docs(templateengine): drop the removed staleness memo; describe the full shared-script compile gate (review 2026-10-21 04/U2, 04/U3)

docs/requirements/Component-TemplateEngine.md

@@ -199,11 +199,12 @@ not replicated between central nodes. A restart, a failover, or any mutation sim
 misses and falls back to the authoritative full flatten, so the watermark can only
 ever cause EXTRA work, never stale work.
 
-The same watermark backs a **staleness fast path** in `StaleInstanceProbe`: a
-previously computed revision hash is reused when the instance's version, the
-structure version, and the version of every template that flatten walked are all
-unchanged. This matters most where the probe is called per-instance across a whole
-bundle import or a fleet-wide staleness sweep.
+The watermark does **not** back any staleness memo. `StaleInstanceProbe` once reused
+a previously computed revision hash while the watermark versions were unchanged; that
+fast path was removed (MG-3), because the watermark is process-local and a
+configuration edit made through the *other* central node never bumps it. Every probe
+now starts a fresh flatten session — see `Component-DeploymentManager.md` →
+*Authoritative staleness and bulk deadlines* (review 2026-10-21 04/U2).
 
 ### Design-time analysis reads
 
@@ -327,7 +328,9 @@ The same validation logic is available to Design users in the Central UI without
 
 ### Shared Script Validation
 
-For shared scripts, pre-compilation validation is performed before deployment. Since shared scripts have no instance context, validation uses `RoslynScriptCompiler.ParseDiagnostics` for syntax errors and `ScriptTrustValidator.FindViolations` for the forbidden-API check. Full type-checking compilation is not performed (no globals type is available), but syntax and trust violations are caught and reported.
+`SharedScriptService` validates on **create and update** (review 2026-10-21 04/U3 — the MG-8 remediation made this a full gate): a cheap structural pass (`CSharpDelimiterScanner` — balanced delimiters outside strings/comments) followed by the **same authoritative gate as instance scripts**, `ScriptCompiler.TryCompile` — `ScriptTrustValidator.FindViolations` for the forbidden-API check plus a real Roslyn type-checking compile against **`ScriptCompileSurface`**, the instance-script globals surface. A save that fails either stage is rejected with the error text.
+
+Gating against the instance surface is a design decision worth knowing: a shared script executes inline inside the calling script's context, so it is type-checked as if it were an instance script. A shared script that references an identifier the instance surface does not expose fails at save, and one that uses an instance accessor (`Attributes`, `Instance`, …) compiles — whether that accessor is meaningful at run time depends on the caller.
 
 ## Dependencies