fix(planning): set aside a stale own answer when the session revises the recommendation

[kyle-sexton]

Closes #5453

Summary

After the session revised a recommendation in response to an own answer, the interview surface kept showing the user's earlier text as the decision, and the next accept carried that stale text.

Fix

reply --rec and revise --rec in plugins/planning/surface/round.py now stamp setAsideAt/Seq/Rev on a question whose counted decision is an own answer, reusing the existing set-aside path, so the page and status drop the stale text. Accept, alt and defer decisions stay. A record-terminal after the revision counts. The note field no longer prefills from a set-aside decision. Planning bumped to 0.47.4 with a changelog entry.

Verification

• python3 -m unittest test_round in plugins/planning/surface: 99 tests OK.
• bash plugins/planning/surface/surface.test.sh: PASS=293 FAIL=0 SKIP=1, including new journey phase 9 (rail reads Open, Ctrl+Enter accepts the revised recommendation).
• scripts/check-changelog-parity.sh --check --check-order: passes.
• scripts/validate-plugins.sh: all manifests and the catalog validate.

Related

Refs #5191 (parent). #4653 tracks the commitment and export gaps behind the other findings.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-30T02:50:22.977360Z	6e8133a	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[claude]

Claude encountered an error after 1s —— View job

---

I'll analyze this and get back to you.

[claude]

Claude encountered an error after 0s —— View job

---

I'll analyze this and get back to you.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4321845ee8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[claude]

Claude finished @kyle-sexton's task in 3m 28s —— View job

---

Code review (/review:code-review)

• Gather context (diff vs origin/main, changed files, prior Codex review)
• Review round.py set-aside logic, index.html fillNote fix, tests, docs
• No new inline findings to post
• Summary

Scope: the 8 changed files in this PR (plugin.json, CHANGELOG.md, surface.md, index.html, round.py, surface.test.sh, test_round.py, tests/ui_journey.js), against the code-review lane's criteria (correctness, maintainability, test coverage; security out of scope here).

Result: no new findings. Walked through the changed code (not just the author's description):

• set_aside_own() (round.py#L249-L257) mirrors the existing op_wait user-hold pattern (setAsideAt/Seq/Rev) rather than inventing a new mechanism, and only fires when the counted decision is own, leaving accept/alt/defer alone.
• The same-write race is handled: op_record_terminal's existing if q.get("setAsideRev") == doc["rev"] + 1 correction (round.py#L606-L608) already covers a record-terminal batched in the same apply call as the revision, and test_a_terminal_record_in_the_same_apply_counts exercises exactly that.
• exporters.set_aside()/newest_decision() compute aside-ness per candidate via seq/rev before picking the newest, so the Python-side status/export path doesn't have an ordering bug.
• The index.html:1004 fillNote() change (d && !d.aside && d.text) matches what Codex's inline P1 comment asked for — it's already applied on this head, not outstanding.

On Codex's still-open P2 comment (decisionOf() sorting by updatedAt before checking set-aside stamps, so a same-second page vs terminal tie can pick the aside one): that function (index.html ~L503-509) is unchanged by this PR — this PR only adds new producers of setAsideRev/setAsideAt, reusing exactly the fields the pre-existing wait --by user hold already produces and that decisionOf() already had to handle. I traced it and the tie-break risk looks real in principle, but it's pre-existing behavior on an untouched line (same latent risk already exists for hold+terminal today), which this lane's high-signal bar excludes. Leaving it to Codex's thread rather than duplicating.

Verification: I was not able to independently run python3 -m unittest test_round or surface.test.sh in this sandbox — both git fetch (to diff against a fresh origin/main) and python3 -m unittest were denied by the permission classifier with no one available to approve in this unattended lane. I instead read the diff via gh pr diff and traced the changed code paths by hand; the PR's own Verification section (99 unit tests, 293 shell-test PASS, changelog/manifest checks) is author-claimed and unverified by me.

[claude]

Claude finished @kyle-sexton's task in 1m 9s —— View job

---

CI security review

• Gather context (PR diff, changed files)
• Check skip gate
• Review changed files for security issues
• Report findings

No security issues found. This PR has no security-relevant surface:

• The diff touches a local, single-operator planning tool: plugins/planning/surface/round.py (a CLI that manages local questions.json/responses.json state and serves a localhost-only interview page) and the corresponding index.html, docs, changelog, version bump, and tests.
• The substantive logic change, set_aside_own, only re-stamps setAsideAt/Seq/Rev fields on locally-owned JSON state that the same trusted process already reads and writes. No new network exposure, no authentication/authorization boundary, no injection surface (command, SQL, path, template), and no secret/token handling is introduced.
• No instruction-surface deletions: the surface.md edits (L39, L48) only append clarifying text; they don't remove or narrow a standing rule.

Per the skill's skip gate, no further findings are reported. Note: the two existing Codex review comments on this PR (stale own-answer text remaining visible in the UI after a revision, and a decisionOf() tie-break favoring a set-aside decision) are correctness/logic issues, not security vulnerabilities, and are out of scope for this security lane.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6e8133a5ad

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[claude]

Claude finished @kyle-sexton's task in 1m 19s —— View job

---

CI security review (/review:security-review)

• Gather context (PR diff vs origin/main via gh pr diff 5498, changed files)
• Check skip gate
• Review changed files for security issues
• Report findings

Skip gate: the diff at the current head (6e8133a) is byte-identical to the two commits already reviewed in this thread's earlier security pass at e5ad169 (2026-09-30T02:33:24Z) — the commits since then only merge unrelated origin/main changes (c74d931, 139f1d0, fc9f95d) into the branch and touch none of this PR's 8 files. That prior pass found no security issues for this exact code, so it still applies. Confirming independently rather than resting solely on that:

No security issues found. This PR has no security-relevant surface:

• The substantive change is set_aside_own() in plugins/planning/surface/round.py — a local CLI that reads/writes questions.json / responses.json for a single-operator planning tool. It only re-stamps setAsideAt/setAsideSeq/setAsideRev fields on locally-owned state the same trusted process already reads and writes; no new network exposure, auth boundary, or injection surface (command, SQL, path, template).
• index.html:936 (fillNote) only changes which local decision object's .text populates a textarea on the localhost-only interview page; no new data source, no innerHTML/eval involvement.
• The surface.md prose edits (L39, L48) only append clarifying sentences to standing rules — no instruction is deleted, narrowed, or softened, so the instruction-surface-deletion lens doesn't flag anything here.
• Test-only changes (test_round.py, surface.test.sh, tests/ui_journey.js) and the version/changelog bump carry no security surface.

The two open Codex review comments on this PR (stale own-answer text in the UI, and a decisionOf() same-second tie-break) are correctness/logic issues, not vulnerabilities, and are out of scope for this security lane — the code-review lane already addressed them in its own pass on this PR.

[claude]

Claude finished @kyle-sexton's task in 1m 51s —— View job

---

Code review (/review:code-review)

• Gather context (diff vs origin/main, changed files, prior review comments)
• Check skip gate
• Review changed files for correctness/maintainability
• Report findings

Skip gate hit: this head already has a successful review from this lane that still applies.

