dsh-ecc-skills 0.4.0

package/skills/cisco-ios-patterns/SKILL.md

@@ -0,0 +1,164 @@
+---
+name: cisco-ios-patterns
+description: Cisco IOS and IOS-XE review patterns for show commands, config hierarchy, wildcard masks, ACL placement, interface hygiene, and safe change-window verification. Use when reading, writing, or reviewing Cisco IOS / IOS-XE configuration or planning a change window.
+metadata:
+  origin: community
+---
+
+# Cisco IOS Patterns
+
+Use this skill when reviewing Cisco IOS or IOS-XE snippets, building a
+change-window checklist, or explaining how to collect evidence from a router or
+switch without making the incident worse.
+
+## When to Use
+
+- Reviewing IOS or IOS-XE configuration before a planned change.
+- Choosing read-only `show` commands for troubleshooting.
+- Checking ACL wildcard masks and interface direction.
+- Explaining global, interface, routing process, and line configuration modes.
+- Verifying that a change landed in running config and was saved intentionally.
+
+## Operating Rules
+
+Treat IOS examples as patterns, not paste-ready production changes. Confirm the
+platform, interface names, current config, rollback path, and out-of-band access
+before making changes on a real device.
+
+Prefer this workflow:
+
+1. Capture current state with read-only commands.
+2. Review the exact candidate config.
+3. Confirm management access cannot be locked out.
+4. Apply the smallest change in a maintenance window.
+5. Re-read state, compare to the baseline, then save only after validation.
+
+## Mode Reference
+
+```text
+Router> enable
+Router# show running-config
+Router# configure terminal
+Router(config)# interface GigabitEthernet0/1
+Router(config-if)# description UPLINK-TO-CORE
+Router(config-if)# no shutdown
+Router(config-if)# exit
+Router(config)# end
+Router# show running-config interface GigabitEthernet0/1
+```
+
+`running-config` is active memory. `startup-config` is what survives reload.
+Do not save a change just because a command was accepted; validate behavior
+first, then use `copy running-config startup-config` if the change is approved.
+
+## Read-Only Collection
+
+```text
+show version
+show inventory
+show processes cpu sorted
+show memory statistics
+show logging
+show running-config | section line vty
+show running-config | section interface
+show running-config | section router bgp
+show ip interface brief
+show interfaces
+show interfaces status
+show vlan brief
+show mac address-table
+show spanning-tree
+show ip route
+show ip protocols
+show ip access-lists
+show route-map
+show ip prefix-list
+```
+
+Collect the specific section you need instead of dumping full config into a
+ticket when the config may contain secrets, customer names, or private topology.
+
+## Wildcard Masks
+
+IOS ACL and many routing statements use wildcard masks, not subnet masks.
+
+```text
+Subnet mask       Wildcard mask
+255.255.255.255   0.0.0.0
+255.255.255.252   0.0.0.3
+255.255.255.0     0.0.0.255
+255.255.0.0       0.0.255.255
+```
+
+Review wildcard masks before deployment. A subnet mask accidentally used as a
+wildcard can match far more traffic than intended.
+
+```text
+ip access-list extended WEB-IN
+  10 permit tcp 192.0.2.0 0.0.0.255 any eq 443
+  999 deny ip any any log
+```
+
+Every ACL has an implicit deny at the end. Add an explicit logged deny when the
+operational goal includes observing misses, and confirm logging volume is safe.
+
+## ACL Placement Review
+
+Before applying an ACL to an interface, answer these questions:
+
+- Which traffic direction is being filtered, `in` or `out`?
+- Is management traffic sourced from a known jump host or management subnet?
+- Is there an explicit permit for required routing, DNS, NTP, monitoring, or
+  application traffic?
+- Are hit counters available from a safe test source?
+- Is there a rollback command and an active console or out-of-band path?
+
+Do not test reachability by removing firewall or ACL protections. Read counters,
+logs, and route state first.
+
+## Interface Hygiene
+
+```text
+interface GigabitEthernet0/1
+ description UPLINK-TO-CORE
+ switchport mode trunk
+ switchport trunk allowed vlan 10,20,30
+ switchport trunk native vlan 999
+ no shutdown
+```
+
+Use clear descriptions, explicit switchport mode, and documented native VLANs.
+On routed interfaces, confirm the mask, peer addressing, and routing process
+before assuming link state means forwarding is correct.
