stack/docs/plans/reviews/2026-09-07_tmux-r2-verdict.md

Tmux r2 — independent verdict: NOT APPROVED

Reviewer: filbert. Author/coordinator: darkwing. Date: 2026-09-07. Authority: 2026-09-07_tmux-r2-review-request.md. No competing assignment is known; I did not author or modify the candidate.

The export remained stable and the supplied executed suites pass. However, baseline/new-message correlation still permits false-positive confirmation when the actual draft is retained behind a prompt/footer lookalike. This was reproduced on real, reviewer-owned scratch tmux panes in both locales, including the wrapper. The no-automatic-extra-Enter change is independently supported and should be retained.

1. Exact reviewed candidate

Only the immutable export and its disposable copy were reviewed: docs/plans/reviews/2026-09-07_tmux-r2-export/. SHA-256 of its SHA256SUMS: 12f498a6e32bc3fe55a2c4707e8ce612e1c7e0801652619a78734e05bfce3244.

File under export tools/tmux/	SHA-256
agent-send.sh	9a1edcafa2b6c575a6afb7fa4b4714b994f8abe2d33a852810ae897b5aca0eb6
agent-send.test.sh	1916b48df4c0924d4d99892904ff8fef2bed50723ff7d3b0cd4accdd9b903cda
README.md	86dfbb34321957d025d85441641d272267ecf13604ce22b13968d9561d4a14f8
send-message.sh	76e17e9e777e95e042f90eee95312f06031c3b66e3c4f56e30f02527fe3737cb
test-agent-send-socket-live.sh	ab2b8fd4f8b3e800f887c5552f935178e032582a449e8f1296aadf567498d607
test-send-message-socket.sh	9831d6dbfb8bc87b9dd2cf56cdda57ebef255991c344a767c915b3d2fea070f2
test-send-message-verdict.sh	43bd569e32f788e95efb7c9a08b6bdaa937364f71a422a4583ebe3b9d6355f6b

All seven hashes passed before admission, after copying, and after execution in both export and copy; final recheck 2026-09-07T20:02:28Z. No mutable working-tree source was substituted. The earlier rejection remains untouched.

Disposable copy: /tmp/filbert-tmux-r2.0tfori1a. Evidence: its evidence/ directory. Script copies were made executable; bytes were unchanged. The export itself was neither edited nor chmodded.

2. Findings

F1 — BLOCKING / high: new visibility does not identify the current cleared editor

Locations: send-message.sh:139–174 (locate_input_box), particularly the final prompt test at 143–145 and footer heuristic at 164–169; confirmation at 228–231; exit-0 message at 242. agent-send.sh propagates this verdict.

The baseline proves only that the normalized body was absent from the earlier capture. The next capture can contain a draft preview, while the selected empty-looking region is transcript decoration rather than the current editor. Neither newly visible text nor the path/branch-shaped footer establishes the missing editor identity. The final-glyph branch has the same problem without needing rules.

Independent real-tmux reproduction

A small raw-TTY synthetic REPL supports bracketed paste and records: pending, accepted, and submit_keys in a separate fixture-state file. It has an honest accepting mode, a visible retained-draft mode, and hidden-editor modes. Hidden modes retain the complete pasted message after the initial Enter; they do not accept it. They render a preview above either:

Draft preview (NOT submitted): <complete message>
────────

────────
~/fixture (main)

or a final > transcript decoration line. The baseline contains no message and no such editor-looking region. This is a hostile synthetic layout, not a claim that a particular live application currently renders it.

Actual results in both LC_ALL=C and LC_ALL=C.UTF-8:

Fixture	Actual receipt	Independently recorded state
Honest accepting REPL	exit 0, delivered	accepted count 1; pending empty
Visible retained draft	exit 2, draft	accepted count 0; body retained
Hidden draft + rule/footer lookalike	exit 0, delivered	accepted count 0; entire body retained
Hidden draft + final glyph lookalike	exit 0, delivered	accepted count 0; entire body retained
Wrapper into hidden rule/footer fixture	exit 0, delivered	accepted count 0; entire prefixed body retained

That is six false-positive confirmations and four honest controls. Every run received exactly one submission key, even with -r 100. Unicode bodies were preserved. This is not merely absence of a model acknowledgement: the fixture positively records the uncleared draft, and the apparent cleared region is not its editor. The “not ACK” qualification does not establish a current editor boundary.

The supplied transition stub covers static/repeated/new text with the same assumed editor shape; its successful new-transition case does not distinguish this retained- draft counterexample. Those passing fixtures therefore cannot close the rule-pair or hidden-editor audit.

Required disposition: leave such observations unconfirmed unless the supported runtime boundary supplies sufficient current-editor/message correlation. Do not restore extra Enter events to compensate. Add hostile retained-draft controls with independent state/key-count evidence and honest accepting controls. If the intended result is only “text appeared near a lookalike,” that is a different, weaker contract requiring explicit owner reconciliation—not a successful fix by relabeling.

F2 — BLOCKING / medium: source/help/test evidence contradicts the revised contract

Exact contradictions in this export:

• send-message.sh:12–13: another Enter is recommended and double-Enter called safe; revised behavior sends no automatic extra Enter.
• send-message.sh:39, 176–186 and 226–227: queued-banner/flush/suffix success descriptions remain, despite the actual banner refusal and whole-body predicate.
• send-message.sh:128–130: the last rule pair is described as making detection safe; F1 demonstrates the missing boundary.
• send-message.sh:170–171: adjacent rules are described as a successful empty range, directly after code that now rejects them.
• agent-send.sh:23 still advertises Enter-flush behavior; README.md:50 still describes -r N as Enter-flush attempts, contradicting its later compatibility text.
• test-send-message-verdict.sh:21 and 142–144 describe the synthetic trailing em-dash fixture as measured live redraw behavior, contradicting the request's explicit correction. Its introductory “three” fixtures and flush-related comments are stale as well.

