[WRONG BRANCH] release: promote dev onto preview for the main-account badge fix

CREDITS.md

@@ -95,3 +95,34 @@ unnecessary.
 
 If you find a landing that belongs on this page, open an issue. Being missed is
 the defect this file documents, not a claim you have to argue for.
+
+### A gap the gate does not close
+
+The gate checks that a trailer is **present**. It cannot check that the trailer
+resolves to the account it names.
+
+A 2026-09-04 backlog review found carry PR
+[#3374](https://github.com/lidge-jun/opencodex/pull/3374), carrying
+[#3333](https://github.com/lidge-jun/opencodex/pull/3333) by
+[@blackjune67](https://github.com/blackjune67), with:
+
+```
+Co-authored-by: hajune <contributor@work-domain.example.test>
+```
+
+(The address is masked here — `privacy:scan` blocks real contributor emails in the
+tree. What matters is its shape: a personal work address, not a GitHub-linked one.)
+
+That is the git identity on the contributor's own commits, so it looks correct
+in every review. But GitHub attributes co-authors by **account-linked** email,
+and that address is linked to no account — so the trailer would have credited
+nobody, and the contributor would have been invisible on their own patch. The
+gate passed it, because a trailer was there.
+
+It was corrected before the merge to the contributor's account-linked
+`users.noreply.github.com` address, which is why there is no table row for it above.
+
+The lesson generalizes: when carrying work, take the trailer address from the
+author's GitHub account (the numeric-id `users.noreply.github.com` form is always
+safe), not from the commit metadata on their branch. A contributor who commits
+under a work email is the normal case, not an edge case.

devlog/_fin/260904_repo_hygiene_campaign/000_plan.md

@@ -0,0 +1,87 @@
+# 260904 — Repository hygiene campaign
+
+Unit for the branch/PR/issue drawdown requested on 2026-09-04: delete landed and
+abandoned refs locally and on `origin`, close superseded and partially-landed
+pull requests and issues, consolidate surviving scope into new issues, and credit
+every contributor whose work is carried.
+
+## Inventory at entry (2026-09-04, origin/dev = b5777aa2d)
+
+| Surface | Count |
+|---|---|
+| Local branches | 230 |
+| Remote branches on `origin` | 56 |
+| Open pull requests | 53 |
+| Open issues | 45 |
+| Worktrees | 67 |
+
+## Classification of local branches
+
+Every branch was scored on four independent axes rather than by name:
+
+1. `git merge-base --is-ancestor <br> origin/dev` — plain ancestry.
+2. `git cherry origin/dev <br>` — patch-equivalence, which catches rebases.
+3. Content landing — the files the branch touches
+   (`git diff --name-only origin/dev...<br>`) are compared two-dot against
+   `origin/dev` restricted to exactly those paths. Zero remaining difference
+   means the branch's content is already on `dev` even though a squash merge
+   destroyed its commit identity.
+4. Exact reference matching against live GitHub state: open-PR head refs,
+   worktree-backing refs, and the PR number a scratch branch was cut for.
+
+Resulting buckets:
+
+| Bucket | Count | Disposition |
+|---|---|---|
+| PROTECTED (`dev`, `main`, `preview`) | 3 | never touched |
+| OPEN_PR_HEAD | 7 | never touched |
+| WORKTREE-backed | 44 | never touched |
+| SAFE_DELETE (ancestor or zero unique commits) | 13 | delete |
+| Scratch branches for MERGED/CLOSED PRs | 85 | delete |
+| Content already landed on `dev` | 6 | delete |
+| UNIQUE_WORK still unlanded | 39 | keep |
+
+## Prior-run failure this unit must not repeat
+
+A cleanup run on 2026-09-02 guessed PR numbers from branch names, treated the
+guesses as merge evidence, and deleted the head refs of open pull requests: only
+4 of 33 open PR heads survived it. Two rules follow. Open-PR head refs are read
+from `gh` and matched by exact string immediately before each deletion batch,
+never inferred. And a branch is deleted only when at least one of the four tests
+above passes on the branch itself.
+
+## A shell hazard that produced a false positive
+
+The content-landing test was first written in shell. The login shell here is
+zsh, which does not word-split an unquoted variable, so a 57-path file list
+collapsed into a single nonexistent pathspec and `git diff` returned empty —
+reporting `feat/macos-app`, a branch with 57 genuinely unlanded files including
+an entire `app/` tree absent from `dev`, as fully landed. Acting on that would
+have destroyed the macOS app work.
+
+The test was rebuilt in Python passing a real argument list, and validated
+against controls in both directions before any deletion: an open PR head must
+score UNLANDED, and a branch whose content is known to be on `dev` must score
+LANDED. The rewritten test moved `feat/macos-app` to UNLANDED and reduced the
+"landed" set from a bogus 41 to a verified 6.
+
+Rule for this unit: any bulk classifier gets a negative control before its
+output authorizes a destructive action.
+
+## Work phases
+
+| Phase | Doc | Scope |
+|---|---|---|
+| wp0 | this file + 010 | roadmap and inventory |
+| wp1 | 020 | local branch deletion |
+| wp2 | 030 | `origin` remote branch deletion |
+| wp3 | 040 | maintainer-authored PR drawdown |
+| wp4 | 050 | contributor PR drawdown with credit |
+| wp5 | 060 | issue drawdown and consolidation |
+| wp6 | 070 | credit ledger and closeout |
+
+## Out of scope
+
+Merging any pull request, pushing to `dev`/`main`/`preview`, releases,
+force-push, history rewriting, worktree removal, and behavior changes under
+`src/`. The local test suite is forbidden for this unit by explicit instruction.

