+| The language is not Python | The mechanism holds where a result is materialized on read: Java `Future.get()` wraps the failure in `ExecutionException`, JS `Promise.allSettled` records rejections, Rust `JoinHandle::join` returns `Err` — the collection loop decides what surfaces |
+| The parallel branch's test asserts `== []` or a count that can legitimately be zero | That assertion cannot separate "nothing to do" from "every worker raised" — add a per-item outcome assertion ([testing-quality-sequential-dispatch-assumption-under-concurrency]) |
+
+## Instead of
+
+| If you are about to | Do this instead | Why |
+|---------------------|-----------------|-----|
+| Grep the callee's name, update its callers, run the tests | Also scan every function between the value's source and the callee for a reference to the new name that is not bound there | The intermediate helper is not a caller of the changed callee, and it is exactly where the `NameError` lives |
+| Read "N parallel tests fail with `[]`" as a scheduling or ordering bug | Print `future.exception()` for each future first | Reproduced 2026-09-28: a `NameError` in the worker gave `results: []`, exit code 0, no traceback |
+| Keep `if f.exception() is None: results.append(f.result())` as the whole collection loop | Record every non-`None` exception against its item | The loop is correct for the futures it records and silent for the ones that carried the failure |
+
+## Sources
+
+- https://docs.python.org/3/library/concurrent.futures.html — `Future.result()`: "If the call raised an exception, this method will raise the same exception"; `Future.exception()`: "Return the exception raised by the call … If the call completed without raising, `None` is returned"; `Executor.map()`: "If a *fn* call raises an exception, then that exception will be raised when its value is retrieved from the iterator" — the exception is stored on the future and surfaces only where a result is read
+- https://docs.python.org/3/library/symtable.html — `Function.get_parameters()` "Return a tuple containing names of parameters to this function"; `Function.get_locals()` "Return a tuple containing names of locals in this function"; `Symbol.is_referenced()` "Return `True` if the symbol is used in its block"; `Symbol.is_free()` "Return `True` if the symbol is referenced in its block, but not assigned to"; `SymbolTable.get_children()` "Return a list of the nested symbol tables" — the basis for the step-1 scan
+- Reproduction 2026-09-28 (CPython 3.14.4, macOS): `run_parallel` submits `run_with_retry(step)` to a `ThreadPoolExecutor(max_workers=4)` and appends `result()` only when `exception()` is `None`; `run_with_retry` calls `run_step(step, keys)` without binding `keys`. Output: `results: []`, exit code 0, no traceback. Calling `result()` on one future raised `NameError: name 'keys' is not defined` from inside the worker. The step-1 scan printed `run_with_retry: uses 'keys' but does not bind it` on the broken file and printed nothing on the fixed file (parameter added and passed at the `submit` site), which then returned three results
+- Field incident 2026-09-28 (a Python workflow runtime, task t175): `binding_keys` was threaded to the step executor but not to `_execute_step_with_retry`, which ran inside `ThreadPoolExecutor` workers; 8 `test_parallel_execution` cases failed showing `[]` steps and no traceback. An `ast.walk` scan listing each function's references to the name against its parameters/locals located the single missing hop and confirmed no other function on the path lacked it
diff --git a/wiki/backend/common/errors/async-failure-handling.md b/wiki/backend/common/errors/async-failure-handling.md
index cee3651..430c8e2 100644
--- a/wiki/backend/common/errors/async-failure-handling.md
+++ b/wiki/backend/common/errors/async-failure-handling.md
@@ -7,7 +7,7 @@ confidence: verified
 sources:
   - https://docs.spring.io/spring-framework/reference/integration/scheduling.html
 last_verified: 2026-07-10
-related: [backend-common-errors-exception-handling, backend-common-jobs-idempotent-handlers, backend-common-orm-transaction-boundaries]
+related: [backend-common-errors-exception-handling, backend-common-jobs-idempotent-handlers, backend-common-orm-transaction-boundaries, backend-common-change-impact-threading-a-parameter-through-executor-hops]
 ---
 
 # Handling Failures in Fire-and-Forget Async Work
@@ -44,6 +44,7 @@ silently never happen (points not accrued, emails not sent) with no error logs.
