[WRONG BRANCH] Promote dev to main: Wave 5 campaign (107 commits)

devlog/_plan/260817_wave5_execution/000_research.md

@@ -0,0 +1,62 @@
+# 260817 Wave 5 execution — research and Gate 0 baseline
+
+Campaign: execute the Wave 5A/5B/5C/5D + Wave 6 roadmap produced by the
+2026-08-17 external audit, landing each item on `dev`, then promoting to
+`preview` and `main`.
+
+## Gate 0 baseline (verified 2026-08-17)
+
+| Fact | Value | Evidence |
+|------|-------|----------|
+| local `dev` head | `1208bd25c` | `git rev-parse HEAD` after `--ff-only origin/dev` (44 commits fast-forwarded) |
+| #1881 merge ancestry | present | `git merge-base --is-ancestor bb984ad47 HEAD` → exit 0 |
+| #1909 ancestry | present | `b1708acc4 Merge pull request #1909` reachable |
+| stable release | v2.24.2 | `origin/main` = `474584bcd Merge pull request #1914 from lidge-jun/release-2.24.2` |
+| working tree | clean | `git status --porcelain` empty |
+
+## Roadmap PR inventory at exact head
+
+| PR | head | draft | review | checks | Wave |
+|----|------|-------|--------|--------|------|
+| #1899 | `8ab0aa8d0` | no | REVIEW_REQUIRED | 15 success | 5A |
+| #1876 | `d5acd7414` | no | CHANGES_REQUESTED | 22 success, 1 skipped | 5A |
+| #1888 | `cd3367193` | no | CHANGES_REQUESTED | 10 success | 5B |
+| #1902 | `b8983c912` | no | REVIEW_REQUIRED | 10 success | 5B |
+| #1884 | `99b0bbc38` | no | REVIEW_REQUIRED | 25 success | 5B |
+| #1892 | `6b17d6233` | no | REVIEW_REQUIRED | 9 success | 5B |
+| #1904 | `c603dcd83` | yes | REVIEW_REQUIRED | 6 success, 1 cancelled | 5B |
+| #1898 | `7279aca7c` | yes | REVIEW_REQUIRED | 21 success, 1 cancelled | 5B |
+| #1900 | `1824a0148` | no | REVIEW_REQUIRED | 10 success | 5C |
+| #1895 | `8a4040384` | yes | CHANGES_REQUESTED | 12 success | 5C |
+| #1887 | `ed4e87753` | yes | REVIEW_REQUIRED | 4 success | 5C |
+| #1896 | `5d2aec482` | yes | REVIEW_REQUIRED | 7 success | 5C |
+| #1903 | `54893ca6e` | no | REVIEW_REQUIRED | 10 success | 5C |
+| #1889 | `ea64418a3` | yes | REVIEW_REQUIRED | **5 failure**, 6 success | 5D |
+| #1891 | `10b88e155` | no | REVIEW_REQUIRED | 14 success | 5D |
+| #1897 | `38c25aed8` | no | REVIEW_REQUIRED | 24 success, 1 cancelled | 5D |
+
+## Correction to the external audit (P-phase finding)
+
+The audit's #1894 remedy — "split direct Google mapping from Antigravity CCA
+mapping" — describes a separation the tree **already has**:
+
+- `src/adapters/google.ts` owns `GEMINI_DIRECT_WIRE_RENAMES` /
+  `resolveDirectGeminiWireModelId()` for the direct AI Studio path.
+- `src/providers/antigravity-models.ts` owns `GEMINI_FLASH_WIRE_ID` /
+  `ANTIGRAVITY_MODEL_ALIASES` for the CCA path.
+- `src/adapters/google.ts:395-399` already branches on provider family before
+  choosing a resolver.
+
+So the real defect is not a shared alias table. It is that
+`GEMINI_DIRECT_WIRE_RENAMES` is an **unconditional** rename applied to every
+direct Google deployment, while the rename is only true for some of them.
+Commit `a70bb78d4` added it from a live capture where bare ids 404'd and
+`-tiered` returned 200; #1894 reports the exact opposite from another account
+on the same day. Both reporters are credible and neither is universal.
+
+PR #1739 already implements the correct shape: a provider-level
+`directGeminiWireRenames` boolean, defaulting to today's behavior. That makes
+the deployment difference configurable but still ships a default that 404s for
+the #1894 reporter.
+
+Wave-5 decision: the default must stop guessing. See `010`.

