docs(plan): issue train 2026-09-30 delivery record

devlog/_plan/260930_issue_train/000_plan.md

@@ -1,6 +1,6 @@
 # Issue train 2026-09-30: dispatch verifier coverage, verifier effects, assumption provenance, decision options, release 0.2.40
 
-Codexclaw has one confirmed defect among its 20 open issues: a dispatch receipt can satisfy a packet that requires two verifier commands with one unrelated passing result (#276). Three contained improvements need no maintainer decision and add no hooks: optional verifier write-effect declarations with a pure preflight (#277), provenance for Interview assumptions so inferred ones are not handed to Plan as agreed requirements (#275), and the `options[]` half of goalplan decisions that #271 left out (#262). This unit fixes and ships those, records a decision for every open issue (001), closes the ones that would grow hooks or depend on host signals the plugin cannot see, and releases the result as 0.2.40 from `main`.
+Codexclaw has one confirmed defect among its 21 open issues: a dispatch receipt can satisfy a packet that requires two verifier commands with one unrelated passing result (#276). Three contained improvements need no maintainer decision and add no hooks: optional verifier write-effect declarations with a pure preflight (#277), provenance for Interview assumptions so inferred ones are not handed to Plan as agreed requirements (#275), and the `options[]` half of goalplan decisions that #271 left out (#262). This unit fixes and ships those, records a decision for every open issue (001), closes the ones that would grow hooks or depend on host signals the plugin cannot see, and releases the result as 0.2.40 from `main`.
 
 Reader: a maintainer deciding whether to merge these changes and publish 0.2.40; familiarity with the dispatch contract, the Interview skill and the goalplan CLI is assumed.
 

devlog/_plan/260930_issue_train/001_research.md

@@ -1,4 +1,4 @@
-# Triage of the 20 open issues (2026-09-30)
+# Triage of the 21 open issues (2026-09-30)
 
 Three explorers read every open issue against `dev` at `659de59b` (read-only, source anchors in their returns). Five issues are new since the 2026-09-27 train (#273-#277). The other fifteen were re-verified against the reasons in `../260927_issue_train/001_research.md`. Only #255, #262 and #265 changed since then, each through a partial ship in that train. This train also applies a rule the user set on 2026-09-30: fix real defects and worthwhile improvements that need no maintainer decision, and do not grow the hook surface (no new hook files, no new hook injections or advisories).
 

devlog/_plan/260930_issue_train/010_wp2_dispatch_contract.md

@@ -334,3 +334,7 @@ Disclosure for the 040 CHANGELOG: besides the command-match change, `validateRec
 Conclusion: #276 and #277 are fixed and merged into `dev` through PR #278 (head `ef1ce80d`, 14/14 checks, merge `069a7d0e`). Evidence: the red check (20/38 failing on the `659de59b` source, including the #276 repro), 38/38 on the new source for the same file (39/39 after C round 2 added one test), and the C gate under `cxc receipt test` (3730 tests, 0 failures, inventory, gate, smoke, empty hook diff). Next: wp3 builds 020.
 
 What did not go well: the first build shipped prose that contradicted the preflight rule (declared writes still need isolation), and three conditional paths plus two malformed-input paths were untested until the C reviewers probed them; C took two review rounds and three gate runs. One full-suite run failed on an unrelated timing assertion (`spawn-attach-hook.test.ts:920`, 0.5 ms to 6.6 ms under concurrent load) that passed 3/3 in isolation; it is a latent flake worth watching in CI. Evidence that this direction is wrong: a caller appears that legitimately reports extra passing checks in `verifierResults` and is broken by D5.
+
+## A review record
+
+Plan audit (A) at P->A: reviewer `01a0ee1f-b88c-73d0-ae1a-c526f311d2c2` and PABCD-initiative verifier `01a0ee1f-b983-7e61-b27e-c9eeeeada686` in parallel (the same pair as wp1, reused per DISPATCH-ACTOR-01). Round 1: reviewer PASS, initiative verifier GO-WITH-FIXES (2: section 5 conflicted with the revalidation; no wp1 D summary to quote), folded in `8a4b3404`; round 2: initiative verifier PASS.

devlog/_plan/260930_issue_train/020_wp3_interview_assumptions.md

@@ -152,3 +152,7 @@ C round 2 on `23b92670`: reviewer GO-WITH-FIXES (blockers=0) after a second fres
 Conclusion: #275 is addressed at the rule level and merged into `dev` through PR #279 (head `6e7bd3eb`, 14/14 checks, merge `58a8a174`). Evidence: INTERVIEW-ASSUME-01 referenced in the three files, two C rounds with fresh-reader passes whose stumbles changed the text, and the C gate on the final head (3730 tests, 0 failures). Next: wp5 builds 030.
 
