fix(claude): preserve signed and redacted thinking ordering

devlog/_plan/260907_lane_d/000_plan.md

@@ -0,0 +1,32 @@
+# Lane D release-train roadmap
+
+Satisfy-spec HOTL for delegated recommendations #16 → #17 → #15 → #21 → #25.
+Goal: independently audited manual dependent PRs ready for main-session integration.
+Scope: Claude outbound, display-name dialog, usage costs/overlays/summary, usage GUI,
+plus directly required CLI/API/tests/docs. i18n files are append-only shared per main's
+2026-09-07 correction. No other lane-owned files; no merge/release/main/preview.
+No local test/typecheck/build/install. Remote ci.yml lane=all at final top SHA is
+sole product verifier. Local source and diff checks are not execution evidence.
+No user token or wall-clock bound supplied. Use existing repo/GitHub authorization.
+Stop: top-head green with reviewer verdicts and layer PR/SHA evidence; otherwise
+record exact DEFER/BLOCKED reasons without claiming implementation passes.
+Memory/evidence: this unit plus .tmp/lane-d for review drafts. Unpublished security
+material stays in scratch. Reclaim failed delegated work after two distinct agents;
+other-lane file collision requires main coordination.
+
+## Dependency and publication map
+
+| Phase | Item | Outcome | Branch |
+|---|---|---|---|
+| 0 | Roadmap | Lock all diff plans before code | first layer docs |
+| 1 | #3719 slice | Legacy redacted-before-signed SSE/JSON parity | codex/260907-d1-thinking |
+| 2 | receipt guard | Prevent new intent while recovery is pending | codex/260907-d2-receipt |
+| 3 | #3817 | Exact account identity resolves provider overlays | codex/260907-d3-account-prices |
+| 4 | #3667 | Price editor + CLI + authoritative explicit zero | codex/260907-d4-price-editor |
+| 5 | #3379 slice / #2956 | Inclusive custom usage bounds + GUI | codex/260907-d5-usage-ranges |
+| 6 | readiness | Fresh top CI, screenshots and implementation audits | top branch |
+
+All lower subjects include [skip ci]; every push uses --no-verify. Native stack null.
+Only phase 6 dispatches ci.yml lane=all; failures get Astra-high exact-log diagnosis,
+fixes on their owning layer and rebase --update-refs cascade. Main alone merges.
+#3719 and #3379 stay open. #2956 credit uses verified GitHub author identity.

devlog/_plan/260907_lane_d/001_roadmap_audit.md

@@ -0,0 +1,16 @@
+# Roadmap audit resolution
+
+Astra Herschel (01a07b2b-5148-73c0-a067-a13485ab32c9) returned
+GO-WITH-FIXES with four bounded roadmap corrections. All are incorporated in
+040_price_editor.md and 050_usage_ranges.md: register management routes; persist
+manual-price display state; filter individual ledger entries before daily aggregation;
+preserve apiKeyId and scan consistency; define milliseconds and explicit window bounds.
+
+Astra Dirac identified two thinking design blockers, recorded in 010 for re-audit:
+item ownership and simultaneous reasoning/frame retention. Astra Ohm limits the account
+mapping to evidenced Codex identities and requires consistent tier-namespace resolution.
+The first implementation phase must finish those fold-backs before code changes.
+
+Only documentation has changed. Source references were inspected; product tests,
+typecheck, builds and installs are NOT RUN by delegation instruction. Product acceptance
+remains open until top-head Cross-platform CI executes lane=all.

