docs(devlog): bug-label drawdown campaign record and main->dev regression audit

devlog/_plan/260902_bug_label_drawdown/000_plan.md

@@ -0,0 +1,59 @@
+# 000 — bug_label_drawdown: Plan
+
+## Objective
+
+Reduce open items carrying the `bug` label — PRs and issues both — from **24** to **3 or
+fewer** (5 acceptable if the last few are genuinely blocked). Feature PRs and enhancement
+issues are out of scope even when they look adjacent.
+
+Inventory taken 2026-09-02.
+
+**14 bug PRs:** #3177 #3176 #3174 #3168 #3164 #3151 #3148 #3144 #3138 #3135 #3121 #3112
+#3109 #3003
+**10 bug issues:** #3170 #3155 #3152 #3150 #3141 #3136 #2999 #2813 #1527 #1419
+
+## Loop-spec
+
+- Archetype: verifier-defined. Each item has a binary terminal state.
+- Write scope: whatever a named bug requires, plus `tests/`, plus this devlog unit.
+- Out of scope: releases, promotion to `main`/`preview`, npm publish, deployment,
+  security-boundary rewrites beyond a named issue, other worktrees.
+- **Verification policy (user-directed, binding):** never run the repository-wide local
+  suite; push with `--no-verify` so no hook runs it either. Focused `bun test` files plus
+  red-green proof. CI trails the work and is judged per batch.
+- Merge mechanism: `gh pr merge --squash --admin --delete-branch`.
+- **Rebase service is authorized.** A PR whose only defect is staleness gets rebased by us;
+  when the contributor branch is unpushable, its unique commits are cherry-picked onto a
+  `codex/` carry branch with author credit preserved and the original closed
+  `landed-via-maintainer` naming the merge SHA.
+
+## Work-phase map
+
+| WP | Doc | Batch | Items | Depends |
+|----|-----|-------|-------|---------|
+| bd0 | 000 | roadmap | inventory + dispositions | — |
+| bd1 | 010 | A: merge train | #3174 #3176 #3177 #3151 | bd0 |
+| bd2 | 020 | B: rebase service | #3168 #3148 #3135 | bd1 |
+| bd3 | 030 | C: changes-requested, maintainer-owned | #3112 #3109 #3003 | bd2 |
+| bd4 | 040 | D: changes-requested, contributor-owned | #3144 #3138 #3121 #3164 | bd3 |
+| bd5 | 050 | E: needs-info issue triage | #3155 #3150 #3141 #3136 #1419 | bd4 |
+| bd6 | 060 | F: implementable bug issues | #3152 #3170 #2999 #2813 #1527 | bd5 |
+
+## Batch A state at inventory
+
+| PR | Draft | Merge state | CI |
+|----|-------|-------------|-----|
+| #3174 gui mobile overflow | no | BLOCKED | running, no failures |
+| #3176 wrapped quota rotation | no | BLOCKED | no failures listed |
+| #3177 413 context overflow | **yes** | BLOCKED | running, no failures |
+| #3151 Hermes vision export | **yes** | BLOCKED | **ci fail + macos fail** |
+
+`BLOCKED` here means "awaiting required review", not unmergeable — all four are
+`MERGEABLE`. Draft status must be cleared before merge, and #3151's red CI must be
+diagnosed rather than waived.
+
+## Accept criteria
+
+Mirrored into the goalplan as c-1..c-7. c-7 is the real bar: **open bug-labelled PRs plus
+issues total 3 or fewer**, 5 acceptable with recorded blockers.
+

devlog/_plan/260902_bug_label_drawdown/010_phase1.md

@@ -0,0 +1,80 @@
+# 010 — Batch A: MERGEABLE review-required bug PRs
+
+Four PRs are `MERGEABLE` and waiting on review rather than on their authors.
+
+## #3174 — fix(gui): mobile topbar and integration card overflow (@lidge-jun)
+
+14 files, +714/-2. Two responsive defects measured through CDP geometry rather than read
+off CSS: a flex child without `min-width: 0` held its intrinsic width and pushed the
+version badge under the action orbs at 320px; and `minmax(260px, 1fr)` could not shrink
+below a 320px content box, pushing the integration card's action row off the page.
+
+Maintainer-authored, carries before/after screenshots (which `enforce-target` requires for
+any PR mentioning gui), and records a review pass that removed an invented 400px
+breakpoint. **Action:** confirm CI, merge.
+
+## #3176 — fix(codex): rotate accounts on wrapped quota failures (@Vadevious)
+
+6 files, +219/-15. ChatGPT reports quota exhaustion as HTTP 502 with a quota-shaped
+message; the pool treated it as transient, retried the exhausted account, and surfaced
+`adapter_eof`. The fix normalizes bounded, display-safe pre-stream 5xx to the existing
+quota path with cooldown, affinity clear, and the bounded alternate retry.
+
+**Security review — performed, recorded here (A-gate finding A5).** This touches account
+selection, which `MAINTAINERS.md` puts behind explicit security review, and the PR carried
+no recorded review when it was merged. The review was done by reading the diff directly;
+recording it after the merge rather than before is the process gap, not the code:
+
+- `src/lib/errors.ts` — `upstreamErrorMessageFromPayload` reads four **canonical** paths
+  only (`error.message`, `last_error.message`, `response.error.message`,
+  `response.incomplete_details.message`) and returns a value only when it is a string.
+  Echoed request content sitting elsewhere in the payload cannot reach the quota matcher.
+- `src/server/responses/core.ts` — `shouldRetryCodexPoolAccountQuota` keeps 402/429 as an
+  immediate true, then admits 5xx **only** when the bounded body is both `displaySafe` and
+  not `truncated`. `fatalUtf8: true` rejects malformed UTF-8 rather than matching quota
+  words around replacement characters. The whole path is wrapped so a read failure returns
+  false — it fails closed, never rotates on an unreadable body.
+- The fallback for non-JSON gateways returns the raw text only from the `catch`, so a
+  well-formed JSON body is never scanned wholesale.
+- Request-log rendering stays limited to canonical fields, so the widened matcher does not
+  widen what gets logged.
+
+Verdict: the credential-boundary reasoning holds. The precedence the plan asked to verify
+is present and is what bounds the blast radius.
+
+## #3177 — fix(responses): surface provider 413 as terminal context overflow (@Ingwannu)
+
+5 files, +350/-1. A streaming 413 became a 5/5 reconnect loop; it now converts to one
+terminal `response.failed` with `context_length_exceeded` so Codex can compact next turn.
+Bounded proxy-owned failure message, so an upstream 413 body cannot echo request content.
+
+**Draft.** Body says it stays draft until exact-head CI resolves. Action: check CI, mark
+ready if green, merge. Closes bug issue #3170, so this is two items for one merge.
+
+## #3151 — fix(export): preserve Hermes vision capabilities (@Ingwannu)
+
+7 files, +97/-13. Replaces the Hermes string-only model array with the metadata map, so
+`supports_vision` is emitted from exported catalog modalities. Closes #3146.
+
+**Draft with red CI** — `ci fail` and `macos fail`. The body claims the failures are
+pre-existing. **The A-gate audit checked the logs and the claim is TRUE (A2):** `ci` is only
+a rollup reporting `platform-macos=failure`, and the macOS job's single `(fail)` is
+`server local API auth > websocket passthrough refreshes pool auth for each response.create
+turn` (`tests/server-auth.test.ts:2302`) — a known macOS flake. This PR touches
+`src/clients/config-export.ts` and the export tests, nowhere near websocket auth.
+
+Action: clear draft, merge. Do not waive the red by assertion — rerun the macOS job first
+and merge on a green or same-flake result.
+
+## Execution order
+
+1. #3174 — maintainer-authored, self-contained, screenshots present.
+2. #3177 — clear draft if CI is clean; closes #3170 too.
+3. #3176 — read the credential-path diff first.
+4. #3151 — diagnose the red CI before deciding merge vs. repair.
+
+## Verification (C)
+
+Per merged PR: `gh pr view <n> --json state,mergeCommit`, then
+`git merge-base --is-ancestor <sha> origin/dev` exiting 0. Linked issues closed by hand,
+since PRs target `dev` rather than the default branch.

