docs(backlog): tick M14-02/05/06/08; the #291 stdin note; M13-71, M13-72; M14-09 pointers

[sandgraal]

What

Conductor docs lane (ADR-0013 amendment, 2026-10-17): docs/BACKLOG.md only.

• Ticks M14-02 (feat(ui): the confirm flow on snap gc and doctor --yes (M14-02) #288), M14-05 (feat(char): wowlab char gear, and the lossless item-link parser (M14-05) #286), M14-06 (feat(char): wowlab_core.keymap and wowlab char binds (M14-06) #287), M14-08 (feat(ui): the Character tab, with the picker, header and gear (M14-08) #290).
• M14-02: a dated note on the Windows stdin follow-up (fix(ui): the plan run's child gets no console on stdin (M14-02) #291, 826ce3d): why DEVNULL made the child's isatty() True on Windows, what changed, and that Windows on main at 826ce3d is green.
• M14-08: a dated note from the feat(ui): the Character tab, with the picker, header and gear (M14-08) #290 reviews (shipped-table colours vs the ticket's "from the model" wording, which is an owner item; the aria-live region; the page.css exemption in the colour grep test).
• M14-09: pointers from the feat(ui): the Character tab, with the picker, header and gear (M14-08) #290 code review (the loadGear refactor, the intro paragraph and allowlist test that change, the default-flavor question, the aria-live narrowing).
• New tickets: M13-71 (guard_bash.py: --input bodies and the substring allowlist match, from the docs+harness: M14-02 marker field, the ui rule's confirm step, M14-03 notes, CharBindsReport fields, M13-70, M13-68 run 2 #289 review; conductor lane) and M13-72 (char list --json carries every full record under the Character tab, and the colour grep's page.css exemption; from the feat(ui): the Character tab, with the picker, header and gear (M14-08) #290 code review, off that branch).

Proof

• grep -c '^## \[' docs/BACKLOG.md → 87 headings; the four ticks are the only [ ] → [x] changes.
• Pre-commit hooks green on the commit (merge-conflict check, end-of-file).
• Rebased on main at 7415e07 (docs+harness: M14-02 marker field, the ui rule's confirm step, M14-03 notes, CharBindsReport fields, M13-70, M13-68 run 2 #289); the one conflict (M13-70 and M13-71 both appended after M13-69) was resolved by keeping both.

Reviewed by

code-reviewer CLEAN at cec1ea3 (every claim checked against main and the CI history; the one nit, a blank line before M13-72, fixed in the follow-up commit).

session: 284d1153-c891-4b84-8e47-150842fac4ba

🤖 Generated with Claude Code

[claude]

Claude finished @sandgraal's task in 45s —— View job

---

Independent review (code-reviewer)

• Read AGENTS.md and .claude/agents/code-reviewer.md (main's copy)
• Read .pr-review/pr.diff (whole; 1 file, docs/BACKLOG.md, +27/−4 on the merge)
• Checked CI and the notes' claims against the tree
• Posted verdict

What should be true (conductor docs lane, ADR-0013 amendment 2026-10-17): only docs/BACKLOG.md changes. Ticks change only [ ] → [x] on tickets that were actually merged. Dated notes describe main accurately. New tickets have a size, dependencies, acceptance criteria and a reviewer. Nothing under lab/*/src/ is touched, and no user-visible surface changes.

What I checked

• Scope. The diff touches one file, docs/BACKLOG.md. No source, test, workflow or harness file is in it, so L1–L8 are not engaged: no install I/O, no parser, no fixture, no flavor constant, nothing from ADR-0023. Nothing user-facing changes, so the missing "User-facing surface" box is not a finding.

• Ticks. Four headings flip, M14-02, M14-05, M14-06 and M14-08, and they are the only [ ] → [x] changes. A grep of the headings on the branch gives 87. That matches the session frontier: 68 done, 12 ready, 2 blocked, 5 owner. The body text of the ticked tickets is unchanged apart from the appended notes.

• M14-02 note (fix(ui): the plan run's child gets no console on stdin (M14-02) #291). It matches lab/core/src/wowlab_core/ui/__init__.py:912-928. The child gets stdin=subprocess.PIPE, process.stdin.close() runs straight after Popen, and tree.started(process) comes after that. The comment explains the Windows NUL-device isatty() problem.

• M14-08 note. All three points hold on the tree:

  • #char-status has role="status" (page.html:84), and aria-live="polite" sits on the whole #char-gear-panel (page.html:87).
  • --field: #ffffff is in page.css:43.
  • test_the_templates_hold_no_slot_name_and_no_colour_code (test_ui_character.py:541) skips the six-digit RGB check for page.css (line 558), and it checks quality words only in page.js (lines 561–563). That is the gap M13-72 (2) names.

• M14-09 pointers. loadGear exists (page.js:1167). The intro says the tab runs wowlab char list and wowlab char gear "and nothing else" (page.html:81).

• M13-71. Both claims hold in .claude/hooks/guard_bash.py:

  • _check_gh reads only query=@ files (lines 150–168). --input only feeds has_body (line 188) and is never read.
  • The allowlist is a substring test over the joined text: any(m in joined for m in _ALLOWED_MUTATIONS) (line 170).

  The ticket sends this to the conductor lane, which is right for a harness file.

• M13-72. keep_records=json_out is at cli.py:7464. The ticket labels its own size figure as not verified on high-level records. The acceptance criteria are concrete: the test must catch #a335ee and a quality word, and the existing output must stay byte-identical.

• Formatting. The merge diff shows M13-72's heading directly after --- with no blank line. On the branch head that is fixed: --- is at line 1064 and the heading at 1066.

• CI. Run 39237493917 (CI) passed.

Off the branch (does not count)

• Nit: M13-71 says to read --input bodies "the way query=@ files are read (JSON, the query key)". query=@ files are read as raw text (guard_bash.py:163), not as JSON. The parenthetical describes the --input format, not how query=@ is handled. The implementer will work it out, but "read the --input file as JSON and judge its query value like a query=@ file" would say it directly.

verdict: CLEAN