Required correction: make help, comments, README and fixture claims consistently state the chosen observation limit, no automatic extra keys, unconfirmed queued banners, and the exact qualified success predicate. Keep synthetic fixtures labeled synthetic; do not restore unsupported live-root-cause claims. Preserve prior records and record corrections honestly.

F3 — NONBLOCKING test-isolation gap: named-socket suite writes shared /tmp paths

test-send-message-socket.sh:76,85 redirect to fixed /tmp/send-message-named.out and /tmp/agent-send-named.out, outside its private scratch roots. Concurrent runs can overwrite each other's files; those paths can also already belong to another task. I did not run this suite under an isolated-only authorization and did not patch it to manufacture a passing receipt. Use per-run output paths in the maintained test. Its coordinator PASS is not an independent rerun here. The separate socket-contract suite was independently run.

3. Verified improvements and remaining limits

• Grouped UTF-8 rules and retained Unicode/wrapped-message controls pass in the supplied verdict suite under C and C.UTF-8. Unicode is no longer filtered away.
• Baseline and post-submission capture failures refuse, including failure with success-looking stdout; post-capture failure sends no additional key.
• Load/paste/submission-key failures refuse at the appropriate stage.
• Adjacent rules and unsupported-footer/history controls refuse in supplied tests.
• Repeated body already in baseline remains unconfirmed even with an empty-looking editor. This is conservative behavior, not a receipt for a second identical send.
• Queued banners alone remain unconfirmed; retained wrapped Unicode stays a draft.
• No automatic extra submission key occurred in the independent retained/hidden/ accepted/fault controls. That fixes the prior flush-safety concern, but not F1.
• Wrapper address/triage and scratch socket-selection controls pass within their tested scope. No remote-host delivery, deployment or live-seat acceptance was tested.

4. Actual commands and receipts

Versions: tmux 3.7c, GNU bash 5.3.15(1)-release. All source/test commands were read before execution. Test environments used env -i semantics (explicit environment dictionaries), PATH /usr/bin:/bin, synthetic HOME, TMPDIR and TMUX_TMPDIR beneath the disposable root, with no inherited TMUX/TMUX_PANE or Mosaic socket identity. Only reviewer-created sockets/panes were used. Scratch socket-contract SSH operations use the test's capture stub, never a remote connection.

Command/test from disposable copy	Actual result
bash -n on all six shell files	exit 0
bash tools/tmux/agent-send.test.sh, LC_ALL=C	exit 0; 19/0
bash tools/tmux/test-send-message-verdict.sh, LC_ALL=C	exit 0; 20/0
Same verdict suite, LC_ALL=C.UTF-8	exit 0; 20/0
bash tools/tmux/test-agent-send-socket-live.sh, LC_ALL=C	exit 0; C1–C6 and effective sabotage controls pass; only private scratch fixtures
python3 evidence/hostile-real.py	exit 0 verifies the six false positives and four controls described in F1; not a candidate PASS
python3 evidence/fault-probes.py	exit 0; nine independent stub-transport controls pass
bash tools/tmux/test-send-message-socket.sh	NOT RUN, fixed shared output paths (F3)

Independent fault controls cover: positive transition; repeated baseline body; post-capture failure; baseline failure; load failure; both paste attempts failing; submission-key failure; retained wrapped Unicode; and queued banner. Stub logs assert zero or one submit-key call as appropriate, with -r 999. No actual socket is used by that additional fault harness.

All seven candidate byte hashes still match in the export and disposable copy. No remaining responding servers were found in the reviewer-owned socket directory; suite-owned scratch servers were cleaned up by their traps. No private pane, default user server or live seat was inspected or mutated.

Selected evidence hashes, relative to /tmp/filbert-tmux-r2.0tfori1a/evidence/:

Artifact	SHA-256
suite-results.json	878348c276ceabf8e454d31ec0f71ff569cc46a1210dedc6b9185aaaf6ca8076
verdict-C.log and verdict-UTF8.log (identical)	8a775338f565016d2ca5610386a0928822115426632d1be5ab97b8b7eee9a720
wrapper.log	2df46e6e4285d1955ce93f1b3a51396ea23facb38b3cabea1e53d3dae8d34017
socket-contract.log	3d794abd5ea59ff4b476f0614a186799141e6863f9fa98f6775d6fb6ad31119c
editor-fixture.py	4761eed8f12755380be751304f227e1d3e129e7069dab1e7c5e674c9b77fece0
hostile-real.py	55e3cf501c44d9041bed4bae360da552ac1360a4eaff8fb343c5e317ab996ebe
hostile-receipts.json	c463b5c013436a622a46672dfdc7620d31bf55b4b34c897669fbd55a8ab6ee1b
fault-receipts.json	1fad321c1f862a8f549f713596f2d96bc3a23c9a0641b564d6d2ff692d356592
case2.state.json	7d86d133a14a50cdeba668b5048f24e9627181044a26d6551f37b2f4cb8a766a
case2.pane.txt	c1b44e938f2cdd7a8cc1d23a77e77eb0deb1e91b5c7389271b07e560fbee15ca

Scratch receipts are local/disposable, not durable publication. The described fixture and saved harness permit reproduction without a live agent.

5. Return

NOT APPROVED at this exact r2 export. Candidate stability is resolved; the confirmation-soundness audit is not. Return F1–F3 to darkwing for reconciliation and a newly frozen revision. No code fixes, export edits, dependency installs, private inspection, live sends, deployment, commits or push occurred. This verdict is the only repository write. No automatic resend, acceptance, timer or subsequent action is inferred.