devlog/_plan/260902_bug_label_drawdown/011_bd1_landing.md

@@ -0,0 +1,32 @@
+# 011 — bd1 Batch A landing record
+
+## Merged
+
+| PR | Merge SHA | Note |
+|---|---|---|
+| #3174 gui mobile overflow | `e582aee214eec70f36be3062708bd1fddcf44807` | maintainer-authored, screenshots present |
+| #3176 wrapped quota rotation | `2e2da87b512bde90a33c53d60d16550b885b9bc5` | credential path — review recorded in 010 |
+| #3177 413 context overflow | `0d6424f80d0a6c28d2abc4816029944c5dade61f` | draft cleared first; closes #3170 |
+| #3178 Hermes vision (carry of #3151) | `51c49177f59238d9e860895ffd76100c293ee4ff` | rebase service |
+
+All four proven ancestors of `origin/dev` with `git merge-base --is-ancestor`.
+
+## Rebase service, first use
+
+#3151 sat 105 commits behind `dev`. Its single commit `5ced04dc0` cherry-picked onto
+current `dev` cleanly (one auto-merge in `structure/09_client-integrations.md`), author
+credit preserved — `git show --stat` reports the same 7 files, +97/-13 as the original.
+Focused suites: 100 pass, 0 fail across 5 export/CLI/management files.
+
+#3151 closed `landed-via-maintainer` naming the carry and the merge SHA, with the reason
+for the carry and confirmation that the author's read of the red CI was correct.
+
+## Issues closed
+
+- **#3170** via #3177 — streaming 413 becomes one terminal `context_length_exceeded`.
+- **#3146** via #3178 — Hermes export emits per-model capabilities.
+
+## Count
+
+Bug-labelled items: **24 → 19** (10 PRs + 9 issues).
+

devlog/_plan/260902_bug_label_drawdown/020_phase2.md

@@ -0,0 +1,38 @@
+# 020 — Batch B: rebase service for CONFLICTING bug PRs
+
+Three PRs are `CONFLICTING`/`DIRTY`. The user authorized doing the rebase work rather than
+waiting on contributors.
+
+- **#3168** fix(remote): restore authenticated GUI health (@Ingwannu) — 27 files,
+  +117/-20, `DIRTY`. Touches the remote-hub surface that moved heavily on `dev` this week,
+  which is almost certainly the conflict source. This is #3158's T3 follow-up.
+- **#3148** fix(claude): keep proxy admission keys out of subscription launches
+  (@Veritas-7) — `CONFLICTING` + `CHANGES_REQUESTED`. Credential-boundary surface;
+  overlaps the shipped stale-credential work. Verify against current `src/cli/claude.ts`
+  before assuming it still applies.
+- **#3135** fix(codex): retain caller main after pool rejection (@luvs01) —
+  `CONFLICTING` + `CHANGES_REQUESTED`, draft. The plan guessed #3166 might have subsumed
+  it. **The A-gate audit disproved that (A3): it is INDEPENDENT.** #3166 is the *initial
+  selection* boundary — keep a healthy request-owned `__main__` pin so Pool discovery does
+  not persist an exhausted stored account before the first send. #3135 is the *post-rejection
+  retry* — after a stored Pool credential is excluded, still allow one caller-owned main
+  send. The landed tree still shows the gap: `src/codex/auth-context.ts:510` retains
+  `!options.excludeAccountId` and `src/server/responses/compact.ts:385` still drops on
+  `!authCtx.accountId`. So this gets rebased, not closed.
+
+  It is also `unsponsored_surface` on `src/codex/auth-context.ts`, the same credential
+  boundary as #3176. Rebasing is ours to do; merging needs the recorded security review.
+
+## Method per PR
+
+1. Fetch the head, rebase onto current `origin/dev` in a scratch branch.
+2. Resolve conflicts by reading both sides — never by taking one wholesale.
+3. If the contributor branch cannot be pushed to, cherry-pick unique commits onto
+   `codex/<n>-carry` preserving author credit, open the carry PR, and close the original as
+   `landed-via-maintainer` naming the merge SHA.
+4. If `dev` already contains the fix, close as superseded with the landing SHA that did it.
+
+## Verification (C)
+
+Rebased head resolves cleanly, focused tests for the touched subsystem pass, merge SHA
+proven an ancestor of `origin/dev`.

devlog/_plan/260902_bug_label_drawdown/021_bd2_landing.md

@@ -0,0 +1,66 @@
+# 021 — bd2 Batch B landing record: rebase service, three carries
+
+Every one of the three CONFLICTING bug PRs landed. None was closed as stale.
+
+| Original | Carry PR | Merge SHA | Author preserved |
+|---|---|---|---|
+| #3168 remote GUI health | #3179 | `eceb02d9d331d3f97b8f0d338c2bcd951778eb5a` | Ingwannu |
+| #3135 caller-main retry | #3180 | `634d9e5a03a6bd23c7eaea101ca712b456e15991` | luvs01 (3 commits) |
+| #3148 Claude subscription | #3182 | `865a36ef04eb6395e617f94ed87aaa474a903444` | Veritas-7 (2 commits) |
+
+All three proven ancestors of `origin/dev`.
+
+## What the conflicts actually were
+
+**#3168 — documentation only.** Both this PR and #3173 documented the same `/readyz`
+protocol fields and the same retired `allowInsecureHttp` key, in the same week. Kept the
+fuller wording on each side. No code conflicted.
+
+**#3135 — two real fixes in one `if`.** #3176 had added a 5xx quota-outcome recorder inside
+the `no-alternate` branch; #3135 widens the guard on that same branch to admit `main`.
+Taking either side alone would have silently dropped a shipped fix. Both kept: the guard
+excludes `pool`, `main-pool`, and `main`, with the recorder inside. The test conflict was
+purely additive and both authors' cases are retained — 70 pass, 0 fail proves it.
+
+**#3148 — a comment conflict hiding a real interaction.** The textual conflict was trivial
+(`dev` had gained `explicitTarget` in the block whose comment the PR rewrote). The
+interaction was not: resolving auth mode *before* adding credentials meant a machine whose
+local environment reads as a Claude subscription stripped the admission token a **connected**
+launch was explicitly constructed with. `tests/claude-cli.test.ts` caught it — expected
+`ocx_data_connected`, received `undefined`. Fixed by gating the subscription strip on
+`!explicitTarget`, with a regression.
+
+That third one is the argument for doing rebases rather than asking contributors to. The
+conflict a contributor would have resolved was one comment; the defect underneath it only
+shows up when you run the suite against current `dev`.
+
+## Security reviews recorded
+
+#3135 and #3148 both touch credential selection. Reviews were written into their PR bodies
+**before** merge, on the exact head — unlike #3176 in Batch A, where the review was recorded
+retroactively. That ordering is the process correction from the A-gate finding.
+
+## Count
+
+Bug-labelled items: **19 → 16** (7 PRs + 9 issues).
+
+## Why the rebase service is worth the maintainer time
+
+Three PRs had been sitting `CONFLICTING`, which reads on the board as "waiting on the
+contributor". None of them actually needed contributor judgment. What they needed was
+someone to run the rebase against a `dev` that had moved 100+ commits, and two of the three
+conflicts were in documentation both sides had written independently.
+
+The cost was three cherry-picks and four conflict resolutions. The return was three bug
+fixes landing that would otherwise have aged until they were stale enough to close.
+
+The #3148 case is the one to remember: the *conflict* was one comment, but the *interaction*
+underneath it broke the connected-runtime launch path, and only running the suite against
+current `dev` surfaced it. A contributor resolving that conflict on their own stale branch
+would have resolved the comment correctly and shipped the defect.
+
+## Remaining after Batch B
+
+7 bug PRs: #3164 #3144 #3138 #3121 #3112 #3109 #3003 — all `CHANGES_REQUESTED`, which is
+Batch C (maintainer-owned) and Batch D (contributor-owned).
+9 bug issues: #3155 #3152 #3150 #3141 #3136 #2999 #2813 #1527 #1419 — Batches E and F.