 What did not go well: the planned prose (1(b)) was written for the plan reviewers, not for a first-time reader; the fresh-reader pass found seven stumbles, and the final text differs materially from the plan. The rule stays agent-followed: nothing checks an `eventId` or decision id, and the goal-mode reference is recorded by the agent. The hypothesis that died: that guidance audited at A reads well to its real audience. Evidence that the direction is wrong: agents keep presenting inferred assumptions as confirmed despite the rule, which would argue for the structured schema the issue lists as future work.
+
+## A review record
+
+Plan audit (A) at P->A: reviewer `01a0ee1f-b88c-73d0-ae1a-c526f311d2c2` and PABCD-initiative verifier `01a0ee1f-b983-7e61-b27e-c9eeeeada686` in parallel (the same pair as wp1, reused per DISPATCH-ACTOR-01). Round 1: both PASS; their nits were folded into the B commit.

devlog/_plan/260930_issue_train/030_wp5_decision_options.md

@@ -186,3 +186,7 @@ Residual for the wp4 CHANGELOG: builds older than this one rebuild decisions fie
 Conclusion: the #262 options half is merged into `dev` through PR #280 (head `7e4b90a3`, 14/14 checks, merge `99c9df6a`); #262 stays open for `withdrawn`. Evidence: red 6/41 on the `58a8a174` source (reproduced independently), 41/41 on the new source, C gate on the final head (3737 tests, 0 failures). Next: wp4 delivers per 040.
 
 What did not go well: the first test set left two rendering branches unobserved and asserted a parse error too loosely; the red check swapped tracked files in place in a shared tree, which worked but is riskier than an export. The downgrade residual (older builds drop `options` on rewrite) was found only at C. Evidence that the direction is wrong: users need `withdrawn` or answer-to-option linking more than option lists, which would show up as `decide` answers that repeat an option verbatim.
+
+## A review record
+
+Plan audit (A) at P->A: reviewer `01a0ee1f-b88c-73d0-ae1a-c526f311d2c2` and PABCD-initiative verifier `01a0ee1f-b983-7e61-b27e-c9eeeeada686` in parallel (the same pair as wp1, reused per DISPATCH-ACTOR-01). Round 1: both PASS; nits (parse-rejection test via `parseGoalplanCliArgs`, stale line numbers, help line into the file map) folded in B.

devlog/_plan/260930_issue_train/040_wp4_delivery.md

@@ -66,3 +66,19 @@ Resource bounds (disclosed gap): the release is C4 and the initiative's loop-eng
 - Kept open (#255, #256, #257, #260, #273, #274): the reason line from 001 and the link.
 
