From 44ab63cffda9d5bb593647d710b12854504bfa3f Mon Sep 17 00:00:00 2001 From: Chris0Jeky Date: Sun, 6 Sep 2026 15:14:47 +0100 Subject: [PATCH 1/2] docs(status): twenty-first block (SC-10 chain complete, second Codex batch, corrections); OUTSTANDING SC-10 ticked --- OUTSTANDING_TASKS.md | 3 ++- docs/STATUS.md | 24 ++++++++++++++++++++++++ 2 files changed, 26 insertions(+), 1 deletion(-) diff --git a/OUTSTANDING_TASKS.md b/OUTSTANDING_TASKS.md index 2bb681b6e..69d69ae03 100644 --- a/OUTSTANDING_TASKS.md +++ b/OUTSTANDING_TASKS.md @@ -162,7 +162,7 @@ The maintainer directed (2026-08-30) that the repository goes **private for the - [ ] **SC-7 — register the isolated runners after cutover (`#2328`, `#2337` B8).** Registration tokens never enter the repository; no runner is attached while the repository is public; `CI_EXECUTION_MODE` moves to `hybrid` only after the runners are proven. - [x] **SC-8 — public-asset and launch-kit decision (`#2337` A; `#2242`).** GitHub Pages keeps publishing from a private repository on Pro (the site stays public); the launch kit and the REVIVAL public-source messaging assumed a public repository — decide keep / move / reword and record it on `#2337`. *(**Ruled 2026-09-03, maintainer decision packet SC8: private development repository + public release/source mirror.** Releases, checksums/provenance and the GPL source stay public through a mirror; development, CI and issues go private; GitHub Pages keeps publishing. Mechanics — which repository, what syncs on a tag, how the launch kit and `awesome-selfhosted` wording point at the mirror — are seeded as CI-16 `#2439` and recorded on `#2337`.)* - [x] **SC-9 — Codex review credits are exhausted (maintainer billing).** On 2026-09-03 at 22:34Z the Codex connector answered PR `#2462`'s second and third pushes with "You have reached your Codex usage limits for code reviews" (it still reviewed the first and the fourth head). Until credits are added at the Codex usage dashboard, the documentation-only review gate falls back to one fresh-context agent review per PR (global law 2), which is what `#2462` used. Decide: top up, or accept the fallback and record that on `#2337` A (review-integration billing). *(**Ticked 2026-09-06, 2026-09-06 guided-walkthrough reply q-4 = A:** the fresh-context agent review is the documentation-only gate whenever the connector is out of credits; the maintainer reported the allowance returns with the OpenAI subscription cycle on 2026-09-07, so Codex resumes as the primary connector when present and no top-up is bought. Recorded on `#2337` A.)* -- [ ] **SC-10 — control-plane PRs awaiting the maintainer's review (ADR-0066 amendment 2026-09-03).** The amendment says control-plane (T0/T2) and runner changes merge only after the maintainer's review plus the fresh-context review. Queued by the 2026-09-04 overnight orchestrator, each already reviewed clean by a fresh-context agent and proven hosted at its head **against the base as of that PR's last hosted run, not against today's `main`** (measured 2026-09-04 21:40Z: `#2502` is 138 commits behind `main`, `#2506` 102, `#2532` 72, `#2550` 46; branch protection is not strict, so GitHub reports them `CLEAN` regardless, and a base change counts as a head change under the global laws). Each therefore needs `gh pr update-branch` plus a fresh hosted run and a re-check of its review against the moved base immediately before merge, `#2502` above all because it rewrites `uses:` refs across 34 workflow files; the update-branch runs were deliberately not spent in advance because `main` will move again before the maintainer arrives: `#2502` (CI-11 slice 1: 152 external actions pinned to full SHAs, guard enforced in `smart-ci-self-test.yml`; SC-5 command in the body), `#2506` (Smart CI planner: accept a merge ref regenerated against the live base tip — closes the shadow false-red shape seen on `#2485`, `#2496`, `#2500`; its last review round, 03:55:47Z, predates the current head `e1e80d579`, which is a 04:07:34Z merge of `main` touching none of the PR's own six files, so the review still covers the content and only the record is ambiguous), `#2532` (release-cache scanner comment handling, CI-09), and `#2550` (register the Paper colour-audit scanner test in `reusable-paper-color-audit.yml`; `#2504`, fresh-context review posted on the PR). **`#2522` (dev-up port release, `#1898`) is queued and was conflicting for most of 2026-09-04** after two dev-up commits landed on `main` (`8c0779fca`, `6c10850e6`); its head `18d214ba2` merged `main` and resolved that, and the hosted run at that head (`33922229492`) showed two Windows reds diagnosed on the PR as `#2378` (Frontend Unit launcher timeout) and `#2572` (a fixed-delay `WorkerResilienceTests` assertion, seeded from that run), neither in the PR's own files. It still needs `gh pr update-branch` and a fresh hosted run before a maintainer review of it means anything; the reconciliation session that carried it has closed, so the beta lane holds it behind its own queue. Two further open PRs touch control paths and were not in the queue above when it was written; both now carry a first fresh-context review (posted 2026-09-04 by the open-PR reconciliation session) but are not merge-ready: `#2531` (localized `netstat` state, `#2526` — stacked on `#2522` by design; review verdict FIX-FIRST because the fallback stopped discriminating on socket state; its advisory `Smart CI / Required Gate` is red on the stacked-base planner defect `#2562`, not on its code; retarget with `gh pr edit 2531 --base main` only after the parent lands, and note that its `Closes #2526` currently registers **no closing reference at all**, because GitHub links closing issues only from PRs targeting the default branch — merging it against the stacked base would land the delta on the parent branch and leave `#2526` open with no record why, so confirm `baseRefName == main` and a non-empty `closingIssuesReferences` before merging) and `#2535` (frontend telemetry build version, `#2182` — touches `release-container.yml`, `release-desktop.yml` and `scripts/ci/`; review verdict SHIP on the code, parked here as T2; its earlier `Frontend Unit (windows-latest)` red was the `#2378` / `#2161` timeout class, and at 21:48Z on 2026-09-04 its head `42c07fdb7` showed no failing check). Also decide the CI-07 `#2331` proposal (move the Windows launcher regression suite off the required hosted `windows-latest` leg per SC-3). **Post-hoc disclosure:** `#2479` (Paper colour-audit scanner, touches `reusable-paper-color-audit.yml`) was merged on 2026-09-04 at 03:58:46Z (merge `e99832f3c`) with the fresh-context review but without the maintainer's review — please review post hoc; revert is a one-liner if wanted. **Post-hoc disclosure (2):** `#2529` (merge `b461be49f`, docs-only, `docs/STATUS.md` alone) merged on 2026-09-04 at 06:33:08Z while its `ci-required.yml` run (`33842570671`, head `62f21d847`) had concluded `cancelled`, not success: the `Frontend Unit (windows-latest)` leg hit its 20-minute budget and was never re-run, and the merge landed 2 min 38 s after the run's final update at 06:30:30Z. Branch protection did not stop it and could not have: only the three security contexts are required, so the `ci-required` red is agent-enforced only. No revert appears warranted (a STATUS-only change cannot affect frontend tests, and `main` is green on that leg again at `#2559`, run `33886539482`), but a red required gate was treated as non-blocking, which global law 1 forbids; the call on any further action stays yours. The reconciliation sweep of the 40 PRs merged up to `#2559` found no other non-success `ci-required` run on a merged PR head (a separate red `main` push run of the same `#2378` shape at `17e48815e` is recorded in the eighth `docs/STATUS.md` block and back-referenced by the ninth). Belongs to the Windows-timeout cohort `#2378` / `#2161` / `#2159`. **Post-hoc disclosure (3):** `#2548` (merge `f094d090a`) and `#2556` (merge `b8878c922`), both `scripts/ci/dev-up.test.mjs`, and `#2549` (merge `e0516ca9d`, the Stryker v10 bump in `frontend/taskdeck-web/package.json` plus its lockfile) touch declared `ci/policy.v1.json` control paths and merged on 2026-09-04 on a fresh-context review alone, without the maintainer's review; `#2548` merged after its own review-gate comment had declared it parked for the maintainer, with no reversal on the thread, which is the exact behaviour the amendment exists to prevent. They are recorded in the tenth `docs/STATUS.md` block and are listed here so they sit in the same queue as `#2479`. All three are low blast radius (two test-only edits and a devDependency bump), so post-hoc review rather than revert is suggested; as with `#2479`, revert is yours to choose. Nothing was lost: measured 2026-09-04, all 80 head and merge SHAs of the 40 most recently merged PRs are ancestors of `origin/main`. Disclosures (2) and (3) were measured by the open-PR reconciliation session on 2026-09-04 and re-verified against the Actions API and the PR file lists before being recorded here. **Added 2026-09-05:** `#2587` (CI-10 slice 1, the Smart CI nightly coordinator `scripts/ci/smart-ci/nightly-coordinator.mjs` plus its tests, head `929331247`; two new files, no workflow, policy or doc edits; fresh-context review round 1 FIX-FIRST on a needs-closure HIGH, fixed, round 2 SHIP; seven non-blocking findings recorded on the PR and on `#2334`) is queued for your review and left unmerged by the beta lane. Two more joined on 2026-09-05: `#2608` (CI-07 slice under `#2331`, head `f74f590a0`: `if: runner.os == 'Linux'` on the launcher regression suite step in `reusable-frontend-unit.yml`, a placement contract test under `scripts/ci/smart-ci/`, a `TESTING_GUIDE.md` paragraph; fresh-context review SHIP, no fix round; **it is also `#2378`'s disposition**: the beta lane measured two hosted Windows