Record the second review of task 23 and the findings first left out

The review table gains findings 16 to 20, which the two review agents
reported and the first write-up dropped. The independent review of the fix
commits, and what was changed for it, is recorded; task 23's claims about
its tests are corrected. The spec and decisions record the day-long cap, the
ttl_ms bound, the socket-directory rule and the listener's retry.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

docs/specs/2026-09-18-m3a-decision-path.md

@@ -98,7 +98,7 @@ broker = "/var/lib/boxmaker/run/loop-broker/broker.sock"
 admin = "/var/lib/boxmaker/run/owner-broker/admin.sock"
 
 [approvals]
-ttl_ms = 900000                       # 15 min
+ttl_ms = 900000                       # 15 min; 1 to 86400000 (a day), else a config error
 ```
 
 A socket path that is absent or empty means the default under `home`, as in `loopd`.
@@ -553,7 +553,10 @@ Nothing is truncated, rewritten or deleted, ever.
 
 `brokerd` creates each directory if it is missing and sets its mode to 0700 whether it made it or
 found it (a failure to do so is a startup error), removes a stale socket file, binds, and sets the
-socket to 0600. All of this comes after the audit lock is taken (section 5, "Startup"): the lock
+socket to 0600. It refuses a socket whose directory is `/` or a symbolic link, since the mode
+change would land on `/` or on the link's target (added after the M3a review). Once serving, a
+listener that runs out of file descriptors or memory pauses and retries; any other `accept`
+failure stops `brokerd` (`see docs/runbook.md#brokerd-listener-lost`). All of this comes after the audit lock is taken (section 5, "Startup"): the lock
 is what proves the socket file is stale and not another `brokerd`'s.
 
 Any other message kind on a socket is answered with `error` `forbidden`, and the connection is
@@ -692,7 +695,10 @@ processes, output size) are M3b's.
   `fn call(&self, req: &ToolRequest, on_pending: &mut dyn FnMut(&Pending)) -> ToolResponse`.
   `BrokerPort` waits for the first frame until `[broker] timeout_ms` (default 120,000) after the
   call began, and after a pending frame until the frame's `expires` plus `timeout_ms`, which
-  leaves a call approved at the last moment the same time to run as any other. These are
+  leaves a call approved at the last moment the same time to run as any other. The wait before
+  that `timeout_ms` is never more than a day (`MAX_PENDING_WAIT`), whatever `expires` says, and
+  `brokerd` refuses a `ttl_ms` over a day, so the two agree (added after the M3a review: a far
+  `expires` parked a turn for ever). These are
   deadlines, not per-read socket timeouts: a peer that trickles bytes must not hold a turn for
   ever. (Unlike the inference path's liveness rule, this is a total limit.) M3b must keep its tool
   time limit under `timeout_ms`. If the socket cannot be reached, closes early or times out, the