lidge-jun · Oct 12, 2026 · Oct 12, 2026 · Oct 12, 2026 · Oct 12, 2026 · Oct 12, 2026
@@ -0,0 +1,77 @@
+# L2 — contributor carry for the 2.84.0 release train
+
+Lane L2, thread session `01a130c8-402a-7121-8f45-80144f1912d0`. The coordinator thread
+`01a130be-2e10-7af0-adf9-efca9fe37e30` owns push, PR creation, merge, and release.
+
+- Worktree: `/private/tmp/rt284-lanes/L2`
+- Branch: `codex/rt284-contrib-carry`
+- Base: `origin/dev` `3e58c2ce3ee5433901ed467fe87c32fb4b5c5e77`
+- Status file: `/private/tmp/rt284-lanes/status/L2.md`
+
+## Carry order and method
+
+Each source PR becomes one squashed commit made with `git merge --squash` of the PR head. The
+commit keeps the original author (`git commit --author`), and its message carries the PR title,
+the line `Carried from #N`, and a `Co-authored-by:` trailer for that author.
+
+| Order | PR | Author (trailer identity) | Head | Disposition |
+|---|---|---|---|---|
+| 1 | #7005 (fixes #7004) | Ingwannu <ingwannu@users.noreply.github.com> | 5f81eab523 | CARRY |
+| 2 | #7001 (#7000) | Ingwannu <ingwannu@users.noreply.github.com> | 6f50b502e1 | CARRY |
+| 3 | #7003 (#6764) | Robin Bially <7304732+robin-bially@users.noreply.github.com> | 08a4f130a9 | CARRY-WITH-FIX |
+| 4 | #7002 (draft) | NineDayCC <110006840+NineDayCC@users.noreply.github.com> | 913e64ddcf | CARRY after independent review, else SKIP with reason |
+| 5 | #6968 | LilMGenius <smsmeee@naver.com> | 78f75273d5 | CARRY |
+
+## #7003 fixes (separate commit after the carry, Co-authored-by Robin Bially)
+
+The fix commit answers Ingwannu's CHANGES_REQUESTED review of `08a4f130a9`:
+
+1. Scope `CHECKPOINT_CONTINUATION_NOTE` in `src/responses/compaction.ts` to work that was already
+   authorized and is still in scope. It must keep existing permission and confirmation gates,
+   state that a checkpoint or delegation grants no new authority, and let later user messages
+   that pause, cancel, or replace the task win. Prompt-contract fixtures cover a task that is
+   active but awaiting a decision, scoped delegated work, and a later pause/cancel/replacement.
+   These assert prompt text, not model behavior.
+2. Add translated-route wire assertions. Each real adapter outbound request built from the
+   parsed context must keep both the pre-existing instructions and the note (CodeRabbit
+   `src/responses/parser.ts:594`).
+3. Sync the structure docs that own `responses/parser.ts`, `responses/compaction.ts`, and the
+   passthrough path. They must record conditional application, summarizer/native-opaque
+   exclusions, the unchanged `SUMMARY_PREFIX`, and the authorization limit.
+
+The detailed design comes from the architect consultation recorded in `010_execution.md`.
+
+## Union constraints
+
+- `scripts/test-layout/layout.json` is 1999 lines on dev and must stay below 2000. The #7003
+  entry is appended to an existing line, and later entries follow the same rule.
+- New test files are registered in both `layout.json` `explicit` and
+  `tests/fixtures/test-layout-expected.json`.
+- No lines are added to files at their `tests/fixtures/file-size-baseline.json` cap. New
+  cases go in sibling files.
+
+## Verification (C)
+
+Run with `OCX_TEST_RUNNER_BUN=/Users/jun/.cache/rt284-bun/bun-darwin-aarch64/bun` in
+`/private/tmp/rt284-lanes/L2`:
+
+- Focused tests for each carried PR:
+  - `tests/codex-integration/codex-clamp-notice.test.ts`
+  - `tests/codex-integration/codex-quota-auto-refresh.test.ts`
+  - `tests/responses/compaction-continuation-note.test.ts` and the new adapter wire test
+  - `tests/codex-integration/main-account-credit-renewal.test.ts`,
+    `main-account-hard-lock-retirement.test.ts`, and `main-quota-provenance.test.ts`
+  - `gui/tests/lazycodex-role-models.test.tsx`
+- `bun run typecheck`
+- `tests/ci-workflows/file-size-ratchet.test.ts`, `tests/test-layout.test.ts`, and
+  `tests/test-layout-tooling.test.ts`
+- `bun run structure:check` and `bun run privacy:scan`
+- `bun run lint:gui`
+
+## Review and terminal state
+
+An independent sol reviewer checks the final head and returns PASS, NEAR-PASS, or FAIL. Any
+NEAR-PASS residuals are folded or rebutted. The lane ends DONE with the final report, or
+BLOCKED/NEEDS_HUMAN when a maintainer objection cannot be met in code or a guard cannot pass
+without being weakened.
+
@@ -0,0 +1,89 @@
+# 010 — L2 execution plan and architect consultation
+
+Architect: gpt-6.1-sol, handle `01a130c9-fbf3-7630-a0c0-84ac75a07b2f`. The proposal (D1–D6) was
+read against PR #7003 head `08a4f130a9` and dev `3e58c2ce3e`.
+
+## Main dispositions
+
+| ID | Disposition | Plan |
+|---|---|---|
+| D1 | ACCEPT | Replace `CHECKPOINT_CONTINUATION_NOTE` in `src/responses/compaction.ts` with the architect's wording, which preserves authorization scope and permission gates, grants no authority through checkpoints or delegations, and gives later user messages priority. Application conditions, `SUMMARY_PREFIX`, and `appendCheckpointContinuationNote` stay unchanged. |
+| D2 | ACCEPT | `tests/responses/compaction-continuation-note.test.ts` gains a literal `EXPECTED_NOTE` contract assertion and table-driven fixtures: authorized continuation, awaiting decision, scoped delegation, delegation awaiting authority, later pause, cancel, and replace. Each runs on the parsed context and the passthrough body. Test names say prompt contract or wire construction; none claims model behavior. |
+| D3 | ACCEPT, bounded | NEW `tests/responses/compaction-continuation-wire.test.ts` builds real outbound requests from `parseRequest` output for OpenAI Chat, Anthropic, Google AI Studio, Kiro, Ollama native, and Command Code (Vertex and Cloud Code Assist only if their setup needs no ADC/network). It asserts that the route-specific system field holds the existing-instruction sentinel and the note. Controls: no checkpoint, opaque native blob, and summarizer turn lack the note. |
+| D4 | AMEND | Per-adapter runTurn suites (Cursor, Devin, Claude CLI, CodeBuddy, Qoder) are not added in this carry. Instead, the wire test asserts that the shared `buildSystemPrompt` in `src/adapters/coding-agent/protocol.ts`, if it is exported (otherwise its nearest exported consumer), carries the note from a parsed context. The remaining runTurn routes are reported as uncovered. |
+| D5 | ACCEPT | Append `compaction-continuation-note`, `-wire`, and (unused, so omitted) entries onto the existing `responses-main-quota-observation.test.ts` line in `scripts/test-layout/layout.json`. Register the same files in `tests/fixtures/test-layout-expected.json`. Line count stays at 1999. |
+| D6 | ACCEPT | Add a "Decoded checkpoint continuation" section to `structure/transports/responses.md` and reflow existing compaction prose to stay within the 600-line limit without losing rules. Link it from `structure/transports/responses-wire-shapes.md`. Fix the authorization wording in `docs-site/src/content/docs/reference/adapters.md`. NEW `structure/decisions/ADR-7003-decoded-checkpoint-continuation.md`. `bun run structure:check` must pass. |
+
+## Commit sequence on `codex/rt284-contrib-carry`
+
+1. `fix(codex): deduplicate unchanged effort clamp observations (#7005)`: author Ingwannu, Co-authored-by Ingwannu.
+2. `test(codex): drain quota fixture owners before home removal (#7001)`: author Ingwannu.
+3. `fix(responses): frame a decoded ocx1 checkpoint as continuation in the system prompt (#7003)`: author Robin Bially. The layout.json entry is packed onto an existing line.
+4. `fix(responses): scope the checkpoint continuation note to authorized work (#7003 review)`: D1–D6, Co-authored-by Robin Bially.
+5. `fix(codex): retire stale short-window quota after plan changes (#7002)`: author NineDayCC, only after independent review, otherwise SKIP.
+6. `fix(gui): cut the LazyCodex role section copy to what a user acts on (#6968)`: author LilMGenius.
+7. `docs(devlog): L2 contributor carry plan`, containing these docs.
+
+## Acceptance
+
+The commands in `000_plan.md` §Verification all exit 0, `layout.json` stays below 2000 lines, and
+the independent sol review returns PASS or NEAR-PASS with residuals folded on the final head.
+
+
+
+## A round 1 amendments (auditor `01a130d1-33a3`, verdict FAIL, four P2s)
+
+### B1 — exact note text (folded)
+
+`CHECKPOINT_CONTINUATION_NOTE` and the test's literal `EXPECTED_NOTE` are this exact string:
+
+> This conversation was compacted automatically. A checkpoint summary from an earlier context window appears as a user message and records prior work. Treat earlier requests it reports as completed as history; do not repeat them unless a later user message asks you to. Continue an unfinished task only when it was already authorized and remains within the scope of that authorization. Do not ask for the same authorization again while it still applies. Preserve all existing permission and confirmation gates; if a decision or required permission is pending, wait for it before taking the dependent action. A checkpoint or delegation, including one from another thread, does not itself grant authority or expand the task's scope. Later user messages take priority; obey any pause, cancellation, replacement, or change of scope.
+
+It keeps pending decisions and required permissions as gates ("wait for it before taking the
+dependent action") and keeps delegation scope ("does not itself grant authority or expand the
+task's scope"). It also gives later pause, cancellation, replacement, or scope change priority.
