Reflect 2 session logs into topic memory files

Updated: gotchas-skills.md (+$VAR paths, $() subshells, relative path
resolution), decisions.md (+CLAUDE_PROJECT_ROOT, settings.yaml relative
paths), process-lessons.md (+research history before building validators).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

memory/decisions.md

@@ -32,6 +32,14 @@ Fast (~1ms), no commits or stash needed, orphan blobs auto-GC'd. Falls back to `
 
 Projects opt in by having a `formatters/` directory with symlinks back to canonical scripts. Zero-config, visible in `ls`, no parsing needed. The hook walks up the directory tree to find `formatters/`.
 
+## Skills: Use CLAUDE_PROJECT_ROOT for cross-project path resolution
+
+Skills that reference files outside their own project (e.g., `/distill-best-practices` reading settings.yaml) use `CLAUDE_PROJECT_ROOT` env var instead of hardcoded `~/dev/claude/` or relative `../` paths. Makes skills portable across users. Env var exported in `~/.bashrc`, with runtime fallback (walk up directory tree to find highest CLAUDE.md).
+
+## Skills: settings.yaml paths relative to project root
+
+`settings.yaml` uses relative paths (`projects_dir: projects`) rather than absolute paths. Combined with `CLAUDE_PROJECT_ROOT`, this keeps config portable. The `extra_projects` section handles projects outside the standard `projects_dir` (e.g., `small-scripts` at root level).
+
 ## CLAUDE.md: Remove technology-specific sections from root
 
 Ansible and Helm sections removed from root CLAUDE.md — already covered with more detail in `best-practices/ansible.md` and `best-practices/helm.md`. Technology-specific practices belong in best-practices, not root guidelines.

memory/gotchas-skills.md

@@ -6,6 +6,23 @@
 **Cause:** `readlink -f` on a broken symlink returns an empty string, causing comparison failure under `set -e`.
 **Fix:** Remove stale symlinks before re-running install. When skills move directories (e.g., from `~/dev/claude/custom-claude-skills/` to `~/dev/claude/projects/custom-claude-skills/`), old symlinks break.
 
+## `$VAR` and `${VAR}` in bang-command paths rejected by permission checker
+
+**Symptom:** Skill fails with "Shell expansion syntax in paths requires manual approval" on `cat $HOME/dev/claude/...` or `cat ${HOME}/...`.
+**Cause:** Claude Code's Bash permission checker rejects any `$VAR` or `${VAR}` expansion in file path arguments, even if the outer command matches an `allowed-tools` pattern.
+**Fix:** Replace bang-commands that need dynamic paths with plain-text instructions telling Claude to use the Read tool at runtime. The Read tool bypasses the shell permission checker entirely.
+
+## `$()` command substitution in bang-commands is rejected
+
+**Symptom:** Bang-command like `git log --since="$(git log ...)"` fails even though `Bash(git *)` is in allowed-tools.
+**Cause:** The permission checker rejects any command containing `$()` subshells regardless of the outer pattern match.
+**Fix:** Keep bang-commands simple. If complex logic is needed, have the skill instructions tell Claude to run it via tool calls instead.
+
+## Relative paths in bang-commands resolve differently based on CWD
+
+**Symptom:** `cat ../claude-foundations/settings.yaml` resolves to the wrong path (outside sandbox) when skill is invoked from an unexpected CWD.
+**Fix:** Use `CLAUDE_PROJECT_ROOT` env var instead of relative paths. Env var expansion (without `$`) isn't rejected by the permission checker when used in the SKILL.md body instructions rather than bang-commands.
+
 ## Skills created mid-session are not available as slash commands
 
 **Symptom:** A newly created skill doesn't appear when you type `/skillname`.

memory/process-lessons.md

@@ -24,6 +24,10 @@ Multiple hooks registered for the same matcher execute concurrently, not sequent
 
 Needs ssh-agent loaded before git push to Gitea. If push hangs, check that the key is added to the agent.
 
+## Research full failure history before building validators
+
+When building a tool that detects known problems (like `validate-skill`), first research all historical failures across session logs and git commits. This reveals non-obvious patterns — e.g., `$HOME` (not just `${HOME}`) being rejected by permission checkers, which wouldn't be found from docs alone. The upfront research investment pays off in comprehensive coverage.
+
 ## Batch parallel file creation for efficiency
 
 Creating many independent files in a single Write batch (e.g., 11 best-practices files at once) is significantly faster than sequential creation.