docs(keycloak-session-store): take the sentences out of the diagram canvases

The skill says drawings carry names and sentences go in <desc> and the
paragraph beside the figure. I put sentences in node details and edge labels
instead, and 27 of the 28 diagrams shipped with prose inside the canvas —
"예측 다섯 개가 틀렸다", "아홉 번 조용히 실패했다", "막혀서 닿지 않는다".

Only label and details render on the canvas; description does not. So every
sentence moved to a noun phrase and the meaning stays in description, which
was already carrying it.

  막혀서 닿지 않는다              -> 차단
  아홉 번 조용히 실패했다         -> 조용한 실패 9건
  예측 다섯 개가 틀렸다           -> 틀린 예측 5건
  로그아웃이 정리하지 않는다      -> 로그아웃 미정리
  볼륨이 없으면 여기까지다        -> 볼륨 없음

Three node labels were sentences too and became names: 세션 스냅샷, 예측
선기록, 대조군 확보.

What stays is what the rules protect — identifiers, commands and measured
values: PRIMARY KEY (client_registration_id, principal_name),
ValidationFailedException: 1 changesets check sum, nginx -t && nginx -s
reload, SET LOCAL synchronous_commit TO OFF. Those are names of things, not
prose about them.

294 canvas strings across 28 diagrams, none matching a sentence ending,
average 11 characters. All 28 still lint clean and re-rendered.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/keycloak-session-store/final/assets/b4-header-trust-boundary/b4-header-trust-boundary.alt.md

@@ -18,5 +18,5 @@ nginx 는 자기가 proxy_set_header 로 설정한 헤더만 덮어쓴다. 설
 ## Relationships
 
 - **밖에서 보낸 위조 헤더 → nginx:** 위조 헤더. Evidence: L393–L400.
-- **nginx → oauth2-proxy:** 지우지 않으면 그대로 지난다. Evidence: L393–L400.
+- **nginx → oauth2-proxy:** 미삭제 시 통과. Evidence: L393–L400.
 - **oauth2-proxy → 앱:** 인가 헤더. Evidence: L393–L408.

docs/keycloak-session-store/final/assets/b4-header-trust-boundary/b4-header-trust-boundary.d2

@@ -14,5 +14,5 @@ n3: "앱" {
   shape: rectangle
 }
 n0 -> n1: "위조 헤더"
-n1 -> n2: "지우지 않으면 그대로 지난다"
+n1 -> n2: "미삭제 시 통과"
 n2 -> n3: "인가 헤더"

docs/keycloak-session-store/final/assets/b4-header-trust-boundary/b4-header-trust-boundary.dot

@@ -7,6 +7,6 @@ digraph techviz {
   n2 [label="oauth2-proxy", shape=diamond, style="rounded,filled"];
   n3 [label="앱", shape=box, style="rounded,filled"];
   n0 -> n1 [label="위조 헤더", style=solid];
-  n1 -> n2 [label="지우지 않으면 그대로 지난다", style=solid];
+  n1 -> n2 [label="미삭제 시 통과", style=solid];
   n2 -> n3 [label="인가 헤더", style=solid];
 }

docs/keycloak-session-store/final/assets/b4-header-trust-boundary/b4-header-trust-boundary.drawio