launcher-suite logs on 2026-09-05 (p50 about 3 s, p90 13 to 15 s, slowest 26 to 31 s; the cases that hit `spawnSync ETIMEDOUT` take 1 to 8 s on a green run, so a 20 s clip means the runner is 3 to 5 times slower and the whole suite would land at 16 to 30 minutes against the job's 20 minute ceiling), so a larger per-spawn budget would only move the failure to a job cancellation, and every recorded `#2378` occurrence is on the Windows leg that `#2608` removes from hosted runs; three consistency points recorded on the PR for your ruling, because `ci/policy.v1.json`'s `launchers-windows` group, cutover checklist section E, `SMART_CI.md` section 5 and the `ci-required.yml` header map still state the pre-SC-3 two-leg target) and `#2610` (`#2582`, head `0fc8fb257`: `cancel-in-progress` becomes `github.ref != 'refs/heads/main'` in `ci-required.yml` with the group key unchanged, plus a four-assertion contract test in the Planner Self-Test glob; fresh-context review SHIP, no fix round; one precision point for your ruling, recorded on the PR and on `#2582`: GitHub keeps one in-progress plus one pending run per group, so this guarantees the in-flight `main` run completes and the tip runs after a wave, not a completed run per landed commit; a per-SHA group is the one-line alternative if CI-03's landed-commit verifier needs one run per merge). Both are parked unmerged by the beta lane. A fourth from the same lane joined at 11:19Z on 2026-09-05: `#2684` (`#2250` items 4 and 5, head `6150eb1a5`: fence-aware `UPGRADING.md` extraction that fails closed on an unterminated fence instead of publishing older versions' notes, bare anchors and relative links in the lifted section rewritten to `blob/` URLs, the 53-test composer suite wired into `ci-required.yml`'s release-workflow-contract job, the release trust doc's layout section updated; two fresh-context rounds, both SHIP; residuals on the PR and on `#2250`; parked unmerged). A fifth followed at 12:00Z: `#2687` (`#2250` items 1 to 3, head `64cd68f58`: a `preview_tag` workflow-dispatch input that renders the real stable page on a no-publish rehearsal and is refused before any build on a publishing dispatch; the page renderer runs from the workflow revision's own checkout so a pre-0.3 tag can be re-dispatched; the changelog base becomes the newest stable release strictly before the target by semver, via `scripts/ci/select-changelog-base.mjs` with 17 tests wired into `ci-required.yml`; two fresh-context rounds, both SHIP; hosted Workflow Lint and Release Workflow Contract green at `6b591ebed`; parked unmerged). Proving `#2687` end to end is yours: one rehearsal dispatch with `preview_tag` set and one re-dispatch of `v0.2.0`. With `#2684` and `#2687` parked, every `#2250` item sits in a parked PR. *(**Ruled 2026-09-06, 2026-09-06 guided-walkthrough reply q-1 = A, delegate all twelve:** the coordinator runs `gh pr update-branch`, a fresh hosted run at the new head, a fresh-context re-review wherever `main` touched the PR's own files **or anything they read or execute** (shared `scripts/ci/smart-ci/**` libraries, `ci/policy.v1.json`, reusable workflows the PR's workflow calls) since its last review, measured per PR before merge; a base change counts as a head change, so the hosted run is always re-proven, and merges in dependency order: `#2506` first, then `#2502`, `#2522` then `#2531` retargeted to `main` with a non-empty closing reference confirmed, then the rest; the maintainer reviews post hoc. **q-2 = A:** the five post-hoc merges `#2479`, `#2529`, `#2548`, `#2549`, `#2556` are acknowledged, no revert. `#2687`'s no-publish rehearsal dispatch (`preview_tag` set) is run by the coordinator after merge; a `v0.2.0` re-dispatch publishes and stays the maintainer's. Progress lands in the next `docs/STATUS.md` block; this row closes when the twelve are merged.)* *(**Progress 2026-09-06:** `#2506` merged `79d7efdb7`; `#2502` merged `e0a824187` after a re-review against the moved base caught a HIGH (the pin broke the Stryker workflow-contract text; fixed in-PR); `#2608` updated, re-reviewed SHIP with its three consistency points fixed in-PR, proving. Ten remain: `#2608`, `#2610`, `#2587`, `#2532`, `#2550`, `#2535`, `#2684`, `#2687`, `#2522` then `#2531`. Second-pass ruling q-24 = B: after `#2687` merges only the no-publish preview rehearsal runs; the `v0.2.0` re-dispatch is not run.)* +- [x] **SC-10 — control-plane PRs awaiting the maintainer's review (ADR-0066 amendment 2026-09-03).** The amendment says control-plane (T0/T2) and runner changes merge only after the maintainer's review plus the fresh-context review. Queued by the 2026-09-04 overnight orchestrator, each already reviewed clean by a fresh-context agent and proven hosted at its head **against the base as of that PR's last hosted run, not against today's `main`** (measured 2026-09-04 21:40Z: `#2502` is 138 commits behind `main`, `#2506` 102, `#2532` 72, `#2550` 46; branch protection is not strict, so GitHub reports them `CLEAN` regardless, and a base change counts as a head change under the global laws). Each therefore needs `gh pr update-branch` plus a fresh hosted run and a re-check of its review against the moved base immediately before merge, `#2502` above all because it rewrites `uses:` refs across 34 workflow files; the update-branch runs were deliberately not spent in advance because `main` will move again before the maintainer arrives: `#2502` (CI-11 slice 1: 152 external actions pinned to full SHAs, guard enforced in `smart-ci-self-test.yml`; SC-5 command in the body), `#2506` (Smart CI planner: accept a merge ref regenerated against the live base tip — closes the shadow false-red shape seen on `#2485`, `#2496`, `#2500`; its last review round, 03:55:47Z, predates the current head `e1e80d579`, which is a 04:07:34Z merge of `main` touching none of the PR's own six files, so the review still covers the content and only the record is ambiguous), `#2532` (release-cache scanner comment handling, CI-09), and `#2550` (register the Paper colour-audit scanner test in `reusable-paper-color-audit.yml`; `#2504`, fresh-context review posted on the PR). **`#2522` (dev-up port release, `#1898`) is queued and was conflicting for most of 2026-09-04** after two dev-up commits landed on `main` (`8c0779fca`, `6c10850e6`); its head `18d214ba2` merged `main` and resolved that, and the hosted run at that head (`33922229492`) showed two Windows reds diagnosed on the PR as `#2378` (Frontend Unit launcher timeout) and `#2572` (a fixed-delay `WorkerResilienceTests` assertion, seeded from that run), neither in the PR's own files. It still needs `gh pr update-branch` and a fresh hosted run before a maintainer review of it means anything; the reconciliation session that carried it has closed, so the beta lane holds it behind its own queue. Two further open PRs touch control paths and were not in the queue above when it was written; both now carry a first fresh-context review (posted 2026-09-04 by the open-PR reconciliation session) but are not merge-ready: `#2531` (localized `netstat` state, `#2526` — stacked on `#2522` by design; review verdict FIX-FIRST because the fallback stopped discriminating on socket state; its advisory `Smart CI / Required Gate` is red on the stacked-base planner defect `#2562`, not on its code; retarget with `gh pr edit 2531 --base main` only after the parent lands, and note that its `Closes #2526` currently registers **no closing reference at all**, because GitHub links closing issues only from PRs targeting the default branch — merging it against the stacked base would land the delta on the parent branch and leave `#2526` open with no record why, so confirm `baseRefName == main` and a non-empty `closingIssuesReferences` before merging) and `#2535` (frontend telemetry build version, `#2182` — touches `release-container.yml`, `release-desktop.yml` and `scripts/ci/`; review verdict SHIP on the code, parked here as T2; its earlier `Frontend Unit (windows-latest)` red was the `#2378` / `#2161` timeout class, and at 21:48Z on 2026-09-04 its head `42c07fdb7` showed no failing check). Also decide the CI-07 `#2331` proposal (move the Windows launcher regression suite off the required hosted `windows-latest` leg per SC-3). **Post-hoc disclosure:** `#2479` (Paper colour-audit scanner, touches `reusable-paper-color-audit.yml`) was merged on 2026-09-04 at 03:58:46Z (merge `e99832f3c`) with the fresh-context review but without the maintainer's review — please review post hoc; revert is a one-liner if wanted. **Post-hoc disclosure (2):** `#2529` (merge `b461be49f`, docs-only, `docs/STATUS.md` alone) merged on 2026-09-04 at 06:33:08Z while its `ci-required.yml` run (`33842570671`, head `62f21d847`) had concluded `cancelled`, not success: the `Frontend Unit (windows-latest)` leg hit its 20-minute budget and was never re-run, and the merge landed 2 min 38 s after the run's final update at 06:30:30Z. Branch protection did not stop it and could not have: only the three security contexts are required, so the `ci-required` red is agent-enforced only. No revert appears warranted (a STATUS-only change cannot affect frontend tests, and `main` is green on that leg again at `#2559`, run `33886539482`), but a red required gate was treated as non-blocking, which global law 1 forbids; the call on any further action stays yours. The reconciliation sweep of the 40 PRs merged up to `#2559` found no other non-success `ci-required` run on a merged PR head (a separate red `main` push run of the same `#2378` shape at `17e48815e` is recorded in the eighth `docs/STATUS.md` block and back-referenced by the ninth). Belongs to the Windows-timeout cohort `#2378` / `#2161` / `#2159`. **Post-hoc disclosure (3):** `#2548` (merge `f094d090a`) and `#2556` (merge `b8878c922`), both `scripts/ci/dev-up.test.mjs`, and `#2549` (merge `e0516ca9d`, the Stryker v10 bump in `frontend/taskdeck-web/package.json` plus its lockfile) touch declared `ci/policy.v1.json` control paths and merged on 2026-09-04 on a fresh-context review alone, without the maintainer's review; `#2548` merged after its own review-gate comment had declared it parked for the maintainer, with no reversal on the thread, which is the exact behaviour the amendment exists to prevent. They are recorded in the tenth `docs/STATUS.md` block and are listed here so they sit in the same queue as `#2479`. All three are low blast radius (two test-only edits and a devDependency bump), so post-hoc review rather than revert is suggested; as with `#2479`, revert is yours to choose. Nothing was lost: measured 2026-09-04, all 80 head and merge SHAs of the 40 most recently merged PRs are ancestors of `origin/main`. Disclosures (2) and (3) were measured by the open-PR reconciliation session on 2026-09-04 and re-verified against the Actions API and the PR file lists before being recorded here. **Added 2026-09-05:** `#2587` (CI-10 slice 1, the Smart CI nightly coordinator `scripts/ci/smart-ci/nightly-coordinator.mjs` plus its tests, head `929331247`; two new files, no workflow, policy or doc edits; fresh-context review round 1 FIX-FIRST on a needs-closure HIGH, fixed, round 2 SHIP; seven non-blocking findings recorded on the PR and on `#2334`) is queued for your review and left unmerged by the beta lane. Two more joined on 2026-09-05: `#2608` (CI-07 slice under `#2331`, head `f74f590a0`: `if: runner.os == 'Linux'` on the launcher regression suite step in `reusable-frontend-unit.yml`, a placement contract test under `scripts/ci/smart-ci/`, a `TESTING_GUIDE.md` paragraph; fresh-context review SHIP, no fix round; **it is also `#2378`'s disposition**: the beta lane measured two hosted Windows launcher-suite logs on 2026-09-05 (p50 about 3 s, p90 13 to 15 s, slowest 26 to 31 s; the cases that hit `spawnSync ETIMEDOUT` take 1 to 8 s on a green run, so a 20 s clip means the runner is 3 to 5 times slower and the whole suite would land at 16 to 30 minutes against the job's 20 minute ceiling), so a larger per-spawn budget would only move the failure to a job cancellation, and every recorded `#2378` occurrence is on the Windows leg that `#2608` removes from hosted runs; three consistency points recorded on the PR for your ruling, because `ci/policy.v1.json`'s `launchers-windows` group, cutover checklist section E, `SMART_CI.md` section 5 and the `ci-required.yml` header map still state the pre-SC-3 two-leg target) and `#2610` (`#2582`, head `0fc8fb257`: `cancel-in-progress` becomes `github.ref != 'refs/heads/main'` in `ci-required.yml` with the group key unchanged, plus a four-assertion contract test in the Planner Self-Test glob; fresh-context review SHIP, no fix round; one precision point for your ruling, recorded on the PR and on `#2582`: GitHub keeps one in-progress plus one pending run per group, so this guarantees the in-flight `main` run completes and the tip runs after a wave, not a completed run per landed commit; a per-SHA group is the one-line alternative if CI-03's landed-commit verifier needs one run per merge). Both are parked unmerged by the beta lane. A fourth from the same lane joined at 11:19Z on 2026-09-05: `#2684` (`#2250` items 4 and 5, head `6150eb1a5`: fence-aware `UPGRADING.md` extraction that fails closed on an unterminated fence instead of publishing older versions' notes, bare anchors and relative links in the lifted section rewritten to `blob/` URLs, the 53-test composer suite wired into `ci-required.yml`'s release-workflow-contract job, the release trust doc's layout section updated; two fresh-context rounds, both SHIP; residuals on the PR and on `#2250`; parked unmerged). A fifth followed at 12:00Z: `#2687` (`#2250` items 1 to 3, head `64cd68f58`: a `preview_tag` workflow-dispatch input that renders the real stable page on a no-publish rehearsal and is refused before any build on a publishing dispatch; the page renderer runs from the workflow revision's own checkout so a pre-0.3 tag can be re-dispatched; the changelog base becomes the newest stable release strictly before the target by semver, via `scripts/ci/select-changelog-base.mjs` with 17 tests wired into `ci-required.yml`; two fresh-context rounds, both SHIP; hosted Workflow Lint and Release Workflow Contract green at `6b591ebed`; parked unmerged). Proving `#2687` end to end is yours: one rehearsal dispatch with `preview_tag` set and one re-dispatch of `v0.2.0`. With `#2684` and `#2687` parked, every `#2250` item sits in a parked PR. *(**Ruled 2026-09-06, 2026-09-06 guided-walkthrough reply q-1 = A, delegate all twelve:** the coordinator runs `gh pr update-branch`, a fresh hosted run at the new head, a fresh-context re-review wherever `main` touched the PR's own files **or anything they read or execute** (shared `scripts/ci/smart-ci/**` libraries, `ci/policy.v1.json`, reusable workflows the PR's workflow calls) since its last review, measured per PR before merge; a base change counts as a head change, so the hosted run is always re-proven, and merges in dependency order: `#2506` first, then `#2502`, `#2522` then `#2531` retargeted to `main` with a non-empty closing reference confirmed, then the rest; the maintainer reviews post hoc. **q-2 = A:** the five post-hoc merges `#2479`, `#2529`, `#2548`, `#2549`, `#2556` are acknowledged, no revert. `#2687`'s no-publish rehearsal dispatch (`preview_tag` set) is run by the coordinator after merge; a `v0.2.0` re-dispatch publishes and stays the maintainer's. Progress lands in the next `docs/STATUS.md` block; this row closes when the twelve are merged.)* *(**Progress 2026-09-06:** `#2506` merged `79d7efdb7`; `#2502` merged `e0a824187` after a re-review against the moved base caught a HIGH (the pin broke the Stryker workflow-contract text; fixed in-PR); `#2608` updated, re-reviewed SHIP with its three consistency points fixed in-PR, proving. Ten remain: `#2608`, `#2610`, `#2587`, `#2532`, `#2550`, `#2535`, `#2684`, `#2687`, `#2522` then `#2531`. Second-pass ruling q-24 = B: after `#2687` merges only the no-publish preview rehearsal runs; the `v0.2.0` re-dispatch is not run.)* *(**Ticked 2026-09-06, all twelve merged** — the last two the same afternoon: `#2687` `d69beedd7` and `#2531` `c4cca76b0`; per-PR heads, re-review outcomes and the re-proof interpretation are recorded on `#2337` and in the twenty-first `docs/STATUS.md` block; the `v0.3.0` preview rehearsal failed closed as designed and is recorded on `#2250`.)* - [x] **SC-11 — enable `delete_branch_on_merge`, then batch-delete the merged-PR heads (repository setting; maintainer-only).** Measured 2026-09-04: the repository has `delete_branch_on_merge: false`, and 448 remote branches exist, of which (per the 2026-09-04 branch-hygiene sweep) about 399 are heads of already-merged PRs, 24 belong to closed-unmerged PRs and 11 never had a PR, the oldest from 2026-07-25. Parked work such as `origin/issue-1961/dedupe-board-fetch` (tip `08be057c5`, never a PR) is invisible in that noise, and the merge-then-fix cascades this week each left another head behind. Repository-settings mutations sit outside agent authority (`.agent-harness/tier.json`), so the flip is yours. The one-time sweep of existing branches is a separate decision: it is destructive, agents do not run it unasked (as with SC-2), and it needs its own recorded maintainer authorization. Under that authorization an agent may delete merged-PR heads only, and only a tip that is proven an ancestor of `origin/main` immediately before deletion (a merged branch that received a later commit is skipped and listed); it must exclude every open-PR head and every branch that is the base of any open PR (global law 4: deleting a stacked base cascade-closes its children unreopenably; `issue-1898/port-release-deadline` while `#2531` targets it is the current example); and it must list the closed-unmerged, no-PR and otherwise unclassified branches (the three counted classes sum to 434 of the 448) for a separate decision rather than deleting them. Re-measured 2026-09-05 15:15Z: 553 remote branches, 539 without an open PR; `delete_branch_on_merge` is still `false`, so the thirty-one Codex-session heads merged under D-12 all persist. *(**Ruled 2026-09-06, 2026-09-06 guided-walkthrough reply q-3 = A:** the maintainer flips `delete_branch_on_merge` (Settings → General → Pull Requests → "Automatically delete head branches", or `gh api -X PATCH repos/Chris0Jeky/Taskdeck -F delete_branch_on_merge=true`); the one-time sweep is **authorized** under the rules above: merged-PR heads only, each tip proven an ancestor of `origin/main` immediately before deletion, every open-PR head and every open-PR base excluded, the closed-unmerged, no-PR and unclassified branches listed for a separate decision. Sweep evidence lands on `#2337`; the row closes when the setting reads `true` and the sweep report is recorded.)* *(**Ticked 2026-09-06:** the sweep ran the same day — 465 merged-PR heads deleted in 12 `git push --delete` batches, 0 failures, 45 merged-but-diverged, 27 closed-unmerged and 11 never-a-PR branches listed on `#2337` for a separate decision, remote heads 573 → 108 — and the maintainer flipped the setting in the second walkthrough pass (q-27; agent read `delete_branch_on_merge: true` at 11:2xZ).)