`CHANGES2.md`

9 lines
## Round 2 Applied
- server.js:5 — imported `fsConstants` from `node:fs` — needed so executable checks can use `X_OK` instead of existence-only access (CODEX_REREVIEW.md “New issues introduced” server.js:225/server.js:231 and “Recommendations”).
- server.js:224 — updated `assertExecutable()` to reject directories and require execute permission for absolute/relative `CLAUDE_CLI` paths and `PATH` candidates — fixes `/health/deep` false positives where non-executable files could report `claude_cli: ok` while `spawn()` would later fail (CODEX_REREVIEW.md “STATUS concern” and P2 new issues at server.js:225/server.js:231).

## Still Deferred
- CODEX_REREVIEW.md listed no missed call-sites.
- No P0/P1 mechanical regressions were listed in CODEX_REREVIEW.md beyond the executable-check concern fixed above.
- Original deferred security/workflow issues from CHANGES.md remain for Steve because they require policy or broader design decisions outside this round’s safe scope: auth/CSRF for mutating routes, generated HTML sandboxing/CSP/network policy, retry/cancellation semantics, render dimension bounds, artifact path trust, activation validation/atomicity, vision approval policy, crash-stage logging semantics, offline font/network behavior, and the missing package script.