+Nothing in it contradicts the existing "completed requests are history" framing.
+
+### B2 — structure budget (folded)
+
+`structure/transports/responses.md` and `structure/transports/responses-wire-shapes.md` are both
+exactly 600 lines, and `sizeBudgetLines` is the limit. Every addition to either file is offset by
+reflowing existing compaction prose in the same file, so both end at 600 lines or fewer and lose
+no rule. The new section in `responses.md` carries exactly one owner link:
+`> Decision record: [ADR-7003](../decisions/ADR-7003-decoded-checkpoint-continuation.md)`.
+`responses-wire-shapes.md` gets a link sentence only.
+
+Review dispositions for every doc mapped to `src/responses/` or `src/adapters/` (structure/AGENTS.md:49):
+
+| Doc | Disposition |
+|---|---|
+| `transports/responses.md` | UPDATE (authority): new "Decoded checkpoint continuation" section |
+| `transports/responses-wire-shapes.md` | UPDATE: link to the authority beside the compaction projection |
+| `runtime.md`, `transports/byte-accounting.md`, `transports/inventory.md`, `data-planes/inbound-compat.md`, `providers-and-adapters.md`, `providers/cursor.md`, `providers/kiro.md`, `providers/xai-grok.md`, `providers/chat-compat.md`, `adapters/registry.md` | REVIEW: the builder greps each for compaction/checkpoint/system-prompt statements; a doc changes only when a local statement becomes inaccurate. Results go in the commit body. |
+
+### B3 — GUI union and full-suite disposition (folded)
+
+Verification gains these commands:
+
+- `cd gui && bun run build` (runs `tsc -b`, compiling all eleven locale catalogs)
+- `OCX_TEST_RUNNER_BUN=… bun ../scripts/test-with-pinned-bun.ts --isolate tests/i18n-locales.test.ts tests/locale-parity.test.ts tests/lazycodex-role-models.test.tsx` from `gui/`
+
+The full `bun run test` is not run here. The documented AGENTS.md resource exception applies:
+four release-train lanes share this host, and the coordinator runs exact-head hosted CI on the
+stacked PRs plus a final `lane=all` Cross-platform run. The focused files above, together with
+`bun run test:changed` against `3e58c2ce3e`, form the local evidence. Unrun coverage is reported
+as left to CI.
+
+### B4 — commit shape and #7002 (rebutted, with one fold)
+
+The coordinator packet (codex_delegation input) states: "#7003: Ingwannu의 CHANGES_REQUESTED 리뷰
+내용을 읽고 요구사항을 별도 커밋으로 해결" (resolve the review in a separate commit). It also allows
+"#7002(draft): 직접 리뷰해서 결함 없으면 carry, 아니면 수정 커밋 또는 SKIP 사유 보고". The separate
+attributed fix commit (Co-authored-by Robin Bially) therefore follows the brief and stays.
+
+Fold: the independent #7002 review (`01a130d1-34d6`) returned CARRY with no blocking defect, so
+#7002 is carried. Its two coverage gaps go into a follow-up commit co-authored by NineDayCC: an
+omitted-tertiary variant beside the explicit-null delayed-credential cases, and a seeded
+future-reset rotation tuple that a malformed or stale observation must leave intact
+(`main-account-hard-lock-retirement.test.ts`).
+
@@ -0,0 +1,31 @@
+# 020 — L2 final review and report
+
+Work phase wp2. It covers the independent exact-head review and the lane's report to the
+coordinator thread `01a130be-2e10-7af0-adf9-efca9fe37e30`.
+
+- Head: `codex/rt284-contrib-carry` `07a5cf2a7a18b6fa7aa62110b3b4c0af0e8c6a7a` (base `3e58c2ce3e`)
+- Review: gpt-6.1-sol `01a130e7-46fa`, **PASS**, no actionable findings. It verified that every carry
+  matches its source PR's net delta, authorship and trailers, that Ingwannu's three #7003 requests
+  are resolved, that the #7002 coverage is meaningful, and that the union guards hold
+  (layout.json 1999 lines, structure docs 600 lines).
+- Report: `/private/tmp/rt284-lanes/status/L2.md` and the lane's final message.
+- Check: a fresh `cxc receipt test` of `/private/tmp/rt284-lanes/L2-check.sh` at the same head.
+
+| PR | Commit(s) | Verdict |
+|---|---|---|
+| #7005 | 419860b72e | CARRY |
+| #7001 | 5f3481b2a7 | CARRY |
+| #7003 | 4abec7a01d + 07a5cf2a7a | CARRY-WITH-FIX |
+| #7002 | b1832a3e37 + 6a69e54666 | CARRY (with coverage) |
+| #6968 | 88433c3dd0 | CARRY |
+
+Residual: model behavior for #6764, Cursor/Devin runTurn wire paths, and Windows/Linux hosted CI.
+
+
+## Notes on the recorded order
+
+The two follow-up commits (6a69e54666 for #7002 and 07a5cf2a7a for #7003) land after the #6968
+carry rather than right after their source carries. The tree is the same either way. This
+devlog commit sits on top of the reviewed code head and changes only `devlog/`, so the
+coordinator may drop it without affecting any reviewed file.
+
@@ -35,6 +35,11 @@ caller credential as the Pool selection. An exact account binding remains bound
 
