docs: review round 1 --- four accuracy defects, one of them a bad command

None changes a decision; all four were claims a reader would check and
find false.

**The durable diagnosis command did not run the pair it claimed.**
`m4_24_` is a PREFIX matching **18** tests, so the recorded invocation
would report roughly 16/2 contaminated and 18/0 clean --- not the 0/2
and 2/2 beside it. A reader following it would see a mostly-green run
and conclude the hazard was mis-diagnosed. Replaced with **four literal
`--exact` invocations, one test each**, every one of them executed
before being written down: `running 1 test`, `171 filtered out`,
contaminated `0 passed; 1 failed` panicking at `:5668:5` and `:6615:5`,
clean `1 passed; 0 failed` with no panic. The block now also says to
read the `running N tests` line, pointing at the libtest-filter bullet
two entries below --- which is the trap that produced this defect in the
first place.

**"The diff touches only `pmacs-gpu/src/main.rs`" -> "the whole
EXECUTABLE diff".** The branch changes six files, five under `docs/`.
The structural argument was always about linkage, not file count, but as
written it was simply false and the first `git diff --name-only` would
say so. Fixed in both the ledger and the handoff.

**"a headless test can drive every family"** contradicted the keyboard
exception three paragraphs below it. Now says every family whose event
winit lets a test construct --- all of them except keyboard --- and
points at `route_keyboard` for how far that reaches.

**`[KeyboardRoute::Press]` names a type that does not exist.** It was
renamed to `KeyAction` when the payload moved onto `Route::Keyboard`,
and this doc link was left behind pointing at nothing.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016bqGA6s9tTUFzYpbeW3tai

docs/active-work.md

@@ -331,20 +331,24 @@ waits for a signal that is not coming.
   `m4_24_d3_fallback_base_is_the_smallest_attachment_dir` — two LSP
   file-watcher tests — with every other target green. Established as
   environmental three ways, in increasing strength:
-  - **Structurally impossible for this branch to cause.** The diff
+  - **Structurally impossible for this branch to cause.** The branch
-    touches only `pmacs-gpu/src/main.rs`; `pmacs-gpu` is a workspace
+    changes six files, five of them under `docs/`; **the whole
-    **member but not a dependency** of the root package, so the
+    executable diff is `pmacs-gpu/src/main.rs`**, and `pmacs-gpu` is a
-    `m4_acceptance` binary never links it.
+    workspace **member but not a dependency** of the root package, so
+    the `m4_acceptance` binary never links it.
   - **The marker is older than the session.** `/tmp/.git` is empty and
     was created at 20:14 CEST, **3.5 h before** the gate run at 23:45;
     `/tmp` held 8,920 entries. That is handoff §1's recorded hazard
     exactly.
   - **A discriminating pair compared on SIGNATURE, not test name**, same
-    binary and commit, one variable. `TMPDIR=/tmp` → **0/2**, panicking
+    binary and commit, one variable — run as **four literal `--exact`
-    at `m4_acceptance.rs:5668:5` and `:6615:5` with `.received = ""` —
+    invocations, one test each**, since `m4_24_` is a prefix matching
-    **byte-identical to the gate red's own signature**.
+    **18** tests. Contaminated: `0 passed; 1 failed` each, panicking at
-    `TMPDIR=<marker-free>` → **2/2 with zero panics**. A rerun would
+    `m4_acceptance.rs:5668:5` and `:6615:5` with `.received = ""`,
-    have established only intermittence; the pair establishes the cause.
+    **matching the gate red's own signature**. Clean: `1 passed; 0
+    failed` each, **zero panics**. The exact commands are in handoff
+    §1's hazard bullet. A rerun would have established only
+    intermittence; the pair establishes the cause.
 
