fix(cli): name the reviewed recovery for Aside profiles that read off (stale)

devlog/_plan/261009_n5_small_sweep/000_plan.md

@@ -0,0 +1,75 @@
+# 261009 N5 — small PR and issue sweep
+
+**Reader summary.** Sweep lane N5 drives three items to a terminal state: contributor PR #6734 (paste a
+`codex://threads/<id>` link into the Logs conversation filter), contributor PR #6813 (an explicit Codex
+account selection can silently lose to a newer disk snapshot, so routing and auth use another account), and
+issue #6757 (Aside profiles show `off (stale)` and `ocx integration client sync --client aside` gives no
+actionable recovery). Each item ends READY, NEEDS_HUMAN, BLOCKED or SUPERSEDED with evidence.
+
+## Loop spec
+
+- **Loop archetype:** satisfy-spec, multi-cycle HOTL (cxc-loop), one work-phase per PABCD cycle.
+- **Trigger:** coordinator chat 01a11fe0 dispatched lane N5 ("ㄱㄱ 하자 너 상속으로 레인 파견하고 sol 서브에이전트
+  무제한으로 쓰라고") with the N5 scope #6734, #6813, #6757.
+- **Goal:** #6734 READY as-is or carried; #6813 carried onto current dev in a maintainer branch so repository
+  CI runs, security-reviewed; #6757 recovery guidance shipped with OFF preferences preserved and the cause
+  reported or its unknown documented.
+- **Non-goals:** other lanes (N1–N4, L1–L7 PRs #6802–#6818 and #6806); `.github/workflows`; the user's live
+  Desktop sidecar (port 10100), `~/.claude`, `~/.aside`, PATH shims; merging, commenting on or closing other
+  authors' PRs and issues; approving fork workflows; release.
+- **Verifier:** per work-phase focused Bun test files named in each decade doc, `bun run typecheck`, and
+  `bun run structure:check` / `bun run privacy:scan` where structure or docs change; exact-head hosted CI is
+  the broad gate. Full `bun run test` is left to CI (lane instruction: minimal local tests).
+- **Stop condition:** every item terminal; one final lane report. Merge is outside authority.
+- **Memory artifact:** this unit; goalplan `.codexclaw/goalplans/opencodex-sweep-lane-n5-small-prs-issues-forked`
+  in the coordinator cwd `/Users/jun/.codex/worktrees/7301/opencodex`.
+- **Expected terminal outcomes:** DONE = all three items READY or terminal with evidence; NEEDS_HUMAN = a product
+  or security decision the evidence cannot settle; BLOCKED = CI infrastructure or permission; UNSAFE = a fix
+  that needs the user's live environment.
+- **Escalation condition:** reviewer FAIL twice on the same packet; any need to write to another author's PR.
+- **Resource bounds:** tools = local shell in lane worktrees, gh for this repository's own branches/PRs/CI,
+  gpt-6.1-sol subagents without a count limit; write scope = `opencodex-lanes/261009-N5-small*`; no token or
+  time budget was stated (host limits apply).
+
+## Work-phase map (dependency order)
+
+The three items are independent; order follows risk of drift (a contributor head that is already green
+first, then the auth carry, then the new CLI behavior).
+
+| Goalplan id | Doc | Slice | PR | Depends on |
+|---|---|---|---|---|
+| wp0 | this unit | docs-first roadmap | none | — |
+| wp1 | `010_pr6734_thread_links.md` | review and union check of #6734; READY or carry | original #6734 (or carry) | wp0 |
+| wp2 | `020_pr6813_account_selection_carry.md` | carry #6813 onto dev, security review | new PR → dev | wp0 |
+| wp3 | `030_issue6757_aside_recovery.md` | Aside off/stale recovery guidance + cause report | new PR → dev (carries this unit) | wp0 |
+| wp4 | `040_closeout.md` | merge #6824 and the #6757 PR under the gate, close originals, final report | none | wp2, wp3 |
+
+## Evidence baseline (origin/dev 730d898457)
+
+- #6734 head `ca2391373f`: `git merge-tree --write-tree origin/dev pr/6734` exit 0, tree `9e44b77e61`; union
+  focused tests 96 + 28 pass, typecheck exit 0 (explorer receipt `/tmp/n5-6734-evidence/receipt.txt`).
+- #6813 head `8441b1bc68` (base `f7d6c049`): merge-tree clean, tree `a86859108a`; #6811 merged as `c3bbaaa342`
+  and shares only the two layout registries and `structure/config.md`; union 460 focused tests pass.
+- #6757: no automatic path flips an explicit true preference to false; candidates are schema fallback of a
+  malformed policy (`src/config/schema/config-schema.ts:239`) and loss of legacy-derived activation
+  (`src/integrations/aside-profile-context.ts:167-181`).
+
+## Source-of-truth sync
+
+`structure/` docs owned by touched areas: `structure/dashboard-and-usage.md` (#6734, already in the PR),
+`structure/config.md` + `structure/providers/openai-accounts.md` (#6813, already in the PR), and the
+integrations doc that owns `src/cli/integration-aside-sync.ts` for wp3 (resolved in 030 via
+`structure/manifest.json`).
+
+## Authority amendment (coordinator steering, 2026-10-09)
+
+The coordinator relayed the user's instruction "머지까지해": this lane now merges its own PRs and closes the
+originals. Per-PR gate immediately before merge: base dev; no failed/cancelled/pending exact-head job (including
+triggered Windows jobs; a queued-only enforce-target over one hour with all code CI green is non-blocking and
+reported); `mergeable == MERGEABLE`; independent gpt-6.1-sol review PASS (plus sol security review PASS for #6813);
+fresh origin/dev with no conflict, and a union focused-test run when another PR touched the same files. Then
+`gh pr merge <n> --squash --admin` (carry bodies keep `Co-authored-by`), close carried/replaced originals with a
+credit comment (merged PR, merge commit, author), and close fixed issues with a dev note. Partial items stay open
+with a comment. Still out of scope: release, main/preview, other lanes' PRs, fork workflow approval, the user's
+live environment.
+Gate addition (audit wp2): no outstanding maintainer change request on the PR at merge time (MAINTAINERS.md).