 | Async annotation on a method called via `this.method()` | Proxy-based async is bypassed by self-invocation — same trap as transactional annotations ([backend-common-orm-transaction-boundaries]); the method runs synchronously and its failures follow sync rules |
 | Async work enqueued inside a DB transaction that later rolls back | The async work still runs against rolled-back state; enqueue after commit or via transactional outbox ([backend-common-orm-transaction-boundaries]) |
 | Future stored but never consumed | Same as void: the exception sits unobserved inside the future. Consuming the future IS the error handling |
+| Collection loop records `result()` only for futures whose `exception()` is `None` | Every failed worker becomes missing work with no log line — record each non-`None` exception against its item; a `NameError` from a parameter that was not threaded through an intermediate helper shows up exactly this way ([backend-common-change-impact-threading-a-parameter-through-executor-hops]) |
 | Executor queue fills up | Bounded queue + explicit rejection policy; an unbounded queue hides the backlog until memory pressure ([backend-common-concurrency-shared-state-and-pools]) |
 
 ## Instead of
diff --git a/wiki/backend/index.md b/wiki/backend/index.md
index f83b2f8..5ee05eb 100644
--- a/wiki/backend/index.md
+++ b/wiki/backend/index.md
@@ -39,6 +39,7 @@ Match your situation to a "load when" line; load only matching pages.
 | [corpus-sweep-before-a-rejection-rule](common/change-impact/corpus-sweep-before-a-rejection-rule.md) | Adding a rule to a compiler/linter/parser/schema validator/repo gate that will start rejecting input the tool accepted silently, and the existing corpus must keep passing; producing the evidence a plan needs before writing the rule (reject count + rejected-path list, enumeration method stated); such a rule landed and went red on inputs nobody had called defective; deciding between narrowing the rule, an opt-in strictness level, and an exemption (whether unimplemented declarative input should reject/warn/ignore at all → common/api-design/unenforced-declarations) |
 | [aggregation-layer-of-a-shared-helper](common/change-impact/aggregation-layer-of-a-shared-helper.md) | A plan, brief, or review comment says to unify or replace "the N call sites" of a helper and names them by line number rather than by what the code does; one site feeds a set-level SQL aggregate while another returns a per-row value that application code reduces later; a "shared helper" landed with one consumer adopting it and the other keeping its old semantics; deciding which layer owns a missing-value rule and whether the plan's grep-count acceptance criterion is reachable at all |
 | [call-site-enumeration](common/change-impact/call-site-enumeration.md) | Changing the contract of a function/method/constructor other code calls — adding, removing, reordering or redefining a parameter — and you need the complete call-site list; scoping such a migration from a search; a migration scoped from recon came back green and then failed on call sites the search never listed; deciding whether to append a parameter or make it keyword-only (release-level re-test scope → qa/process/regression-scope) |
+| [threading-a-parameter-through-executor-hops](common/change-impact/threading-a-parameter-through-executor-hops.md) | Adding a parameter and threading its value through intermediate helpers (retry wrapper, dispatcher) to a callee when one hop is an `Executor.submit()`/`map()` boundary; scanning each function on the path for a reference to the new name it does not bind before running tests; a parallel section produced no results (`[]`, zero recorded outcomes) with no traceback and exit code 0 after such a change |
 | [compiler-as-call-site-inventory](common/change-impact/compiler-as-call-site-inventory.md) | Adding a required field to a TypeScript type and relying on the compiler error list as the complete inventory of sites that build it; enumerating those sites by grepping the type name; publishing that count into a plan or worker brief; a monorepo package whose `tsconfig.json` `include` omits its own tests |
 | [cross-module-consumer-census](common/change-impact/cross-module-consumer-census.md) | Your task added a public function, endpoint, export, or hook whose consumer belongs to a *different* task (parallel work split by file ownership, a backend change whose UI wiring is another ticket); deciding whether that task is done; a feature typed, tested, reviewed and merged changes nothing at runtime; separating same-module helpers and entry points from genuine orphans in a zero-consumer list |
 | [inserting-a-guard-before-an-existing-side-effect](common/change-impact/inserting-a-guard-before-an-existing-side-effect.md) | Implementing, adopting, or auditing a planned change that adds a precondition guard to an existing script/function where the plan names the insertion point in prose ("after X is built"); the target has an earlier unconditional default/auto-create side effect touching the state the guard checks; writing the test for such a guard's refusal path |
diff --git a/wiki/security/agent-exposure/authorization-scope-persistence.md b/wiki/security/agent-exposure/authorization-scope-persistence.md
index 232111a..5048e05 100644
--- a/wiki/security/agent-exposure/authorization-scope-persistence.md
+++ b/wiki/security/agent-exposure/authorization-scope-persistence.md
@@ -8,7 +8,7 @@ sources:
   - https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/scope-contract.md
   - https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md
 last_verified: 2026-08-24
-related: [security-agent-exposure-in-session-tool-exposure, infrastructure-agent-orchestration-autonomous-decision-rulings]
+related: [security-agent-exposure-in-session-tool-exposure, infrastructure-agent-orchestration-autonomous-decision-rulings, security-agent-exposure-capability-flag-across-adapters]
 ---
 
 # Gating a Dangerous Agent Capability on Persisted Authorization
@@ -48,6 +48,7 @@ specific target and must be established before the agent acts.
