diff --git a/devlog/_plan/260825_owner_backlog_and_bugpr_closeout/000_research_snapshot.md b/devlog/_plan/260825_owner_backlog_and_bugpr_closeout/000_research_snapshot.md
new file mode 100644
index 0000000000..d45e8b7f86
--- /dev/null
+++ b/devlog/_plan/260825_owner_backlog_and_bugpr_closeout/000_research_snapshot.md
@@ -0,0 +1,90 @@
+# 000 — Research snapshot: owner backlog + bug PR closeout
+
+Unit opened 2026-08-25. Base: `origin/dev` at `b33d82dc3`.
+
+## Scope
+
+Two populations, 31 items at open:
+
+- **A. Maintainer-authored open issues (15):** #2569 #2568 #2566 #2565 #2558 #2557 #2491
+  #2472 #2465 #2464 #2463 #1478 #1049 #1048 #820
+- **B. Open `bug`-labelled community PRs (16):** #2567 #2563 #2555 #2550 #2542 #2532
+  #2528 #2515 #2513 #2512 #2510 #2503 #2497 #2490 #2488 #2474
+
+## Method
+
+Six read-only investigation lanes (`gpt-5.6-sol`, medium) were dispatched in parallel
+against a worktree pinned at the then-current dev head. Each lane was required to verify
+the claim in the issue/PR body against the actual line cited, and to return a verdict
+with file:line evidence rather than a plausibility judgement. Lane reports are
+summarized per item in `010`-`080`; this document records only the classification and
+the dependency order.
+
+## Classification
+
+| Item | Verdict | Effort | Risk | Owner phase |
+|---|---|---|---|---|
+| PR #2528 | MERGED (verified, 41 focused tests) | S | LOW | wp1 |
+| PR #2555 | MERGED (verified, 11 GUI tests) | S | LOW | wp1 |
+| PR #2532 | MERGED (verified, 46 focused tests) | M | MED | wp2 |
+| PR #2515 | MERGED (verified, 88 focused tests) | M | MED | wp2 |
+| PR #2474 | MERGED (Linux-only regression, skipped on macOS) | XS | LOW | wp2 |
+| PR #2550 | MERGED (verified, 138 focused tests) | XS | MED | wp3 |
+| PR #2563 | NEEDS-FIXUP (returned to draft on new commits) | M | HIGH | wp2 |
+| PR #2503 | NEEDS-FIXUP (53 commits behind; capability lost via combo/trusted/live paths) | M | MED | wp3 |
+| PR #2488 | NEEDS-FIXUP (2 correctness blockers: policy-code overwrite, envelope selection) | M | HIGH | wp5 |
+| PR #2542 | NEEDS-FIXUP (51 commits behind; red focused test) | S | MED | wp5 |
+| PR #2513 | NEEDS-FIXUP (eviction not applied to AI Studio; test lacks HOME isolation) | S | MED | wp4 |
+| PR #2512 | NEEDS-FIXUP (substring model match caps unknown models) | M | MED | wp4 |
+| PR #2510 | NEEDS-FIXUP (`retry-after` spelling omitted from transient guard) | XS | MED | wp4 |
+| PR #2567 | NEEDS-FIXUP (hygiene: missing_regression_test) | S | MED | wp5 |
+| PR #2497 | NEEDS-FIXUP (unsponsored_surface; auth boundary needs maintainer sponsorship) | L | HIGH | wp5 |
+| PR #2490 | NEEDS-FIXUP (unsponsored_surface only; code reviewed sound) | S | MED | wp5 |
+| Issue #2565 | IMPLEMENT (formatter mismatch, renderer already exists) | XS | LOW | wp8 |
+| Issue #2566 | IMPLEMENT (CLI never passes `quota=1`) | M | MED | wp8 |
+| Issue #2558 | IMPLEMENT (no destination-authority field on tier observation) | S | MED | wp9 |
+| Issue #2557 | IMPLEMENT (PowerShell statement join + probe failure is not absence) | S | HIGH | wp9 |
+| Issue #2491 | IMPLEMENT (four relations confirmed with file:line) | M | MED | wp10 |
+| Issue #2472 | INVALID/WONTFIX (envelope owned by the Codex host, not this proxy) | XS | LOW | wp11 |
+| Issue #2465 | IMPLEMENT (GUI surface) | L | MED | wp12 |
+| Issue #2464 | IMPLEMENT (GUI surface) | L | HIGH | wp12 |
+| Issue #2463 | IMPLEMENT (GUI surface) | L | HIGH | wp12 |
+| Issue #2569 | IMPLEMENT (live roster drift, measured) | M | LOW | wp6 |
+| Issue #2568 | IMPLEMENT (generalize OAuth account failover) | M | MED | wp7 |
+| Issue #1478 | IMPLEMENT (config provenance still absent) | L | HIGH | wp13 |
+| Issue #1049 | IMPLEMENT (legacy homes still `legacy-uncoordinated`) | L | HIGH | wp13 |
+| Issue #1048 | IMPLEMENT (disposable-host runner absent) | L | HIGH | wp13 |
+| Issue #820 | IMPLEMENT (session-lane scheduler absent) | L | HIGH | wp13 |
+
+## Key findings that change the plan
+
+**#2472 is not our bug.** `wall_time_seconds` and `exec_command` appear nowhere under
+`src/` or `tests/` — that result envelope belongs to the Codex host. The lane also
+rejected the Cursor call-ID theory: live bridge calls pass `allowEmptyArgs: true`
+(`src/adapters/cursor/live-transport.ts:243`) and duplicate call IDs are deduplicated
+deliberately (`src/adapters/cursor/protobuf-events.ts:1044`). Closing with evidence
+rather than implementing.