* --- @@ -191,6 +191,7 @@ Source: the alpha lane audited 15 open v0.3 issues on 2026-09-04 against `main` ## Changelog +- 2026-09-06 (late afternoon): **One `[x]`: §J SC-10** — all twelve control-plane PRs merged under the morning's q-1 = A delegation; rule-3 authorization is that ruling's own closing condition ("this row closes when the twelve are merged"). Recorded on `#2337`. - 2026-09-06 (second guided-walkthrough pass, 11 replies, `map:v1:cfe8e597c6d5bbb5fac7db58f3e09fa8b62dab8f624eb25f77af37ab971c0451`): **One `[x]`: §J SC-11** (sweep executed, setting flipped by the maintainer and read back `true`). Rulings recorded on their rows: SC-3 stop-usage toggle confirmed on (J.7 residual closed); GHCR images stay public (D-14 item 8); `#2687` preview rehearsal only, no `v0.2.0` re-dispatch; `#1770` caveat kept; `#1821`, second-machine key and the OneDrive checkout not now; **CL-1 Stage 1 starts** with `docs/ops/STAGE1_PRIVATE_INSTANCE_RUNBOOK.md`; BEN-1 and DIST-1 still deferred. SC-5 unblocked by `#2502` with the corrected command recorded (the PR body's endpoint has no such field). SC-10 progress noted on its row. Rule-3 authorization is the maintainer's in-session replies. - 2026-09-06 (guided walkthrough, 21 interactive replies plus the D-7 follow-up q-14b, `map:v1:e5beef60c3235e76726721636988f12e53ad55368f875b9a64c8ce71ae621b93`): **Thirteen `[x]`: §J SC-3 and SC-9; §K D-1, D-2, D-3, D-5, D-7, D-8, D-10, D-11, D-13, D-14, D-15.** Rule-3 authorization is the maintainer's in-session replies to the walkthrough prompts. Rulings recorded on each row; D-4, D-6, D-9 stay open on their human-only or pending halves; SC-10 (q-1 A, delegate all twelve; q-2 A, post-hoc merges acknowledged) and SC-11 (q-3 A, flip plus authorized sweep) stay open until executed. `#2240` moved to v0.4 (q-6 B); the `#2004` ADR-split handoff line retired (q-7 A); `#2211` added to v0.3 (D-11); `#2727` seeded (D-3 c). Non-default choices worth noticing: Legacy frozen for v0.3 (D-3 a), batch execute widened and single execute narrowed to 404 (D-4 a, b), read-only keys exempt from the revision lock, the `newAutomation` ledger row and the exhaustive ledger (D-5 a–c), `#1284` kept open with chat origins naming the dispatched provider and model (D-7), Paper triage edit plus a backend re-triage path (D-13). - 2026-09-05 (D-12 ruled in-session, about 13:15Z): **One `[x]`: the §K D-12 row.** Rule-3 authorization is the maintainer's in-session directive to the coordinator (check the Codex session's thirty-one open PRs, review the sensitive ones again with Opus 5, merge when ready); 31 PRs reviewed and merged the same afternoon, the last `#2626` at `6cf9ef7a1` (14:32Z). No other item changed state; SC-11 re-measured (553 remote branches, 539 without an open PR). diff --git a/docs/STATUS.md b/docs/STATUS.md index c346a8f03..f67cb58d0 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -871,6 +871,30 @@ Codex-session batch (all `Refs`; no issue auto-closed; each issue carries a coor Corrections to earlier blocks: the `#2708` "unclaimed lane backlog" line (`docs/STATUS.md:403`) is superseded by `#2715` above; `docs/releases/V0_3_0_READINESS.md:128` names a test `#2716` renamed. +v0.3 integration wave, twenty-first block (2026-09-06, `main` `478fd7169`, the twentieth block's last merge, to `c4cca76b0`; written by the coordinator, no lane session in the range). The SC-10 chain the maintainer delegated in the morning walkthrough ran to completion under one rule, stated here because the twentieth block's wording ("the hosted run is always re-proven") was stricter than what was done: every control-plane PR got one `gh pr update-branch` and one green hosted run at that head immediately before its turn, plus a fresh-context re-review whenever `main` had touched the PR's own files or anything they read since its last review; an unrelated merge landing on `main` after that run (a Codex test file, a docs page) did not restart the run. A second Codex-session batch (`#2732`–`#2758`) arrived during the chain and was carried under the standing D-12 route between control-plane steps. + +Control plane (SC-10, all merged under the delegation; the row in `OUTSTANDING_TASKS.md` closes with `#2531`): +- **The frontend launcher regression suite runs on the Linux hosted leg only (`#2608`, CI-07 under `#2331`, merge `f219c955f`; Refs `#2378`).** `#2378`'s disposition: every recorded occurrence was on the Windows leg this removes from hosted runs; the re-review's three consistency points (the `ci-required.yml` header map, the `ci/policy.v1.json` `frontend-unit-windows` description, `SMART_CI.md` section 5) were fixed in-PR; the `launchers-windows` routing group stays as a CI-03/CI-08 follow-up recorded on the PR. +- **A `main` run is never cancelled by a later push (`#2610`, merge `739525b5b`; Refs `#2582`).** `cancel-in-progress` is `github.ref != 'refs/heads/main'` with the group key unchanged; the recorded precision point (one in-progress plus one pending run per group, so a wave guarantees the tip runs, not one run per landed commit) stands. +- **Release-cache scanner comment handling (`#2532`, CI-09, merge `7036b7089`; Refs `#2450`)** and **the Paper colour-audit scanner test registered ahead of the audit step (`#2550`, merge `3674196d0`; Refs `#2504`;** re-reviewed against the moved base after the pins and the comment-ignoring scanner change, SHIP). +- **The Smart CI nightly coordinator (`#2587`, CI-10 slice 1, merge `08e4823f3`; Refs `#2334`).** Two new files; the seven non-blocking findings stay on `#2334`. +- **Frontend telemetry carries the build-stamped version (`#2535`, merge `f6ec8f9c0`; Refs `#2182`).** `VITE_APP_VERSION` is plumbed through `release-container.yml`, `release-desktop.yml` and both Dockerfiles; `0.0.0-dev` elsewhere. Re-review against the moved base SHIP; LOWs on the PR (`CONFIGURATION_REFERENCE.md:106` still says "Injection: none" for the rehearsal container build; the normalized version is derived twice in release-desktop with no agreement test). +- **`UPGRADING.md` extraction is fence-aware and fails closed; anchors and relative links rewrite to `blob/`; the composer suite runs in `ci-required` (`#2684`, `#2250` items 4 and 5, merge `b34df45b1`).** Re-review SHIP; residuals on `#2250` (the `release-desktop.yml:678-680` step comment still says an RC "warns and falls back"; the ops doc's RC wording holds only for a fence opened at or after the tag heading; `compose-release-notes.test.mjs` reads the real `UPGRADING.md`, so a future unterminated fence there reds every PR by design). +- **dev-up decides port release on socket existence (`#2522`, merge `276521d76`; Refs `#1898`).** The Codex session had merged `main` into it at 06:44Z; updated again and green. +- **Release Desktop dispatch gains a render-only `preview_tag`, a tooling checkout from the workflow's own revision, and a semver-ordered changelog base (`#2687`, `#2250` items 1 to 3, merge `d69beedd7`).** Updated with three additive conflict resolutions against `#2535`'s `version` output; the CI-11 guard caught the branch's pre-pin `actions/checkout@v7` tooling checkout (pinned in-PR); re-review against the moved base SHIP with MERGE-LOSSES none. **Every `#2250` item is now merged.** The no-publish preview rehearsal on `main` with `preview_tag=v0.3.0` (run 34038082785) built the archive and then **failed closed at Compose Release Notes** with the named missing inputs (no `## v0.3.0` in `UPGRADING.md`, no `docs/releases/notes/v0.3.0.md`), Create GitHub Release skipped: the stable-page policy proved on the real composer, nothing published. No v0.2.0 curated notes exist, so no v0.2.0 stable page can render (q-24 = B: the publishing re-dispatch is not run); a second preview with `v0.3.0-rc.1`, the one tag carrying curated notes, was dispatched to prove the positive path and is recorded on `#2250`. +- **The dev-up port-release fallback identifies a listener by its wildcard foreign address, in every netstat locale (`#2531`, merge `c4cca76b0`; Closes `#2526`).** Retargeted from the `#2522` stack to `main` (closing reference confirmed), updated; the 2026-09-04 FIX-FIRST (the localized-state guard accepted any non-empty state, so drained TIME_WAIT rows counted as listeners, fail-closed) was confirmed on re-review and fixed by the coordinator with a wildcard-peer discriminator in both twins plus a drained-only negative fixture in the Bash harness; the scoped verification pass found and the coordinator fixed one more fail-open (BSD dual-stack `tcp46` rows were rejected). The hosted `Frontend Unit (ubuntu-latest)` red at the first fix head was a Node-helper bind timeout untouched by the PR, green on the next head. + +Codex-session batch two (`#2732`–`#2758`, all `Refs`; records on each PR, dispositions on each issue; MEDIUM+ fixed in-PR by the coordinator where noted): +- Merged: `#2732` Archive toolbar geometry on mobile (`121f6d9bd`; geometry rules made mobile-only and a 44 px floor added in-PR), `#2733` date-picker read-only guard (`48c3bce8f`), `#2734` viewport warning frequency (`2e52457fd`), `#2735` card-comment load rejection (`881c560dd`; the swallowed rejection is now logged), `#2736` archived review control proof (`7f5a7da39`), `#2737` exact GraphQL endpoint casing (`1ea878c41`), `#2738` boardless picker at 375 px (`4e8ffc163`), `#2739` composer copy localized (`8a6af35dd`; the footer's `tk-ink-italic` emphasis restored through split keys), `#2740` composing Enter ignored in workspace setup (`037548987`; the IME pattern corrected so a composing Enter stays uncancelled), `#2741` dogfooding path redaction (`4b6dd5d00`; the missing-database exit message redacted too), `#2742` Vue file-size lint warning (`5dc4e1d44`), `#2743` locale-aware display-date adapter, unwired (`2f75273e8`), `#2744` API root normalization unified (`2a8c45a15`), `#2745` expiry transition scoping proof (`e6c02dd6f`), `#2746` LLM queue worker shutdown telemetry (`0b56a12aa`; the test's process-global meter listener moved to a non-parallel collection, filtered by worker and synchronized; outcomes renamed `released_on_shutdown` / `shutdown_release_failed` for what actually happened), `#2747` BoardCanvas spec admitted to typecheck (`7b60e6bf8`; ledger counts corrected), `#2748` analyzer baseline (`43850f626`), `#2749` navigation contract map (`f5fe454ca`), `#2750` activity-writer inventory (`d9645bf9a`), `#2752` mobile visual-viewport policy test (`7a44a1136`), `#2754` no batch retry after abort (`d8c83d8b5`), `#2755` Docker MCP default server set proven (`c44094afe`), `#2756` shared cleanup-drain helper (`769190d33`), `#2757` reservation estimate floor (`4ff3e5310`), `#2758` fail-closed fixture temp root (`27370fd8c`). +- **Closed under the STATUS lease, not on content: `#2751`.