devlog: owner backlog and bug-PR closeout unit (260825)

devlog/_plan/260825_owner_backlog_and_bugpr_closeout/000_research_snapshot.md

@@ -0,0 +1,90 @@
+# 000 — Research snapshot: owner backlog + bug PR closeout
+
+Unit opened 2026-08-25. Base: `origin/dev` at `b33d82dc3`.
+
+## Scope
+
+Two populations, 31 items at open:
+
+- **A. Maintainer-authored open issues (15):** #2569 #2568 #2566 #2565 #2558 #2557 #2491
+  #2472 #2465 #2464 #2463 #1478 #1049 #1048 #820
+- **B. Open `bug`-labelled community PRs (16):** #2567 #2563 #2555 #2550 #2542 #2532
+  #2528 #2515 #2513 #2512 #2510 #2503 #2497 #2490 #2488 #2474
+
+## Method
+
+Six read-only investigation lanes (`gpt-5.6-sol`, medium) were dispatched in parallel
+against a worktree pinned at the then-current dev head. Each lane was required to verify
+the claim in the issue/PR body against the actual line cited, and to return a verdict
+with file:line evidence rather than a plausibility judgement. Lane reports are
+summarized per item in `010`-`080`; this document records only the classification and
+the dependency order.
+
+## Classification
+
+| Item | Verdict | Effort | Risk | Owner phase |
+|---|---|---|---|---|
+| PR #2528 | MERGED (verified, 41 focused tests) | S | LOW | wp1 |
+| PR #2555 | MERGED (verified, 11 GUI tests) | S | LOW | wp1 |
+| PR #2532 | MERGED (verified, 46 focused tests) | M | MED | wp2 |
+| PR #2515 | MERGED (verified, 88 focused tests) | M | MED | wp2 |
+| PR #2474 | MERGED (Linux-only regression, skipped on macOS) | XS | LOW | wp2 |
+| PR #2550 | MERGED (verified, 138 focused tests) | XS | MED | wp3 |
+| PR #2563 | NEEDS-FIXUP (returned to draft on new commits) | M | HIGH | wp2 |
+| PR #2503 | NEEDS-FIXUP (53 commits behind; capability lost via combo/trusted/live paths) | M | MED | wp3 |
+| PR #2488 | NEEDS-FIXUP (2 correctness blockers: policy-code overwrite, envelope selection) | M | HIGH | wp5 |
+| PR #2542 | NEEDS-FIXUP (51 commits behind; red focused test) | S | MED | wp5 |
+| PR #2513 | NEEDS-FIXUP (eviction not applied to AI Studio; test lacks HOME isolation) | S | MED | wp4 |
+| PR #2512 | NEEDS-FIXUP (substring model match caps unknown models) | M | MED | wp4 |
+| PR #2510 | NEEDS-FIXUP (`retry-after` spelling omitted from transient guard) | XS | MED | wp4 |
+| PR #2567 | NEEDS-FIXUP (hygiene: missing_regression_test) | S | MED | wp5 |
+| PR #2497 | NEEDS-FIXUP (unsponsored_surface; auth boundary needs maintainer sponsorship) | L | HIGH | wp5 |
+| PR #2490 | NEEDS-FIXUP (unsponsored_surface only; code reviewed sound) | S | MED | wp5 |
+| Issue #2565 | IMPLEMENT (formatter mismatch, renderer already exists) | XS | LOW | wp8 |
+| Issue #2566 | IMPLEMENT (CLI never passes `quota=1`) | M | MED | wp8 |
+| Issue #2558 | IMPLEMENT (no destination-authority field on tier observation) | S | MED | wp9 |
