BunsDev · Nov 1, 2026 · Nov 1, 2026 · Nov 1, 2026 · Nov 1, 2026 · Nov 1, 2026
diff --git a/docs/reviews/2026-10-22-cr8-acceptance-matrix.md b/docs/reviews/2026-10-22-cr8-acceptance-matrix.md
@@ -1,5 +1,7 @@
 # Code Review acceptance matrix (CR-8), 2026-10-22
 
+**Superseded for current `main`:** the [2026-11-01 matrix refresh](2026-11-01-cr8-acceptance-matrix.md) maps every control and AC to evidence on `main` `0a8c513`. This page stays as the 2026-10-22 baseline; its "not started" and "Gate A is not complete" lines describe product `0e674e7` only.
+
 **Later fixture refresh:** The [2026-10-28 journey receipt](2026-10-28-cr8-journey-refresh.md) adds real Electron R2 activity and R3 instructions interactions through the production read service with synthetic GitHub responses. It supersedes this historical snapshot's claim that those journey states are waiting for unbuilt producers. Original-reference comparison, human accessibility and the remaining integrated/live gates stay open.
 
 **Historical baseline:** This matrix records the CR-8 candidate based on product `0e674e7`. Its “not started” entries describe that snapshot. Later overview, remote-diff and unwired action-foundation implementations have separate receipts; the integration candidate must reconcile their automated evidence without claiming missing original-reference or human acceptance.

diff --git a/docs/reviews/2026-10-22-cr8-voiceover/checklist.md b/docs/reviews/2026-10-22-cr8-voiceover/checklist.md
@@ -14,7 +14,8 @@ listed at the end for their own issues' acceptance and are not part of #322 AC4.
 
 **Build:** `main` at `afec85b` (#438, the CR-3 acceptance follow-up) or later, built with `pnpm build`. On
 2026-10-30 `main` was `f51ef7e`; the automated half of this gate was re-run there
-([resume record](../2026-10-30-cr3-acceptance-resume.md)). Record the SHA you used. The automated half's first run
+([resume record](../2026-10-30-cr3-acceptance-resume.md)). On 2026-11-01 it was re-run on `0a8c513`, the seed was
+rebuilt there and its launch line opened the app ([matrix refresh](../2026-11-01-cr8-acceptance-matrix.md)). Record the SHA you used. The automated half's first run
 is in [the CR-3 acceptance record](../2026-10-28-cr3-acceptance.md).
 