 | Case | Then |
 |------|------|
 | Read-only reconnaissance (passive lookups, public data) | Allowed before a grant; gate only the active/mutating actions in step 2 |
+| The gate is a flag in a config struct shared by several backends/adapters and only some of them read it | An adapter that never reads the flag runs unconfined while the caller believes it gated — census the readers, refuse the flag in non-enforcing adapters, pass each adapter's native lock-down switch ([security-agent-exposure-capability-flag-across-adapters]) |
 | Authorization covers one target but the agent discovers an adjacent one | The new target is out of scope until its own grant is written — discovery does not extend authorization |
 
 ## Instead of
diff --git a/wiki/security/agent-exposure/capability-flag-across-adapters.md b/wiki/security/agent-exposure/capability-flag-across-adapters.md
new file mode 100644
index 0000000..b65f9bb
--- /dev/null
+++ b/wiki/security/agent-exposure/capability-flag-across-adapters.md
@@ -0,0 +1,87 @@
+---
+id: security-agent-exposure-capability-flag-across-adapters
+domain: security
+category: agent-exposure
+applies_to: [general]
+confidence: verified
+sources:
+  - https://cwe.mitre.org/data/definitions/636.html
+  - https://cheatsheetseries.owasp.org/cheatsheets/Secure_Product_Design_Cheat_Sheet.html
+  - https://github.com/badlogic/pi-mono/issues/555
+last_verified: 2026-09-28
+related: [security-agent-exposure-authorization-scope-persistence, backend-common-api-design-unenforced-declarations, testing-mocking-captured-call-arguments, security-authn-retiring-a-replaced-auth-gate]
+---
+
+# A Capability-Restriction Flag in a Shared Config That Only Some Adapters Enforce
+
+## When this applies
+
+A spawner drives several interchangeable backends through one config struct —
+agent-harness adapters (claude / codex / pi), CI runners, sandbox providers,
+storage drivers — and the struct carries a restriction flag (`tool_use: false`,
+write confinement, network off, read-only) that one adapter implements and the
+others never read. Also when a caller sets that flag for every backend and
+downstream automation (auto-commit, merge, push, deploy) treats the flag as the
+guarantee that the backend ran confined; and when reviewing a new adapter added
+to such a struct.
+
+## Do this
+
+1. **Census which adapters read the flag.** Grep the field name across every
+   adapter implementation; each adapter with zero reads runs at its own default
+   permissions whatever the caller set. That is CWE-636 "Not Failing Securely":
+   the product falls "back to a state that is less secure than other options
+   that are available, such as … using the most permissive access control
+   restrictions".
+2. **Make every non-enforcing adapter refuse the flag with an explicit error
+   before spawning.** Refusal at spawn time is the fail-closed arm; a silently
+   ignored restriction is a recorded-but-unenforced declaration that reads as
+   protection to everyone downstream
+   ([backend-common-api-design-unenforced-declarations]).
+3. **Gate the flag at the caller on the adapter id** — set it only for adapters
+   whose enforcement exists — so the caller's promise and the adapter's behaviour
+   agree in code. Step 2's refusal then runs as defence in depth, not as the
+   normal path.
+4. **Pass each adapter's own lock-down switch unconditionally.** Least privilege
+   is "the minimum amount of access necessary to perform their job"; pi ships
+   `--no-tools` ("Disable all tools by default (built-in and extension)"). With
+   the adapter-native switch always present, the shared flag selects among
+   already-confined invocations instead of being the only thing standing between
+   the agent and its default permissions.
+5. **Test the true arm per adapter.** For each non-enforcing adapter, a test
+   that sets the flag and asserts the spawn is refused — red before the fix. For
+   the enforcing adapter, assert the spawn command carries its confinement
+   argument ([testing-mocking-captured-call-arguments]). Per-adapter reviews
+   miss this class because the flag was false everywhere when the adapter was
+   written.