The head SHA moved from e5ad169 to 6e8133a between the last full review (2026-09-30T02:30, job run) and this run, but I confirmed the move is a no-op for this PR's own content: 6e8133a only merges in unrelated origin/main commits (c74d931 stale-worktree-lock release, 139f1d0 disk-hygiene repairs, fc9f95d the two-column interview-card fix for #5191) plus the mechanical version-bump fallout from that merge (plugin.json 0.47.4 → 0.47.5, and the matching CHANGELOG.md entry, since #5463 landed on 0.47.4 first). I diffed e5ad169..6e8133a scoped to plugins/planning/ and verified round.py, test_round.py, surface.test.sh, tests/ui_journey.js, and surface.md are byte-identical to what the prior review already covered; gh pr diff 5498 shows the same 8 files as before with the same substantive hunks, plus only the trivial version/changelog bump.

That prior review (code-review lane) walked set_aside_own(), the same-write record-terminal race, the exporter set-aside/newest-decision ordering, and the index.html:1004 fillNote() fix, and found no blocking issues — see the prior comment for the detail. The security-review lane likewise found nothing on this same content. Codex's two open review comments (own-answer prefill P1, decisionOf() tie-break P2) were also already addressed/triaged there: the P1 fix is on this head at index.html:935 (d && !d.aside && d.text), and the P2 tie-break risk is pre-existing behavior on an untouched decisionOf() line, out of this lane's high-signal bar for pre-existing issues.

No new findings to post. Re-review the version/changelog hunk only if it's regenerated again before merge.
· branch fix/5453-set-aside-stale-own-on-revise

[claude]

Claude finished @kyle-sexton's task in 2m 19s —— View job

---

Code review (/review:code-review)

• Gather context (diff vs origin/main, prior reviews and Codex comments)
• Invoke /review:code-review skill and follow it exactly
• Review the new content added since the last lane pass
• Summary

Scope: this PR's diff against origin/main at HEAD 17c2b39. The last full pass from this lane covered through 6e8133a; commit b5dea9c ("merge base and address review on set-aside own answer") and the final merge 17c2b39 are new since then, so the skip gate does not apply — I reviewed the delta rather than resting on the prior pass.

Result: no new findings. b5dea9c specifically resolves both open Codex review comments on this PR:

• P1 (stale own text stays in the note/UI): index.html decisionOf() (index.html#L504-L510) now marks every candidate's aside flag before sorting, and sorts non-aside candidates first, so a same-second terminal record-terminal correctly beats a set-aside page answer instead of losing a stable-sort tie. The render loop (index.html#L1606-L1608) now also clears a set-aside prefill even while the note has focus, closing the original gap where apply() only called fillNote() on an empty textarea. New journey phase 9 in tests/ui_journey.js exercises exactly this (rail reads Open, note clears, Ctrl+Enter accepts the revision rather than resending the stale text).
• P2 (TOCTOU on the freshness guard vs. the set-aside stamp): guard_revision() now reads responses.json once and returns that snapshot (round.py#L211-L233), and both op_reply and op_revise feed that same snapshot into set_aside_own() (round.py#L529, round.py#L560-L572) instead of each doing its own read. A page write landing between the two reads can no longer pass the freshness guard on stale data while getting set aside on fresher data — test_an_answer_saved_after_the_guard_read_is_not_set_aside exercises this directly against round.guard_revision/round.set_aside_own.

I traced both fixes against exporters.latest_decision/newest_decision/set_aside (unchanged) and the existing wait --by user hold pattern that setAsideAt/Seq/Rev mirrors, and they're consistent: set_aside_own stamps the same three fields the same way, and op_record_terminal's same-write correction at round.py#L639-L641 (unchanged, pre-existing) still covers a record-terminal batched in the same apply as the revision.

No other functional changes landed in this delta — the rest of b5dea9c/17c2b39 is an origin/main merge (unrelated plugins, e.g. the group-summary-staleness feature and machine-profile docs, already on main) plus the resulting version/changelog bump to 0.47.8.

Verification: I did not independently run python3 -m unittest test_round or surface.test.sh — read the diff and traced the changed code paths by hand only. The PR's Verification section (99 unit tests, 293/294 shell-test PASS, changelog/manifest checks) is author-claimed and unverified by me.
· branch fix/5453-set-aside-stale-own-on-revise

[claude]

Claude finished @kyle-sexton's task in 1m 25s —— View job

---

CI security review (/review:security-review)

• Gather context (diff vs origin/main at HEAD 17c2b39, changes since last reviewed head 6e8133a)
• Check skip gate
• Review changed files for security issues
• Report findings

No security issues found.

What's new since the last security pass on this PR (which covered 6e8133a): commit b5dea9c addresses both open Codex review comments plus a third TOCTOU-shaped issue Codex raised on the merge commit:

• guard_revision() now returns the responses.json snapshot it read, and op_reply/op_revise pass that same snapshot into set_aside_own() instead of re-reading the file. This closes the window Codex flagged where a page write landing between the guard's read and a second, later read could be set aside despite arriving after the freshness check passed.
• decisionOf() now marks every candidate's aside flag before sorting, and sorts non-aside candidates first, fixing the same-second tie-break Codex identified.
• fillNote() and the render loop now clear a set-aside prefill even while the note has focus.

None of this changes the security posture already assessed on this PR: everything here operates on locally-owned questions.json/responses.json state read and written by the same trusted process (round.py, a local CLI) and rendered on a localhost-only interview page (index.html). No new network exposure, no auth/authz boundary, no injection surface (command, SQL, path, template), and no secret/token handling. The snapshot-reuse fix and the sort/tie-break fix are both concurrency/logic corrections with no attacker-controlled input in play — a single local operator is the only actor able to write these files.

The unrelated files also touched in this PR (plugin.json version bump, CHANGELOG.md, surface.md prose, test_round.py, surface.test.sh, tests/ui_journey.js) carry no security surface — the surface.md edits only append clarifying sentences to existing rules, deleting or narrowing nothing.

Per the skip gate, no further findings are reported. The two previously open Codex comments (own-answer prefill, decisionOf() tie-break) are both resolved by this commit; a third Codex comment (the TOCTOU snapshot reuse) is also resolved. All three were correctness/logic findings, not security ones, but resolving them removes any residual doubt about this lane's earlier read of the code.
· branch fix/5453-set-aside-stale-own-on-revise

[claude]

Claude finished @kyle-sexton's task in 59s —— View job

---

CI security review (/review:security-review)

• Gather context (diff vs origin/main at HEAD d95518a, changes since last reviewed head 17c2b39)
• Check skip gate
• Review changed files for security issues
• Report findings

Skip gate hit: this head already has a successful security review that still applies.

git diff 17c2b39fa33f9d34e1df5044b6913c8175c7d742..d95518a5341a4eaec1b8a188b534ecb6e35dd9d5 -- plugins/planning/surface/round.py plugins/planning/surface/index.html plugins/planning/surface/test_round.py plugins/planning/surface/surface.test.sh plugins/planning/surface/tests/ui_journey.js plugins/planning/skills/interview/context/surface.md is empty — every one of this PR's own files is byte-identical to what the prior security pass at 17c2b39 already covered (that pass found the TOCTOU fix in guard_revision()/set_aside_own(), the decisionOf() tie-break fix, and the fillNote() prefill fix all landed with no security issues).

The only content added between 17c2b39 and d95518a is:

• plugins/planning/.claude-plugin/plugin.json: version bump 0.47.8 → 0.47.9.
• plugins/planning/CHANGELOG.md: entry reorder/addition for the version bump.
• plugins/planning/surface/DEFERRED.md (new) and plugins/planning/surface/README.md: merged in from origin/main (unrelated PR, deferred-work tracking doc), not authored by this PR.
• A batch of unrelated origin/main merge commits (disk-hygiene, guardrails, wizard secrets rung, repo-hygiene branch-delete guard, plugin-quality audit fields, etc.) — none touch plugins/planning/.

None of this is new logic in this PR's own surface (round.py, index.html), so there is nothing new to assess. DEFERRED.md/README.md are documentation-only (a table of deferred feature decisions and a file-listing update) with no security surface.

Conclusion: no security issues found, consistent with every prior pass on this PR.
· branch fix/5453-set-aside-stale-own-on-revise

[claude]

Claude finished @kyle-sexton's task in 1m 21s —— View job

---

Code review (/review:code-review)

• Gather context (diff vs origin/main, changed files, prior reviews)
• Invoke /review:code-review skill and follow it exactly
• Review the new content added since the last lane pass
• Summary

Skip gate hit: this head already has a successful review from this lane that still applies.

HEAD moved from 17c2b39 (last full pass, comment) to d95518a via commit d95518a itself ("merge origin/main, bump to 0.47.9"). I confirmed the move is a no-op for this PR's own content:

• git diff 17c2b39..d95518a -- plugins/planning/ touches only plugin.json (version 0.47.8 → 0.47.9), a CHANGELOG.md reorder/insert, and an unrelated surface/DEFERRED.md/README.md addition that came in from an origin/main merge commit (7b867ac, already on main, not part of this PR's own diff).
• gh pr diff 5498 still shows exactly the same 8 files as before, and round.py, index.html, surface.md, test_round.py, surface.test.sh, and tests/ui_journey.js are byte-identical to what the prior pass reviewed — none of them appear in the 17c2b39..d95518a diff at all.

That prior pass (2026-09-30T04:32) reviewed the full current diff: set_aside_own() in round.py, the guard_revision() snapshot-reuse fix for the TOCTOU Codex flagged, the decisionOf() aside-before-sort tie-break fix, and the fillNote()/render-loop fix for the stale-note-while-focused case — and found no blocking issues. The security lane's most recent pass (2026-09-30T04:37) covered the same content and agreed. Nothing in this PR's own files changed since then, so I'm not re-reviewing content already covered, per this lane's skip gate.

No new findings to post.

Verification: author-claimed and unverified by me — I did not independently run python3 -m unittest test_round or surface.test.sh in this pass (no new code to verify; prior passes also noted this tool wasn't runnable in-sandbox).
· branch fix/5453-set-aside-stale-own-on-revise

[claude]

Claude finished @kyle-sexton's task in 44s —— View job

---

CI security review (/review:security-review)

• Gather context (diff vs origin/main, changes since last reviewed head d95518a)
• Check skip gate
• Review changed files for security issues
• Report findings

Skip gate hit: this head already has a successful security review that still applies.

git diff d95518a5341a4eaec1b8a188b534ecb6e35dd9d5..08150e796409d333cdf78f2ead0725baa22df0ea scoped to this PR's own files (plugins/planning/surface/round.py, plugins/planning/surface/index.html, plugins/planning/surface/test_round.py, plugins/planning/surface/surface.test.sh, plugins/planning/surface/tests/ui_journey.js, plugins/planning/skills/interview/context/surface.md) is empty — byte-identical to what the prior security pass at d95518a already covered and cleared.

gh pr diff 5498 --name-only confirms the PR's changed-file set is still exactly the same 8 files. The only content added between d95518a and 08150e7 (verified via git diff -- plugins/planning/) is:

• plugins/planning/.claude-plugin/plugin.json: version bump 0.47.9 → 0.47.10.
• plugins/planning/CHANGELOG.md: new entry for this PR's own fix, reordered above an unrelated 0.47.9 entry pulled in by the merge.
• plugins/planning/agents/plan-reviewer.md and plugins/planning/skills/plan/SKILL.md: not part of this PR's diff — these came in from the origin/main merge (an unrelated #4256 fix already landed on main) and don't appear in gh pr diff 5498's file list.

Since this PR's own substantive files (round.py's set_aside_own()/guard_revision() snapshot reuse, index.html's decisionOf()/fillNote() fixes, tests) are unchanged since the last full pass, that assessment still holds:

No security issues found. The change operates entirely on locally-owned questions.json/responses.json state read/written by a single trusted local CLI (round.py) and rendered on a localhost-only interview page (index.html). No new network exposure, auth/authz boundary, injection surface (command, SQL, path, template), or secret/token handling. The surface.md prose edits only append clarifying sentences to existing rules — nothing deleted or narrowed, so the instruction-surface-deletion lens doesn't flag anything.
· branch fix/5453-set-aside-stale-own-on-revise

[claude]

Claude finished @kyle-sexton's task in 45s —— View job

---

Code review (/review:code-review)

• Gather context (diff vs origin/main at HEAD 08150e7, prior reviews and Codex comments)
• Invoke /review:code-review skill and follow it exactly
• Review the new content added since the last lane pass
• Summary

Skip gate hit: this head already has a successful review from this lane that still applies.

HEAD moved from d95518a (last full pass, comment) to 08150e7 ("chore(planning): merge origin/main, bump to 0.47.10"). I confirmed the move is a no-op for this PR's own content:

• git diff d95518a..08150e7 -- plugins/planning/surface/round.py plugins/planning/surface/index.html plugins/planning/surface/test_round.py plugins/planning/surface/surface.test.sh plugins/planning/surface/tests/ui_journey.js plugins/planning/skills/interview/context/surface.md is empty — every one of this PR's own substantive files is byte-identical to what the prior review already covered (the set_aside_own() logic, the guard_revision() TOCTOU fix, the decisionOf() tie-break fix, and the fillNote()/render-loop fix).
• The only diff in plugins/planning/ between d95518a and 08150e7 is: plugin.json version bump (0.47.9 → 0.47.10), a CHANGELOG.md entry reorder/insert, and unrelated origin/main merge content this PR did not author — agents/plan-reviewer.md and skills/plan/SKILL.md (the plan-reviewer maxTurns verification work from planning:plan mandates two nested reviews with no brevity instruction, no effort knob, and no cost disclosure #4256/935e8ee), neither of which is in this PR's changed-files list.

That prior pass (and the security lane's matching pass) reviewed the full current diff — set_aside_own() in round.py, the same-write record-terminal race, the exporter set-aside/newest-decision ordering, the TOCTOU fix via the shared guard_revision() snapshot, the decisionOf() aside-before-sort tie-break, and the fillNote()/render-loop fix for the stale-note-while-focused case — and found no blocking issues. All three Codex review threads on this PR are resolved on this head.

No new findings to post.

Verification: author-claimed and unverified by me — I did not independently run python3 -m unittest test_round or surface.test.sh in this pass (no new code in this PR's own files to verify).
· branch fix/5453-set-aside-stale-own-on-revise

[claude]

Claude finished @kyle-sexton's task in 44s —— View job

---

Code review (/review:code-review)

• Gather context (diff vs origin/main, prior reviews and Codex comments)
• Invoke /review:code-review skill and follow it exactly
• Review the new content added since the last lane pass
• Summary

Skip gate hit: this head already has a successful review from this lane that still applies.

HEAD moved from 08150e7 (last full pass, comment) to 7bd8f05 ("chore(planning): merge origin/main, bump to 0.47.11"). Confirmed the move is a no-op for this PR's own content:

• git diff 08150e7..7bd8f05 -- plugins/planning/surface/round.py plugins/planning/surface/index.html plugins/planning/surface/test_round.py plugins/planning/surface/surface.test.sh plugins/planning/surface/tests/ui_journey.js plugins/planning/skills/interview/context/surface.md is empty — every one of this PR's substantive files is byte-identical to what the prior review already covered (set_aside_own(), the guard_revision() TOCTOU fix, the decisionOf() tie-break fix, and the fillNote()/render-loop fix).
• The only diff under plugins/planning/ between those two heads is plugin.json (version 0.47.10 → 0.47.11), a CHANGELOG.md insert for this same fix, and plugins/planning/tests/interview-defenses.test.sh — which is not in this PR's changed-file list and came in from an unrelated origin/main merge (#5332, the "recomputing a digest or pin is attended-only" changelog entry now visible at 0.47.10 in the same diff).