+
+## Change-Window Verification
+
+Use before/after checks that match the actual change.
+
+```text
+show running-config | section interface GigabitEthernet0/1
+show interfaces GigabitEthernet0/1
+show logging | include GigabitEthernet0/1|changed state|line protocol
+show ip route <prefix>
+show ip access-lists <name>
+```
+
+For routing changes, also capture neighbor state and route tables before and
+after the change. For ACL changes, compare hit counters from a planned test
+source rather than relying on a generic ping.
+
+## Anti-Patterns
+
+- Applying a generated config without a device-specific diff.
+- Saving configuration before post-change checks pass.
+- Using a subnet mask where IOS expects a wildcard mask.
+- Applying an ACL to the wrong interface direction.
+- Troubleshooting by disabling ACLs, route policies, or authentication.
+- Pasting full configs into public tools without sanitizing secrets and topology.
+
+## See Also
+
+- Agent: `network-config-reviewer`
+- Agent: `network-troubleshooter`
+- Skill: `network-config-validation`
+- Skill: `network-interface-health`

package/skills/ck/SKILL.md

@@ -0,0 +1,148 @@
+---
+name: ck
+description: Persistent per-project memory for Claude Code. Auto-loads project context on session start, tracks sessions with git activity, and writes to native memory. Commands run deterministic Node.js scripts — behavior is consistent across model versions. Use when a project needs context to survive across Claude Code sessions instead of being re-explained each time.
+metadata:
+  version: 2.0.0
+  origin: community
+author: sreedhargs89
+repo: https://github.com/sreedhargs89/context-keeper
+---
+
+# ck — Context Keeper
+
+You are the **Context Keeper** assistant. When the user invokes any `/ck:*` command,
+run the corresponding Node.js script and present its stdout to the user verbatim.
+Scripts live at: `~/.claude/skills/ck/commands/` (expand `~` with `$HOME`).
+
+---
+
+## Data Layout
+
+```
+~/.claude/ck/
+├── projects.json              ← path → {name, contextDir, lastUpdated}
+└── contexts/<name>/
+    ├── context.json           ← SOURCE OF TRUTH (structured JSON, v2)
+    └── CONTEXT.md             ← generated view — do not hand-edit
+```
+
+---
+
+## Commands
+
+### `/ck:init` — Register a Project
+```bash
+node "$HOME/.claude/skills/ck/commands/init.mjs"
+```
+The script outputs JSON with auto-detected info. Present it as a confirmation draft:
+```
+Here's what I found — confirm or edit anything:
+Project:     <name>
+Description: <description>
+Stack:       <stack>
+Goal:        <goal>
+Do-nots:     <constraints or "None">
+Repo:        <repo or "none">
+```
+Wait for user approval. Apply any edits. Then pipe confirmed JSON to save.mjs --init:
+```bash
+echo '<confirmed-json>' | node "$HOME/.claude/skills/ck/commands/save.mjs" --init
+```
+Confirmed JSON schema: `{"name":"...","path":"...","description":"...","stack":["..."],"goal":"...","constraints":["..."],"repo":"..." }`
+
+---
+
+### `/ck:save` — Save Session State
+**This is the only command requiring LLM analysis.** Analyze the current conversation:
+- `summary`: one sentence, max 10 words, what was accomplished
+- `leftOff`: what was actively being worked on (specific file/feature/bug)
+- `nextSteps`: ordered array of concrete next steps
+- `decisions`: array of `{what, why}` for decisions made this session
+- `blockers`: array of current blockers (empty array if none)
+- `goal`: updated goal string **only if it changed this session**, else omit
+
+Show a draft summary to the user: `"Session: '<summary>' — save this? (yes / edit)"`
+Wait for confirmation. Then pipe to save.mjs:
+```bash
+echo '<json>' | node "$HOME/.claude/skills/ck/commands/save.mjs"
+```
+JSON schema (exact): `{"summary":"...","leftOff":"...","nextSteps":["..."],"decisions":[{"what":"...","why":"..."}],"blockers":["..."]}`
+Display the script's stdout confirmation verbatim.
+
+---
+
+### `/ck:resume [name|number]` — Full Briefing
+```bash
+node "$HOME/.claude/skills/ck/commands/resume.mjs" [arg]
+```
+Display output verbatim. Then ask: "Continue from here? Or has anything changed?"