 ## Setup (about 3 minutes)
@@ -28,7 +29,9 @@ node ../../docs/reviews/2026-10-22-cr8-voiceover/seed.mjs /tmp/modex-cr8-voiceov
 ```
 
 The script writes the home, the synthetic `gh` and its world (the journey's three authored PRs and one to
-review, all made up), and prints an `env … npx electron .` line. Run that line, then:
+review, all made up), and prints an `env … npx electron .` line. Since 2026-11-01 it also puts recorder `claude`
+and `codex` executables first on PATH: they log to `provider-calls.log` and exit 1, so nothing in this home reaches
+your own Claude login or a provider. Run that line, then:
 
 1. Open DevTools (View → Toggle Developer Tools) and run `localStorage.setItem("modex.codeReview", "on")`. Then reload (Command-R). This turns on the unfinished destination in a built app.
 2. Make the window about 1440×900.
@@ -44,8 +47,8 @@ review, all made up), and prints an `env … npx electron .` line. Run that line
 | A1 | Tab to the rail's **Code Review** button and press Return | The inbox opens: "Code Review", **Inbox actions**, the search field, then "Authored by me" and "Needs my review" | |
 | A2 | Tab into the list, then use Down, Up, Home and End | One Tab stop for the whole list; the arrow keys move between rows; each row shows a focus ring | |
 | A3 | Press Return on "Move holds between branches…" | The PR opens: the PR tab and the **Changes +8,912 −47** tab appear in the title bar; the header reads "Open", "lending #73" | |
-| A4 | Keep pressing Tab | Pin, Copy link, Open in GitHub, Review with Codex, Review instructions and Merge, then the title bar's PR tab, its close, Changes and its close, New tab, and the split button. **Note:** the title-bar tabs come after the header, though they are drawn above it. Record whether that order is acceptable. | |
-| A5 | On **Review with Codex**, **Review instructions**, **Merge** and **New tab**, press Return and Space | Nothing happens; each one says why it isn't available (tooltip). Focus stays put. | |
+| A4 | Keep pressing Tab | Pin, Copy link, Open in GitHub, Review with Claude, Review instructions and Merge, then the title bar's PR tab, its close, Changes and its close, New tab, and the split button. **Note:** the title-bar tabs come after the header, though they are drawn above it. Record whether that order is acceptable. | |
+| A5 | On **New tab**, press Return and Space. Then on **Review with Claude**, **Review instructions** and **Merge**, press Return | New tab does nothing and says why it isn't available (tooltip); focus stays put. The other three open their panel or popover (they have landed, #325 and #326), and Close or Escape returns focus to the button. Don't press Start or confirm anything here; those rows belong to #325 and #326 below | |
 | A6 | Tab to the split button and press Return; then Tab to the divider between the panes and press Left/Right (Shift for larger steps) | Changes opens beside the PR. The divider moves and its value changes. It stops at each pane's minimum. | |
 | A7 | Inbox actions → Return → Escape | The menu opens with **Refresh** focused; Escape closes it and returns focus to **Inbox actions** | |
 | A8 | Open the second PR, then use the title bar's Back and Forward | Each PR returns as you left it (split or not), without a loading spinner | |
@@ -60,7 +63,7 @@ review, all made up), and prints an `env … npx electron .` line. Run that line
 | --- | --- | --- | --- |
 | B1 | VO-Right from the rail into the inbox | "Pull request inbox, complementary"; "Code Review, heading level 1"; "Inbox actions, menu pop-up button"; "Search or paste a PR link, search text field"; "Authored by me, group" | |
 | B2 | VO-Right over a row | The title, then "example-org/lending #73, ada-fixture ·" and its age. A selected row adds "current". A row that may be part of a stack adds "May be part of a stack (inferred from its base branch)". | |
-| B3 | Open a PR and VO-Right through the header | "Open"; "lending #73"; while it loads, "Loading the pull request"; "Pin, toggle button"; "Copy link"; "Open in GitHub, link"; "Review with Codex, dimmed" with the reason as its description; the same for Review instructions and Merge | |
+| B3 | Open a PR and VO-Right through the header | "Open"; "lending #73"; while it loads, "Loading the pull request"; "Pin, toggle button"; "Copy link"; "Open in GitHub, link"; "Review with Claude, button"; "Review instructions"; "Merge" (record what each one says while the PR loads and after) | |
 | B4 | Activate **Copy link** | "Link copied" is announced (a polite live region) | |
 | B5 | VO-Right through the title bar's tabs | "…, tab, selected, 1 of 2" for the PR tab; "Changes, plus 8,912 minus 47, tab" (note how the totals are read); "Close Changes, button" | |
 | B6 | Move to a divider | "Resize the pull request pane, splitter" or similar, with its value; VO-Shift-Arrow or Left/Right changes it | |

diff --git a/docs/reviews/2026-10-22-cr8-voiceover/seed.mjs b/docs/reviews/2026-10-22-cr8-voiceover/seed.mjs
@@ -1,6 +1,8 @@
 // Seeds a disposable Modex home for the Code Review keyboard and VoiceOver review: the CR-8 journeys' synthetic
 // GitHub world (apps/desktop/test/fixtures/code-review-gh-world.ts, built to dist/test), a synthetic `gh` first on
 // PATH, and a throwaway gh configuration. No token is set and the person's own gh login is never read.
+// `claude` and `codex` on PATH are recorders that log their argv and exit 1, so pressing Start in Review with
+// Claude (#325) shows a failure and never reaches the person's own login or a provider.
 // Prints the command that launches the app against it.
 // Usage, from apps/desktop after `pnpm build`: node ../../docs/reviews/2026-10-22-cr8-voiceover/seed.mjs <empty directory>
 import { execFileSync } from "node:child_process";
