# Tmux R3 — independent verdict: NOT APPROVED

Reviewer: filbert. Author/coordinator: darkwing. Date: 2026-09-07.
Authority: `2026-09-07_tmux-r3-review-request.md`.
No competing assignment is known. I did not author or modify the implementation.

**The R2 confirmation-soundness blocker remains.** R3 adds useful, tested reason
diagnostics and corrects several claims, but its success predicate still reports
success for a retained hidden draft behind a prompt/footer lookalike. Six independent
real-scratch-pane counterexamples reproduce, including the wrapper, in both locales.
A successful coordinator live send cannot establish that these negatives are safe.

## 1. Exact candidate and stable admission

Reviewed only the frozen `docs/plans/reviews/2026-09-07_tmux-r3-export/` and its
verified disposable copy. SHA-256 of export `SHA256SUMS`:
`12e30fde5f8a6d35e01f6125e4963792d97f08172291e97b859999a47392d1d9`.

| File under export `tools/tmux/` | SHA-256 |
|---|---|
| `agent-send.sh` | `d59b60d601a9076e152830ee769772f7b099aada0d194b6e3844f5fbdcd7f5d0` |
| `agent-send.test.sh` | `1916b48df4c0924d4d99892904ff8fef2bed50723ff7d3b0cd4accdd9b903cda` |
| `README.md` | `86dfbb34321957d025d85441641d272267ecf13604ce22b13968d9561d4a14f8` |
| `send-message.sh` | `0efe48969dd52db634b46c99410070811d3be78e2a33a373ab8f1bef128b2703` |
| `test-agent-send-socket-live.sh` | `ab2b8fd4f8b3e800f887c5552f935178e032582a449e8f1296aadf567498d607` |
| `test-send-message-socket.sh` | `9831d6dbfb8bc87b9dd2cf56cdda57ebef255991c344a767c915b3d2fea070f2` |
| `test-send-message-verdict.sh` | `a286cfb1c3bfa4a5a762250f0dbfb66b2b405b4602e739129b201a65e8c189d9` |

All seven hashes match before copying/execution and afterwards in both export and
copy. Final recheck: **2026-09-07T20:15:16Z**. Mutable working-tree source was not
used. Earlier exports and verdicts remain untouched.

Disposable root: `/tmp/filbert-tmux-r3.4cyawppa`; evidence is under `evidence/`.
Only disposable script permissions were made executable; candidate bytes and export
permissions were preserved. Source/test changes were inspected before execution.

## 2. Findings and prior dispositions

### F1 — BLOCKING / high, unchanged: newly visible text is not a cleared current editor

Locations: `send-message.sh:139–174`, especially final-glyph acceptance at 143–145
and rule/footer recognition at 164–169; success predicate at 217–222 and exit 0 at
238. The wrapper propagates that status.

R3 still checks that the normalized complete message was absent from the baseline,
is present somewhere in the new capture, and is absent from a region selected by
visual resemblance. It does not establish that this region is the current editor.
A newly displayed draft preview satisfies the first two conditions while a transcript
prompt or footer satisfies the third. Reason diagnostics affect unconfirmed cases;
they do not prevent this erroneous success path.

I reran the independent raw-TTY scratch REPL from R2. It handles bracketed paste and
records `pending`, `accepted`, and `submit_keys` separately from the display. Hidden
modes retain the complete body after Enter and render its preview above either:

```
Draft preview (NOT submitted): <complete body>
────────

────────
~/fixture (main)
```

or a final `> transcript decoration` line. The baseline contains neither the message
nor that editor-looking region. These are intentionally hostile synthetic layouts,
not claims about an observed live application's rendering.

Actual results, independently repeated under **LC_ALL=C and LC_ALL=C.UTF-8**:

| Mode | Tool outcome | Recorded application state |
|---|---|---|
| Honest acceptance control | exit 0 | accepted count 1, pending empty |
| Visible retained-draft control | exit 2 / draft | accepted count 0, entire body retained |
| Hidden draft + rule/footer lookalike | **exit 0 / delivered** | **accepted count 0, entire body retained** |
| Hidden draft + final glyph lookalike | **exit 0 / delivered** | **accepted count 0, entire body retained** |
| Wrapper into hidden rule/footer fixture | **exit 0 / delivered** | **accepted count 0, entire prefixed body retained** |

Six false positives and four honest controls. Every run receives **exactly one**
submission key, including direct sends with `-r 100`. Unicode bodies survive intact.
The failure is not merely lack of a model ACK: the editor remains uncleared, and the
region treated as cleared is not the editor. The weaker “not ACK” qualification does
not resolve that distinction.

Required disposition: retain unconfirmed status when current-editor/message binding
is unsupported; preserve the one-Enter safety property. Provide a bounded, justified
runtime boundary and regression controls that distinguish acceptance from previewed
retained drafts, or obtain explicit reconciliation of a weaker contract. Passing
positive fixtures or another successful live send is not a substitute. Do not
reintroduce extra submission keys or simply relabel these counterexamples as success.

### F2 — partially corrected; remaining contract/evidence wording must be reconciled

R3 correctly removes the double-Enter recommendation, dead flush counter and several
queued-success/flush comments. It now labels the em-dash renderer synthetic, not a
measured live cause. Those corrections are credited.

Remaining contradictions in the frozen bytes:

- `send-message.sh:128–130` still says anchoring on the last rule pair is what makes
  it safe, notwithstanding F1 and the later heuristic qualification.
- Unchanged `README.md:50` still describes `-r N` as Enter-flush attempts; its later
  contract and script help say it is compatibility-only with no extra Enter.
- `test-send-message-verdict.sh:17–18` and the retained-renderer comment still describe
  behavior across flush Enters; the introductory “three” fixtures remains stale.

