devlog: wp1-wp5 disposition records for the owner backlog closeout

devlog/_plan/260823_owner_backlog_closeout/010_wp1_pr2439_contract_manifest.md

@@ -0,0 +1,50 @@
+# 010 — wp1: PR #2439, fixture-backed OpenAI contract manifest
+
+## Item
+
+`Ingwannu` PR #2439 `ingw/refactor-provider-contracts` -> `dev`, head `0225f2b9`.
+Adds a strict V1 compatibility-manifest schema and catalog with one canonical
+OpenAI Codex-forward contract for `gpt-5.6-sol`, backed by production-adapter
+fixtures, plus synchronized documentation. 13 files.
+
+## Reviewer verdict
+
+`gpt-5.6-sol` high, read-only, exact head `0225f2b9`:
+
+- VERDICT PASS_WITH_NITS, disposition SQUASH_MERGE, risk low.
+- `bun test tests/compatibility-manifest.test.ts` 6 pass / 0 fail.
+- `bun test tests/core-lab-boundary.test.ts` 13 pass / 0 fail.
+- `cd docs-site && bun run build` passed, 393 pages.
+- `gh pr checks 2439` 23 passed, 1 intentionally skipped, 0 failed.
+- Export and call-site tracing found no dropped exports, no import cycle, no
+  core-to-manifest or core-to-Lab edge, no credential or request-body logging.
+
+## The one nit, and why it does not block
+
+`tests/compatibility-manifest.test.ts:67` — the graph guard skips every dynamic
+import, so a future direct `import("../compatibility")` from a protected core
+file would slip past it. The current tree has no such edge, and
+`tests/core-lab-boundary.test.ts` already carries the stricter direct-dynamic
+check for the Lab boundary. This is a guard-strength gap in a new test, not a
+defect in shipped behavior, so it is recorded rather than held.
+
+## Disposition
+
+Squash-merge. The manifest is additive and sits off the core request path.
+
+## Verification
+
+Post-merge on `dev`: `bun test tests/compatibility-manifest.test.ts
+tests/core-lab-boundary.test.ts`, bound to the merged tree by a check receipt.
+
+
+## Execution record
+
+Squash-merged 2026-08-23 as `2a2f6e68f` on `origin/dev`, branch deleted.
+
+```
+gh pr merge 2439 --squash --admin --delete-branch
+2a2f6e68f feat(compatibility): add fixture-backed OpenAI contract manifest (#2439)
+```
+
+No linked issue: #2439 stands on its own.

devlog/_plan/260823_owner_backlog_closeout/020_wp2_pr2437_history_manifest.md

@@ -0,0 +1,32 @@
+# 020 — wp2: PR #2437 and issue #2436, history manifest contract
+
+## Item
+
+`Ingwannu` PR #2437 `ingw/refactor-history-manifest-boundary-2436` -> `dev`,
+head `f1774833`. Closes issue #2436, "extract the Codex history manifest
+contract into a shared leaf".
+
+Extracts manifest types, provenance validation, path identity, and backup IDs
+into a pure builtin-only leaf module.
+
+## Reviewer verdict
+
+`gpt-5.6-sol` high, read-only:
+
+- VERDICT PASS, disposition MERGE, risk low, no nits.
+- `bun test tests/codex-history-provider.test.ts tests/codex-native-residue.test.ts tests/core-lab-boundary.test.ts` -> 142 pass / 0 fail.
+- `gh pr checks 2437` -> 23 passed, 1 expected matrix job skipped, 0 failed.
+- Both callers keep their filesystem, SQLite, mutation, and diagnostic
+  responsibilities. No dropped export, no import cycle, core/Lab boundary intact,
+  no request-body or credential logging change.
+
+## Disposition
+
+Merge, then close #2436 by hand. PRs here target `dev`, so GitHub does not
+auto-close the linked issue.
+
+
+## Execution record
+
+Squash-merged 2026-08-23 as `81474259e` on `origin/dev`, branch deleted.
+Issue #2436 closed by hand with the merge SHA and the reviewer's test evidence.

devlog/_plan/260823_owner_backlog_closeout/030_wp3_pr2435_fetch_helper_boundary.md

