docs(devlog): record 2026-10-02 merge activity

devlog/_plan/261002_merge_activity/000_scope.md

@@ -0,0 +1,27 @@
+# Merge activity record — scope
+
+Post-hoc record of what landed on `dev` between the last recorded units and 2026-10-02
+(~2026-09-30 13:14 UTC through 2026-10-02 16:55 UTC — the 2.77.0 dev-open — with the 2.76.0
+release evidence that followed through 18:42 UTC, plus the 2.73.0 and 2.74.0 releases that
+shipped just before the window and were never written up). Baseline tip: `21aed9fee`;
+upstream `dev` now ends at `b4616be1e4`, two merges ahead of the fork.
+
+## Tracked by its own unit — not duplicated here
+
+| Unit | Record |
+|---|---|
+| omo / LazyCodex carry (#6366 #6367 #6389, close #6390) | `devlog/_fin/261001_omo_lazycodex_carry/` |
+| Quota send-lock split (#6361 shim, #6363 hard-lock) | `devlog/_plan/261001_quota_send_lock_split/` |
+| JEV decision methods (#6364) | `devlog/_plan/261001_jev_decision_routing/` |
+| Zed Hosted AI carry (#6362, source #5912) | `devlog/_plan/261001_zed_hosted_uayor_carry/` |
+| Claude CLI first-party picker (#6418) | `devlog/_plan/261002_claude_cli_picker/` |
+| Claude UX: intercept-on-demand + Claude page (#6428 #6430) | `devlog/_plan/261002_claude_ux/` |
+
+## Method
+
+Per PR: number, author, carry source where the commit title names one, head SHA, squash SHA on
+`dev`, and the exact-head `ci` aggregate and `enforce-target` conclusions from GitHub check runs.
+Lane review verdicts (Kimi/Sol/Codex) are not re-derived here — the table records the published
+merge and CI evidence only. Runs are cited by run id; links point at lidge-jun/opencodex.
+
+Files: 010–035 the four release rounds, 040–080 the merge waves in landing order, 090 totals.

devlog/_plan/261002_merge_activity/010_release_2_73_0.md

@@ -0,0 +1,35 @@
+# 010 — release 2.73.0
+
+Shipped 2026-09-30. Candidate = `dev` at `cfa56e34d` (parent of the 2.74.0 dev-open);
+the macOS keyring signing fix (#6271) landed after the pin and was carried onto both
+release branches, so the published builds are the carry heads.
+
+## Outcome
+
+| Criterion | Result |
+|---|---|
+| dev opened at next version | `a30e67f7` chore(release): open dev at 2.74.0 (#6267, 09-29 23:32 UTC) |
+| preview promotion | #6265 → `c3eabadc`; keyring carry #6272 → `0cdf0f1f` |
+| main promotion | #6266 → `b825f4fc`; keyring carry #6273 → `569e3e7d` (stable gitHead) |
+| preview release run | [run 36652390709](https://github.com/lidge-jun/opencodex/actions/runs/36652390709) on `0cdf0f1f` — success |
+| main release run | [run 36654088816](https://github.com/lidge-jun/opencodex/actions/runs/36654088816) on `569e3e7d` — success |
+| preview tag | `v2.73.0-preview.20260930` published 2026-09-30 01:12 UTC |
+| stable tag | `v2.73.0` published 2026-09-30 01:31 UTC, 25 assets, non-draft |
+
+## Release content since 2.72.0
+
+Dev first-parent between `73289d46a` (#6243, dev opened at 2.73.0) and `cfa56e34d`
+(#6263), 19 merges: #6230 cursor native-tool denials via code-mode exec; #6236 routed
+compaction compatibility left unknown; #6248 Codex rate-limit retry advice (carry
+#6225); #6235 passthrough upstream reset ends as an Anthropic error event; #6249 Qwen3.8
+reminders valid after first turn; #6161 keyring native addon shipped with the desktop
+sidecar; #6247 internal `summary:none` marker stripped on the wire; #6255 combos spent
+pool account no longer cools the target (carry #6234); #6258 standalone Windows
+wrappers accepted by the ownership probe (carry #6238); #6204 Anthropic pause recheck
+before auxiliary sends; #6207 per-account Anthropic usage thresholds; #6200 canonical
+non-streaming delivery; #6203 Anthropic reset-cooldown recovery; #6261 keyring
+target-platform path rules; #6263 GPT-6.1 Sol as the Sol default + TokenLab per-model
+wires; #6250 the 2.72.0 devlog record itself.
+
+Boundary: npm dist-tags not re-queried for this record; evidence is the GitHub
+release objects and the successful Release runs above.

devlog/_plan/261002_merge_activity/020_release_2_74_0.md

@@ -0,0 +1,35 @@
+# 020 — release 2.74.0
+
+Shipped 2026-09-30. Candidate = `dev` at `26acb4076` (parent of the 2.75.0 dev-open).
+The first main Release run failed and was resumed on the same head.
+
+## Outcome
+
+| Criterion | Result |
+|---|---|
+| dev opened at next version | `3008bae77` chore(release): open dev at 2.75.0 (#6317, 09-30 11:06 UTC) |
+| preview promotion | #6318 → `cbfa828c` |
+| main promotion | #6322 → `cae9b553` (stable gitHead) |
+| preview release run | [run 36713179697](https://github.com/lidge-jun/opencodex/actions/runs/36713179697) on `cbfa828c` — success |
+| main release run | [run 36717981696](https://github.com/lidge-jun/opencodex/actions/runs/36717981696) on `cae9b553` — **failure**; resumed [run 36720108460](https://github.com/lidge-jun/opencodex/actions/runs/36720108460) same head — success |
+| preview tag | `v2.74.0-preview.20260930` published 2026-09-30 12:33 UTC |
+| stable tag | `v2.74.0` published 2026-09-30 13:33 UTC, 25 assets, non-draft |
+
+## Release content since 2.73.0
+
+Dev first-parent between `a30e67f7` (#6267) and `26acb4076` (#6310), 15 merges:
+#6271 packaged macOS keyring addons signed before notarization (same fix carried into
+2.73.0 via #6272/#6273); #6264 Linux package E2E limited to packaging inputs; #6279
+server-admission lifecycle isolation + quota-switch synchronization; #6277 Windows
+catalog/picker/log-guard fixture stabilization; #6284 autostart shims from standalone
+ocx; #6287 main short-lock retired on explicit absent primary; #6286 packaged macOS
+startup probes and desktop ownership safety; #6283 kiro single final answer across
+completion retry; #6285 catalog discovers new native models from the live Codex roster;
+#6303 dashboard links open in the default browser; #6304 MiniMax-M3.1-Flash-Preview
+with its always-on thinking contract; #6307 suite runnable from Codex worktrees beside
+a live proxy; #6311 browser-launch failure reporting and device-login UX; #6312 one
+Grok 4.7 row, OAuth Fast on the build-fast lane; #6310 Codex credits under the Week
+bar behind a Codex Auth switch.
+
+Boundary: npm dist-tags not re-queried; evidence is the GitHub release objects and
+Release runs above.

devlog/_plan/261002_merge_activity/030_release_2_75_0.md

@@ -0,0 +1,35 @@
+# 030 — release 2.75.0
+
+Shipped 2026-10-01. Candidate = `dev` at `82a495519` (parent of the 2.76.0 dev-open).
+Clean run — both Release jobs green on first attempt.
+
+## Outcome
+
+| Criterion | Result |
+|---|---|
+| dev opened at next version | `64294638a` chore(release): open dev at 2.76.0 (#6351, 10-01 03:31 UTC) |
+| preview promotion | #6352 → `dc1a1b0c` |
+| main promotion | #6353 → `ef0297f8` (stable gitHead) |
+| preview release run | [run 36812938867](https://github.com/lidge-jun/opencodex/actions/runs/36812938867) on `dc1a1b0c` — success |
+| main release run | [run 36814374365](https://github.com/lidge-jun/opencodex/actions/runs/36814374365) on `ef0297f8` — success |
+| preview tag | `v2.75.0-preview.20261001` published 2026-10-01 04:15 UTC |
+| stable tag | `v2.75.0` published 2026-10-01 04:31 UTC, 25 assets, non-draft |
+
+## Release content since 2.74.0
+
+Dev first-parent between `3008bae77` (#6317) and `82a495519` (#6349), 21 merges —
+the 09-30 evening bounds wave (#6319/#6308/#6315/#6324/#6325/#6326, then
+#6328–#6333) plus the pre-pin wave (#6341–#6349): TOML value preservation and
+routing-marker ownership (#6308), bounded signature payloads / family axes / XML
+attribute scans (#6315 #6324 #6325), live credential evidence for pool quota policy
+(#6326), Cognition blocklist rewrites (#6328), per-model real 128K Claude maxima
+(#6329), passthrough failure reason rows (#6330), new-model policy before discovery
+publication (#6331), drifted discovery reads (#6333), current Grok CLI versions on
+both xAI paths (#6341 #6343), late-reasoning Devin answer preservation (#6344),
+quota-popover hover gap (#6345), bare native ids in pickerOrder (#6346), pre-output
+403 failover (#6347), refusal-rotator oracle follow (#6349), Cursor installer
+manifest bound (#6319), cold-runner test budget (#6321), structure budget doc
+(#6332), TokenLab guide link (#6342). Per-PR detail in `040_wave_0930_1001.md`.
+
+Boundary: npm dist-tags not re-queried; evidence is the GitHub release objects and
+Release runs above.

devlog/_plan/261002_merge_activity/035_release_2_76_0.md

@@ -0,0 +1,29 @@
+# 035 — release 2.76.0
+
+Shipped 2026-10-02. Candidate = `dev` at `e0af52c8a2` (#6448, parent of the 2.77.0
+dev-open). Clean run — both Release jobs green on first attempt.
+
+## Outcome
+
+| Criterion | Result |
+|---|---|
+| dev opened at next version | `b4616be1e4` chore(release): open dev at 2.77.0 (#6462, 10-02 16:55 UTC) |
+| preview promotion | #6467 → `7a1faecb1f` (head `e3a72124ab` `chore(release): 2.76.0-preview.20261003`) |
+| main promotion | #6468 → `249462bf57` (stable gitHead; promotion branch `d2f8fd3562` merged `e0af52c8a2` + `ef0297f86c`) |
+| preview release run | [run 37041498025](https://github.com/lidge-jun/opencodex/actions/runs/37041498025) — success |
+| main release run | [run 37047146196](https://github.com/lidge-jun/opencodex/actions/runs/37047146196) — success |
+| preview tag | `v2.76.0-preview.20261003` published 2026-10-02 17:55 UTC |
+| stable tag | `v2.76.0` published 2026-10-02 18:42 UTC, 25 assets, non-draft |
+
+## Release content since 2.75.0
+
+Dev first-parent between `82a495519` (#6349) and `e0af52c8a2` (#6448), 60 merges —
+the 2.75.0 dev-open (#6351), the post-release provider/carry lanes and the luvs01
+fix batch (`050_wave_1001.md`), the omo carry set (`_fin/261001_omo_lazycodex_carry`),
+the Windows service/update batch (`060_wave_1001_windows.md`), and the 10-02 Claude
+page/pool + CLI wave (`070_wave_1002.md`) including the tracked landings of the
+quota split (#6361 #6363 #6412 #6413), JEV (#6364), Zed carry (#6362), Claude picker
+(#6418 #6419) and Claude UX (#6428 #6430) units.
+
+Boundary: npm dist-tags not re-queried; evidence is the GitHub release objects and
+Release runs above.

