--- a/.claude/skills/zenbu-bazel-c/SKILL.md	Tue Aug 04 15:12:09 2026 -0700
+++ b/.claude/skills/zenbu-bazel-c/SKILL.md	Tue Aug 04 15:12:18 2026 -0700
@@ -26,6 +26,10 @@
 
 Avoid broad searches in `third_party/`, Bazel output directories, virtualenvs, `node_modules`, and generated bundles unless the task specifically requires them.
 
+For cross-codebase audits, inspect `BUILD` files and Bazel dependencies first.
+Use the dependency graph to identify actual first-party consumers before broad
+text search, then audit only those targets and their transitive owners.
+
 ## Build and test commands
 
 Use Bazel targets from the repository root:
@@ -58,6 +62,16 @@
   `TRUE`/`FALSE` in first-party C. Do not introduce `<stdint.h>` `_t` aliases
   or `<stdbool.h>` `bool` when a Dowa type already expresses the value.
 - C code generally uses `Dowa_Arena` for request-scoped allocations.
+- An arena owns every pointer returned by `Dowa_Arena_Allocate`, aligned arena
+  allocation, arena string helpers, and arena array/hash-map macros. Never pass
+  those pointers to libc `free()`, `Dowa_Free`, or an element-level destroy
+  function.
+- Release a locally created arena exactly once with `Dowa_Arena_Free()` on
+  every return path. Do not release a borrowed request arena; its owner must
+  free it.
+- Prefer `Dowa_Free` over raw libc `free()` for separately heap-allocated
+  first-party pointers. Keep the allocation source explicit when heap and arena
+  ownership coexist in one function.
 - HTTP responses are usually `Seobeo_Request_Entry *resp = NULL` maps filled with `Dowa_HashMap_Push_Arena`.
 - Route handlers return response maps; streaming handlers receive `Seobeo_Handle *` directly.
 - Existing code favors explicit status/content-type/body response fields.