docs: macOS/BSD find — template+понимание вместо ветвления

- Зачем:
  - `-newermt "@<epoch>"` и `-printf` в secondary session-id capture — GNU-специфичные; на macOS BSD find они не работают, а тестировать на маке негде.
- Что:
  - SKILL.md: добавлена one-paragraph platform note рядом с `find` — формулирует цель шага ("найти свежие rollout-файлы, выбрать последний, извлечь UUID") и приглашает Opus/пользователя подставить BSD-эквивалент.
  - docs/DESIGN.md §9.5: новое known-limitation с обоснованием template+understanding подхода вместо platform-detection.
  - README.md Known limitations: user-facing note, что end-to-end на macOS не тестировался.
- Проверка:
  - Ничего не ломается на Linux (команды без изменений).
  - На macOS оператор читает note и адаптирует.

README.md

@@ -262,6 +262,12 @@ review correctness.
   scoped to the submodule — `git rev-parse --show-toplevel` does not walk
   up to the parent. A warning is printed; invoke from the parent repo if
   you want parent scope.
+- **GNU find on macOS.** The secondary session-id capture uses
+  `find -newermt "@<epoch>"` and `-printf`, both GNU extensions. On
+  macOS (BSD find) the skill's default command does not work; the skill
+  states the *goal* of the step in SKILL.md and invites the model (or
+  user) to substitute an equivalent BSD-compatible command. The skill
+  has not been end-to-end tested on macOS.
 
 ## Roadmap
 

SKILL.md

@@ -384,6 +384,8 @@ cat /tmp/codex-prompt-${REVIEW_ID}.md | timeout 600 codex exec --json \
 
    A single `find` invocation keeps the permission rule simple (`Bash(find ~/.codex/sessions*)`) and the parsing stays in your head — no shell pipeline needed.
 
+   **Platform note.** `-newermt "@<epoch>"` and `-printf` are GNU extensions. On macOS (BSD find) they are unsupported — substitute an equivalent that achieves the same goal: "list rollout files modified since `${CODEX_SESSIONS_BEFORE}`, newest first". For example, `find ~/.codex/sessions -name 'rollout-*.jsonl' -type f` plus `stat -f '%m %N' <path>` per result, or `ls -t ~/.codex/sessions/*/*/*/rollout-*.jsonl` and filter by a reference file's mtime. The goal is what matters, not the exact flags.
+
    **Parallel-codex caveat:** if you happened to pick a rollout from a parallel codex invocation, Step 7's resume will either succeed against the wrong session (detected later via VERDICT / severity checks) or fail at the stderr/exit-code check and route to the standard fallback (§4.11). Either outcome is recoverable.
 
 4. **Review file sanity.** (Performed again in Step 5, but note upfront.) `/tmp/codex-review-${REVIEW_ID}.md` must exist and contain a line matching `^VERDICT: (APPROVED|REVISE)$`. If not → Step 5 will handle it via retry/abort.

docs/DESIGN.md

@@ -1169,7 +1169,27 @@ If this becomes an issue, the fix is to sanitize / escape before
 substitution, which requires careful handling of double-quoted `-C`
 argument and single-quoted `cd` prefix.
 
-### §9.5. No automated tests
+### §9.5. GNU find dependency in the filesystem session-id fallback
+
+The secondary session-id capture (`§4.1b`) uses `find -newermt "@<epoch>"`
+and `-printf`, both GNU extensions. On macOS (BSD `find`) the commands
+do not accept these flags. The skill does not detect the platform and
+does not translate commands automatically.
+
+Mitigation today: `SKILL.md` Step 4 check 3 includes a one-paragraph
+platform note that states the *goal* of the command ("list rollout
+files modified since `CODEX_SESSIONS_BEFORE`, pick newest, extract
+UUID from filename") and invites the operator or the lead to substitute
+an equivalent BSD-compatible command (`find ... -type f` + `stat -f
+'%m %N'`, or `ls -t ... | head -1` against a reference marker file).
+This is a "template + understanding" approach: rely on the lead's
+adaptability rather than branching the skill for every platform.
+
+If BSD support ever becomes load-bearing (a macOS-running user base,
+a CI on macOS runners), this can be upgraded to a bundled portable
+command variant or a platform-detection branch.
+
+### §9.6. No automated tests
 
 `§7. Smoke test protocol` is manual. Automating it would require: