T16: reviewed, ticked

tasks/reviews.md

@@ -80,3 +80,9 @@ Each task gets at most three codex rounds. Each round: the commit, the verdict,
 - Round 1, a8a30d3: FAIL. After a folder change the old view stayed until the new read landed, so an action pressed in between reached the repository left behind; a diff still loading from the old folder popped up over the new one; a slow commit's success emptied a draft typed while it ran. Fixed in 27270ae: no action runs until the shown folder has read, and the view blanks on a folder outside the shown work tree; a folder change drops a diff still loading; a commit empties only the fields that still hold what it committed; actions chain, each after the one asked before it, a race of the same kind found while fixing.
 - Round 2, 27270ae: FAIL. Entering a nested repository kept the outer view while it read, and a commit finishing then emptied a retyped draft: its completion checked the view, not the read. Fixed in fcd0792: the completion passes the same gate as every action.
 - Round 3, fcd0792: PASS.
+
+## T16
+
+- Round 1, 3e1535e: FAIL. The shell check asked only for an execute bit, so a file the running user may not run, as 0641 or an execute-deny ACL, saved and then failed every new session; a bare name counted relative PATH folders, which hang on each session's own folder, so the check and the start could find different programs. Fixed in 3c51b01: the check asks access(X_OK), and a bare name looks only in PATH's full folders; a session runs the full path the check found.
+- Round 2, 3c51b01: FAIL. On Windows the .exe candidate replaced an explicit extension, so review.com saved and review.exe ran; a program found at a path not in UTF-8 saved, though the start takes UTF-8 and refused it. Fixed in 9e69288: .exe joins only a name without an extension; the shared resolver returns the program as UTF-8 text and refuses a match that is not, before the save.
+- Round 3, 9e69288: PASS.