docs(devlog): 260815 old-draft triage plan, matrix, worker packets

devlog/_plan/260815_old_draft_triage/000_plan.md

@@ -0,0 +1,42 @@
+# 000 - 260815_old_draft_triage: Plan
+
+## Objective
+
+Triage the 18 older open drafts (#1703 #1669 #1664 #1660 #1655 #1652 #1645 #1644 #1624 #1584 #1569 #1557 #1552 #1526 #1521 #1498 #1367 #1165): land the worthwhile (provider additions prioritized), close the superseded, keep the rest drafted with named gaps. Then a release-readiness hardening loop on dev (no publish).
+
+## Loop-spec
+
+- Archetype: verifier-defined (gh state + lidge suite + dev CI).
+- Write scope: GitHub PR state + devlog unit + repair branches. Out of scope: npm publish, tags, main/preview, issues.
+- Bounds: one session; heavy repairs capped at one worker attempt each, else KEEP-DRAFT.
+- Subagents: gpt-5.6-sol, medium effort (owner directive).
+
+## Evidence base
+
+4 sol/medium explorer verdicts (2026-08-15, diff-level + merge-tree + GraphQL threads) against origin/dev 420db6274.
+
+## Disposition summary (010 has full evidence)
+
+- CLOSE (2): #1498 (superseded by policy routing + #1702, 31 unresolved defects), #1367 (retired seam, 10 blockers).
+- KEEP-DRAFT (6): #1552 (auth sponsorship), #1703 (unsafe routing design), #1645 (5 correctness/security blockers), #1557 (not fail-closed), #1526 (5748-line auth surface), #1624 (dormant contract).
+- CHERRY-PICK light (6): #1664 MiniMax, #1669 modelPickerOrder, #1660 terminal guard, #1652 streamAborted, #1165 imageInput, #1644 droid docs.
+- CHERRY-PICK heavy (4): #1655 empty-completion guard, #1569 native chat->chat, #1584 request pacing, #1521 service tiers.
+
+## Work-phase map
+
+| WP | Doc | Slice |
+|----|-----|-------|
+| wp1 | 010 | this matrix |
+| wp2 | 020 | CLOSE 2 + KEEP-DRAFT 6 comments; dispatch 6 light repair workers |
+| wp3 | 020 | integrate light six; lidge verify; land via admin PR; close source PRs with landed-SHA comment |
+| wp4 | 020 | heavy four: one worker attempt each; land what passes, else KEEP-DRAFT |
+| wp5 | 030 | release-readiness loop: lidge gates, dev CI, release.ts preflight, report |
+
+## Landing mechanics (from 260815_open_pr_triage, proven)
+
+Cherry-pick contributor commits (author preserved) onto repair branch off origin/dev, repair commits on top, integrate into int branch, lidge suite, open PR to dev, --admin merge, close source PR with landed-SHA comment. Direct dev push impossible (Protect dev ruleset, bypass=pull_request).
+
+## Accept criteria
+
+- c1 matrix; c2 18 dispositions executed; c3 lidge suite green on final tree; c4 readiness report; c5 privacy clean.
+

devlog/_plan/260815_old_draft_triage/010_triage_matrix.md

@@ -0,0 +1,39 @@
+# 010 - Old-draft triage matrix (wp1 deliverable)
+
+Evidence: 4 sol/medium subagents + A-audit (GO-WITH-FIXES, 2 blockers folded), 2026-08-15, against origin/dev 420db6274. All 18 are drafts.
+
+A-audit amendment: both CLOSE calls were revised to KEEP-DRAFT. #1498 is NOT superseded (current policy routing lacks allowance snapshots, reservations, settlement, pre-dispatch quota/cost evidence; assemble.ts passes neither codexAccountId nor accountRef). #1367's failure class is NOT covered (terminal repair is a narrower registry-controlled case; no custom-provider escape hatch exists on dev). Closing would discard real requirements with no preservation mechanism in scope.
+
+## KEEP-DRAFT (8)
+
+| PR | Gaps |
+|----|------|
+| #1498 economy combo routing | Defective as written (31 unresolved threads, conflicts, 755 behind) but its allowance/reservation/settlement semantics remain unimplemented; preserve until a scoped runtime follow-up exists |
+| #1367 bounded JSON fallback | Redesign around current registry-only compat + terminal-repair architecture; 10 unresolved blockers |
+| #1552 Command Code OAuth pool | 2565-line auth-boundary change; needs maintainer security sponsorship, real GUI screenshot, rebase |
+| #1703 claude classifier affinity | Real defect but implementation can silently cross provider privacy/billing boundaries; maintainer design hold |
+| #1645 vision chat/Google sidecars | 5 verified blockers incl. OAuth-over-HTTP loopback (describe-chat.ts:25) and missing image-boundary checks |
+| #1557 least-privilege catalog endpoint | Response not projected through closed allowlist DTO; not fail-closed; unsponsored auth-cors surface |
+| #1526 reset-credit operation identity | Real idempotency gap but 5748-line auth/persistence authority; needs split or exceptional security review |
+| #1624 quota recovery policy contract | Sound but dormant no-op contract; land only with the #657 runtime slice |
+
+## CHERRY-PICK light (6) - repair then land
+
+| PR | Repair scope |
+|----|--------------|
+| #1664 MiniMax Code/CLI | Shared compiled-aware argv builder (Bun.isStandaloneExecutable) replacing spawn(execPath,[argv[1]]) - repo-wide launcher debt (index.ts/opencode.ts/claude.ts), not MiniMax-only; rebase (124 behind); full gates |
+| #1669 modelPickerOrder | Fail-soft string-array normalization + malformed-input regression + docs contradiction fix |
+| #1660 terminal guard openai-chat | Resolve src/types.ts conflict; add explicit-false + combo/routed-compaction exclusion tests; provider-option docs |
+| #1652 streamAborted | Cover WS finalize + relay-eager paths; fix trackSseForRequestLog cancellation race; drop unrelated fixture churn |
+| #1165 imageInput combo control | Fix double expansion of combo continuations; combo set round-trip; add Turkish/zh-TW locale keys; test coverage |
+| #1644 Factory Droid docs | Name the droid provider id in config; define text-only accepted schema + rejection behavior (EN+KO); docs build |
+
+## CHERRY-PICK heavy (4) - one worker attempt each
+
+| PR | Repair scope |
+|----|--------------|
+| #1655 empty-completion guard | Reimplement on current core.ts: bound retained events/bytes, usage preservation, guard composition, retry-cause record, integration tests; currently CI-red |
+| #1569 native chat->chat | Rebuild around shared openai-chat request builder + bounded SSE parser; redactSecretString on structured provider errors; URL normalization |
+| #1584 request pacing | Reconcile 4 conflicting files (ProviderSettings, responses/core, fetch-helpers, policy-fallback); remove real-timer flake tests; 358 behind |
+| #1521 service tiers | Port per-model resolver across 4 conflicts (openai-chat adapter, provider-fetch, 2 test files) onto current service-tier gating; #1436 |
+

