instar 1.3.984 → 1.3.986

package/upgrades/1.3.985.md

@@ -0,0 +1,109 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+**A flag placed after the topic id was sent to the user as literal message text, and the
+setting it carried was silently dropped.**
+
+`telegram-reply.sh` parses flags in a loop that breaks at the first non-flag argument — the
+topic id. Everything after that becomes the message via `MSG="$*"`. So
+`telegram-reply.sh 29723 --tone-ack B15 --tone-reason "why"` sent the user the literal text
+`--tone-ack B15 --tone-reason why`, while the tone-advisory override never reached the
+server. Both failures were silent; the script exited 0.
+
+This is measured, not inferred. The pre-fix template is captured verbatim as a test fixture
+(at the same SHA now registered in the migrator's shipped-SHA allowlist) and run against a
+stub of the reply route: exit 0, received text containing `--tone-ack`, and no
+`toneAdvisoryAck` in the metadata.
+
+**The cost was a corrupted measurement.** Because the override never applied, the tone gate
+re-reviewed the send as an ordinary message whose text now began with option noise. The
+verdict looked absurd, was read as a malfunction, and a **correct** check was graded `wrong`
+in the decision-quality data — the data used to decide which checks to trust. That record is
+durable and is not retracted by this change.
+
+**The root cause was not the script.** These flags were documented nowhere agent-facing:
+not in the script's own usage header (which covers `--format` and `--stdin-base64`), and not
+in the agent instructions, which document the HTTP `metadata.*` fields while simultaneously
+mandating "ALWAYS the relay script, never a hand-rolled curl". The bridge between the two
+did not exist, so the invocation had to be guessed — and the script accepted the guess
+without complaint. A capability shipped without instructions, plus a tool that stayed silent
+on the only usage an uninstructed caller would try.
+
+An inconsistency underneath made the fix obvious once seen: the script **already** treated an
+unrecognised flag-shaped token as fatal when it appeared *before* the topic id. It was strict
+about nonsense in one position and fully permissive about a real flag in the other. Both
+positions are now treated the same.
+
+Three parts, because the chain had three links:
+
+1. **The script refuses** a `--*` argument after the topic id, printing the correct ordering
+   and the corrected command. Nothing is sent.
+2. **A typo'd flag is caught too** (`--tone-akc`) — the realistic mistake, and equally silent
+   before. The guard matches the *shape*, not a list of known names, which is what makes it
+   useful rather than decorative.
+3. **The flags are documented** — in the script's usage header and in the agent instructions,
+   with a worked example showing flags before the topic id.
+
+**What this does not do:** it does not retract the false grade from 2026-07-26. Whether a
+mistaken grade can be corrected at all — and whether correcting one erases the evidence that
+it was ever made, which would be the opposite defect — is a separate open question, and is
+deliberately not answered here. It also fixes only this script; `slack-reply.sh` and
+`whatsapp-reply.sh` share the parse-then-break shape but carry no tone flags today, so they
+are named rather than swept in.
+
+## What to Tell Your User
+
+If a stray double-dash option ever appeared in the middle of one of my messages to you, that
+was this: a setting that belonged in the plumbing ended up in the text, and whatever it was
+supposed to do quietly didn't happen. It can't reach you as text any more — the send is
+refused and corrected instead.
+
+The part worth knowing: one of those settings is how I record that I disagree with one of my
+own safety checks. When it silently failed to apply, I misread the result and marked a check
+as faulty when it had actually been right. So this wasn't only cosmetic — it put a wrong
+entry in the records used to judge whether those checks are any good. That entry is still
+there; this stops more from being created.
+
+## Summary of New Capabilities
+
+- A flag placed after the topic id is refused with an actionable message naming the correct
+  ordering, instead of being sent to the user as literal text with its effect dropped.
+- A misspelled flag after the topic id is caught by the same guard.
+- The tone-advisory reaction flags (`--tone-ack`, `--tone-reason`, `--tone-complied`,
+  `--tone-decision-ref`) are documented in the script's usage header and in the agent
+  instructions, with a worked example.
+- Existing agents receive both the new script and the new documentation — the doc block is
+  sniffed on its own marker so an agent that already carries the surrounding section is not
+  skipped.
+
+## Evidence
+
+**Reproduction (before),** the pre-fix template against a stub reply route:
+
+| invocation | exit | text received by the user | override applied |
+|---|---|---|---|
+| `… 4242 --tone-ack B15 --tone-reason because` | `0` | `--tone-ack B15 --tone-reason because` | no |
+
+**Observed after,** same stub:
+
+| invocation | before | after |
+|---|---|---|
+| flag after the topic id | sent as message text, exit 0 | refused, exit 1, **zero requests sent** |
+| typo'd flag after the topic id | sent as message text, exit 0 | refused, exit 1, zero requests |
+| flags before the topic id | worked | works — text clean, `toneAdvisoryAck` + reason present |
+| message on stdin containing a flag-shaped token | sent verbatim | sent verbatim (stdin is not inspected) |
+| unknown flag before the topic id | `Unknown flag`, exit 1 | unchanged |
+
+**Tests:** `tests/integration/telegram-reply-misplaced-flag.test.ts` (6) runs the real
+template — and the pre-fix fixture — against a stub route, so "was it sent as text?" is
+answered by the received payload rather than by reading the script.
+`tests/unit/PostUpdateMigrator-toneAdvisoryFlagPosition.test.ts` (3) covers migration parity,
+including the load-bearing case: an agent that already carries the tone-advisory section must
+still receive the invocation guidance. That test was verified to FAIL when the second
+migration block is disabled, so it cannot pass whether or not the migration exists. The full
+telegram-reply and template-SHA surface (10 files, 51 tests) passes unchanged;
+`npx tsc --noEmit` clean.

package/upgrades/1.3.986.md

@@ -0,0 +1,153 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+**A session's startup banner — and a session's startup QUESTION — were read as an input prompt, so
+a message could be typed into a pane that could not receive it, and the delivery was logged as a
+success.**
+
+`SessionManager.detectClaudePrompt` decided a pane was accepting input if the last six
+non-blank lines contained `❯`, `›`, `bypass permissions`, or a mention of `/effort`,
+`/model` or `/fast`. That last clause matched a bare slash-command mention **anywhere, in
+any context, including prose**.
+
+Claude Code's startup banner advertises slash commands in prose. The pane that caused the
+incident carried, verbatim:
+
+> `…Fable 5 draws down usage faster than Opus 4.8. Run /model and`
+> `select Fable to use it. Learn more: https://support.claude.com/…`
+
+so the probe matched a promotional line and declared a still-painting pane ready.
+
+**Observed (topic 29723, 2026-07-26).** Inbound message at `17:44:49Z`, session respawned,
+pointer prompt injected at `17:45:00Z` — but that session's own start hook did not complete
+until `17:45:15Z`. The paste landed fifteen seconds early, was swallowed by the TUI redraw,
+and the injector wrote `Injected initial message into "…" (915 chars, after stabilization
+delay)`. A success line for a delivery that did not happen. The message reached the agent
+only because the start hook's unanswered-message backstop re-reads recent history — an
+unrelated path that happens to cover this hole and cannot be relied on to.
+
+**The slash-command clauses are deleted, not tuned.** A first attempt kept them and required
+"status-bar shape" (line-start or directly after an interpunct). Second-pass review falsified that:
+the banner uses the same shape — `· /memory to free up context` and `+1 more · /status` are BANNER
+lines — so the discrimination was still vocabulary, and `· /model to opt in` matched outright. The
+line-start branch also reinstated the very dependency it claimed to remove: at a fixed pane width, a
+copy edit shifting the wrap by ~14 characters puts the command at column 0 and the defect returns. A
+signal that cannot separate an ADVERT for a command from a STATUS BAR showing one carries no
+readiness information. The structural markers were widened instead — `? for shortcuts`,
+`shift+tab to cycle` and `auto-accept edits` join `bypass permissions`, so a session in auto-accept
+mode no longer depends on the prompt glyph being visible.
