What
When sandboxing is disabled, the model is now told directly that commands run without sandbox restrictions and that earlier sandbox instructions no longer apply, so it does not keep working around limits that are gone.
Details
- Two new lists of refusal reasons ship alongside it: write refusals (
compliance_restricted,org_mismatch,org_toggle_disabled,summon_foreign_sender,user_entitlement_denied,write_gate_disabled) and device-binding refusals (bind_attestation_stale,bound_session_unattested_write,untrusted_device).
Evidence
Commands now run without sandbox restrictions; the earlier sandbox instructions no longer apply.
Strings lifted out of the shipped bundle, so the claim above can be checked against them.