@@ -266,7 +266,7 @@ Claude does channel work in an isolated [sandbox](https://claude.com/docs/claude
 
 * **A domain entry**: a hostname added to a bundle that applies to the channel. Requests to it pass with no credential attached; see [Add a domain](#add-a-domain).
 * **A [connector](#add-a-connector)**: a credential that applies to the channel. Requests matching its [allowed websites](#set-allowed-websites) pass with that credential attached.
-* **The channel's [environment](https://claude.com/docs/claude-tag/concepts/glossary.md#environment)**: the compute configuration the channel's sessions run in, which carries its own network access setting, starting at the Trusted access level that covers common package registries. Requests to hosts it allows pass with no credential; see [Broad web access through the environment](#broad-web-access-through-the-environment).
+* **The channel's [environment](https://claude.com/docs/claude-tag/concepts/glossary.md#environment)**: the compute configuration the channel's sessions run in, which carries its own network access setting, starting at the **Limited access** level that covers common package registries. Requests to hosts it allows pass with no credential; see [Broad web access through the environment](#broad-web-access-through-the-environment).
 
 A host that none of these allows stays unreachable, and when more than one bundle applies to a channel, the entries of all of them apply. Web search is governed by none of them, because searching happens on Anthropic's servers rather than in the sandbox; see [Web search vs. network requests](#web-search-vs-network-requests). Claude's GitHub API requests and git operations are governed by none of them either, because they go through a separate GitHub proxy. That proxy limits them to the repositories you [granted to the channel](https://claude.com/docs/claude-tag/admins/configure-github.md#grant-repository-access), except that git may still be able to clone public repositories you didn't grant.
 
@@ -293,7 +293,7 @@ You don't have to predict the full list up front. When a request is blocked, Cla
 * **The bundle applied before the thread started.** A bundle added to a channel after a thread started isn't guaranteed to reach that thread, so start a fresh thread to use its entries.
 * **The request came from a channel, not a DM.** A bundle added to a channel doesn't apply in DMs.
 
-Typical entries are hosts the work calls without a key, such as a docs site or a public API. Common package registries are usually already reachable through the [environment's Trusted access default](#broad-web-access-through-the-environment), and a host that needs a credential belongs in a [connector](#add-a-connector) instead. Entries appear under **What's in it** with the type **Domain**, and each row's menu has **Edit** and **Remove**.
+Typical entries are hosts the work calls without a key, such as a docs site or a public API. Common package registries are usually already reachable through the [environment's **Limited access** default](#broad-web-access-through-the-environment), and a host that needs a credential belongs in a [connector](#add-a-connector) instead. Entries appear under **What's in it** with the type **Domain**, and each row's menu has **Edit** and **Remove**.
 
 > [!NOTE]
 >
@@ -303,7 +303,7 @@ Typical entries are hosts the work calls without a key, such as a docs site or a
 
 Domain entries allow hosts one at a time. For a channel whose work needs more of the web, the environment setting grants broader access. An [environment](https://claude.com/docs/claude-tag/concepts/glossary.md#environment) is the sandboxed compute configuration the channel's sessions run in, and it carries its own network access setting.
 
-A new environment's network access level is Trusted access, which allows a [documented set of package registries and developer hosts](https://code.claude.com/docs/en/cloud-environments#default-allowed-domains). A channel can already reach hosts like `pypi.org` and `registry.npmjs.org` with no domain entry.
+A new environment's network access level is **Limited access**, which allows a [documented set of package registries and developer hosts](https://code.claude.com/docs/en/cloud-environments#default-allowed-domains). A channel can already reach hosts like `pypi.org` and `registry.npmjs.org` with no domain entry.
 
 To give a workspace or channel broader access, create an organization-shared environment with a more permissive level and set it on that place's page, under **Advanced > Sessions > Environment**, as described in [Configure the environment for a scope](https://claude.com/docs/claude-tag/admins/customize.md#configure-the-environment-for-a-scope). **Full access** allows any domain; see [Network access in the Claude Code docs](https://code.claude.com/docs/en/cloud-environments#network-access) for the other levels.
 