+
+**Second defect, found by the operator: a startup question read as ready.** Claude Code paints the
+same `❯` on a menu's focused option that it uses for the input box. This is strictly worse than the
+banner — text typed at a banner is lost, but Enter at a menu SELECTS AN OPTION, so an arriving
+message can answer a permission question on the operator's behalf. A focused menu is now its own
+state, never ready.
+
+**The verdict is no longer a boolean.** Three consumers ask this question and one of them KILLS a
+live session when the answer is not-ready. "Still painting" and "waiting on an answer" want opposite
+responses from it, so the probe now names which state it saw and each caller applies its own policy;
+the destructive caller leaves a menu alone, waits a bounded moment for the always-on auto-resolver to
+clear it, and only then treats the session as stuck.
+
+Classification moved into a small pure module so the incident's literal pane text is a
+regression fixture rather than a paraphrase.
+
+## What to Tell Your User
+
+If you ever messaged me, watched a session start, and then saw it sit there doing nothing with
+your message apparently lost — this was one way that happened. I was deciding I was awake by
+looking for certain command names on screen, and my own startup banner mentions those command
+names while advertising a feature. So I read "still starting up" as "ready", typed your message
+into a screen that was still drawing itself, and recorded it as delivered.
+
+There is a second case, sharper than the first. Sessions sometimes start by asking a question,
+and the marker drawn beside the selected answer is the same one drawn for the input box. So a
+session waiting on a question also read as ready. At a banner, a message typed too early is
+simply lost. At a question it is not lost — pressing Enter picks an answer, so an arriving
+message could have answered a permission question on your behalf. That can no longer happen.
+
+I now wait for the actual input box, or for a footer that only exists once the app is running,
+and I treat a question on screen as somewhere not to type.
+
+One honest limit: this makes typing too early far less likely, but I still report a message as
+delivered on the basis of having typed it, not on the basis of it appearing. Confirming that
+typed text actually arrived is a separate change, recorded and not bundled here.
+
+## Summary of New Capabilities
+
+- A pane showing only a startup banner is no longer classified as ready for input, so a message
+  is not injected before the session can receive it.
+- A focused selection menu is recognised as its own state and is never ready, so an arriving
+  message cannot select an option in a question meant for the operator.
+- Slash-command mentions no longer count as a readiness signal in any form — the discrimination
+  moved to markers that only exist once the TUI is running.
+- All three permission-mode footers are recognised (`bypass permissions`, `? for shortcuts`,
+  `auto-accept edits`, `shift+tab to cycle`), where previously only one was — so a session in
+  auto-accept mode no longer depends on the prompt glyph being visible.
+- The readiness verdict names which state it saw rather than answering yes/no, so the caller that
+  kills a stuck session no longer kills one that is merely waiting on a question.
+- The readiness decision is a pure, separately-testable function, so the pane text from a real
+  incident is carried as a regression fixture instead of being described.
