Add session log and reflect: API design research session

Session log for 2026-03-29 covering API/LLM security research, agent-runtimes
audit, and review skill creation. Reflected into:
- decisions.md: best-practices topic split, review skills read-only design
- process-lessons.md: background agents for research, Edit context
  disambiguation, best-practices repo location

Pruned 2 old reflected logs (2026-03-17, 2026-03-18).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

memory/process-lessons.md

@@ -39,3 +39,15 @@ Before creating a new system or document, discuss where it belongs conceptually
 ## Add SSH-authenticating user as collaborator when creating repos via API
 
 When creating Gitea repos via API token (e.g., `ai_admin`), the SSH alias may authenticate as a different user (e.g., `cluster-administrator`). Always add the SSH user as admin collaborator via API before pushing.
+
+## Use background agents for parallel independent research
+
+When researching multiple topics that don't depend on each other, launch background subagents simultaneously. Both API design and LLM security research completed in ~5 minutes each, producing structured output with citations. Review results as they complete. Don't duplicate research work the subagent is doing.
+
+## Include more surrounding context when Edit tool matches are ambiguous
+
+The Edit tool fails if `old_string` matches multiple locations. When editing files with repeated patterns (like FUTURE.md items that all end with "Depends on: M9"), include unique surrounding lines (a heading, the preceding paragraph) to disambiguate. Don't use `replace_all: true` as a workaround — it changes all instances.
+
+## Best-practices repo is separate from claude-foundations
+
+Best practices live in skynet/best-practices (cloned at ~/dev/claude/projects/best-practices/). ~/dev/claude/BESTPRACTICES.md is a symlink to its index. context-load doesn't show the best-practices directory in the tree — remember it exists when working on best practices topics.