What
A new layer checks every storage key before it reaches the storage engine and rejects malformed ones with a specific message instead of letting them through. You would only ever see one of these if something were already wrong.
Details
- It enumerates the legal directory names under the user config directory, including
mcp-discovery-cache, and the plugin registry files:installed,marketplaces,flagged,catalog,inUseSweep. - Log channels are restricted, with the error text "must be debug, telemetry or apiDump".
- Relationships are enforced too, such as a scratch relative path requiring a session id.
Evidence
must be debug, telemetry or apiDump
Strings lifted out of the shipped bundle, so the claim above can be checked against them.