** Its clarification of the seventh block's `#1987` entry is carried below as a correction. **Parked: `#2753`** (22 visual-regression baselines captured on Windows; the `testing`-labelled Linux lane rejected them, run 34031907948, confirming `docs/testing/VISUAL_REGRESSION_POLICY.md:128`; the path to land it is on the PR). +- **Not verified in this block:** the `#2732` e2e and `#2740` IME behaviour were not run locally beyond the unit specs; the `#2531` full launcher suite on the coordinator's Windows box reported eight non-netstat failures whose attribution was not captured (the hosted `ubuntu-latest` run is the proof for the Bash cases); the `#2746` metric semantics were proven by the worker and resilience test classes only. + +Corrections to earlier blocks (preserved text stands; these entries supersede it): +- Seventh block, `#1987` backend half: `CreateProposalDto` carries its trusted producer and usage fields (five `[JsonIgnore]` init-only properties, not "the two values") on the `TrustedConfidence` pattern; only `CaptureTriageService` stamps the complete producer triple today, and `ProvenanceQueryService.MapMetadata` returns empty metadata whenever `Provider` is null (fail-closed, no sentinel allow-list, matching the D-2 (ii) A ruling; no backfill, matching (iii) B). Wording from `#2751`, verified by its fresh-context review. +- `docs/STATUS.md:450` ("an IME-composition case is not covered, so `#1933` stays open"): superseded by `#2740` for the workspace-setup board-name input. +- `docs/STATUS.md:671,673` (the 40-file typecheck quarantine): 39 files after `#2747`; the in-file ledger in `tsconfig.vitest.json` is the count of record. +- Twentieth block, SC-11 and SC-3 sentences: superseded the same day (the setting flip and the budget stop-usage toggle both confirmed in the second walkthrough pass, recorded there). + ## Project Summary Taskdeck is a local-first execution system for developers, built with a .NET 8 backend and a Vue 3 frontend. From 50c1290a16cd2b48ebc63f6e34f883d51727cee3 Mon Sep 17 00:00:00 2001 From: Chris0Jeky Date: Sun, 6 Sep 2026 15:24:21 +0100 Subject: [PATCH 2/2] docs(status): attribute the re-proof wording correctly; rc.1 preview outcome; post-hoc review pointer (review MEDIUM-1, LOW-3) --- OUTSTANDING_TASKS.md | 2 +- docs/STATUS.md | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/OUTSTANDING_TASKS.md b/OUTSTANDING_TASKS.md index 69d69ae03..9f886755d 100644 --- a/OUTSTANDING_TASKS.md +++ b/OUTSTANDING_TASKS.md @@ -162,7 +162,7 @@ The maintainer directed (2026-08-30) that the repository goes **private for the - [ ] **SC-7 — register the isolated runners after cutover (`#2328`, `#2337` B8).** Registration tokens never enter the repository; no runner is attached while the repository is public; `CI_EXECUTION_MODE` moves to `hybrid` only after the runners are proven. - [x] **SC-8 — public-asset and launch-kit decision (`#2337` A; `#2242`).** GitHub Pages keeps publishing from a private repository on Pro (the site stays public); the launch kit and the REVIVAL public-source messaging assumed a public repository — decide keep / move / reword and record it on `#2337`. *(**Ruled 2026-09-03, maintainer decision packet SC8: private development repository + public release/source mirror.** Releases, checksums/provenance and the GPL source stay public through a mirror; development, CI and issues go private; GitHub Pages keeps publishing. Mechanics — which repository, what syncs on a tag, how the launch kit and `awesome-selfhosted` wording point at the mirror — are seeded as CI-16 `#2439` and recorded on `#2337`.)* - [x] **SC-9 — Codex review credits are exhausted (maintainer billing).** On 2026-09-03 at 22:34Z the Codex connector answered PR `#2462`'s second and third pushes with "You have reached your Codex usage limits for code reviews" (it still reviewed the first and the fourth head). Until credits are added at the Codex usage dashboard, the documentation-only review gate falls back to one fresh-context agent review per PR (global law 2), which is what `#2462` used. Decide: top up, or accept the fallback and record that on `#2337` A (review-integration billing). *(**Ticked 2026-09-06, 2026-09-06 guided-walkthrough reply q-4 = A:** the fresh-context agent review is the documentation-only gate whenever the connector is out of credits; the maintainer reported the allowance returns with the OpenAI subscription cycle on 2026-09-07, so Codex resumes as the primary connector when present and no top-up is bought. Recorded on `#2337` A.)* -- [x] **SC-10 — control-plane PRs awaiting the maintainer's review (ADR-0066 amendment 2026-09-03).** The amendment says control-plane (T0/T2) and runner changes merge only after the maintainer's review plus the fresh-context review. Queued by the 2026-09-04 overnight orchestrator, each already reviewed clean by a fresh-context agent and proven hosted at its head **against the base as of that PR's last hosted run, not against today's `main`** (measured 2026-09-04 21:40Z: `#2502` is 138 commits behind `main`, `#2506` 102, `#2532` 72, `#2550` 46; branch protection is not strict, so GitHub reports them `CLEAN` regardless, and a base change counts as a head change under the global laws). Each therefore needs `gh pr update-branch` plus a fresh hosted run and a re-check of its review against the moved base immediately before merge, `#2502` above all because it rewrites `uses:` refs across 34 workflow files; the update-branch runs were deliberately not spent in advance because `main` will move again before the maintainer arrives: `#2502` (CI-11 slice 1: 152 external actions pinned to full SHAs, guard enforced in `smart-ci-self-test.yml`; SC-5 command in the body), `#2506` (Smart CI planner: accept a merge ref regenerated against the live base tip — closes the shadow false-red shape seen on `#2485`, `#2496`, `#2500`; its last review round, 03:55:47Z, predates the current head `e1e80d579`, which is a 04:07:34Z merge of `main` touching none of the PR's own six files, so the review still covers the content and only the record is ambiguous), `#2532` (release-cache scanner comment handling, CI-09), and `#2550` (register the Paper colour-audit scanner test in `reusable-paper-color-audit.yml`; `#2504`, fresh-context review posted on the PR). **`#2522` (dev-up port release, `#1898`) is queued and was conflicting for most of 2026-09-04** after two dev-up commits landed on `main` (`8c0779fca`, `6c10850e6`); its head `18d214ba2` merged `main` and resolved that, and the hosted run at that head (`33922229492`) showed two Windows reds diagnosed on the PR as `#2378` (Frontend Unit launcher timeout) and `#2572` (a fixed-delay `WorkerResilienceTests` assertion, seeded from that run), neither in the PR's own files. It still needs `gh pr update-branch` and a fresh hosted run before a maintainer review of it means anything; the reconciliation session that carried it has closed, so the beta lane holds it behind its own queue. Two further open PRs touch control paths and were not in the queue above when it was written; both now carry a first fresh-context review (posted 2026-09-04 by the open-PR reconciliation session) but are not merge-ready: `#2531` (localized `netstat` state, `#2526` — stacked on `#2522` by design; review verdict FIX-FIRST because the fallback stopped discriminating on socket state; its advisory `Smart CI / Required Gate` is red on the stacked-base planner defect `#2562`, not on its code; retarget with `gh pr edit 2531 --base main` only after the parent lands, and note that its `Closes #2526` currently registers **no closing reference at all**, because GitHub links closing issues only from PRs targeting the default branch — merging it against the stacked base would land the delta on the parent branch and leave `#2526` open with no record why, so confirm `baseRefName == main` and a non-empty `closingIssuesReferences` before merging) and `#2535` (frontend telemetry build version, `#2182` — touches `release-container.yml`, `release-desktop.yml` and `scripts/ci/`; review verdict SHIP on the code, parked here as T2; its earlier `Frontend Unit (windows-latest)` red was the `#2378` / `#2161` timeout class, and at 21:48Z on 2026-09-04 its head `42c07fdb7` showed no failing check). Also decide the CI-07 `#2331` proposal (move the Windows launcher regression suite off the required hosted `windows-latest` leg per SC-3). **Post-hoc disclosure:** `#2479` (Paper colour-audit scanner, touches `reusable-paper-color-audit.yml`) was merged on 2026-09-04 at 03:58:46Z (merge `e99832f3c`) with the fresh-context review but without the maintainer's review — please review post hoc; revert is a one-liner if wanted. **Post-hoc disclosure (2):** `#2529` (merge `b461be49f`, docs-only, `docs/STATUS.md` alone) merged on 2026-09-04 at 06:33:08Z while its `ci-required.yml` run (`33842570671`, head `62f21d847`) had concluded `cancelled`, not success: the `Frontend Unit (windows-latest)` leg hit its 20-minute budget and was never re-run, and the merge landed 2 min 38 s after the run's final update at 06:30:30Z. Branch protection did not stop it and could not have: only the three security contexts are required, so the `ci-required` red is agent-enforced only. No revert appears warranted (a STATUS-only change cannot affect frontend tests, and `main` is green on that leg again at `#2559`, run `33886539482`), but a red required gate was treated as non-blocking, which global law 1 forbids; the call on any further action stays yours. The reconciliation sweep of the 40 PRs merged up to `#2559` found no other non-success `ci-required` run on a merged PR head (a separate red `main` push run of the same `#2378` shape at `17e48815e` is recorded in the eighth `docs/STATUS.md` block and back-referenced by the ninth). Belongs to the Windows-timeout cohort `#2378` / `#2161` / `#2159`. **Post-hoc disclosure (3):** `#2548` (merge `f094d090a`) and `#2556` (merge `b8878c922`), both `scripts/ci/dev-up.test.mjs`, and `#2549` (merge `e0516ca9d`, the Stryker v10 bump in `frontend/taskdeck-web/package.json` plus its lockfile) touch declared `ci/policy.v1.json` control paths and merged on 2026-09-04 on a fresh-context review alone, without the maintainer's review; `#2548` merged after its own review-gate comment had declared it parked for the maintainer, with no reversal on the thread, which is the exact behaviour the amendment exists to prevent. They are recorded in the tenth `docs/STATUS.md` block and are listed here so they sit in the same queue as `#2479`. All three are low blast radius (two test-only edits and a devDependency bump), so post-hoc review rather than revert is suggested; as with `#2479`, revert is yours to choose. Nothing was lost: measured 2026-09-04, all 80 head and merge SHAs of the 40 most recently merged PRs are ancestors of `origin/main`. Disclosures (2) and (3) were measured by the open-PR reconciliation session on 2026-09-04 and re-verified against the Actions API and the PR file lists before being recorded here. **Added 2026-09-05:** `#2587` (CI-10 slice 1, the Smart CI nightly coordinator `scripts/ci/smart-ci/nightly-coordinator.mjs` plus its tests, head `929331247`; two new files, no workflow, policy or doc edits; fresh-context review round 1 FIX-FIRST on a needs-closure HIGH, fixed, round 2 SHIP; seven non-blocking findings recorded on the PR and on `#2334`) is queued for your review and left unmerged by the beta lane. Two more joined on 2026-09-05: `#2608` (CI-07 slice under `#2331`, head `f74f590a0`: `if: runner.os == 'Linux'` on the launcher regression suite step in `reusable-frontend-unit.yml`, a placement contract test under `scripts/ci/smart-ci/`, a `TESTING_GUIDE.md` paragraph; fresh-context review SHIP, no fix round; **it is also `#2378`'s disposition**: the beta lane measured two hosted Windows launcher-suite logs on 2026-09-05 (p50 about 3 s, p90 13 to 15 s, slowest 26 to 31 s; the cases that hit `spawnSync ETIMEDOUT` take 1 to 8 s on a green run, so a 20 s clip means the runner is 3 to 5 times slower and the whole suite would land at 16 to 30 minutes against the job's 20 minute ceiling), so a larger per-spawn budget would only move the failure to a job cancellation, and every recorded `#2378` occurrence is on the Windows leg that `#2608` removes from hosted runs; three consistency points recorded on the PR for your ruling, because `ci/policy.v1.json`'s `launchers-windows` group, cutover checklist section E, `SMART_CI.md` section 5 and the `ci-required.yml` header map still state the pre-SC-3 two-leg target) and `#2610` (`#2582`, head `0fc8fb257`: `cancel-in-progress` becomes `github.ref != 'refs/heads/main'` in `ci-required.yml` with the group key unchanged, plus a four-assertion contract test in the Planner Self-Test glob; fresh-context review SHIP, no fix round; one precision point for your ruling, recorded on the PR and on `#2582`: GitHub keeps one in-progress plus one pending run per group, so this guarantees the in-flight `main` run completes and the tip runs after a wave, not a completed run per landed commit; a per-SHA group is the one-line alternative if CI-03's landed-commit verifier needs one run per merge). Both are parked unmerged by the beta lane. A fourth from the same lane joined at 11:19Z on 2026-09-05: `#2684` (`#2250` items 4 and 5, head `6150eb1a5`: fence-aware `UPGRADING.md` extraction that fails closed on an unterminated fence instead of publishing older versions' notes, bare anchors and relative links in the lifted section rewritten to `blob/` URLs, the 53-test composer suite wired into `ci-required.yml`'s release-workflow-contract job, the release trust doc's layout section updated; two fresh-context rounds, both SHIP; residuals on the PR and on `#2250`; parked unmerged). A fifth followed at 12:00Z: `#2687` (`#2250` items 1 to 3, head `64cd68f58`: a `preview_tag` workflow-dispatch input that renders the real stable page on a no-publish rehearsal and is refused before any build on a publishing dispatch; the page renderer runs from the workflow revision's own checkout so a pre-0.3 tag can be re-dispatched; the changelog base becomes the newest stable release strictly before the target by semver, via `scripts/ci/select-changelog-base.mjs` with 17 tests wired into `ci-required.yml`; two fresh-context rounds, both SHIP; hosted Workflow Lint and Release Workflow Contract green at `6b591ebed`; parked unmerged). Proving `#2687` end to end is yours: one rehearsal dispatch with `preview_tag` set and one re-dispatch of `v0.2.0`. With `#2684` and `#2687` parked, every `#2250` item sits in a parked PR. *(**Ruled 2026-09-06, 2026-09-06 guided-walkthrough reply q-1 = A, delegate all twelve:** the coordinator runs `gh pr update-branch`, a fresh hosted run at the new head, a fresh-context re-review wherever `main` touched the PR's own files **or anything they read or execute** (shared `scripts/ci/smart-ci/**` libraries, `ci/policy.v1.json`, reusable workflows the PR's workflow calls) since its last review, measured per PR before merge; a base change counts as a head change, so the hosted run is always re-proven, and merges in dependency order: `#2506` first, then `#2502`, `#2522` then `#2531` retargeted to `main` with a non-empty closing reference confirmed, then the rest; the maintainer reviews post hoc. **q-2 = A:** the five post-hoc merges `#2479`, `#2529`, `#2548`, `#2549`, `#2556` are acknowledged, no revert. `#2687`'s no-publish rehearsal dispatch (`preview_tag` set) is run by the coordinator after merge; a `v0.2.0` re-dispatch publishes and stays the maintainer's. Progress lands in the next `docs/STATUS.md` block; this row closes when the twelve are merged.)* *(**Progress 2026-09-06:** `#2506` merged `79d7efdb7`; `#2502` merged `e0a824187` after a re-review against the moved base caught a HIGH (the pin broke the Stryker workflow-contract text; fixed in-PR); `#2608` updated, re-reviewed SHIP with its three consistency points fixed in-PR, proving. Ten remain: `#2608`, `#2610`, `#2587`, `#2532`, `#2550`, `#2535`, `#2684`, `#2687`, `#2522` then `#2531`. Second-pass ruling q-24 = B: after `#2687` merges only the no-publish preview rehearsal runs; the `v0.2.0` re-dispatch is not run.)* *(**Ticked 2026-09-06, all twelve merged** — the last two the same afternoon: `#2687` `d69beedd7` and `#2531` `c4cca76b0`; per-PR heads, re-review outcomes and the re-proof interpretation are recorded on `#2337` and in the twenty-first `docs/STATUS.md` block; the `v0.3.0` preview rehearsal failed closed as designed and is recorded on `#2250`.)* +- [x] **SC-10 — control-plane PRs awaiting the maintainer's review (ADR-0066 amendment 2026-09-03).** The amendment says control-plane (T0/T2) and runner changes merge only after the maintainer's review plus the fresh-context review. Queued by the 2026-09-04 overnight orchestrator, each already reviewed clean by a fresh-context agent and proven hosted at its head **against the base as of that PR's last hosted run, not against today's `main`** (measured 2026-09-04 21:40Z: `#2502` is 138 commits behind `main`, `#2506` 102, `#2532` 72, `#2550` 46; branch protection is not strict, so GitHub reports them `CLEAN` regardless, and a base change counts as a head change under the global laws). Each therefore needs `gh pr update-branch` plus a fresh hosted run and a re-check of its review against the moved base immediately before merge, `#2502` above all because it rewrites `uses:` refs across 34 workflow files; the update-branch runs were deliberately not spent in advance because `main` will move again before the maintainer arrives: `#2502` (CI-11 slice 1: 152 external actions pinned to full SHAs, guard enforced in `smart-ci-self-test.yml`; SC-5 command in the body), `#2506` (Smart CI planner: accept a merge ref regenerated against the live base tip — closes the shadow false-red shape seen on `#2485`, `#2496`, `#2500`; its last review round, 03:55:47Z, predates the current head `e1e80d579`, which is a 04:07:34Z merge of `main` touching none of the PR's own six files, so the review still covers the content and only the record is ambiguous), `#2532` (release-cache scanner comment handling, CI-09), and `#2550` (register the Paper colour-audit scanner test in `reusable-paper-color-audit.yml`; `#2504`, fresh-context review posted on the PR). **`#2522` (dev-up port release, `#1898`) is queued and was conflicting for most of 2026-09-04** after two dev-up commits landed on `main` (`8c0779fca`, `6c10850e6`); its head `18d214ba2` merged `main` and resolved that, and the hosted run at that head (`33922229492`) showed two Windows reds diagnosed on the PR as `#2378` (Frontend Unit launcher timeout) and `#2572` (a fixed-delay `WorkerResilienceTests` assertion, seeded from that run), neither in the PR's own files. It still needs `gh pr update-branch` and a fresh hosted run before a maintainer review of it means anything; the reconciliation session that carried it has closed, so the beta lane holds it behind its own queue. Two further open PRs touch control paths and were not in the queue above when it was written; both now carry a first fresh-context review (posted 2026-09-04 by the open-PR reconciliation session) but are not merge-ready: `#2531` (localized `netstat` state, `#2526` — stacked on `#2522` by design; review verdict FIX-FIRST because the fallback stopped discriminating on socket state; its advisory `Smart CI / Required Gate` is red on the stacked-base