+
+**The four old architecture issues are genuinely open.** #1478, #1049, #1048, and #820
+were each checked against `_fin` units and against `src/`. All four are real remaining
+work, all L, all HIGH risk. They are not stale-but-done, and they cannot be honestly
+closed by adjudication alone. They form wp13 and are the largest single risk to the
+DONE criterion.
+
+**Three hygiene-blocked PRs fail for two different reasons.** #2567 fails
+`missing_regression_test` — a real, satisfiable gap. #2497 and #2490 fail
+`unsponsored_surface`, which is a maintainer-sponsorship gate on the auth/quota
+surface, not a code defect; #2490's code was reviewed sound.
+
+**The three Google PRs do not conflict.** #2510 changes `google-errors.ts`; #2512 and
+#2513 change `google.ts`. No merge-order dependency, but #2512 and #2513 will textually
+conflict with each other and must be sequenced.
+
+## Dependency order
+
+wp1 → wp2 → wp3 (merge train, ordered by base freshness) runs first because every later
+implementation phase rebases on a moving dev. wp4/wp5 are independent of each other.
+wp6-wp12 are implementation phases on issues; wp12 is the only GUI-bearing phase and
+routes through cxc-dev-uiux-design before cxc-dev-frontend. wp13 is last because it is
+the only phase whose scope can force a plan amendment.
+
diff --git a/devlog/_plan/260825_owner_backlog_and_bugpr_closeout/001_audit_response.md b/devlog/_plan/260825_owner_backlog_and_bugpr_closeout/001_audit_response.md
new file mode 100644
index 0000000000..b677574c9f
--- /dev/null
+++ b/devlog/_plan/260825_owner_backlog_and_bugpr_closeout/001_audit_response.md
@@ -0,0 +1,100 @@
+# 001 — Audit response (round 1)
+
+Independent auditor verdict: **fail**, 5 blocking findings. Findings are accepted
+unless an explicit rebuttal is recorded.
+
+## B1 — The admin merge train left dev red. ACCEPTED, FIXED.
+
+The auditor was right and the failure was real. Reproduced locally at `e42778adc`:
+`bun test tests/subagent-model-fallback.test.ts tests/subagent-fallback-handle-responses.test.ts`
+→ 86 pass / **2 fail**, both throwing `CodexPoolAuthenticationError` at
+`src/codex/auth-context.ts:464`.
+
+Root cause is a semantic conflict invisible to either PR alone. #2550 made
+`gpt-5.6-*` account-gated and fails closed when the entitlement snapshot has no
+roster (`auth-context.ts:463`). Two preview cases added by #2515 bind on
+`gpt-5.6-sol` without installing a roster mock, while the neighbouring cases #2550
+itself touched do install one (lines 732, 793). Each PR was green alone; only the
+union is red.
+
+Fixed in #2570 (merged `6b08567fa`). Post-fix CI run `32865619167`: all four test
+shards, gates, api-usage, storage-policy and all three keyring jobs **success**;
+14745 pass / 1 fail. The one remaining failure is
+`tests/cursor-desktop-exec.test.ts` "computer-use non-zero exit", which passes
+locally 12/12 — the known desktop-exec flake, unrelated to this change.
+
+**Process correction for the rest of the loop:** focused suites are necessary but not
+sufficient. Two PRs touching one subsystem get a combined run on the merge result
+before the second lands, and dev CI is checked after each landing.
+
+## B2 — #2472 INVALID/WONTFIX is unsupported. ACCEPTED, RECLASSIFIED.
+
+Doc 070 proved only that the envelope FIELDS are host-owned, which does not establish
+that OpenCodex cannot emit an empty successful turn. Counter-evidence:
+`src/adapters/cursor/protobuf-events.ts:1055` can return `[]`,
+`finalizeTurnEvents` emits `done` without semantic output (`:1365`), and
+`emptyCompletionRetry` is off by default (`src/config.ts:869`).
+
+Reclassified **INVALID/WONTFIX → IMPLEMENT (protocol gap)**. wp11 owns closing the
+zero-output producer path. "Not reproduced" is a note, not a verdict.
+
+## B3 — Security/auth material in tracked devlog. ACCEPTED, MOVED.
+
+`AGENTS.md:95-128` is unambiguous and the plan violated it: unreleased credential and
+replay analysis in `030` §#2497, and unimplemented rotator design in `050`. Both are
+pre-disclosure — #2497 is unmerged auth work and #2568's rotator does not exist yet.
+
+Resolution: both sections are reduced to a public pointer (issue/PR number plus the
+already-public gate name) and the analysis moves to `.tmp/` for the duration. The
+redaction lands before this unit is pushed.
+
+## B4 — WP13 is not a credible single phase. ACCEPTED, RESTRUCTURED.
+
+The honest reading is stronger than the plan's: #1478's owner disposition says it
+needs its own cycle, #820 says explicitly it is roadmap work "not an issue a backlog
+pass should touch", #1049 is deliberately deferred. Four L/HIGH programs are not one
+work-phase, and closing them by adjudication would be the completion-shrinking
+GOAL-COMPLETE-GATE-01 exists to stop.
+
+Split into wp13a/wp13b/wp13c/wp13d, one issue per PABCD cycle. If a cycle proves the
+work exceeds this loop's bound, that phase reports `NEEDS_HUMAN` or
+`BUDGET_EXHAUSTED` — not a blanket DONE. #1048 goes first as the closest to closable.
+
+## B5 — WP12 is narrower than its issues. ACCEPTED, WIDENED.
+
+#2463-#2465 require persisted schema/baseline, convergence, management API, CLI, docs
+and GUI; doc 080 framed them as `Models.tsx` work. wp12 acceptance now names each
+non-GUI surface, so a GUI-only implementation cannot satisfy it.
+
+## Non-blocking and missed hazards adopted
+
+- **N2 stale heads.** #2563 is now `bc37d3d7`, non-draft, current-base; #2503 is 59
+  behind / 2 ahead. Doc 010's SHAs are stale; re-verify at exact head before acting.
+- **H2 shared-core serialization.** #2563, #2497, #2488, #2558 and the later
+  architecture work all touch `src/server/responses/core.ts`; #2488 also touches
+  `src/lab/`. Serialize them, rebase each at exact head, and make
+  `tests/core-lab-boundary.test.ts` a required gate (`AGENTS.md:37-53`).
+- **H3 #2465 before #2464.** Adopted as a hard order: a non-empty preset allowlist
+  makes #2464 structurally inert for preset providers and avoids blocklist growth.
+- **H4 WP7 surface enumeration.** wp7 must enumerate every `hasKeyPoolFailover` call
+  site (Responses core, compact Responses, native Chat) or it can generalize the
+  rotator while leaving live OAuth 429 paths unfixed. Presence-driven default-on is
+  flagged as an explicit consent question for the user.
+- **H5 Google rebase order.** #2512/#2513 both rebase over merged #2532's
+  `google.ts`: rebase → full adapter CI → rebase second over that result → combined
+  Google suites.
+
+## New item admitted this round (LOOP-UNIT-CHAIN-01)
+
+The user reported a further defect: a Codex model configured with a 922k context
+window is reported as 258k inside a subagent. Admitted as wp15 with its own
+investigation; it is a catalog/context-resolution defect, not part of any existing
+phase.
+
+## Verification environment (user directive, this round)
+
+Pushes use `--no-verify`; the pre-push hook duplicates repository CI and blocks the
+loop for minutes per push. Long or device-specific verification runs asynchronously on
+`ssh lidge` / `ssh macmini`, with a real install on `macmini` when a released build
+must be exercised. CI is the final gate, repaired at the end rather than per step.
+
diff --git a/devlog/_plan/260825_owner_backlog_and_bugpr_closeout/010_wp2_merge_train_remainder.md b/devlog/_plan/260825_owner_backlog_and_bugpr_closeout/010_wp2_merge_train_remainder.md
new file mode 100644
index 0000000000..eb8f0ce6f5
--- /dev/null
+++ b/devlog/_plan/260825_owner_backlog_and_bugpr_closeout/010_wp2_merge_train_remainder.md
@@ -0,0 +1,26 @@
+# 010 — wp2/wp3 merge train remainder
+
+Landed already (verified locally, focused suites green, admin-squashed onto dev):
+#2528 (7cf041cf7), #2555 (70eb01d19), #2532 (fea4538d5), #2515 (6c4556cfb),
+#2474 (b33d82dc3), #2550 (e42778adc).
