docs(changelog): fix round 4.5b2 part A, the review's findings as known issues

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -209,6 +209,12 @@ Fix round 4.5a (decisions 57, 67 and 68): the round's 30 findings, where a Voyag
 - **Other spellings of the heredoc operator for a second shell still pass** (fix round 4.5b2 part A, decision 107). Other spellings that build the parser's heredoc operator or word for a second shell still pass and expand or close early: a quoted `<<` next to the word (`'<<'`), `<` and `<` in two strings, the word held in a variable, an empty quote pair before the word inside a string (decision 125), and a form on one physical line. Only `\<\<` with a line after it is checked (EVL), and it is checked with or without a second shell, so `\<\<` before the word with a line after it is refused even where no shell reads it again.
 - **The escape scan models default shell options only** (fix round 4.5b2 part A, decision 124). Text before the escaped run that changes how the shell reads quotes, aliases or expansions (`setopt`, `emulate`, `set -o`, `shopt`, an alias) is not followed: for example `shopt -s expand_aliases`, an alias `q` for `bash -c "`, and `q echo x \\\<<…` with a body line and the closing line passes since part A, and `/bin/bash` expands the body (with `set -o posix` too); zsh does not.
 - **A split opener inside a string or a quoted heredoc's body is refused** (fix round 4.5b2 part A, decision 123, widened by decision 126). A `<<` whose opener a backslash-newline splits is refused inside a string or in the body of a quoted heredoc that passes when a line follows it, also where the shell reads it as text.
+- **The quote scan's signature differs from part A's plan** (MAJOR `227985d4`, `hooks/scripts/pre-bash-executor.mjs`; part A's review, decision 127). The simplify pass dropped the unused `from` parameter of `argsQuoteScan`, while the plan's text still gives five parameters. Behaviour is unchanged: the one caller always passed 0 and a scan state.
+- **The split-suffix branch's pass exits have no test** (MAJOR `90e253d3`, `hooks/scripts/pre-bash-executor.mjs`; part A's review, decision 127). Every test of a split delimiter with a suffix expects a block; none shows that a quoted one closing once at the end, or one with no body line, passes as the same opener written out does, so a change that refuses them would leave the suite green.
+- **A `<<-` heredoc closed by a tab-indented line before an escaped run has no test** (MAJOR, the review's finding at `hooks/scripts/pre-bash-executor.mjs:462`; part A's review, decision 127). The quote scan strips leading tabs from the closing line of a `<<-` heredoc, and no test combines that with a later escaped `<`; if the strip were lost, such a command would be refused again without a test failing.
+- **An error in the shell reading hides the regex reading's reason** (MAJOR `3890ec2b`, `hooks/scripts/pre-bash-executor.mjs`; part A's review, decision 127). The shell reading now runs first, so an error in it blocks with the unquoted, unreadable reason even where the regex reading would have named the early close. The command is still blocked; only the reason is wrong.
+- **More spellings of the operator for a second shell pass** (MINOR `402a9416` and `0464e12e`, `hooks/scripts/pre-bash-executor.mjs`; part A's review, decision 127). Measured by the review: quoting inside the delimiter word (`VOYAGE"_ARGS…"`, `VOYAGE\_ARGS…`), a `$'…'` word, and an escaped `<` next to a quoted one (`\<'<'`, `'<'\<`) after `eval cat` pass the guard, and `/bin/bash` and zsh expand the body. The check reads one spelling of the operator and a prefix-stripped word, not the word as a second shell reads it; the mechanism goes to the 4.5c structure review with the full reader.
+- **Smaller findings of part A's review** (MINOR `397b32ae`, `179386c4`, `73f6727b`, `75c439ab`, `f9ee4fd4`; decision 127). A second, weaker word reader next to the shell reading's word loop; the split-opener rule repeated in three places; the suffix branch repeating the regex reading's quoted test and body lines; a per-opener copy of the rest of the command in the re-read check; and this round's simplify commit `cc277c4` again without a scope. The corpus test's case with the guard switched off also passes on a corpus run killed at its timeout.
 
 ### Doors