+If user reports changes → run `/ck:save` immediately.
+
+---
+
+### `/ck:info [name|number]` — Quick Snapshot
+```bash
+node "$HOME/.claude/skills/ck/commands/info.mjs" [arg]
+```
+Display output verbatim. No follow-up question.
+
+---
+
+### `/ck:list` — Portfolio View
+```bash
+node "$HOME/.claude/skills/ck/commands/list.mjs"
+```
+Display output verbatim. If user replies with a number or name → run `/ck:resume`.
+
+---
+
+### `/ck:forget [name|number]` — Remove a Project
+First resolve the project name (run `/ck:list` if needed).
+Ask: `"This will permanently delete context for '<name>'. Are you sure? (yes/no)"`
+If yes:
+```bash
+node "$HOME/.claude/skills/ck/commands/forget.mjs" [name]
+```
+Display confirmation verbatim.
+
+---
+
+### `/ck:migrate` — Convert v1 Data to v2
+```bash
+node "$HOME/.claude/skills/ck/commands/migrate.mjs"
+```
+For a dry run first:
+```bash
+node "$HOME/.claude/skills/ck/commands/migrate.mjs" --dry-run
+```
+Display output verbatim. Migrates all v1 CONTEXT.md + meta.json files to v2 context.json.
+Originals are backed up as `meta.json.v1-backup` — nothing is deleted.
+
+---
+
+## SessionStart Hook
+
+The hook at `~/.claude/skills/ck/hooks/session-start.mjs` must be registered in
+`~/.claude/settings.json` to auto-load project context on session start:
+
+```json
+{
+  "hooks": {
+    "SessionStart": [
+      { "hooks": [{ "type": "command", "command": "node \"~/.claude/skills/ck/hooks/session-start.mjs\"" }] }
+    ]
+  }
+}
+```
+
+The hook injects ~100 tokens per session (compact 5-line summary). It also detects
+unsaved sessions, git activity since last save, and goal mismatches vs CLAUDE.md.
+
+---
+
+## Rules
+- Always expand `~` as `$HOME` in Bash calls.
+- Commands are case-insensitive: `/CK:SAVE`, `/ck:save`, `/Ck:Save` all work.
+- If a script exits with code 1, display its stdout as an error message.
+- Never edit `context.json` or `CONTEXT.md` directly — always use the scripts.
+- If `projects.json` is malformed, tell the user and offer to reset it to `{}`.

package/skills/claude-devfleet/SKILL.md

@@ -0,0 +1,112 @@
+---
+name: claude-devfleet
+description: Orchestrate multi-agent coding tasks via Claude DevFleet — plan projects, dispatch parallel agents in isolated worktrees, monitor progress, and read structured reports. Use when dispatching parallel coding agents across isolated worktrees and tracking their reports.
+metadata:
+  origin: community
+---
+
+# Claude DevFleet Multi-Agent Orchestration
+
+## When to Use
+
+Use this skill when you need to dispatch multiple Claude Code agents to work on coding tasks in parallel. Each agent runs in an isolated git worktree with full tooling.
+
+## Setup
+
+The DevFleet server is a separate project, not bundled with ECC. Install and
+run it from its repository first: <https://github.com/LEC-AI/claude-devfleet>
+
+Then connect the running instance via MCP:
+```bash
+claude mcp add devfleet --transport http http://localhost:18801/mcp
+```
+
+Before first use, verify the process listening on port 18801 is the DevFleet
+binary you installed (see SECURITY.md on localhost MCP servers).