That prior pass (and the matching security-lane pass) walked the full current diff — set_aside_own() in round.py, the same-write record-terminal race, the exporter set-aside/newest-decision ordering, the TOCTOU fix via the shared guard_revision() snapshot, the decisionOf() aside-before-sort tie-break, and the fillNote()/render-loop fix for the stale-note-while-focused case — and found no blocking issues. All three Codex review threads on this PR are resolved on this head.

No new findings to post.

Verification: author-claimed and unverified by me — no new code in this PR's own files to verify in this pass, and I did not independently run python3 -m unittest test_round or surface.test.sh.
· branch fix/5453-set-aside-stale-own-on-revise

[claude]

Claude finished @kyle-sexton's task in 46s —— View job

---

CI security review (/review:security-review)

• Gather context (diff vs origin/main, changes since last reviewed head 08150e7)
• Check skip gate
• Review changed files for security issues
• Report findings

Skip gate hit: this head already has a successful security review that still applies.

git diff 08150e796409d333cdf78f2ead0725baa22df0ea..7bd8f05fde6e27a927d9534f5e0b1601a46eae03 scoped to this PR's own files (plugins/planning/surface/round.py, plugins/planning/surface/index.html, plugins/planning/surface/test_round.py, plugins/planning/surface/surface.test.sh, plugins/planning/surface/tests/ui_journey.js, plugins/planning/skills/interview/context/surface.md) is empty — byte-identical to what the prior security pass at 08150e7 already covered and cleared.

The only content that changed in plugins/planning/ between 08150e7 and this HEAD (7bd8f05) is:

• plugin.json: version bump 0.47.10 → 0.47.11.
• CHANGELOG.md: reorder/insert for this bump.
• plugins/planning/tests/interview-defenses.test.sh: not part of this PR's diff — merged in from origin/main (unrelated fix for issue planning/interview: hub gates outside the re-attach slice, and who may recompute defense digests #5332, adding an "attended-only" note to digest/pin failure messages). Not in this PR's changed-files list.

Since this PR's own substantive files (round.py's set_aside_own() / guard_revision() snapshot reuse, index.html's decisionOf() / fillNote() fixes, and tests) are unchanged since the last full pass, that assessment still holds:

No security issues found. The change operates entirely on locally-owned questions.json/responses.json state read/written by a single trusted local CLI (round.py) and rendered on a localhost-only interview page (index.html). No new network exposure, auth/authz boundary, injection surface (command, SQL, path, template), or secret/token handling. The surface.md prose edits only append clarifying sentences to existing rules — nothing deleted or narrowed, so the instruction-surface-deletion lens doesn't flag anything.

All three Codex review threads on this PR (own-answer prefill, decisionOf() tie-break, TOCTOU snapshot reuse) remain resolved on this head.
· branch fix/5453-set-aside-stale-own-on-revise

[claude]

Claude finished @kyle-sexton's task in 1m 46s —— View job

---

CI security review (/review:security-review)

• Gather context (diff vs origin/main, changes since last reviewed head c86a3da)
• Check skip gate
• Review changed files for security issues
• Report findings

Skip gate hit: this head already has a successful security review that still applies.

gh pr diff 5498 --name-only shows the same 8 files as every prior pass, and the full diff at this head (d9c7aa5) is functionally identical to what the d95518a/08150e7/7bd8f05/c86a3da passes already covered and cleared:

• set_aside_own() in round.py still takes the shared responses.json snapshot rather than re-reading, and guard_revision() at round.py#L213-L237 still returns that snapshot for op_reply/op_revise to reuse — the TOCTOU fix is unchanged.
• decisionOf() still marks aside on every candidate before sorting non-aside candidates first, and fillNote() plus the render loop at index.html#L1607-L1608 still clear a set-aside prefill even while the note has focus.
• plugins/planning/skills/interview/context/surface.md carries only the same two prose additions already reviewed (documenting the set-aside behavior); nothing is deleted or narrowed, so the instruction-surface-deletion lens still finds nothing here.
• The only content added between the last-reviewed head and this one (d9c7aa5) is: plugin.json version bump (0.47.x → 0.48.1), a matching CHANGELOG.md reorder/insert, and a batch of origin/main merge commits touching unrelated plugins (e.g. the sign-off recap feature, skill-spoke path resolution, guardrails docs) — none of which land in this PR's own file set.

Conclusion: no security issues found, consistent with every prior pass on this PR. The change operates entirely on locally-owned questions.json/responses.json state read and written by a single trusted local CLI (round.py) and rendered on a localhost-only interview page (index.html). No new network exposure, auth/authz boundary, injection surface (command, SQL, path, template), or secret/token handling. All three previously-open Codex review threads (own-answer prefill, decisionOf() tie-break, TOCTOU snapshot reuse) remain resolved on this head.
· branch fix/5453-set-aside-stale-own-on-revise

[claude]

Claude finished @kyle-sexton's task in 43s —— View job

---

Code review (/review:code-review)

• Gather context (diff vs origin/main at HEAD 4a43031, prior reviews and Codex comments)
• Invoke /review:code-review skill and follow it exactly
• Review the new content added since the last lane pass
• Summary

Skip gate hit: this head already has a successful review from this lane that still applies.

HEAD moved from d9c7aa5 (last full pass, comment) to 4a43031 ("chore(planning): merge origin/main, bump to 0.48.2"). Confirmed the move is a no-op for this PR's own content: gh pr diff 5498 at this head still lists the same 8 files, and the hunks in round.py, index.html, surface.md, test_round.py, surface.test.sh, and tests/ui_journey.js are byte-identical to what the prior pass already reviewed (set_aside_own(), the guard_revision() snapshot-reuse fix, the decisionOf() aside-before-sort tie-break, and the fillNote()/render-loop fix). The only new content in this PR's own files is the routine plugin.json version bump (0.48.1 → 0.48.2) and the matching CHANGELOG.md entry.

(A local git diff d9c7aa5..4a43031 on index.html/tests/ui_journey.js shows an unrelated openAssumeWarn wrap-up-warning hunk — that's origin/main content merged into this branch's history, not part of this PR's own diff per gh pr diff, so it's out of scope here.)

The prior full pass (and the matching security-lane pass) walked set_aside_own() in round.py, the same-write record-terminal race, the exporter set-aside/newest-decision ordering, the guard_revision() TOCTOU fix, the decisionOf() aside-before-sort tie-break fix, and the fillNote()/render-loop fix for the stale-note-while-focused case — and found no blocking issues. All three Codex review threads on this PR (own-answer prefill, decisionOf() tie-break, TOCTOU snapshot reuse) remain resolved on this head.

No new findings to post.

