## Next steps The durable skill in this workbook is not command memorization\. It is the ability to say exactly what changed\, what stayed available\, who had authority\, and what evidence supports that account\. A useful conclusion may be a verified local result\. It may also be a refusal\, an unavailable dependency\, an ambiguous identity\, or an inspection gap\. Reporting that boundary accurately is better than manufacturing success by changing settings\, supplying credentials\, guessing a target\, or widening permissions\. ### A safe workflow for the next piece of work 1. **Choose the need before the mechanism\.** Returning to history\, recalling evidence\, asking a tangent\, understanding a tool decision\, and adding a capability are different needs\. Use a reading path and its source chapters before selecting a command or API\. 2. **Establish the target and scope\.** Record the persistent session identity and file when relevant\, the active cwd\, the exact agent\/job association\, the tool and any inner device operation\, or the domain object and revision\. Do not use a title\, row number\, or success toast as the sole identity check\. 3. **Choose an owned practice surface\.** Use the Memory simulator\, printed Tan fixtures\, inert permissions cases\, or a disposable copy of the supplied examples\. Keep personal journals\, memory rows\, settings\, credentials\, and real review packets out of the workbook route\. 4. **Predict the boundary\.** Write down the state expected to change and at least one state expected not to change\. Include authority\, pending work\, and copies outside the immediate view\. For a tool decision\, name the applicable policy key and effective mode rather than relying on the displayed tool label alone\. 5. **Use one supported action or inspection\.** Follow the original caption and prerequisites\. Printing a native command is not running it\; selecting a simulator stage is not a real memory operation\; reading an approval case is not answering a live dialog\. Stop at setup\, identity\, permission\, or compatibility failures rather than silently substituting another path\. 6. **Check the specific postcondition\.** Inspect the relevant complete state\, journal\, result body\, or owned file\. Use the original chapter’s falsifiable acceptance checks\. A receipt is evidence about its own operation\, not automatic proof of project correctness\. An approval is not proof of execution\, and execution is not proof that the intended effect succeeded\. 7. **Record the result at its real verification level\.** Separate what the source predicts\, what the historical report observed\, and what you personally observed\. Mark unexecuted or blocked checks as such\. Keep complete sensitive diagnostics private\. 8. **Finish without crossing another boundary accidentally\.** Returning to Main is not cancellation\. Cancellation is not undo\. A local accepted draft is not published\. No cleanup is needed for reading the permissions cases\. Any later disposal is limited to exclusively owned exercise material no longer needed\; destructive session or memory commands are not a cleanup shortcut\. ### Make the next check falsifiable The supplied stories provide concrete standards without requiring a new live service experiment\: | Learning target | Check to carry forward | Claim to avoid | | --- | --- | --- | | Continuity | The intended journal identity and active project scope agree with the selected fictional target\; today’s workspace still has today’s label\. | Reopening yesterday restored yesterday’s files\. | | Memory | The simulator reports fictional tutorial state\; the source correction workflow requires an exact ID and full row content before an edit\. | Selecting a stage saved or recalled a real memory\. | | Tan control | The intended agent\, any current backing job\, and the current input recipient are separately identified\; available output is read in its actual form\. | A job label\, delivery receipt\, or automatic return establishes successful work or terminal agent removal\. | | Permissions | Explain the exact policy source and key\, required prompt count\, and recorded execution count\; distinguish denial\, dismissal\, unavailable UI\, revised input\, and an OS error\. | No prompt proves safety\, Approve persists a blanket grant\, or yolo supplies OS authority\. | | Extension design | The original domain checks distinguish stale revision\, missing grant\, cancellation\, and a successful mutation\; the relevant host scenario reaches the layer being claimed\. | A resolved promise\, registered tool\, or visible widget proves the full workflow\. | | Packet review | The fictional parent\, pre\-clear material\, and nested records are inspected through an available raw\, decoded\, or explicitly permitted rendered route\. | A blank viewer\, hidden panel\, encrypted link\, or cancelled loader proves privacy\. | For an offline extension starting point\, the original [debugging chapter]() contains a complete Review Desk domain\-test exercise\. Use its existing code and stated limits rather than adding a provider call merely to make the exercise feel more complete\. For continuity\, begin with [the ledger’s fixture inspection]()\. For Memory\, begin in [the local fictional lab]()\. For Tan\, the [already\-running chapter]() is the immediate control reference\, while its fictional assignments can be studied without launching work\. For permissions\, compare `boundary-approval-does-not-persist` in [Boundary Desk’s data]() with `dispatch-explicit-prompt-twice` in [Dispatch Desk’s data]()\. Both recorded two prompts and one inert execution\, but for different reasons\: two separate calls in the first case\, outer and inner gates for one dispatch in the second\. If your explanation treats them as the same lifetime\, return to [One call at a time]()\. Use [Recovery without widening permission]() to finish with a precise blocked outcome rather than a broader policy\. ### Keep disclosure as a separate decision Nothing about finishing the book authorizes publishing a real transcript\, dump\, sidecar\, memory\, or complete access\-bearing share link\. The [safe disclosure checklist]() applies to the actual outgoing representation\, not merely its visible page\. If inspection is incomplete\, hold the packet\. Do not run a share to discover its policy or repeat an ambiguous share to recover a URL\. Likewise\, no additional authentication\, provider inference\, destructive session operation\, privileged\-broker exercise\, personal settings change\, or live upload is needed to complete this unified route\. Service adapters remain contracts until their real prerequisites and separately authorized verification exist\. A tool\-tier declaration is not a substitute for that authorization\. Carry the six connections into future work\: distinguish stores\, distinguish forks\, stop the owned operation\, bind authority to a lifetime\, separate delivery from disclosure\, and match evidence to its layer\. Those habits make both operation and extension design easier to explain\, recover\, and trust\.