 Order: issue comments and closes run after the release so "released in v0.2.40" is true.
+
+## A review record
+
+Plan audit (A) at P->A: reviewer `01a0ee1f-b88c-73d0-ae1a-c526f311d2c2` and PABCD-initiative verifier `01a0ee1f-b983-7e61-b27e-c9eeeeada686` in parallel (the same pair as wp1, reused per DISPATCH-ACTOR-01). Round 1: both PASS; nits (per-issue not-planned reasons for #209/#213/#265, per-PR fix comments, leftover-version `rg`, full `expected_sha` with `--ref main`, known-flake policy, CHANGELOG Compatibility and Verification headings, a working latest check, one clock for date and stamp) folded in B.
+
+## wp4 C record (2026-09-30)
+
+Gates on the release tree: local `/tmp/it0930/c-gate.sh` on `1f02cfd4` before the PR (3737 tests, 0 failures, inventory, gate, smoke; its c-5 line was narrowed there because `plugin.json`'s version bump sits under `.codex-plugin`: hook files and `hook.ts` must have no diff, the manifest may change only its `version` line, and 31 hooks must stay published), `check-versions.mjs 0.2.40` OK, leftover `0.2.39` only in the `hook.test.ts:181` fixture path, and the same gate under `cxc receipt test` on `0ff1ae01` (exit 0). Hosted: #281 14/14 on `1f02cfd4`; `dev` push runs on `ff3f5af5`; #282 28/28 on `ff3f5af5` (including its own `pull_request` CI 36615865372 and Packed install 36615865506); `main` push CI, Packed install, WSL and Docs on `3c1459ac`; release dry run 36618591813 and publish 36619043417 both `READY — 0.2.40` with `pass=3661 fail=0 total=3737` (the 76 unlisted tests are platform skips, as in 0.2.39's 3533/3609); assets verified twice (main and the release reviewer's fresh download).
+
+C lanes in parallel: release reviewer `01a0eea5-aa63-7ab3-b773-2b5c86144e0b` PASS (every release, CI, asset, issue and CHANGELOG claim re-checked against GitHub); PABCD-initiative verifier `01a0eea5-aba9-74e1-a829-ada290c75c65` GO-WITH-FIXES (5, all loop records: this C record, criteria c-5 to c-9, A-round IDs in the decade docs, the wp4 D summary, and 041's wording before #283 lands), folded in this commit. Deviations from the plan: the CHANGELOG heading is dated 2026-09-29 (UTC, matching the build stamp and publish time) instead of 2026-09-30; issue comments link 001 on `main` (identical blob on `dev`).
+
+## wp4 D summary (2026-09-30)
+
+Conclusion: codexclaw 0.2.40 is released from `main` `3c1459ac` with verified assets, all 21 open issues are dispositioned, and the delivery record lands through #283. No next work phase: every goalplan phase is done after this cycle.
+
+What did not go well: the c-5 gate line was written for implementation phases and flagged the release's own version bump, so it had to be narrowed at B; the first issue-comment template gave three issues the wrong reason until A caught it; the loop's review evidence lived in ledger attests rather than the decade docs until the final verifier asked for it. The hypothesis that died: that a train-wide gate script could be reused unchanged for the release phase. Evidence that the delivery direction is wrong: users hit the stricter #276 receipt rule or the dropped `options` on an older build, which would show up as issues against 0.2.40.

