diff --git a/docs/specification.md b/docs/specification.md
index dbe7bd381..e6e5d7b96 100644
--- a/docs/specification.md
+++ b/docs/specification.md
@@ -46205,6 +46205,8 @@ The sandbox is the primary safety mechanism preventing untested changes from rea
 3. **Atomic apply**: The Apply phase is an atomic operation — either all sandbox changes are committed to the real resources, or none are. For git-based resources, this uses git merge. For database resources, this uses transaction commit.
 4. **Sandbox cleanup**: Sandbox directories are cleaned up according to `sandbox.cleanup` policy. Sensitive data (API responses, LLM outputs) is purged from the sandbox on cleanup.
 
+**Sandbox cleanup re-discovery contract**: The cleanup service MUST re-discover sandbox directories on each scan or purge operation — it MUST NOT cache the directory list across invocations. Sandbox directories are created dynamically during plan execution; a cache populated at service initialization time will miss all sandboxes created after the first scan. The cleanup service is typically a long-running singleton, so permanent caching would cause stale sandbox accumulation even when the cleanup service is actively running. Each `scan()` and `purge()` call must perform a fresh filesystem scan of the sandbox root directory.
+
 #### Prompt Injection Mitigation
 
 In server mode, where user-provided content may flow into LLM prompts, CleverAgents implements several mitigations: