Distillation

🔴 (10:04) [enforced-workflow] User reiterated continuation of issue #4 only from completed notifications: use the completed ZIP-hardening design if substantive; add deterministic fail-first regressions for all completed JSON/pin, descriptor, ZIP, and CLI-publication findings before fixing production code; never poll, duplicate, or overlap active work; then run targeted and full verification and obtain fresh independent correctness and security reviews against the exact final tree.
🔴 (10:04) [enforced-review-retry] User reiterated that if a reviewer returns empty once, retry it once; if it returns empty twice, replace only that reviewer with smaller disjoint scopes.
🔴 (10:04) [enforced-follow-up] User directed retaining exactly one follow-up if any relevant work remains active.
🟡 (10:04) Assistant reported that no ZIP-hardening design completion notification had arrived, so shared source and tests remained untouched to avoid overlapping active work.
🟡 (10:04) Follow-up g8toqd56 was scheduled for 15 minutes and became the single pending continuation, replacing prior follow-up 5odv7xg3.

Observations