fix(t3): transport reach and writer-mode note (#273)

.claude/skills/verify-open-pstack/scripts/core.test.ts

@@ -66,9 +66,10 @@ describe('registry and ownership', () => {
   test('only the T3 dispatch surfaces reach t3:dispatch, and self-test never adds a T3 session', () => {
     const reach = (filename: string) => classify([{ filename }], registry).features.includes('t3:dispatch');
     for (const filename of ['plugins/pstack/skills/poteto-mode/references/provider-dispatch.md', 'plugins/pstack/skills/poteto-mode/references/codex-tools.md',
-      'plugins/pstack/skills/setup-pstack/SKILL.md', '.claude/skills/verify-open-pstack/features/recipes.ts']) expect(reach(filename)).toBe(true);
+      'plugins/pstack/skills/setup-pstack/SKILL.md', '.claude/skills/verify-open-pstack/features/recipes.ts',
+      '.claude/skills/verify-open-pstack/scripts/harness.ts', '.claude/skills/verify-open-pstack/scripts/doctor.ts']) expect(reach(filename)).toBe(true);
     for (const filename of ['plugins/pstack/skills/poteto-mode/references/model-catalog.md', 'plugins/pstack/skills/poteto-mode/SKILL.md',
-      'plugins/pstack/hooks/hooks.json', '.claude/skills/verify-open-pstack/scripts/harness.ts']) expect(reach(filename)).toBe(false);
+      'plugins/pstack/hooks/hooks.json', '.claude/skills/verify-open-pstack/scripts/verify.ts']) expect(reach(filename)).toBe(false);
     const r = receipt(true);
     expect(requiredHarnesses(r)).toEqual(['claude', 'codex']);
     r.runFeatures = ['t3:dispatch'];

.claude/skills/verify-open-pstack/scripts/core.ts

@@ -20,6 +20,7 @@ export function matches(path: string, pattern: string): boolean {
 const T3_DISPATCH_PATHS = [
   'plugins/pstack/skills/poteto-mode/references/provider-dispatch.md', 'plugins/pstack/skills/poteto-mode/references/codex-tools.md',
   'plugins/pstack/skills/setup-pstack/SKILL.md', '.claude/skills/verify-open-pstack/features/recipes.ts',
+  '.claude/skills/verify-open-pstack/scripts/harness.ts', '.claude/skills/verify-open-pstack/scripts/doctor.ts',
 ];
 
 export const VERSION_MANIFESTS: Readonly<Record<string, Harness>> = {

plugins/pstack/skills/poteto-mode/references/provider-dispatch.md

@@ -59,6 +59,7 @@ On the T3 route:
 - `inherit-parent` and `auto` call `delegate_task` with no `target`, so the child inherits the parent's provider, model, and options. Record the parent selection from the snapshot's `inheritedProviderInstanceId`, `inheritedModel`, and `inheritedOptions`.
 - A rolling alias such as `opus` resolves only among that provider's models, from the `orchestrator_capabilities` search `claude-<alias>`; the unfiltered list omits models, so search before treating a model as missing. Keep only IDs that match the alias's versioned-predecessor form in the catalog's [rolling-alias table](model-catalog.md#kept-predecessors-and-normalization), and take the highest revision, compared number by number. A suffix that is not digits and hyphens, such as `-high`, is not a revision. A registered exact pin stays exact.
 - A writer that needs its own checkout uses `isolation: "worktree"`. T3 creates it from the parent's commit and leaves uncommitted edits out, so give the child a committed base or explicit fixture inputs in its task. Never commit unrelated changes for it, and never create a child checkout in the shell.
+- The [writer sandbox](#writer-sandbox) setting governs only lanes that take the standalone route. A writer on the T3 route runs with whatever runtime mode the T3 session has, and needs no setting line.
 - T3 does not enforce read-only access. A read-only lane on the T3 route is advisory read-only: add "Do not edit files." to its task and record it as advisory. When the calling skill requires enforced read-only access, the lane takes the standalone route.
 
 Keep one T3 result record per lane: the capability snapshot, the normalized descriptor, the request, and every raw response. Its model evidence is T3 launch configuration, never `provider-report` or `pinned-argv`. It shows what T3 launched, not which model served the request or the reasoning depth it applied.

plugins/pstack/skills/setup-pstack/SKILL.md

@@ -43,7 +43,7 @@ A qualifying rerun is a rerun whose sheet loaded, whose loaded state has a valid
 
 Otherwise, ask whether to keep these role-to-family assignments or change named roles. Keeping them is the default. Apply only role changes the operator names; never offer a reset of a customized sheet to the first-run assignments. A changed role may use any model-matrix family, `inherit-parent`, or `auto`.
 
-Ask once about a provider's setting line when the loaded state has none for it, and only for these providers: Codex, and each provider that a writer role (see step 3) uses through the external runner and whose Access modes cell lists `isolated-write-full-access` but not `isolated-write`. For Codex, ask whether its writer lanes that the external runner launches should run with Codex's full-access sandbox. Say that full access lets the writer launch a browser and write dot-folders such as `.agents/`, and that it removes every sandbox limit, including filesystem confinement to the worktree. For any other provider, ask whether it may write at all, and warn: "Nothing stops this provider from writing outside its worktree, including the main repository's shared Git state." Declining is the default. Record `<provider> writer sandbox: full-access` on a yes and `<provider> writer sandbox: bounded` on a decline, so a rerun does not ask again. When the line exists, keep it unless the operator names a change, and do not ask.
+Ask once about a provider's setting line when the loaded state has none for it, and only for these providers: Codex, and each provider that a writer role (see step 3) uses through the external runner and whose Access modes cell lists `isolated-write-full-access` but not `isolated-write`. For Codex, ask whether its writer lanes that the external runner launches should run with Codex's full-access sandbox, and say that the line does not apply to writer lanes that T3 runs. Say that full access lets the writer launch a browser and write dot-folders such as `.agents/`, and that it removes every sandbox limit, including filesystem confinement to the worktree. For any other provider, ask whether it may write at all, and warn: "Nothing stops this provider from writing outside its worktree, including the main repository's shared Git state." Declining is the default. Record `<provider> writer sandbox: full-access` on a yes and `<provider> writer sandbox: bounded` on a decline, so a rerun does not ask again. When the line exists, keep it unless the operator names a change, and do not ask.
 
 ### 3. Parse per-family efforts