docs: record thirteen verified contract issue outcomes

devlog/_plan/260919_contract_resolution/000_plan.md

@@ -18,8 +18,8 @@ Evidence lives in this unit; previous implementation specifications remain in `d
 
 | Lane | Sole issue ownership | File domains and sequence |
 | --- | --- | --- |
-| Runtime | #5109 #5110 #5111 #5113 #5115 #5122 #5123 #5124 | Raw transport contract, custom input consistency, send accounting, journal ownership and continuation policy. Stack null-body/coding only if a real shared helper dependency exists; upload can stay independent. Keep stream and state changes separate. |
-| Policy and operator | #5112 #5114 #5116 #5117 #5118 #5119 #5120 #5121 | Schema reports before reject-lossy policy, static merge parity before consolidation, identity hints separate from availability, authority-map/tooling, optional metrics and pure preview, documentation alignment. Stack by these dependencies; independent docs can land separately. |
+| Runtime | #5109 #5110 #5111 #5113 #5115 #5118 #5122 #5123 #5124 | Raw transport contract, custom input consistency, send accounting, journal ownership and continuation policy. Stack null-body/coding only if a real shared helper dependency exists; upload can stay independent. Keep stream and state changes separate. |
+| Policy and operator | #5112 #5114 #5116 #5117 #5119 #5120 #5121 | Schema reports before reject-lossy policy, static merge parity before consolidation, identity hints separate from availability, authority-map/tooling, optional metrics and pure preview, documentation alignment. Stack by these dependencies; independent docs can land separately. |
 | Coordinator | Review, CI, base/merge judgment and issue closure | Workers never merge or close issues. Cross-lane shared test-layout/structure changes are serialized at integration, with no cap increases or dropped regressions. |
 
 The user chose two different main-task models and a specific subagent model. Runtime/model selection provenance stays in task records rather than public repository artifacts. Workers may use unlimited useful subagent rounds; concurrent workers have disjoint writes and never perform branch-level git operations in parallel on one checkout.
@@ -49,3 +49,5 @@ The roadmap is locked, the two isolated implementation owners are active, and th
 Ownership amendment: #5115 moved to the runtime owner after the policy owner confirmed no implementation writer or commit existed. Independent preparation can proceed on current dev because its known-model hint region is unchanged by #5174; final landing remains after #5171 and #5174, with a fresh integration base, reviewed delta and exact-head hosted CI. The two-owner limit, acceptance criteria and execution restrictions are unchanged.
 
 Independent preparation audit accepted the #5115 ownership amendment: `knownModelIdsForProvider` is byte-identical across #5174, the registry entry type is unchanged by that layer, and the new helper has no static-policy dependency. Expected later overlap is import ordering and line movement; integration must retain both independent changes and obtain new-head hosted proof.
+
+Second ownership amendment: #5118 transferred to the existing runtime owner after confirmation that no implementation writer, branch or commit existed. Server and dashboard delivery remain required, with the prior private pre-build audit incorporated before implementation. Metrics-to-preview shared-route integration is serialized; preparation can proceed in disjoint files. Dashboard evidence must satisfy the actual file-based screenshot gate using hosted artifacts under the no-local-build restriction. No third implementation owner was created.

devlog/_plan/260919_contract_resolution/001_status.md

@@ -1,13 +1,13 @@
 # Campaign status
 
-Status: ACTIVE. Ten of the sixteen original issues are resolved and closed. Remaining: #5112, #5114, #5115, #5117, #5118, #5123. Supplementary sideband recovery #5161 and send-assertion follow-up #5170 are merged. Runtime ownership #5157, strict-policy child #5167 (report parent #5162 merged), and static-policy resolver/consumer stack #5171/#5174 are under exact-head hosted verification and static review. Latest integration recorded here: #5162 at `8a030721b3ffc909ca7d8b05ca0b7c873c1493a1`.
+Status: ACTIVE. Thirteen of the sixteen original issues are resolved and closed. Remaining: #5114, #5117, #5118. Supplementary sideband recovery #5161 and send-assertion follow-up #5170 are merged. Runtime ownership #5157 is merged. Strict-policy child #5167 is merged. Static-policy resolver/consumer stack #5171/#5174 and metrics #5183 remain under review and hosted verification; preview #5185 is a draft. Integration snapshot at 2026-09-19T15:27:51Z: #5167 at `96a6de86b71cf8a8f78959e0bf626dac642510a7`.
 