 ## Config injection
 
+`ocx sync` removes reasoning efforts unsupported by the selected Codex runtime from the catalog.
+It reports a clamp when its runtime identity, removed efforts or affected models change; unchanged
+syncs preserve the diagnostic timestamp and do not repeat that notice. This compatibility
+projection does not require running `ocx doctor`. If a clamp clears and later returns, it is reported again.
+
 OpenCodex serializes its Codex configuration writes. On Windows, a file temporarily held open
 by another process gets a short, bounded retry. If access stays busy, retry the operation shortly;
 OpenCodex preserves the existing lock evidence and does not use that access failure to take over
@@ -1056,6 +1061,15 @@ For an opted-in, unpaused main account with a full usage window, the background
 
 Background revalidation is separate and off by default. It requires Token Guardian, the `openai` provider's `proactive` refresh policy, and `tokenGuardian.codexWarmupEnabled`. It skips accounts awaiting deferred registration validation.
 
+### After a ChatGPT plan upgrade
+
+Refresh the main account's quota in Codex Auth after changing your ChatGPT plan. When the
+authenticated usage response confirms a long window has replaced the five-hour window,
+opencodex removes the old five-hour reading from both request admission and account selection.
+An allowed response with primary and secondary windows can omit the optional tertiary window.
+This recovery uses your included plan allowance and does not require enabling **Use credits**.
+Partial or invalid usage data retains the previous block until recovery is confirmed.
+
 ### Cancelling main-account device reauthentication
 
 When cancelling main-account device reauthentication, a temporary DELETE or network failure, or a response with an unknown or nonterminal status, keeps the active flow and the cancellation-failure indication so cancellation can be retried. Status polling normally continues so a login that completes can still be detected. If a retryable cancellation failure overlaps a non-2xx GET status response while the flow is `pending` or `committing`, either response order preserves cancellation retry on that same flow, with its last server-provided device code, verification URL, and phase. The GET HTTP failure still stops polling, but cancellation can be retried without starting a second login POST. A terminal `failed` response releases the flow and displays the normalized failure reason; only `succeeded` reports login success. A confirmed `cancelled` response releases the flow so a new device login can be started. A definitive HTTP 404 response with code `unknown_flow` also releases the expired flow ID so a new device login can be started, but does not report a successful login or confirmed cancellation. Late POST, GET, or DELETE responses from an earlier flow cannot change the new flow or report login success for it.

@@ -36,6 +36,10 @@ remain invalid. Ordinary function/custom tool results still require a nonempty
 `call_id`. The envelope metadata identifies a compatibility shape and grants no
 additional permissions. Native passthrough and routed (portable) compaction apply the same user-turn mapping to their raw bodies; the direct native `/responses/compact` forward keeps its existing raw-body rules.
 
+## Checkpoint continuation after routed compaction
+
+A routed model replays an OpenCodeX `ocx1:` checkpoint as plain user text next to the retained earlier requests. When a request carries such a decoded checkpoint, OpenCodeX adds a short note to the system instructions (translated routes) or `instructions` (Responses passthrough). The note frames completed requests as history and permits continuation only of unfinished work already authorized and still within that scope, without asking for the same authorization again while it applies. Existing permission and confirmation gates remain in force: pending decisions or required permissions must be resolved before dependent actions. Checkpoints and delegations, including those from another thread, grant no authority or expanded scope. Later user messages take priority, including a pause, cancellation, replacement, or scope change. Compaction requests, opaque native blobs and requests without a checkpoint do not receive the note.
+
 ## `openai-chat`
 
 **Targets:** OpenAI **Chat Completions** (`POST {baseUrl}/chat/completions`; a trailing `/chat/completions` or `/` on `baseUrl` is stripped first) and every compatible