docs(devlog): close the model-picker ladder unit

devlog/_plan/260913_missing_coauthor_credits/000_plan.md

@@ -0,0 +1,66 @@
+# Missing co-author credits (origin/dev last 3000)
+
+A maintainer carry that names another author's pull request can still leave that
+author invisible on GitHub when the **actual landing commit** has no account-linked
+`Co-authored-by` trailer. The last 3,000 commits on `origin/dev` were scanned
+against `CREDITS.md`. One new landing is still in that state and is not already
+on the page: **#3988 by @rrmlima**, merged through **#4031**.
+
+## Loop spec
+
+- **Loop archetype:** satisfy-spec (attribution repair, not optimization).
+- **Trigger:** operator request to find collaborators whose GitHub credit did not
+  go up in the last 3000 commits, update the record, open a PR, and merge it.
+  HOTL. Unlimited subagents. No local test suite. Push `--no-verify` authorized.
+- **Goal:** `CREDITS.md` records the missing landing with a cited maintainer
+  quote; the forward commit carries an account-linked noreply trailer; a PR
+  targeting `dev` is merged.
+- **Non-goals:** history rewrite; tag invalidation; inferring credit from diffs;
+  changing `.github/scripts/pr-carry-attribution.cjs`; `bun test` / full suite;
+  GitHub native stacks; starring or account actions; merging to `main` (release
+  promotion remains maintainer-controlled). Default branch is `main`, so profile
+  credit from this forward commit appears after the next `dev`→`main` promotion,
+  same as #3787 / #3811.
+- **Verifier:** `rg '/pull/3988' CREDITS.md` (must match); `git log -1 --format=%B`
+  on the **exact squash object** (`gh pr view --json mergeCommit`) must contain
+  `137737127+rrmlima@users.noreply.github.com`; `gh pr view` shows base `dev` and
+  merged. PLAN-VERIFIER-REAL-01: `rg` reads `CREDITS.md` as a direct path argument.
+  No test file observes this docs change. Local suite: NOT RUN (user-forbidden).
+  Merge uses `gh pr merge --squash --match-head-commit` with the trailer in the
+  squash message so it cannot be dropped again.
+- **Stop condition:** #3988 is on `CREDITS.md`, the PR is merged to `dev`, or
+  NOOP if a later origin/dev commit already repaired it.
+- **Memory artifact:** this unit
+  `devlog/_plan/260913_missing_coauthor_credits/` plus
+  `.codexclaw/evidence/4c876c16-4cd9-4a26-bcd5-743ccaa1b137/credits-scan/`.
+- **Expected terminal outcomes:** DONE (row + merged PR); NOOP (already repaired);
+  BLOCKED (merge protection); UNSAFE (history rewrite / raw email in tree).
+- **Escalation:** disputed authorship; a second maintainer approval the session
+  cannot provide. Dispatch retirement: main reclaims after two distinct agents
+  fail a packet.
+- **HOTL bounds:** write `CREDITS.md` only (optional one-line `AGENTS.md` number
+  sync rejected — the "27 landings" sentence is historical). New branch from
+  `origin/dev` in a clean worktree. Wall clock 4h. Push `--no-verify`. Merge
+  authorized.
+
+## Phase map (dependency order)
+
+1. **010 inventory freeze** — persist the scan window and the unique miss. No
+   `src/` edits.
+2. **020 branch + CREDITS.md row** — create worktree/branch `docs/credits-3988-rrmlima`
+   from `origin/dev` first, then insert the #3988 table row and commit with the
+   numeric-id noreply trailer.
+3. **030 PR and merge** — push that same branch `--no-verify`, fill
+   `.github/PULL_REQUEST_TEMPLATE.md` including the exact-head SHA in the
+   description, squash-merge with `--match-head-commit` and the trailer in the
+   squash message.
+
+## Scope
+
+**IN:** `CREDITS.md` (MODIFY). Forward `Co-authored-by: rrmlima <137737127+rrmlima@users.noreply.github.com>`.
+**OUT:** `.github/scripts/*`, `AGENTS.md` (leave the historical 27), any other
+carries whose landing already has a GitHub-resolved author or trailer.
+
+## SoT
+
+`CREDITS.md` is the SoT this unit patches. `structure/` is untouched.

devlog/_plan/260913_missing_coauthor_credits/001_scan_evidence.md

@@ -0,0 +1,56 @@
+# Scan evidence (000-range research)
+
+Window: `git log origin/dev -n 3000` after fetch. Tip recorded in
+`.codexclaw/evidence/4c876c16-4cd9-4a26-bcd5-743ccaa1b137/credits-scan/window.txt`.
+Default branch is `main`. Previous `CREDITS.md` follow-ups: #3318, #3787, #3811.
+
+## Method
+
+1. Tight regex for carry/reimplement/supersede + `#N` on commit subject/body.
+2. For each source PR, `gh api repos/lidge-jun/opencodex/pulls/N` for `user.login`.
+3. Inspect the **actual landing** (merge unique commits, not the PR body).
+4. GitHub GraphQL `Commit.authors.nodes.user.login` — this is whether GitHub
+   maps the trailer/author to an account.
+5. Skip rows already in `CREDITS.md`. Skip self-carries (`lidge-jun`). Skip
+   normally merged contributor PRs.
+
+Nothing here is inferred from a diff.
+
+## Negative results (ordinary path worked)
+
+These titled carries are **not** new `CREDITS.md` rows:
+
+- Sep 7 skip-ci train `#3871`–`#3892` / `#3878`: second-parent commits already
+  contain `ID+login@users.noreply.github.com` trailers. GraphQL resolves
+  Liang-Psych, RobinBially, x3M3x, luvs01, makesomethingshit, Ingwannu,
+  hualiny, terrytan95.
+- `#3921` carry `#3908`: `ankaifeng <qq.com>` GraphQL-resolves to **akf66**.
+- `#4285` carry `#4078`: `Sayo <hi@sayo.wtf>` resolves to **wtfsayo**.
+- `#4300` reimplements `#4293`: `Valerio Coltre <gmail>` resolves to **colthreepv**.
+  `#4291` by L4XB was superseded and explicitly **not** carried ("Does not
+  include #4291's fabricated text floor").
+- `#3870` reimplements `#2033`: `louis-tepe` noreply on `6eadb1658`.
+- `#4347` / `#4340` / `#4338`: Warexpor, david-wang-0, luvs01 resolve.
+- `#3388` carry on `3f3008422`: `Maple <hzlhu@qq.com>` GraphQL-resolves to
+  **zleo-ai**. Trailer present and linked; no `CREDITS.md` row.
+- `#4026`/`#4027`/`#4028` carry `#3340`/`#3349`/`#3350`: unique commits are
+  **authored** by Flowershangfromthebranches with numeric-id noreply.
+- `#4030` carry `#3990`: unique commit authored `rrmlima <rrmlima@users.noreply.github.com>`;
+  GraphQL resolves to rrmlima.
+- `#4102` carry `#4081`: unique commits include `luvs01 <27862058+luvs01@users.noreply.github.com>`
+  as **author**.
+- `#3954` by omarjson was closed "Landed via #4136" but the maintainer comment
+  says the approach **cannot land** (report/diagnosis, not carried code).
+
+## The miss
+
+| Source | Author | Landing | Why GitHub credit is missing |
+| --- | --- | --- | --- |
+| [#3988](https://github.com/lidge-jun/opencodex/pull/3988) | [@rrmlima](https://github.com/rrmlima) | `#4031` merge `e2bf1672c` (on `main`); cherry-pick `14ce693e5` | Unique commit author is an unmapped machine identity (GraphQL `user: null`). Only other trailer is `CommandCodeBot`. `#4031` **PR body** had `Co-authored-by: rrmlima <rrmlima@users.noreply.github.com>` and was dropped from the merge message. |
+
+Maintainer words (PR #4031 Summary): "Carries #3988 by @rrmlima (`cherry-pick -x`)".
+Merge subject: "fix(google): guard model-tail histories with user continue nudge across Gemini and CCA (carry #3988)".
+
+rrmlima already has a noreply trailer on `#3787` (`24c761a05`) for earlier
+uncredited landings. That does not attribute **this** cherry-pick. `CREDITS.md`
+does not yet list `#3988`.