+
+## Evidence
+
+**Reproduction (before),** real pane text against the pre-fix clause:
+
+| input | pre-fix verdict | correct verdict |
+|---|---|---|
+| the 2026-07-26 boot banner (contains `Run /model and`) | `ready` | not ready |
+| `Do you want to proceed?` + `❯ 1. Yes` / `2. No` | `ready` | menu (never ready) |
+| `Do you trust the files in this folder?` + two options | `ready` | menu (never ready) |
+| `Run /fast to enable faster output on this plan.` | `ready` | not ready |
+
+**Also falsified — the intermediate "status-bar shape" attempt,** kept here because it is the
+reason the clause was deleted rather than narrowed:
+
+| input | "shape" verdict | correct verdict |
+|---|---|---|
+| `⚠ Fable 5 promotional access ends soon · /model to opt in` | `ready` | not ready |
+| `  · /model to switch between Opus and Fable` | `ready` | not ready |
+| soft-wrapped banner putting `/model` at column 0 | `ready` | not ready |
+| `opus 5 • medium • /effort` (bullet separator) | not ready | ready |
+
+**Observed after:**
+
+| input | before | after |
+|---|---|---|
+| the 2026-07-26 boot banner | ready | **not ready** |
+| any prose or interpunct mention of `/model`, `/fast`, `/effort` | ready | **not ready** |
+| a focused startup question (3 real shapes) | ready | **menu — never typed into** |
+| ordinary output listing `1.` / `2.` above the input box | ready | ready (not mistaken for a menu) |
+| a single numbered line beside the prompt | ready | ready |
+| drawn input box (`❯`) / codex prompt (`›`) | ready | ready |
+| `⏵⏵ bypass permissions on` | ready | ready |
+| `? for shortcuts` / `auto-accept edits` / `shift+tab to cycle` | **not ready** | **ready** (newly recognised) |
+| banner that has since grown an input box | ready | ready |
+| empty / whitespace pane | not ready | not ready |
+
+**Both guards refuse.** Restoring the old slash-command clause fails six assertions; removing the
+menu classification fails three. Both include the discrimination guard, whose only job is to prove
+the probe still tells its three verdicts apart:
+
+```
+# restoring the slash-command clause
+× REGRESSION: the 2026-07-26 startup banner does NOT read as ready
+× REGRESSION: a banner line in interpunct "status-bar shape" does NOT read as ready
+× REGRESSION: a soft-wrapped banner putting /model at line start does NOT read as ready
+× an agent echoing a slash command in its own output does NOT read as ready
+× the probe discriminates > produces all three verdicts and is not stuck on one
+Tests  6 failed | 12 passed (18)
+
+# removing the menu classification
+× REGRESSION: a startup question does NOT read as ready
+× a menu is not ready to be typed into
+× the probe discriminates > produces all three verdicts and is not stuck on one
+Tests  3 failed | 15 passed (18)
+```
+
+**Scope run:** `npx tsc --noEmit` clean; every tree-scanning test under `tests/unit` plus every
+test that mocks `capture-pane` (the fixtures that feed this probe) — counts in the PR body.

package/upgrades/side-effects/booting-pane-read-as-ready.md

@@ -0,0 +1,222 @@
+# Side-Effects Review — a startup banner, and a startup menu, were read as an input prompt
+
+**Version / slug:** `booting-pane-read-as-ready`
+**Date:** `2026-07-26`
+**Author:** `Echo (instar-dev agent)`
+**Second-pass reviewer:** `independent reviewer subagent — VERDICT: CONCERN. Design changed in response; see Phase 5.`
+
+## Summary of the change
+
+`SessionManager.detectClaudePrompt` decided a pane was accepting input if the last
+six non-blank lines contained `❯`, `›`, `bypass permissions`, `/(effort|model|fast)`,
+or `(low|medium|high) · /effort`. Two independent defects:
+
+**1 — the banner.** The slash-command clause matched a bare mention **anywhere, in
+any context, including prose**. Claude Code's startup banner advertises slash
+commands in prose; the incident pane carried:
+
+> `…Fable 5 draws down usage faster than Opus 4.8. Run /model and`
+> `select Fable to use it. Learn more: https://support.claude.com/…`
+
+**2 — the menu (found by the operator).** Claude Code paints the **same `❯`** on a
+menu's focused option that it uses for the input box. A session sitting on a
+startup question therefore read as READY. This is strictly worse: text typed at a
+banner is lost, but **Enter at a menu SELECTS AN OPTION**, so an arriving message
+can answer a permission question on the operator's behalf.
