# 🔍 Cross-Review: v4.1.2 Upstream Bug-Fix Triage & Implementation (Job 8e6b346e)

- **Reviewer**: `reviewer-opencode-01` (role: reviewer)
- **Target**: Working-tree implementation of the v4.1.2 PATCH on top of `a18f9f8` (uncommitted, per the brief): planner triage plan (`plan-c107763c.md` Rev.2), the two applied code fixes (Bug-1 pane-resolution guard, Bug-4 idle-pane reuse), the two rejected/no-action issue verdicts, 4 new tests, and the 3-way lockstep bump to `4.1.2`.
- **Method**: Every claim re-derived from live source and my own runs — including behavioral verification of the exact misattribution scenario the upstream report describes, the full 451-test suite, and direct checks of each triage verdict against the adapter/caller code.

---

## 0. My Verification Runs

| Check | Result |
|---|---|
| `bash -n lib.sh` | OK |
| Targeted 6-file suite (a4, c1, b19, herdr_shim, version_consistency, tier2) | **123 passed** |
| Full suite `pytest tests/ -q` | **451 passed / 0 failed** (635s, my own run) — 447 prior + 4 new (r2, r3, h24, h25) |
| Lockstep | `lib.sh:32` `MAM_VERSION="4.1.2"`, 8× `SKILL.md` `version: 4.1.2`, `VERSIONS.md` header `v4.1.2` + date + prose + 8 matrix rows + changelog — `test_version_consistency.py` **2/2 passed** |
| Working-tree scope | Exactly the 12 files in the brief's diff + plan doc + `bug-report/` — no incidental drift |
| Generated shim `.mam/shim/herdr` | Contains the new `idle_pane` logic (3 matches) — template regeneration propagated |

## 1. Triage verdicts — all four independently re-verified

### Issue 1 (`agent_kind` fallback misattribution) — CONFIRMED REAL, fix correct
- Live code at `lib.sh:442`: `if agent_kind and (tn == agent_kind or tsa == agent_kind):` — the gate is present as planned.
- The pre-fix unsoundness is exactly as diagnosed: the yaml-derived kind was used to broadly match any single same-kind pane. I verified the real-world trigger path exists: `has-session`'s shim arm falls through to `_resolve_herdr_pane_id "$sess"` on role-prefixed names — precisely the drifted-kind scenario.
- The planner's Rev.2 refinement (Finding B) is also correctly applied: `for key in ('label', 'name')` at `lib.sh:415` — `'agent'` removed from the exact-match tuple, funneling all kind-based resolution through the R-1-guarded block. `test_r3` proves the bare-kind multi-pane case now fails closed instead of first-matching through the preempting loop.
- `test_r2` reproduces the upstream report's exact scenario (dead `creator-agy-01` + one unrelated live `agy` orchestrator pane) and asserts RC=1 — the fix-old-fail/new-pass discipline is genuinely applied.

### Issue 2 (`resume_spec` `materialized` gate) — REJECTION VERIFIED SOUND
- Live `opencode.py` `resume_spec` unchanged: `if materialized and session_uuid:`. I independently confirmed the rejection rationale: the identical pattern exists in all 5 adapters (verified in claude/grok/agy/hermes/opencode), `materialized` is produced by a real `verify_artifact()` SQLite check (which I exercised in earlier rounds — epoch/cwd filtering works), and `resume_session.sh` validates `--workspace` as required, so the claimed false-negative path doesn't reproduce. Removing the gate would break 5-adapter consistency and reintroduce invalid-session-id risk. **Rejection is the right call** — this is the same discipline I would apply.

### Issue 3 (`ready_tokens`) — ALREADY FIXED, verification correct
- Live value is the v4.1.1 string (I verified this string as the agent whose TUI it matches — my own session's startup surface). The upstream report was written against a stale checkout. No action is correct.

### Issue 4 (idle-pane reuse) — CONFIRMED REAL, fix correct including the Rev.2 refinement
- Live code at `lib.sh:715-745`: idle-pane lookup (workspace-scoped, `not p.get('agent')`), reuse as `target_pane`, and — critically — the Finding-A env-injection fix: `idle_env="${env_flags//--env /}"` + `HERDR_WORKSPACE_ID=$existing_ws` prefixed via `env` onto `$final_cmd`. This closes the regression the planner's own first draft introduced (env flags would have been silently dropped on the reuse path).
- The `else` branch preserves the entire pre-existing sample-pane/layout/split logic, and the W2b overflow policy (fresh workspace on `split_dir == "overflow"`, `lib.sh:771`) remains reachable only when no idle pane exists — as documented.
- `test_h24` asserts reuse-without-split; `test_h25` asserts both `MY_TEST_FLAG=active` and `HERDR_WORKSPACE_ID=w1` survive into the agent command — exactly the Finding-A regression lock.

## 2. Plan-of-record quality (planner `c107763c` Rev.2)

- The Rev.2 changelog honestly documents the agy challenge (`d14ab345`) and the two confirmed findings — and, notably, the planner **corrected one of the challenger's own supporting examples** (the `OPENCODE_PERMISSION` env example doesn't route through `$env_flags` today) while still accepting the underlying contract-level defect. That is the right epistemic standard: accept findings on evidence, not on rhetorical strength.
- The self-caught regression (double-quoted comment text corrupting the embedded Python inside the double-quoted bash block) is documented in the plan, and the live comment now contains no embedded double quotes — I verified the comment text directly. This is a real trap in this codebase's python-in-bash pattern and the record of it is valuable.

## 3. SemVer v4.1.2 (PATCH) — Correct

Both applied fixes are internal reliability hardening: no public `--agent` value, flag, or YAML key changed. §6 PATCH is right; consistent with v4.1.1/v3.0.1 precedents. The changelog transparently documents the two *not* adopted as well — including the reasoned rejection of Issue 2 and the stale-report finding for Issue 3. That is exactly what a durable release record should contain.

## 4. Test integrity

- 4 new tests, all passing, each named for the defect/regression it locks (r2 misattribution, r3 bare-kind fail-closed, h24 reuse-no-split, h25 env preservation).
- Full suite 451/451 in my own run — matches the plan's predicted count (449 + 2 Rev.2 tests) exactly.
- No existing test was weakened or skipped; the r1 fail-closed contract from the prior round still passes.

## 5. Non-blocking observations

- `${env_flags//--env /}` inherits the pre-existing word-splitting fragility for env values containing spaces (the split/create paths had the same limitation pre-Bug-4). Documented as out-of-scope in the plan; agreed — a broader quoting refactor is a separate change.
- `test_h25`'s env assertion checks the mock's recorded command string rather than real process env — adequate for the shim contract; the mock is the ground truth available.
- The peer reviews from Grok (job `c9796d8c`) and the Claude verification jobs were still running at my report time; per this session's standard I did not wait for them or cite them as evidence.

---

## 6. Verdict

The upstream report was triaged with genuine rigor — two real defects fixed correctly (including a planner self-caught draft regression and a challenge-driven refinement that closed a real env-loss gap), one proposal correctly rejected with verified reasoning (5-adapter `materialized` safety contract), one entry correctly identified as already fixed. All fixes are present in live source exactly as planned, the generated shim propagated them, the four new tests lock each behavior, the full suite passes 451/451 in my own run, the 3-way lockstep holds at 4.1.2, and the changelog honestly documents what was and wasn't adopted. No lint, functionality, or data-loss issues. No design-level rework; no planner escalation.

[VERDICT: PASS]