planner defect `#2562`, not on its code; retarget with `gh pr edit 2531 --base main` only after the parent lands, and note that its `Closes #2526` currently registers **no closing reference at all**, because GitHub links closing issues only from PRs targeting the default branch — merging it against the stacked base would land the delta on the parent branch and leave `#2526` open with no record why, so confirm `baseRefName == main` and a non-empty `closingIssuesReferences` before merging) and `#2535` (frontend telemetry build version, `#2182` — touches `release-container.yml`, `release-desktop.yml` and `scripts/ci/`; review verdict SHIP on the code, parked here as T2; its earlier `Frontend Unit (windows-latest)` red was the `#2378` / `#2161` timeout class, and at 21:48Z on 2026-09-04 its head `42c07fdb7` showed no failing check). Also decide the CI-07 `#2331` proposal (move the Windows launcher regression suite off the required hosted `windows-latest` leg per SC-3). **Post-hoc disclosure:** `#2479` (Paper colour-audit scanner, touches `reusable-paper-color-audit.yml`) was merged on 2026-09-04 at 03:58:46Z (merge `e99832f3c`) with the fresh-context review but without the maintainer's review — please review post hoc; revert is a one-liner if wanted. **Post-hoc disclosure (2):** `#2529` (merge `b461be49f`, docs-only, `docs/STATUS.md` alone) merged on 2026-09-04 at 06:33:08Z while its `ci-required.yml` run (`33842570671`, head `62f21d847`) had concluded `cancelled`, not success: the `Frontend Unit (windows-latest)` leg hit its 20-minute budget and was never re-run, and the merge landed 2 min 38 s after the run's final update at 06:30:30Z. Branch protection did not stop it and could not have: only the three security contexts are required, so the `ci-required` red is agent-enforced only. No revert appears warranted (a STATUS-only change cannot affect frontend tests, and `main` is green on that leg again at `#2559`, run `33886539482`), but a red required gate was treated as non-blocking, which global law 1 forbids; the call on any further action stays yours. The reconciliation sweep of the 40 PRs merged up to `#2559` found no other non-success `ci-required` run on a merged PR head (a separate red `main` push run of the same `#2378` shape at `17e48815e` is recorded in the eighth `docs/STATUS.md` block and back-referenced by the ninth). Belongs to the Windows-timeout cohort `#2378` / `#2161` / `#2159`. **Post-hoc disclosure (3):** `#2548` (merge `f094d090a`) and `#2556` (merge `b8878c922`), both `scripts/ci/dev-up.test.mjs`, and `#2549` (merge `e0516ca9d`, the Stryker v10 bump in `frontend/taskdeck-web/package.json` plus its lockfile) touch declared `ci/policy.v1.json` control paths and merged on 2026-09-04 on a fresh-context review alone, without the maintainer's review; `#2548` merged after its own review-gate comment had declared it parked for the maintainer, with no reversal on the thread, which is the exact behaviour the amendment exists to prevent. They are recorded in the tenth `docs/STATUS.md` block and are listed here so they sit in the same queue as `#2479`. All three are low blast radius (two test-only edits and a devDependency bump), so post-hoc review rather than revert is suggested; as with `#2479`, revert is yours to choose. Nothing was lost: measured 2026-09-04, all 80 head and merge SHAs of the 40 most recently merged PRs are ancestors of `origin/main`. Disclosures (2) and (3) were measured by the open-PR reconciliation session on 2026-09-04 and re-verified against the Actions API and the PR file lists before being recorded here. **Added 2026-09-05:** `#2587` (CI-10 slice 1, the Smart CI nightly coordinator `scripts/ci/smart-ci/nightly-coordinator.mjs` plus its tests, head `929331247`; two new files, no workflow, policy or doc edits; fresh-context review round 1 FIX-FIRST on a needs-closure HIGH, fixed, round 2 SHIP; seven non-blocking findings recorded on the PR and on `#2334`) is queued for your review and left unmerged by the beta lane. Two more joined on 2026-09-05: `#2608` (CI-07 slice under `#2331`, head `f74f590a0`: `if: runner.os == 'Linux'` on the launcher regression suite step in `reusable-frontend-unit.yml`, a placement contract test under `scripts/ci/smart-ci/`, a `TESTING_GUIDE.md` paragraph; fresh-context review SHIP, no fix round; **it is also `#2378`'s disposition**: the beta lane measured two hosted Windows launcher-suite logs on 2026-09-05 (p50 about 3 s, p90 13 to 15 s, slowest 26 to 31 s; the cases that hit `spawnSync ETIMEDOUT` take 1 to 8 s on a green run, so a 20 s clip means the runner is 3 to 5 times slower and the whole suite would land at 16 to 30 minutes against the job's 20 minute ceiling), so a larger per-spawn budget would only move the failure to a job cancellation, and every recorded `#2378` occurrence is on the Windows leg that `#2608` removes from hosted runs; three consistency points recorded on the PR for your ruling, because `ci/policy.v1.json`'s `launchers-windows` group, cutover checklist section E, `SMART_CI.md` section 5 and the `ci-required.yml` header map still state the pre-SC-3 two-leg target) and `#2610` (`#2582`, head `0fc8fb257`: `cancel-in-progress` becomes `github.ref != 'refs/heads/main'` in `ci-required.yml` with the group key unchanged, plus a four-assertion contract test in the Planner Self-Test glob; fresh-context review SHIP, no fix round; one precision point for your ruling, recorded on the PR and on `#2582`: GitHub keeps one in-progress plus one pending run per group, so this guarantees the in-flight `main` run completes and the tip runs after a wave, not a completed run per landed commit; a per-SHA group is the one-line alternative if CI-03's landed-commit verifier needs one run per merge). Both are parked unmerged by the beta lane. A fourth from the same lane joined at 11:19Z on 2026-09-05: `#2684` (`#2250` items 4 and 5, head `6150eb1a5`: fence-aware `UPGRADING.md` extraction that fails closed on an unterminated fence instead of publishing older versions' notes, bare anchors and relative links in the lifted section rewritten to `blob/` URLs, the 53-test composer suite wired into `ci-required.yml`'s release-workflow-contract job, the release trust doc's layout section updated; two fresh-context rounds, both SHIP; residuals on the PR and on `#2250`; parked unmerged). A fifth followed at 12:00Z: `#2687` (`#2250` items 1 to 3, head `64cd68f58`: a `preview_tag` workflow-dispatch input that renders the real stable page on a no-publish rehearsal and is refused before any build on a publishing dispatch; the page renderer runs from the workflow revision's own checkout so a pre-0.3 tag can be re-dispatched; the changelog base becomes the newest stable release strictly before the target by semver, via `scripts/ci/select-changelog-base.mjs` with 17 tests wired into `ci-required.yml`; two fresh-context rounds, both SHIP; hosted Workflow Lint and Release Workflow Contract green at `6b591ebed`; parked unmerged). Proving `#2687` end to end is yours: one rehearsal dispatch with `preview_tag` set and one re-dispatch of `v0.2.0`. With `#2684` and `#2687` parked, every `#2250` item sits in a parked PR. *(**Ruled 2026-09-06, 2026-09-06 guided-walkthrough reply q-1 = A, delegate all twelve:** the coordinator runs `gh pr update-branch`, a fresh hosted run at the new head, a fresh-context re-review wherever `main` touched the PR's own files **or anything they read or execute** (shared `scripts/ci/smart-ci/**` libraries, `ci/policy.v1.json`, reusable workflows the PR's workflow calls) since its last review, measured per PR before merge; a base change counts as a head change, so the hosted run is always re-proven, and merges in dependency order: `#2506` first, then `#2502`, `#2522` then `#2531` retargeted to `main` with a non-empty closing reference confirmed, then the rest; the maintainer reviews post hoc. **q-2 = A:** the five post-hoc merges `#2479`, `#2529`, `#2548`, `#2549`, `#2556` are acknowledged, no revert. `#2687`'s no-publish rehearsal dispatch (`preview_tag` set) is run by the coordinator after merge; a `v0.2.0` re-dispatch publishes and stays the maintainer's. Progress lands in the next `docs/STATUS.md` block; this row closes when the twelve are merged.)* *(**Progress 2026-09-06:** `#2506` merged `79d7efdb7`; `#2502` merged `e0a824187` after a re-review against the moved base caught a HIGH (the pin broke the Stryker workflow-contract text; fixed in-PR); `#2608` updated, re-reviewed SHIP with its three consistency points fixed in-PR, proving. Ten remain: `#2608`, `#2610`, `#2587`, `#2532`, `#2550`, `#2535`, `#2684`, `#2687`, `#2522` then `#2531`. Second-pass ruling q-24 = B: after `#2687` merges only the no-publish preview rehearsal runs; the `v0.2.0` re-dispatch is not run.)* *(**Ticked 2026-09-06, all twelve merged** — the last two the same afternoon: `#2687` `d69beedd7` and `#2531` `c4cca76b0`; per-PR heads, re-review outcomes and the re-proof interpretation are recorded on `#2337` and in the twenty-first `docs/STATUS.md` block; the `v0.3.0` preview rehearsal failed closed as designed and the `v0.3.0-rc.1` preview rendered the real RC page, both recorded on `#2250`. The maintainer's post-hoc review of the twelve remains theirs; the list with heads and merge SHAs is on `#2337`.)* - [x] **SC-11 — enable `delete_branch_on_merge`, then batch-delete the merged-PR heads (repository setting; maintainer-only).