[danczw]

#26 grep only: it checks the cancel token before each file and returns Cancelled, never a marked partial listing. find, read, ls, write and edit stay uncancellable and #26 stays open: none has a safe point whose stop is worth the partial state or the wider sandbx-core API.

A stopped call now reads "cancelled" and not "cancelled and killed", since only a bash is killed.

SECURITY.md changed: the interrupt bullet and the session-store bullet name grep and say the walk before it and the read inside a file are not interruptible.

Reviews, all over origin/main...HEAD from the worktree: /code-review at 6ecd945 (6 files, +72/-18), /security-review at 3ff1af0 (10 files, +86/-28), no findings. Comment pass at 1b6370a (10 files, +88/-29), code unchanged by it.