stack/docs/plans/reviews/2026-09-07_tmux-r3-verdict.md

Tmux R3 — independent verdict: NOT APPROVED

Reviewer: filbert. Author/coordinator: darkwing. Date: 2026-09-07. Authority: 2026-09-07_tmux-r3-review-request.md. No competing assignment is known. I did not author or modify the implementation.

The R2 confirmation-soundness blocker remains. R3 adds useful, tested reason diagnostics and corrects several claims, but its success predicate still reports success for a retained hidden draft behind a prompt/footer lookalike. Six independent real-scratch-pane counterexamples reproduce, including the wrapper, in both locales. A successful coordinator live send cannot establish that these negatives are safe.

1. Exact candidate and stable admission

Reviewed only the frozen docs/plans/reviews/2026-09-07_tmux-r3-export/ and its verified disposable copy. SHA-256 of export SHA256SUMS: 12e30fde5f8a6d35e01f6125e4963792d97f08172291e97b859999a47392d1d9.

File under export tools/tmux/	SHA-256
agent-send.sh	d59b60d601a9076e152830ee769772f7b099aada0d194b6e3844f5fbdcd7f5d0
agent-send.test.sh	1916b48df4c0924d4d99892904ff8fef2bed50723ff7d3b0cd4accdd9b903cda
README.md	86dfbb34321957d025d85441641d272267ecf13604ce22b13968d9561d4a14f8
send-message.sh	0efe48969dd52db634b46c99410070811d3be78e2a33a373ab8f1bef128b2703
test-agent-send-socket-live.sh	ab2b8fd4f8b3e800f887c5552f935178e032582a449e8f1296aadf567498d607
test-send-message-socket.sh	9831d6dbfb8bc87b9dd2cf56cdda57ebef255991c344a767c915b3d2fea070f2
test-send-message-verdict.sh	a286cfb1c3bfa4a5a762250f0dbfb66b2b405b4602e739129b201a65e8c189d9

All seven hashes match before copying/execution and afterwards in both export and copy. Final recheck: 2026-09-07T20:15:16Z. Mutable working-tree source was not used. Earlier exports and verdicts remain untouched.

Disposable root: /tmp/filbert-tmux-r3.4cyawppa; evidence is under evidence/. Only disposable script permissions were made executable; candidate bytes and export permissions were preserved. Source/test changes were inspected before execution.

2. Findings and prior dispositions

F1 — BLOCKING / high, unchanged: newly visible text is not a cleared current editor

Locations: send-message.sh:139–174, especially final-glyph acceptance at 143–145 and rule/footer recognition at 164–169; success predicate at 217–222 and exit 0 at 238. The wrapper propagates that status.

R3 still checks that the normalized complete message was absent from the baseline, is present somewhere in the new capture, and is absent from a region selected by visual resemblance. It does not establish that this region is the current editor. A newly displayed draft preview satisfies the first two conditions while a transcript prompt or footer satisfies the third. Reason diagnostics affect unconfirmed cases; they do not prevent this erroneous success path.

I reran the independent raw-TTY scratch REPL from R2. It handles bracketed paste and records pending, accepted, and submit_keys separately from the display. Hidden modes retain the complete body after Enter and render its preview above either:

Draft preview (NOT submitted): <complete body>
────────

────────
~/fixture (main)

or a final > transcript decoration line. The baseline contains neither the message nor that editor-looking region. These are intentionally hostile synthetic layouts, not claims about an observed live application's rendering.

Actual results, independently repeated under LC_ALL=C and LC_ALL=C.UTF-8:

Mode	Tool outcome	Recorded application state
Honest acceptance control	exit 0	accepted count 1, pending empty
Visible retained-draft control	exit 2 / draft	accepted count 0, entire body retained
Hidden draft + rule/footer lookalike	exit 0 / delivered	accepted count 0, entire body retained
Hidden draft + final glyph lookalike	exit 0 / delivered	accepted count 0, entire body retained
Wrapper into hidden rule/footer fixture	exit 0 / delivered	accepted count 0, entire prefixed body retained

Six false positives and four honest controls. Every run receives exactly one submission key, including direct sends with -r 100. Unicode bodies survive intact. The failure is not merely lack of a model ACK: the editor remains uncleared, and the region treated as cleared is not the editor. The weaker “not ACK” qualification does not resolve that distinction.

Required disposition: retain unconfirmed status when current-editor/message binding is unsupported; preserve the one-Enter safety property. Provide a bounded, justified runtime boundary and regression controls that distinguish acceptance from previewed retained drafts, or obtain explicit reconciliation of a weaker contract. Passing positive fixtures or another successful live send is not a substitute. Do not reintroduce extra submission keys or simply relabel these counterexamples as success.

F2 — partially corrected; remaining contract/evidence wording must be reconciled

R3 correctly removes the double-Enter recommendation, dead flush counter and several queued-success/flush comments. It now labels the em-dash renderer synthetic, not a measured live cause. Those corrections are credited.

Remaining contradictions in the frozen bytes:

• send-message.sh:128–130 still says anchoring on the last rule pair is what makes it safe, notwithstanding F1 and the later heuristic qualification.
• Unchanged README.md:50 still describes -r N as Enter-flush attempts; its later contract and script help say it is compatibility-only with no extra Enter.
• test-send-message-verdict.sh:17–18 and the retained-renderer comment still describe behavior across flush Enters; the introductory “three” fixtures remains stale.