+
+## How It Works
+
+```
+User → "Build a REST API with auth and tests"
+  ↓
+plan_project(prompt) → project_id + mission DAG
+  ↓
+Show plan to user → get approval
+  ↓
+dispatch_mission(M1) → Agent 1 spawns in worktree
+  ↓
+M1 completes → auto-merge → auto-dispatch M2 (depends_on M1)
+  ↓
+M2 completes → auto-merge
+  ↓
+get_report(M2) → files_changed, what_done, errors, next_steps
+  ↓
+Report back to user
+```
+
+### Tools
+
+| Tool | Purpose |
+|------|---------|
+| `plan_project(prompt)` | AI breaks a description into a project with chained missions |
+| `create_project(name, path?, description?)` | Create a project manually, returns `project_id` |
+| `create_mission(project_id, title, prompt, depends_on?, auto_dispatch?)` | Add a mission. `depends_on` is a list of mission ID strings (e.g., `["abc-123"]`). Set `auto_dispatch=true` to auto-start when deps are met. |
+| `dispatch_mission(mission_id, model?, max_turns?)` | Start an agent on a mission |
+| `cancel_mission(mission_id)` | Stop a running agent |
+| `wait_for_mission(mission_id, timeout_seconds?)` | Block until a mission completes (see note below) |
+| `get_mission_status(mission_id)` | Check mission progress without blocking |
+| `get_report(mission_id)` | Read structured report (files changed, tested, errors, next steps) |
+| `get_dashboard()` | System overview: running agents, stats, recent activity |
+| `list_projects()` | Browse all projects |
+| `list_missions(project_id, status?)` | List missions in a project |
+
+> **Note on `wait_for_mission`:** This blocks the conversation for up to `timeout_seconds` (default 600). For long-running missions, prefer polling with `get_mission_status` every 30–60 seconds instead, so the user sees progress updates.
+
+### Workflow: Plan → Dispatch → Monitor → Report
+
+1. **Plan**: Call `plan_project(prompt="...")` → returns `project_id` + list of missions with `depends_on` chains and `auto_dispatch=true`.
+2. **Show plan**: Present mission titles, types, and dependency chain to the user.
+3. **Dispatch**: Call `dispatch_mission(mission_id=<first_mission_id>)` on the root mission (empty `depends_on`). Remaining missions auto-dispatch as their dependencies complete (because `plan_project` sets `auto_dispatch=true` on them).
+4. **Monitor**: Call `get_mission_status(mission_id=...)` or `get_dashboard()` to check progress.
+5. **Report**: Call `get_report(mission_id=...)` when missions complete. Share highlights with the user.
+
+### Concurrency
+
+DevFleet runs up to 3 concurrent agents by default (configurable via `DEVFLEET_MAX_AGENTS`). When all slots are full, missions with `auto_dispatch=true` queue in the mission watcher and dispatch automatically as slots free up. Check `get_dashboard()` for current slot usage.
+
+## Examples
+
+### Full auto: plan and launch
+
+1. `plan_project(prompt="...")` → shows plan with missions and dependencies.
+2. Dispatch the first mission (the one with empty `depends_on`).
+3. Remaining missions auto-dispatch as dependencies resolve (they have `auto_dispatch=true`).
+4. Report back with project ID and mission count so the user knows what was launched.
+5. Poll with `get_mission_status` or `get_dashboard()` periodically until all missions reach a terminal state (`completed`, `failed`, or `cancelled`).
+6. `get_report(mission_id=...)` for each terminal mission — summarize successes and call out failures with errors and next steps.
+
+### Manual: step-by-step control
+
+1. `create_project(name="My Project")` → returns `project_id`.
+2. `create_mission(project_id=project_id, title="...", prompt="...", auto_dispatch=true)` for the first (root) mission → capture `root_mission_id`.
+   `create_mission(project_id=project_id, title="...", prompt="...", auto_dispatch=true, depends_on=["<root_mission_id>"])` for each subsequent task.
+3. `dispatch_mission(mission_id=...)` on the first mission to start the chain.
+4. `get_report(mission_id=...)` when done.
+
+### Sequential with review
+
+1. `create_project(name="...")` → get `project_id`.
+2. `create_mission(project_id=project_id, title="Implement feature", prompt="...")` → get `impl_mission_id`.
+3. `dispatch_mission(mission_id=impl_mission_id)`, then poll with `get_mission_status` until complete.
+4. `get_report(mission_id=impl_mission_id)` to review results.
+5. `create_mission(project_id=project_id, title="Review", prompt="...", depends_on=[impl_mission_id], auto_dispatch=true)` — auto-starts since the dependency is already met.
+
+## Guidelines
+
+- Always confirm the plan with the user before dispatching, unless they said to go ahead.
+- Include mission titles and IDs when reporting status.
+- If a mission fails, read its report before retrying.
+- Check `get_dashboard()` for agent slot availability before bulk dispatching.
+- Mission dependencies form a DAG — do not create circular dependencies.
+- Each agent runs in an isolated git worktree and auto-merges on completion. If a merge conflict occurs, the changes remain on the agent's worktree branch for manual resolution.
+- When manually creating missions, always set `auto_dispatch=true` if you want them to trigger automatically when dependencies complete. Without this flag, missions stay in `draft` status.

package/skills/click-path-audit/SKILL.md

@@ -0,0 +1,245 @@
+---
+name: click-path-audit
+description: "Trace every user-facing button/touchpoint through its full state change sequence to find bugs where functions individually work but cancel each other out, produce wrong final state, or leave the UI in an inconsistent state. Use when: systematic debugging found no bugs but users report broken buttons, or after any major refactor touching shared state stores."
+metadata:
+  origin: community
+---
+
+# /click-path-audit — Behavioural Flow Audit
+
+Find bugs that static code reading misses: state interaction side effects, race conditions between sequential calls, and handlers that silently undo each other.
+
+## The Problem This Solves
+
+Traditional debugging checks:
+- Does the function exist? (missing wiring)
+- Does it crash? (runtime errors)
+- Does it return the right type? (data flow)
+
+But it does NOT check:
+- **Does the final UI state match what the button label promises?**
+- **Does function B silently undo what function A just did?**
+- **Does shared state (Zustand/Redux/context) have side effects that cancel the intended action?**
+
+Real example: A "New Email" button called `setComposeMode(true)` then `selectThread(null)`. Both worked individually. But `selectThread` had a side effect resetting `composeMode: false`. The button did nothing. 54 bugs were found by systematic debugging — this one was missed.
+
+---
+
+## How It Works
+
+For EVERY interactive touchpoint in the target area:
+
+```
+1. IDENTIFY the handler (onClick, onSubmit, onChange, etc.)
+2. TRACE every function call in the handler, IN ORDER
+3. For EACH function call:
+   a. What state does it READ?
+   b. What state does it WRITE?
+   c. Does it have SIDE EFFECTS on shared state?
+   d. Does it reset/clear any state as a side effect?
+4. CHECK: Does any later call UNDO a state change from an earlier call?
+5. CHECK: Is the FINAL state what the user expects from the button label?
+6. CHECK: Are there race conditions (async calls that resolve in wrong order)?
+```
+
+---
+
+## Execution Steps
+
+### Step 1: Map State Stores
+
+Before auditing any touchpoint, build a side-effect map of every state store action:
+
+```
+For each Zustand store / React context in scope:
+  For each action/setter:
+    - What fields does it set?
+    - Does it RESET other fields as a side effect?
+    - Document: actionName → {sets: [...], resets: [...]}
+```
+
+This is the critical reference. The "New Email" bug was invisible without knowing that `selectThread` resets `composeMode`.
+
+**Output format:**
+```
+STORE: emailStore
+  setComposeMode(bool) → sets: {composeMode}
+  selectThread(thread|null) → sets: {selectedThread, selectedThreadId, messages, drafts, selectedDraft, summary} RESETS: {composeMode: false, composeData: null, redraftOpen: false}
+  setDraftGenerating(bool) → sets: {draftGenerating}
+  ...
+
+DANGEROUS RESETS (actions that clear state they don't own):
+  selectThread → resets composeMode (owned by setComposeMode)
+  reset → resets everything
+```
+
+### Step 2: Audit Each Touchpoint
+
+For each button/toggle/form submit in the target area:
+
+```
+TOUCHPOINT: [Button label] in [Component:line]
+  HANDLER: onClick → {
+    call 1: functionA() → sets {X: true}
+    call 2: functionB() → sets {Y: null} RESETS {X: false}  ← CONFLICT
+  }
+  EXPECTED: User sees [description of what button label promises]
+  ACTUAL: X is false because functionB reset it
+  VERDICT: BUG — [description]
+```
+
+**Check each of these bug patterns:**
+
+#### Pattern 1: Sequential Undo
+```
+handler() {
+  setState_A(true)     // sets X = true
+  setState_B(null)     // side effect: resets X = false
+}
+// Result: X is false. First call was pointless.