devlog/_plan/260817_wave5_execution/001_audit_synthesis.md

@@ -0,0 +1,52 @@
+# A-phase synthesis — round 1 (VERDICT: FAIL, 9 blockers)
+
+An independent reviewer audited `000`-`090` against the tree at `1208bd25c`
+and live GitHub state. Verdict FAIL. Every blocker was re-verified by the main
+agent before disposition; all nine are accepted.
+
+## Accepted blockers and their amendments
+
+| # | Blocker | Disposition |
+|---|---------|-------------|
+| 1 | WP1's 404 retry has no host: AI Studio installs no `fetchResponse` (`google.ts:384`), so the adapter never sees a `Response`; the fetch is core-owned (`core.ts:3586`) | **Folded** — retry dropped entirely |
+| 2 | The retry is only safe in the pre-stream `recovery:` loop (`core.ts:3696`); the terminal-guard continuation (`core.ts:3960`) refetches mid-stream and would splice two upstream turns into one client stream | **Folded** — dropped; discovery replaces it |
+| 3 | Memo key `(provider, model)` is too coarse and could silently override an explicit operator `false` | **Folded** — identity-keyed, and config always wins |
+| 4 | #1739 is mis-scoped: real head `e1c7ec85e`, state CHANGES_REQUESTED/BLOCKED, and its diff also changes `messagesToGeminiFormat`'s identity argument — the subject of the open review finding | **Folded** — `010` rewritten with the real head and the identity change in the file map |
+| 5 | WP2 is not implementable for 2 of 3 files: no effects recorder in `dsh-writer-lock.test.ts` or `native-main-claim.test.ts`, both already carry #1881's guards, and #1899 is CONFLICTING/DIRTY | **Folded** — WP2 narrowed to one file; #1899 reclassified |
+| 6 | WP3's sentinel already exists (`app-server-processes.ts:372/377/392`) and `unknown` already exists (line 574); the plan described shipped work | **Folded** — WP3 narrowed to the one real gap |
+| 7 | WP4's durability fix targets `google-antigravity-replay.ts`, which never calls the remember API; the seam is `thought-signature-replay.ts:190` and already returns `durable` | **Folded** — retargeted, with a caller-discovery step |
+| 8 | WP4's key change silently invalidates the persisted store (`version: 2` at line 143 is keyed by `keyFor` output) | **Folded** — explicit version bump + migration decision |
+| 9 | Wave 5C has no rebase plan for `src/adapters/cursor/live-transport.ts`, which four PRs modify | **Folded** — rebase-and-recheck step added |
+
+## Accepted medium findings
+
+- 5B's ordering rationale was false: #1904 already bundles #1892's characterization
+  tests verbatim (identical blob). Order kept, rationale corrected, rebase noted.
+- 5D should run `#1891 -> #1897 -> #1889`; the original order put the only
+  red-CI PR first and held the train hostage to it.
+- `080` had two state facts inverted: **#1836 is already CLOSED** and
+  **#1906 is OPEN (reopened)** — both verified via `gh`.
+- `git merge-base --is-ancestor` cannot verify merge *order*; once both are on
+  `dev` each is an ancestor of the tip. Use `git rev-list --topo-order --first-parent`.
+- `bun run test` already runs `bun test --isolate` (`scripts/test.ts:144`), so
+  `090` presented one command as two.
+
+## The finding that changes the campaign shape
+
+Blocker 2 is the important one. The proposed 404-triggered retry was the only
+*new* production mechanism in Wave 5A, and it cannot be built where the plan put
+it without either (a) touching the shared core recovery loop — which `AGENTS.md`
+gates behind the full suite — or (b) risking a mid-stream splice.
+
+The alternative is strictly better: the repo **already** lists models per
+account (`src/oauth/index.ts:811`, `/v1beta/models?pageSize=1000`). Reading what
+the account actually advertises beats inferring from a 404, needs no request
+replay, and cannot distort the attempt log. The retry is dropped.
+
+## Verified-correct plan claims (kept unchanged)
+
+- The #1894 separation finding in `000` is confirmed real; the external audit's
+  "split the tables" remedy is confirmed a no-op.
+- WP4's key-completeness finding is confirmed exactly right: `keyFor` uses 5
+  fields where the sibling `reasoning-replay-cache.ts:65` uses 7.
+- WP3's two review blockers are confirmed live on #1876's head.

