docs(fr-041): two validity threats found by running the thing, not reasoning about it

A pilot run on 2026-09-12 (first execution of the revived harness against 1.0.3)
surfaced two §8 entries that no amount of reading the design would have produced.

The agent inherits the HOST's MCP servers and user-level agent instructions,
because it is launched headless with the sandbox as its working directory and
nothing isolates its configuration. Part of each arm's context therefore comes
from whichever workstation runs it: not a fixed treatment, and not reproducible
by a stranger, which is the whole claim a published benchmark makes. Every
archived run shares the exposure.

And the per-task budget cap has to be re-derived whenever the agent model
changes — the same run took roughly twice the turns and cost of its archived
predecessor on the previous model generation, so a cap carried over unchanged
binds at a different rate than the one §8 reasons about.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011cQxyVuTkdPmAduLiedNEg

Author: dmealing

docs/superpowers/specs/2026-09-11-fr-041-drift-ab-benchmark-design.md

@@ -317,6 +317,17 @@ unflattering headline is the specific thing pre-registration exists to stop.
   flatters it on a measure that requires completion. The cap is set from the pilot so that it
   binds at the same *rate* in both arms rather than at the same number, every truncation is
   recorded, and truncated tasks count as failures (§5a).
+- **Host contamination of the agent's context — OBSERVED, not hypothetical.** A 2026-09-12 pilot
+  run launched the agent headless with the sandbox as its working directory, and it inherited the
+  **host machine's** MCP servers and user-level agent instructions. Part of the arm's context
+  therefore came from whichever workstation ran it, so the treatment was neither fixed across runs
+  nor reproducible by anyone else — and every archived run shares the exposure. Mitigation: run
+  each arm in a clean room with its settings and MCP configuration supplied explicitly, and record
+  in the pre-registration exactly what context each arm was given.
+- **A per-task budget sized on the wrong model.** The cap must be re-derived whenever the agent
+  model changes: the same pilot run took ~2x the turns and cost of its archived predecessor on the
+  previous model generation, so a cap carried over unchanged would bind at a different rate than
+  intended.
 - **Oracle bugs.** Every oracle is run against a known-good and a known-drifted reference solution
   in both arms before any scored run (§4b).
 - **Model drift.** Arms are interleaved; the model version is recorded per run.