devlog/_plan/261002_merge_activity/040_wave_0930_1001.md

@@ -0,0 +1,36 @@
+# 040 — wave: 09-30 evening → 10-01 pre-pin (2.75.0 content)
+
+Twenty merges in two bursts (09-30 14:48–15:29 UTC, 10-01 02:08–02:55 UTC), all inside
+the 2.75.0 candidate — the wave closed just before the `64294638a` dev-open at 2.76.0.
+Theme: bounds and correctness hardening across codex/devin/redaction plus the
+provider-lane fix queue (xAI, Claude/Anthropic, models catalog).
+
+## PRs
+
+| PR | Author | Head → squash | ci | et | Change |
+|---|---|---|---|---|---|
+| #6319 | luvs01 | `09fcf7bc` → `b933aa2923` | ✓ | ✓ | bound Cursor local installer manifests |
+| #6308 | luvs01 | `55839fb9` → `2713b60e32` | ✓ | ✓ | preserve TOML values and routing-marker ownership |
+| #6315 | luvs01 | `46a3ceac` → `57fc9cc57e` | ✓ | ✓ | bound held signature-type payloads |
+| #6324 | luvs01 | `63f460bf` → `8326838e1d` | ✓ | ✓ | score Devin family axes sparsely with own-key targets |
+| #6325 | luvs01 | `0ae9ef5d` → `f5e9fdabaa` | ✓ | ✓ | bound XML identifying-attribute scans |
+| #6326 | luvs01 | `082c8aa3` → `b0d275dc79` | ✓ | ✓ | live credential evidence for pool quota policy |
+| #6328 | lidge-jun | `5e214434` → `662dfe170e` | ✗ | ✓ | Cognition blocklist rewrites applied to system prompt |
+| #6329 | lidge-jun | `e21d966a` → `6c32c4da36` | ✗ | ✓ | each Claude model gets its real 128K output maximum |
+| #6330 | lidge-jun | `ff2dc75b` → `87e182f110` | ✗ | ✓ | record why a native passthrough failed in its request-log row |
+| #6331 | lidge-jun | `104f29de` → `f9bfca0d0a` | ✗ ci+structure | ✓ | new-model policy before discovery, sync and export publication |
+| #6332 | lidge-jun | `9111e4f6` → `4f3182292d` | ✓ | ✓ | keep providers-and-adapters.md inside its 600-line budget |
+| #6333 | lidge-jun | `c7cdebeb` → `349588e2f1` | ✗ | ✓ | project drifted discovery reads instead of catalog_busy |
+| #6341 | lidge-jun | `6261e304` → `6f2f6ae9cf` | — | ✓ | report a current Grok CLI version on the OAuth path |
+| #6343 | lidge-jun | `16a5455e` → `a8c6c3f0d0` | ✗ | ✓ | report the current stable Grok CLI 1.0.46 |
+| #6342 | lidge-jun | `d3885b88` → `7ea77aaaf5` | ✓ | ✓ | link the TokenLab OpenCodex integration guide |
+| #6344 | lidge-jun | `f90c5c51` → `ee3845fb10` | ✗ | ✓ | preserve Devin answers with late reasoning signatures |
+| #6345 | lidge-jun | `f05b4088` → `8ad261e000` | ✗ | ✓ | bridge quota popover hover gap, link account management |
+| #6346 | lidge-jun | `8b510524` → `09a86e1ab3` | ✗ | ✓ | accept visible bare native ids in pickerOrder |
+| #6347 | lidge-jun | `b9483926` → `c4a521985a` | ✗ | ✓ | fail over on proven pre-output account 403 refusals |
+| #6349 | lidge-jun | `a79913a2` → `82a4955196` | ✗ | ✓ | follow renamed refusal rotators in source oracles |
+
+`ci`/`et` = the `ci` aggregate and `enforce-target` conclusions on the exact head SHA.
+The 10-01 burst landed mostly red on its own `ci` runs — the wave merged under the
+coordinator's closing rule and shipped in 2.75.0 (030). #6341 ran no `ci` aggregate on
+head.

