Whiteboard permission verdicts and state sanitising are hardened, behind the disabled whiteboard skill.
What
Permission checks, board state loading and merge-state application all got stricter validation. Not reachable in this build.
Details
sendAccess()returns'unknown'for an absent module, a rejection, or a transient code; onlygranted,prompt, or a member ofPERMANENTcounts as a verdictcapability_disabledandcapability_removedmoved out of PERMANENT and are treated as transient, which leaves Send livesanitize()drops duplicate ids, normalises negative width/height to a top-left corner, clamps textsizeto 8..64, and nulls arrow bindings that do not point at a connectable element- ping counts are bounded to 0..1e9 and
ping.atis sliced to 64 chars - the merge-state helper rejects addition ids over 40 characters, rejects
fromId/toIdthat do not name a box, sticky or text node, clampssize, and refines the rename guard so a board with an unreadable send marker gets its own message - gate: whiteboard skill
isEnabled g5v = Wms() && Ige(), andWmsreturns!1
Evidence
const PERMANENT = ['denied', 'unavailable', 'consent_required', 'not_writer', 'not_granted', 'not_declared'];
Strings lifted out of the shipped bundle, so the claim above can be checked against them.