+```
+
+#### Pattern 2: Async Race
+```
+handler() {
+  fetchA().then(() => setState({ loading: false }))
+  fetchB().then(() => setState({ loading: true }))
+}
+// Result: final loading state depends on which resolves first
+```
+
+#### Pattern 3: Stale Closure
+```
+const [count, setCount] = useState(0)
+const handler = useCallback(() => {
+  setCount(count + 1)  // captures stale count
+  setCount(count + 1)  // same stale count — increments by 1, not 2
+}, [count])
+```
+
+#### Pattern 4: Missing State Transition
+```
+// Button says "Save" but handler only validates, never actually saves
+// Button says "Delete" but handler sets a flag without calling the API
+// Button says "Send" but the API endpoint is removed/broken
+```
+
+#### Pattern 5: Conditional Dead Path
+```
+handler() {
+  if (someState) {        // someState is ALWAYS false at this point
+    doTheActualThing()    // never reached
+  }
+}
+```
+
+#### Pattern 6: useEffect Interference
+```
+// Button sets stateX = true
+// A useEffect watches stateX and resets it to false
+// User sees nothing happen
+```
+
+### Step 3: Report
+
+For each bug found:
+
+```
+CLICK-PATH-NNN: [severity: CRITICAL/HIGH/MEDIUM/LOW]
+  Touchpoint: [Button label] in [file:line]
+  Pattern: [Sequential Undo / Async Race / Stale Closure / Missing Transition / Dead Path / useEffect Interference]
+  Handler: [function name or inline]
+  Trace:
+    1. [call] → sets {field: value}
+    2. [call] → RESETS {field: value}  ← CONFLICT
+  Expected: [what user expects]
+  Actual: [what actually happens]
+  Fix: [specific fix]
+```
+
+---
+
+## Scope Control
+
+This audit is expensive. Scope it appropriately:
+
+- **Full app audit:** Use when launching or after major refactor. Launch parallel agents per page.
+- **Single page audit:** Use after building a new page or after a user reports a broken button.
+- **Store-focused audit:** Use after modifying a Zustand store — audit all consumers of the changed actions.
+
+### Recommended agent split for full app:
+
+```
+Agent 1: Map ALL state stores (Step 1) — this is shared context for all other agents
+Agent 2: Dashboard (Tasks, Notes, Journal, Ideas)
+Agent 3: Chat (DanteChatColumn, JustChatPage)
+Agent 4: Emails (ThreadList, DraftArea, EmailsPage)
+Agent 5: Projects (ProjectsPage, ProjectOverviewTab, NewProjectWizard)
+Agent 6: CRM (all sub-tabs)
+Agent 7: Profile, Settings, Vault, Notifications
+Agent 8: Management Suite (all pages)
+```
+
+Agent 1 MUST complete first. Its output is input for all other agents.
+
+---
+
+## When to Use
+
+- After systematic debugging finds "no bugs" but users report broken UI
+- After modifying any Zustand store action (check all callers)
+- After any refactor that touches shared state
+- Before release, on critical user flows
+- When a button "does nothing" — this is THE tool for that
+
+## When NOT to Use
+
+- For API-level bugs (wrong response shape, missing endpoint) — use systematic-debugging
+- For styling/layout issues — visual inspection
+- For performance issues — profiling tools
+
+---
+
+## Integration with Other Skills
+
+- Run AFTER `/superpowers:systematic-debugging` (which finds the other 54 bug types)
+- Run BEFORE `/superpowers:verification-before-completion` (which verifies fixes work)
+- Feeds into `/superpowers:test-driven-development` — every bug found here should get a test
+
+---
+
+## Example: The Bug That Inspired This Skill
+
+**ThreadList.tsx "New Email" button:**
+```
+onClick={() => {
+  useEmailStore.getState().setComposeMode(true)   // ✓ sets composeMode = true
+  useEmailStore.getState().selectThread(null)      // ✗ RESETS composeMode = false
+}}
+```
+
+Store definition:
+```
+selectThread: (thread) => set({
+  selectedThread: thread,
+  selectedThreadId: thread?.id ?? null,
+  messages: [],
+  drafts: [],
+  selectedDraft: null,
+  summary: null,
+  composeMode: false,     // ← THIS silent reset killed the button
+  composeData: null,
+  redraftOpen: false,
+})
+```
+
+**Systematic debugging missed it** because:
+- The button has an onClick handler (not dead)
+- Both functions exist (no missing wiring)
+- Neither function crashes (no runtime error)
+- The data types are correct (no type mismatch)
+
+**Click-path audit catches it** because:
+- Step 1 maps `selectThread` resets `composeMode`
+- Step 2 traces the handler: call 1 sets true, call 2 resets false
+- Verdict: Sequential Undo — final state contradicts button intent