** Measured 2026-09-04: the repository has `delete_branch_on_merge: false`, and 448 remote branches exist, of which (per the 2026-09-04 branch-hygiene sweep) about 399 are heads of already-merged PRs, 24 belong to closed-unmerged PRs and 11 never had a PR, the oldest from 2026-07-25. Parked work such as `origin/issue-1961/dedupe-board-fetch` (tip `08be057c5`, never a PR) is invisible in that noise, and the merge-then-fix cascades this week each left another head behind. Repository-settings mutations sit outside agent authority (`.agent-harness/tier.json`), so the flip is yours. The one-time sweep of existing branches is a separate decision: it is destructive, agents do not run it unasked (as with SC-2), and it needs its own recorded maintainer authorization. Under that authorization an agent may delete merged-PR heads only, and only a tip that is proven an ancestor of `origin/main` immediately before deletion (a merged branch that received a later commit is skipped and listed); it must exclude every open-PR head and every branch that is the base of any open PR (global law 4: deleting a stacked base cascade-closes its children unreopenably; `issue-1898/port-release-deadline` while `#2531` targets it is the current example); and it must list the closed-unmerged, no-PR and otherwise unclassified branches (the three counted classes sum to 434 of the 448) for a separate decision rather than deleting them. Re-measured 2026-09-05 15:15Z: 553 remote branches, 539 without an open PR; `delete_branch_on_merge` is still `false`, so the thirty-one Codex-session heads merged under D-12 all persist. *(**Ruled 2026-09-06, 2026-09-06 guided-walkthrough reply q-3 = A:** the maintainer flips `delete_branch_on_merge` (Settings → General → Pull Requests → "Automatically delete head branches", or `gh api -X PATCH repos/Chris0Jeky/Taskdeck -F delete_branch_on_merge=true`); the one-time sweep is **authorized** under the rules above: merged-PR heads only, each tip proven an ancestor of `origin/main` immediately before deletion, every open-PR head and every open-PR base excluded, the closed-unmerged, no-PR and unclassified branches listed for a separate decision. Sweep evidence lands on `#2337`; the row closes when the setting reads `true` and the sweep report is recorded.)* *(**Ticked 2026-09-06:** the sweep ran the same day — 465 merged-PR heads deleted in 12 `git push --delete` batches, 0 failures, 45 merged-but-diverged, 27 closed-unmerged and 11 never-a-PR branches listed on `#2337` for a separate decision, remote heads 573 → 108 — and the maintainer flipped the setting in the second walkthrough pass (q-27; agent read `delete_branch_on_merge: true` at 11:2xZ).)* --- diff --git a/docs/STATUS.md b/docs/STATUS.md index f67cb58d0..4fc767654 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -871,7 +871,7 @@ Codex-session batch (all `Refs`; no issue auto-closed; each issue carries a coor Corrections to earlier blocks: the `#2708` "unclaimed lane backlog" line (`docs/STATUS.md:403`) is superseded by `#2715` above; `docs/releases/V0_3_0_READINESS.md:128` names a test `#2716` renamed. -v0.3 integration wave, twenty-first block (2026-09-06, `main` `478fd7169`, the twentieth block's last merge, to `c4cca76b0`; written by the coordinator, no lane session in the range). The SC-10 chain the maintainer delegated in the morning walkthrough ran to completion under one rule, stated here because the twentieth block's wording ("the hosted run is always re-proven") was stricter than what was done: every control-plane PR got one `gh pr update-branch` and one green hosted run at that head immediately before its turn, plus a fresh-context re-review whenever `main` had touched the PR's own files or anything they read since its last review; an unrelated merge landing on `main` after that run (a Codex test file, a docs page) did not restart the run. A second Codex-session batch (`#2732`–`#2758`) arrived during the chain and was carried under the standing D-12 route between control-plane steps. +v0.3 integration wave, twenty-first block (2026-09-06, `main` `478fd7169`, the twentieth block's last merge, to `c4cca76b0`; written by the coordinator, no lane session in the range). The SC-10 chain the maintainer delegated in the morning walkthrough ran to completion under one rule, stated here because the SC-10 row's annotation in `OUTSTANDING_TASKS.md` ("the hosted run is always re-proven", the coordinator's recording of the delegation after the `#2728` review asked for a wider criterion, not the maintainer's own words) was stricter than what was done: every control-plane PR got one `gh pr update-branch` and one green hosted run at that head immediately before its turn, plus a fresh-context re-review whenever `main` had touched the PR's own files or anything they read since its last review; an unrelated merge landing on `main` after that run (a Codex test file, a docs page) did not restart the run. A second Codex-session batch (`#2732`–`#2758`) arrived during the chain and was carried under the standing D-12 route between control-plane steps. Control plane (SC-10, all merged under the delegation; the row in `OUTSTANDING_TASKS.md` closes with `#2531`): - **The frontend launcher regression suite runs on the Linux hosted leg only (`#2608`, CI-07 under `#2331`, merge `f219c955f`; Refs `#2378`).** `#2378`'s disposition: every recorded occurrence was on the Windows leg this removes from hosted runs; the re-review's three consistency points (the `ci-required.yml` header map, the `ci/policy.v1.json` `frontend-unit-windows` description, `SMART_CI.md` section 5) were fixed in-PR; the `launchers-windows` routing group stays as a CI-03/CI-08 follow-up recorded on the PR. @@ -881,7 +881,7 @@ Control plane (SC-10, all merged under the delegation; the row in `OUTSTANDING_T - **Frontend telemetry carries the build-stamped version (`#2535`, merge `f6ec8f9c0`; Refs `#2182`).** `VITE_APP_VERSION` is plumbed through `release-container.yml`, `release-desktop.yml` and both Dockerfiles; `0.0.0-dev` elsewhere. Re-review against the moved base SHIP; LOWs on the PR (`CONFIGURATION_REFERENCE.md:106` still says "Injection: none" for the rehearsal container build; the normalized version is derived twice in release-desktop with no agreement test). - **`UPGRADING.md` extraction is fence-aware and fails closed; anchors and relative links rewrite to `blob/`; the composer suite runs in `ci-required` (`#2684`, `#2250` items 4 and 5, merge `b34df45b1`).** Re-review SHIP; residuals on `#2250` (the `release-desktop.yml:678-680` step comment still says an RC "warns and falls back"; the ops doc's RC wording holds only for a fence opened at or after the tag heading; `compose-release-notes.test.mjs` reads the real `UPGRADING.md`, so a future unterminated fence there reds every PR by design). - **dev-up decides port release on socket existence (`#2522`, merge `276521d76`; Refs `#1898`).** The Codex session had merged `main` into it at 06:44Z; updated again and green. -- **Release Desktop dispatch gains a render-only `preview_tag`, a tooling checkout from the workflow's own revision, and a semver-ordered changelog base (`#2687`, `#2250` items 1 to 3, merge `d69beedd7`).** Updated with three additive conflict resolutions against `#2535`'s `version` output; the CI-11 guard caught the branch's pre-pin `actions/checkout@v7` tooling checkout (pinned in-PR); re-review against the moved base SHIP with MERGE-LOSSES none. **Every `#2250` item is now merged.** The no-publish preview rehearsal on `main` with `preview_tag=v0.3.0` (run 34038082785) built the archive and then **failed closed at Compose Release Notes** with the named missing inputs (no `## v0.3.0` in `UPGRADING.md`, no `docs/releases/notes/v0.3.0.md`), Create GitHub Release skipped: the stable-page policy proved on the real composer, nothing published. No v0.2.0 curated notes exist, so no v0.2.0 stable page can render (q-24 = B: the publishing re-dispatch is not run); a second preview with `v0.3.0-rc.1`, the one tag carrying curated notes, was dispatched to prove the positive path and is recorded on `#2250`. +- **Release Desktop dispatch gains a render-only `preview_tag`, a tooling checkout from the workflow's own revision, and a semver-ordered changelog base (`#2687`, `#2250` items 1 to 3, merge `d69beedd7`).** Updated with three additive conflict resolutions against `#2535`'s `version` output; the CI-11 guard caught the branch's pre-pin `actions/checkout@v7` tooling checkout (pinned in-PR); re-review against the moved base SHIP with MERGE-LOSSES none. **Every `#2250` item is now merged.** The no-publish preview rehearsal on `main` with `preview_tag=v0.3.0` (run 34038082785) built the archive and then **failed closed at Compose Release Notes** with the named missing inputs (no `## v0.3.0` in `UPGRADING.md`, no `docs/releases/notes/v0.3.0.md`), Create GitHub Release skipped: the stable-page policy proved on the real composer, nothing published. No v0.2.0 curated notes exist, so no v0.2.0 stable page can render (q-24 = B: the publishing re-dispatch is not run); a second preview with `v0.3.0-rc.1`, the one tag carrying curated notes, then **rendered the real RC page end to end** (run 34038530375: Compose Release Notes success, Create GitHub Release skipped), so both halves of item 1 are proved on the real composer; recorded on `#2250`. - **The dev-up port-release fallback identifies a listener by its wildcard foreign address, in every netstat locale (`#2531`, merge `c4cca76b0`; Closes `#2526`).** Retargeted from the `#2522` stack to `main` (closing reference confirmed), updated; the 2026-09-04 FIX-FIRST (the localized-state guard accepted any non-empty state, so drained TIME_WAIT rows counted as listeners, fail-closed) was confirmed on re-review and fixed by the coordinator with a wildcard-peer discriminator in both twins plus a drained-only negative fixture in the Bash harness; the scoped verification pass found and the coordinator fixed one more fail-open (BSD dual-stack `tcp46` rows were rejected). The hosted `Frontend Unit (ubuntu-latest)` red at the first fix head was a Node-helper bind timeout untouched by the PR, green on the next head. Codex-session batch two (`#2732`–`#2758`, all `Refs`; records on each PR, dispositions on each issue; MEDIUM+ fixed in-PR by the coordinator where noted):