devlog/_plan/260817_wave5_execution/002_merge_order_corrections.md

@@ -0,0 +1,61 @@
+# Merge-order corrections (folds blocker 9 + medium findings)
+
+Amends `060`, `070`, `080`, `090` after the round-1 audit. Read alongside them.
+
+## Verifying merge ORDER (correction to 060 and 090)
+
+`git merge-base --is-ancestor` cannot verify order: once both PRs are on `dev`,
+each is an ancestor of the tip regardless of which merged first. Use
+`git rev-list --topo-order --first-parent dev` and compare merge-commit positions.
+
+## Wave 5B (060)
+
+Order `#1888 -> #1902 -> #1884 -> #1892 -> #1904 -> #1898` is kept, but the stated
+rationale was wrong. #1892 and #1904 both add the same two
+`fastwire-characterization-*.test.ts` files as **byte-identical blobs** — #1904
+already bundles the characterization suite. So "#1904 without #1892 has no
+baseline" is false.
+
+The real consequence: after whichever lands first, the other is an add/add conflict
+or a no-op. Add an explicit rebase step between them and verify the surviving test
+file once, rather than assuming both apply cleanly.
+
+## Wave 5C (070) — the conflict surface
+
+`src/adapters/cursor/live-transport.ts` is modified by **four** PRs in one train:
+#1900, #1887, #1896, #1903. Further overlaps:
+
+| Pair | Shared files |
+|------|--------------|
+| #1900 ∩ #1895 | `tool-definitions.ts` + its test |
+| #1900 ∩ #1896 | `src/responses/parser.ts` |
+| #1900 ∩ #1903 | `live-models.ts`, `cursor-hardening.test.ts` |
+| #1887 ∩ #1896 | five `native-exec*.ts` files |
+| #1887 ∩ #1903 | two docs files |
+
+Every merge after the first will conflict textually. Mandatory per merge:
+rebase onto the new `dev`, re-run the focused Cursor suite, and only then merge the
+next. The #1887/#1896 consolidation removes one of the four, which is an additional
+reason to do it before #1903.
+
+## Wave 5D (080) — reorder, and two inverted facts
+
+Corrected order: **`#1891 -> #1897 -> #1889`**.
+
+#1889 and #1891 both rewrite `src/adapters/client-fingerprint.ts` and its test, so
+they conflict either way — and #1889 is the only PR in the campaign with red CI
+(5 failing checks). Putting it first holds the whole train hostage to it.
+
+State corrections, both verified with `gh`:
+
+- **#1836 is already CLOSED.** `080`'s "close as superseded" is a no-op; the only
+  remaining question is whether its unique tests were migrated.
+- **#1906 is OPEN (reopened).** `080` said it stays closed. Whether it should be
+  closed depends on the undocumented-`v1internal` policy decision, which belongs
+  to the user (see `090`).
+
+## Wave 6 (090)
+
+`bun run test` already runs `bun test --isolate` (`scripts/test.ts:144`), so the
+two commands `090` distinguished are one command. The remote-execution preference
+for the full suite stands on its own.