+
+**Observed (topic 29723, 2026-07-26).** Inbound `17:44:49Z` → respawn → pointer
+injected `17:45:00Z` → that session's start hook completed `17:45:15Z`. The paste
+landed 15s early, was swallowed by the redraw, and the injector logged
+`Injected initial message into "…" (915 chars, after stabilization delay)` — a
+success line for a delivery that did not happen. The message reached the agent only
+via the start hook's unanswered-message backstop, an unrelated path.
+
+**The slash-command clauses are DELETED, not tuned.** The first attempt kept them
+and required "status-bar shape" (line-start or post-interpunct). Second-pass review
+falsified that, and I verified each claim before accepting it:
+
+| falsifying input | verdict under the "shape" fix |
+|---|---|
+| `⚠ Fable 5 promotional access ends soon · /model to opt in` | `ready` (false positive) |
+| `  · /model to switch between Opus and Fable` | `ready` (false positive) |
+| soft-wrapped banner putting `/model` at column 0 | `ready` (false positive) |
+| `opus 5 • medium • /effort` (bullet separator) | not ready (false negative) |
+
+The artifact's own fixture contains `· /memory to free up context` and
+`+1 more · /status` — **banner** lines in the exact shape it claimed prose never
+uses. So discrimination was still vocabulary wearing structure's clothes, and the
+line-start branch reinstated the Anthropic-copy dependency it claimed to remove
+(at a fixed pane width, a copy edit shifting the wrap ~14 chars recreates the
+original defect). A signal that cannot separate an *advert for* a command from a
+*status bar showing* one carries no readiness information. Deleted, and the
+genuinely structural markers widened instead.
+
+**The answer is no longer a boolean.** See §1 — one of three consumers KILLS a live
+session on not-ready. `classifyPaneReadiness` returns `ready | menu | not-ready`;
+`isReadyPromptTail` is retained as the façade for callers that only want "can I
+type now".
+
+## Decision-point inventory
+
+| point | classification | note |
+|---|---|---|
+| `❯` / `›` present (and not on an option line) → ready | `invariant` | Deterministic substring test. |
+| permission-mode / shortcut footer present → ready | `invariant` | Widened from one marker to four, sourced from the probes already trusted for this (`SessionReaper`, interactive-pool config) rather than invented here. |
+| selector glyph ON a numbered option line + ≥2 options → menu | `invariant` | Deterministic shape test, mirroring `PermissionPromptAutoResolver`'s existing definition rather than a second divergent one. |
+| slash-command mention → ready | **REMOVED** | Could not distinguish advert from status bar in any formulation tried. |
+| consent-dialog auto-accept | `invariant` | Unchanged, and deliberately left in `SessionManager` — it has a side effect (`send-keys`), so it does not belong in a pure classifier. Verified still running BEFORE the classifier and over all 20 captured lines. |
+
+No judgment points. No model call.
+
+## 1. Over-block
+
+**The risk is not uniform across callers, and the first draft of this section was
+wrong about that.** There are three consumers:
+
+1. `waitForClaudeReadyWithRetry` → `handleReadyAndInject` (spawn/inject). Failure
+   direction: waits, then the pre-existing extended-wait and blind-inject-if-alive
+   fallbacks apply. Safe.
+2. `waitForClaudeReady` direct, in the Slack stuck-session path (`server.ts:8395`).
+   **Failure direction: it KILLS the live session and respawns.** A tightened probe
+   that false-negatives here destroys a live conversation. `docs/signal-vs-authority.md`
+   names session lifecycle as explicitly high-risk.
+3. `classifyPaneState` (new), used by (2) to tell `menu` from `not-ready`.