@@ -0,0 +1,34 @@
+# 030 — wp3: PR #2435 and issue #2434, Responses fetch-helper boundary
+
+## Item
+
+`Ingwannu` PR #2435 `ingw/refactor-fetch-helper-boundary-2434` -> `dev`, head
+`be6ea98a`. Closes issue #2434, "keep Responses fetch helpers on a
+transport-only import boundary".
+
+Removes stale runtime imports from `src/server/responses/fetch-helpers.ts` and
+pins the permitted runtime edges with a regression test.
+
+## Reviewer verdict
+
+`gpt-5.6-sol` high, read-only, exact head `be6ea98a`:
+
+- VERDICT PASS, disposition SQUASH_MERGE, risk low, no nits.
+- Six focused files (`responses-fetch-helpers-boundary`, `fetch-header-timeout`,
+  `request-pacing`, `upstream-http-version`, `ws-upstream`,
+  `core-lab-boundary`) -> 71 passed, 1 skipped, 0 failed.
+- CI 23 checks passed, 1 conditional Windows shard skipped, at the exact head.
+- Complete export surface preserved, helper implementations byte-identical, the
+  new guard at `tests/responses-fetch-helpers-boundary.test.ts:43` rejects
+  computed dynamic-import bypasses. No cycle, no logging, credential, routing, or
+  behavior change.
+
+## Disposition
+
+Squash-merge, then close #2434 by hand.
+
+
+## Execution record
+
+Squash-merged 2026-08-23 as `4fb0fbe7b` on `origin/dev`, branch deleted.
+Issue #2434 closed by hand with the merge SHA and the reviewer's evidence.

devlog/_plan/260823_owner_backlog_closeout/040_wp4_pr2433_combo_failover.md

@@ -0,0 +1,58 @@
+# 040 — wp4: PR #2433, combo zero-output failover
+
+## Item
+
+`Ingwannu` PR #2433 `ingw/fix-combo-zero-output-failover-2431` -> `dev`, head
+`3ec2b1a6`. Addresses issue #2431, "failover combos stop on zero-output SSE
+terminal failures and model-EOL HTTP 410 responses".
+
+Adds a bounded SSE preflight so failover combos can retry terminal failures
+before any output is committed, plus model-lifecycle HTTP 410 classification and
+synchronized documentation. 12 files.
+
+## Reviewer verdict: FAIL
+
+`gpt-5.6-sol` high, read-only, exact head `3ec2b1a6`:
+
+- VERDICT FAIL, disposition NEEDS_CHANGES, risk medium.
+- `bun test tests/combos.test.ts tests/combo-stream-preflight.test.ts tests/server-combo-failover-e2e.test.ts tests/core-lab-boundary.test.ts` -> 126 passed, 0 failed, 694 assertions.
+- `gh pr checks 2433` -> 23 passed, 1 skipped, 0 failed.
+
+Green tests and green CI, and still not landable. That gap is the point of the
+finding: the defect is in accounting the existing tests do not assert.
+
+## The blocker
+
+`src/server/responses/core.ts:1974` — the new preflight manually records a failed
+terminal. Native forward and pool passthrough streams already record that same
+physical terminal through their eager and tee inspectors at `:3785` and `:3868`.
+The once-guard added at `:1930` wraps only the exported callback, so it never
+observes the inspector's direct invocation.
+
+One physical 502 therefore increments native account health twice. A production
+recorder diagnostic confirmed `consecutiveFailures: 2` for a single terminal.
+The practical effect is that soft-avoid and credential rotation fire at half the
+configured threshold, on an account that is healthy.
+
+Everything else checked clean: stream commit boundary, attempt receipts, usage
+handling, marker preservation, export surface, ESM/Bun constraints, no core-to-Lab
+edge, no import cycle, no sensitive logging, translated docs aligned, template
+complete.
+
+## Disposition
+
+Hold. Not closed, not merged. The required change is a single shared
+once-guarded recorder owning both the preflight path and the inspector path, with
+a regression asserting exactly one health transition per streamed attempt.
+
+That fix is being built on `codex/fix-2433-exactly-once-terminal` rather than
+asked of the contributor, because the PR is otherwise complete and the defect is
+in a seam the original author had no reason to suspect. wp4 closes on the review
+being posted; the landing of the corrected work is its own later work-phase.
+
+
+## Execution record
+
+Review posted on #2433 on 2026-08-23 naming the blocker, the reproduction, and the
+required shape of the fix. PR left open, not closed. Fix in flight on
+`codex/fix-2433-exactly-once-terminal`.