devlog/_plan/260817_wave5_execution/010_1894_gemini_wire_id.md

@@ -0,0 +1,90 @@
+# WP1 — #1894 direct Gemini wire id (Wave 5A-1) — rev 2 after audit
+
+> Rev 2 folds audit blockers 1-4. The 404-triggered retry proposed in rev 1 is
+> **dropped**: AI Studio installs no `fetchResponse` (`src/adapters/google.ts:384`),
+> so the adapter can never observe the 404; the only hosts are the core pre-stream
+> recovery loop or the mid-stream terminal guard, and the latter would splice two
+> upstream turns into one client stream.
+
+## Defect
+
+`GEMINI_DIRECT_WIRE_RENAMES` (src/adapters/google.ts:58-61) unconditionally
+rewrites `gemini-3.7-flash` -> `gemini-3.7-flash-tiered` for every direct Google
+deployment. Two live captures disagree:
+
+- `a70bb78d4` (2026-08-14): bare 404s, `-tiered` 200s.
+- #1894 (2026-08-16): bare 200s, `-tiered` 404s, `models.list` has no `-tiered` row.
+
+Neither reporter is wrong; the spelling differs per account/rollout. A static
+default therefore breaks one population whichever value it takes.
+
+## Decision (rev 2)
+
+**Land #1739 only.** It is the whole of WP1's production change. No new
+mechanism ships in this work-phase.
+
+#1739 real state: head `e1c7ec85e`, OPEN, `MERGEABLE/BLOCKED`,
+`reviewDecision=CHANGES_REQUESTED`. Its diff is larger than rev 1 recorded:
+
+| #1739 change | Note |
+|---|---|
+| `resolveDirectGeminiWireModelId(modelId, applyRenames)` | the config gate |
+| new `googleMode === "vertex" ? parsed.modelId` branch | Vertex keeps requested identity |
+| `messagesToGeminiFormat(parsed, identityModelId)` signature change | **the open review finding** |
+| `identityModelId` split for CCA vs direct | stops the `-tiered` wire spelling leaking into the model identity line |
+
+The identity split is a real second bug fix — without it the system prompt tells
+the model it is `gemini-3.7-flash-tiered`. The open reviewer finding is that the
+fix is applied too broadly across Google modes; that must be resolved before
+landing, not merged as-is.
+
+## Deferred to its own work-phase: discovery-resolved spelling
+
+The durable fix is to stop guessing and read what the account advertises.
+`src/oauth/index.ts:811` already issues `/v1beta/models?pageSize=1000` per
+provider. A later work-phase can resolve the wire spelling from that listing,
+keyed on destination + credential identity exactly as
+`src/responses/reasoning-replay-cache.ts:65` does, with an explicit
+`directGeminiWireRenames` value always winning over any inferred spelling.
+That is a separate PABCD cycle, not a rider on #1739.
+
+## File change map (WP1 as executed)
+
+| File | Change |
+|------|--------|
+| `src/types.ts` | `directGeminiWireRenames?: boolean` (from #1739) |
+| `src/config.ts` | zod boolean + round-trip incl. explicit `false` (from #1739) |
+| `src/adapters/google.ts` | config gate, Vertex identity branch, `identityModelId` split (from #1739, review finding resolved) |
+| `tests/config.test.ts` | persisted `false` round-trip; non-boolean rejected (from #1739) |
+| `tests/google-adapter.test.ts` | default/true/false wire ids; CCA unaffected; identity line uses the base id (from #1739) |
+| `docs-site/.../providers.md` | document the setting (from #1739) |
+
+## Scope boundary
+
+IN: direct AI Studio wire id resolution and the identity string derived from it.
+OUT: any new retry/recovery mechanism; `src/server/responses/core.ts`;
+Antigravity/CCA resolution; picker/catalog/usage/price keys (all stay on the base id).
+
+## Accept criteria (with activation)
+
+1. Default (setting absent) sends the `-tiered` id.
+   *Activation:* `buildRequest` on a default provider; assert the URL path.
+2. `directGeminiWireRenames: false` sends the bare id.
+   *Activation:* adapter built with the flag false; assert the URL path.
+3. The system-instruction identity names the base id, never the `-tiered` spelling.
+   *Activation:* parse the built body `systemInstruction.parts[0].text` and assert
+   it contains `powered by the gemini-3.7-flash` and NOT `-tiered`.
+4. Cloud Code Assist request paths are unchanged by the flag.
+   *Activation:* build with `googleMode: cloud-code-assist` and both flag values.
+5. Config round-trips an explicit `false`; a non-boolean is rejected to fallback.
+
+Verifier: `bun test tests/google-adapter.test.ts tests/config.test.ts tests/gemini-37-flash-migration.test.ts`
+— all three exist and read the change target.
+
+## Closure
+
+#1894 gets the `bug` label (it is a real regression, currently labeled
+`provider-compatibility,provider` only). It closes only once #1739 is on
+`origin/dev` with 1-5 green. Because the default still favors the `-tiered`
+population, the closing comment must tell the #1894 reporter to set
+`directGeminiWireRenames: false` — closing silently would leave them broken.