devlog/_plan/260907_lane_d/010_thinking.md

@@ -0,0 +1,26 @@
+# 010 Thinking ordering
+MODIFY src/claude/outbound.ts ensureBlock/closeOpenBlock and reasoning done.
+Before: thinking start/deltas are emitted immediately; done closes thinking then red.
+After: retain already-budgeted thinking text, defer its start/index/delta until close;
+reasoning done emits red blocks before flushing pending signed thinking. Preserve text
+and tool order, hidden env.txt non-disclosure, genuine signature and budget release.
+MODIFY tests/claude-integration/claude-outbound.test.ts: compare collected SSE against
+literal expected content and JSON for combined envelopes with preceding deltas,
+multiple summary parts/red blocks, text prefix, signed-only, red-only. Check sequential
+non-overlapping block indices and cancellation/overflow existing assertions.
+Independent Astra audit must resolve streaming latency and allocation implications.
+
+Verification: NOT RUN locally by user instruction; focused tests execute in final top-head Cross-platform CI.
+
+## A audit fold-back
+Astra Dirac found two blockers: unmatched-item reordering and closure memory overlap.
+Track bounded reasoningItemKey separately from part identity; flush on changed explicit
+item identity, and close unrelated pending thinking before another item's red blocks.
+Only same identity (including both omitted) reorders red before pending thinking.
+Retain thinkingBuf through signature emission as before;
+queued frame budget stays authoritative, never weakened. Add near-limit valid control,
+shared-budget collector control, overflow/cancel regressions. Deferred thinking is an
+accepted visible-latency tradeoff; text/tool frames remain live with incremental-reader
+coverage. Late done after a different emitted block cannot reorder earlier content.
+
+Re-audit Dirac: VERDICT PASS, blockers=0. Accept tight artificial budget capacity reduction; retain original overflow assertions and production limits.

devlog/_plan/260907_lane_d/020_receipt.md

@@ -0,0 +1,12 @@
+# 020 Display-name receipt recovery
+MODIFY gui/src/components/ModelDisplayNameDialog.tsx.
+Before: input/reset enabled whenever saving=false; input onEdit clears recovery.
+After: new mutationOutcomeUnknown prop from Models.tsx recovery.confirmed===false
+disables draft editing and reset, submit retains
+read/retry action. Handler guards prevent synthetic events bypassing disabled controls.
+Close/cancel stays available. This is bounded UI recovery, not server request ordering.
+MODIFY gui/tests/models-display-name-editor.test.tsx: unknown receipt cannot replace intent; retry recovers; confirmed saved:true
+and ordinary validation error remain
+editable. Screenshot changed disabled input/reset with retry available.
+
+Verification: NOT RUN locally by user instruction; focused tests execute in final top-head Cross-platform CI.

devlog/_plan/260907_lane_d/030_account_prices.md

@@ -0,0 +1,13 @@
+# 030 Account price identity
+MODIFY src/usage/user-cost-overlays.ts registry refresh and signature/version.
+Before: configured provider set and overlay rows only.
+After: exact account identifiers/log labels from config mapped to established provider
+identity. Include mapping in signature for memo and aggregate cache invalidation.
+MODIFY src/usage/cost.ts resolveMatchedPrice: exact configured namespace and exact
+user overlay precede account identity; unresolved suffix is never guessed/stripped.
+MODIFY tests/usage/usage-cost.test.ts or existing provider-overlay tests: custom account
+id, qualified id, stable log label, configured collision, unrelated hyphenated provider,
+account rename/removal invalidation. Account aliases never become identity authority.
+Audit determines precise supported historical labels from actual producer evidence.
+
+Verification: NOT RUN locally by user instruction; focused tests execute in final top-head Cross-platform CI.

devlog/_plan/260907_lane_d/040_price_editor.md

@@ -0,0 +1,23 @@
+# 040 Manual price editor
+MODIFY src/usage/cost.ts userOverlayMatch: valid operator all-zero row returns user
+price, while generated catalog zeros keep unknown/fallback semantics.
+MODIFY src/server/management/model-routes.ts: exact-provider model-costs GET/PUT,
+validate four finite nonnegative bounded rates or null reset, preserve siblings,
+rollback on persist failure, no routing/catalog mutation required for price-only edits.
+MODIFY src/cli/models-runtime.ts, models-runtime-subcommands.ts and capabilities.ts:
+models set-price provider/model --input N --output N [--cache-read N --cache-write N]
+or --auto. GET for show and PUT for set/reset through existing management client.
+ADD gui/src/components/ModelPriceDialog.tsx; MODIFY Models.tsx and models-shared.ts
+only as needed: edit action, load exact saved override, inputs 4 rates USD/1M,
+save/reset and manual indicator. Reuse dialog/fetch/i18n patterns. All locale keys
+append-only pricing.override.*. Add endpoint, CLI, estimator and GUI regressions;
+register new test files in both append-only layout manifests. Public docs and generated
+CLI surface map mirror actual capability entries; source-generation commands NOT RUN
+locally so map is updated by its source contract without claiming verification.
+
+Verification: NOT RUN locally by user instruction; focused tests execute in final top-head Cross-platform CI.
+
+A fold-back: add GET/PUT entries in src/server/management/route-registry.ts.
+Reuse providerModelCostsConfigError. GET returns sanitized per-provider modelCosts map;
+Models owns a typed map loaded with catalog or dedicated GET, so manual badges survive
+reload. CLI omitted cache-read/cache-write rates default to zero, explicitly documented.

