docs: scope deletion-authority wording to bank folder + guard growing-read NUL terminator

src/core/instrument/map/bridge_marshal.h

@@ -82,6 +82,7 @@ GrowingExtStateRead readProjExtStateGrowing(ReadFn&& read) {
             result.status = GrowingExtStateRead::Status::Absent;
             return result;
         }
+        buf[static_cast<std::size_t>(cap) - 1] = '\0';  // defensive: guard against a read() that fills the buffer without honoring NUL-termination within cap
         std::string s(buf.data());
         if (static_cast<int>(s.size()) + 1 < cap) {
             result.status = GrowingExtStateRead::Status::Complete;

src/persist.h

@@ -8,7 +8,9 @@
 //   * shell/persist/ext_state_io.h + ext_state_io.cpp — the ext-state ↔ JSON
 //     serialization bridge, key contract, GUID minting, bank-folder relocation.
 //   * shell/persist/prune_fs.cpp — the prune scan + THE SINGLE FILE-DELETION
-//     AUTHORITY (deleteOrphanFile, file-local; nothing else deletes bytes).
+//     AUTHORITY over USER files in the bank folder (deleteOrphanFile, file-local);
+//     a shell's self-cleanup of its own transient scratch files (.vstpreset temp,
+//     realtime finalize temp) is excluded from this authority.
 //
 // This header re-exports the split APIs so every existing caller (actions.cpp,
 // main.cpp, ingest.cpp, the panel TUs, capture shells) keeps compiling untouched —

src/shell/persist/session.h

@@ -11,8 +11,11 @@
 //     writeAssignmentRequest: the ext-state ↔ JSON serialization bridge, plus GUID
 //     minting and bank-folder relocation (see ext_state_io.h for the key contract).
 //   * prune_fs.cpp     — pruneDryRun / pruneOrphanSet / pruneReclaim: the prune scan
-//     and THE SINGLE FILE-DELETION AUTHORITY in ReaSampler (deleteOrphanFile via
-//     SHFileOperationW). Nothing else in the system deletes bytes.
+//     and THE SINGLE FILE-DELETION AUTHORITY over USER files in the bank folder in
+//     ReaSampler (deleteOrphanFile via SHFileOperationW). Nothing else in the system
+//     deletes bank-folder bytes; a shell's self-cleanup of a transient scratch file
+//     it just created (the drop path's .vstpreset temp, the realtime finalize temp)
+//     is excluded from this authority.
 //
 // Save: serialize the BankModel JSON -> SetProjExtState under namespace
 //   "reasampler" (ext state lives inside the .rpp, so the index travels with the