docs(devlog): record the 260827/260828 bug-PR merge rounds

devlog/_plan/260827_igwanu_bug_pr_merge_round/041_wp2b_2729_supersede.md

@@ -124,10 +124,24 @@ carries no competing keyword, and 25/25 passed straight over the defect.
 
 Fixed by moving the check ahead of the overload keywords in both functions: the
 explicit gRPC status is a structured backend signal, while `unavailable` and
-`temporarily` beside it are inference over free text. Differential against
-`origin/dev`: exactly one case moves (503 -> 400); real overloads, auth, rate
-limit, timeout and invalid-request are unchanged, and authentication still
-outranks both.
+`temporarily` beside it are inference over free text.
+
+Differential against `origin/dev`: **the whole failed-precondition class moves to
+400**, not a single case. Constructible inputs that change:
+
+```
+failed_precondition + "unavailable"    503 -> 400
+failed_precondition + "temporarily"    503 -> 400
+"failed precondition" + "overloaded"   503 -> 400
+bare failed_precondition               502 -> 400
+```
+
+The non-precondition controls are unchanged: real overload 503, authentication
+401, rate limit 429, timeout 504, invalid request 400.
+
+(An earlier draft said "exactly one case moves". That was the sample I happened to
+probe, not the size of the change — the correct framing is a class, and describing
+a class by one member is how a differential stops being evidence.)
 
 **This is the third time in one PR that a fix was correct in principle and wrong
 in precedence** — the envelope masking, my blanket 502, and now this. The pattern

devlog/_plan/260827_igwanu_bug_pr_merge_round/070_outcome.md

@@ -14,7 +14,7 @@ Six merges, no direct commit (verified: first-parent count 6, no-merges count 0)
 | #2764 | Ingwannu | L1 | **MERGED** | `3b5302410`; rebased, patch ID unchanged, 26 green |
 | #2767 | Ingwannu | L1 | **MERGED** | `50e955604`; rebased, patch ID unchanged, 26 green |
 | #2729 | lidge-jun | L4 | **CLOSED-SUPERSEDED** | by #2769; patch IDs match exactly |
-| #2769 | lidge-jun | L4 | **NEEDS_HUMAN** (approval) | CI green at head `16cb875b8`; self-approval refused |
+| #2769 | lidge-jun | L4 | **NEEDS_HUMAN** (approval) | head `16cb875b8`: CI 23 green / 0 fail, full suite 15350/0; self-approval refused |
 | #2747 | olddonkey | L1 | **NEEDS_AUTHOR** (rebase) | approved; fork head, rerun cannot move base |
 | #2740 | luvs01 | L1 | **NEEDS_AUTHOR** (ready+rebase) | reviewed, oracle 2/0 vs 0/2, tsc 0 |
 | #2693 | yxr1995-maker | L4 | **BLOCKED** (author) | 3 reproduced blockers stand, 131 behind |
@@ -84,6 +84,14 @@ incorrect correction is worse than the original error.
 7. A safety net that exists in code is not a safety net that functions.
 8. `gh run rerun` replays the same commit. When the fix landed elsewhere, only a
    rebase moves the evidence.
+9. A stalled remote suite is not necessarily a wedged suite. `ocx-run` reported
+   `RUNNING (775s since last output)` while `bun scripts/test.ts` sat printing
+   "another Bun test run holds the machine lock; waiting". The owner recorded in
+   `/tmp/opencodex-bun-test.lock/owner.json` was pid `2108243`, and `ps` showed it
+   dead — a **root-owned stale lock** blocking a user-owned run, which is the
+   documented failure mode. Removed the lock directory; the suite resumed within
+   seconds. `OCX_TEST_NO_QUEUE=1` remains the wrong answer: it leaks into the child
+   process `tests/test-runner.test.ts` spawns and fails the machine-lock cases.
 