+
+## Remaining in this decade
+
+### #2563 — Cursor ref-less checkpoint ownership
+Head moved to `f7892785` after the lane report and the PR returned to draft, which
+resets the contributor readiness checklist by design. The code at head `93057665` was
+verified locally: `bun test tests/cursor-request-builder.test.ts` → 49 pass.
+Action: re-verify the NEW head, then merge. The one unresolved CodeRabbit thread asks
+for broader ja/ translation parity on a pre-existing doc and is not a correctness
+blocker.
+
+### #2503 — xAI verbosity
+53 commits behind dev, and the lane found the fix incomplete: an explicit
+`supportsVerbosity: false` is lost through combo derivation
+(`src/codex/catalog/aggregation.ts:173`) and trusted replacement rows
+(`src/codex/catalog/provider-fetch.ts:2147`), and live-discovered xAI/Kiro ids can
+still advertise verbosity because `modelRecordValue` has no provider-wide fallback
+(`src/reasoning-effort.ts:83`).
+Action: rebase onto dev, add the conservative false through both derivation paths plus
+a provider-wide fallback, extend `tests/codex-catalog.test.ts`.
+
diff --git a/devlog/_plan/260825_owner_backlog_and_bugpr_closeout/020_wp4_google_lane.md b/devlog/_plan/260825_owner_backlog_and_bugpr_closeout/020_wp4_google_lane.md
new file mode 100644
index 0000000000..6dc401728c
--- /dev/null
+++ b/devlog/_plan/260825_owner_backlog_and_bugpr_closeout/020_wp4_google_lane.md
@@ -0,0 +1,32 @@
+# 020 — wp4: Google adapter lane (#2510, #2512, #2513)
+
+No merge-order dependency between #2510 and the other two (#2510 touches
+`google-errors.ts`; #2512/#2513 touch `google.ts`), but #2512 and #2513 will
+textually conflict and must be sequenced.
+
+### #2510 — Antigravity quota exhaustion classification
+Defect: the transient guard matches `retry after` but not the standard `retry-after`
+spelling (`src/adapters/google-errors.ts:33-51`), so
+`Quota exceeded; retry-after: 60` is classified as permanent exhaustion via
+`isQuotaExhaustedBody` (`:104-113`). A transient 429 then suppresses retry and can
+trigger account-fallback exhaustion.
+Fix: add the hyphenated spelling to the transient guard; regression in
+`tests/google-errors.test.ts`. Effort XS.
+
+### #2512 — max output token clamp
+Defect: substring matching (`src/adapters/google.ts:51-58`) treats any id containing
+`pro`/`oss` as known, silently capping every unknown model at 16,384. The PR's own
+tests lock that fallback in (`tests/google-output-clamp.test.ts:5-12`), and it
+contradicts `structure/02_config-and-codex-home.md:321` (explicit request values win).
+Fix: exact-id matching with an explicit unknown-model passthrough; rewrite the test to
+pin passthrough rather than the silent cap.
+
+### #2513 — thought-signature replay
+Defect: durable lookup applies to every Google mode (`src/adapters/google.ts:268-277`)
+but eviction is restricted to Cloud Code Assist/Vertex (`:631-646`), so AI Studio
+keeps rejected signatures cached — replay-store poisoning. Separately the new
+persistence suite writes without `OPENCODEX_HOME` isolation
+(`tests/google-signature-history-roundtrip.test.ts:605`), so it can touch the
+operator's real config.
+Fix: apply eviction across all modes; sandbox the test home.
+
diff --git a/devlog/_plan/260825_owner_backlog_and_bugpr_closeout/030_wp5_hygiene_and_drafts.md b/devlog/_plan/260825_owner_backlog_and_bugpr_closeout/030_wp5_hygiene_and_drafts.md
new file mode 100644
index 0000000000..81a806d454
--- /dev/null
+++ b/devlog/_plan/260825_owner_backlog_and_bugpr_closeout/030_wp5_hygiene_and_drafts.md
@@ -0,0 +1,40 @@
+# 030 — wp5: hygiene-blocked and draft PRs
+
+Two distinct gate failures, not one.
+
+### #2567 — `missing_regression_test` (satisfiable)
+The change sets `timeout: 0` on upstream fetches. The gate objects because the PR
+changes source files and adds no test.
+Fix: add propagation coverage in `tests/fetch-header-timeout.test.ts` and
+`tests/claude-messages-endpoint.test.ts`.
+
+### #2490 — `unsponsored_surface` only
+Quota-window preservation. Code was reviewed and found sound; CodeRabbit's one finding
+was resolved by the author. The failing gate is a maintainer-sponsorship requirement on
+the quota surface, not a defect.
+Action: sponsor, verify at exact head, merge.
+
+### #2497 — `unsponsored_surface`, credential boundary
+Native-main token refresh and replay. This is the authentication/credential surface that
+`AGENTS.md` places under explicit security review, and the change is unmerged, so its
+analysis is pre-disclosure material. Per `AGENTS.md` §"Security working notes" the
+review notes live in scratch (`.tmp/260825_backlog_scratch/`), not here.
+Action: rebase, exact-head security review, then sponsor. HIGH risk; do not shortcut.
+
+### #2488 — two correctness blockers
+1. `adapterFailureFromEvent` overwrites the classified policy code before testing it
+   (`src/bridge.ts:131`), so a conflicting-code policy failure stays 502/retryable —
+   a retry across a safety boundary.
+2. `normalizeUpstreamErrorText` takes the first field-bearing envelope
+   (`src/server/responses/core.ts:694`) whereas passthrough scans every candidate
+   (`src/server/responses/passthrough-error.ts:15`), so a generic outer envelope can
+   hide a nested `cyber_policy`.
+Both need regressions in `tests/cyber-policy-error-fidelity.test.ts`.
+Serialization: this PR touches `core.ts` and `src/lab/` — see 001 §H2.
+
+### #2542 — stale catalog during refresh
+All code-review findings addressed at head `e30a0cfd`, but 51 commits behind and the
+focused file still reports one failure at
+`tests/codex-app-server-processes.test.ts:925`.
+Action: rebase, then dispose of that failure at exact head.
+
diff --git a/devlog/_plan/260825_owner_backlog_and_bugpr_closeout/040_wp6_cursor_catalog.md b/devlog/_plan/260825_owner_backlog_and_bugpr_closeout/040_wp6_cursor_catalog.md
new file mode 100644
index 0000000000..6c69974c39
--- /dev/null
+++ b/devlog/_plan/260825_owner_backlog_and_bugpr_closeout/040_wp6_cursor_catalog.md
@@ -0,0 +1,27 @@
+# 040 — wp6: Cursor catalog refresh (#2569)
+
+Measured 2026-08-25 against a live logged-in account: `GetUsableModels` returns 204
+wire ids normalizing to 34 base models; `CURSOR_STATIC_MODELS` carries 50 entries.
+
+Missing from the catalog: `gemini-3.7-flash` (low/medium/high) and
+`gemini-3.6-flash` (minimal/low/medium/high). `minimal` is not currently in
+`CANONICAL_EFFORT_SUFFIXES`, which is derived from `CURSOR_MODEL_EFFORT_TIERS`
+values — listing it in the 3.6 ladder admits it.
+
+Drifted ladders: `claude-opus-5`, `claude-4.6-sonnet`, `gpt-5.5`, and the three
+`gpt-5.6-*` families (live exposes a `none` tier the map lacks).
+
+Unmodelled axis: a `-thinking` family whose suffix ORDER varies —
+`{base}-thinking-{effort}` for Opus 4.7/4.8/5, `{base}-{effort}-thinking` for
+4.6/4.5-opus, bare `{base}-thinking` for 4-sonnet/4.5-sonnet.
+`isCursorModelAvailableForAccount` matches none of these, so they are invisible.
+
+Static-only entries (13) survive as the logged-out/discovery-failure fallback and
+should be pruned or re-justified. `glm-5.3` is a documented preemptive seed and stays.
+
+Decision for this phase: add the two Gemini models with their real ladders, admit
+`minimal`, refresh the drifted ladders, prune the stale static entries, and expose the
+`-thinking` families as first-class base ids the way the `-fast` families were handled
+in `831810c13`. Vision classification must keep the new Gemini rows on the native path
+(`CURSOR_NO_VISION_MODELS` currently lists composer/glm only).
+
diff --git a/devlog/_plan/260825_owner_backlog_and_bugpr_closeout/050_wp7_oauth_failover.md b/devlog/_plan/260825_owner_backlog_and_bugpr_closeout/050_wp7_oauth_failover.md
new file mode 100644
index 0000000000..cdea11f25b
--- /dev/null
+++ b/devlog/_plan/260825_owner_backlog_and_bugpr_closeout/050_wp7_oauth_failover.md
@@ -0,0 +1,24 @@
+# 050 — wp7: generic OAuth multi-account 429 failover (#2568)
+
+Public statement of the gap (the issue is public; the patch design is not, and lives in
+`.tmp/260825_backlog_scratch/050_full_analysis.md` until it ships — `AGENTS.md`
+§"Security working notes").
+
+Today's ladder: API-key pools rotate by default (`hasKeyPoolFailover`), the Codex pool
+has its own quota/lease machinery, and Anthropic OAuth rotates only when its opt-in is
+set. `hasKeyPoolFailover` returns false for `authMode === "oauth"`, so several OAuth
+providers have no recovery path on a 429.
+
+Phase requirements (acceptance, not design):
+
+1. Enumerate EVERY `hasKeyPoolFailover` call site — Responses core, compact Responses,
+   native Chat — and prove each observable OAuth 429 path is covered. Generalizing the
+   rotator without this leaves live paths unfixed (001 §H4).
+2. The Codex pool is out of scope; its quota scopes, probe leases and affinity must not
+   be reimplemented.
+3. Existing Anthropic configuration keeps its current meaning.
+4. Rotation is bounded per request.
+5. **Open consent question for the user:** presence-driven default-on rotation spends a
+   second account's subscription quota. This is a product decision, not a code decision,
+   and is escalated rather than settled by an opt-out knob.
+
diff --git a/devlog/_plan/260825_owner_backlog_and_bugpr_closeout/060_wp8_wp9_cli_and_platform.md b/devlog/_plan/260825_owner_backlog_and_bugpr_closeout/060_wp8_wp9_cli_and_platform.md
new file mode 100644
index 0000000000..918a46c476
--- /dev/null
+++ b/devlog/_plan/260825_owner_backlog_and_bugpr_closeout/060_wp8_wp9_cli_and_platform.md
@@ -0,0 +1,35 @@
+# 060 — wp8/wp9: CLI quota surfaces and platform fixes
+
+### #2565 — `ocx provider quota` prints a count
+`quota()` (`src/cli/provider-runtime.ts:105`) renders through `summaryLines()`, a
+depth-1 flattener that emits `N item(s)` for a non-scalar array
+(`src/cli/runtime-api.ts:294`). The correct per-report renderer already exists:
+`quotaParts()`/`providerQuotaLine()` (`src/cli/account-extended.ts:267`), used today
+by `ocx account refresh`. Effort XS; add a rendering regression.
+
+### #2566 — per-account quota in `ocx account list`
+Server side already exists: `fetchProviderAccountQuotas`
+(`src/providers/quota.ts:1561`) exposed at
+`/api/oauth/accounts?provider=…&quota=1` (`oauth-account-routes.ts:268`), gated to
+Anthropic by `supportsPerAccountQuota()` (`quota.ts:1395`). The CLI never passes
+`quota=1` (`src/cli/account-api.ts:237`) and rejects `--quota`
+(`src/cli/account.ts:18`). Add the opt-in flag, keep default listing cheap, update the
+eight locale docs.
+
+### #2558 — Fast falsely reported as downgraded
+`src/providers/fastwire.ts:345` treats any non-priority response tier as a confirmed
+`response-declined`, and `TierObservationContext` (`src/types/provider.ts:107`) has
+no destination-authority field, so a ChatGPT-forward destination that echoes
+`default` is indistinguishable from a real downgrade. Canonical forward detection
+already exists (`src/providers/openai-tiers.ts:34`) and the route is in scope where
+the context is built (`src/server/responses/core.ts:1638`). Note: `fastOutcome`
+drives priority pricing, so this changes cost attribution.
+
+### #2557 — Windows `--restart-desktop-app`
+Two defects: PowerShell statements are joined with spaces
+(`src/codex/desktop-app-restart.ts:124`), and a thrown probe becomes `[]`
+(`:140`) → `no_targets` (`:268`) → the CLI prints "not running"
+(`src/cli/dispatch.ts:618`). The reason union has no probe-failure state (`:43`).
+HIGH risk: this is a process-termination path and must stay fail-closed on both the
+initial and PID-recheck probes.
+
diff --git a/devlog/_plan/260825_owner_backlog_and_bugpr_closeout/070_wp10_wp11_slug_and_exec.md b/devlog/_plan/260825_owner_backlog_and_bugpr_closeout/070_wp10_wp11_slug_and_exec.md
new file mode 100644
index 0000000000..72f10faab0
--- /dev/null
+++ b/devlog/_plan/260825_owner_backlog_and_bugpr_closeout/070_wp10_wp11_slug_and_exec.md
@@ -0,0 +1,24 @@
+# 070 — wp10/wp11: slug equivalence and the exec_command class
+
+### #2491 — four slug-equivalence relations
+Confirmed on dev:
+1. visibility compares lossy `slugEquivalenceKey(routedSlug(...))`, collapsing
+   `a/b` and `a-b` (`src/codex/catalog/provider-fetch.ts:1613`);
+2. persisted sync rebuilds the same lossy keys independently
+   (`src/codex/catalog/sync.ts:819,1038`);
+3. `ocx models remove` uses exact `slugEquals` (`src/cli/models.ts:278`,
+   `src/providers/slug-codec.ts:83`);
+4. routing throws on encode collisions (`src/router.ts:650`,
+   `slug-codec.ts:72`).
+The over-grant is already pinned as expected behaviour in
+`tests/selected-models.test.ts:88`. Unify on one relation and update that pin.
+
+### #2472 — exec_command zero-output class → CLOSE
+Neither `wall_time_seconds` nor `exec_command` appears under `src/` or `tests/`;
+the result envelope is the Codex host's. The Cursor call-ID theory is disproved: live
+bridge calls pass `allowEmptyArgs: true`
+(`src/adapters/cursor/live-transport.ts:243`) and duplicate call IDs are deduplicated
+deliberately (`src/adapters/cursor/protobuf-events.ts:1044`). The related zero-output
+stream mitigation already shipped in `88b7cc057`. Close with this evidence rather than
+changing proxy finalization, which would risk duplicate retries/execution/billing.
+
diff --git a/devlog/_plan/260825_owner_backlog_and_bugpr_closeout/080_wp12_catalog_ux.md b/devlog/_plan/260825_owner_backlog_and_bugpr_closeout/080_wp12_catalog_ux.md
new file mode 100644
index 0000000000..c9e02cf66b
--- /dev/null
+++ b/devlog/_plan/260825_owner_backlog_and_bugpr_closeout/080_wp12_catalog_ux.md
@@ -0,0 +1,28 @@
+# 080 — wp12: catalog defaults and aliases (GUI-bearing)
+
+All three issues are unimplemented (only docs-only PR #2466 merged, `438b9cc77`) and
+all three change `gui/src/pages/Models.tsx`. Per the loop contract this phase routes
+through cxc-dev-uiux-design for direction, then cxc-dev-frontend for implementation and
+rendered verification. No visual claim without a screenshot.
+
+### #2465 — latest-only default preset
+Configuration has only `selectedModels`, where absent/empty exposes everything
+(`src/types/provider.ts:262`) and an empty selection deletes the allowlist
+(`src/server/management/model-routes.ts:546`). No `modelPreset` symbol exists.
+Care: "empty preset materializes to all" means zero-match handling must be atomic.
+
+### #2464 — new models arrive disabled
+The live cache is memory-only with a 5-minute TTL (`src/codex/model-cache.ts:1`), so
+there is no durable baseline to diff arrivals against. HIGH risk: baseline corruption
+or repeated arrival detection could hide entire catalogs or repeatedly override a
+user's enable choice.
+
+### #2463 — provider/model aliases
+`displayName` is display-only metadata (`src/types/config.ts:175`); the only runtime
+alias today is the combo alias resolved before provider routing
+(`src/router.ts:625`). HIGH risk: alias collisions can shadow combos, native models,
+account namespaces, or `defaultProvider`.
+
+Sequencing note: #2464 and #2465 both write the visibility baseline and must not be
+implemented in the same cycle.
+
diff --git a/devlog/_plan/260825_owner_backlog_and_bugpr_closeout/090_wp13_architecture.md b/devlog/_plan/260825_owner_backlog_and_bugpr_closeout/090_wp13_architecture.md
new file mode 100644
index 0000000000..20be1681bf
--- /dev/null
+++ b/devlog/_plan/260825_owner_backlog_and_bugpr_closeout/090_wp13_architecture.md
@@ -0,0 +1,41 @@
+# 090 — wp13: the four architecture issues
+
+Each was checked against `devlog/_fin/` and against `src/`. None is stale-but-done.
+
+### #1478 — config rebase provenance
+`src/config.ts:2590` stores snapshot baselines only, and `:2901` still infers intent
+from key presence, so deletion and unseen-key cannot be distinguished. Both regressions
+are separately pinned (`tests/config-user-edits.test.ts:652` and `:221`).
+`devlog/_plan/260823_owner_backlog_closeout/110` explicitly retains this as unresolved.
+L / HIGH: persisted-config schema migration plus provenance at every top-level deletion
+writer (12 call sites).
+
+### #1049 — pre-substrate Codex home adoption
+`src/codex/inject-coordination.ts:87` still classifies routed/indeterminate
+pre-substrate homes as `legacy-uncoordinated`, and `src/codex/inject.ts:932` bypasses
+transition publication on that path. `git grep adoption-pending` returns nothing.
+The deferral is recorded at `devlog/_fin/260816_wave34_closeout/101`.
+L / HIGH: incorrect crash-safe publication can strand every pre-substrate home.
+
+### #1048 — WP13 composed acceptance
+PR #1106 (`43a1fdc45`) delivered the workstation suite and #2452 (`6b0f61f64`) is an
+ancestor of dev, but `git ls-tree origin/dev scripts/disposable-host` is empty and
+`devlog/_fin/260806_wp13_toggles_resume/030` explicitly excludes P09/P10/P18/P34-P36.
+L / HIGH: service-manager acceptance is destructive and platform-specific — it cannot
+run on an ordinary workstation.
+
+### #820 — bounded 32-session tool recall
+Partial bounds landed via #829 (`09a0a1826`): per-call/turn/transport limits
+(`src/lib/translator-budget.ts:1`) and a 256-turn global gate
+(`src/server/lifecycle.ts:32`). But lifecycle still keys leases by `AbortController`
+(`:160`) rather than logical session lanes, and no 32/64-session harness exists.
+The scheduler architecture is explicitly deferred at
+`devlog/_fin/260801_zero_leak_state_stores/035:677`.
+L / HIGH: spans protocol, memory admission, retries, and account affinity.
+
+## Honest assessment
+
+This phase is four L/HIGH units. It is the single largest risk to the DONE criterion,
+and it is where a BUDGET_EXHAUSTED or NEEDS_HUMAN outcome is most plausible. It is
+sequenced last so that everything cheaper lands first.
+
diff --git a/devlog/_plan/260825_owner_backlog_and_bugpr_closeout/100_wp6_wp8_execution.md b/devlog/_plan/260825_owner_backlog_and_bugpr_closeout/100_wp6_wp8_execution.md
new file mode 100644
index 0000000000..80d821e483
--- /dev/null
+++ b/devlog/_plan/260825_owner_backlog_and_bugpr_closeout/100_wp6_wp8_execution.md
@@ -0,0 +1,50 @@
+# 100 — wp6/wp8 execution record (issues #2569, #2565, #2566)
+
+Cycle after the roadmap lock. Three maintainer-authored issues closed, each with its own PR
+onto `dev`.
+
+## #2569 — Cursor catalog drift (2 PRs)
+
+**#2584** catalogued `gemini-3.6-flash` and `gemini-3.7-flash`, which the live roster
+carries but the static catalog did not. Adding them exposed a second defect:
+`gemini-3.6-flash` is the only Cursor model with a `minimal` rung, and
+`cursorModelEffortLadder` filtered against the canonical five-rung order, so the tier was
+dropped from the picker while `cursorEffortSuffix` would have sent it — declared but
+unreachable.
+
+**#2585** exposed the 13 `-thinking` families. `isCursorModelAvailableForAccount` matches a
+base id against `{base}`, `{base}-{effort}` and the family wire form; no `-thinking` id
+matches any of those, so all 46 thinking wire ids were invisible. The marker's position is
+family-dependent and the wrong order is rejected `ERROR_BAD_MODEL_NAME`, so all three
+shapes are modelled: thinking-then-effort, effort-then-thinking, bare.
+
+Evidence: composed every catalogued id/tier pair against a live `GetUsableModels` roster —
+46 matched, 0 mismatched. Visible models 41 → 52.
+
+Not done, deliberately: the 13 static-only entries stay. They are the logged-out and
+discovery-failure fallback, and `filterCursorConfiguredModelsByLiveDiscovery` already drops
+them when live discovery succeeds.
+
+## #2565 — `ocx provider quota` printed a count (#2586)
+
+`quota()` rendered through `summaryLines()`, a depth-1 flattener that emits `N item(s)` for
+a non-scalar array, so every fetched report was discarded. Now renders through
+`providerQuotaLine`, the formatter `ocx account refresh` already uses.
+
+## #2566 — per-account quota in `ocx account list` (#2587)
+
+Server side already existed; the CLI never passed `quota=1`. Added `--quota` (opt-in,
+because the server probes once per stored credential) and `--refresh`. Unprobed shows `-`,
+failed probe shows `unavailable` — blank would read as "no usage" rather than "not
+measured". Live proof on three Anthropic logins: active account 45% weekly while a sibling
+sits at 98%.
+
+## Self-inflicted regression, found and repaired
+
+#2578 (my #2503 landing) made the catalog hint pass read `PROVIDER_REGISTRY`. A gather
+flight captures its registry authority up front and forbids later reads, so every hint pass
+became that forbidden read and a custom-destination flight lost its own discovery result.
+Bisected: green at `4d3d2716e`, red from `844885ab1`. Repaired in #2582 by materializing the
+default at seed time (`applyVerbosityDefaults`) and stripping it from saved config per the
+#1100 invariant — whose test caught the first version of the patch.
+