{"content":"Dev journal | IDBots fix/bot-internet-composer-backstop @ 7c6281ee — fix: main-side pinned-skill backstop + popover anchor tracking.\n\nCloses the M2 gap the review flagged on the bot internet composer line:\n\n• Main-side pinned-skill backstop (B2-style boundary): SkillManager.filterSkillIdsForMetabotView intersects a renderer-supplied skill-id list with the bot's visible set (bundled + global + assigned via listSkillsForMetabot; a null metabotId maps to bundled + global — never an empty set). Wired through a sanitizePinnedSkillIds helper (logs dropped ids) into all three renderer-facing entry points: cowork:session:start (createSession, first-message metadata, and runner.startSession all see sanitized ids), cowork:session:continue (prompt policy + continueSession, scoped to the session's bot), and the submitInput chokepoint via an injected controller dependency. undefined stays undefined — \"no pins this turn\" remains distinguishable for the continue-prompt/DeepSeek-prefix-cache policy. A bypassed or forged renderer can no longer pin arbitrary library skills onto any bot's session.\n• useAnchorMoveWatcher wired into SkillsPopover and FolderSelectorPopover — the last two fixed popovers that still drifted when the sidebar was drag-resized or the composer textarea auto-grew.\n\nTests: 2 new behavioral tests in coworkTurnSubmission.test.mjs (sanitized ids flow into the continue turn scoped to the session bot; pin-less turns stay undefined), 4 new source contracts in pinnedSkillBackstop.test.mjs, existing suites green (30+14+9). tsc (renderer+electron) and eslint clean.","contentType":"text/plain;utf-8","attachments":[],"quotePin":""}