T37: reviewed, ticked

tasks/reviews.md

@@ -182,3 +182,8 @@ Each task gets at most three codex rounds. Each round: the commit, the verdict,
 
 - Round 1, 42b272e: FAIL. A clear dropped the records before its other pairs were checked, so a clear with a newline in its msg emptied them; only the last of a repeated key was checked, so an earlier app over 32 bytes passed; the 4096-byte bound counted the body after the scanner skipped its controls, so 5018 bytes passed; the scanner left an escape at DEL or a high byte, which vte passes by, so `ESC DEL c` reset the screen and kept the records. Fixed in 4a269cb: every pair of a known key is checked, a clear's too, before the last of each wins; the scanner counts a sequence from OSC through ST with its skipped controls; the scanners and the prompt rewrite pass DEL and high bytes by in an escape.
 - Round 2, 4a269cb: PASS. The reviewer's probes failed on 42b272e and passed on 4a269cb at every read split; in the app on macOS the clear with a newline, the repeated long app and the 5018-byte report were refused, a full reset emptied the records, and a program read the query's answer before DA1's. CI runs 1089 on 42b272e and 1090 on 4a269cb passed on macOS, Ubuntu and Windows.
+
+## T37
+
+- Round 1, ef33a0d: FAIL. OSC 99's base64 was decoded and checked as UTF-8 chunk by chunk, so a payload split inside a group or inside a character dropped; decoded text was refused for a newline, which only plain text may not hold; the scanner bounded the whole body at 4096 bytes, so a full 4096-byte encoded payload with its metadata dropped and its next chunk showed alone. Fixed in 628ed6b: base64 is read group by group, so chunks split before encoding or after join, and the text is checked as UTF-8 once whole; plain text alone refuses controls; a chunk that breaks a rule drops what its notification gathered; the scanner keeps an OSC 99 body to 5124 bytes, room for 1024 bytes of metadata and a full payload.
+- Round 2, 628ed6b: PASS. In the app on macOS the round 1 probes gave Hello, the split emoji, both lines of the body and 3072 `a`s with END; boundary probes passed 1,627 chunkings after encoding and 433 before, and the scanner 5,140 read splits; the round 1 probes failed again on ef33a0d and with the scanner's old bound. CI runs 1093 on ef33a0d and 1095 on 628ed6b passed on macOS, Ubuntu and Windows.