devlog/_plan/260817_wave5_execution/020_1899_harden_ordering.md

@@ -0,0 +1,71 @@
+# WP2 — #1899 / harden-before-publish ordering (Wave 5A-2) — rev 2 after audit
+
+> Rev 2 folds blocker 5. Rev 1 named three test files; two of them have no
+> effects recorder to order, and both already carry #1881's guards on `dev`.
+
+## Real state of #1899
+
+`mergeable=CONFLICTING`, `mergeStateStatus=DIRTY`, head `8ab0aa8d0`. It conflicts
+precisely because #1881 already landed two of its three files:
+`tests/dsh-writer-lock.test.ts:173` already has the `existsSync` + win32 guard and
+`tests/native-main-claim.test.ts:174` already carries the POSIX-only guard.
+
+Its remaining unique value is one file: `tests/codex-catalog-writer.test.ts`,
+where `dev` still uses unbound `effects.some(...)` checks (lines 242-246) that
+would pass even if the harden and the publish touched different files. #1899
+binds all three effects to one temp path.
+
+## Correction to rev 1
+
+Rev 1 claimed the ordering assertion was #1899 residue. It is not: #1899 asserts
+set membership (`expect(effects).toContain(...)`), not index order. A writer that
+published first and hardened after still passes #1899's diff. Index ordering is
+therefore **new work**, and it is only implementable in the one file that has an
+ordered `effects` array (recorder at `tests/codex-catalog-writer.test.ts:60-95`).
+
+## File change map
+
+| File | Change |
+|------|--------|
+| `tests/codex-catalog-writer.test.ts` | adopt #1899's temp-path binding, then add `indexOf(harden) < indexOf(publish)` for that same temp path |
+
+Building effects recorders for the other two files is out of scope for Wave 5A;
+their Windows/POSIX split is already correct on `dev`.
+
+## Accept criteria
+
+1. The ordering assertion fails when harden and publish are swapped.
+   *Activation:* invert the order in a scratch edit, capture the red run, revert.
+2. `bun test tests/codex-catalog-writer.test.ts` green afterwards.
+3. No assertion duplicated from #1881.
+
+## Closure
+
+#1899 cannot merge as-is (CONFLICTING/DIRTY, head `8ab0aa8d0` — re-verified after a
+transient `UNKNOWN` reading). Land the one-file residue as a direct commit on `dev`,
+then close #1899 with a comment naming the commit, what was taken, and what #1881
+already covered.
+
+## Outcome (executed)
+
+DONE. Two commits on `tests/codex-catalog-writer.test.ts`:
+
+| Commit | Change |
+|--------|--------|
+| `fb5ceee35` | bind `temp:`/`harden:`/`publish:`\|`rename:` to one temp path; assert `hardenIndex < publishIndex` |
+| `50a057e20` | state the scope limit the review asked for |
+
+**Red proof.** Forcing the harden index above the publish index fails 4 of 9 tests;
+restoring returns all 9 to green. An independent reviewer reproduced this with two
+ablations on a scratch copy and found something the plan had not predicted: for the
+two backup mutators the index comparison is the **only** detector. `publishNoReplace`
+is `linkSync`, so a temp hardened after publication still shares the destination's
+inode — `chmod` succeeds, `statSync` reads `0o600`, the leftover-`.tmp` check passes,
+and every other assertion agrees nothing is wrong. Only the order disagrees.
+
+**Scope limit, now written into the test.** `io` is an injected seam, so what is
+asserted is production's call order (`src/config.ts:236`,
+`src/codex/internal/catalog-writer.ts:147` both run write → harden → publish).
+Supplying `io` bypasses `hardenSecretPath`, so this proves hardening is *requested*
+on the temp before publication, not that it restricts. The Windows NTFS ACL is
+covered in `tests/windows-secret-acl.test.ts`.