devlog/_plan/261002_merge_activity/050_wave_1001.md

@@ -0,0 +1,49 @@
+# 050 — wave: 10-01 post-release lanes
+
+Thirty-two merges 10-01 07:29–17:25 UTC, the first wave after 2.75.0 pinned. Two
+threads interleaved: provider/adapter correctness lanes (kiro, xAI, Antigravity,
+Gemini, Anthropic/Claude, combos, qwen chat) and the carry/hardening queue
+(responses, service, router, update, config, spend, tests). Eight wave-mates already
+have their own units — #6366 #6367 #6389 #6390 (omo/LazyCodex carry), #6362 (Zed
+Hosted AI), #6361 #6363 #6364 (quota split / JEV) — cross-referenced, not repeated.
+
+## PRs
+
+| PR | Author | Head → squash | ci | et | Change |
+|---|---|---|---|---|---|
+| #6360 | lidge-jun | `a0d9da37` → `0328373fb8` | ✓ | ✓ | reuse measured entry strings for the state snapshot |
+| #6355 | vadymhimself | `3f94e5c9` → `7b2deb8059` | ✓ | ✓ | clamp budget thinking to the model's real output maximum |
+| #6354 | sh940701 | `97254b53` → `b7f106ea3f` | ✓ | ✓ | log stalled/over-cap passthrough as a 502 incomplete row |
+| #6371 | luvs01 | `5540486e` → `22c890c8df` | ✓ | ✓ | enforce model routes for vision and search helpers |
+| #6372 | luvs01 | `83355c9c` → `459b4ec16f` | ✓ | ✓ | one sibling rotation across authentication failures |
+| #6369 | luvs01 | `7b227283` → `7429513548` | ✓ | ✓ | bound type-array schema normalization, preserve pointers |
+| #6374 | luvs01 | `2534809a` → `5939b09dbe` | ✓ | ✓ | retry rebuilt kiro requests at the rebuilt destination |
+| #6373 | luvs01 | `581b963d` → `de4b2e2a20` | ✓ | cancelled | authorize the Fast wire model across API endpoints |
+| #6377 | luvs01 | `badac2a8` → `3ed275fbf5` | ✓ | ✓ | release kiro leases granted across request cancellation |
+| #6375 | luvs01 | `c912ec1b` → `6e5101115c` | ✓ | ✓ | owner-only no-follow registry publication |
+| #6368 | luvs01 | `c19b45df` → `72e65439f7` | ✓ | ✓ | reject unpaired surrogates in discovered model metadata |
+| #6385 | arikon | `fc615627` → `c94fcf5645` | ✓ | ✓ | Eliza qwen3-8-27b checkpoint ids in leading-system template |
+| #6323 | luvs01 | `992a49bc` → `faf946e8bf` | ✓ | ✓ | preserve canonical path case in project confinement |
+| #6388 | pengusto | `0a2a3894` → `50b3dd48db` | ✓ | ✓ | native login confirmation readable and contained |
+| #6205 | JinHanAI | `a4b595d4` → `7f6b5b7389` | ✓ | fail→pass | why macOS proxy "auto" refuses (exception shapes, SOCKS-only) |
+| #6356 | Ingwannu | `54e870d7` → `404ca8b551` | ✓ | ✓ | relay native Anthropic rate-limit headers |
+| #6399 | lidge-jun | `a1279cf0` → `95f21f438c` | ✗ windows shards | ✓ | canonical role path in role-route write-failure test |
+| #6392 | lidge-jun | `39378850` → `a207452b37` | ✓ | ✓ | first-output timing for tool-only streams (carry #6259) |
+| #6397 | lidge-jun | `c7c4b98f` → `a9d5a80c2d` | ✓ | ✓ | verify service manager identity before census delegation (carry #6379) |
+| #6376 | luvs01 | `02f32ae1` → `6256cb4f8d` | ✓ | ✓ | rebind continuation ownership after refusal failover |
+| #6383 | vadymhimself | `0602d7ba` → `bd3d303bd2` | ✓ | ✗ | pool-held 429 must not park the combo target past the pool |
+| #6394 | lidge-jun | `d6ff960a` → `5444d343e2` | ✓ | ✓ | hosted image results in local Codex clients (carry #6233) |
+| #6396 | lidge-jun | `10644c22` → `58a26f0c13` | ✓ | cancelled | policy authorization across fallback redirects (carry #6380) |
+| #6398 | lidge-jun | `fadf162b` → `4448e98a60` | ✓ | ✓ | name the refused ledger file/condition; warn on synced dirs |
+| #6393 | lidge-jun | `d1d2dd93` → `0202cc68e8` | ✓ | ✓ | exclude macOS Electron helpers from client diagnostics (carry #6296) |
+| #6411 | lidge-jun | `d11845fd` → `665e2bc15b` | ✓ | cancelled | canonicalize owner-registry ACL test root (macOS) |
+| #6395 | lidge-jun | `1c0a53c2` → `09cd45daa5` | ✗ win+mac shards | ✓ | check and pin the npm cache root before staging (#6288) |
+| #6391 | lidge-jun | `4a2a475d` → `8a3a7762fe` | ✗ mac shards | ✓ | tolerate locale dates in Windows service wrappers (carry #6298) |
+| #6359 | lidge-jun | `5bd44661` → `58726ae418` | ✓ | ✓ | opt-in Antigravity TLS profile onto provider egress (carry #3741) |
+| #6412 | lidge-jun | `c4eac63f` → `ff1ce7e8c5` | ✓ | cancelled | close #6361 review follow-ups (over-cap line, docs, structure map) |
+| #6413 | lidge-jun | `5e732845` → `5ea63751d8` | ✓ | cancelled | bundled app-server path via posix.join on every host |
+| #6414 | lidge-jun | `4dfc9503` → `328ce95814` | ✓ | cancelled | classify synced state paths with POSIX rules on every host |
+
+`et:cancelled` rows were superseded by later runs; `et:✗` on #6383 is an
+enforce-target conclusion on an external-contributor head, merged by admin. #6205
+self-corrected on rerun. `ci:✗` rows name the failing shard family.

devlog/_plan/261002_merge_activity/060_wave_1001_windows.md

@@ -0,0 +1,19 @@
+# 060 — wave: 10-01 night Windows service/update
+
+Seven merges 10-01 23:51 → 10-02 00:46 UTC. Six are the devin-ai-integration bot's
+Windows service/update fixes (guarded stop, takeover budget, scheduler probes,
+updater/restart leases — the #5760 restart-lease work), all merged with
+`enforce-target` red on bot heads; #6419 is the maintainer's CLI-picker repair.
+Wave-mate #6418 (Claude CLI first-party picker) has its own unit.
+
+## PRs
+
+| PR | Author | Head → squash | ci | et | Change |
+|---|---|---|---|---|---|
+| #6403 | devin-ai-integration | `e6bf0bae` → `89db85ff05` | ✓ | ✗ | bound every Windows manager command the guarded stop depends on |
+| #6400 | devin-ai-integration | `bd5c085c` → `137164e3eb` | ✓ | ✗ | Windows guarded takeover finishes within one bounded budget |
+| #6407 | devin-ai-integration | `dc10a269` → `17d6e8498d` | ✓ | ✗ | release the Bun updater lease around service-manager starts (#5760) |
+| #6401 | devin-ai-integration | `914c0524` → `cfde167436` | ✓ | ✗ | scope scheduler probes to root task, re-probe deleted registrations |
+| #6404 | devin-ai-integration | `e7a59053` → `0f2ec7adb0` | ✓ | ✗ | release the restart lease before the service refresh (#5760) |
+| #6402 | devin-ai-integration | `e419c711` → `6d84e4468d` | ✓ | ✗ | stabilize guarded-stop re-verification, report the failing guard fact |
+| #6419 | lidge-jun | `fa2e493f` → `8b23fe340a` | ✓ | ✓ | rebuild a CLI picker snapshot whose rows no longer decode |