@@ -6,30 +6,30 @@
         <mxCell id="0"/>
         <mxCell id="1" parent="0"/>
         <mxCell id="n_attacker" value="밖에서 보낸 위조 헤더&lt;br/&gt;X-Auth-Request-Roles" tooltip="앱이 믿는 이름을 그대로 쓴다. | Evidence: L393-L400" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;dashed=1;fillColor=#f5f7fa;strokeColor=#d97706;fillColor=#fffdf5;" vertex="1" parent="1">
-          <mxGeometry x="124.5" y="60.0" width="170.0" height="84.0" as="geometry"/>
+          <mxGeometry x="82.5" y="60.0" width="170.0" height="84.0" as="geometry"/>
         </mxCell>
-        <mxCell id="n_nginx" value="nginx&lt;br/&gt;proxy_set_header ... &quot;&quot; 로 먼저 지워야 한다" tooltip="설정하지 않은 이름은 덮어쓰지 않는다. | Evidence: L393-L400" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;rhombus;perimeter=rhombusPerimeter;fillColor=#fff7e8;strokeColor=#d97706;fillColor=#fffdf5;" vertex="1" parent="1">
-          <mxGeometry x="70.0" y="240.0" width="279.0" height="71.0" as="geometry"/>
+        <mxCell id="n_nginx" value="nginx&lt;br/&gt;proxy_set_header ... &quot;&quot;" tooltip="설정하지 않은 이름은 덮어쓰지 않는다. | Evidence: L393-L400" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;rhombus;perimeter=rhombusPerimeter;fillColor=#fff7e8;strokeColor=#d97706;fillColor=#fffdf5;" vertex="1" parent="1">
+          <mxGeometry x="70.0" y="240.0" width="195.0" height="71.0" as="geometry"/>
         </mxCell>
         <mxCell id="n_proxy" value="oauth2-proxy&lt;br/&gt;--set-xauthrequest" tooltip="인증 결과를 헤더로 넣는다. | Evidence: L393-L400" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;rhombus;perimeter=rhombusPerimeter;fillColor=#fff7e8;" vertex="1" parent="1">
-          <mxGeometry x="129.5" y="407.0" width="160.0" height="71.0" as="geometry"/>
+          <mxGeometry x="87.5" y="407.0" width="160.0" height="71.0" as="geometry"/>
         </mxCell>
-        <mxCell id="n_app" value="앱&lt;br/&gt;세션은 로그인 시점의 스냅샷" tooltip="헤더를 믿고 인가한다. | Evidence: L401-L408" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;strokeColor=#2563eb;strokeWidth=2;" vertex="1" parent="1">
-          <mxGeometry x="134.5" y="574.0" width="150.0" height="71.0" as="geometry"/>
+        <mxCell id="n_app" value="앱&lt;br/&gt;로그인 시점 스냅샷" tooltip="헤더를 믿고 인가한다. | Evidence: L401-L408" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;strokeColor=#2563eb;strokeWidth=2;" vertex="1" parent="1">
+          <mxGeometry x="92.5" y="574.0" width="150.0" height="71.0" as="geometry"/>
         </mxCell>
         <mxCell id="e_a-n" value="위조 헤더" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeWidth=2;endArrow=block;endFill=1;" edge="1" parent="1" source="n_attacker" target="n_nginx">
           <mxGeometry relative="1" as="geometry">
-            <mxPoint x="233.5" y="192.0" as="offset"/>
+            <mxPoint x="191.5" y="192.0" as="offset"/>
           </mxGeometry>
         </mxCell>
-        <mxCell id="e_n-p" value="지우지 않으면 그대로 지난다" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeWidth=2;endArrow=block;endFill=1;" edge="1" parent="1" source="n_nginx" target="n_proxy">
+        <mxCell id="e_n-p" value="미삭제 시 통과" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeWidth=2;endArrow=block;endFill=1;" edge="1" parent="1" source="n_nginx" target="n_proxy">
           <mxGeometry relative="1" as="geometry">
-            <mxPoint x="233.5" y="359.0" as="offset"/>
+            <mxPoint x="191.5" y="359.0" as="offset"/>
           </mxGeometry>
         </mxCell>
         <mxCell id="e_p-a" value="인가 헤더" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeWidth=2;endArrow=block;endFill=1;" edge="1" parent="1" source="n_proxy" target="n_app">
           <mxGeometry relative="1" as="geometry">
-            <mxPoint x="233.5" y="526.0" as="offset"/>
+            <mxPoint x="191.5" y="526.0" as="offset"/>
           </mxGeometry>
         </mxCell>
       </root>

docs/keycloak-session-store/final/assets/b4-header-trust-boundary/b4-header-trust-boundary.excalidraw