 
@@ -63,7 +63,7 @@ For each outbound request from the sandbox, other than a GitHub API request or a
 | Is allowed by the network access setting of the [environment](https://claude.com/docs/claude-tag/concepts/glossary.md#environment) the [scope](https://claude.com/docs/claude-tag/concepts/glossary.md#scope)'s sessions run on | The proxy forwards the request without a credential. |
 | Matches none of these | The proxy blocks the request. |
 
-A new environment's network access level defaults to Trusted access, so a fresh setup can reach a documented set of package registries and developer hosts before an admin has configured anything. The [cloud environments documentation](https://code.claude.com/docs/en/cloud-environments#default-allowed-domains) lists the covered hosts. To narrow that default, pin an environment with a stricter level, such as No access.
+A new environment's network access level defaults to **Limited access**, so a fresh setup can reach a documented set of package registries and developer hosts before an admin has configured anything. The [cloud environments documentation](https://code.claude.com/docs/en/cloud-environments#default-allowed-domains) lists the covered hosts. To narrow that default, pin an environment with a stricter level, such as **No access**.
 
 The same rules apply to code Claude runs in the sandbox, like `curl` or a `fetch` call: a request is blocked unless its host is allowed by one of the layers above.
 
 
@@ -51,11 +51,11 @@ This means:
 
 ### Network egress
 
-In an Anthropic-hosted environment, outbound traffic from a channel session's sandbox is default-deny, apart from its GitHub API requests and git operations. Requests go only to hosts an allow layer covers, and the layers are a [credential's allowed websites](https://claude.com/docs/claude-tag/admins/connections/custom.md#fill-out-the-custom-tool-form), the [allowed domains](https://claude.com/docs/claude-tag/admins/add-connections.md#allow-a-host-without-a-credential) that apply to the channel, and the network access setting of the [environment](https://claude.com/docs/claude-tag/concepts/glossary.md#environment) the scope's sessions run on. A new environment's default level, Trusted access, already covers a [documented set of package registries and developer hosts](https://code.claude.com/docs/en/cloud-environments#default-allowed-domains). See [Agent Proxy](https://claude.com/docs/claude-tag/concepts/agent-identity.md#agent-proxy) for what happens to a request under each layer.
+In an Anthropic-hosted environment, outbound traffic from a channel session's sandbox is default-deny, apart from its GitHub API requests and git operations. Requests go only to hosts an allow layer covers, and the layers are a [credential's allowed websites](https://claude.com/docs/claude-tag/admins/connections/custom.md#fill-out-the-custom-tool-form), the [allowed domains](https://claude.com/docs/claude-tag/admins/add-connections.md#allow-a-host-without-a-credential) that apply to the channel, and the network access setting of the [environment](https://claude.com/docs/claude-tag/concepts/glossary.md#environment) the scope's sessions run on. A new environment's default level, **Limited access**, already covers a [documented set of package registries and developer hosts](https://code.claude.com/docs/en/cloud-environments#default-allowed-domains). See [Agent Proxy](https://claude.com/docs/claude-tag/concepts/agent-identity.md#agent-proxy) for what happens to a request under each layer.
 
 ![Flow diagram across two zones, labeled Anthropic's infrastructure and your systems. In the first zone, a session sandbox that holds no stored credentials sends every outbound request to Agent Proxy, which matches it against admin rules. Three outcomes branch toward your systems: on a rule match, the credential is attached at the boundary and the request proceeds; on an allowlist-only match, from an allowed domain or the environment's network access setting, the request is sent without credentials; on no match, the request is blocked entirely (the default-deny outcome) and the host is unreachable.](https://mintcdn.com/claude-ai/f29MqpCRlPctgTn5/images/claude-tag/diagrams/proxy-decision.svg?fit=max\&auto=format\&n=f29MqpCRlPctgTn5\&q=85\&s=f87bc9ca2d2de09e4feda0a60695e9bd)
 