Do not claim all contradictory wording is closed. Reconcile these statements in the
next authorized revision. They do not erase the independent F1 code blocker.

### F3 — NONBLOCKING test-isolation gap remains

Unchanged `test-send-message-socket.sh:76,85` writes fixed shared paths
`/tmp/send-message-named.out` and `/tmp/agent-send-named.out`. I did not execute this
suite under an isolated-only mandate or patch the test to manufacture a pass. Move
these outputs under its private per-run scratch in a future revision. The separate
C1–C6 scratch socket-contract suite was independently executed and passes.

## 3. R3 diagnostic and safety verification

Eleven additional independent fake-transport controls verified:

- Positive new-message/clear-region control: exit 0, one key.
- Repeated baseline body: exit 2, `reason=message-present-in-baseline`.
- Clear-looking region without new message: exit 2, `reason=new-message-not-visible`.
- Unrecognized editor: exit 2, `reason=editor-shape-unrecognized`.
- Queued banner: exit 2, `reason=queued-banner-ambiguous`.
- Baseline and post-send capture failures, including success-looking partial stdout:
  exit 2; no extra key. Baseline failure causes no submission.
- Load, paste and submission-key failures: exit 2 at the appropriate stage.
- Retained wrapped Unicode: exit 2 / draft, one key.

The four reason identifiers are fixed and do not echo the test message. Counted
submit-key calls are zero or one as appropriate even with `-r 999`. Repeated/common
content already visible in the baseline conservatively prevents confirmation; it
cannot prove acceptance of a new identical send. These passing controls support the
diagnostics and no-extra-Enter improvements, **not** F1's false-positive path.

## 4. Actual execution and receipts

Versions: **tmux 3.7c**, **GNU bash 5.3.15(1)-release**.
Tests used explicit clean environments: PATH `/usr/bin:/bin`; HOME, TMPDIR and
TMUX_TMPDIR beneath the disposable root; no inherited TMUX/TMUX_PANE or Mosaic socket
identity. Only reviewer-created scratch panes/sockets were used. The socket-contract
suite's SSH is stubbed; no remote host was contacted.

| Command in disposable copy | Actual result |
|---|---|
| `bash -n` on all six shell files | exit 0 |
| `bash tools/tmux/agent-send.test.sh`, C locale | exit 0; **19/0** |
| `bash tools/tmux/test-send-message-verdict.sh`, C locale | exit 0; **20/0**, including updated diagnostic assertions |
| Same verdict suite, C.UTF-8 locale | exit 0; **20/0** |
| `bash tools/tmux/test-agent-send-socket-live.sh`, C locale | exit 0; C1–C6 and effective sabotage controls pass, private fixtures only |
| `python3 evidence/hostile-real.py` | exit 0 verifies six false positives plus four controls; **not** a candidate PASS |
| `python3 evidence/fault-probes.py` | exit 0; eleven independent transport/diagnostic controls pass |
| `bash tools/tmux/test-send-message-socket.sh` | **NOT RUN**, shared output paths (F3) |

No remaining responding servers were found in the reviewer-owned socket directory;
suite-created scratch servers were cleaned up by their traps. Candidate hashes remain
unchanged. No private pane/default user server/live seat was inspected or mutated.

The request's coordinator live ms-test success is not my independent live measurement.
I performed no live verification, inspected no private pane and did not treat that
receipt as proof against the demonstrated negatives. Earlier failed live receipts
are not upgraded. Ten seconds remains a chosen observation budget, not a proved
rendering guarantee.

Evidence hashes, relative to `/tmp/filbert-tmux-r3.4cyawppa/evidence/`:

| Artifact | SHA-256 |
|---|---|
| `suite-results.json` | `878348c276ceabf8e454d31ec0f71ff569cc46a1210dedc6b9185aaaf6ca8076` |
| `wrapper.log` | `2df46e6e4285d1955ce93f1b3a51396ea23facb38b3cabea1e53d3dae8d34017` |
| `verdict-C.log` and `verdict-UTF8.log` (identical) | `69c3819b6fa362684e4b401c0a6aa9cce95f599451e42343d41f9c4965808abd` |
| `socket-contract.log` | `3d794abd5ea59ff4b476f0614a186799141e6863f9fa98f6775d6fb6ad31119c` |
| `editor-fixture.py` | `4761eed8f12755380be751304f227e1d3e129e7069dab1e7c5e674c9b77fece0` |
| `hostile-real.py` | `08e95356ae96fffe2d64e27005ef103642fe03eeec0f9c50f630beb04d6e6ac2` |
| `hostile-receipts.json` | `c463b5c013436a622a46672dfdc7620d31bf55b4b34c897669fbd55a8ab6ee1b` |
| `fault-receipts.json` | `52a79d7a2eb62da3563bab4edb357b681de129745d26027f29229d9dec3fe738` |

Equal R2/R3 hostile receipt hashes reflect identical measured outcomes, not reuse
instead of execution: the harness was rerun against the newly verified R3 copy.
Scratch is local/disposable evidence; no durable publication is claimed.

## 5. Return

**NOT APPROVED at the exact R3 export.** Stable admission and reason diagnostics
are verified improvements. Confirmation soundness remains unresolved. Return the
findings to darkwing for substantive reconciliation and a newly frozen candidate.
No source/export edits, dependency installs, live sends, deployment, commits or push
occurred. This verdict is the only repository write. No automatic acceptance,
resend, timer, commit/push readiness or subsequent action is inferred.