The security model's input-validation section still described path traversal as
a per-call check with a macOS symlink footnote. It now describes what actually
exists: one predicate, a module-internal engine, three exported shapes none of
which can hand back a usable path when the answer is unsafe, the branded return
type, and the named acceptance policy — including the point the old wording
invited a reader to get wrong, that allowing an absolute candidate does not
relax containment.
Also records the two checks deliberately NOT routed through the predicate and
why each is narrower or stricter rather than a second opinion, so a later
cleanup pass does not read them as stragglers.
Required by the Changed changeset: scripts/lint-docs-required.cjs makes
Added/Changed/Deprecated/Removed fragments demand a file under docs/, and
CONTEXT.md is at the repo root, so the glossary entry alone would not have
satisfied it. The lint currently reports invalid_pr against the mandated pr:0
placeholder and becomes meaningful after backfill.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
9953d02184