docs(devlog): plan the 260911 lane dispatch round

devlog/_plan/260911_lane_dispatch_round/000_plan.md

@@ -0,0 +1,68 @@
+# Lane dispatch round — 260911
+
+Freeze: `origin/dev` `6d3ad12e3` (package.json 2.51.0). Every lane branch is cut from that SHA.
+
+## Why this round exists
+
+`dev` did not move for 24 hours while 80 pull requests stayed open. The blocking pattern is not
+reviewer capacity alone: three of the most urgent PRs (#4184, #4181, #4203) sat at
+`CHANGES_REQUESTED`, and four more (#4188, #4174, #4171, #4210) were reset to draft by the
+readiness gate after a push. Waiting on those forks does not land anything this round.
+
+## What decides the lane boundaries
+
+File ownership, not topic. `010_lane_partition.md` records the measured collisions across 27 open
+PRs. Two facts fix the shape of this round: `src/server/responses/core.ts` is contended by four
+open PRs and `src/providers/quota.ts` by another four, while twelve PRs touch no file any other
+PR touches. Lanes are cut so that no two lanes own the same file, which is what makes unlimited
+parallel agents useful rather than a rebase generator.
+
+## Decision-free filter
+
+This round dispatches only work whose expected behaviour is already fixed by a filed issue, so no
+lane has to invent a maintainer policy. An item is in when the issue states the expected result and
+no competing design is open; it is out when landing it would decide a policy the maintainer has not
+decided.
+
+Excluded on purpose, with the decision that blocks each one:
+
+- #4213 — whether unknown native-surface endpoints are forwarded upstream or keep returning 404 is a
+  proxy policy decision, and the issue explicitly asks for it.
+- #4198, #4179 — publishing an official container image changes a documented policy
+  ("opencodex does not publish an official container image").
+- #4173 — the atomic update design competes with #4185 and #4203 already in flight.
+- Contributor feature PRs (#4183, #4100, #4111, #4193, #4033, #4042) — these need review, not
+  reimplementation, and reimplementing them would discard the author's work.
+
+## Roles
+
+The orchestrator thread owns the round: it holds the host goal, tracks every lane, refreshes live PR
+and CI state, and performs merges one at a time. Lane threads own implementation inside their file
+territory and stop at a green PR; they never merge and never touch another lane's files.
+
+## Execution rules carried from earlier rounds
+
+These are not new. They are the rules this repository's earlier parallel rounds ran under, and they
+are repeated inside every packet so a lane thread that never reads this file still obeys them.
+
+1. **No local product suite.** No `bun test`, no `bun run test`, no `bun run typecheck`, no build, no
+   install. Report those checks as `NOT RUN` and bind confidence to hosted CI. Reading source and
+   running read-only `git`/`gh` is not a suite run.
+2. **Push with `--no-verify`**, and prefix every mutating git command with
+   `git -c core.hooksPath=/dev/null` — this repository's hooks can start a GUI install, typecheck,
+   and build, which rule 1 forbids.
+3. **Ordinary dependent PRs.** The first PR of a lane targets `dev`; a child targets its parent's
+   head branch, and is retargeted to `dev` after the parent lands. No native GitHub stacks.
+4. **Attribution.** Carrying, superseding, or reimplementing another author's work requires a
+   `Co-authored-by` trailer naming that author in a branch commit, not prose.
+5. **Final-head CI is the proof.** Green on an older head, a cancelled run, or a skipped job is not
+   passing evidence. The exact pushed SHA must be the one that is green.
+6. **Unlimited `xai/grok-4.6` subagents**, read-only. They verify, reproduce, and audit; they do not
+   write files, and no finding enters a lane's work without a `path:line` anchor.
+
+## Merge policy
+
+Merges are serialized through the orchestrator because `dev` is protected and shared. A lane PR
+merges when its exact head is green on final-head CI; the landing is proven by fetching `origin/dev`
+and checking ancestry, never by the merge command's own output.
+

devlog/_plan/260911_lane_dispatch_round/010_lane_partition.md

@@ -0,0 +1,53 @@
+# Lane partition — measured file collisions
+
+Method: `gh pr view <n> --json files` over 27 open PRs on 2026-09-11, `devlog/` paths dropped, then
+grouped by path. This is a snapshot; a lane that finds a new collision reports it rather than
+working around it silently.
+
+## Contended files
+
+| Count | Path | Open PRs |
+|---|---|---|
+| 4 | `src/server/responses/core.ts` | #4050, #4118, #4181, #4184 |
+| 4 | `src/providers/quota.ts` | #4090, #4105, #4174, #4210 |
+| 4 | `tests/providers/provider-quota.test.ts` | #4090, #4105, #4174, #4210 |
+| 3 | `gui/src/i18n/{de,en,fr,ja,ko,ru,tr,zh,zh-TW}.ts` | #4111, #4183, #4193 |
+| 3 | `scripts/test-layout/layout.json` | #4119, #4193, #4203 |
+| 3 | `tests/fixtures/test-layout-expected.json` | #4119, #4193, #4203 |
+| 2 | `src/server/claude-messages.ts` | #4050, #4184 |
+| 2 | `src/server/chat-completions.ts` | #4118, #4184 |
+| 2 | `src/types/tools.ts` | #4171, #4181 |
+| 2 | `src/combos/resolve.ts` | #4090, #4105 |
+| 2 | `src/config.ts` | #4100, #4183 |
+| 2 | `src/update/job.ts` | #4185, #4203 |
+
+Collision-free PRs, touching no file any other open PR touches: #4062, #4104, #4119, #4124, #4130,
+#4139, #4159, #4177, #4178, #4187, #4188, #4199.
+
+The two `test-layout` rows are the interesting ones. #4119, #4193, and #4203 have nothing to do with
+each other and still collide, because every new test file has to be registered in both. The way out
+is naming, not coordination: a test file named `tests/<domain>/<name>.test.ts` is placed by the regex
+seeds in `layout.json` and needs no entry at all.
+
+## Lanes
+
+| Lane | Branch | File territory | Stack order |
+|---|---|---|---|
+| L1 | `codex/260911-l1-responses-core` | `src/server/responses/*`, `src/server/chat-completions.ts`, `src/server/claude-messages.ts`, `src/providers/opencode-go-transport.ts`, `src/types/tools.ts`, `src/responses/code-mode-helper-compat.ts` | #4172 → #4176 |
+| L2 | `codex/260911-l2-catalog-provider` | `src/providers/quota*.ts`, `src/codex/catalog/*`, BigModel provider preset | #4201 → #4207 |
+| L3 | `codex/260911-l3-account-pool` | `src/codex/account-*.ts`, `plan*.ts`, `warmup.ts`, `model-entitlements.ts` | #4126 → #4212 → #4211 |
+| L4 | `codex/260911-l4-service-cli` | `src/update/*`, `src/service*.ts`, `src/cli/*`, stop/ownership refusal paths | #4202 → #4169 → #4204 |
+| L5 | `codex/260911-l5-integrations-io` | `src/config/atomic-write.ts`, `src/integrations/*` | #4197 → #4214 |
+| L6 | `codex/260911-l6-streaming-tools` | streaming/WebSocket prelude paths, vendor scaffolding filters | #4191 → #4190 |
+| L7 | `codex/260911-l7-docs` | `docs-site/**` only | #4215 → #4200 |
+
+## Custody of shared assets
+
+Three assets are owned by nobody in this round and would otherwise collide across lanes.
+
+- `scripts/test-layout/layout.json` and `tests/fixtures/test-layout-expected.json`: no lane edits
+  them. Name new test files conventionally so the regex seeds place them.
+- `gui/src/i18n/*`: no lane in this round adds a locale key. A lane that believes it needs one stops
+  and reports it to the orchestrator instead of editing nine files.
+- `src/config.ts`: only L3 may add a configuration field, and only the opt-in key named in #4211.
+

devlog/_plan/260911_lane_dispatch_round/020_lane_packets.md

@@ -0,0 +1,181 @@
+# Lane dispatch packets — 260911
+
+Seven implementation lanes, one Codex thread each, one worktree each, dispatched in one round.
+They run concurrently because their file territories do not intersect (`010_lane_partition.md`).
+
+## Shared frame
+
+Every packet carries this frame; only `SCOPE` differs.
+
+**Repository.** Your worktree is listed in your packet. It is already checked out on your lane
+branch, cut from `origin/dev` `6d3ad12e3` (2.51.0). Work only there. Do not `git worktree add`,
+move, or remove any worktree, and do not touch another lane's directory.
+
+**Loop.** Run `$codexclaw:cxc-loop` as HOTL for your lane's scope: one work-phase per issue in your
+stack, in the given order. Your goal ends when your last PR is green and reported, not when you
+think the code is right.
+
+**Subagents.** Unlimited `xai/grok-4.6` subagents, read-only. Use them to reproduce, to read the
+call sites you are about to change, to hunt for a second caller of the same helper, and to audit
+your own diff adversarially before you push. A subagent finding enters your work only with an exact
+`path:line` anchor. Subagents never write, commit, push, or call a mutating `gh`.
+
+**MUST NOT.**
+
+- No local product suite: no `bun test`, no `bun run test`, no `bun run test:changed`, no
+  `bun run typecheck`, no `bun run build:gui`, no `bun install`. Report them as `NOT RUN`.
+- No merge, no release, no force-push to any shared branch, no direct push to `dev`.
+- No edits to `scripts/test-layout/layout.json`, `tests/fixtures/test-layout-expected.json`, or
+  `gui/src/i18n/*`. Name new test files `tests/<domain>/<name>.test.ts` so the layout regex seeds
+  place them. If you believe you need one of those files, stop and report instead.
+- No file outside your lane's territory. A change that needs another lane's file is a report, not a
+  patch.
+- No security write-up in `devlog/`; scratch space only, per `AGENTS.md`.
+
+**MUST.**
+
+- Prefix every mutating git command with `git -c core.hooksPath=/dev/null`. This repository's hooks
+  can start a GUI install, typecheck, and build, which the no-local-suite rule forbids.
+- Push with `--no-verify`.
+- Write the focused regression test that `AGENTS.md` requires for a behaviour change, in the domain
+  directory next to the existing tests for that subsystem. You will not run it; hosted CI will.
+- Fill every section of `.github/PULL_REQUEST_TEMPLATE.md`. Put `Closes #<issue>` in the body. In
+  **Verification**, state plainly that local suite, typecheck, and build were `NOT RUN` by operator
+  instruction and that hosted CI on the exact pushed head is the proof.
+- When you carry, supersede, or reimplement another author's pull request, add a `Co-authored-by`
+  trailer naming that author in a branch commit. Resolve the address with
+  `gh api users/<login> --jq '.id'` and use `<id>+<login>@users.noreply.github.com`. Prose is not a
+  substitute; `.github/scripts/pr-carry-attribution.cjs` reads the trailer.
+- Keep a devlog unit for your lane under `devlog/_plan/260911_l<N>_<slug>/`, with the plan, the
+  evidence you actually captured, and the decision you made where the issue left room.
+
+**Stacking.** Your first PR targets `dev`. Your second targets your first PR's head branch, your
+third targets your second. `enforce-target` allows that for children of an open parent. After a
+parent lands, retarget the child to `dev`. Do not register a native GitHub stack.
+
+**Stop conditions.** Stop and report, do not decide, when: the fix requires a policy the issue does
+not already fix; the change would touch another lane's territory; a locale key or a layout-json entry
+turns out to be unavoidable; or hosted CI fails for a reason outside your diff.
+
+**Report format to the orchestrator.** For each PR: number, exact head SHA, the CI run id and its
+conclusion, the issue it closes, the co-authors credited, and anything you decided that the issue
+left open. Say `NOT RUN` for local checks; never imply a suite you did not run.
+
+**Decision boundary.** You do not merge. You do not close another author's PR. You do not rank your
+lane against another. When your last PR is green, report and stop.
+
+## L1 — responses and tool contract
+
+Worktree `~/.codex/worktrees/260911-l1/opencodex`, branch `codex/260911-l1-responses-core`.