+| Issue #2557 | IMPLEMENT (PowerShell statement join + probe failure is not absence) | S | HIGH | wp9 |
+| Issue #2491 | IMPLEMENT (four relations confirmed with file:line) | M | MED | wp10 |
+| Issue #2472 | INVALID/WONTFIX (envelope owned by the Codex host, not this proxy) | XS | LOW | wp11 |
+| Issue #2465 | IMPLEMENT (GUI surface) | L | MED | wp12 |
+| Issue #2464 | IMPLEMENT (GUI surface) | L | HIGH | wp12 |
+| Issue #2463 | IMPLEMENT (GUI surface) | L | HIGH | wp12 |
+| Issue #2569 | IMPLEMENT (live roster drift, measured) | M | LOW | wp6 |
+| Issue #2568 | IMPLEMENT (generalize OAuth account failover) | M | MED | wp7 |
+| Issue #1478 | IMPLEMENT (config provenance still absent) | L | HIGH | wp13 |
+| Issue #1049 | IMPLEMENT (legacy homes still `legacy-uncoordinated`) | L | HIGH | wp13 |
+| Issue #1048 | IMPLEMENT (disposable-host runner absent) | L | HIGH | wp13 |
+| Issue #820 | IMPLEMENT (session-lane scheduler absent) | L | HIGH | wp13 |
+
+## Key findings that change the plan
+
+**#2472 is not our bug.** `wall_time_seconds` and `exec_command` appear nowhere under
+`src/` or `tests/` — that result envelope belongs to the Codex host. The lane also
+rejected the Cursor call-ID theory: live bridge calls pass `allowEmptyArgs: true`
+(`src/adapters/cursor/live-transport.ts:243`) and duplicate call IDs are deduplicated
+deliberately (`src/adapters/cursor/protobuf-events.ts:1044`). Closing with evidence
+rather than implementing.
+
+**The four old architecture issues are genuinely open.** #1478, #1049, #1048, and #820
+were each checked against `_fin` units and against `src/`. All four are real remaining
+work, all L, all HIGH risk. They are not stale-but-done, and they cannot be honestly
+closed by adjudication alone. They form wp13 and are the largest single risk to the
+DONE criterion.
+
+**Three hygiene-blocked PRs fail for two different reasons.** #2567 fails
+`missing_regression_test` — a real, satisfiable gap. #2497 and #2490 fail
+`unsponsored_surface`, which is a maintainer-sponsorship gate on the auth/quota
+surface, not a code defect; #2490's code was reviewed sound.
+
+**The three Google PRs do not conflict.** #2510 changes `google-errors.ts`; #2512 and
+#2513 change `google.ts`. No merge-order dependency, but #2512 and #2513 will textually
+conflict with each other and must be sequenced.
+
+## Dependency order
+
+wp1 → wp2 → wp3 (merge train, ordered by base freshness) runs first because every later
+implementation phase rebases on a moving dev. wp4/wp5 are independent of each other.
+wp6-wp12 are implementation phases on issues; wp12 is the only GUI-bearing phase and
+routes through cxc-dev-uiux-design before cxc-dev-frontend. wp13 is last because it is
+the only phase whose scope can force a plan amendment.
+

devlog/_plan/260825_owner_backlog_and_bugpr_closeout/001_audit_response.md

@@ -0,0 +1,100 @@
+# 001 — Audit response (round 1)
+
+Independent auditor verdict: **fail**, 5 blocking findings. Findings are accepted
+unless an explicit rebuttal is recorded.
+
+## B1 — The admin merge train left dev red. ACCEPTED, FIXED.
+
+The auditor was right and the failure was real. Reproduced locally at `e42778adc`:
+`bun test tests/subagent-model-fallback.test.ts tests/subagent-fallback-handle-responses.test.ts`
+→ 86 pass / **2 fail**, both throwing `CodexPoolAuthenticationError` at
+`src/codex/auth-context.ts:464`.
+
+Root cause is a semantic conflict invisible to either PR alone. #2550 made
+`gpt-5.6-*` account-gated and fails closed when the entitlement snapshot has no
+roster (`auth-context.ts:463`). Two preview cases added by #2515 bind on
+`gpt-5.6-sol` without installing a roster mock, while the neighbouring cases #2550
+itself touched do install one (lines 732, 793). Each PR was green alone; only the
+union is red.
+
+Fixed in #2570 (merged `6b08567fa`). Post-fix CI run `32865619167`: all four test
+shards, gates, api-usage, storage-policy and all three keyring jobs **success**;
+14745 pass / 1 fail. The one remaining failure is
+`tests/cursor-desktop-exec.test.ts` "computer-use non-zero exit", which passes
+locally 12/12 — the known desktop-exec flake, unrelated to this change.
+
+**Process correction for the rest of the loop:** focused suites are necessary but not
+sufficient. Two PRs touching one subsystem get a combined run on the merge result
+before the second lands, and dev CI is checked after each landing.
+
+## B2 — #2472 INVALID/WONTFIX is unsupported. ACCEPTED, RECLASSIFIED.
+
+Doc 070 proved only that the envelope FIELDS are host-owned, which does not establish
+that OpenCodex cannot emit an empty successful turn. Counter-evidence:
+`src/adapters/cursor/protobuf-events.ts:1055` can return `[]`,
+`finalizeTurnEvents` emits `done` without semantic output (`:1365`), and
+`emptyCompletionRetry` is off by default (`src/config.ts:869`).
+
+Reclassified **INVALID/WONTFIX → IMPLEMENT (protocol gap)**. wp11 owns closing the
+zero-output producer path. "Not reproduced" is a note, not a verdict.
+
+## B3 — Security/auth material in tracked devlog. ACCEPTED, MOVED.
+
+`AGENTS.md:95-128` is unambiguous and the plan violated it: unreleased credential and
+replay analysis in `030` §#2497, and unimplemented rotator design in `050`. Both are
+pre-disclosure — #2497 is unmerged auth work and #2568's rotator does not exist yet.
+
+Resolution: both sections are reduced to a public pointer (issue/PR number plus the
+already-public gate name) and the analysis moves to `.tmp/` for the duration. The
+redaction lands before this unit is pushed.
+
+## B4 — WP13 is not a credible single phase. ACCEPTED, RESTRUCTURED.
+
+The honest reading is stronger than the plan's: #1478's owner disposition says it
+needs its own cycle, #820 says explicitly it is roadmap work "not an issue a backlog
+pass should touch", #1049 is deliberately deferred. Four L/HIGH programs are not one
+work-phase, and closing them by adjudication would be the completion-shrinking
+GOAL-COMPLETE-GATE-01 exists to stop.
+
+Split into wp13a/wp13b/wp13c/wp13d, one issue per PABCD cycle. If a cycle proves the
+work exceeds this loop's bound, that phase reports `NEEDS_HUMAN` or
+`BUDGET_EXHAUSTED` — not a blanket DONE. #1048 goes first as the closest to closable.
+
+## B5 — WP12 is narrower than its issues. ACCEPTED, WIDENED.
+
+#2463-#2465 require persisted schema/baseline, convergence, management API, CLI, docs
+and GUI; doc 080 framed them as `Models.tsx` work. wp12 acceptance now names each
+non-GUI surface, so a GUI-only implementation cannot satisfy it.
+
+## Non-blocking and missed hazards adopted
+
+- **N2 stale heads.** #2563 is now `bc37d3d7`, non-draft, current-base; #2503 is 59
+  behind / 2 ahead. Doc 010's SHAs are stale; re-verify at exact head before acting.
+- **H2 shared-core serialization.** #2563, #2497, #2488, #2558 and the later
+  architecture work all touch `src/server/responses/core.ts`; #2488 also touches
+  `src/lab/`. Serialize them, rebase each at exact head, and make
+  `tests/core-lab-boundary.test.ts` a required gate (`AGENTS.md:37-53`).
+- **H3 #2465 before #2464.** Adopted as a hard order: a non-empty preset allowlist
+  makes #2464 structurally inert for preset providers and avoids blocklist growth.
+- **H4 WP7 surface enumeration.** wp7 must enumerate every `hasKeyPoolFailover` call
+  site (Responses core, compact Responses, native Chat) or it can generalize the
+  rotator while leaving live OAuth 429 paths unfixed. Presence-driven default-on is
+  flagged as an explicit consent question for the user.
+- **H5 Google rebase order.** #2512/#2513 both rebase over merged #2532's
+  `google.ts`: rebase → full adapter CI → rebase second over that result → combined
+  Google suites.
+
+## New item admitted this round (LOOP-UNIT-CHAIN-01)
+
+The user reported a further defect: a Codex model configured with a 922k context
+window is reported as 258k inside a subagent. Admitted as wp15 with its own
+investigation; it is a catalog/context-resolution defect, not part of any existing
+phase.
+
+## Verification environment (user directive, this round)
+
+Pushes use `--no-verify`; the pre-push hook duplicates repository CI and blocks the
+loop for minutes per push. Long or device-specific verification runs asynchronously on
+`ssh lidge` / `ssh macmini`, with a real install on `macmini` when a released build
+must be exercised. CI is the final gate, repaired at the end rather than per step.
+

devlog/_plan/260825_owner_backlog_and_bugpr_closeout/010_wp2_merge_train_remainder.md

@@ -0,0 +1,26 @@
+# 010 — wp2/wp3 merge train remainder
+
+Landed already (verified locally, focused suites green, admin-squashed onto dev):
+#2528 (7cf041cf7), #2555 (70eb01d19), #2532 (fea4538d5), #2515 (6c4556cfb),
+#2474 (b33d82dc3), #2550 (e42778adc).
+
+## Remaining in this decade
+
+### #2563 — Cursor ref-less checkpoint ownership
+Head moved to `f7892785` after the lane report and the PR returned to draft, which
+resets the contributor readiness checklist by design. The code at head `93057665` was
+verified locally: `bun test tests/cursor-request-builder.test.ts` → 49 pass.
+Action: re-verify the NEW head, then merge. The one unresolved CodeRabbit thread asks
+for broader ja/ translation parity on a pre-existing doc and is not a correctness
+blocker.
+
+### #2503 — xAI verbosity
+53 commits behind dev, and the lane found the fix incomplete: an explicit
+`supportsVerbosity: false` is lost through combo derivation
+(`src/codex/catalog/aggregation.ts:173`) and trusted replacement rows
+(`src/codex/catalog/provider-fetch.ts:2147`), and live-discovered xAI/Kiro ids can
+still advertise verbosity because `modelRecordValue` has no provider-wide fallback
+(`src/reasoning-effort.ts:83`).
+Action: rebase onto dev, add the conservative false through both derivation paths plus
+a provider-wide fallback, extend `tests/codex-catalog.test.ts`.
+

devlog/_plan/260825_owner_backlog_and_bugpr_closeout/020_wp4_google_lane.md

@@ -0,0 +1,32 @@
+# 020 — wp4: Google adapter lane (#2510, #2512, #2513)
+
+No merge-order dependency between #2510 and the other two (#2510 touches
+`google-errors.ts`; #2512/#2513 touch `google.ts`), but #2512 and #2513 will
+textually conflict and must be sequenced.
+
+### #2510 — Antigravity quota exhaustion classification
+Defect: the transient guard matches `retry after` but not the standard `retry-after`
+spelling (`src/adapters/google-errors.ts:33-51`), so
+`Quota exceeded; retry-after: 60` is classified as permanent exhaustion via
+`isQuotaExhaustedBody` (`:104-113`). A transient 429 then suppresses retry and can
+trigger account-fallback exhaustion.
+Fix: add the hyphenated spelling to the transient guard; regression in
+`tests/google-errors.test.ts`. Effort XS.
+
+### #2512 — max output token clamp
+Defect: substring matching (`src/adapters/google.ts:51-58`) treats any id containing
+`pro`/`oss` as known, silently capping every unknown model at 16,384. The PR's own
+tests lock that fallback in (`tests/google-output-clamp.test.ts:5-12`), and it
+contradicts `structure/02_config-and-codex-home.md:321` (explicit request values win).
+Fix: exact-id matching with an explicit unknown-model passthrough; rewrite the test to
+pin passthrough rather than the silent cap.
+
+### #2513 — thought-signature replay
+Defect: durable lookup applies to every Google mode (`src/adapters/google.ts:268-277`)
+but eviction is restricted to Cloud Code Assist/Vertex (`:631-646`), so AI Studio
+keeps rejected signatures cached — replay-store poisoning. Separately the new
+persistence suite writes without `OPENCODEX_HOME` isolation
+(`tests/google-signature-history-roundtrip.test.ts:605`), so it can touch the
+operator's real config.
+Fix: apply eviction across all modes; sandbox the test home.
+

devlog/_plan/260825_owner_backlog_and_bugpr_closeout/030_wp5_hygiene_and_drafts.md

@@ -0,0 +1,40 @@
+# 030 — wp5: hygiene-blocked and draft PRs
+
+Two distinct gate failures, not one.
+
+### #2567 — `missing_regression_test` (satisfiable)
+The change sets `timeout: 0` on upstream fetches. The gate objects because the PR
+changes source files and adds no test.
+Fix: add propagation coverage in `tests/fetch-header-timeout.test.ts` and
+`tests/claude-messages-endpoint.test.ts`.
+
+### #2490 — `unsponsored_surface` only
+Quota-window preservation. Code was reviewed and found sound; CodeRabbit's one finding
+was resolved by the author. The failing gate is a maintainer-sponsorship requirement on
+the quota surface, not a defect.
+Action: sponsor, verify at exact head, merge.
+
+### #2497 — `unsponsored_surface`, credential boundary
+Native-main token refresh and replay. This is the authentication/credential surface that
+`AGENTS.md` places under explicit security review, and the change is unmerged, so its
+analysis is pre-disclosure material. Per `AGENTS.md` §"Security working notes" the
+review notes live in scratch (`.tmp/260825_backlog_scratch/`), not here.
+Action: rebase, exact-head security review, then sponsor. HIGH risk; do not shortcut.
+
+### #2488 — two correctness blockers
+1. `adapterFailureFromEvent` overwrites the classified policy code before testing it
+   (`src/bridge.ts:131`), so a conflicting-code policy failure stays 502/retryable —
+   a retry across a safety boundary.
+2. `normalizeUpstreamErrorText` takes the first field-bearing envelope
+   (`src/server/responses/core.ts:694`) whereas passthrough scans every candidate
+   (`src/server/responses/passthrough-error.ts:15`), so a generic outer envelope can
+   hide a nested `cyber_policy`.
+Both need regressions in `tests/cyber-policy-error-fidelity.test.ts`.
+Serialization: this PR touches `core.ts` and `src/lab/` — see 001 §H2.
+
+### #2542 — stale catalog during refresh
+All code-review findings addressed at head `e30a0cfd`, but 51 commits behind and the
+focused file still reports one failure at
+`tests/codex-app-server-processes.test.ts:925`.
+Action: rebase, then dispose of that failure at exact head.
+

devlog/_plan/260825_owner_backlog_and_bugpr_closeout/040_wp6_cursor_catalog.md

@@ -0,0 +1,27 @@
+# 040 — wp6: Cursor catalog refresh (#2569)
+
+Measured 2026-08-25 against a live logged-in account: `GetUsableModels` returns 204
+wire ids normalizing to 34 base models; `CURSOR_STATIC_MODELS` carries 50 entries.
+
+Missing from the catalog: `gemini-3.7-flash` (low/medium/high) and
+`gemini-3.6-flash` (minimal/low/medium/high). `minimal` is not currently in
+`CANONICAL_EFFORT_SUFFIXES`, which is derived from `CURSOR_MODEL_EFFORT_TIERS`
+values — listing it in the 3.6 ladder admits it.
+
+Drifted ladders: `claude-opus-5`, `claude-4.6-sonnet`, `gpt-5.5`, and the three
+`gpt-5.6-*` families (live exposes a `none` tier the map lacks).
+
+Unmodelled axis: a `-thinking` family whose suffix ORDER varies —
+`{base}-thinking-{effort}` for Opus 4.7/4.8/5, `{base}-{effort}-thinking` for
+4.6/4.5-opus, bare `{base}-thinking` for 4-sonnet/4.5-sonnet.
+`isCursorModelAvailableForAccount` matches none of these, so they are invisible.
+
+Static-only entries (13) survive as the logged-out/discovery-failure fallback and
+should be pruned or re-justified. `glm-5.3` is a documented preemptive seed and stays.
+
+Decision for this phase: add the two Gemini models with their real ladders, admit
+`minimal`, refresh the drifted ladders, prune the stale static entries, and expose the
+`-thinking` families as first-class base ids the way the `-fast` families were handled
+in `831810c13`. Vision classification must keep the new Gemini rows on the native path
+(`CURSOR_NO_VISION_MODELS` currently lists composer/glm only).
+

devlog/_plan/260825_owner_backlog_and_bugpr_closeout/050_wp7_oauth_failover.md

@@ -0,0 +1,24 @@
+# 050 — wp7: generic OAuth multi-account 429 failover (#2568)
+
+Public statement of the gap (the issue is public; the patch design is not, and lives in
+`.tmp/260825_backlog_scratch/050_full_analysis.md` until it ships — `AGENTS.md`
+§"Security working notes").
+
+Today's ladder: API-key pools rotate by default (`hasKeyPoolFailover`), the Codex pool
+has its own quota/lease machinery, and Anthropic OAuth rotates only when its opt-in is
+set. `hasKeyPoolFailover` returns false for `authMode === "oauth"`, so several OAuth
+providers have no recovery path on a 429.
+
+Phase requirements (acceptance, not design):
+
+1. Enumerate EVERY `hasKeyPoolFailover` call site — Responses core, compact Responses,
+   native Chat — and prove each observable OAuth 429 path is covered. Generalizing the
+   rotator without this leaves live paths unfixed (001 §H4).
+2. The Codex pool is out of scope; its quota scopes, probe leases and affinity must not
+   be reimplemented.
+3. Existing Anthropic configuration keeps its current meaning.
+4. Rotation is bounded per request.
+5. **Open consent question for the user:** presence-driven default-on rotation spends a
+   second account's subscription quota. This is a product decision, not a code decision,
+   and is escalated rather than settled by an opt-out knob.
+