Loops docs (#120): resolve review findings before Phase 2 is built

[radroid]

#120 merged as 3d91c5754 after four independent reviews. All four returned no merge blockers — the docs are internally sound enough to merge, and every load-bearing [V] claim about the tree reproduced exactly. These are the findings that survived, all of which land before anyone builds Phase 2 from the plan, not before merge.

A. Contradictions across the document set

1. The deference cap's precondition is asserted, disputed and refuted in three files. This is the single load-bearing correction of the final revision, and it did not propagate. BACKEND.md:334-337 flags "reject arming without a deadline" as an unresolved change to §3's contract; PLAN.md:135-136, :316-320, :489-503 state the deadline bound with no caveat; TESTS.md:94 case 15 treats a null deadline as supported. Worse, BACKEND.md:288-290 and guard 10b at :529 make deadlineAtMs == null mean no deference at all, so a deadline-less loop fires on top of a healthy self-pacing thread — the exact case BACKEND.md:47 declares impossible. Untested in both directions under a stated 100%-branch gate (TESTS.md:387).
2. Console precedence reverses the report's own recommendation, undeclared. FINDINGS.md:269 records it as the user's requirement and p7-console-shapes.html:292 (Shape A, the recommended shape) both say opening a loop lands on the console; PLAN.md:193-195 decides the opposite and attributes the rejection to [Feature]: supervise long-running threads — turns complete while background subagents are still working, and nothing restarts the run #38 only.
3. Phase 4 acceptance contradicts the guard table. PLAN.md:383 says master-toggle-off ⇒ "no fiber" and "stand down at next tick" — a tick requires a fiber. p4-settings.html:286-287 ships the wrong half in user-facing help text.
4. Grace boundary disagrees between adjacent cases. TESTS.md:60-61 (11e) exclusive vs :87 (11k) inclusive; guard 10b is inclusive, so 11e is the wrong one.
5. PLAN.md:104 D2 says "never session.status" without BACKEND's scoping — PLAN never mentions idleMs/busyIdleMs, so a reader building from PLAN alone drops the long-tool-call case.
6. The superseded-design pointer (docs/coil/loop/DESIGN.md:3-7) names feat: native subagent & workflow observability pingdotgg/t3code#5219 and feat: scheduled tasks (automations) pingdotgg/t3code#3638 as the premises that "did not survive" — both re-checks actually came back confirming. The three premises that moved are in FINDINGS.md:20-91.

B. Designed but unscoped

7. store.global.enabled is the headline kill switch with no data model, no route and no test. BACKEND.md:210-273 defines only LoopRecord and Blocker; §10's four routes never touch global settings. Sequencing consequence: Phase 2 ships "default off behind the master toggle" but only Phase 4 can flip it — phases 2 and 3 are unswitchable as ordered.
8. Push notifications and mobile surfacing are designed in the report (report.src.html:1175-1187) and named in scope (PLAN.md:140-141) but have no phase, no seam line, no acceptance criteria and no tests. PLAN.md:480 cites push-copy assertions that do not exist.
9. Sidebar/mobile row chrome: deferred in the report, priced at 0 rows in PLAN, asserted as a requirement in p8-mobile.html:655-657. A budget on the mobile row is a mobile seam row.
10. gate_off is declared user-visible and starred in TESTS.md:68, but appears in no prototype and has no source test.

C. Tooling

11. build-report.mjs can silently drop a prototype. The guard at :77 only fires when zero markers match; a single drifted marker (the hint regex terminates on > and splits on |) emits a report missing that frame, invisible in the browser and in a 15k-line diff. Reproduced: 7 inlined, no error. There is also no check that every file in prototypes/ is referenced. Fix: assert the count.
12. docs/coil/loop/DESIGN.md contains a /Users/<username>/… path (pre-existing, already public).

Considered and rejected: adding report.html linguist-generated -diff to .gitattributes. .gitattributes is upstream-owned, so it would buy a diff-noise improvement at the cost of a permanent seam row — the wrong trade for this fork, especially since a fork-only path cannot conflict during a rebase anyway.

D. Already stale — arriving in the current upstream sync

Both anchored facts changed upstream after the docs' merge-base cebac353d, and both weaken a stated rationale:

• f70eeeeb0 (fix(clients): move settled pinned threads into the settled section pingdotgg/t3code#7969, 2026-08-23) inverted pin-vs-settle. Upstream now reads "Settled and snoozed threads remain in their respective shelves even when pinned" — order moved from snooze>pin>settled to snooze>settled>pin. Loop-as-pinned-thread (D3) no longer keeps a settled loop visible.
• c7222ca4d (feat(claude): compact old threads before they burn through usage pingdotgg/t3code#8144, 2026-08-25) added a second blocking dialog — onUserDialog with supportedDialogKinds: ["resume_return"] routes into the same blocking Deferred as AskUserQuestion, and fires on session resume. The loop's own nudge can therefore manufacture a pending user-input that the plan's pending-input guard then treats as a hard skip.
• Churn figures in UPSTREAM-DELTA.md:209-215 (RightPanelTabs.tsx now +265/-86, not +13) and :52 (Sidebar.logic.ts now +22/-7, not unchanged) have moved. PLAN.md's churn/risk figures reproduce only against the older base a4cc1367b, not the stated cebac353d.

The 2-row answer to #112 and the 3-row phase 1–4 total both still hold.