Do not claim all contradictory wording is closed. Reconcile these statements in the next authorized revision. They do not erase the independent F1 code blocker.

F3 — NONBLOCKING test-isolation gap remains

Unchanged test-send-message-socket.sh:76,85 writes fixed shared paths /tmp/send-message-named.out and /tmp/agent-send-named.out. I did not execute this suite under an isolated-only mandate or patch the test to manufacture a pass. Move these outputs under its private per-run scratch in a future revision. The separate C1–C6 scratch socket-contract suite was independently executed and passes.

3. R3 diagnostic and safety verification

Eleven additional independent fake-transport controls verified:

• Positive new-message/clear-region control: exit 0, one key.
• Repeated baseline body: exit 2, reason=message-present-in-baseline.
• Clear-looking region without new message: exit 2, reason=new-message-not-visible.
• Unrecognized editor: exit 2, reason=editor-shape-unrecognized.
• Queued banner: exit 2, reason=queued-banner-ambiguous.
• Baseline and post-send capture failures, including success-looking partial stdout: exit 2; no extra key. Baseline failure causes no submission.
• Load, paste and submission-key failures: exit 2 at the appropriate stage.
• Retained wrapped Unicode: exit 2 / draft, one key.

The four reason identifiers are fixed and do not echo the test message. Counted submit-key calls are zero or one as appropriate even with -r 999. Repeated/common content already visible in the baseline conservatively prevents confirmation; it cannot prove acceptance of a new identical send. These passing controls support the diagnostics and no-extra-Enter improvements, not F1's false-positive path.

4. Actual execution and receipts

Versions: tmux 3.7c, GNU bash 5.3.15(1)-release. Tests used explicit clean environments: PATH /usr/bin:/bin; HOME, TMPDIR and TMUX_TMPDIR beneath the disposable root; no inherited TMUX/TMUX_PANE or Mosaic socket identity. Only reviewer-created scratch panes/sockets were used. The socket-contract suite's SSH is stubbed; no remote host was contacted.

Command in disposable copy	Actual result
bash -n on all six shell files	exit 0
bash tools/tmux/agent-send.test.sh, C locale	exit 0; 19/0
bash tools/tmux/test-send-message-verdict.sh, C locale	exit 0; 20/0, including updated diagnostic assertions
Same verdict suite, C.UTF-8 locale	exit 0; 20/0
bash tools/tmux/test-agent-send-socket-live.sh, C locale	exit 0; C1–C6 and effective sabotage controls pass, private fixtures only
python3 evidence/hostile-real.py	exit 0 verifies six false positives plus four controls; not a candidate PASS
python3 evidence/fault-probes.py	exit 0; eleven independent transport/diagnostic controls pass
bash tools/tmux/test-send-message-socket.sh	NOT RUN, shared output paths (F3)

No remaining responding servers were found in the reviewer-owned socket directory; suite-created scratch servers were cleaned up by their traps. Candidate hashes remain unchanged. No private pane/default user server/live seat was inspected or mutated.

The request's coordinator live ms-test success is not my independent live measurement. I performed no live verification, inspected no private pane and did not treat that receipt as proof against the demonstrated negatives. Earlier failed live receipts are not upgraded. Ten seconds remains a chosen observation budget, not a proved rendering guarantee.

Evidence hashes, relative to /tmp/filbert-tmux-r3.4cyawppa/evidence/:

Artifact	SHA-256
suite-results.json	878348c276ceabf8e454d31ec0f71ff569cc46a1210dedc6b9185aaaf6ca8076
wrapper.log	2df46e6e4285d1955ce93f1b3a51396ea23facb38b3cabea1e53d3dae8d34017
verdict-C.log and verdict-UTF8.log (identical)	69c3819b6fa362684e4b401c0a6aa9cce95f599451e42343d41f9c4965808abd
socket-contract.log	3d794abd5ea59ff4b476f0614a186799141e6863f9fa98f6775d6fb6ad31119c
editor-fixture.py	4761eed8f12755380be751304f227e1d3e129e7069dab1e7c5e674c9b77fece0
hostile-real.py	08e95356ae96fffe2d64e27005ef103642fe03eeec0f9c50f630beb04d6e6ac2
hostile-receipts.json	c463b5c013436a622a46672dfdc7620d31bf55b4b34c897669fbd55a8ab6ee1b
fault-receipts.json	52a79d7a2eb62da3563bab4edb357b681de129745d26027f29229d9dec3fe738

Equal R2/R3 hostile receipt hashes reflect identical measured outcomes, not reuse instead of execution: the harness was rerun against the newly verified R3 copy. Scratch is local/disposable evidence; no durable publication is claimed.

5. Return

NOT APPROVED at the exact R3 export. Stable admission and reason diagnostics are verified improvements. Confirmation soundness remains unresolved. Return the findings to darkwing for substantive reconciliation and a newly frozen candidate. No source/export edits, dependency installs, live sends, deployment, commits or push occurred. This verdict is the only repository write. No automatic acceptance, resend, timer, commit/push readiness or subsequent action is inferred.