Root cause · sequence
Two runs, one envelope
Run 1
Summarization run
<untrusted-post>
raw tweet + fetched article text
envelope coverage ends at this write
writes
.Twitter/summary.md
node written to the workspace — no envelope persisted with it
hours or days
no shared call stack, request, or session
loads
Run 2
Home agent run
trusted
build_context_message
renders into context
<file name=".Twitter/summary.md">
tweet-derived summary text
</file>
tweet-derived summary text
</file>
a plain, unwrapped <file> block — nothing marks this load untrusted
Fig. 2 — The <untrusted-post> envelope wrapped run 1’s input; nothing wrapped run 2’s load of the persisted summary.