docs: align isolation-profile claims with implementation (#900)

CHANGELOG.md

@@ -4,6 +4,16 @@ All notable changes to the Claude Code node harness. Dates are KST.
 
 ## [Unreleased]
 
+### Fixed
+- Docs: `CCC_NODE_ISOLATION_PROFILE=external` is now described as what it is
+  — a memory-source gate that forces Family Wiki paths off — not a
+  "non-bypassable PreToolUse guard" (that hook was removed, TM-1306), with
+  README/memory.md pointing at service-control.md for the real enforcement
+  split (#900). Per-provider feature status is owned by
+  provider-capability-matrix.md (README links instead of generalizing), and
+  the README env table now exposes `CCC_CODEX_MEMORY_LOADER` and the
+  default-on `CCC_CODEX_SKILL_COLLECTOR` opt-out.
+
 ### Added
 - SessionStart stage timing instrumentation (#897 step 1). `load-memory.sh`
   now appends one body-free JSON line per run (fixed stage names + integer

README.md

@@ -34,7 +34,7 @@ After setup:
 
 | Area | One-line summary | Details |
 |---|---|---|
-| Memory hooks | SessionStart/PostCompact memory snapshot + background refresh; startup is no-network/fail-open. | [`docs/memory.md`](docs/memory.md) |
+| Memory hooks | SessionStart/PostCompact memory snapshot + background refresh; startup is no-network/fail-open. Per-provider feature status (incl. degraded lanes) is owned by [`docs/provider-capability-matrix.md`](docs/provider-capability-matrix.md). | [`docs/memory.md`](docs/memory.md) |
 | Telegram bridge | Telegram ↔ Claude Code bridge with daemon/supervisor, streaming UI, push notifier, voice/media helpers. | [`bridge/README.md`](bridge/README.md), [`docs/bridge-ops.md`](docs/bridge-ops.md) |
 | Harness settings | Claude settings, status line, Korean output style, plugin/standalone hook modes. | [`docs/harness.md`](docs/harness.md) |
 | Doctor diagnostics | Read-only drift report plus conservative dry-run/apply repairs for settings and allowlisted files. | [`docs/doctor.md`](docs/doctor.md) |
@@ -73,9 +73,11 @@ setup.sh                   Idempotent bootstrap; refuses to overwrite real node
 | `CCC_STATE_DIR` | `$CCC_CLAUDE_DIR/state` | Local node state and memory index |
 | `CCC_MEMORY_PROFILE` | `honcho` | Memory profile: `honcho`, `hybrid`, or `max-perf` |
 | `CCC_MEMORY_CACHE_DIR` | `$CCC_CLAUDE_DIR/hooks/cache` | Wiki/Honcho cache metadata |
-| `CCC_NODE_ISOLATION_PROFILE` | `fleet` | Set `external` for a non-bypassable external-node Family-resource guard |
+| `CCC_NODE_ISOLATION_PROFILE` | `fleet` | `external` forces Family Wiki memory off (injection/refresh/index/distill queue). This is a memory-source gate, not an execution boundary — the node has no PreToolUse policy hook (removed, TM-1306); see [`docs/service-control.md`](docs/service-control.md) for the real enforcement split |
 | `CCC_WIKI_MEMORY_ENABLED` | `1` | Set `0` to disable Wiki injection, refresh, indexing, and distill queue writes |
 | `CCC_MEMORY_USER_LABEL` / `CCC_MEMORY_ASSISTANT_LABEL` | fleet-compatible labels | Node-local relationship labels for injection/distill |
+| `CCC_CODEX_MEMORY_LOADER` | auto | Codex: explicit trusted memory-loader path (always wins over automatic selection); see [`docs/memory.md`](docs/memory.md) |
+| `CCC_CODEX_SKILL_COLLECTOR` | `1` | Codex-only skill-candidate collection; set `false` to opt out. See [`docs/skill-autosave.md`](docs/skill-autosave.md) |
 
 More memory-specific variables live in [`docs/memory.md`](docs/memory.md).
 

docs/memory.md

@@ -13,7 +13,7 @@ ccc-node memory starts from a no-network SessionStart snapshot and refreshes cac
 
 ## Source isolation
 
-- `CCC_NODE_ISOLATION_PROFILE=external` is the higher-priority external-node placement policy. The bridge validates and exports it to Claude hooks; it forces Family Wiki off and the PreToolUse guard rejects Family/internal paths, URLs, commands, and MCP calls before the ordinary approval escape hatch.
+- `CCC_NODE_ISOLATION_PROFILE=external` is the higher-priority external-node placement policy. The bridge validates and exports it to Claude hooks; it forces Family Wiki off (injection, refresh, local indexing, and distill queue writes). It is a **memory-source gate, not an execution boundary**: the node has no PreToolUse policy hook (removed, TM-1306), so path/URL/command/MCP execution is governed by behavioral policy plus the OS-level wrappers documented in [`docs/service-control.md`](service-control.md).
 - `CCC_WIKI_MEMORY_ENABLED=0` disables the Family Wiki read and write path: no cache injection, refresh, local indexing, distill candidate generation, or Wiki queue writes. Existing cache files are ignored and removed from the local index on its next update/rebuild. An external isolation profile overrides an attempted `=1`.
 - `CCC_MEMORY_USER_LABEL` and `CCC_MEMORY_ASSISTANT_LABEL` set the node-local relationship labels used by memory injection and distill. Defaults preserve the existing Seoyoon fleet behavior.
 - `CCC_HONCHO_MEMORY_ENABLED=0` disables the Honcho read and Codex write-back path. A node may therefore run built-in/local memory only, Honcho without Wiki, or the default combined profile. `CCC_HONCHO_CFG` selects the owner-only endpoint/credential config (default `~/.hermes/honcho.json`).