Verification: author-claimed and unverified by me — no new code in this PR's own files to verify in this pass, and I did not independently run python3 -m unittest test_round or surface.test.sh.
· branch fix/5453-set-aside-stale-own-on-revise

[claude]

Claude finished @kyle-sexton's task in 1m 8s —— View job

---

CI security review (/review:security-review)

• Gather context (diff vs origin/main, changes since last reviewed head d9c7aa5)
• Check skip gate
• Review changed files for security issues
• Report findings

Skip gate hit: this head already has a successful security review that still applies.

gh pr diff 5498 (the authoritative diff against the real merge base, immune to this branch's shallow-checkout merge noise) shows this PR's own content is unchanged since the prior security pass at d9c7aa5:

• set_aside_own() still takes the shared responses.json snapshot rather than re-reading, and guard_revision() still returns that snapshot for op_reply/op_revise to reuse — the TOCTOU fix is unchanged.
• decisionOf() still marks aside on every candidate before sorting non-aside candidates first, and fillNote() plus the render loop at index.html#L1606-L1608 still clear a set-aside prefill even while the note has focus.
• plugins/planning/skills/interview/context/surface.md carries only the same two prose additions already reviewed; nothing deleted or narrowed.
• The only content added since the last-reviewed head is: plugin.json version bump (0.48.1 → 0.48.2), the matching CHANGELOG.md entry, and a batch of unrelated origin/main merge commits (e.g. an "open assumptions" wrap-up warning in index.html from a different PR, a blank-line changelog fix) — I confirmed via gh pr diff 5498 that none of that merged-in content is part of this PR's own file set.

Conclusion: no security issues found, consistent with every prior pass on this PR. The change operates entirely on locally-owned questions.json/responses.json state read and written by a single trusted local CLI (round.py) and rendered on a localhost-only interview page (index.html). No new network exposure, auth/authz boundary, injection surface (command, SQL, path, template), or secret/token handling. All three previously-open Codex review threads (own-answer prefill, decisionOf() tie-break, TOCTOU snapshot reuse) remain resolved on this head.
· branch fix/5453-set-aside-stale-own-on-revise

[claude]

Claude finished @kyle-sexton's task in 55s —— View job

---

CI security review (/review:security-review)

• Gather context (diff vs origin/main at HEAD 80cc4cd, changes since last reviewed head 4a43031)
• Invoke /review:security-review skill and follow it exactly
• Review changed files for security issues
• Report findings

Skip gate hit: this head already has a successful security review that still applies.

HEAD moved from 4a43031 (last full security pass, comment) to 80cc4cd ("chore(planning): merge origin/main, bump to 0.49.1"). gh pr diff 5498 — computed server-side against the real merge base, so it's immune to this branch's merge-commit noise — confirms the move is a no-op for this PR's own content:

• set_aside_own() in round.py still takes the shared responses.json snapshot rather than re-reading, and guard_revision() still returns that snapshot for op_reply/op_revise to reuse — the TOCTOU fix is unchanged.
• decisionOf() still marks aside on every candidate before sorting non-aside candidates first, and fillNote() plus the render loop at index.html#L1608-L1610 still clear a set-aside prefill even while the note has focus.
• plugins/planning/skills/interview/context/surface.md carries only the same two prose additions already reviewed; nothing deleted or narrowed.
• The only content added since the last-reviewed head is: plugin.json version bump (0.48.2 → 0.49.1), the matching CHANGELOG.md entry, and the unrelated #5497 commitments feature (commits/commitsSinceSeq in round.py/index.html) merged in from origin/main — I verified via gh pr diff 5498 that none of that merged-in content is part of this PR's own file set; it only shows up as surrounding context in a local-branch diff.

Conclusion: no security issues found, consistent with every prior pass on this PR. The change operates entirely on locally-owned questions.json/responses.json state read and written by a single trusted local CLI (round.py) and rendered on a localhost-only interview page (index.html). No new network exposure, auth/authz boundary, injection surface (command, SQL, path, template), or secret/token handling. All three previously-open Codex review threads (own-answer prefill, decisionOf() tie-break, TOCTOU snapshot reuse) remain resolved on this head.
· branch fix/5453-set-aside-stale-own-on-revise

[claude]

Claude finished @kyle-sexton's task in 1m 18s —— View job

---

Code review (/review:code-review)

• Gather context (diff vs origin/main at HEAD 80cc4cd, prior reviews and Codex comments)
• Invoke /review:code-review skill and follow it exactly
• Review the new content added since the last lane pass
• Summary

Skip gate hit: this head already has a successful review from this lane that still applies.

HEAD moved from 4a43031 (last full pass, comment) to 80cc4cd ("chore(planning): merge origin/main, bump to 0.49.1"). Confirmed the move is a no-op for this PR's own content: gh pr diff 5498 at this head still lists the same 8 files, and I read the full diff directly (not just a name/stat summary) — every hunk in round.py, index.html, surface.md, test_round.py, surface.test.sh, and tests/ui_journey.js matches exactly what the prior passes already reviewed:

• set_aside_own() (round.py#L251-L258) still takes the response snapshot as a parameter rather than re-reading, and guard_revision() (round.py#L216-L241) still returns that snapshot for op_reply/op_revise (round.py#L529, round.py#L564-L579) to reuse — the TOCTOU fix is unchanged.
• decisionOf() (index.html#L504-L510) still marks aside on every candidate before sorting non-aside candidates first, and fillNote()/the render loop (index.html#L1007-L1010, index.html#L1606-L1608) still clear a set-aside prefill even while the note has focus.
• surface.md carries only the same two prose additions already reviewed; nothing deleted or narrowed.
• New tests (TestReviseSetsAsideOwn in test_round.py, journey phases 8/9) are unchanged from the versions already walked in prior passes.

The only content added since the last-reviewed head is the routine plugin.json version bump (0.49.0 → 0.49.1) and the matching CHANGELOG.md entry — no logic change.

That prior full pass (and the matching security-lane pass) walked set_aside_own(), the same-write record-terminal race, the exporter set-aside/newest-decision ordering, the guard_revision() TOCTOU fix, the decisionOf() aside-before-sort tie-break fix, and the fillNote()/render-loop fix for the stale-note-while-focused case — and found no blocking issues. All three Codex review threads on this PR (own-answer prefill, decisionOf() tie-break, TOCTOU snapshot reuse) remain resolved on this head.

No new findings to post.

Verification: author-claimed and unverified by me — no new code in this PR's own files to verify in this pass, and I did not independently run python3 -m unittest test_round or surface.test.sh.
· branch fix/5453-set-aside-stale-own-on-revise

[claude]

Claude finished @kyle-sexton's task in 1m 16s —— View job

---

Code review (/review:code-review)

• Gather context (diff vs origin/main at HEAD fa7c2e6, prior reviews and Codex comments)
• Invoke /review:code-review skill and follow it exactly
• Review the new content added since the last lane pass
• Summary

Skip gate hit: this head already has a successful review from this lane that still applies.

HEAD moved from 80cc4cd (last full pass, comment) to fa7c2e6 ("chore(planning): merge origin/main, bump to 0.49.2"). Confirmed the move is a no-op for this PR's own content: gh pr diff 5498 at this head still shows the same 8 files, and every hunk in round.py, index.html, surface.md, test_round.py, surface.test.sh, and tests/ui_journey.js is unchanged from what the prior passes already reviewed:

• set_aside_own() still takes the response snapshot as a parameter rather than re-reading, and guard_revision() still returns that snapshot for op_reply/op_revise to reuse — the TOCTOU fix Codex raised is unchanged.
• decisionOf() still marks aside on every candidate before sorting non-aside candidates first, and fillNote() plus the render loop at index.html#L1606-L1608 still clear a set-aside prefill even while the note has focus.
• surface.md carries only the same two prose additions already reviewed; nothing deleted or narrowed. (This branch's local copy of the file also picked up an unrelated export-brief acceptance-criteria wording change from an origin/main merge — confirmed via gh pr diff that it is not part of this PR's own diff, so it's out of scope here.)
• The only new content in this PR's own files since 80cc4cd is the routine plugin.json version bump (0.49.1 → 0.49.2) and the matching CHANGELOG.md entry — no logic change.

