docs(roadmap): file the macOS-only background-notice flake; close out session C

ROADMAP.md

@@ -43,7 +43,7 @@ Target: `v1.3`
 | Area | Open | Needs verify | Decisions | Parked |
 |---|---|---|---|---|
 | [native-harness](docs/roadmap/native-harness.md) — the app's own agent doing work | 51 | 8 | 0 | 16 |
-| [dev-workspace](docs/roadmap/dev-workspace.md) — building the app, not the app | 39 | 19 | 0 | 8 |
+| [dev-workspace](docs/roadmap/dev-workspace.md) — building the app, not the app | 40 | 20 | 0 | 8 |
 | [user-interface](docs/roadmap/user-interface.md) — shared primitives, chrome, layout, copy | 27 | 17 | 0 | 5 |
 | [files](docs/roadmap/files.md) — documents the user opens, edits or organises | 21 | 5 | 0 | 9 |
 | [marketplace](docs/roadmap/marketplace.md) — finding, installing and rating plugins and themes | 18 | 6 | 0 | 3 |

docs/active/handoffs/2026-09-02-session-c-report.md

@@ -7,7 +7,8 @@ topic: overnight session C — making the verification tooling honest
 
 # Session C — the verification tooling now tells the truth about itself
 
-**PRs:** youcoded#384 (the app's test tree) · youcoded-dev#19 (the workspace tooling).
+**PRs, both MERGED:** youcoded#384 -> `da955301` (the app's test tree) · youcoded-dev#19 ->
+`ba0566c` (the workspace tooling).
 Headless throughout — no dev window, no `run-dev.sh`.
 
 The short version: **three of the eight filed items were already fixed on `master`** and only
@@ -283,3 +284,32 @@ worst.
 5. **Type-aware ESLint rules on `tests/**`** — blocked on (1).
 6. **`docs/roadmap/dev-workspace.md`'s macOS sync-spaces flake** was not touched; it needs the
    macOS CI leg, which this machine is not.
+
+
+---
+
+## Addendum — the one CI failure, and why it was not mine
+
+youcoded#384's first run went green on Ubuntu, Windows and the Android leg, and **red on macOS**:
+
+```
+FAIL tests/native-session-host.test.ts > G-1 background Bash > a finished run is injected ONCE …
+AssertionError: expected '[Background command sh-4c82 finished …' to match
+  /^\[Background command sh-4c82 finished · exit 2 · \d+s\]\n\$ echo done; exit 2\ndone\nFull log: /
+```
+
+Three things established it was not this branch:
+
+1. **The diff does not reach it.** That test is at line 4969; every hunk this branch touches in
+   that file is between 2407 and 3631 (`git diff --stat` per hunk).
+2. **The macOS leg is already flaky on master.** `master`'s own run 33615851775, five hours
+   earlier and with no PR involved, failed macOS on `sync-spaces-engine` — a separate, already-filed
+   entry. Ubuntu and Windows passed the same commit.
+3. **A plain re-run of the identical commit passed**, no code change: macos-latest `success`.
+   The suite took 317 s on that runner against 37 s locally, which is the load signature.
+
+Filed as its own roadmap entry rather than fixed here, because the honest reading is not settled:
+the notice arriving without the command's stdout may be a test race OR a real product race in the
+finished-notice composer — in which case a user on a slow machine sees a background command report
+finished with none of its output. Deciding that needs a reproduction on macOS, which this machine
+is not, and guessing a fix would paper over the second possibility.

docs/roadmap/dev-workspace.md

@@ -4,6 +4,14 @@ seen-on is always n/a here.
 
 ## tests
 
+- [ ] `native-session-host` "a finished run is injected ONCE as a user turn with injected:
+      shell-complete" fails on the macOS CI leg only: the finished-notice text arrives without the
+      command's own output ("done"), so the exact-match regex misses. Passed on a plain re-run of
+      the same commit, and the same suite is green in 27 local runs — but if it is real rather
+      than a test race, a user on a slow machine sees a background command report finished with
+      no output
+      `n/a` `needs-verify` `checked 2026-09-02` `regression`
+
 - [ ] Coverage debt from the feature-flow build: nothing renders the contract table or its
       verdict column in a browser test, the close-out Contract section runs only locally so no
       unattended check guards it, and an empty verdict, a two-hash source, a corrupt verdicts file