+
+**Mitigations, both required by the above:**
+- The positive marker set was **widened**, not just narrowed: `? for shortcuts`,
+  `shift+tab to cycle`, `auto-accept edits` join `bypass permissions`. Previously
+  only one of Claude Code's three permission-mode footers was recognised, so a
+  session in auto-accept mode depended entirely on `❯` being visible. That
+  assumption is no longer load-bearing. All four are asserted absent from the
+  banner fixture, so the widening costs no false positives.
+- The Slack path no longer kills on `menu`. It gives the always-on auto-resolver a
+  bounded second window and re-checks; a menu that never clears falls through to
+  the pre-existing stuck path, so no message is lost.
+
+**Residual, stated honestly:** a status bar using a separator other than U+00B7 (`•`,
+box-drawing) and showing none of the four footers and no `❯` would now wait. I have
+not enumerated every Claude Code rendering across widths and themes. On caller (1)
+that costs a delay; on caller (2) the menu carve-out plus the widened footers are
+what keep it from costing a session.
+
+## 2. Under-block
+
+**Injection still reports success on having TYPED, not on arrival.**
+`verifyInjection` recovers a swallowed *submit*, not a swallowed *paste*. A pane
+that becomes ready and then stalls mid-paste still produces a success log for a lost
+message. Deliberately **not bundled** — it changes the injector's success criterion
+at every inject callsite, and folding it in would make this PR's refusal evidence
+ambiguous. Recorded as a candidate, not silently deferred.
+
+Also untouched: the probe reads the last 6 of 20 captured non-blank lines. A banner
+longer than that window pushing a real prompt out of view still reads not-ready.
+Unchanged behaviour; fails toward waiting on callers (1) and (3).
+
+The menu detector requires ≥2 numbered options. A single-option prompt, or a
+free-text startup question with no numbered options, is not detected as a menu.
+
+## 3. Level-of-abstraction fit
+
+One pure function, no state, no I/O, below `SessionManager`. The consent-dialog
+branch stayed behind because it presses keys — a classifier that mutates the pane is
+not a classifier.
+
+**A smarter component already exists and was consulted rather than duplicated.**
+`PermissionPromptAutoResolver` owns approval-prompt handling (matching, auto-answer,
+audit). This probe deliberately reuses its notion of a menu (selector glyph on a
+numbered option line) instead of inventing a second one, and does not attempt to
+answer prompts — it only declines to call a menu an input surface.
+
+Callers of the removed clause: exactly one, verified independently by grep. No
+duplicate site left holding the old semantics.
+
+## 4. Signal vs authority compliance
+
+**The first draft's answer here was materially incomplete and is corrected.** It
+claimed the probe "cannot block a message, refuse an action, or reach a user". False
+via §1(2): a not-ready verdict at `server.ts` refuses an action and kills a session.
+
+The *principle* is not violated — `docs/signal-vs-authority.md` scopes it to
+brittle logic making judgments about **meaning**, and exempts deterministic
+invariants. This is mechanics (is a glyph on screen), not meaning. But the honest
+statement is: **this probe feeds a destructive authority**, which is exactly why the
+verdict was widened from a boolean to a named state, so that authority can
+distinguish "wedged" from "waiting on an answer" instead of treating both as kill.
+
+## 4b. Judgment-point check (Judgment Within Floors standard)
+
+No judgment points introduced. The change moves *away* from a vocabulary match whose
+behaviour drifts as Anthropic edits its banner copy, toward structural markers. Note
+the correction to the first draft: the intermediate "status-bar shape" design did
+**not** achieve that and claimed it anyway — the claim is retracted above rather
+than quietly restated.
+
+## 5. Interactions
+
+- **`waitForClaudeReadyWithRetry` / `handleReadyAndInject`** — unchanged; both now
+  consult the corrected probe. A pane that used to pass early on the banner now
+  passes on the input box instead: later, and correctly.
+- **`server.ts` Slack stuck-session path** — changed, see §1.
