docs(wish): record the #2817 FIX-FIRST review and fix disposition in the dual-mode Orca ledger

.genie/INDEX.md

@@ -19,7 +19,6 @@
 - [brainstorm-domain-map](brainstorms/brainstorm-domain-map/DRAFT.md) — **LIVE (re-verified 2026-07-21):** WRS 80; executable spec compiler (intent → requirement-ID → oracle-class → execution → proof-packet); deterministic gates, residual-risk review only; subjective-truth ownership still open (umbrella G8)
 ## Ready
 
-- [genie-dual-mode-orca-plugin — DESIGN](brainstorms/genie-dual-mode-orca-plugin/DESIGN.md) → [WISH](wishes/genie-dual-mode-orca-plugin/WISH.md) — **APPROVED / SHIP** (A0 canonical-doc evidence gate closed; current design digest `2499668e81fe3d3f3f7f15bac0246c3e0647a036e9441fa882dcf6a8ecb92bf9`; independent reviewer `term_6c98a3c8-7ac8-4274-a8e9-ade35e2d82dd`, `2026-08-29T18:13:16Z`): preserve standalone lifecycle authority while explicit Orca mode uses only a closed, stateless public `orca orchestration ... --json` adapter; next A1 mode guards ∥ A2 adapter → A3 plugin → A4 lifecycle → A5 packaging → A6 docs → A7 MCP retirement. P1 remains no-retry with recovery reads limited to an exact identifier known before launch; no fallback, lifecycle store, private API, board/global-DB mutation, or implementation is authorized outside this approved plan.
 
 - [WISH: v4-home-residue-doctor](wishes/v4-home-residue-doctor/WISH.md) — **DRAFT** (2026-07-05, small appetite, never started; Felipe directive: "find and clean all stale genie v4 shit… genie doctor should do that"): v4 residue manifest + doctor check/fix + diagnostics age filter. Relevance raised 2026-07-26 by the backlog sweep: the only live-impact open product bug (#2450 — v4 pgserve PM2 entry crash-loops after upgrade) is v4 daemon/process residue that file-scoped `legacy-v4.ts` never touches; this wish is the natural vehicle (added to INDEX 2026-07-26 — entry was missing)
 - [WISH: release-ops-hardening](wishes/release-ops-hardening/WISH.md) — **DRAFT** (2026-07-26, small-medium appetite; needs Felipe approval + a plan gate before execution): enforce the outage-taught release rules mechanically — publish admit refuses re-dispatch of published versions (#2674), orphan-alert exempts pending stable candidates (structural false positive on every dev→main promotion, live example #2681), #2675 dead-default deletion + multi-attestation/CAS-loop test coverage + #2669 pin-checker quoting, and dogfood FIXTURE_N tracking real N. Sequenced after the first stable release
@@ -33,6 +32,7 @@
 
 ## Poured
 
+- [genie-dual-mode-orca-plugin — DESIGN](brainstorms/genie-dual-mode-orca-plugin/DESIGN.md) → [WISH](wishes/genie-dual-mode-orca-plugin/WISH.md) — **IN_PROGRESS** (plan APPROVED/SHIP 2026-08-29 design digest `2499668e…`; A1–A7 merged to dev #2808–#2820; rolling promotion #2817 dev→main reviewed **FIX-FIRST** 2026-08-30 at `eccf0ae4a` by independent reviewer + supply-chain/architecture lenses: 6 HIGH — doctor/ui-bridge breach the Orca barrier, update aborted delivery on a failed Orca probe, adapter ignores `timeoutMs`, `run-use` read-back TypeError, unbundled-parity Orca entrypoint; 0 CRITICAL). Fixes merged #2821/#2823/#2825, open #2824/#2827/#2822/#2826, in flight adapter-readback + mode-guards; re-review required before human promotion. Also found and fixed outside wish scope: `version.yml` runs from main so the ninth version field never synced on dev (no dev tarball after v5.260829.4); `tar -xzf` without `-p` broke `genie update` under umask 077
 - [delegate-bridge — DESIGN](brainstorms/delegate-bridge/DESIGN.md) → [WISH](wishes/delegate-bridge/WISH.md) — **APPROVED 2026-08-12** (design SHIP digest `a720e84c…` after 1 fix loop — the HIGH was prepare-cadence: turn-1-only, existence-refusal ≠ dirtiness; plan SHIP after 1 fix loop — the HIGH was the doctor module path, all loop-1 advisories applied in-document): W2+W3 of cross-agent-delegation — turn-per-launch bridge (`task delegate [--continue]`, spike-first, `requireRosterAgent` at consumption, adapter cards ×5 with hermes stateless, fail-open + single first-turn `-r1` orphan retry, timeline-recorded orphan doctor check) and `task fan` fan-out with ratification picker. 7 groups A (unblocked W1 handoffs) · S gate · B ∥ C · D ∥ E · F live smoke; cards `t_msp6a1ql…`–`t_msp6a25s…`, wish card `t_msp4fp6ce714c8be` task-blocked on remotty `headless-turn-open` (seeded in remotty's `.genie` 2026-08-11, board card there) **Amendment recorded 2026-08-13 (spawn-context-contract group reversals):** S–F turn transport re-bases to live herdr sessions; the block re-targets from `headless-turn-open` to the herdr 0.3 swap + `engine-turn-verbs` (remotty card `t_msqkkjt221792465`), recorded on the umbrella + group cards in the board snapshot.
 - [cross-agent-delegate — DESIGN](brainstorms/cross-agent-delegate/DESIGN.md) → [WISH](wishes/cross-agent-delegate/WISH.md) — **APPROVED 2026-08-11** (design SHIP digest `c15d6a9e…` after 2 fix loops; plan SHIP with all 7 findings applied in-document, incl. the A1/A2 gate split; re-opened orca-inspired 2026-08-10, umbrella G6): W1 declared-routing wish — `assigned_agent`+`assigned_reason` on the card (default = current agent), roster allowlist (claude/codex/pi/hermes/prime), `create --agent/--why` + `task assign --clear`, lane-path-only `board --json` (laneless stays byte-frozen), roadmap-sync lockstep; 4 groups A1 → A2 ∥ B ∥ C, 5 board cards. Follow-on `delegate-bridge` poured 2026-08-12 (entry above) with the 5 logged residuals resolved in its own SHIP'd design; unblocks remotty's `assigned_agent` rendering ask
 