I independently re-traced set_aside_own(), guard_revision(), op_reply/op_revise, decisionOf(), and fillNote() against this head rather than resting solely on the prior comments, and reached the same conclusion: the same-write record-terminal race, the exporter set-aside/newest-decision ordering, the TOCTOU fix via the shared guard_revision() snapshot, the decisionOf() aside-before-sort tie-break, and the fillNote()/render-loop fix for the stale-note-while-focused case all hold up. All three Codex review threads on this PR (own-answer prefill, decisionOf() tie-break, TOCTOU snapshot reuse) remain resolved on this head.

No new findings to post.

Verification: author-claimed and unverified by me — no new code in this PR's own files to verify in this pass, and I did not independently run python3 -m unittest test_round or surface.test.sh.
· branch fix/5453-set-aside-stale-own-on-revise

[claude]

Claude finished @kyle-sexton's task in 1m 7s —— View job

---

CI security review (/review:security-review)

• Gather context (diff vs origin/main at HEAD fa7c2e6, changes since last reviewed head 80cc4cd)
• Invoke /review:security-review skill and follow it exactly
• Check skip gate
• Report findings

Skip gate hit: this head already has a successful security review that still applies.

HEAD moved from 80cc4cd (last full security pass, comment) to fa7c2e6 ("chore(planning): merge origin/main, bump to 0.49.2"). Confirmed the move is a no-op for this PR's own content:

• git diff 80cc4cd..fa7c2e6 scoped to plugins/planning/surface/round.py, plugins/planning/surface/index.html, plugins/planning/surface/test_round.py, plugins/planning/surface/surface.test.sh, and plugins/planning/surface/tests/ui_journey.js is empty — set_aside_own() and guard_revision() (the TOCTOU fix) are byte-identical to what the prior pass cleared, as are decisionOf() (the aside-before-sort tie-break fix) and fillNote()/the render loop (the stale-note-while-focused fix).
• gh pr diff 5498 (computed server-side against the real merge base, immune to this branch's merge-commit noise) confirms plugins/planning/skills/interview/context/surface.md still carries only the same two prose additions already reviewed (documenting the set-aside behavior at what's now L33 and L97) — nothing deleted or narrowed. A third hunk visible in a raw local git diff 80cc4cd..HEAD on this file (an export-brief/acceptance-criteria wording change) is confirmed via gh pr diff to be not part of this PR's own diff — it's unrelated origin/main merge content (issue fix(planning): route interview acceptance criteria into export-brief #5461, already reflected in the CHANGELOG's 0.49.1 entry).
• The only content that is this PR's own since 80cc4cd: the routine plugin.json version bump (0.49.1 → 0.49.2) and a CHANGELOG.md reorder placing this PR's own entry above the merged-in 0.49.1 entry — no logic change.

Since this PR's own substantive files are unchanged, the prior assessment still holds:

No security issues found. The change operates entirely on locally-owned questions.json/responses.json state read and written by a single trusted local CLI (round.py) and rendered on a localhost-only interview page (index.html). No new network exposure, auth/authz boundary, injection surface (command, SQL, path, template), or secret/token handling. All three previously-open Codex review threads on this PR (own-answer prefill, decisionOf() tie-break, TOCTOU snapshot reuse) remain resolved on this head.
· branch fix/5453-set-aside-stale-own-on-revise

[claude]

Claude finished @kyle-sexton's task in 44s —— View job

---

CI security review (/review:security-review)

• Gather context (diff vs origin/main at HEAD c5ec8d3, changes since last reviewed head fa7c2e6)
• Invoke /review:security-review skill and follow it exactly
• Check skip gate
• Report findings

Skip gate hit: this head already has a successful security review that still applies.

HEAD moved from fa7c2e6 (last full security pass, comment) to c5ec8d3 ("chore(planning): merge origin/main, bump to 0.49.3"). Confirmed the move is a no-op for this PR's own security-relevant content:

• git diff fa7c2e6..c5ec8d3 -- plugins/planning/surface/round.py plugins/planning/surface/index.html plugins/planning/surface/test_round.py plugins/planning/surface/surface.test.sh plugins/planning/surface/tests/ui_journey.js is empty — set_aside_own() and guard_revision() (the TOCTOU fix) are byte-identical to what the prior pass cleared, as are decisionOf() (the aside-before-sort tie-break fix) and fillNote()/the render loop (the stale-note-while-focused fix).
• git diff fa7c2e6..c5ec8d3 -- plugins/planning/skills/interview/context/surface.md is also empty — the two prose additions documenting set-aside behavior are unchanged.
• The only content that is this PR's own since fa7c2e6: the routine plugin.json version bump (0.49.2 → 0.49.3) and a CHANGELOG.md entry/reorder — no logic change. (The 0.49.2 changelog entry now visible above this PR's 0.49.3 entry is unrelated origin/main merge content, not authored by this PR.)

Since this PR's own substantive files are unchanged, the prior assessment still holds:

No security issues found. The change operates entirely on locally-owned questions.json/responses.json state read and written by a single trusted local CLI (round.py) and rendered on a localhost-only interview page (index.html). No new network exposure, auth/authz boundary, injection surface (command, SQL, path, template), or secret/token handling. All three previously-open Codex review threads on this PR (own-answer prefill, decisionOf() tie-break, TOCTOU snapshot reuse) remain resolved on this head.
· branch fix/5453-set-aside-stale-own-on-revise

[claude]

Claude finished @kyle-sexton's task in 31s —— View job

---

Code review (/review:code-review)

• Gather context (diff vs origin/main at HEAD c5ec8d3, prior reviews and Codex comments)
• Invoke /review:code-review skill and follow it exactly
• Review the new content added since the last lane pass
• Summary

Skip gate hit: this head already has a successful review from this lane that still applies.

HEAD moved from fa7c2e6 (last full pass, comment) to c5ec8d3 ("chore(planning): merge origin/main, bump to 0.49.3"). Confirmed the move is a no-op for this PR's own content:

• git diff fa7c2e6..c5ec8d3 -- plugins/planning/surface/round.py plugins/planning/surface/index.html plugins/planning/surface/test_round.py plugins/planning/surface/surface.test.sh plugins/planning/surface/tests/ui_journey.js plugins/planning/skills/interview/context/surface.md is empty — every substantive file (set_aside_own() and the guard_revision() snapshot-reuse fix in round.py#L251-L258/round.py#L216-L241; decisionOf()'s aside-before-sort tie-break and fillNote()'s prefill fix in index.html#L504-L510/index.html#L1007-L1010) is byte-identical to what the prior pass already reviewed.
• The only content that changed between the two heads is the routine plugin.json version bump (0.49.2 → 0.49.3) and a CHANGELOG.md reorder placing this PR's own 0.49.3 entry above an unrelated 0.49.2 entry pulled in by the origin/main merge — no logic change.

That prior full pass (and the matching security-lane pass) walked set_aside_own(), the same-write record-terminal race, the exporter set-aside/newest-decision ordering, the guard_revision() TOCTOU fix, the decisionOf() aside-before-sort tie-break fix, and the fillNote()/render-loop fix for the stale-note-while-focused case — and found no blocking issues. All three Codex review threads on this PR (own-answer prefill, decisionOf() tie-break, TOCTOU snapshot reuse) remain resolved on this head.