@@ -6,7 +6,7 @@
     {
       "id": "edge-a-n",
       "type": "arrow",
-      "x": 209.5,
+      "x": 167.5,
       "y": 144.0,
       "width": 0.0,
       "height": 96.0,
@@ -66,7 +66,7 @@
     {
       "id": "edge-label-a-n",
       "type": "text",
-      "x": 188.5,
+      "x": 146.5,
       "y": 180.0,
       "width": 90,
       "height": 24,
@@ -105,7 +105,7 @@
     {
       "id": "edge-n-p",
       "type": "arrow",
-      "x": 209.5,
+      "x": 167.5,
       "y": 311.0,
       "width": 0.0,
       "height": 96.0,
@@ -165,9 +165,9 @@
     {
       "id": "edge-label-n-p",
       "type": "text",
-      "x": 173.5,
+      "x": 146.5,
       "y": 347.0,
-      "width": 120,
+      "width": 90,
       "height": 24,
       "angle": 0,
       "strokeColor": "#1e1e1e",
@@ -193,18 +193,18 @@
       "locked": false,
       "fontSize": 13,
       "fontFamily": 5,
-      "text": "지우지 않으면 그대로 지난다",
+      "text": "미삭제 시 통과",
       "textAlign": "center",
       "verticalAlign": "middle",
       "containerId": null,
-      "originalText": "지우지 않으면 그대로 지난다",
+      "originalText": "미삭제 시 통과",
       "autoResize": true,
       "lineHeight": 1.25
     },
     {
       "id": "edge-p-a",
       "type": "arrow",
-      "x": 209.5,
+      "x": 167.5,
       "y": 478.0,
       "width": 0.0,
       "height": 96.0,
@@ -264,7 +264,7 @@
     {
       "id": "edge-label-p-a",
       "type": "text",
-      "x": 188.5,
+      "x": 146.5,
       "y": 514.0,
       "width": 90,
       "height": 24,
@@ -303,7 +303,7 @@
     {
       "id": "node-attacker",
       "type": "rectangle",
-      "x": 124.5,
+      "x": 82.5,
       "y": 60.0,
       "width": 170.0,
       "height": 84.0,
@@ -333,7 +333,7 @@
     {
       "id": "node-label-attacker",
       "type": "text",
-      "x": 134.5,
+      "x": 92.5,
       "y": 70.0,
       "width": 150.0,
       "height": 64.0,
@@ -374,7 +374,7 @@
       "type": "rectangle",
       "x": 70.0,
       "y": 240.0,
-      "width": 279.0,
+      "width": 195.0,
       "height": 71.0,
       "angle": 0,
       "strokeColor": "#1e1e1e",
@@ -404,7 +404,7 @@
       "type": "text",
       "x": 80.0,
       "y": 250.0,
-      "width": 259.0,
+      "width": 175.0,
       "height": 51.0,
       "angle": 0,
       "strokeColor": "#1e1e1e",
@@ -430,18 +430,18 @@
       "locked": false,
       "fontSize": 15,
       "fontFamily": 5,
-      "text": "nginx\nproxy_set_header ... \"\" 로 먼저 지워야 한다",
+      "text": "nginx\nproxy_set_header ... \"\"",
       "textAlign": "center",
       "verticalAlign": "middle",
       "containerId": null,
-      "originalText": "nginx\nproxy_set_header ... \"\" 로 먼저 지워야 한다",
+      "originalText": "nginx\nproxy_set_header ... \"\"",
       "autoResize": true,
       "lineHeight": 1.25
     },
     {
       "id": "node-proxy",
       "type": "rectangle",
-      "x": 129.5,
+      "x": 87.5,
       "y": 407.0,
       "width": 160.0,
       "height": 71.0,
@@ -471,7 +471,7 @@
     {
       "id": "node-label-proxy",
       "type": "text",
-      "x": 139.5,
+      "x": 97.5,
       "y": 417.0,
       "width": 140.0,
       "height": 51.0,
@@ -510,7 +510,7 @@
     {
       "id": "node-app",
       "type": "rectangle",
-      "x": 134.5,
+      "x": 92.5,
       "y": 574.0,
       "width": 150.0,
       "height": 71.0,
@@ -540,7 +540,7 @@
     {
       "id": "node-label-app",
       "type": "text",
-      "x": 144.5,
+      "x": 102.5,
       "y": 584.0,
       "width": 130.0,
       "height": 51.0,
@@ -568,11 +568,11 @@
       "locked": false,
       "fontSize": 15,
       "fontFamily": 5,
-      "text": "앱\n세션은 로그인 시점의 스냅샷",
+      "text": "앱\n로그인 시점 스냅샷",
       "textAlign": "center",
       "verticalAlign": "middle",
       "containerId": null,
-      "originalText": "앱\n세션은 로그인 시점의 스냅샷",
+      "originalText": "앱\n로그인 시점 스냅샷",
       "autoResize": true,
       "lineHeight": 1.25
     }

docs/keycloak-session-store/final/assets/b4-header-trust-boundary/b4-header-trust-boundary.manifest.json