 ## Owners
 
 | Lane | State | Issues |
 | --- | --- | --- |
-| Runtime | Active in an isolated worktree | #5109 #5110 #5111 #5113 #5115 #5122 #5123 #5124 |
-| Policy and operator | Active in an isolated worktree | #5112 #5114 #5116 #5117 #5118 #5119 #5120 #5121 |
+| Runtime | Active in an isolated worktree | #5109 #5110 #5111 #5113 #5115 #5118 #5122 #5123 #5124 |
+| Policy and operator | Active in an isolated worktree | #5112 #5114 #5116 #5117 #5119 #5120 #5121 |
 
 Private orchestration records retain the actual task handles, model-selection evidence and wake cursors. The current coordinator heartbeat is ACTIVE at a 20-minute interval. It follows the two existing implementation owners; it must not duplicate them. The coordinator owns integration and issue closure.
 
@@ -20,8 +20,8 @@ Private orchestration records retain the actual task handles, model-selection ev
 
 ## Issue outcomes
 
-Closed: #5109, #5110, #5111, #5113, #5116, #5119, #5120, #5121, #5122, #5124.
-Open: #5112, #5114, #5115, #5117, #5118, #5123.
+Closed: #5109, #5110, #5111, #5112, #5113, #5115, #5116, #5119, #5120, #5121, #5122, #5123, #5124.
+Open: #5114, #5117, #5118.
 
 The entries below are chronological historical checkpoints. Their earlier open/closed states do not override the current summary or acceptance ledger.
 
@@ -126,3 +126,11 @@ Report parent #5162 merged at `8a030721b3ffc909ca7d8b05ca0b7c873c1493a1` after c
 Runtime owner pushed `9e789c1613b22109dd0398e9619be8902bff9662` for #5157: management ACL failure injection is restricted to the token file, the stream retry fixture uses its narrow relay-platform seam, and the direct combo fixture holds a writer lease and drains its response. Assertions and production ownership rules are unchanged in this delta. Independent review and fresh hosted CI are required. Policy owner is implementing #5117 in its isolated checkout while repairing #5174; #5115 and #5118 remain required scope.
 
 Ownership amendment: #5115 moved to the runtime owner after the policy owner confirmed no implementation writer or commit existed. Independent preparation can proceed on current dev because its known-model hint region is unchanged by #5174; final landing remains after #5171 and #5174, with a fresh integration base, reviewed delta and exact-head hosted CI. The two-owner limit, acceptance criteria and execution restrictions are unchanged.
+
+#5157 integrated and #5123 closed after final acceptance verification. Current progress is11/16, with five remaining original issues. See031_pr_5157.md for exact-head CI and merge evidence.
+
+Second ownership amendment: #5118 transferred to the existing runtime owner after confirmation that no implementation writer, branch or commit existed. Server and dashboard delivery remain required, with the prior private pre-build audit incorporated before implementation. Metrics-to-preview shared-route integration is serialized; preparation can proceed in disjoint files. Dashboard evidence must satisfy the actual file-based screenshot gate using hosted artifacts under the no-local-build restriction. No third implementation owner was created.
+
+#5177 is integrated and #5115 closed after complete acceptance verification. Current progress is12/16; remaining issues are #5112/#5114/#5117/#5118. The independent decode-hint change landed before policy migration after a recorded source-based sequencing amendment.
+
+The current-task heartbeat was updated and read back ACTIVE with the existing twenty-minute cadence. It now reflects twelve closed issues, runtime ownership of #5118, policy ownership of #5112/#5114/#5117, and the remaining publication/visual verification duties. Other task monitors were not modified.

devlog/_plan/260919_contract_resolution/020_integration.md

@@ -74,3 +74,5 @@ Background receipt update: #5009 advanced from a relocated-test conflict to clea
 Background receipts now record clean replay for #3901 at `d0da0264e8092f65575b6eb69aa9bc2ee067e9d8` and #3983 at `c25e79ea0d076859aa43f09fd97802e3e7cd79ee` after the whitespace correction. #4989 publication matched remote head `7a8cb1ad286355c5aaefcdd84b16752daad8e849`. The separate consolidation command reports #3389 closed as superseded by #4989, not merged. #3025 still reports a Logs.tsx conflict at a later replay step. These are external lane receipts rather than campaign completion evidence.
 
 Final background batch in this notification: #4056 reports clean replay at `5eb0d1e311a1c2d5986bcd701711cd007f2090b8`; #4225 still has a compatibility-facade conflict. An older pinned-base check detected concurrent remote changes for #5157 and #5136, and verified an externally updated #5016. The historical pinned-base mismatch is not current mergeability evidence and triggers no automatic overwrite/rebase by this coordinator. Both campaign implementation owners remain active, repairing the separately observed exact-head CI failures.
+
+Cumulative integration verification: push run [35446842226](https://github.com/lidge-jun/opencodex/actions/runs/35446842226) completed successfully at `8a030721b3ffc909ca7d8b05ca0b7c873c1493a1`, including aggregate ci and all applicable jobs. This independently verifies the earlier runtime union through #5170/#5162. The later docs-only #5175 is separate; future runtime integrations still require fresh cumulative proof. Superseded earlier runs are not retried merely because their canceled legs made an aggregate red.

devlog/_plan/260919_contract_resolution/031_pr_5157.md

@@ -1,6 +1,6 @@
 # PR 5157: spend-ledger writer ownership
 
-Issue #5123 is open. [PR #5157](https://github.com/lidge-jun/opencodex/pull/5157) targets `dev`; its current head is `647dc675019a995b97c73c7b7ce02fe4cebaf5f4`. It has not been integrated and is not approved for merge until exact-head hosted verification and remaining public reviews pass.
+Issue #5123 is closed after verified integration. [PR #5157](https://github.com/lidge-jun/opencodex/pull/5157) targets `dev`; its current head is `a67cd9b3be6965f3b7435aa0702b6b9b5bf68fc3`. It merged into dev as `40670044146adc714f06d8b2e29f9114f8393df5`; the entries below preserve pre-integration checkpoints.
 
 The proposed control requires a single writer for each state directory. Implementation and regression changes have received independent static reviews, including storage, startup/shutdown, fixture lifetime, and current integration compatibility. Detailed security review and historical repair reasoning are retained in ignored task scratch pending a final published outcome.
 
@@ -9,3 +9,11 @@ The preceding head `271139883a552f1aac9ce3f847eb94e3327e5efc` failed Linux shard
 Local suites, individual tests, typecheck, builds, installation and runtime execution were NOT RUN. Static syntax screens performed during earlier review are not compiler or runtime proof. No issue closure or completion claim is made.
 
 A subsequent three-file fixture correction addresses platform-specific hosted failures. Independent delta review and current-head hosted CI are running; previous-head successes do not establish the new head. Public status remains open and unmerged.
+
+Acceptance mapping exposed a mode-activation gap in the process tests. The new test-only delta adds all four holder/contender combinations with actual contender policy configuration, and a transition from observation to enforcement. Independent review and new-head hosted CI are pending; no production behavior change or completion is claimed.
+
+Independent review of the mode-activation correction at `a67cd9b3be6965f3b7435aa0702b6b9b5bf68fc3` passed. The real-process matrix and configuration transition now exercise the stated modes; existing failure, restart, cleanup and privacy checks remain. Hosted CI at this head is still required.
+
+Verified integration at 2026-09-19T14:35:24Z: reviewed head `a67cd9b3be6965f3b7435aa0702b6b9b5bf68fc3` passed all applicable hosted checks and aggregate [35448104919](https://github.com/lidge-jun/opencodex/actions/runs/35448104919). Logs show actual four-mode process contention, observation-to-enforcement transition, independent directories, crash recovery and startup rollback. Independent technical/security and nine-file integration-union reviews passed; no unresolved public reviews or maintainer objections remained. Merge `40670044146adc714f06d8b2e29f9114f8393df5` was verified in origin/dev before #5123 closed at 2026-09-19T14:36:03Z. The resulting cumulative dev run remains separately monitored.
+
+Cumulative dev verification completed successfully at merge head `40670044146adc714f06d8b2e29f9114f8393df5` in [push run35449204833](https://github.com/lidge-jun/opencodex/actions/runs/35449204833). All applicable jobs and aggregate passed, confirming the integrated ownership change with the current runtime union.

devlog/_plan/260919_contract_resolution/034_strict_schema_policy.md

@@ -23,3 +23,27 @@ Secondchildhostedfailure: test2job105898238282 layoutseed resolvesgoogle-tool-sc
 Child745f6b6 test-onlycorrectionindependentPASS: originalVertex400literalexpected, newdiagnosticprivacyretained, renamedmanagement-configtestbody100%unchangedandseed/explicit/expectedagree. Parsedregistrydiffhasnoothermappingchanges. Latestchild60516397 requiresinterdiffconfirmation beforeusingearlierevidence.
 
 Latestchild60516397 onlyrestoresregistryformatting over745f6b6; parsedfullJSONsemanticsequalforbothlayoutfiles. Previousscopedtest/code reviewsremainvalid; currentheadCIrequired.
+
+Prepared post-parent cascade at `16ed5bee42eb53110983e2788f607c390bf43ac0` has clean merge-tree against current dev. Range-diff matches the first four strict-policy commits exactly; test rename/repair history is consolidated. Final inventory/union re-review was assigned before treating the cascade as equivalent. The previous head CI is not new-head proof; fresh hosted CI remains required.
+
+Independent cascade review PASS at `16ed5bee42eb53110983e2788f607c390bf43ac0`: base ancestry verified, first four stable patch IDs preserved, complete child patch equivalent excluding the two test-layout inventories, renamed test byte-identical, and inventories changed only the intended test name. Production strict-uncertainty behavior, docs and regression assertions remain intact. The new head is published and hosted CI is in progress.
+
+Current public review additionally requests consistent documentation of both strict refusal conditions (proven loss or indeterminate comparison), and exact repair-diagnostic shape. Source/documentation validation was assigned before accepting the requested edits. The request for local verification commands does not override the task restriction: applicable hosted suite, type and privacy proof must be recorded instead. The current PR remains unmerged.
+
+Independent documentation validation confirmed a bounded seventeen-file correction: all eight guide/configuration pairs must describe rejection on proven loss or indeterminate comparison; the eight guides must include the bounded uncertainty count in their report shape; the Google structure repair-shape list must include the same field already emitted by source. No runtime change was requested.
+
+Documentation correction `fc12e8f7b009cc31b6bebf7b6633c91de35d972b` is prepared; seventeen-file locale/shape interdiff review assigned. Earlier runtime reviews remain relevant only where source is unchanged; new-head hosted proof is still required.
+
+The seventeen-file uncertainty documentation correction passed independent review. New head `50af16087ca08751af7c1b1e49fd85337a1b99f2` additionally clarifies that compatibility repair replay remains enabled by default and adds exact original-400-body assertions in two existing regression cases. This narrow delta is under re-review; production source is unchanged.
+
+Final nine-file delta at `50af16087ca08751af7c1b1e49fd85337a1b99f2` passed independent review: each translated guide distinguishes strict repair withholding from unchanged default replay, and both additional response assertions retain the original 400 payload and one-send behavior while diagnostic canaries stay excluded. Production source is unchanged. No known static blocker remains; current-head hosted jobs are still running.
+
+Final integration-union review passed for candidate tree `07141dc1ab9e6dbe313208a1bf5a00f3e0979968` with dev `4067004414`: five shared structure/layout files preserve both ownership and strict-policy contracts; source/tests on each side remain intact. New public wording feedback identified one separate diagnostic-boundary clarification: strict initial compilation throws before initial loss-record emission, while strict repair has its own record. Main verified the source order and requested a precise eight-guide correction, without changing runtime behavior.
+
+The latest guide-only review accepted the strict initial diagnostic boundary but rejected a newly added statement that the policy error carries the full same facts as the report. The error and report have different bounded shapes. The owner was asked only to remove that added clause across eight translations, retaining all already-correct behavior descriptions and avoiding a runtime expansion.
+
+Commit `eb5d51b7c0` removes only the newly introduced overclaim about policy-error/report equivalence from all eight guides. Main inspected the bounded deletion; independent language consistency re-review is pending. No runtime or regression behavior changes in this delta.
+
+Independent review accepted final eight-guide clause removal at `eb5d51b7c022637ac086639a695864bcf1f7a136`. No other claim or behavior changed. Current-head hosted verification remains required before integration.
+
+Verified integration: #5167 merged as `96a6de86b71cf8a8f78959e0bf626dac642510a7` at2026-09-19T15:26:53Z. Exact headeb5d51b7 passed every applicable job and aggregate [35450471540](https://github.com/lidge-jun/opencodex/actions/runs/35450471540), including type/privacy checks. Logs explicitly show endpoint loss/uncertainty refusals, lossless/native-output acceptance, indexed/unindexed withholding, direct no-repair and CLI/management persistence. All known reviews resolved; current union retains ownership and decode hints. Both parent8a030721 and child merge ancestries were verified before #5112 was closed. No local execution.