devlog/_plan/260913_missing_coauthor_credits/010_inventory_freeze.md

@@ -0,0 +1,57 @@
+# 010 — Persist the scan inventory
+
+## IN / OUT
+
+**IN:** copy already-gathered evidence under
+`.codexclaw/evidence/4c876c16-4cd9-4a26-bcd5-743ccaa1b137/credits-scan/`
+(`window.txt`, `tight.json`, `author-absent.txt`). Re-read `origin/dev:CREDITS.md`
+and confirm `#3988` is still absent before 020.
+
+**OUT:** no `CREDITS.md` edit in this phase; no `src/` edits.
+
+## Files
+
+| Path | Op | Notes |
+| --- | --- | --- |
+| `.codexclaw/evidence/4c876c16-4cd9-4a26-bcd5-743ccaa1b137/credits-scan/*` | NEW (gitignored) | Already written during Plan exploration. |
+
+## Accept
+
+- `rg '/pull/3988' CREDITS.md` on `origin/dev` exits 1 (not yet recorded).
+- Evidence files exist and name `#3988` / `e2bf1672c` / `14ce693e5`.
+
+## B confirmation (wp0)
+
+Roadmap locked in B: 000/001/010/020/030 are on disk; insertion uses full SHAs
+`e2bf1672c974611f8db736cd64a90e1dc443924a` and
+`14ce693e5846596c823941ce90add538713a25b1`; branch is created before the
+CREDITS.md edit. No production patch in this cycle.
+
+## wp1 P stale-check (after wp0 D)
+
+Previous D: docs-only roadmap locked; unique miss is #3988; CREDITS.md not patched.
+
+Re-fetch `origin/dev` is now `2206f960669691555e41f506e53087cbc208f42d`
+(was `27fa557db` in `window.txt`). Nine new commits `27fa557db..origin/dev`
+have no carry/reimplement/supersede/cherry-pick language. `rg '/pull/3988'`
+on `origin/dev:CREDITS.md` still exits 1.
+
+GraphQL re-check of the landing objects:
+
+- `e2bf1672c974611f8db736cd64a90e1dc443924a` (#4031 merge): authors resolve only
+  to `lidge-jun`.
+- `14ce693e5846596c823941ce90add538713a25b1` (cherry-pick): unmapped machine
+  identity (`user: null`) plus `CommandCodeBot`. No `rrmlima`.
+- `#3388` on `3f3008422be4af5adf1b0632f920d65fb051c646`: `Maple` trailer
+  GraphQL-resolves to `zleo-ai`. GitHub credit already maps; not a CREDITS.md row.
+
+Inventory freeze still names exactly one new miss: #3988 / @rrmlima. No
+`CREDITS.md` edit in this work-phase.
+
+## wp1 B freeze
+
+Evidence files confirmed in B. `window.txt` now also records tip
+`2206f960669691555e41f506e53087cbc208f42d` and `wp1_other_misses: none`.
+Independent explorer `338f07cd` and reviewer `92d6377c` agree the unique
+new miss is #3988. `CREDITS.md` was not modified. Next cycle (020) creates
+the worktree/branch then inserts the row.

devlog/_plan/260913_missing_coauthor_credits/020_credits_update.md

@@ -0,0 +1,88 @@
+# 020 — CREDITS.md row for #3988
+
+Work from a **clean worktree** of `origin/dev`. Do not touch the dirty files on
+the session checkout (`src/cli/dispatch.ts`, other in-progress units).
+
+Create the delivery branch **before** editing, so 020's commit is on the branch
+030 will push (reviewer blocker: branching from `origin/dev` after the commit
+orphans it):
+
+```
+git fetch origin dev
+git worktree add /tmp/opencodex-credits-3988 origin/dev
+cd /tmp/opencodex-credits-3988
+git switch -c docs/credits-3988-rrmlima
+```
+
+## Files
+
+| Path | Op |
+| --- | --- |
+| `CREDITS.md` | MODIFY — insert the follow-up table below after the four-track section (after the paragraph ending "The table deliberately retains the unadopted scope.", currently around line 156) and before `## Report and diagnosis`. |
+
+## wp2 P stale-check (after wp1 D)
+
+Previous D: inventory frozen; unique miss #3988; `origin/dev:CREDITS.md` still
+lacks `/pull/3988`. Insertion anchor on current `origin/dev` CREDITS.md is
+still line 156 ("The table deliberately retains the unadopted scope.") then
+blank then `## Report and diagnosis` at line 158. Work from a clean worktree;
+session checkout may only have the untracked plan unit.
+
+Do not edit CREDITS.md until B after this cycle's A.
+
+## Insert (exact)
+
+```markdown
+### 2026-09-13 follow-up: landing trailer dropped at merge
+
+The last 3,000 commits reachable from current `dev` were scanned the same way
+as the 2026-09-07 audit: carry/reimplement language on the landing, then the
+**actual landing commit**, then GitHub's commit-author mapping. One new miss
+is not already on this page.
+
+[#4031](https://github.com/lidge-jun/opencodex/pull/4031)'s own description
+named the trailer. The merge commit did not keep it. The cherry-picked object
+is authored as an unmapped machine identity, which GitHub maps to no account.
+The only remaining trailer is automation.
+
+| Pull request | Author | Landed as | What landed |
+| --- | --- | --- | --- |
+| [#3988](https://github.com/lidge-jun/opencodex/pull/3988) | [@rrmlima](https://github.com/rrmlima) | [`e2bf1672c`](https://github.com/lidge-jun/opencodex/commit/e2bf1672c974611f8db736cd64a90e1dc443924a) / [`14ce693e5`](https://github.com/lidge-jun/opencodex/commit/14ce693e5846596c823941ce90add538713a25b1) | "Carries #3988 by @rrmlima (`cherry-pick -x`)" — Gemini/CCA/Vertex/AI Studio model-tail `(continue)` nudge in `messagesToGeminiFormat`. |
+```
+
+Link targets are the full SHAs (`git rev-parse e2bf1672c` /
+`git rev-parse 14ce693e5` on `origin/dev`). Table cells keep the 9-char prefix,
+matching the 2026-09-07 follow-up tables. Do not publish the machine author
+address; describe it as an unmapped machine identity (same masking rule as
+`CREDITS.md` unlinked-trailer section).
+
+## Commit trailers (forward attribution)
+
+The commit that lands this docs change **must** include:
+
+```
+Co-authored-by: rrmlima <137737127+rrmlima@users.noreply.github.com>
+```
+
+Numeric-id form only. Do not copy the id-less `users.noreply.github.com`
+form, and do not copy any personal address from #4031's PR body.
+
+Suggested subject:
+
+```
+docs(credits): record the #3988 carry whose merge dropped the trailer
+```
+
+`[skip ci]` is allowed, matching merged #3811 / #3787 (docs-only credits
+repairs that the operator also asked to merge without a local suite). Hosted
+required checks are not the verifier for this docs row; the trailer on the
+exact merge object is.
+
+## Accept
+
+- `rg '/pull/3988' CREDITS.md` exits 0.
+- New row cites the #4031 quote, not a diff.
+- `git log -1 --format=%B` contains `137737127+rrmlima@users.noreply.github.com`.
+- `privacy:scan` not required locally if the file adds no new email; do not
+  introduce one.
+- No other files in the commit.

devlog/_plan/260913_missing_coauthor_credits/030_pr_merge.md

@@ -0,0 +1,122 @@
+# 030 — PR targeting origin/dev and merge
+
+## Branch
+
+From the worktree and branch already created in 020 (`docs/credits-3988-rrmlima`
+on `/tmp/opencodex-credits-3988`). Do **not** `git switch -c` from `origin/dev`
+again — that would leave the 020 commit behind.
+
+## wp3 P stale-check (after wp2 D)
+
+Previous D: CREDITS.md row is commit `d0360cc6d780e0d5a497a961a5dc3ce62f6b42ad`
+on local `docs/credits-3988-rrmlima` in `/private/tmp/opencodex-credits-3988`.
+`origin/dev` is still `2206f9606`. The branch is **not** on origin yet. Push
+this existing branch; do not recreate it from `origin/dev`.
+
+Do not commit unrelated dirty files from the session working tree.
+
+## Push
+
+```
+git push -u origin HEAD --no-verify
+```
+
+Authorized by the operator for this loop.
+
+## PR body (repository template)
+
+Base: `dev`. Fill every section of `.github/PULL_REQUEST_TEMPLATE.md`.
+
+Title: `docs(credits): record the #3988 carry whose merge dropped the trailer`
+
+Body:
+
+```markdown
+## Summary
+
+- Record #3988 by @rrmlima on CREDITS.md. Maintainer carry #4031 named the
+  trailer in the pull-request description; the merge commit and the
+  cherry-pick (`14ce693e5`, authored as an unmapped machine identity) did not
+  keep a GitHub-resolvable co-author. Forward attribution uses the account-linked
+  noreply trailer on this commit. No history rewrite.
+
+### Maintainer-integration decision
+
+Merging under `MAINTAINERS.md` maintainer integration into `dev`: documentation-only
+CREDITS.md repair, same class as #3787 / #3811. Exact-head SHA: (fill
+`HEAD_OID` here before merge). Local suite **NOT RUN** (operator instruction). Hosted
+Cross-platform CI is not the verifier for this row; GraphQL `Commit.authors` on the
+squash object must resolve `rrmlima`. This is maintainer integration, not self-approval.
+
+## Verification
+
+- `git log origin/dev -n 3000` carry scan; GitHub GraphQL `Commit.authors` on
+  `14ce693e5` (`user: null` for the unmapped machine author; only CommandCodeBot otherwise).
+- `rg '/pull/3988' CREDITS.md`
+- Local bun test / typecheck / full suite: **NOT RUN** (operator instruction).
+
+## Checklist
+
+- [x] Scope stays focused and avoids unrelated cleanup.
+- [x] Docs or release notes were updated when needed.
+- [x] Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.
+```
+
+`[skip ci]` in the commit subject is enough to skip hosted suite, matching #3811.
+
+## Merge
+
+Deterministic contract: **squash** with an explicit commit message that
+**contains the literal trailer**. Do not rely on GitHub copying the PR body.
+This is the failure mode that dropped the #4031 trailer.
+
+1. Capture `HEAD_OID=$(gh pr view --json headRefOid -q .headRefOid)`.
+   Write that SHA into the PR description's "Exact-head SHA:" line (and a
+   comment if the description was already submitted) **before** merging —
+   `MAINTAINERS.md` requires the exact-head record on the PR.
+2. Squash with `--match-head-commit "$HEAD_OID"` and a message that includes
+   the subject plus:
+
+   ```
+   Co-authored-by: rrmlima <137737127+rrmlima@users.noreply.github.com>
+   ```
+
+   Example:
+
+   ```
+   gh pr merge --squash --match-head-commit "$HEAD_OID" --subject "docs(credits): record the #3988 carry whose merge dropped the trailer" --body "Forward attribution for #3988 / #4031.
+
+   Co-authored-by: rrmlima <137737127+rrmlima@users.noreply.github.com>
+   "
+   ```
+
+3. Read `MERGE_OID=$(gh pr view --json mergeCommit -q .mergeCommit.oid)` and
+   inspect **that object**, not `origin/dev` tip (another PR can land first):
+
+   ```
+   git fetch origin
+   git log -1 --format=%B "$MERGE_OID"
+   ```
+
+   The body must contain `137737127+rrmlima@users.noreply.github.com`.
+
+4. GraphQL-resolve that exact object (trailer text is not enough —
+   `CREDITS.md` "Verify the landing"):
+
+   ```
+   gh api graphql -f query='query { repository(owner:"lidge-jun", name:"opencodex") { object(expression:"'"$MERGE_OID"'") { ... on Commit { authors(first:10) { nodes { name email user { login } } } } } } }'
+   ```
+
+   Require a node with `user.login == "rrmlima"`.
+
+## Accept
+
+- PR URL returned; `gh pr view --json state,baseRefName,mergedAt,mergeCommit`
+  shows `MERGED`, base `dev`.
+- Squash object body has the numeric-id noreply trailer **and** GraphQL
+  `Commit.authors` on that oid includes `user.login = rrmlima`.
+- No local suite was run.
+
+## wp3 B merge
+
+PR #4432 squash `dcd13b4358befaae0fdca845a8219103943faca0` on `dev`. GraphQL `user.login=rrmlima`.