devlog/_plan/260930_issue_train/041_delivery.md

@@ -0,0 +1,48 @@
+# 041 — Delivery record: issue train 2026-09-30 and release 0.2.40
+
+codexclaw 0.2.40 is published and is the latest release: https://github.com/lidge-jun/codexclaw/releases/tag/v0.2.40 (stable, not a draft, published 2026-09-29T19:27:44Z, tag `v0.2.40` -> `3c1459ac`). It ships this train's #276/#277 fix and preflight (#278), the Interview assumption provenance guidance for #275 (#279) and the goalplan decision options for #262 (#280), together with the 2026-09-27 train (#269-#272). No hook file, hook registration or hook handler changed in this train (31 hooks before and after).
+
+## Pull requests and CI
+
+| PR | Scope | Head at merge | Merge commit | Hosted checks on the head |
+|---|---|---|---|---|
+| #278 | #276, #277, DISPATCH-VERIFIER-01, roadmap unit | `ef1ce80d` | `069a7d0e` | 14/14 (CI 36606303599, Packed install 36606303523) |
+| #279 | #275 INTERVIEW-ASSUME-01 | `6e7bd3eb` | `58a8a174` | 14/14 (CI 36608949299, Packed install 36608949301) |
+| #280 | #262 decision options | `7e4b90a3` | `99c9df6a` | 14/14 (CI 36611468113, Packed install 36611468104) |
+| #281 | version 0.2.40, CHANGELOG | `1f02cfd4` | `ff3f5af5` | 14/14 (CI 36613312947, Packed install 36613313066) |
+| #282 | promotion `dev` -> `main` | `ff3f5af5` | `3c1459ac` | 28/28 (PR CI 36615865372, Packed install 36615865506; `dev` push CI 36614079312, Packed install 36614079283, WSL 36614079194) |
+
+`main` at `3c1459ac`: push CI 36616839395, Packed install 36616839230, WSL 36616839277 and Docs 36616839247 all success.
+
+## Release
+
+| Step | Evidence |
+|---|---|
+| Dry run | run 36618591813: `release verify: READY — 0.2.40 @ 3c1459ac`, version kind stable, `release tests: pass=3661 fail=0 total=3737` |
+| Publish | run 36619043417 success, same READY line; tag `v0.2.40` -> `3c1459acadeb1906d97c00a598e1457327ae372d`; `gh release list` shows v0.2.40 `isLatest=true` |
+| Assets | `candidate-0.2.40.json`, `codexclaw-payload-0.2.40.tar.gz`, `SHA256SUMS`; `shasum -a 256 -c SHA256SUMS` OK; payload equals `git archive 3c1459ac plugins/codexclaw` (1120 files, 0 differing, 0 missing, 0 extra); manifest `0.2.40+codex.20260929183231` |
+
+## Issue dispositions
+
+- Closed as completed with a comment naming the PR, merge SHA and release: #275, #276, #277.
+- Commented and kept open: #262 (options shipped; `withdrawn` needs a maintainer decision), #255, #256, #257, #260, #273, #274.
+- Closed as not planned with per-issue reasons and a link to 001: #209, #213, #247, #258, #259, #263, #264, #265, #266, #267, #268.
+
+## Review record
+
+Every work phase ran P -> A -> B -> C -> D with persisted transitions; wp4 closes to IDLE after this record lands. Parallel lanes per phase (agent ids in each decade doc): A used reviewer `01a0ee1f-b88c` with initiative verifier `01a0ee1f-b983` for every phase; C used fresh pairs for wp2 (`01a0ee2f-7b70`/`01a0ee2f-7cbd`), wp3 (`01a0ee49-6e1e`/`01a0ee49-6f1d`), wp5 (`01a0ee5f-7c4f`/`01a0ee5f-7d90`) and wp4 (`01a0eea5-aa63` release reviewer PASS, `01a0eea5-aba9` initiative verifier with record-keeping fixes); wp1, docs only, reused its A round-2 PASS at C instead of a fresh pair. The architect (one V1 subagent) proposed D1-D28 and reflected on the plan (MISALIGNED with one gap, folded). At every A, a reviewer and a PABCD-initiative verifier (checking `pabcd_initiative/skills/dev-pabcd`) audited in parallel; at every implementation C, a fresh reviewer and a fresh initiative verifier ran in parallel against the final text and code. All agents inherited this session's model, so review independence is context-only (REVIEW-DECORRELATE-01 not established; disclosed in 000). Findings that changed the work: the roadmap's c-10 criterion contradicted architect D25 and was corrected at P with a recorded rationale; the privacy grep and the npm-ci precondition were broken in the first plan draft; the #277 prose contradicted the preflight rule; malformed-input paths threw; the #275 guidance failed a fresh-reader pass and was rewritten twice; two option-rendering branches were unobserved until C.
+
+## Residual risks
+
+- #276's stricter rule rejects a receipt that reports extra passing checks in `verifierResults`; no caller in codexclaw uses the contract today.
+- INTERVIEW-ASSUME-01 is agent-followed guidance: nothing checks an answer reference against the ledger.
+- Builds older than 0.2.40 drop a decision's `options` if they rewrite the plan.
+- A timing assertion (`subagent-config/test/spawn-attach-hook.test.ts:920`) failed once locally under concurrent load and passed 3/3 in isolation and in every hosted run.
+- The wp1 C receipt path under `.codexclaw/evidence/` was overwritten by later check epochs; each phase's gate output is quoted in its C->D attestation.
+- The installed plugin cache (0.2.36) and remote hosts were not updated; that was outside this train's scope.
+
+## Operational notes
+
+- The worktree guard blocked one red-check command because it mentioned this worktree's path next to an `rm -rf` of a temp directory; the script was rewritten to resolve the repo with `git rev-parse` instead of bypassing the guard. The host also rejects `rm -rf`, so `/tmp/it0930/redcopy` was left in place.
+- `Fixes #n` does not close issues from PRs into `dev`; issues were closed by hand after the release.
+