devlog/_plan/260902_bug_label_drawdown/030_phase3.md

@@ -0,0 +1,24 @@
+# 030 — Batch C: changes-requested, maintainer-owned
+
+Three PRs authored by @lidge-jun or @luvs01 carrying `CHANGES_REQUESTED`. Maintainer-owned
+means we can push to the branch directly.
+
+- **#3112** fix(codex): serialize native-main refresh on the CODEX_HOME claim — closes bug
+  issue #2999. Two items for one merge.
+- **#3109** fix(compact): route combo compact requests through the failover path.
+- **#3003** fix(codex): throttle repeated failed pool quota primes (draft).
+
+## Method
+
+Read the review threads first and classify each finding: still valid, already fixed, or
+rebuttable. Apply the valid ones on the branch, reply to the rest with a reason, then
+re-request review or merge on maintainer authority where the finding was addressed.
+
+Do **not** admin-merge over an unaddressed review comment — that is the line Batch C of the
+previous campaign refused to cross for #2986, and it holds here.
+
+## Verification (C)
+
+Focused tests for the touched subsystem, then landing SHA ancestry. #2999 closed manually
+once #3112 lands.
+

devlog/_plan/260902_bug_label_drawdown/031_bd3_landing.md

@@ -0,0 +1,63 @@
+# 031 — bd3 Batch C landing record: maintainer-owned changes-requested
+
+All three landed. `CHANGES_REQUESTED` turned out to mean three different things.
+
+| Original | Rebase PR | Merge SHA | What the review state actually was |
+|---|---|---|---|
+| #3112 native-main claim | #3183 | `fecb77a91386a4b99c2524b8df9f91d0dcadaee8` | already fixed on branch |
+| #3109 combo compact failover | #3184 | `afd5b4630dc59f891c4497174dd21b53ed24b400` | already fixed on branch |
+| #3003 quota prime throttle | #3185 | `fe766e129441180c6fefcdc45b9e5609b2e2c326` | **genuinely open — fixed here** |
+
+All three proven ancestors of `origin/dev`. All three rebased without conflicts.
+
+## The lesson: read the thread against the current head, not the badge
+
+Every one of these read `CHANGES_REQUESTED` on the board. Two were stale — the reviewer's
+finding had been fixed by a later commit on the same branch, so the thread stayed open while
+the defect did not.
+
+- **#3112 P2** asked that claim waiting honor the refresh abort signal.
+  `src/codex/main-account.ts` already passed `{ waitMs: 30_000, signal }` with
+  `AbortSignal.any([dependencies.signal, refreshTimeout])` — delivered by "abort contended
+  native-main refresh claims", two commits after the reviewed one.
+- **#3109 P1** asked that `ocx1` be decoded after account-gated combo failover. The branch
+  already keyed that decision on the **returned prefix** rather than the pre-failover child,
+  plus a second fix rejecting empty ciphertext where an empty `ocx1:` envelope decodes to
+  `""` rather than `null`.
+
+Closing either as "changes requested, contributor's move" would have stalled a landed fix.
+
+## #3003 was the real one
+
+CodeRabbit was right: the prune of removed-account markers sat **after** the
+provider-eligibility early return, so a removal during a disabled window never reached it,
+and restoring the same id inside `POOL_CACHE_TTL` read the stale failure as current.
+
+Fixed on the carry, not deferred. The existing test removed an account with the provider
+**enabled**, which is exactly why this survived review — the disabled-window case now exists
+and was verified red-green: moving the prune back turns it red (21/1), restoring it returns
+green (22/0).
+
+## Count
+
+Bug-labelled items: **16 → 14** (5 PRs + 9 issues).
+
+## Scope discipline on #2999
+
+030_phase3.md originally said #3112 "closes bug issue #2999. Two items for one merge."
+The A-gate audit disproved that and the correction held through execution: #2999 describes
+**two** races, and #3112 is explicitly only the lock-scope half — serializing two
+`OPENCODEX_HOME`s against one `CODEX_HOME`. The publication/overwrite race is still carried
+by the existing refuse-rather-than-overwrite check.
+
+So #3112's carry PR states that boundary in its own body and #2999 stays open. Closing it
+by association would have been the cheap way to make the count drop by one; it would also
+have buried a live race behind a green checkmark.
+
+The publication half is now Batch F work with its scope already written down.
+
+## Remaining after Batch C
+
+5 bug PRs, all contributor-owned (Batch D): #3164 #3144 #3138 #3121, plus whatever the
+recount shows.
+9 bug issues (Batches E and F): #3155 #3152 #3150 #3141 #3136 #2999 #2813 #1527 #1419.