- AGENTS.md and the skill: only the user's browser is off (xdg-open); browser tools run in the sandbox, headless or in a Wayland window; host-run project files are read-only - wt rm: refuse a dirty worktree before wt-pre-rm runs, so its stack is not stopped for nothing