🤖 fix: harden verify-xum launch, cleanup and recipes (follow-up to #7895)

.xum/skills/verify-xum/SKILL.md

@@ -37,8 +37,12 @@ Surfaces:
 
 ## Launch
 
-The script runs on Linux only: it needs `setsid`, `flock`, `ss` and `/proc`. Bun on PATH must be
-the version in `package.json` `packageManager`. Launch refuses another Bun.
+The script runs on Linux only: it needs `setsid`, `flock`, `ss` and `/proc`. Every command
+refuses a checkout whose git dir (or, for a worktree, its common git dir) is not yours or is
+writable by group or others, and one with a folder above that git dir that is not yours or
+root's, or that group or others can write without the sticky bit: the launch lock and the
+newest-run link live there. Use a checkout of your own, not a shared repository. Bun on PATH must be the version in `package.json`
+`packageManager`. Launch refuses another Bun.
 
 ```bash
 .xum/skills/verify-xum/scripts/verify-xum.sh launch
@@ -185,6 +189,14 @@ Proof standards:
   the worktree alone. A mock run does not prove a change to provider requests or tool execution:
   report that part as not verified, or prove it at that boundary.
 - Capture the action and the resulting state, not only the final screen.
+- Check a UI change at phone width too. Run `agent-browser set viewport 375 812` and
+  `verify-xum.sh idle`, repeat the changed recipe's steps and captures with names that end in
+  `-375`, and look for clipped text, content past the right edge
+  (`agent-browser eval 'document.documentElement.scrollWidth <= innerWidth'` prints `true`) and
+  controls that cover each other. When the phone layout reaches a step's control another way, or
+  does not show it, follow the phone layout's own path to it or capture that it is absent, and
+  say which. Run `agent-browser set viewport 1280 720` afterwards. A change with no UI needs no
+  phone pass: say so.
 - Check side effects next to what is visible: rows in
   `$VERIFY_XUM_ROOT/sessions/<workspace id>/chat.jsonl`, entries in `$VERIFY_XUM_ROOT/config.json`,
   git state in the worktree, or the CLI view above.

.xum/skills/verify-xum/features/command-palette.md

@@ -26,17 +26,17 @@ Preconditions:
   `agent-browser wait '[aria-label="Command palette"]'` and
   `agent-browser wait '[role="listbox"][aria-label="Suggestions"] [role="option"]'`: on the first
   open of a page the list fills a moment after the combobox shows. The combobox
-  `Command palette` is expanded, with the listbox `Suggestions`. Run `agent-browser press Escape`.
-  The combobox is gone.
-- **Switch workspace.** Read the id with `RN_ID=$(verify-xum.sh workspace-field release-notes id)`
-  (see [workspaces](./workspaces.md) **Open from the sidebar**). Press Ctrl+Shift+P, wait for the
-  palette as above, then run
+  `Command palette` is expanded, with the listbox `Suggestions`. Run `agent-browser press Escape`
+  and `agent-browser wait --fn '!document.querySelector("[aria-label=\"Command palette\"]")'`.
+  The combobox is gone. The press can return before the palette closes, and the next shortcut
+  would then close the palette that is still open instead of opening it.
+- **Switch workspace.** Press Ctrl+Shift+P, wait for the palette as above, then run
   `agent-browser keyboard type "release"` and
   `agent-browser wait '[role="option"][aria-selected="true"][aria-label="release-notes"]'`.
   `Suggestions` lists the option `release-notes`, selected. Run `agent-browser press Enter` and
-  `agent-browser wait --url "**/workspace/$RN_ID"`: the palette closes first and navigates a
-  moment later. The URL is `/workspace/$RN_ID`. Capture
-  `command-palette/switched`.
+  `agent-browser wait --url "**/workspace/$(verify-xum.sh workspace-field release-notes id)"`:
+  the palette closes first and navigates a moment later. The URL is the `release-notes`
+  workspace's. Capture `command-palette/switched`.
 - **Command mode.** Run `agent-browser press F4` and
   `agent-browser wait '[aria-label="Command palette"]'`. The combobox value is `>`, and
   `Suggestions` lists commands such as `Open Settings` and `Change Model…`.

.xum/skills/verify-xum/features/review.md

@@ -61,9 +61,11 @@ Preconditions:
   `$VERIFY_XUM_ROOT/sessions/$VERIFY_XUM_WORKSPACE_ID/review-state.json` has `"isRead": true` for
   that hunk. Capture `review/read`.
 
-- **Keyboard toggle.** Run `agent-browser press Control+Shift+B`. The sidebar collapses, and the
-  button `Expand right sidebar` is back. Run `agent-browser press Control+Shift+B` again. The
-  button reads `Collapse right sidebar`, and the tab `Review 1/1 Close Review` is selected.
+- **Keyboard toggle.** Run `agent-browser press Control+Shift+B` and
+  `agent-browser wait '[aria-label="Expand right sidebar"]'`. The sidebar collapses, and the
+  button `Expand right sidebar` is back. Run `agent-browser press Control+Shift+B` again and
+  `agent-browser wait '[aria-label="Collapse right sidebar"]'`. The button reads
+  `Collapse right sidebar`, and the tab `Review 1/1 Close Review` is selected.
 - **Restore.** The sidebar slid open again: run `verify-xum.sh idle`, then
   `agent-browser find role button click --name "Mark as read (M)" --exact`. The tab reads
   `Review 0/1` at once, and the app writes `review-state.json` a moment later. Wait for

.xum/skills/verify-xum/features/workspaces.md

@@ -89,10 +89,10 @@ Preconditions:
   `agent-browser wait '[aria-label="Restore workspace release-notes"]'`. The region
   `Archived workspaces` lists `release-notes` and `scratch-notes`. Run
   `agent-browser find role button click --name "Restore workspace release-notes" --exact`, then
-  wait for the result with `agent-browser wait --url "**/workspace/$RN_ID"` (`RN_ID` as in
-  **Open from the sidebar**) and
-  `agent-browser wait '[aria-label="Select workspace release-notes"]'`. The app is on
-  `/workspace/$RN_ID`, the sidebar row is back, and `config.json` has an
+  wait for the result in the same bash call with
+  `agent-browser wait --url "**/workspace/$(verify-xum.sh workspace-field release-notes id)"` and
+  `agent-browser wait '[aria-label="Select workspace release-notes"]'`. The app is on the
+  `release-notes` workspace URL, the sidebar row is back, and `config.json` has an
   `unarchivedAt` time for it. Capture `workspaces/restored`.
 - **CLI view.** List the workspaces through the CLI: