@@ -69,6 +69,10 @@ Only `w:instrText` is known to the library today. A `replace()` targeting text i
 
 #77 made `unpack_document` refuse a symlinked nearest-existing ancestor of `output_dir`, but `Document.open(path, workspace_dir=<symlink>)` still extracts through the link: `workspace.py` creates the workspace directory before calling unpack, so the guard sees an existing real directory. Applying the same rule at workspace creation would refuse `workspace_dir="/tmp/<new>"` on macOS (`/tmp → private/tmp`), so it needs the same nearest-existing-ancestor rule *and* a decision on whether a user-chosen `workspace_dir` under a system symlink is legitimate (it is on macOS; document or resolve it). Found by the multi-review of PR #88. Also: `openspec/specs/structured-errors/spec.md:49` still describes an unscoped `replace()` call that the runtime rejects.
 
+### 82. `start_session`'s control-channel probe can crash a starting ipykernel
+
+The #91 diagnostics caught it on their first CI failure (run 33331432527, load average 1.14 — an idle runner): the kernel wrote `kernel.json` in 0.5 s, then our `kernel_info` probe on the control channel raised inside ipykernel's ZMQStream callback — `KeyError: '_control_lock'` (traitlets) — because the control message arrived before the kernel finished initializing; the callback's exception left the control stream broken and the kernel never replied within the remaining 59.5 s. So the residual "flake" is a race our own probe triggers, not load. Fix directions, in preference order: probe on the shell channel or wait for the iopub `status: starting` message before touching control; retry with a *fresh* client (the broken stream may be permanent for that connection); check whether current ipykernel has fixed `_control_lock` initialization order and pin/upgrade. Regression test: a kernel whose control channel receives `kernel_info` immediately after `kernel.json` appears must still become ready.
+
 ### 69. Return-leg reconciliation: which changesets survived?  [design]
 
 The product loop is agent proposes → human adjudicates in Word → document comes back; accepted revisions become plain text, rejected ones vanish, and there is no way to ask "which of my changesets survived?". A sent-vs-returned compare keyed on changeset `w:date` + content. Design first; large.