@@ -2,7 +2,7 @@
   "harness_version": "0.2.0",
   "spec_id": "b4-header-trust-boundary",
   "spec_version": "1.1",
-  "spec_sha256": "9ae5cf39dfc20e31d81b892ae7483d2b9ccf94fa2c91a03837200b463bfc1103",
+  "spec_sha256": "56747d5f7826ad63f202d8dc4d6a4f1323f12eeaedb4bf989b67d0bfab5f09cd",
   "source_context": {
     "document": "docs/keycloak-session-store/final/document.md",
     "document_sha256": "1d44cba1905544d92f1d26ae36a8deb64a3db3914d6b488fd30d6ae7f8cfbabe",

docs/keycloak-session-store/final/assets/b4-header-trust-boundary/b4-header-trust-boundary.mmd

@@ -6,7 +6,7 @@ flowchart TB
     n2{"oauth2-proxy"}
     n3["앱"]
     n0 -->|"위조 헤더"| n1
-    n1 -->|"지우지 않으면 그대로 지난다"| n2
+    n1 -->|"미삭제 시 통과"| n2
     n2 -->|"인가 헤더"| n3
     classDef external stroke-dasharray: 6 4
     class n0 external

docs/keycloak-session-store/final/assets/b4-header-trust-boundary/b4-header-trust-boundary.svg