-Because requests to any other host are blocked, data leaves the sandbox only to hosts an allow layer covers and to GitHub through the GitHub proxy. An admin sets the allowed websites on each credential and the allowed domains. An admin sets the environment's network access level, which defaults to Trusted access, from the **Cloud environments** page in [admin settings](https://claude.ai/admin-settings). See [Set allowed websites](https://claude.com/docs/claude-tag/admins/add-connections.md#set-allowed-websites) and [Allow a host without a credential](https://claude.com/docs/claude-tag/admins/add-connections.md#allow-a-host-without-a-credential).
+Because requests to any other host are blocked, data leaves the sandbox only to hosts an allow layer covers and to GitHub through the GitHub proxy. An admin sets the allowed websites on each credential and the allowed domains. An admin sets the environment's network access level, which defaults to **Limited access**, from the **Cloud environments** page in [admin settings](https://claude.ai/admin-settings). See [Set allowed websites](https://claude.com/docs/claude-tag/admins/add-connections.md#set-allowed-websites) and [Allow a host without a credential](https://claude.com/docs/claude-tag/admins/add-connections.md#allow-a-host-without-a-credential).
 
 Allow-all egress is a `*` domain. The entry admits requests to any host on the ports it lists, still without credentials. Private and internal network addresses and cloud metadata endpoints remain blocked. See [Allow all hosts](https://claude.com/docs/claude-tag/admins/add-connections.md#allow-all-hosts).
 
 
@@ -582,10 +582,11 @@ async function onInbound(message: PlatformMessage) {
 }
 ```
 
-A remote reply that doesn't exactly match the expected format fails in one of two ways, and in both cases the local terminal dialog stays open:
+If a remote reply has no effect and the local terminal dialog stays open, check for these causes:
 
-* **Different format**: your inbound handler's regex fails to match, so text like `approve it` or `yes` without an ID falls through as a normal message to Claude.
-* **Right format, wrong ID**: your server emits a verdict, but Claude Code finds no open request with that ID and drops it silently.
+* **The format is wrong**: your inbound handler's regex fails to match, so text like `approve it` or `yes` without an ID falls through as a normal message to Claude.
+* **The ID is wrong**: your server emits a verdict, but Claude Code finds no open request with that ID and drops it silently.
+* **The ID was used by an earlier prompt**: your server emits a verdict with the ID from the request, but an earlier prompt in the session had the same ID. Once an ID repeats, Claude Code drops any channel verdict carrying it, so that a reply meant for one prompt can't approve the other. An ID is five random letters, so a repeat is rare. Answer at the terminal instead.
 
 ### Full example
 
 
@@ -90,9 +90,9 @@ Checkpointing only tracks files that have been edited within the current session
 
 ### Messages sent mid-turn not checkpointed
 
-In the rewind menu, a message you [typed while Claude was still working](https://code.claude.com/docs/en/interactive-mode.md#queue-messages-while-claude-works) can be marked **No code restore**. Claude read that message before its turn ended. [Checkpoints are taken for prompts that start a turn](#how-checkpoints-work), so this message has none of its own. The edits Claude made after reading it count toward the prompt that started the turn.
+In the rewind menu, a message you [typed while Claude was still working](https://code.claude.com/docs/en/interactive-mode.md#queue-messages-while-claude-works) can be marked **No code restore**. The marked message has no [checkpoint](#how-checkpoints-work) of its own.
 
-You don't need to do anything about the message itself. To undo the file changes from that part of the session, select the prompt that started the turn and choose **Restore code** or **Restore code and conversation**. That reverts Claude's file edits from the whole turn, including the ones from before your message arrived. Selecting the marked message still offers **Restore conversation**, which rewinds the conversation to it and leaves your files as they are.
+To undo the file edits Claude made after that message, select the prompt that started the turn and choose **Restore code** or **Restore code and conversation**. That reverts Claude's file edits from the whole turn, including the ones from before your message arrived.
 
 ### Symlinked and hard-linked paths not restored