devlog/_plan/260823_owner_backlog_closeout/050_wp5_pr2387_process_state.md

@@ -0,0 +1,45 @@
+# 050 — wp5: PR #2387 and issue #2378, proxy process-state ownership
+
+## Item
+
+`Ingwannu` PR #2387 `ingw/refactor-process-state` -> `dev`. Closes issue #2378,
+"extract proxy process-state ownership from config persistence".
+
+Extracts OpenCodex-home paths, atomic writes, and PID/runtime-port ownership into
+three acyclic config leaf modules, keeping `src/config.ts` compatibility exports.
+
+## Reviewer verdict
+
+`gpt-5.6-sol` high, read-only:
+
+- VERDICT PASS_WITH_NITS, disposition SQUASH_MERGE, risk medium.
+- Eight suites (`process-state`, `config`, `process-control`, `proxy-liveness`,
+  `port-reclaim`, `service`, `update-job`, `core-lab-boundary`) -> 472 pass / 0 fail.
+- `stale-state-purge` -> 4 pass / 0 fail.
+- Synthesized current-`dev` merge -> 473 pass / 0 fail, `bun run typecheck` passed.
+- `gh pr checks 2387` -> 29 pass, 1 skipped, 0 failures.
+- Lifecycle, management, service, OAuth, and update callers import process state
+  directly without changing their destructive identity checks. No request-body or
+  API-key logging, no dropped runtime export, no import cycle, no core-to-Lab edge.
+
+## Nits, recorded not held
+
+- `tests/process-state.test.ts:6` — the dedicated suite does not exercise
+  `readAlivePid()`, `verifyPidIdentity()`, or the `EPERM` behavior #2378 asks for.
+- `tests/config.test.ts:2216` — process-state characterization is duplicated;
+  owner behavior should move fully to `process-state.test.ts`.
+
+Both are test-ownership improvements on a behavior-preserving extraction whose
+coverage already runs 472 green. Recorded as follow-up rather than blocking a
+maintainer refactor that is otherwise clean.
+
+## Disposition
+
+Squash-merge, then close #2378 by hand.
+
+
+## Execution record
+
+Squash-merged 2026-08-23 as `b6c7c0afe` on `origin/dev`, branch deleted.
+Issue #2378 closed by hand with the merge SHA, the reviewer's evidence, and the
+two test-ownership follow-ups stated openly rather than quietly dropped.

devlog/_plan/260823_owner_backlog_closeout/060_wp6_pr2380_provider_validation.md

@@ -0,0 +1,31 @@
+# 060 — wp6: PR #2380 and issue #2379, provider validation boundary
+
+## Item
+
+`Ingwannu` PR #2380 `ingw/refactor-provider-validation` -> `dev`. Closes issue
+#2379, "extract provider validation from config persistence".
+
+Moves 11 pure provider-validation helpers and three supporting constants into a
+focused leaf module.
+
+## Reviewer verdict
+
+`gpt-5.6-sol` high, read-only:
+
+- VERDICT PASS, disposition MERGE, risk low, no actionable findings.
+- `bun test tests/provider-config-validation.test.ts tests/management-provider-validation.test.ts tests/management-origin-tls.test.ts tests/server-auth.test.ts tests/core-lab-boundary.test.ts` -> 187 pass / 0 fail.
+- `bun test tests/config.test.ts` -> 153 pass / 0 fail. `bun run typecheck` -> pass.
+- `gh pr checks 2380` -> 23 pass, 1 skipped, 0 failures.
+- All function bodies match the originals. `src/config.ts` retains every
+  compatibility re-export while direct consumers take the narrower dependency.
+  Auth/CORS behavior, logging, persistence, response shapes, and the core/Lab
+  boundary are unchanged. The current dev merge tree is clean.
+
+This PR touches provider validation, which sits next to the auth surface, so the
+reviewer was asked to trace it as a security-adjacent change. It found no
+behavior delta in auth or CORS handling.
+
+## Disposition
+
+Merge, then close #2379 by hand.
+