No new findings to post.

Verification: author-claimed and unverified by me — no new code in this PR's own files to verify in this pass, and I did not independently run python3 -m unittest test_round or surface.test.sh.
· branch fix/5453-set-aside-stale-own-on-revise

[claude]

Claude finished @kyle-sexton's task in 57s —— View job

---

CI security review (/review:security-review)

• Gather context (diff vs origin/main at HEAD ca1939b, changes since last reviewed head c5ec8d3)
• Invoke /review:security-review skill and follow it exactly
• Check skip gate
• Report findings

Skip gate hit: this head already has a successful security review that still applies.

HEAD moved from c5ec8d3 (last full security pass, comment) to ca1939b ("chore(planning): merge origin/main, bump to 0.49.4"). A raw git diff c5ec8d3..ca1939b on index.html/surface.test.sh/tests/ui_journey.js shows a large amount of new content (a hiddenBase/arrivalKeys() mechanism, a title badge for activity that lands while the tab is hidden, and journey phases 8–13 exercising it). I confirmed via gh pr diff 5498 — computed server-side against the real merge base, so it isolates this PR's own authored content from merge noise — that none of that is part of this PR's diff: it's #5522 ("badge the interview page title while the tab is hidden"), already landed on main and pulled in by this branch's routine origin/main merge.

gh pr diff 5498 confirms this PR's own content is unchanged since the last-reviewed head:

• set_aside_own() still takes the shared responses.json snapshot rather than re-reading, and guard_revision() still returns that snapshot for op_reply/op_revise to reuse — the TOCTOU fix is unchanged.
• decisionOf() still marks aside on every candidate before sorting non-aside candidates first, and fillNote() plus the render loop at index.html#L1608-L1610 still clear a set-aside prefill even while the note has focus.
• plugins/planning/skills/interview/context/surface.md carries only the same two prose additions already reviewed; nothing deleted or narrowed.
• The only content that is this PR's own since c5ec8d3: the routine plugin.json version bump (0.49.3 → 0.49.4) and the matching CHANGELOG.md entry — no logic change.

Conclusion: no security issues found, consistent with every prior pass on this PR. The change operates entirely on locally-owned questions.json/responses.json state read and written by a single trusted local CLI (round.py) and rendered on a localhost-only interview page (index.html). No new network exposure, auth/authz boundary, injection surface (command, SQL, path, template), or secret/token handling. All three previously-open Codex review threads on this PR (own-answer prefill, decisionOf() tie-break, TOCTOU snapshot reuse) remain resolved on this head.
· branch fix/5453-set-aside-stale-own-on-revise

[claude]

Claude finished @kyle-sexton's task in 1m 1s —— View job

---

Code review (/review:code-review)

• Gather context (diff vs origin/main at HEAD ca1939b, prior reviews and Codex comments)
• Invoke /review:code-review skill and follow it exactly
• Review the new content added since the last lane pass
• Summary

Skip gate hit: this head already has a successful review from this lane that still applies.

HEAD moved from c5ec8d3 (last full pass, comment) to ca1939b ("chore(planning): merge origin/main, bump to 0.49.4"). I confirmed the move is a no-op for this PR's own content by diffing gh pr diff 5498 (computed server-side against the real merge base, immune to this branch's merge-commit noise) against what the prior pass already reviewed:

• round.py: same hunks — guard_revision() still returns the responses.json snapshot it read (round.py#L213-L237), and set_aside_own() still takes that snapshot as a parameter instead of re-reading (round.py#L251-L258), fed in from op_reply/op_revise (round.py#L529, round.py#L560-L577) — the TOCTOU fix Codex flagged is unchanged.
• index.html: same hunks — decisionOf() still marks aside on every candidate before sorting non-aside candidates first (index.html#L504-L510), fillNote() still excludes an aside decision's text (index.html#L1009-L1011), and the render loop still clears a set-aside prefill even while the note has focus (index.html#L1608-L1610) — both fixes for Codex's two open threads are unchanged.
• surface.md: still exactly the same two prose additions documenting set-aside behavior.
• test_round.py / tests/ui_journey.js / surface.test.sh: TestReviseSetsAsideOwn and journey phases 14/15 are unchanged from the versions already walked in prior passes (the phase numbers shifted from 8/9 to 14/15 only because an unrelated tab-badge feature, merged in from origin/main in d1e8a11/feat(planning): badge the interview page title while the tab is hidden #5522, inserted its own journey phases 8–13 ahead of them — that feature is not part of this PR's own diff).
• Only new content in this PR's own files since c5ec8d3: the routine plugin.json version bump (0.49.3 → 0.49.4) and the matching CHANGELOG.md entry — no logic change.

That prior full pass (and the matching security-lane pass) walked set_aside_own(), the same-write record-terminal race, the exporter set-aside/newest-decision ordering, the guard_revision() TOCTOU fix, the decisionOf() aside-before-sort tie-break fix, and the fillNote()/render-loop fix for the stale-note-while-focused case — and found no blocking issues. All three Codex review threads on this PR (own-answer prefill, decisionOf() tie-break, TOCTOU snapshot reuse) remain resolved on this head.

No new findings to post.

Verification: author-claimed and unverified by me — no new code in this PR's own files to verify in this pass, and I did not independently run python3 -m unittest test_round or surface.test.sh.
· branch fix/5453-set-aside-stale-own-on-revise

[claude]

Claude finished @kyle-sexton's task in 33s —— View job

---

CI security review (/review:security-review)

• Gather context (diff vs origin/main at HEAD 87dfaf5, changes since last reviewed head ca1939b)
• Invoke /review:security-review skill and follow it exactly
• Check skip gate
• Report findings

Skip gate hit: this head already has a successful security review that still applies.

HEAD moved from ca1939b (last full security pass, comment) to 87dfaf5 ("chore(planning): merge origin/main, bump to 0.49.5"). git diff ca1939b..87dfaf5 scoped to this PR's own substantive files (plugins/planning/surface/round.py, plugins/planning/surface/index.html, plugins/planning/surface/test_round.py, plugins/planning/surface/surface.test.sh, plugins/planning/surface/tests/ui_journey.js, plugins/planning/skills/interview/context/surface.md) is empty — byte-identical to what the prior pass already covered:

• set_aside_own() still takes the shared responses.json snapshot rather than re-reading, and guard_revision() still returns that snapshot for op_reply/op_revise to reuse — the TOCTOU fix is unchanged.
• decisionOf() still marks aside on every candidate before sorting non-aside candidates first, and fillNote() plus the render loop still clear a set-aside prefill even while the note has focus.
• surface.md carries only the same two prose additions already reviewed; nothing deleted or narrowed, so the instruction-surface-deletion lens still finds nothing here.

The only content that is this PR's own since ca1939b: the routine plugin.json version bump (0.49.4 → 0.49.5) and a CHANGELOG.md reorder placing this PR's own 0.49.5 entry above an unrelated 0.49.4 entry pulled in by the origin/main merge — no logic change.

Conclusion: no security issues found, consistent with every prior pass on this PR. The change operates entirely on locally-owned questions.json/responses.json state read and written by a single trusted local CLI (round.py) and rendered on a localhost-only interview page (index.html). No new network exposure, auth/authz boundary, injection surface (command, SQL, path, template), or secret/token handling. All three previously-open Codex review threads on this PR (own-answer prefill, decisionOf() tie-break, TOCTOU snapshot reuse) remain resolved on this head.
· branch fix/5453-set-aside-stale-own-on-revise

[claude]

Claude finished @kyle-sexton's task in 1m 1s —— View job

---

Code review (/review:code-review)

• Gather context (diff vs origin/main at HEAD 87dfaf5, prior reviews and Codex comments)
• Invoke /review:code-review skill and follow it exactly
• Review the new content added since the last lane pass
• Summary

Skip gate hit: this head already has a successful review from this lane that still applies.