@@ -29,6 +31,9 @@ fs.writeFileSync(path.join(home, "app", "state.json"), JSON.stringify({
   settings: { default_backend: "mock", default_mode: "chat", default_model: { codex: "", claude: "", mock: "mock" }, routing: { jev_transport: "http" } },
 }));
 fs.writeFileSync(path.join(bin, "gh"), WORLD_GH, { mode: 0o755 });
+const recorder = `#!/bin/sh\nprintf '%s %s\\n' "$(basename "$0")" "$*" >> '${path.join(root, "provider-calls.log").replace(/'/g, "'\\''")}'\nexit 1\n`;
+for (const cli of ["claude", "codex"]) fs.writeFileSync(path.join(bin, cli), recorder, { mode: 0o755 });
+fs.writeFileSync(path.join(root, "provider-calls.log"), "");
 fs.writeFileSync(path.join(root, "gh-world.json"), JSON.stringify(baseWorld()));
 fs.writeFileSync(path.join(root, "gh-calls.log"), "");
 fs.writeFileSync(path.join(config, "hosts.yml"), "github.com:\n    user: ada-fixture\n    git_protocol: https\n");

diff --git a/docs/reviews/2026-10-25-cr7-merge.md b/docs/reviews/2026-10-25-cr7-merge.md
@@ -63,7 +63,9 @@ Everything below is mock or synthetic `gh`. **No live merge was run**, and no re
 
 ## Open
 
-- A live merge against a disposable repository Val names.
+- A live merge against a disposable repository Val names (step 9 of the
+  [canary procedure](2026-11-01-cr7-live-canary.md); not run).
 - A merge queue set by classic branch protection is invisible to the rules read. GitHub refuses the direct
   merge, which shows as a refusal.
-- Decisions 2–4 (increment 3).
+- ~~Decisions 2–4 (increment 3).~~ Landed with this increment through #416 (`b3aad0d`, 2026-10-27);
+  see [2026-10-25-cr7-pr-actions.md](2026-10-25-cr7-pr-actions.md). (Corrected 2026-11-01.)
diff --git a/docs/reviews/2026-10-25-cr7-pr-actions.md b/docs/reviews/2026-10-25-cr7-pr-actions.md
@@ -72,7 +72,8 @@ Everything below is mock or synthetic `gh`. **No live action was run** on any re
 
 ## Open
 
-- A live run against a disposable repository Val names.
+- A live run against a disposable repository Val names (steps 3–8 of the
+  [canary procedure](2026-11-01-cr7-live-canary.md); not run).
 - GitHub has no precondition on a PATCH, so an edit made on GitHub in the moment between main's check and
   its PATCH would still be overwritten.
 - Reviewer requests can't be withdrawn, and team reviewers aren't offered.
diff --git a/docs/reviews/2026-10-25-cr7-write-submit.md b/docs/reviews/2026-10-25-cr7-write-submit.md
@@ -87,7 +87,10 @@ repository authorized by Val yet, and no real PR, comment or review was created.
 
 ## Open
 
-- A live write against a disposable repository Val names.
-- Merge (increment 2) and decisions 2–4 (increment 3).
+- A live write against a disposable repository Val names. The procedure is
+  [2026-11-01-cr7-live-canary.md](2026-11-01-cr7-live-canary.md); it has not run.
+- ~~Merge (increment 2) and decisions 2–4 (increment 3).~~ Both landed with this increment through #416
+  (`b3aad0d`, 2026-10-27): see [2026-10-25-cr7-merge.md](2026-10-25-cr7-merge.md) and
+  [2026-10-25-cr7-pr-actions.md](2026-10-25-cr7-pr-actions.md). (Corrected 2026-11-01.)
 - The intent marker is visible in the Markdown source of the posted text.
 - A read-back matches a review's body, author and head, not each of its line comments.
diff --git a/docs/reviews/2026-10-26-cr7-write-repair.md b/docs/reviews/2026-10-26-cr7-write-repair.md
@@ -31,3 +31,15 @@ The follow-up build, renderer typecheck and full unit command passed (2,165 pass
 Complete first-failure results are preserved externally in `cr7-graphql-first-e2e-results`, with extracted `cr7-panel-pointer-events.json`. The passive trace records off-script zero-button pointer moves interleaved with the scripted held-button drags; the sidebar never establishes capture, and the workspace loses capture on a zero-button move before its drag completes. The resize component and test are unchanged from the earlier published candidate. This supports investigating input interference without identifying its source or proving absence of a source defect. A single unchanged focused diagnostic passed 1/1 in 8.2 seconds with retries disabled; its trace is preserved separately in `cr7-panel-diagnostic-results`. Independent review confirmed the conflicting delivered input without identifying its origin or establishing a source defect. No timeout, assertion or product behavior was altered. The full E2E command remains failed; the site stage and fresh hosted candidate checks are separate evidence.
 
 The separately executed site E2E stage passed 7/7 in 14.0 seconds. The follow-up is published for fresh hosted validation with the failed aggregate result, narrow diagnostic pass and independent review all retained. No green aggregate local E2E claim or protected-merge readiness is made from these results.
+
+## Delivery (recorded 2026-11-01)
+
+The signed candidate and protected delivery that this page said "remain to be recorded" have landed: PR #416
+merged through the merge queue on 2026-10-27 as `b3aad0d85b91f479d5415abdec15d9f74a5dd61c`, carrying #412's
+preflight and the stacked #413, #414 and #415 (all four closed unmerged; #416 superseded them) together with
+this repair and the GraphQL follow-up. The required `unit + e2e (macOS)` check passed on the PR head `fffd07e`
+(run `40415729228`) and in the merge queue on top of `main` (`merge_group` run `40420085521`, job `121912060965`).
+The local `panel-resize.spec.ts:65` failure above was not reproduced there and stays recorded as diagnosed input
+interference, not a fix. The post-merge push run on `main` (`40423890925`) failed its unit step (job
+`121924751474`) and the run was then cancelled; that failure is not diagnosed here and is not counted as a pass. It shipped in v0.4.0 and v0.4.1. No authenticated live write has been
+performed; the [live canary procedure](2026-11-01-cr7-live-canary.md) waits for a disposable repository Val names.