+
+1. **#4172 — OpenCode Go sessionless requests omit `x-opencode-session`.** The issue fixes the
+   expected behaviour precisely: every request routed to the canonical Go destination carries the
+   header; a request with real conversation identity keeps its stable per-conversation value; a
+   request with no identity gets an isolated per-request value rather than none and rather than one
+   shared global id; an explicitly supplied header still wins. Carry PR #4184 by `chilung-cgu`,
+   which is at `CHANGES_REQUESTED` — read the review first and decide what survives. This is the
+   most urgent item in the round: upstream ended the grace period on 09/06 and now errors on
+   requests without the header, which is recorded with its source in the issue comments.
+2. **#4176 — a routed provider prefixes a bare Codex tool with `default.`,** and
+   `default.view_image` is then rejected as undeclared. Two competing pull requests exist and both
+   are at `CHANGES_REQUESTED`: #4181 by `chilung-cgu` normalizes the invented prefix back at the
+   undeclared-tool guard, #4171 by `rrmlima` handles the code-mode `view_image` call through unified
+   exec. Land one coherent fix, credit both authors, and say in the PR body why the other shape was
+   not taken.
+
+Territory: `src/server/responses/*`, `src/server/chat-completions.ts`, `src/server/claude-messages.ts`,
+`src/server/request-log-conversation.ts`, `src/server/responses-undeclared-tool-guard.ts`,
+`src/providers/opencode-go-transport.ts`, `src/types/tools.ts`,
+`src/responses/code-mode-helper-compat.ts`.
+
+`src/server/responses/core.ts` is the most contended file in the repository — four open PRs touch
+it. Keep the diff minimal, do not reformat, and do not opportunistically clean up around your change.
+
+## L2 — catalog and provider compatibility
+
+Worktree `~/.codex/worktrees/260911-l2/opencodex`, branch `codex/260911-l2-catalog-provider`.
+
+1. **#4201 — BigModel Responses Coding Plan: missing quota probe and GLM-5.3-Flash catalog support.**
+   A provider-compatibility report from `bluesmilery`. #4210 by `Ingwannu` is an open draft
+   restoring BigModel preset quota visibility; read it before you write anything and either build on
+   it with attribution or stay clear of it.
+2. **#4207 — the connected catalog reports success while the local Codex CLI rejects unsupported
+   reasoning levels.** Related to #3775, which is the same rejection seen from the CLI side.
+
+Territory: `src/providers/quota*.ts`, `src/codex/catalog/*`, provider preset definitions.
+
+`src/providers/quota.ts` is contended by four open PRs. Prefer a preset or catalog-side fix; if the
+change genuinely belongs in `quota.ts`, keep it surgical and name the overlap in your report.
+
+## L3 — Codex account pool
+
+Worktree `~/.codex/worktrees/260911-l3/opencodex`, branch `codex/260911-l3-account-pool`.
+
+1. **#4126 — a newly created ChatGPT Free account fails Codex warmup with HTTP 404.** Carry PR
+   #4188 by `chilung-cgu`, which retries warmup with `gpt-5.6-luna` on 400 and 404; it was reset to
+   draft by the readiness gate, not rejected on merit.
+2. **#4212 — an account stuck on a failed credential refresh silently drops its models.** The ask is
+   attribution, not new routing: when a model disappears or a request is refused because an account
+   is unusable, name the account and the reason on the surfaces the operator already reads.
+3. **#4211 — keep Free-tier accounts out of pool selection.** Opt-in, default off, so an existing
+   install sees no behaviour change. This is the one place in this round where a lane may add a
+   configuration field, and only the key the issue names.
+
+Territory: `src/codex/account-*.ts`, `src/codex/plan.ts`, `src/codex/plan-from-token.ts`,
+`src/codex/warmup.ts`, `src/codex/model-entitlements.ts`, `src/codex/account-pause.ts`.
+
+## L4 — service, update, and operator CLI
+
+Worktree `~/.codex/worktrees/260911-l4/opencodex`, branch `codex/260911-l4-service-cli`.
+
+1. **#4202 — global pnpm installations cannot self-update.** Carry PR #4203 by `oliver-mee`
+   (`CHANGES_REQUESTED`, 20 files). Trim it to the defect; a self-update path is not the place for
+   adjacent refactoring.
+2. **#4169 — every stop refusal is reported as a `CODEX_HOME` ownership mismatch,** hiding
+   `respawnable_service` and looping the operator. Carry PR #4170 by `yeongjunyoo`.