   **`scripts/gate` isolates the target dir and five ambient roots but
   NOT `TMPDIR`** — recorded in handoff §1, where the standing fix is

docs/agent-handoff.md

@@ -215,25 +215,43 @@ commands, read `docs/active-work.md` immediately after this file.
     FROM IT.** The gate isolates the target directory and five ambient
     roots but **not `TMPDIR`**, so `tempfile::tempdir()` still lands
     under a `/tmp` that may carry a marker. It surfaced inside a gate
-    run on an unrelated lane (GUI 1-pre, which touches only
+    run on an unrelated lane (GUI 1-pre, whose whole **executable** diff
-    `pmacs-gpu/src/main.rs`) as **`m4_24_bare_string_glob_stays_relative`
+    is `pmacs-gpu/src/main.rs`) as **`m4_24_bare_string_glob_stays_relative`
     and `m4_24_d3_fallback_base_is_the_smallest_attachment_dir`**, in
     both the `m4` step and the `--workspace` sweep, with every other
     target in the corpus green.
 
     **Diagnose it with the discriminating pair, not a rerun** — same
-    binary, same commit, one variable:
+    binary, same commit, one variable. **Four literal `--exact`
+    invocations, one test each**, because `m4_24_` is a PREFIX matching
+    **18** tests and a prefix run reports ~16/2 and 18/0 rather than the
+    0/1 and 1/0 that make the pair readable:
 
     ```sh
-    TMPDIR=/tmp                 cargo test --test m4_acceptance -- m4_24_   # 0/2
+    C=<marker-free dir>   # outside /tmp AND outside every git worktree
-    TMPDIR=<marker-free dir>    cargo test --test m4_acceptance -- m4_24_   # 2/2
+
+    TMPDIR=/tmp cargo test --test m4_acceptance -- \
+      --exact m4_24_bare_string_glob_stays_relative                 # 0 passed; 1 failed
+    TMPDIR=$C   cargo test --test m4_acceptance -- \
+      --exact m4_24_bare_string_glob_stays_relative                 # 1 passed; 0 failed
+
+    TMPDIR=/tmp cargo test --test m4_acceptance -- \
+      --exact m4_24_d3_fallback_base_is_the_smallest_attachment_dir # 0 passed; 1 failed
+    TMPDIR=$C   cargo test --test m4_acceptance -- \
+      --exact m4_24_d3_fallback_base_is_the_smallest_attachment_dir # 1 passed; 0 failed
     ```
 
+    Each prints `running 1 test` and `171 filtered out`. **Read that
+    line** — see the libtest-filter bullet below for why a filter that
+    reaches nothing still prints green.
+
     Check the ancestors of the temp root for `.git`, `Cargo.toml` and
     friends before believing any markerless-fixture red, and **compare
-    SIGNATURES, not test names** — here both runs matched on panic site
+    SIGNATURES, not test names** — the contaminated legs panic at
-    (`:5668:5`, `:6615:5`) and on `.received = ""`, which is what makes
+    `m4_acceptance.rs:5668:5` and `:6615:5` with `.received = ""`,
-    the pair evidence rather than coincidence.
+    matching the gate red's own signature, and the clean legs panic
+    nowhere. That is what makes the pair evidence rather than
+    coincidence.
 
     **The isolated `TMPDIR` must be outside `/tmp` AND outside every git
     worktree.** A child of `/tmp` is not isolated: `/tmp/.git` is still

pmacs-gpu/src/main.rs

@@ -3135,7 +3135,7 @@ impl App {
         }
     }
 
-    /// Perform [`KeyboardRoute::Press`]. The router has already
+    /// Perform [`KeyAction::Press`]. The router has already
     /// discarded key-ups, so `key` is always a press.
     #[allow(clippy::too_many_lines)] // one linear key pipeline; splitting hides the order.
     fn apply_keyboard(&mut self, key: &KeyEvent) -> EventOutcome {
@@ -3342,8 +3342,10 @@ impl App {
 ///
 /// The seam splits the two halves. **Deciding** is [`route_event`] — a
 /// free function over `&WindowEvent` alone, so a headless test can drive
-/// every family. **Performing** stays on `App`, in the `apply_*` methods
+/// it for **every family whose event winit lets a test construct**,
-/// the router's variants name.
+/// which is all of them except keyboard; see [`route_keyboard`] for that
+/// exception and how far it reaches. **Performing** stays on `App`, in
+/// the `apply_*` methods the router's variants name.
 ///
 /// The decision is what the route *is*, not merely which family claims
 /// it: `Exit` is the local exit effect, `Resize` carries the clamped