- The dump script cuts query strings from CSS url() in style attributes,
<style> nodes, and the inlined stylesheets (signed asset URLs), empties
srcdoc, and covers background and xlink:href.
- Persisted dumps are chmod 600; MEDIUM redaction findings persist (an
authenticated page shows emails) and the prose says so; earlier runs'
dumps are swept before the first dump of a run unless --keep-dom.
- The Aside dump prose asks for `'` in a pasted URL to be percent-encoded
(a bare single quote would end the script) and never to paste an unread
URL.
- Repo-config ignores are evidence, not settled decisions, in /review,
/ship, and design-review's probe prose; the scan JSON's text fields are
named as untrusted.
- design-html's skeleton ceiling is re-measured (54,545); ship goldens
refreshed for the checklist prose.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