@@ -50,35 +50,35 @@
   </style>
 </defs>
 <rect class="canvas" width="680" height="690" />
-<polyline class="edge kind-request style-solid emphasis-normal" points="209.5,144.0 209.5,192.0 209.5,192.0 209.5,240.0" data-evidence="393-400" />
-<rect class="edge-label-bg" x="207.8" y="178.0" width="51.5" height="22" rx="3" />
-<text class="edge-label" x="233.5" y="193.0">위조 헤더</text>
-<polyline class="edge kind-request style-solid emphasis-normal" points="209.5,311.0 209.5,359.0 209.5,359.0 209.5,407.0" data-evidence="393-400" />
-<rect class="edge-label-bg" x="174.2" y="345.0" width="118.5" height="22" rx="3" />
-<text class="edge-label" x="233.5" y="360.0">지우지 않으면 그대로 지난다</text>
-<polyline class="edge kind-request style-solid emphasis-normal" points="209.5,478.0 209.5,526.0 209.5,526.0 209.5,574.0" data-evidence="393-408" />
-<rect class="edge-label-bg" x="207.8" y="512.0" width="51.5" height="22" rx="3" />
-<text class="edge-label" x="233.5" y="527.0">인가 헤더</text>
+<polyline class="edge kind-request style-solid emphasis-normal" points="167.5,144.0 167.5,192.0 167.5,192.0 167.5,240.0" data-evidence="393-400" />
+<rect class="edge-label-bg" x="165.8" y="178.0" width="51.5" height="22" rx="3" />
+<text class="edge-label" x="191.5" y="193.0">위조 헤더</text>
+<polyline class="edge kind-request style-solid emphasis-normal" points="167.5,311.0 167.5,359.0 167.5,359.0 167.5,407.0" data-evidence="393-400" />
+<rect class="edge-label-bg" x="155.7" y="345.0" width="71.6" height="22" rx="3" />
+<text class="edge-label" x="191.5" y="360.0">미삭제 시 통과</text>
+<polyline class="edge kind-request style-solid emphasis-normal" points="167.5,478.0 167.5,526.0 167.5,526.0 167.5,574.0" data-evidence="393-408" />
+<rect class="edge-label-bg" x="165.8" y="512.0" width="51.5" height="22" rx="3" />
+<text class="edge-label" x="191.5" y="527.0">인가 헤더</text>
 <g id="node-attacker">
-<g class="actor-symbol emphasis-warning" data-evidence="393-400"><circle cx="209.5" cy="80.0" r="11.0" /><line x1="209.5" y1="96.0" x2="209.5" y2="105.0" /><line x1="191.5" y1="106.0" x2="227.5" y2="106.0" /><line x1="209.5" y1="105.0" x2="194.5" y2="122.0" /><line x1="209.5" y1="105.0" x2="224.5" y2="122.0" /></g>
-<text class="node-label" x="209.5" y="137.0">밖에서 보낸 위조 헤더</text>
+<g class="actor-symbol emphasis-warning" data-evidence="393-400"><circle cx="167.5" cy="80.0" r="11.0" /><line x1="167.5" y1="96.0" x2="167.5" y2="105.0" /><line x1="149.5" y1="106.0" x2="185.5" y2="106.0" /><line x1="167.5" y1="105.0" x2="152.5" y2="122.0" /><line x1="167.5" y1="105.0" x2="182.5" y2="122.0" /></g>
+<text class="node-label" x="167.5" y="137.0">밖에서 보낸 위조 헤더</text>
 </g>
 <g id="node-nginx">
-<polygon class="node-shape kind-gateway emphasis-warning role-control" data-evidence="393-400" points="209.5,240.0 349.0,275.5 209.5,311.0 70.0,275.5" />
-<text class="node-label" x="209.5" y="267.0">nginx</text>
-<line class="node-detail-divider" x1="84.0" y1="288.0" x2="335.0" y2="288.0" />
-<text class="node-detail" x="86.0" y="305.0">proxy_set_header ... &quot;&quot; 로 먼저 지워야 한다</text>
+<polygon class="node-shape kind-gateway emphasis-warning role-control" data-evidence="393-400" points="167.5,240.0 265.0,275.5 167.5,311.0 70.0,275.5" />
+<text class="node-label" x="167.5" y="267.0">nginx</text>
+<line class="node-detail-divider" x1="84.0" y1="288.0" x2="251.0" y2="288.0" />
+<text class="node-detail" x="86.0" y="305.0">proxy_set_header ... &quot;&quot;</text>
 </g>
 <g id="node-proxy">
-<polygon class="node-shape kind-gateway emphasis-normal role-control" data-evidence="393-400" points="209.5,407.0 289.5,442.5 209.5,478.0 129.5,442.5" />
-<text class="node-label" x="209.5" y="434.0">oauth2-proxy</text>
-<line class="node-detail-divider" x1="143.5" y1="455.0" x2="275.5" y2="455.0" />
-<text class="node-detail" x="145.5" y="472.0">--set-xauthrequest</text>
+<polygon class="node-shape kind-gateway emphasis-normal role-control" data-evidence="393-400" points="167.5,407.0 247.5,442.5 167.5,478.0 87.5,442.5" />
+<text class="node-label" x="167.5" y="434.0">oauth2-proxy</text>
+<line class="node-detail-divider" x1="101.5" y1="455.0" x2="233.5" y2="455.0" />
+<text class="node-detail" x="103.5" y="472.0">--set-xauthrequest</text>
 </g>
 <g id="node-app">
-<rect class="node-shape kind-service emphasis-primary role-target" data-evidence="401-408" x="134.5" y="574.0" width="150.0" height="71.0" rx="7" />
-<text class="node-label" x="209.5" y="601.0">앱</text>
-<line class="node-detail-divider" x1="148.5" y1="622.0" x2="270.5" y2="622.0" />
-<text class="node-detail" x="150.5" y="639.0">세션은 로그인 시점의 스냅샷</text>
+<rect class="node-shape kind-service emphasis-primary role-target" data-evidence="401-408" x="92.5" y="574.0" width="150.0" height="71.0" rx="7" />
+<text class="node-label" x="167.5" y="601.0">앱</text>
+<line class="node-detail-divider" x1="106.5" y1="622.0" x2="228.5" y2="622.0" />
+<text class="node-detail" x="108.5" y="639.0">로그인 시점 스냅샷</text>
 </g>
 </svg>