fix(cli): guard the one migration write path that skips parse validation

mode-functions writes without a parse check when a mode wrapper survives
holding api entries, since that intermediate state is unparseable until
move-api-blocks runs later in the same pass. Brace balance is the invariant
a bad splice offset would break, so check that instead; nothing downstream
could tell a corrupted wrapper from an untouched one.

Also records that Task 5's example-app migration ran against an already-
migrated target and so did not prove end-to-end behaviour.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/superpowers/plans/2026-08-19-update-migration.md

@@ -477,3 +477,20 @@ git commit -m "feat(cli): fail the update when a project needs manual review"
 - **Never half-rewrite a file.** Parse first; on failure, record and move on. If any part of a file's transform cannot complete, skip the whole file and report it.
 - **Idempotency is not optional.** Every transform detects already-migrated input.
 - **Task 4 writes no transform.** If you find yourself building one, stop — the spec explains why a correct automatic answer does not exist.
+
+---
+
+## Post-execution note (2026-08-20)
+
+**Step 4 of Task 5 did not prove what it was written to prove.** By the time it ran,
+`examples/basic-app` had already been moved to the current syntax by hand in commit
+`890d6106`, so `wrnexus update` migrated a no-op target: 0 changed, 0 needing review,
+0 parse failures. The framework's own example therefore does NOT demonstrate the tool
+against real legacy syntax.
+
+The guarantee instead rests on fixture-based tests that drive the real `updateApp` /
+`runUpdate` entry points over projects containing genuine `ssr {}` / `client {}` source
+-- including the mixed-content page that only converges because `move-mode-functions`
+is registered before `move-api-blocks`. That is adequate coverage, but it is a weaker
+kind of evidence than the plan intended, and it is recorded here rather than quietly
+counted as a pass.