docs: rebalance prose cleanup and add trimming skill

packages/code-runtime/code-runtime-worker/src/index.ts

@@ -1,7 +1,8 @@
 /**
- * Worker-thread implementation of the code-execution seam: one fresh Node worker per run,
- * executing the model's TypeScript after a host-side type-strip, with bindings bridged over
- * the message port.
+ * Worker-thread code runtime: a fresh worker runs each host-type-stripped TypeScript program
+ * and bridges bindings over its message port. This is containment, not a security boundary:
+ * model code has bash-equivalent trust despite an empty environment, a heap cap, measured
+ * event-loop busy-time and wall-time budgets, and termination that also stops synchronous loops.
  * @module @deepseek-ai/dsh-code-runtime-worker
  */
 
@@ -289,9 +290,8 @@ export class WorkerCodeRuntime extends CodeRuntime {
       const logs: CodeLogEntry[] = []
       const strayLogs: CodeLogEntry[] = []
 
-      // one host-side ledger for everything that lands in `logs`/`strayLogs`, whatever the
-      // path: honest port entries, FORGED port entries (model code posting `log` messages
-      // directly, bypassing the worker-side LogBuffer), and stray pipe bytes.
+      // One host-side budget covers normal, forged, and stray-pipe log entries. The first
+      // overflow emits the shared in-band marker and drops everything after it.
       let logBudget = this.config.maxLogBytes
       let logsTruncated = false
       const admit = (entry: CodeLogEntry, sink: CodeLogEntry[]): void => {
@@ -315,9 +315,8 @@ export class WorkerCodeRuntime extends CodeRuntime {
       worker.stdout.on('data', captureStray('stdout'))
       worker.stderr.on('data', captureStray('stderr'))
 
-      // Settlement: exactly one outcome wins; every path funnels through here, cleans up the
-      // timers/listeners, terminates the worker, and resolves only after the worker actually
-      // exited (quiescence).
+      // Exactly one outcome wins. Every path cleans up, terminates, and awaits the worker;
+      // logs captured before timeout, abort, or failure remain in the result.
       let finishResolve!: () => void
       const finished = new Promise<void>((done) => { finishResolve = done })
       const finish = (result: Omit<CodeRunResult, 'logs'>): void => {
@@ -335,9 +334,8 @@ export class WorkerCodeRuntime extends CodeRuntime {
 
       const onDone = (message: WorkerToHost): void => {
         if (message.type !== 'done') return
-        // Re-cap the completion value HOST-side: the honest path already capped it in the
-        // worker (prepareValue there), but a forged done message bypasses the bootstrap
-        // entirely — without this, model code could flood the host past maxValueBytes.
+        // Re-cap forged completion traffic at the hostile boundary. Honest worker-capped values
+        // pass unchanged via VALUE_RENDER_SLACK; error text is bounded too.
         finish({
           ...prepareValue(message.value, this.config.maxValueBytes + VALUE_RENDER_SLACK),
           ...message.error ? { error: { kind: 'exception' as const, message: truncateUtf8Bytes(message.error.message, this.config.maxValueBytes) } } : {},