[WRONG BRANCH] release: bring preview onto the verified 2.57.0 product tree

.github/workflows/ci.yml

@@ -535,9 +535,10 @@ jobs:
       # (`is_bun_runtime_crash`). The unsharded macOS control had no equivalent,
       # so the same crash that Linux absorbs failed the whole promotion here.
       #
-    # Keep the signature list in sync with `is_bun_runtime_crash` in
-    # scripts/ci/run-bun-test-batches.sh. An assertion failure still fails on
-    # the first attempt — only the crash signature is retried, exactly once.
+    # The classifier is `is_bun_runtime_crash` from scripts/ci/bun-crash-signatures.sh, which
+    # this leg, the Windows leg, the macOS control and the Linux batch runner all source. It used
+    # to be four inline copies kept in sync by a test; one definition cannot drift. An assertion
+    # failure still fails on the first attempt — only a crash is retried, exactly once.
       - name: Test
         env:
           MACOS_TEST_SHARD: ${{ matrix.shard }}
@@ -546,6 +547,8 @@ jobs:
           # errexit so a Bun crash reaches PIPESTATUS and the bounded retry.
           set +e
           set -uo pipefail
+          # One shared classifier for every lane; see scripts/ci/bun-crash-signatures.sh.
+          source scripts/ci/bun-crash-signatures.sh
 
           run_macos_suite() {
             local suite_log suite_status attempt
@@ -559,7 +562,7 @@ jobs:
                 rm -f "$suite_log"
                 return 0
               fi
-              if ! grep -Eqi 'oh no: Bun has crashed|Internal assertion failure|Segmentation fault at address|Illegal instruction|Bus error|Aborted \(core dumped\)' "$suite_log"; then
+              if ! is_bun_runtime_crash "$suite_status" "$suite_log"; then
                 echo "::error::macOS suite failed on attempt ${attempt} (exit ${suite_status}); assertion failures are not retried."
                 rm -f "$suite_log"
                 return "$suite_status"
@@ -685,15 +688,17 @@ jobs:
       # (`is_bun_runtime_crash`). The unsharded macOS control had no equivalent,
       # so the same crash that Linux absorbs failed the whole promotion here.
       #
-    # Keep the signature list in sync with `is_bun_runtime_crash` in
-    # scripts/ci/run-bun-test-batches.sh. An assertion failure still fails on
-    # the first attempt — only the crash signature is retried, exactly once.
+    # The classifier is `is_bun_runtime_crash` from scripts/ci/bun-crash-signatures.sh, shared
+    # with every other lane. An assertion failure still fails on the first attempt — only a
+    # crash is retried, exactly once.
       - name: Test
         run: |
           # GitHub Actions starts bash `run:` blocks with `-e`. Disable
           # errexit so a Bun crash reaches PIPESTATUS and the bounded retry.
           set +e
           set -uo pipefail
+          # One shared classifier for every lane; see scripts/ci/bun-crash-signatures.sh.
+          source scripts/ci/bun-crash-signatures.sh
           suite_log="$(mktemp -t ocx-macos-suite.XXXXXX)"
           for attempt in 1 2; do
             # --timeout: Bun's default 5s per-test ceiling is the recurring flake
@@ -708,7 +713,7 @@ jobs:
             if [ "$suite_status" -eq 0 ]; then
               exit 0
             fi
-            if ! grep -Eqi 'oh no: Bun has crashed|Internal assertion failure|Segmentation fault at address|Illegal instruction|Bus error|Aborted \(core dumped\)' "$suite_log"; then
+            if ! is_bun_runtime_crash "$suite_status" "$suite_log"; then
               echo "::error::macOS suite failed on attempt ${attempt} (exit ${suite_status}); assertion failures are not retried."
               exit "$suite_status"
             fi
@@ -834,14 +839,16 @@ jobs:
         run: |
           set +e
           set -uo pipefail
+          # One shared classifier for every lane; see scripts/ci/bun-crash-signatures.sh.
+          source scripts/ci/bun-crash-signatures.sh
           suite_log="$(mktemp -t ocx-windows-suite.XXXXXX)"
           for attempt in 1 2; do
             bun test --isolate --timeout 60000 tests --shard=${{ matrix.shard }}/6 2>&1 | tee "$suite_log"
             suite_status="${PIPESTATUS[0]}"
             if [ "$suite_status" -eq 0 ]; then
               exit 0
             fi
-            if ! grep -Eqi 'oh no: Bun has crashed|Internal assertion failure|Segmentation fault at address|Illegal instruction|Bus error|Aborted \(core dumped\)' "$suite_log"; then
+            if ! is_bun_runtime_crash "$suite_status" "$suite_log"; then
               echo "::error::Windows shard ${{ matrix.shard }}/6 failed on attempt ${attempt} (exit ${suite_status}); assertion failures are not retried."
               exit "$suite_status"
             fi

Dockerfile

@@ -1,7 +1,7 @@
 # syntax=docker/dockerfile:1
 
 # Keep the runtime aligned with package.json and pin the multi-platform image index.
-ARG BUN_IMAGE=oven/bun:1.4.2@sha256:9114c058aeae42162ee16dd5084b95fe9473970bb6bcb5b232ab1630f0546895
+ARG BUN_IMAGE=oven/bun:1.4.0@sha256:5ff609364c049b54eb0ff560ec96319729a972078ef2c755d758f0c6ef89c2d6
 
 FROM ${BUN_IMAGE} AS build
 WORKDIR /home/bun/app

bin/ocx.mjs

@@ -522,6 +522,16 @@ function runPackageManagerSelfUpdate(manager) {
         "  After the update: close the Codex app, run 'ocx doctor', then run 'ocx stop' once to retry.",
       );
     }
+    if (decision.reason === "history-deferred") {
+      // The reported #4718 path is this lane. Nothing was restored, so this is a different
+      // sentence from the manifest warning above: an operator told "history metadata is
+      // incomplete" would assume config and catalog already came back.
+      console.warn(
+        "opencodex: WARNING — the shared teardown was refused by the Codex history preflight and restored nothing.\n" +
+        "  Config, catalog, history and provenance were preserved, and the teardown receipt was kept.\n" +
+        "  The proxy is down, so the update continues; close the Codex app and run 'ocx stop' once afterwards to finish the restore.",
+      );
+    }
   }
 
   // npm keeps the existing stage -> verify -> swap -> rollback flow. pnpm owns a

devlog/_plan/260915_2560_release_train/040_release_decision.md

@@ -44,3 +44,29 @@ What the decision rests on, and what it does not:
 Recorded as each step completes.
 
 - #4690 head `0026b14e83`, the post-fix candidate.
+
+## What actually happened
+
+- Candidate: `386303af1c` on `dev` — the squash of #4690, which carried the two regression fixes.
+  Its pre-merge head `26b3ff244434846149b560e28f7441afae529564` passed Cross-platform CI as run
+  `34945255301`.
+- `dev` moved to 2.57.0 through #4686 before any promotion, so `assert-ahead` could pass.
+- `main`: #4694 merged as `e4a8539b957b7ae7cd278666f0364eb0f82d4ac3`, carrying 2.56.0. Its push
+  runs at that exact SHA: Cross-platform CI `34947608073` success, Service lifecycle `34947608122`
+  success. #4687, cut from the pre-fix `2702911708`, was closed as superseded.
+- `preview`: #4698 merged as `b552b1db59`. The head was an `ours`-strategy merge, so its tree is
+  byte-identical to the candidate and to what `main` received; the merge exists to record the old
+  preview tip as a parent, which is the shape every earlier promotion onto that branch used.
+- Release: `release.yml` run `34951392978`, dispatched from `main` with
+  `expected-sha=e4a8539b95…`, `version=2.56.0`, `tag=latest`, `dry-run=false`. Both jobs succeeded.
+  The publish step reported `+ @bitkyc08/opencodex@2.56.0` with a provenance statement written to
+  the sigstore transparency log, and tag `v2.56.0` plus the GitHub release exist.
+- Registry metadata still read 2.55.0 immediately afterwards. The workflow says so itself and
+  instructs against republishing; a lagging read is not a failed publish.
+
+## What shipped that the audit did not clear
+
+Nothing. The two regressions it found were fixed before promotion, and the fix itself went through
+three review rounds: the first only released in the `catch`, the second confirmed before a rebuild
+that can fail without sending, and only the third confirms at the two points that reach the wire.
+The accepted risks are listed in `020_regression_audit.md` and are unchanged by this release.

devlog/_plan/260916_release_2570_stabilization/031_openai_tiers_split.md

@@ -0,0 +1,28 @@
+# Planned split: structure/providers/openai-tiers.md
+
+## Why there is a grace entry
+
+`openai-tiers.md` sat at 597 lines on `dev` against a 600-line budget, so it had
+room for three lines. Any real contract addition fails the gate, which is what
+happened when the account-selection work recorded the uploaded-file retention
+invariant and the flagship roster polarity. The doc is now 638 lines and carries
+a `grace.oversizeDocs` entry, which `structure/AGENTS.md` reserves for a split
+that is already planned. This is that plan.
+
+## The topic boundary
+
+The file has held two subjects for a while. One is account identity and wire
+shape: Pool and Direct modes, API-key separation, the ChatGPT wire identity, and
+the entitlement rosters. The other is selection and quota behaviour: eligibility
+guards, priority tiers, cache affinity, reset-first ordering, observed capacity,
+and now uploaded-file retention. The split runs on that line, leaving
+`providers/openai-tiers.md` with identity and wire shape and moving selection and
+quota behaviour into a sibling doc with its own manifest entry.
+
+## Why it is not done in this release
+
+Splitting an invariant doc renumbers nothing but does move every anchor other
+documents link to, and `structure:check` resolves those references. Doing that
+while five behaviour changes are landing would mix a documentation refactor into
+the release candidate for no user benefit. The grace entry states the debt
+honestly and the gate drops it again once the doc is back under budget.