 ## Follow-ups outside this round's scope
 

devlog/_plan/260828_bugpr_fix_and_reimplement/000_plan.md

@@ -0,0 +1,73 @@
+# 000 — fix-and-reimplement round: plan
+
+Base: `dev @ 50e955604`. Continues the igwanu round, which merged six PRs and left
+seven open. This round's mandate is narrower and harder: **fix what can be fixed,
+reimplement what cannot, and merge both** — the user explicitly authorized pushing
+to contributor fork branches this round.
+
+## Re-verified state (2026-08-28, against `dev@50e955604`)
+
+| PR | author | fork writable | behind | merge-tree | tsc on merged tree | own suite |
+|---|---|---|---|---|---|---|
+| #2747 | olddonkey | **yes** | 39 | CLEAN | OK | 15/0 |
+| #2740 | luvs01 | **yes** | 39 | CLEAN | OK | 2/0 |
+| #2693 | yxr1995-maker | **yes** | 131 | CLEAN | OK | 62/0 |
+| #2638 | luvs01 | **yes** | 192 | CLEAN | OK | — |
+| #2497 | MarcTCruz | **yes** | 399 | **CONFLICT** | unreachable | — |
+| #2745 | lidge-jun | n/a | 39 | CLEAN | OK | — |
+
+**#2693 passing 62/0 is the trap this round has to avoid.** Its own suite is green
+and its three reviewer-reproduced defects are all real. A suite written alongside a
+defect tends to encode it; that is why the reimplementation below is driven by the
+defect list, not by the PR's tests.
+
+## Contention
+
+`src/server/responses/core.ts` — #2745, #2638, #2497.
+`src/codex/auth-context.ts` — #2638, #2497.
+Everything else is disjoint. Pairwise `git merge-tree` before any second one of the
+three lands; textual mergeability is not behavioral compatibility on that boundary.
+
+## Lane assignment
+
+| WP | Doc | PR | lane | why |
+|----|-----|----|------|-----|
+| wp2 | 010 | #2747, #2740 | **FIX** | correct code, stale base only |
+| wp3 | 020 | #2693 | **REIMPLEMENT** | three reproduced logic defects |
+| wp4 | 030 | #2745 | **FIX or NEEDS_HUMAN** | OAuth credential boundary |
+| wp5 | 040 | #2638 | **REBASE + verdict** | auth/routing boundary, 192 behind |
+| wp6 | 050 | #2497 | **adjudicate** | OAuth refresh, conflicting, 399 behind |
+| wp7 | 060 | — | close-out | ledger + verification |
+
+## Loop-spec
+
+- Archetype: spec-satisfaction repair. Each target has a verifier that defines done.
+- Write scope: `devlog/_plan/260828_bugpr_fix_and_reimplement/`, `src/` and `tests/`
+  changes needed to fix or reimplement a target, fork-branch rebases where
+  `maintainerCanModify` is true, `codex/` branches, PR metadata.
+- Out of scope: `main`/`preview`, releases, enhancement PRs, history rewrite on
+  `dev`, approving my own PRs, pre-disclosure security notes in tracked dirs.
+- Bounds: one `bun test` at a time; long suites on `lidge` via `ocx-run`. Never
+  `OCX_TEST_NO_QUEUE=1` — remove a stale root-owned lock instead.
+
+## Standing gates
+
+1. Compile/test evidence from the MERGED tree, never the PR head.
+2. Pairwise `git merge-tree` before two PRs sharing a file both land.
+3. Green checks are not health unless `ci` / `test N/4` / `macos` are present.
+4. **Green targeted suites are not health either — you chose the targets.** Any
+   function whose behavior changes gets a differential probe over every arm.
+5. `gh run rerun` replays the same commit; only a rebase moves the base.
+6. A safety net that exists in code is not one that functions.
+7. A regression must FAIL without its fix (mutation-verified) to count as evidence.
+
+## Accept criteria (mirrored into goalplan criteria[])
+
+- c1 — every target has a recorded terminal disposition verified against live `gh`.
+- c2 — merged-tree compile/test gate ran for every candidate.
+- c3 — each landed change carries a mutation-verified regression.
+- c4 — `dev` advances only through PRs targeting `dev`; forks rebased, not rewritten
+  beyond the authorized scope.
+- c5 — every behavior-changing function is differentially probed across all arms.
+- c6 — auth/credential/OAuth surfaces land only when proven safe, else
+  NEEDS_HUMAN/UNSAFE with the exact unresolved question.