devlog/_plan/260815_old_draft_triage/020_execution.md

@@ -0,0 +1,56 @@
+# 020 - Execution record (wp2-wp4)
+
+## wp2 worker packets (P artifact)
+
+Shared mechanics for every worker (sol/medium, forked session):
+
+1. git worktree add /tmp/ocx-repair-<n> -b repair/260815-pr-<n> origin/dev   (run from the main checkout)
+2. cd /tmp/ocx-repair-<n>; git fetch origin pull/<n>/head; cherry-pick the PR commits (author preserved); resolve conflicts
+3. Apply the named repairs only - no drive-by refactors
+4. bun install at root (plus cd gui && bun install when touching gui/)
+5. bun run typecheck MUST pass; run ONLY focused tests for touched/added files; NEVER the full suite (owner runs it remotely)
+6. Commit with clear messages; DO NOT push; DO NOT touch the main checkout working tree
+7. Report: branch, commits, files changed, test tails, rejected repairs + reasons
+
+### repair/260815-pr-1664 (MiniMax Code/CLI, 3 commits)
+
+Cherry-pick EXACTLY the two non-merge commits (A-audit: skip merge commit 50ac35d02, whose second-parent patch duplicates befd076f6):
+  git cherry-pick befd076f601f1c77a57406b93dabe10347013edb
+  git cherry-pick cd3c26a4c7a51937c4a58ced88a4cbb5a8519098
+Repairs:
+- Introduce ONE shared compiled-aware launcher argv helper (Bun.isStandaloneExecutable split: standalone -> spawn(process.execPath, args); source -> spawn(process.execPath, [process.argv[1], ...args])) in a shared cli module.
+- Migrate ALL launcher call sites (A-audit expanded scope): PR-head src/cli/minimax.ts:261; existing src/cli/index.ts:123 (+consumers 471/518, dispatch injection 934-936), src/cli/opencode.ts:497, src/cli/claude.ts:272, src/server/management/system-restart.ts:216, src/update/index.ts (251, 301, 307, 331, 375), src/update/job.ts (1869, 1873).
+- Unit tests for both modes.
+
+### repair/260815-pr-1669 (modelPickerOrder, 1 commit)
+
+- Runtime-normalize config value: fail-soft string-array filter before any .filter() use; malformed hand-edited values must not crash catalog sync.
+- Malformed-input regression tests; fix docs contradiction in docs-site model-ordering guide.
+
+### repair/260815-pr-1660 (terminal guard openai-chat, 2 commits; conflict src/types.ts)
+
+- Resolve types.ts conflict against current dev.
+- Add explicit-false activation test; combo-attempt and routed-compaction exclusion tests; document the provider option.
+
+### repair/260815-pr-1652 (streamAborted, 1 commit)
+
+- Mark streamAborted on the native Responses WebSocket finalize path and src/server/relay-eager.ts eager path (both currently omit it).
+- Fix trackSseForRequestLog continuing terminal handling after cancellation.
+- Drop the unrelated rate-limit test fixture mutation from the cherry-pick.
+
+### repair/260815-pr-1165 (imageInput combo control, 3 commits)
+
+- Preserve and regression-test the existing anti-double-expansion deletion (PR head deletes previous_response_id before child dispatch; A-audit: already correct - lock with a test, do not 'fix').
+- ocx combo set must not silently reset imageInput disabled mode (round-trip test).
+- Add missing Turkish + zh-TW locale keys; stored-image replay coverage.
+
+### repair/260815-pr-1644 (Factory Droid docs, 1 commit)
+
+- Name the droid provider id in the config example so the verification command works.
+- Define the text-only accepted input schema + explicit rejection behavior for images/tool items, in BOTH English and Korean guides.
+- Run the docs-site build.
+
+## Execution log
+
+(pending)
+

devlog/_plan/260815_old_draft_triage/030_release_readiness.md

@@ -0,0 +1,3 @@
+# 030 - Release-readiness record (wp5)
+
+(pending)