docs(specs): guard the signature splice against deleting the user's text

Finding a "-- " delimiter is not enough to authorise removing what
follows it. The block is replaced only when its text matches one of the
signatures on disk; otherwise the new signature is inserted and nothing
is removed.

"-- " can reach the buffer without the user ever choosing a signature,
most plausibly pasted in with quoted text from another client, and the
unguarded scan would have deleted everything after it silently. The
failure is now directional: a block that matches is replaced, and one
that does not produces a second signature, visible in the editor and one
undo away. A wrong guess adds text rather than losing it.

Two markers were considered for the same problem and refused, both
recorded with the reasons. A zero-width character ships in the sent
message, fingerprinting the client in outgoing mail, and has to survive
the draft round trip through GMime, quoted-printable and MimeParser,
which is the pipeline that normalises such characters away. A doubled
delimiter is not the RFC 3676 separator, so no receiving client would
recognise the signature, and it would not have caught the pasted-text
case that prompted it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KEcn3u19xPqv6ggD15PG4c

1 files changed, 16 insertions, 0 deletions

diff --git a/docs/superpowers/plans/2026-08-03-post-0.1.0-usability.md b/docs/superpowers/plans/2026-08-03-post-0.1.0-usability.md
index c91884e..15f8654 100644
--- a/docs/superpowers/plans/2026-08-03-post-0.1.0-usability.md
+++ b/docs/superpowers/plans/2026-08-03-post-0.1.0-usability.md
@@ -1356,6 +1356,22 @@ clients offer it. The scan needed the quote-aware clause for `above_quote`
 anyway, so the key is roughly ten lines rather than one, and a naive tail rule
 would have eaten the quote under the other placement.
 
+**A delimiter alone must not authorise a deletion.** The block after `-- ` is
+replaced only when its text matches one of the signatures on disk; otherwise
+the new one is inserted and nothing is removed. `-- ` can reach the buffer
+pasted in with quoted text from another client, and the unguarded scan would
+have silently deleted everything after it. The failure is now directional: a
+wrong guess adds a visible duplicate rather than losing the user's writing.
+Raised by the user against the first draft of this design.
+
+Two markers were considered for the same problem and refused. A zero-width
+character SHIPS in the sent message, fingerprinting the client in outgoing
+mail, and must survive the draft round trip through GMime, quoted-printable
+and `MimeParser`, which is exactly what normalises such characters away. A
+doubled delimiter (`--` plus two spaces) is not the RFC 3676 separator, so no
+receiving client would fold or strip the signature, and trailing whitespace is
+unreliable through the same pipeline.
+
 **Two things the design refuses.** No signature editor: the directory is
 edited with the user's own editor, and a text editor inside a mail client is
 not this project's to build. And a resumed draft seeds nothing, because the