.genie/wishes/genie-dual-mode-orca-plugin/WISH.md

@@ -2,7 +2,7 @@
 
 | Field | Value |
 |-------|-------|
-| **Status** | APPROVED — independent review SHIP at `2026-08-29T18:13:16Z` |
+| **Status** | IN_PROGRESS — A1–A7 merged to `dev` (#2808–#2820); rolling promotion #2817 (dev→main) reviewed **FIX-FIRST** at `2026-08-30` on `eccf0ae4a`; fix PRs in flight, re-review pending |
 | **Slug** | `genie-dual-mode-orca-plugin` |
 | **Date** | 2026-08-29 |
 | **Author** | Codex wish author |
@@ -361,6 +361,36 @@ done
 
 ## Review Results
 
+- **PR review of #2817 (dev→main) — FIX-FIRST (2026-08-30):** independent reviewer (`genie:reviewer` subagent dispatched
+  from session `session_018QrkgYMEEhrWTUo5E7Nkjg`, plus supply-chain and architecture lens panels) reviewed the pinned
+  read-only snapshot `eccf0ae4a038850896cd6bea5051301c45d5fec5` (base `origin/main` = `e0e0a32cb`; 125 files,
+  +5728/−7886, 19 commits) against A1–A7 and the repository contracts. Validation on the snapshot:
+  `bun install --frozen-lockfile` PASS; every `bun run check` gate except tests PASS on a mode-normalized tree
+  (typecheck, lint, knip, skills/wishes lint, complexity budget, council workflow, hook-bundle parity, hook content,
+  plugin executables); `bun test` 3303 pass / 19 fail / 1 skip — 1 real failure (committed `orca-plugin.json`
+  version-sync), 6 pre-existing `scripts/reconcile-release-assets.test.ts` timeouts (byte-identical blob fails the same
+  way on `origin/main`), 12 umask-077 snapshot artifacts (516/516 pass when re-run at umask 022); `bun run build` PASS
+  (single 2.29 MB bundle, Orca dynamic imports inlined). CRITICAL: none. HIGH: H1 `doctor` `checkCodexProjectContext`
+  opens `genie.db` in Orca mode (creates `-wal`/`-shm`; A1 breach); H2 `genie ui-bridge` dies on an uncaught
+  `LocalLifecycleDisabledError`; H3 `genie update` aborted delivery after the payload swap when the Orca ownership
+  refresh/probe failed; H4 adapter `executeProcess` pins a 30 s deadline and ignores validated `timeoutMs`
+  (`ask`/`check --wait`); H5 untyped `TypeError` on the `run-use` read-back when `run-current` returns `run: null`;
+  H6 shipped `orca-entrypoint.min.js` had no source-parity gate. MEDIUM: M1 flaky `bounds timeout termination` test
+  (20 ms); M2 A3 real-runtime smoke never executes anywhere; M3/M4 read-back over-strictness (100-capped `task-list`,
+  optional `model`/`effort`); M5 `pi-genie`/`hermes-genie` manifests outside the version gate; M6 `board`/`idea` raw
+  stack traces in Orca mode; M7/M8 stale MCP/`pm` references (CLAUDE.md, plugin references, Kimi `pm.md`); M9 Hermes
+  loses all tool-surface board access; M10 dead launcher validator; M11 this ledger not advanced. Root causes fixed
+  outside the wish scope during the same review: `version.yml` executes from `main` under `workflow_run`, so the
+  ninth version field never synced on dev and no dev tarball shipped after v5.260829.4; `tar -xzf` without `-p` broke
+  `genie update` under umask 077.
+- **Fix disposition (2026-08-30):** merged to `dev` — #2821 (admission tolerates umask-restricted payloads),
+  #2823 (committed Orca manifest version no longer gates dev releases), #2825 (H6 esbuild parity gate for
+  `orca-entrypoint.min.js`, wired into `check`/CI/`build-binary.sh`). Open — #2824 (`tar -xzpf` in both extractors),
+  #2827 (H3: ownership refresh runs after `publishCodexDeliveryFacts`, advisory), #2822 (`version.yml` ninth field →
+  `main`), #2826 (M7/M8 docs, Kimi `pm.md`→`quick.md`, orphan check); in flight — `fix/orca-adapter-readback`
+  (H4, H5, M1) and `fix/orca-mode-guards` (H1, H2, M6). Per-group acceptance boxes stay unticked until the clean
+  re-review; #2817 is not approved for human promotion before that re-review returns SHIP.
+
 - **Current canonical plan — SHIP:** independent reviewer `term_6c98a3c8-7ac8-4274-a8e9-ade35e2d82dd` reviewed
   reviewable DESIGN content SHA-256 `2499668e81fe3d3f3f7f15bac0246c3e0647a036e9441fa882dcf6a8ecb92bf9`
   at `2026-08-29T18:13:16Z`. The exact four-document set is approved and A1–A7 are authorized in the recorded DAG.