devlog/_plan/260907_lane_d/050_usage_ranges.md

@@ -0,0 +1,30 @@
+# 050 Custom usage windows
+REIMPLEMENT range slice from PR #2956 with Manson2438 credit; do not carry offline reports.
+ADD src/usage/time-range.ts strict timestamp parser and inclusive since/until bounds;
+MODIFY summary.ts accumulator interface to support bounded windows without poisoning
+preset daily aggregates. Use stream ledger filtering for partial days if compact daily
+partitions cannot answer exact boundaries. Reject malformed/reversed bounds at API/CLI.
+MODIFY src/server/management/logs-usage-routes.ts custom-window path before preset cache,
+stream/filter into isolated accumulator preserving surface/provider/model and truncation
+metadata. Do not persist normalized ledger rows. Include bounds in response.
+MODIFY CLI observe/capabilities usage flags and GUI Usage.tsx custom datetime inputs,
+independent draft/applied bounds, cache key includes bounds, grid anchored to effective
+window, clear returns to preset. All locale keys append-only usage.range.*.
+Tests: inclusive boundaries, partial same-day, reversed/invalid, empty ledger, existing
+provider/model/surface filters, preset cache after custom query; GUI apply/clear/errors.
+Public API/CLI docs describe epoch/ISO contract and local datetime conversion.
+
+Verification: NOT RUN locally by user instruction; focused tests execute in final top-head Cross-platform CI.
+
+A fold-back: immutable window option on createUsageSummaryAccumulator; add() checks
+inclusive bounds AFTER recording whole-scan snapshot timestamps but BEFORE partitioning.
+clone preserves window. summarize uses window endpoint for grid, actual now for generatedAt;
+retain 366-day grid cap. Custom queries use isolated row-unique accumulator via existing
+getFilteredUsageAggregate with window in key. Reuse overlay/timezone revision restart
+and scanner identity controls. Preserve apiKeyId and current filter echo alongside all
+other filters. USAGE_RANGES remains preset-only; response range stays selected preset
+with customWindow:true, since/until explicit bounds (bounds override preset). API accepts
+integer epoch milliseconds or full ISO-8601 with timezone only; require both bounds;
+reject negative/unsafe/date-invalid/reversed, never normalize overflow dates.
+MODIFY src/cli/usage-report.ts heading prints since/until for customWindow responses.
+GUI datetime values become epoch ms locally; end selected minute includes 59.999s.

src/claude/outbound.ts

@@ -215,6 +215,8 @@ interface OpenBlock {
   callId?: string;
   /** Last fixed-size reasoning identity (item + summary/content index) seen by this block. */
   reasoningPartKey?: string;
+  /** Fixed-size item identity; missing IDs only match other missing IDs. */
+  reasoningItemKey?: string;
   thinkingBuf?: string;
   thinkingBufBytes?: number;
   reasoningSig?: string;
@@ -308,6 +310,20 @@ export function responsesSseToAnthropicSse(
           open.webSearchArgsEmitted = true;
         }
         if (open.kind === "thinking") {
+          // Delay the index and all thinking frames until closure so a matching
+          // done envelope can put its redacted blocks first. The existing buffer
+          // remains charged through signature emission, including queued frames.
+          open.index = blockIndex++;
+          emit("content_block_start", {
+            type: "content_block_start", index: open.index,
+            content_block: { type: "thinking", thinking: "", signature: "" },
+          });
+          if (open.thinkingBuf) {
+            emit("content_block_delta", {
+              type: "content_block_delta", index: open.index,
+              delta: { type: "thinking_delta", thinking: open.thinkingBuf },
+            });
+          }
           const signature = open.reasoningSig ?? encodeReasoningEnvelope({ txt: open.thinkingBuf ?? "" }, translatorBudget);
           emit("content_block_delta", {
             type: "content_block_delta", index: open.index,
@@ -323,12 +339,13 @@ export function responsesSseToAnthropicSse(
         ensureStarted();
         if (open && open.kind === kind) return;
         closeOpenBlock();
+        if (kind === "thinking") {
+          open = { kind, index: -1, thinkingBuf: "", thinkingBufBytes: 0 };
+          return;
+        }
         const index = blockIndex++;
-        const contentBlock: Rec = kind === "text"
-          ? { type: "text", text: "" }
-          : { type: "thinking", thinking: "", signature: "" };
-        emit("content_block_start", { type: "content_block_start", index, content_block: contentBlock });
-        open = { kind, index, thinkingBuf: "", thinkingBufBytes: 0 };
+        emit("content_block_start", { type: "content_block_start", index, content_block: { type: "text", text: "" } });
+        open = { kind, index };
       };
       const finish = (stopReason: string, usage: unknown) => {
         if (terminated) return;
@@ -405,11 +422,13 @@ export function responsesSseToAnthropicSse(
           case "response.reasoning_summary_text.delta":
           case "response.reasoning_text.delta": {
             if (typeof data.delta !== "string" || data.delta.length === 0) break;
+            const itemKey = boundedReasoningIdentity(data.item_id);
+            if (open?.kind === "thinking" && open.reasoningItemKey !== itemKey) closeOpenBlock();
             ensureBlock("thinking");
             const active = open;
             if (!active || active.kind !== "thinking") break;
             // The JSON path joins reasoning summary/content parts with "\n\n"
-            // (responsesJsonToAnthropicMessage); mirror that at part and item boundaries
+            // (responsesJsonToAnthropicMessage); mirror that at part boundaries
             // so multi-part summaries do not glue into one run-on paragraph. Frames
             // without part indices produce a constant key and never get a separator.
             const slot = eventName === "response.reasoning_summary_text.delta"
@@ -418,7 +437,7 @@ export function responsesSseToAnthropicSse(
             // Upstream string metadata can be arbitrarily large. Hash strings into fixed-size
             // components while retaining item and part equality, rather than dropping item_id and
             // accidentally joining distinct malformed reasoning items.
-            const partKey = `${boundedReasoningIdentity(data.item_id)}:${slot}`;
+            const partKey = `${itemKey}:${slot}`;
             const needsPartSeparator = active.reasoningPartKey !== undefined
               && active.reasoningPartKey !== partKey;
             const appended = `${needsPartSeparator ? "\n\n" : ""}${data.delta}`;
@@ -436,17 +455,8 @@ export function responsesSseToAnthropicSse(
               reservation.release();
               throw error;
             }
-            if (needsPartSeparator) {
-              emit("content_block_delta", {
-                type: "content_block_delta", index: active.index,
-                delta: { type: "thinking_delta", thinking: "\n\n" },
-              });
-            }
+            active.reasoningItemKey = itemKey;
             active.reasoningPartKey = partKey;
-            emit("content_block_delta", {
-              type: "content_block_delta", index: active.index,
-              delta: { type: "thinking_delta", thinking: data.delta },
-            });
             break;
           }
           case "response.output_item.added": {
@@ -563,20 +573,27 @@ export function responsesSseToAnthropicSse(
               const encrypted = typeof item.encrypted_content === "string" ? item.encrypted_content : "";
               const env = encrypted ? decodeReasoningEnvelope(encrypted, translatorBudget) : null;
               const red = env?.red ?? [];
-              if (env?.sig && open?.kind !== "thinking") ensureBlock("thinking");
-              if (open?.kind === "thinking") {
-                if (env?.sig) open.reasoningSig = env.sig;
+              const itemKey = boundedReasoningIdentity(item.id);
+              // A late/unrelated done cannot reorder or sign another item's text.
+              if (open?.kind === "thinking" && open.reasoningItemKey !== itemKey) {
                 closeOpenBlock();
               }
               if (red.length > 0) {
                 ensureStarted();
-                closeOpenBlock();
+                if (open?.kind !== "thinking") closeOpenBlock();
               }
               for (const data of red) {
                 const idx = blockIndex++;
                 emit("content_block_start", { type: "content_block_start", index: idx, content_block: { type: "redacted_thinking", data } });
                 emit("content_block_stop", { type: "content_block_stop", index: idx });
               }
+              if (env?.sig && open?.kind !== "thinking") {
+                ensureBlock("thinking");
+              }
+              if (open?.kind === "thinking") {
+                if (env?.sig) open.reasoningSig = env.sig;
+                closeOpenBlock();
+              }
             }
             break;
           }