fix(pty-runner): active-render gate veto in the floor check + honest periodic-wiring docs

Codex re-review P2s on the fix wave, both verified:

- A finding AUQ rendering within TAIL_SCAN_BYTES of the gate (model waiting,
  no further output) was vetoed by the blanket tail exclusion until timeout.
  The veto is now ACTIVE-RENDER-aware: parseNumberedOptions anchors the last
  cursor menu, so only a pending GATE menu vetoes; the judge fallback shares
  the same check. Residual (documented): prose gate + prose finding inside
  one tail — floors run the native-menu path in practice.
- The four demoted periodic tests are not in evals-periodic.yml's explicit
  matrix (a named instance of the pre-existing periodic-orphans TODO), so
  they run locally/manually until the PTY-capable periodic job lands.
  CHANGELOG claim softened accordingly; TODO filed with the wiring recipe.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/helpers/claude-pty-runner.scope-gate-floor.unit.test.ts

@@ -34,6 +34,7 @@ import {
   isPermissionDialogVisible,
   isScopeGateQuestionVisible,
   isScopeGateAutoSelectVisible,
+  parseNumberedOptions,
 } from './claude-pty-runner';
 
 // The gate's native AskUserQuestion render (numbered options + cursor) —
@@ -107,6 +108,26 @@ describe('floor-check scope-gate exclusion (acceptance-condition regression)', (
     const tail = GATE_NATIVE_RENDER.slice(-TAIL_SCAN_BYTES);
     expect(isScopeGateQuestionVisible(tail)).toBe(true);
   });
+
+  test('active-render veto: a finding AUQ close after the gate is NOT vetoed (codex P2 re-review)', () => {
+    // The finding menu renders <TAIL_SCAN_BYTES after the gate, then the
+    // model waits (no further output). A blanket tail veto would suppress
+    // this until timeout; the active-render veto anchors on the LAST cursor
+    // menu, which is the finding AUQ, so the floor is satisfiable.
+    const visible = GATE_NATIVE_RENDER + '\nAuditing the plan…\n' + FINDING_AUQ_RENDER;
+    const activeMenu = parseNumberedOptions(visible);
+    expect(activeMenu.length).toBeGreaterThan(0);
+    const gateIsActiveRender = activeMenu.some((o) => /current\s*branch\s*diff/i.test(o.label));
+    expect(gateIsActiveRender).toBe(false);
+  });
+
+  test('active-render veto: the gate as the pending menu IS vetoed', () => {
+    const visible = 'booting…\n' + GATE_NATIVE_RENDER;
+    const activeMenu = parseNumberedOptions(visible);
+    expect(activeMenu.length).toBeGreaterThan(0);
+    const gateIsActiveRender = activeMenu.some((o) => /current\s*branch\s*diff/i.test(o.label));
+    expect(gateIsActiveRender).toBe(true);
+  });
 });
 
 describe('isScopeGateAutoSelectVisible collapsed hyphen-less branch', () => {

test/helpers/claude-pty-runner.ts

@@ -2260,14 +2260,27 @@ export async function runPlanSkillFloorCheck(opts: {
       // gate render has been seen, acceptance scans only the content APPENDED
       // after it (positional anchor above) — the buffer is append-only, so a
       // whole-buffer acceptance would keep matching the stale gate render
-      // forever. The tail exclusion additionally covers the window where the
-      // gate menu is still the active render.
+      // forever.
+      //
+      // The gate veto is ACTIVE-RENDER-aware, not blanket-tail: when a
+      // numbered menu is up, parseNumberedOptions anchors on the LAST cursor
+      // line, so we veto only when the pending menu IS the gate — a finding
+      // AUQ that renders within TAIL_SCAN_BYTES of the gate (model waiting,
+      // no further output) still satisfies the floor. Prose renders have no
+      // cursor anchor, so the prose path falls back to the tail check
+      // (accepted residual: prose gate + prose finding inside one tail can
+      // suppress until timeout; floors run the native-menu path in practice).
       const tail = visible.slice(-TAIL_SCAN_BYTES);
       const acceptWindow = gateSeenIdx === -1 ? visible : visible.slice(gateSeenIdx);
+      const activeMenu = parseNumberedOptions(visible);
+      const gateIsActiveRender =
+        activeMenu.length > 0
+          ? activeMenu.some((o) => /current\s*branch\s*diff/i.test(o.label))
+          : isScopeGateQuestionVisible(tail);
       if (
         (isNumberedOptionListVisible(acceptWindow) || isProseAUQVisible(acceptWindow)) &&
         !isPermissionDialogVisible(tail) &&
-        !isScopeGateQuestionVisible(tail)
+        !gateIsActiveRender
       ) {
         return {
           auqObserved: true,
@@ -2291,8 +2304,9 @@ export async function runPlanSkillFloorCheck(opts: {
         lastJudgeVerdict = judgePtyState(visible, { testName: opts.skillName });
         // The judge can't tell a scope-gate question from a finding question,
         // so a 'waiting' verdict while the gate menu is the pending render
-        // must NOT satisfy the floor — same exclusion as the regex path.
-        if (lastJudgeVerdict.state === 'waiting' && !isScopeGateQuestionVisible(tail)) {
+        // must NOT satisfy the floor — same active-render exclusion as the
+        // regex path.
+        if (lastJudgeVerdict.state === 'waiting' && !gateIsActiveRender) {
           return {
             auqObserved: true,
             outcome: 'auq_observed',