docs: address PR review -- stale validator comment, fragile test counts, policy.ui gap

state_aware.rs: the block comment above the validate_<phase> hooks still said network policy was rejected at every phase. That stopped being true when provision started accepting the canonical unrestricted-network acknowledgment. Correct the network clause while keeping the statements that are still true (the backend has no network primitive; proxy policy is rejected at every phase).

oneshot.md: drop the Test Plan Count column and the '~31 backend-specific' / '287 total currently passing' figures. They were already stale (policy.rs has 28 tests, listed as ~24) and the rows never summed to the stated total. No other backend doc or README tracks test counts, so removing them makes this doc consistent and deletes a number that silently rots whenever a test is added. The durable Category / Location / What-it-verifies content stays.

state-aware-rust.md: policy.ui was documented as rejected at every phase, but the backend never validates it, so a supplied UI policy is silently ignored. Correct the matrix to 'ignored' (matching the runtime and the state-aware design doc) and add an explicit known-gap note -- this is the same false-guarantee shape the network honesty gate closes, so rejecting policy.ui is the intended end state, not a deliberate exemption.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 47662115-cf22-4564-8930-370dfbee63fb

Author: adpa-ms

docs/isolation-session/oneshot.md

@@ -239,16 +239,16 @@ versions and stating that the bindings must be regenerated.
 
 **Automated (`cargo test`, runs on any machine including CI):**
 
-| Category | Count | Location | What it verifies |
-|---|---:|---|---|
-| Config parsing | ~8 | `config_parser.rs` | `"isolation_session"` containment value and `experimental.isolation_session` section parsing |
-| Policy validation | ~24 | `policy.rs` | Filesystem fields (`readwritePaths` / `readonlyPaths` / `deniedPaths`) are rejected at every phase; the network policy must be the canonical unrestricted-network acknowledgment (`defaultPolicy=allow` + `allowLocalNetwork=true`, no host rules or proxy) at provision, and any supplied network policy is rejected post-provision |
-| Option building | ~6 | `isolation_session_runner.rs` | `ExecutionRequest` → `ProcessOptions` mapping (timeout, cwd, env vars, redirect flags) |
-| Feature unavailable | 1 | `isolation_session_runner.rs` | Runner returns a clean error on machines without the IsolationSession feature enabled, so the test passes everywhere |
-
-These ~31 backend-specific tests run alongside the existing workspace tests
-(287 total currently passing). The feature-unavailable test is what runs in
-CI, since CI machines do not have a Windows build with the IsolationSession feature enabled.
+| Category | Location | What it verifies |
+|---|---|---|
+| Config parsing | `config_parser.rs` | `"isolation_session"` containment value and `experimental.isolation_session` section parsing |
+| Policy validation | `policy.rs` | Filesystem fields (`readwritePaths` / `readonlyPaths` / `deniedPaths`) are rejected at every phase; the network policy must be the canonical unrestricted-network acknowledgment (`defaultPolicy=allow` + `allowLocalNetwork=true`, no host rules or proxy) at provision, and any supplied network policy is rejected post-provision |
+| Option building | `isolation_session_runner.rs` | `ExecutionRequest` → `ProcessOptions` mapping (timeout, cwd, env vars, redirect flags) |
+| Feature unavailable | `isolation_session_runner.rs` | Runner returns a clean error on machines without the IsolationSession feature enabled, so the test passes everywhere |
+
+These backend-specific tests run alongside the existing workspace tests. The
+feature-unavailable test is what runs in CI, since CI machines do not have a
+Windows build with the IsolationSession feature enabled.
 
 **Integration tests (require a Windows host with the IsolationSession feature enabled):**
 

docs/isolation-session/state-aware-rust.md

@@ -132,7 +132,7 @@ it accepts is the optional Entra `user` bundle, at provision and start.
 | `policy.filesystem.deniedPaths` | rejected | rejected | rejected | rejected | rejected |
 | `policy.network` — canonical `allow` acknowledgment (`defaultPolicy=allow` + `allowLocalNetwork=true`, no host rules, no proxy, default enforcement) | **required** | rejected | rejected | rejected | rejected |
 | `policy.network` — any other value (incl. absent → `block`, host rules, proxy) | rejected | rejected | rejected | rejected | rejected |
-| `policy.ui` | rejected | rejected | rejected | rejected | rejected |
+| `policy.ui` — see the known gap below | ignored | ignored | ignored | ignored | ignored |
 | `experimental.isolation_session.{provision,start}.user` | **honored** | **honored** | n/a | n/a | n/a |
 
 Rejection of `policy.*` fields surfaces as `error.code = "policy_validation"`.
@@ -155,13 +155,20 @@ user it assigned at provision.
 ### Policy fields and mode parity
 
 Both modes share the same policy matrix above. Every `policy.filesystem`
-field (`readwritePaths`, `readonlyPaths`, `deniedPaths`) and `policy.ui` are
-rejected at every phase (no host-folder-sharing primitive; `ui` not yet
-honored). The network policy is honesty-gated per the matrix — provision
-requires the canonical unrestricted-network acknowledgment and post-provision
-rejects any supplied network policy (inheriting an absent one). One-shot
-enforces this via `validate_runner`; state-aware enforces it via the
-`validate_<phase>` hooks.
+field (`readwritePaths`, `readonlyPaths`, `deniedPaths`) is rejected at every
+phase (no host-folder-sharing primitive). The network policy is honesty-gated
+per the matrix — provision requires the canonical unrestricted-network
+acknowledgment and post-provision rejects any supplied network policy
+(inheriting an absent one). One-shot enforces this via `validate_runner`;
+state-aware enforces it via the `validate_<phase>` hooks.
+
+**Known gap — `policy.ui` is silently ignored.** The backend has no
+UI-restriction primitive, and it does not validate `policy.ui`, so a supplied
+UI policy is accepted and then dropped rather than refused. That is the same
+false-guarantee shape the network honesty gate closes: a caller asking for a
+UI restriction gets no error and no enforcement. Rejecting `policy.ui` is the
+intended end state, not a deliberate exemption — the matrix records `ignored`
+because that is the current behavior, not the desired one.
 
 ### Fields valid in state-aware only
 

src/backends/isolation_session/common/src/state_aware.rs

@@ -156,9 +156,13 @@ impl StatefulSandboxBackend for IsolationSessionRunner {
         Ok(DeprovisionResult { metadata: None })
     }
 
-    // Filesystem rw/ro/denied paths, network, and proxy policy are rejected
-    // at every phase: the backend has no host-folder-sharing, network, or
-    // proxy primitive. Anything rejected produces a `policy_validation`
+    // Filesystem rw/ro/denied paths are rejected at every phase: the backend
+    // has no host-folder-sharing primitive. Network policy is honesty-gated —
+    // the backend cannot filter or deny the container network, so provision
+    // requires the canonical unrestricted-network acknowledgment, and every
+    // post-provision phase rejects a supplied network policy (the posture is
+    // fixed at provision) while inheriting an absent one. Proxy policy is
+    // rejected at every phase. Anything rejected produces a `policy_validation`
     // envelope rather than silent ignore.
 
     fn validate_provision(