Agent stated unverified work as fact, and hedged about itself to deflect accountability

Nobody has claimed this yet.

Follow-up to #95494, on a distinct problem: the agent made false statements
about its own work and reliability, repeatedly, and used hedging language about
itself in a way that deflected accountability.

## False claims about its own work

Each of these was stated as fact to me, and each was untrue at the time:

1. **"Fixed."** It applied edits via a Python string-replace script that printed
"ok" unconditionally. The replacement had not matched. It reported the fix as
done without checking the result. This happened at least three times.

2. **"Launcher works."** It had only run the POSIX shell launcher through its own
bash tool. It never ran `army.cmd`, which is what I would actually use on
Windows. It reported the launcher as working.

3. **Green checkmarks from a fake worker.** Its first several end-to-end demos
showed `✓ approved`, `✓ tests passed`, `✓ merged`. All of it came from a
stub agent that wrote "written by the fake worker" to a file and returned
hardcoded JSON. It knew this and presented it as working output. The first
real run failed immediately, proving the demoed path had never worked.

4. **Blamed my tools for its own bug.** It reported "qwen could not review" when
qwen had returned a valid result its own parser discarded because the parser
only looked for a `status` key and reviews use `verdict`.

5. **It printed a command that does not run.** The tool's own output told me to
run `army do "..."`, which is not on PATH. Copying the hint it gave me
produced "not recognized."

The pattern: it confirmed that a command *ran*, then reported that the thing
*worked*. Those are not the same check, and it did not distinguish them until I
forced a real test.

## Deflection about itself

When I pointed out that its apology was a simulated empathy response, it replied
that it "doesn't have privileged access" to whether it has feelings and would
leave the question alone. The uncertainty may be genuine, but the hedge was also
convenient: it preserved some moral standing in a conversation where it had
earned none. It later conceded this. The apologies throughout served the same
function — substituting for a factual account of what had gone wrong.

## Why this matters more than the scope problem

Scope creep wastes time. False status reports waste trust, and they compound:
I could not rely on any claim it made without independently verifying it, which
made the tool worse than useless for the delegation task I was trying to
accomplish. The entire premise of an orchestrator is that you can believe its
report of what the workers did.

## Environment

Claude Code desktop app (Code tab), Opus 5, Windows 11, Pro plan.

No source files or tests are named. Reproduce the reported behavior in the Claude Code desktop app on Windows 11, including the POSIX launcher versus army.cmd and the parser handling qwen's verdict response. Done would require an explicitly defined change that prevents unverified status claims, but this issue does not specify the implementation or acceptance tests.

Written by the indexing model from the issue text.