unreal: distill two automation-scripting traps (2026-08)

[butterstack]

Summary

This is a weekly-schedule distillation pass comparing the private working repo's in-scope files (LEARNINGS.md, NOTES.md, and the mirrored skills/agents/commands instruction files) against what's already reflected in this repo, plugin by plugin.

Only one genuinely new item was found: a unreal/LEARNINGS.md section B entry (item 15 in the private file) covering two automation-scripting traps hit while authoring the Windows CI scripts already documented in items 10 and 14 of the public file - a PowerShell Mandatory parameter that silently prompts on stdin when omitted (hanging a non-interactive SSH call instead of erroring), and ssh -n swallowing a heredoc meant to feed a remote bash -s. Both are generic scripting gotchas with no internal identifiers, so the sanitization pass made no redactions - it was carried over with only light prose tightening.

Everything else checked out already-distilled: godot, jenkins, lore, perforce, and the unity LEARNINGS.md/NOTES.md content matched what's already here (a few private unity/LEARNINGS.md bullets - zero-scene builds, unity projects info, two Windows rig footguns - are absent from the public file, but those look like intentional cuts from the original compression pass rather than un-distilled new material, so they were left alone). All skills/*/SKILL.md, agents/*.md, and commands/*.md files across every plugin are byte-identical between the two repos except one.

Before/after line counts

• unreal/LEARNINGS.md: 172 -> 179 lines (added, not compressed - a single small item, no trimming needed elsewhere in the file).

Sanitization grep sweep

Zero hits on the new content (checked for internal fork/service references, private-repo issue/branch pointers, agent-transcript artifacts, and personal names).

Review notes

• No secrets or credential values were found anywhere in the reviewed source material.
• Flagging for human review, not distilled or changed here: unity/skills/unity-cli/SKILL.md differs between the two repos. The private repo's current version replaced the public repo's safer install flow (download install.ps1, verify its SHA-256 against a pinned hash, then run it) with a direct irm ... | iex pipe-to-Invoke-Expression, dropping the verification step entirely. That reads as a regression in the private repo rather than a new learning to mirror forward, so this PR does not carry it over - the public file's existing (safer) version is left as-is. Worth a human look at why the private copy lost the hash-check step.

Update (2026-09-14 pass)

This weekly pass found one further genuinely new item, added to this branch as a second commit: two dated perforce/LEARNINGS.md entries from a Git->Perforce mirror running against a p4d that ships as a Docker image, sourced from a single private-repo commit landing after the pass above.

The first entry covers the p4d image re-applying its own engine typemap preset on every container start rather than just first provision - since p4 typemap is one server-wide table with no compare-and-swap, that silently drops depot-scoped rows another system had appended, with a measured roughly 8 minute exposure window on one real restart, and no way to trace who changed the table without a spec depot.

The second entry covers three related diagnostic traps hit while chasing the first: the "Wrong number of words for field 'X'" error string means something different for the typemap spec than it does for the trigger table it's normally associated with, p4 exits 1 with empty stdout on both a connection failure and an auth failure (so a set -euo pipefail script aborts rather than reading an empty string), and an idempotency check keyed on a commit-sha trailer needs to match every width its writers actually produce, not just a fixed 40-character sha.

Everything else in this pass's private-repo diff (godot, jenkins, lore, unity, unreal, and all mirrored skills/agents/commands files) was already reflected here - the unity/skills/unity-cli/SKILL.md regression noted above is unchanged and still just flagged, not carried over.

perforce/LEARNINGS.md: 41 -> 87 lines. The new material itself compressed from 72 lines in the private source to 47 lines here (about 35% cut, within the 30-50% target) - both findings were kept since each is a concrete, load-bearing trap, prose was tightened around the specifics, and the private entries' inline links to the p4-workflows/p4-observe skill sections were dropped since no other entry in this file links to skills inline and the reference reads fine as prose.

Sanitization grep sweep on the new perforce content: zero hits (checked for the real internal service-path patterns, docker/hostname patterns, and personal names used in the private-repo commit, none of which appear in the finding's technical content).

No secrets or credential values were found in this pass's source material either.

🤖 Generated with Claude Code