HEAD moved from ca1939b (last full pass, comment) to 87dfaf5 ("chore(planning): merge origin/main, bump to 0.49.5"). Confirmed the move is a no-op for this PR's own content:

• git diff ca1939b..87dfaf5 -- plugins/planning/surface/round.py plugins/planning/surface/index.html plugins/planning/surface/test_round.py plugins/planning/surface/surface.test.sh plugins/planning/surface/tests/ui_journey.js plugins/planning/skills/interview/context/surface.md is empty — set_aside_own() and the guard_revision() snapshot-reuse fix (TOCTOU) in round.py#L251-L258 / round.py#L216-L241, the decisionOf() aside-before-sort tie-break fix in index.html#L504-L510, and the fillNote()/render-loop fix for the stale-note-while-focused case (index.html#L1009-L1011) are all byte-identical to what the prior pass already reviewed and cleared.
• gh pr diff 5498 --name-only still lists the same 8 files as every prior pass on this PR.
• The only content that changed between the two heads is the routine plugin.json version bump (0.49.4 → 0.49.5) and a CHANGELOG.md entry/reorder — no logic change.

That prior full pass walked set_aside_own(), the same-write record-terminal race, the exporter set-aside/newest-decision ordering, the guard_revision() TOCTOU fix, the decisionOf() aside-before-sort tie-break fix, and the fillNote()/render-loop fix for the stale-note-while-focused case — and found no blocking issues. All three Codex review threads on this PR (own-answer prefill, decisionOf() tie-break, TOCTOU snapshot reuse) remain resolved on this head.

No new findings to post.

Verification: author-claimed and unverified by me — no new code in this PR's own files to verify in this pass, and I did not independently run python3 -m unittest test_round or surface.test.sh.
· branch fix/5453-set-aside-stale-own-on-revise

[claude]

Claude finished @kyle-sexton's task in 1m 8s —— View job

---

CI security review (/review:security-review)

• Gather context (diff vs origin/main at HEAD 79755bd, changes since last reviewed head 87dfaf5)
• Invoke /review:security-review skill and follow it exactly
• Check skip gate
• Report findings

Skip gate hit: this head already has a successful security review that still applies.

HEAD moved from 87dfaf5 (last full security pass, comment) to 79755bd ("chore(planning): merge origin/main, bump to 0.50.2"). gh pr diff 5498 — computed server-side against the real merge base, so it isolates this PR's own authored content from local merge-commit noise — confirms this PR's own content is byte-identical to what the prior pass already covered:

• set_aside_own() in round.py still takes the shared responses.json snapshot rather than re-reading, and guard_revision() still returns that snapshot for op_reply/op_revise to reuse — the TOCTOU fix is unchanged.
• decisionOf() still marks aside on every candidate before sorting non-aside candidates first, and fillNote() plus the render loop at index.html#L1609-L1611 still clear a set-aside prefill even while the note has focus.
• plugins/planning/skills/interview/context/surface.md carries only the same prose additions already reviewed (documenting the set-aside behavior); nothing deleted or narrowed, so the instruction-surface-deletion lens still finds nothing here.

A local git diff 87dfaf5..79755bd on index.html/surface.md shows an unrelated "note looks cut off" nudge feature (DANGLING/midSentence(), #cutNudge) and matching journey-phase wording — I verified via gh pr diff 5498 that none of that is part of this PR's own diff; it's separate origin/main content pulled in by this branch's routine merge. round.py, test_round.py, surface.test.sh, and tests/ui_journey.js are unchanged from the prior pass aside from the journey-phase count bump already reviewed.

The only content that is this PR's own since 87dfaf5: the routine plugin.json version bump (0.49.5 → 0.50.2) and matching CHANGELOG.md entries — no logic change.

Conclusion: no security issues found, consistent with every prior pass on this PR. The change operates entirely on locally-owned questions.json/responses.json state read and written by a single trusted local CLI (round.py) and rendered on a localhost-only interview page (index.html). No new network exposure, auth/authz boundary, injection surface (command, SQL, path, template), or secret/token handling. All three previously-open Codex review threads on this PR (own-answer prefill, decisionOf() tie-break, TOCTOU snapshot reuse) remain resolved on this head.
· branch fix/5453-set-aside-stale-own-on-revise

[claude]

Claude finished @kyle-sexton's task in 1m 4s —— View job

---

Code review (/review:code-review)

• Gather context (diff vs origin/main at HEAD 79755bd, prior reviews and Codex comments)
• Invoke /review:code-review skill and follow it exactly
• Review the new content added since the last lane pass
• Summary

Skip gate hit: this head already has a successful review from this lane that still applies.

HEAD moved from 87dfaf5 (last full pass, comment) to 79755bd ("chore(planning): merge origin/main, bump to 0.50.2"). I pulled gh pr diff 5498 fresh at this head (computed server-side against the real merge base, so it's immune to this branch's merge-commit noise) and read the full diff line by line rather than trusting a name/stat summary — it is unchanged in substance from what the prior full passes already reviewed:

• round.py: guard_revision() still returns the responses.json snapshot it read (round.py#L213-L237), and set_aside_own() still takes that snapshot as a parameter instead of re-reading (round.py#L251-L258), fed in from op_reply/op_revise — the TOCTOU fix Codex raised remains in place.
• index.html: decisionOf() still marks aside on every candidate before sorting non-aside candidates first (index.html#L504-L510) — the same-second tie-break fix. fillNote() still excludes an aside decision's text (index.html#L1012-L1015), and the render loop still clears a set-aside prefill even while the note has focus (index.html#L1612-L1613) — both fixes for Codex's two originally-open threads are unchanged.
• surface.md: still exactly the same two prose additions documenting the set-aside behavior.
• test_round.py / tests/ui_journey.js / surface.test.sh: TestReviseSetsAsideOwn (including test_an_answer_saved_after_the_guard_read_is_not_set_aside, which exercises the TOCTOU fix directly) and journey phases 14/15 (own answer on a page with focus, then the revision, then Ctrl+Enter accepting the revised recommendation rather than resending stale text) are unchanged from what prior passes walked.
• Only new content since 87dfaf5: the routine plugin.json version bump (0.50.1 → 0.50.2) and the matching CHANGELOG.md entry — no logic change. (A "note looks cut off" nudge visible in a raw local git diff 87dfaf5..79755bd on index.html/surface.test.sh is confirmed via gh pr diff to be not part of this PR's own diff — unrelated origin/main merge content.)

That prior full pass walked set_aside_own(), the same-write record-terminal race, the exporter set-aside/newest-decision ordering, the guard_revision() TOCTOU fix, the decisionOf() aside-before-sort tie-break fix, and the fillNote()/render-loop fix for the stale-note-while-focused case — and found no blocking issues. All three Codex review threads on this PR (own-answer prefill, decisionOf() tie-break, TOCTOU snapshot reuse) remain resolved on this head.

No new findings to post.

Verification: author-claimed and unverified by me — no new code in this PR's own files to verify in this pass, and I did not independently run python3 -m unittest test_round or surface.test.sh.
· branch fix/5453-set-aside-stale-own-on-revise