+- **`PermissionPromptAutoResolver`** — complementary, not shadowed. It clears
+  prompts; this declines to type at them. The Slack carve-out explicitly depends on
+  it running (it is an always-on floor with no enable flag).
+- **`StuckInputSentinel`, `SessionWatchdog`, `PromptGate`, `PresenceProxy`,
+  `SessionReaper`, `TriageOrchestrator`, `anthropic-interactive-pool`** — each keeps
+  its own independent markers for its own question ("is it stuck?", "is it idle?").
+  None imports `detectClaudePrompt`; none carried the removed clause. Their marker
+  vocabulary is now the *source* for this probe's footers rather than a fourth
+  divergent set.
+- **`ModelSwapService`** injects literal `/model <id>` into live panes — a real
+  in-pane source of the removed token. Another reason the clause had to go.
+- **Codex / Gemini / pi panes** — the `›` clause is unchanged; they do not print the
+  Claude banner.
+
+## 6. External surfaces
+
+None. No route, no config key, no CLI flag, no message text, no state file. Two new
+exported functions and one new public method on `SessionManager`, all internal.
+
+## 6b. Operator-surface quality
+
+One new log line when the Slack path declines to kill a session on a menu, naming
+the session and the reason. The pre-existing failure lines are unchanged.
+
+Worth recording for the follow-up: the *success* line still reports typing, not
+arrival — the asymmetry that hid this incident for seven hours is untouched here.
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+
+Machine-local by construction — the probe reads a tmux pane on the machine that owns
+it. No replication, no lease interaction, no shared state, no generated URL. Two
+machines on different versions apply their own probe to their own panes; there is no
+cross-machine invariant to violate.
+
+## 8. Rollback cost
+
+Low. Delete the module, restore the inline clauses, revert one `server.ts` block. No
+migration, no persisted state, no config default, nothing written to an agent home.
+The test file would fail on revert, which is the desired property.
+
+## Phase 5 — Second-pass review (independent reviewer subagent)
+
+**VERDICT: CONCERN** — one blocking, four should-fix, one note. Every finding was
+independently verified before being accepted; all were real.
+
+| # | finding | disposition |
+|---|---|---|
+| 1 (blocking) | Unenumerated third consumer at `server.ts:8395` kills a live session on not-ready, so §1's "the failure direction is waiting, which is safe" and §4's "cannot refuse an action" are false for it. | **Design changed.** Verdict widened to `ready \| menu \| not-ready`; Slack path given a menu carve-out + bounded re-check; §1 and §4 rewritten. |
+| 2 (should-fix) | The `^` line-start branch reinstates the Anthropic-copy dependency via wrap geometry, and carries no test weight. | **Clause deleted entirely** (both branches). |
+| 3 (should-fix) | "Shape, not vocabulary" is falsified by the artifact's own fixture; `· /model to opt in` matches. | **Verified and accepted.** Clause deleted; the claim is retracted in §4b rather than restated. |
+| 4 (should-fix) | "A ready pane always shows `❯`" is contradicted by four sibling probes; only one of three permission-mode footers was covered. | **Marker set widened** to four footers, sourced from those siblings. This is also the mitigation for #1. |
+| 5 (should-fix) | §4 Q4 materially incomplete. | **Rewritten** above. |
+| 6 (note) | Interpunct is U+00B7 only; `•` and box-drawing are false negatives. `ModelSwapService` injects `/model` into live panes. | Moot for the separator (clause deleted); the `ModelSwapService` point is recorded in §5 as further justification. |
+
+**Independently found by the operator, in parallel:** the menu case (§ Summary 2).
+Verified against three realistic startup questions, all three of which read as ready
+before this change.
+
+**Reviewer concurrence on the revised design was not re-sought.** The revision was
+driven by the reviewer's own findings plus a verified operator report, and every
+change is pinned by a test asserting both sides of its boundary. That is a
+disclosed reduction in independence for the second iteration, not a claim of
+concurrence.