devlog/_fin/260904_repo_hygiene_campaign/010_method.md

@@ -0,0 +1,98 @@
+# 010 — Classification method and its controls
+
+## The four tests
+
+A local branch is deletable when at least one holds, and no guard fires.
+
+```
+T1 ancestry      git merge-base --is-ancestor <br> origin/dev
+T2 patch-equiv   git cherry origin/dev <br>            -> no '+' lines
+T3 content       paths = git diff --name-only origin/dev...<br>
+                 git diff --name-only origin/dev <br> -- <paths>  -> empty
+T4 scratch       branch name encodes a PR number whose state is MERGED or CLOSED
+                 AND the name matches the scratch prefix set
+                 AND the number is a WHOLE numeric token of the branch name
+                 AND the branch is provably a duplicate of that PR's head:
+                     identical SHA, an ancestor of it, or content-identical to it
+```
+
+T3 is the one that matters for this repository, because `dev` takes squash
+merges: after a squash the branch shares no commit with `dev`, so T1 and T2 both
+report "unmerged" for work that is fully shipped. T3 asks the only question that
+is actually load-bearing — is there any difference left in the files this branch
+claims to change.
+
+T4 is deliberately narrow. It fires only for throwaway prefixes
+(`pr*`, `rb-`, `jrb-`, `mtp/`, `big-`, `cf-`, `ocx-`, `wip/`, `backup/`,
+`candidate`, `cursor-`, `midstream`) created by earlier review and rebase runs,
+and only when the referenced PR is already MERGED or CLOSED. A `codex/*` branch
+is never deleted on T4 alone.
+
+**T4 alone is not sufficient, and the first version of it was wrong.** PR state
+says nothing about whether *this branch* still holds unique work, so T4 now
+requires a positive duplication proof against the PR head itself: the branch is
+the same commit, an ancestor of it, or content-identical to it. If the PR head
+cannot be fetched or the branch matches none of those, the branch falls through
+to the content test against `dev`, and if that also fails it is preserved.
+
+The number must also be a whole numeric token of the branch name. The naive
+regex extracted `2608` from the date suffix in
+`cursor-call-prerebase-260818` and matched it to an unrelated merged PR — the
+exact name-guessing that destroyed open-PR heads on 2026-09-02, reproduced
+inside the very unit written to prevent it. That branch holds two unique Cursor
+stream-EOF and cancel fixes and 31 otherwise-unreachable commits.
+
+This was caught by an independent auditor, not by the author of the rule.
+
+## The guards
+
+Deletion is refused, regardless of test result, for:
+
+- `dev`, `main`, `preview`
+- any ref appearing as `headRefName` of an open pull request, read from `gh`
+  immediately before the batch and matched as an exact string
+- any ref backing a live worktree, from `git worktree list --porcelain`
+- the currently checked-out branch
+
+## Controls run before deletion was authorized
+
+The content test is a destructive-action authority, so it was falsified first.
+
+**Negative control.** `origin/codex/responses-usage-passthrough`, head of open
+PR #3364, must not score LANDED. It differs from `dev` in 38 files and scored
+UNLANDED. Passed.
+
+**Positive control.** `codex/remote-hub-restack-roadmap-archive` carries 39
+unique commits but every file it touches is already identical on `dev`; a
+commit-based test calls it unmerged, the content test calls it LANDED. Passed.
+
+**Failure the controls caught.** The first shell implementation reported 41
+branches LANDED including `feat/macos-app`, which adds an entire `app/` tree
+that does not exist on `dev`. Cause: zsh does not word-split unquoted
+variables, so `git diff ... -- $paths` passed one 57-line pathspec that matched
+nothing and produced empty output, which the test read as "no difference." Any
+branch would have scored LANDED. Rebuilt in Python with a real argv list; the
+landed set fell from 41 to 6 and `feat/macos-app` correctly moved to UNLANDED.
+
+## Result
+
+Candidate set 104, of which 33 failed the hardened tests and are preserved.
+
+| Verdict | Count | Proof |
+|---|---|---|
+| Delete | 50 | identical SHA to its PR head |
+| Delete | 2 | ancestor of its PR head |
+| Delete | 13 | ancestor of `dev` or zero unique commits |
+| Delete | 6 | content already on `dev` (squash-hidden) |
+| **Total deletion set** | **71** | every entry carries a named proof |
+| Preserved: failed the duplication proof | 32 | |
+| Preserved: number not a whole token | 1 | `cursor-call-prerebase-260818` |
+| Keep: unlanded unique work | 39 | |
+| Keep: open-PR head, worktree-backed, protected | 54 | |
+
+Every entry in the final set names its own proof, so no deletion rests on the
+absence of evidence. Ledgers: `.tmp/hygiene/DELETE_FINAL.json` and
+`.tmp/hygiene/REJECTED_FINAL.json`.
+
+Ledger of the deletion set with per-branch reason:
+`.tmp/hygiene/delete-local.json` (scratch space, not tracked).

devlog/_fin/260904_repo_hygiene_campaign/015_audit_record.md

@@ -0,0 +1,78 @@
+# 015 — Audit record for the deletion ledger
+
+The branch-deletion ledger was reviewed by an independent auditor before any
+branch was touched. It failed three times. Each failure is recorded here because
+each one would have destroyed work.
+
+## Round 1 — FAIL
+
+> `cursor-call-prerebase-260818` was matched to unrelated PR #2608 by parsing a
+> date-like branch suffix and still contains unique unmerged patches
+
+The scratch-branch rule extracted the first 3–4 digit run from a branch name and
+treated the matching PR's state as merge evidence. The branch is dated
+2026-08-18, so `260818` yielded `2608`, which is a real merged PR about a
+completely different subject. The branch carries two unique Cursor fixes — an
+unlabeled stream EOF failure and a cancel surface — and 31 commits reachable
+from nothing else.
+
+This is the same class of error that deleted open-PR head refs on 2026-09-02,
+reproduced inside the unit written to prevent it. Writing the rule down did not
+prevent it; an auditor running the numbers did.
+
+Fix: the PR number must be a whole numeric token of the branch name, and PR
+state alone no longer authorizes anything — the branch must be proven a
+duplicate of that PR's head (same SHA, ancestor, or content-identical).
+Candidate set 104 → approved 71.
+
+## Round 2 — FAIL
+
+> `final.py` can authorize deletion from a stale PR-head ref or failed `git
+> diff` because both command failures are ignored
+
+The generator ignored return codes. A failed `fetch` left a stale
+`refs/prhead/<n>` that would be compared as if current, and a failed `git diff`
+produced empty stdout that read as "no difference" — the same shape as the zsh
+bug in `010_method.md`, where absence of output was mistaken for absence of
+change. Twice in one unit, so it is a pattern and not an accident: **empty
+output is not evidence unless the command is known to have succeeded.**
+
+Fix: fail-closed. Git failures raise, PR heads are force-fetched with a checked
+return code, and any error rejects the branch. Regenerating produced exactly the
+same 71 branches, which is itself the evidence that the earlier approvals were
+sound rather than lucky.
+
+## Round 3 — FAIL
+
+> cached T1/T2 and T3 proofs are not recomputed or SHA-bound, so a branch that
+> moves after classification can lose new work
+
+Proofs were inherited from JSON snapshots taken earlier in the session and the
+ledger stored no SHAs, so a branch that gained a commit between classification
+and deletion would still be deleted on the strength of a stale verdict.
+
+Fix: snapshots now supply only the candidate list. Every proof is recomputed
+live, and each approval records the branch tip, the proof, and the `origin/dev`
+SHA it was proven against. Execution re-reads each tip immediately before
+deletion and refuses on any mismatch.
+
+## Round 4 — PASS
+
+- 71/71 recorded tips equal current branch tips
+- 71/71 proofs still hold at the recorded SHA
+- 33/33 rejected branches still present, including `cursor-call-prerebase-260818`
+- guards empty against live state: no open-PR head, no worktree ref, nothing protected
+- `origin/dev` moved during the audit (`b5777aa2d` → `664d80c76`) and invalidates
+  no proof; no rejected branch became landed as a result
+
+Non-safety note from the auditor: `rb-2122-ELZMyj` and `rb-2734` are
+tree-identical to their PR heads but stay preserved because the comparison uses
+three-dot form. Over-preservation, so it stands.
+
+## What this cost and why it was worth it
+
+Four rounds against one auditor, no branch deleted until the fourth passed. The
+first round alone justifies the whole exercise: the plan document explicitly
+warned against branch-name guessing on line 46, and the implementation did it
+anyway on line 12 of the very next file. A rule you wrote does not audit the
+code you wrote.

devlog/_fin/260904_repo_hygiene_campaign/020_wp1_local_branches.md

@@ -0,0 +1,54 @@
+# 020 — wp1: local branch deletion
+
+Delete the 71 branches in the verified deletion set, in batches, re-reading the
+guard sets before each batch. Each entry carries a named proof; a branch with no
+proof is preserved rather than deleted.
+
+## Procedure
+
+1. Snapshot every local ref to scratch: `git for-each-ref refs/heads` with SHAs,
+   so any deletion is recoverable by SHA for as long as the objects survive gc.
+2. Re-read open-PR head refs from `gh` and worktree refs from
+   `git worktree list --porcelain`. Intersect with the deletion set; a non-empty
+   intersection aborts the phase.
+3. Delete with `git branch -D` in batches of ~20, capturing the reported SHA for
+   each deletion.
+4. Verify: the local branch count drops by exactly 71, and every
+   protected / open-PR / worktree ref still resolves. Counts are measured live
+   at execution rather than asserted here — the branch total moves as other
+   sessions work in this repository, and a stale expected number is a false
+   alarm, not a safety property.
+
+`-D` rather than `-d` is required because squash-landed branches are not
+ancestors of `dev` and `-d` refuses them; that is exactly the case T3 exists to
+decide, and the decision has already been made with evidence.
+
+## Outcome (executed 2026-09-04)
+
+71 branches deleted, each after re-reading its tip and comparing it to the SHA
+recorded at classification. Zero failures, zero tip mismatches.
+
+| Measure | Before | After |
+|---|---|---|
+| Local branches | 241 | 170 |
+
+Post-deletion verification, run against live state rather than the plan:
+
+| Check | Result |
+|---|---|
+| Open-PR head refs present locally that were lost | 0 of 13 |
+| Worktree-backing refs lost | 0 of 47 |
+| Preserved (rejected) branches wrongly deleted | 0 of 33 |
+| `dev` / `main` / `preview` intact | yes |
+
+That first row is the whole point of this unit. The 2026-09-02 run left only 4
+of 33 open-PR heads alive; this one lost none.
+
+## Exit criteria
+
+- Exactly the 71 approved refs are gone; nothing else was removed.
+- Every open-PR head ref present locally still resolves.
+- Every worktree-backing ref still resolves.
+- `dev`, `main`, `preview` resolve to their pre-phase SHAs.
+- `cursor-call-prerebase-260818` and the other 32 preserved branches still
+  resolve.