From eefc080cfe11f79b044d82f14f4a46a2c611c944 Mon Sep 17 00:00:00 2001 From: bitkyc08-arch Date: Wed, 26 Aug 2026 05:47:32 +0900 Subject: [PATCH] devlog: record the owner-backlog closeout --- .../130_wp16_late_bug_prs.md | 58 ++++++++++++++++ .../140_closeout.md | 66 +++++++++++++++++++ 2 files changed, 124 insertions(+) create mode 100644 devlog/_plan/260825_owner_backlog_and_bugpr_closeout/130_wp16_late_bug_prs.md create mode 100644 devlog/_plan/260825_owner_backlog_and_bugpr_closeout/140_closeout.md diff --git a/devlog/_plan/260825_owner_backlog_and_bugpr_closeout/130_wp16_late_bug_prs.md b/devlog/_plan/260825_owner_backlog_and_bugpr_closeout/130_wp16_late_bug_prs.md new file mode 100644 index 0000000000..2b1fdab539 --- /dev/null +++ b/devlog/_plan/260825_owner_backlog_and_bugpr_closeout/130_wp16_late_bug_prs.md @@ -0,0 +1,58 @@ +# 130 — wp16: bug PRs opened after the 260825 triage + +The original triage snapshot (`000_research_snapshot.md`) enumerated 16 bug-labelled PRs. +Five more carry the `bug` label and were not in it, either because they were opened later +or because the label moved after the snapshot was taken: + +| PR | Title | Author | State at triage | +|---|---|---|---| +| #2595 | fix(combos): bound preflight retained chunk count | luvs01 | review-ready, closes #2592 | +| #2583 | fix(kiro): preserve keyword-named composed properties | luvs01 | review-ready, closes #2571 | +| #2575 | fix(pricing): map Daybreak cost overlays and preserve model identity in logs | riique | draft | +| #2430 | fix(gui): align the sidebar foot's four rows | olddonkey | review-ready | +| #2427 | fix(test): pass --parallel so the full suite finishes instead of reading as hung | olddonkey | review-ready | + +## Why this is its own work-phase + +The DONE criterion is "every bug-labelled PR is terminal", not "the sixteen I happened to +list yesterday". A snapshot taken at plan time is a starting inventory, not the scope. These +five are resolved on the same terms as the original sixteen: an independent review that +re-runs the focused suite against a merge with current `dev`, and a falsification pass that +reverts the production hunk to prove the regression test is load-bearing. + +## Verification standard applied + +Each PR was reviewed in its own worktree by a separate reviewer with no knowledge of the +others' conclusions. The merge into `dev` happened only after: + +1. `git merge origin/dev` into the PR head resolved cleanly and `bun x tsc --noEmit` stayed at + exit 0 — a PR green on its own base is not evidence it is green on the current one; +2. the focused suite covering the changed subsystem passed on that merge; +3. reverting the production hunk made the new test fail, and restoring it made the test pass. + +Step 3 is the one that earns its keep. It has already caught a patch in this unit's history +(#2488) whose test passed with the fix reverted — the test was pinning behavior that already +held, so the "fix" was decoration. That patch was dropped and only the test kept. + +#2430 additionally required a rendered check rather than a passing assertion: it is a CSS +alignment change, and a unit test that reads the stylesheet cannot see what the browser lays +out. The reviewer built the GUI, served `gui/dist`, drove it with a real browser, and measured +the four rows — text left edge at x=49, trailing controls ending at x=207, row height 35.5px +across all four. + +#2427 is the highest-risk of the five because it rewrites the test runner every later +verification depends on. It was checked against a real `SIGKILL` of the lock owner +(`RECLAIMED acquired=true`), and the full suite was run through the new runner end to end: +14955 pass / 12 skip / 0 fail in 178s across seven lanes. A runner that reports green while +silently skipping lanes would be worse than the hang it replaces, so the lane totals were +summed rather than trusting the final line. + +#2575 arrived as a draft with an unticked "resolved all Codex/CodeRabbit findings" box. The +review found no blockers, so it was marked ready and merged; the unticked box reflected an +author workflow state, not an outstanding finding. + +## Outcome + +All five merged into `dev`. Linked issues (#2592, #2571) closed by hand with the merge SHA +and the falsification result quoted, because GitHub only auto-closes on merges into `main` +and every PR here targets `dev`. diff --git a/devlog/_plan/260825_owner_backlog_and_bugpr_closeout/140_closeout.md b/devlog/_plan/260825_owner_backlog_and_bugpr_closeout/140_closeout.md new file mode 100644 index 0000000000..5ded3f86cc --- /dev/null +++ b/devlog/_plan/260825_owner_backlog_and_bugpr_closeout/140_closeout.md @@ -0,0 +1,66 @@ +# 140 — closeout + +## Where this landed + +Every issue authored by `lidge-jun` is closed. `gh issue list --author lidge-jun --state open` +returns zero rows. Every `bug`-labelled pull request is terminal except one, and that one is +open by decision rather than by omission. + +Final `dev` verification at `1a92d6b55`: **15005 pass / 16 skip / 0 fail**, typecheck exit 0. + +## The one thing deliberately left open + +**#2497** — native main token refresh and replay. It is the credential boundary AGENTS.md +places under explicit security review, it got one, and three blockers were verified by hand +rather than taken on a reviewer's word (`120_wp5_2497_security_review.md`): + +1. `auth.json` publication renames before it links, so a crash between the two strands the file + and nothing recovers it at startup. +2. The same-account fallback adopts a *different* pool refresh grant into native-main. Account-id + equivalence is not grant ownership — this is the exact hazard `anthropic-routing.ts` fails + closed on. +3. The "exactly one" 401 replay is one *logical* replay. The post-401 send goes through + `fetchWithTransientRetry`, whose 3x3 ladder means one recovery can be up to nine physical + sends. Nothing reaches the client twice, but upstream work can commit more than once. + +(2) is a credential-ownership decision, not a defect to pick a side on silently: tightening it +to grant-only changes what happens to an operator who re-logged in through the pool and expects +main to follow. Fixing three security blockers inside someone else's 2,600-line credential PR +and admin-merging it is not a thing to do quietly. + +## What the run found that nobody asked for + +Three defects that only appeared because the work was verified rather than assumed: + +- **`ocx uninstall` could not remove a config home OpenCodex created itself.** Two of our own + writers produce files the ownership manifest never claimed. Only the disposable-host acceptance + could surface this, because only it runs the production uninstall against a home the product + built. Fixed in #2618. +- **Three regressions from combining #2463 and #1478**, each green in isolation and red together: + a `structuredClone` that threw on a non-cloneable provider value, an alias route that swallowed + the API-key-pool rename endpoint, and a command missing from both documentation sweeps. Fixed + in #2614. This is the argument for a full-suite gate that a per-PR gate cannot make. +- **A session lane keyed on the parent thread** would have 503'd every parallel subagent after + the first. Reproduced before fixing; a lane wants the most specific identity, which is the + opposite of what account affinity wants. + +## Recorded, not absorbed + +- **#2622** — the Codex provenance ledger is never written; `updateIntegrationRecord` has no + production caller. Found while the #1048 rows tried to assert on it. The rows now fail only on + disagreement, because requiring an entry no production path can produce would have been testing + an unimplemented writer. +- **#2568's activation default stays opt-in.** The issue asks for presence-driven activation by + analogy with a 2-key API pool. An API-key pool spends the operator's own metered credit; + rotating across subscription accounts spends a second subscription's quota, which is why the + Anthropic pool shipped opt-in. Turning it on later costs nothing; a default-on rotation that + surprises someone has already spent the quota. Escalated to the owner with the one-line change + named. + +## What earned its keep + +Falsification. Reverting each fix to confirm its test actually fails caught a patch earlier in +this unit (#2488) whose test passed with the fix removed — it was pinning behavior that already +held. That patch was dropped and only the test kept. Every fix merged here was checked the same +way, and three of them (the parent-thread lane, the atomic adoption publication, both uninstall +hunks) are load-bearing only because that check said so.