chore: pause work and save context handoff

.planning/codebase/CONCERNS.md

@@ -0,0 +1,15 @@
+# Codebase Concerns (`CONCERNS.md`)
+
+## Known Technical Debt & Fragile Areas
+
+1. **UTF-8 Support on PowerShell**: 
+   The `sync_vendors.bat` script utilizes `chcp 65001 >nul` to support symbols and emojis (`🔄`, `⛏️`, `🌐`). However, invoking this `.bat` script directly from the new `powershell.exe` execution layers occasionally mangles the output characters or breaks parsing commands. Developers manually validating `sync_vendors.bat` in Powershell may observe syntax exceptions that don't manifest inside standard CMD executions.
+   
+2. **Path Encoding Depth Limitations**:
+   The GSD implementation maps Deep nested `.agent/vendor/**` repositories and heavily duplicates structure into `.agent/skills/`. For Windows systems overriding 260-character restrictions, this can theoretically introduce silent file truncation if the local `.agent` environment scales beyond expectations.
+
+3. **Submodule Divergences**:
+   The primary master hook uses `git submodule update --remote --merge`. Tracking upstream mains from multiple open-source repositories means breaking changes authored dynamically by upstream maintainers (e.g., `browser_use` rewriting its setup commands or `obsidian-skills` evolving) could cascade into local logic breaks, requiring a robust `translate_skills.js` sync layer to patch integration shifts.
+
+4. **Environment Abstraction Leaks**:
+   While Zero-Pollution aims to block system pollution, `bootstrap.bat` utilizes `AGENT_PYTHON_PATH` configured globally to execute `.requirements.txt`. There is an implicit assumption that this python executable is correctly mapped to an isolated virtual environment (`venv`). The architecture relies heavily on Developer compliance to not provide a root Python executable.