+
+| Adapter | Caller | Adapter |
+|---------|--------|---------|
+| Implements the restriction | Sets the flag | Passes its own confinement args; a test asserts them |
+| Does not implement it | Leaves the flag unset (gate on adapter id) | Refuses with an explicit error naming the flag and the adapter if reached anyway |
+| Added after the flag existed | Inherits the gate's default: unset | Exhaustive dispatch (a `match` with no wildcard arm, a `supports(flag)` method defaulting to `false`) forces the decision at compile or review time |
+
+## Edge cases
+
+| Case | Then |
+|------|------|
+| The adapter enforces part of the restriction (read-only tools yes, network off no) | Refuse the sub-capability it cannot enforce; partial enforcement reported as full is the same weakness |
+| Downstream automation already trusted the flag for past runs | Treat every earlier run under a non-enforcing adapter as unconfined and audit its outputs (commits, pushes, writes) before trusting the flag going forward |
+| Existing tests exercise only the false arm | Add the true arm per adapter — a review that sees the flag false everywhere approves an adapter that never reads it |
+| The adapter's CLI has no lock-down switch at all | Refuse the flag for that adapter and record it in the adapter table; the spawner emulating confinement around an unconfined process is not enforcement |
+| The flag is read but only to write a log line or a status field | Count that as zero enforcement in step 1 — the read is cosmetic, the permissions are unchanged |
+
+## Instead of
+
+| If you are about to | Do this instead | Why |
+|---------------------|-----------------|-----|
+| Set a restriction flag for all backends in one shared config | Gate it on the adapter id and refuse it in every adapter that cannot enforce it | Field incident 2026-09-28: the pi adapter never read the flag; a RED test showed pi spawned with the restriction set and no confinement argument |
+| Ignore an unsupported config field in an adapter so the spawn "just works" | Return an explicit error naming the flag and the adapter | CWE-636: failing functional instead of failing safe "causes administrators to have a false sense of security" |
+| Rely on the shared flag alone for confinement | Pass the adapter's native lock-down flag on every spawn | Secure by default: the confined invocation stops depending on the shared struct being interpreted |
+
+## Sources
+
+- https://cwe.mitre.org/data/definitions/636.html — CWE-636 "Not Failing Securely ('Failing Open')": "When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as … using the most permissive access control restrictions"; "At the least, it causes administrators to have a false sense of security. This weakness typically occurs as a result of wanting to 'fail functional' to minimize administration and support costs, instead of 'failing safe.'"
+- https://cheatsheetseries.owasp.org/cheatsheets/Secure_Product_Design_Cheat_Sheet.html — Principle of Least Privilege: "users should only be given the minimum amount of access necessary to perform their job"; Fail Securely: "Design systems to fail in a secure state, rather than exposing vulnerabilities when they malfunction"; Secure by Default: "Configure systems and software to be secure by default, with minimal manual setup or configuration required"; Defense-in-Depth: "multiple layers of security controls"
+- https://github.com/badlogic/pi-mono/issues/555 — the request that added `--no-tools` to the pi coding agent (closed); `pi --help` on 2026-09-28 lists `--no-tools, -nt  Disable all tools by default (built-in and extension)`, and the package CHANGELOG records that "`--no-tools` now disables all tools by default rather than only built-ins" (#2835, #3452) — the adapter-native lock-down switch step 4 passes unconditionally
+- Field incident 2026-09-28 (a Rust multi-agent runner, `crew-run`, task t7): `role_harness_cfg` set `tool_use` for every harness; `pi.rs` never read the field, so pi ran with default tool access while the run's commit/merge/push automation trusted the flag. A RED test asserting refusal showed the pi spawn attempted with `tool_use=true`; the fix gated the flag on the adapter id at the caller, made each non-supporting adapter return an explicit error before spawning, and passed `--no-tools` unconditionally
diff --git a/wiki/security/index.md b/wiki/security/index.md
index 2af5a92..f8e0707 100644
--- a/wiki/security/index.md
+++ b/wiki/security/index.md
@@ -27,6 +27,7 @@ Match your situation to a "load when" line; load only matching pages.
 |------|-----------|
 | [in-session-tool-exposure](agent-exposure/in-session-tool-exposure.md) | Exposing executable actions to an LLM agent operating inside a user's authenticated session (WebMCP tools, in-page assistant, browser-agent integration); deciding confirmation gating per tool consequence class (`consequentialHint`, `readOnlyHint`); reviewing prompt-injection blast radius of a tool set |
 | [authorization-scope-persistence](agent-exposure/authorization-scope-persistence.md) | Authoring a skill or agent that can take consequential, hard-to-reverse actions against a target (active security scanning, exploitation, destructive ops, spending); authorization depends on the specific target and must be established before acting; keeping a `--force` flag from bypassing the authorization check; scoping network blast radius |
+| [capability-flag-across-adapters](agent-exposure/capability-flag-across-adapters.md) | A restriction flag (`tool_use: false`, write confinement, network off) lives in a config struct shared by several interchangeable adapters/backends (agent harnesses, runners, sandboxes) and only some adapters read it; a caller sets it for every adapter; downstream automation (commit/merge/push) trusts the flag as the confinement guarantee; reviewing a new adapter added to such a struct; choosing the refuse-vs-ignore behaviour for an unsupported restriction |
 
 ## authn