+3. **#4204 — Windows: a stale persisted CLI 0.135.0 strips max/ultra while Codex Desktop runs
+   0.153.4.** #4178 by `luvs01` is review-ready with full CI green and already owns
+   `src/codex/cli-install-provenance.ts`. Do not duplicate it: if it lands first, rebase onto it;
+   otherwise keep your change out of that file and say so.
+
+Territory: `src/update/*`, `src/service*.ts`, `src/cli/*`, and the stop/ownership refusal paths.
+
+## L5 — file IO and client integrations
+
+Worktree `~/.codex/worktrees/260911-l5/opencodex`, branch `codex/260911-l5-integrations-io`.
+
+1. **#4197 — the DSH integration's atomic replace changes file ownership and causes `EACCES` across
+   UIDs.** The issue already argues the safe shape: do not relax the global `0600` hardening in
+   `atomic-write.ts`; refuse the integration write when the target exists and its owner is not the
+   process euid, and only then consider a metadata-preserving replace. Decide which of the two you
+   ship and justify it.
+2. **#4214 — add Cline as a supported client integration.** Follow the existing registry pattern in
+   `src/integrations/registry.ts`; do not invent a parallel mechanism.
+
+Territory: `src/config/atomic-write.ts`, `src/integrations/*`. No open PR touches either, so this
+lane is free to move fastest.
+
+## L6 — streaming and vendor tool leakage
+
+Worktree `~/.codex/worktrees/260911-l6/opencodex`, branch `codex/260911-l6-streaming-tools`.
+
+1. **#4191 — a long Codex thread fails only through the proxy** (WS 1006 / response prelude
+   timeout) while the bypass works immediately. Your first deliverable is a reproduction, not a
+   patch: establish what input length and timing reproduce it and where the prelude budget is
+   actually spent. If the cause lands inside L1's territory, stop and report rather than editing it.
+2. **#4190 — vendor CLI agent scaffolding leaks into routed output** for `qoder`: an MCP
+   lazy-loading reminder and tool-call markup reach the user.
+
+## L7 — documentation
+
+Worktree `~/.codex/worktrees/260911-l7/opencodex`, branch `codex/260911-l7-docs`.
+
+1. **#4215 — state whether each provider login consumes a subscription allowance or bills per
+   token.** Write the rule per authentication mode, then one explicit line per provider that
+   supports both.
+2. **#4200 — the remote hub guide breaks on a fresh config** (nested `ocx config set` fails when the
+   parent object is absent) and has no macOS data-plane TLS example. Fix the English source first;
+   translations are a follow-up, not a blocker.
+
+Territory: `docs-site/**` only. No `src` change belongs in this lane.
+

devlog/_plan/260911_lane_dispatch_round/060_ledger.md

@@ -0,0 +1,17 @@
+# Round ledger
+
+Refreshed by the orchestrator from `gh`, never from narration. `NOT RUN` is the honest value for
+every local product check in this round.
+
+| Lane | Worktree | Branch | Thread | PR | Head SHA | Final-head CI | State |
+|---|---|---|---|---|---|---|---|
+| L1 | `~/.codex/worktrees/260911-l1/opencodex` | `codex/260911-l1-responses-core` | pending | — | — | — | dispatched |
+| L2 | `~/.codex/worktrees/260911-l2/opencodex` | `codex/260911-l2-catalog-provider` | pending | — | — | — | dispatched |
+| L3 | `~/.codex/worktrees/260911-l3/opencodex` | `codex/260911-l3-account-pool` | pending | — | — | — | dispatched |
+| L4 | `~/.codex/worktrees/260911-l4/opencodex` | `codex/260911-l4-service-cli` | pending | — | — | — | dispatched |
+| L5 | `~/.codex/worktrees/260911-l5/opencodex` | `codex/260911-l5-integrations-io` | pending | — | — | — | dispatched |
+| L6 | `~/.codex/worktrees/260911-l6/opencodex` | `codex/260911-l6-streaming-tools` | pending | — | — | — | dispatched |
+| L7 | `~/.codex/worktrees/260911-l7/opencodex` | `codex/260911-l7-docs` | pending | — | — | — | dispatched |
+
+Base freeze for every lane: `6d3ad12e3`.
+