[mariojgt]

Follow-up to #165. That PR gave scan a new source edit and did not update the docs that describe what scan writes, which CLAUDE.md treats as the expensive kind of inaccuracy: "agents audit the shipped docs, so inaccuracies in AGENT-INSTALL.md cost trust and cause refusals."

Three separate claims went stale, all in one sentence:

scan makes one source edit, and only after a successful post: … the first of index.html, public/index.html, or src/app.html … It touches no other file

• there are now two edits, not one
• the marker goes into a JSX root, which is not in that list of files
• it is written before the post, so an offline or || true build still gets the flag

Corrected there and in the scan / setup rows of the command-reference table, the first-scan summary, and the manual-placement step for code roots — which is precisely the step that told an agent to add a widget tag with no marker beside it.

README.md carried the same claims in its command summary and The disclosure widget section; both updated.

Not changed

The install prompt. It already reads "authorize its widget and production build hooks" and "leave dev builds unchanged", which the import.meta.env.PROD gate satisfies exactly — the marker is inert in dev. No new authorization is needed, so the tested artifact stays untouched.

Separate finding, not fixed here

CLAUDE.md states the prompt "appears in three places that must stay identical: README.md, GETTING-STARTED.md, and field-test/prompt.txt". They have drifted:

• GETTING-STARTED.md and field-test/prompt.txt match each other.
• README.md:11 is a different prompt — hosted-workspace variant, adds PATCHSTACK_ENVIRONMENT=sandbox, authorizes "runtime protection source edits", and says regular dependency where the other two say dev dependency.

Two consequences worth a decision: the README ships a prompt the field-test harness never exercises, and the tested prompt asks for a devDependency install, which contradicts README's own warning that "deployments that prune dev dependencies need the package in dependencies" — the shape a real Lovable project has.

Reconciling them means editing the adversarial surface, so it belongs in its own change with a field-test run behind it, not bundled into a docs correction.

Before merging

Docs-only, no code. npm test 1315 passed / 6 skipped, npm run typecheck clean. This touches AGENT-INSTALL.md, so per CLAUDE.md it wants node field-test/run.mjs --persona hostile --rounds 3 — not run, same as #165.

🤖 Generated with Claude Code

[coderbuds]

Documentation clearly describes both the disclosure widget update and new production marker integration.

🎯 Quality: 93% Elite · 📦 Size: Small

📈 This month: Your 63rd PR — above team average · Averaging Excellent

_{See how your team is trending →}

[mariojgt]

Superseded by #171 (same disclosure, rebased onto current main after the credential-file doc updates).

[mariojgt]

Closing in favor of #171.