devlog/_plan/260828_bugpr_fix_and_reimplement/010_phase1.md

@@ -0,0 +1,108 @@
+# 010 — wp2 FIX lane: #2747 and #2740
+
+Both are correct code sitting on a stale base. Neither needs a logic change; both
+need a rebase I am now authorized to push.
+
+## #2747 — reap the recovery proxy instead of trusting `stop`
+
+Head `07b975873`, **already approved by me**, 39 behind, merge CLEAN, tsc OK,
+15/0 on its own suite on the merged tree. Fork `olddonkey/fix/update-recovery-orphan-cleanup`,
+`maintainerCanModify: true`.
+
+Its `ci`/`macos` red is the pre-#2766 `release version line` failure, and a rerun
+cannot clear it because a rerun replays the same commit.
+
+ACTION: rebase `pr2747-r3` onto `origin/dev`, force-push to the fork branch, let CI
+run at the new head, merge when green.
+
+**Fork-push discipline.** The previous round declined this; the user has now
+authorized it. The A-gate reviewer demolished an earlier draft of this section, and
+it was right: the draft said "verify `git diff` between old and new head touches
+nothing but the rebase", and that check is actively misleading. A two-dot
+`git diff OLD NEW` after a 39-commit rebase reports the entire intervening `dev`
+range — **70 files** on #2747's real rebase — so an executor following it either
+panics at 70 files or waves through a genuine rewrite. Use checks that are invariant
+under rebase:
+
+```bash
+# 1. the patch itself is unchanged
+git diff-tree -p OLD~1..OLD | git patch-id --stable
+git diff-tree -p NEW~1..NEW | git patch-id --stable    # must match
+
+# 2. commit-for-commit correspondence — no drops, no reorders
+git range-diff origin/dev...NEW OLD_BASE...OLD          # every row reads "="
+
+# 3. the PR's own file set — three-dot, not two-dot
+git diff --name-only origin/dev...NEW
+
+# 4. never overwrite a concurrent author push
+git push --force-with-lease=refs/heads/<branch>:<author's last OID> \
+  https://github.com/<AUTHOR>/opencodex.git NEW:refs/heads/<branch>
+```
+
+On #2747 these read: patch-id `efa23210f341` both sides, `range-diff` `1: = 1:`,
+three-dot name list `tests/update-stop-first.test.ts` alone.
+
+Two further rules absent from the first draft:
+
+- **Push to the fork, never to `origin`.** Destination is
+  `https://github.com/<author>/opencodex.git`. The previous round created a stray
+  same-named branch on `origin` and had to delete it.
+- **Stop if the live head is already on current `dev`.** Re-rebasing a stale local
+  ref rewrites a branch that is already correct. Check
+  `gh pr view <n> --json headRefOid` first.
+
+**A force-push resets the readiness checklist.** `enforce-target` returns a
+contributor PR to draft and unticks all four boxes on new commits — by design, since
+an attestation about the old commit cannot cover a new one. So a rebase does not end
+at "let CI run": the PR is a draft again, and drafts here start only
+`enforce-target`/`hygiene`/`label`/`resolve-pr`/CodeRabbit, none of which compile or
+test. Two boxes ("on the latest dev commit", "resolved all Codex and CodeRabbit
+findings") become objectively true and can be evidenced; the local-CI attestation
+and the ready-for-review confirmation belong to the author. **Ask — do not tick
+another contributor's attestation.**
+
+## #2740 — atomically commit cleanup run metadata
+
+Head `f07ee36f2`, draft, 39 behind, merge CLEAN, tsc OK, 2/0 on the merged tree.
+Fork `luvs01/fix/storage-policy-metadata-race`, `maintainerCanModify: true`.
+
+Mutation oracle already proven in the previous round: revert only
+`src/storage/policy.ts` + `src/storage/policy-job.ts` and the race test goes 0 pass /
+2 fail. The test drives the interleave through
+`setPersistedConfigMutationBeforeCommitForTests`, so it is deterministic rather than
+timing-dependent — it will not become a flake later.
+
+It has only 5 checks, none of which compile or test. The merged-tree run is its first
+real evidence.
+
+ACTION: rebase onto `origin/dev`, force-push under lease, then ask the author to
+complete the readiness checklist so the full matrix runs. Merge when green **and** a
+non-author approval exists — `luvs01` is the author, so mine qualifies.
+
+Recording a judgement the reviewer flagged as unstated: this PR writes through
+`mutatePersistedConfig` into `config.json`, the file that holds API keys. It is not
+a credential surface — it changes *how* a metadata write commits, not what is
+stored, and its whole purpose is to stop clobbering concurrent edits. But "adjacent
+to the file holding the keys" deserves an explicit call rather than an assumed one.
+
+## Ordering
+
+Independent — `tests/update-stop-first.test.ts` vs `src/storage/*`. No pairwise
+merge-tree needed. Land #2747 first (already approved), then #2740.
+
+## TESTS
+
+- #2747: `tests/update-stop-first.test.ts` (the PR is the test).
+- #2740: `tests/storage-policy-config-race.test.ts`.
+
+## Verification (C)
+
+```bash
+bun x tsc --noEmit
+bun test tests/update-stop-first.test.ts          # expect 15/0
+bun test tests/storage-policy-config-race.test.ts # expect 2/0
+```
+
+Plus exact-head CI green after each rebase, and for #2740 the mutation oracle
+re-run on the rebased tree rather than the remembered one.