devlog/_plan/261009_n5_small_sweep/010_pr6734_thread_links.md

@@ -0,0 +1,54 @@
+# 010 — wp1: PR #6734, Codex thread links in the conversation filter
+
+**Reader summary.** #6734 (luvs01) lets the Logs conversation filter, `GET /api/logs?conversationId=` and
+`ocx logs filter --conversation` accept a pasted `codex://threads/<id>` link. Its CI ran green on an older dev
+base; this phase proves it still holds on current dev and gets an independent review. No code is written
+unless the review finds a defect.
+
+## Facts (verified against origin/dev 730d898457)
+
+- Head `ca2391373f10795bf9270ba388344bec2ec2301f`, MERGEABLE, all triggered checks green on that head
+  (Cross-platform CI run 37725885408; enforce-target/hygiene reruns 37846215811/37846185830).
+- Union: `git merge-tree --write-tree origin/dev pr/6734` exit 0, no conflicts, tree `9e44b77e61`.
+- Ten touched files; only `structure/dashboard-and-usage.md` changed on dev since the PR base (lines 336, 500);
+  the union reaches the 600-line structure budget exactly (`structure/manifest.json:3`, enforced by
+  `scripts/structure-ssot.ts:350-357`). No file-size baseline caps apply; no test-layout registration changes.
+
+## Plan
+
+1. Independent gpt-6.1-sol review (no builder context; the lane did not author the change) of the PR diff
+   against current dev: bounded unwrap (512 chars, `src/server/request-log-conversation.ts:40-66`), digest
+   bound (4096, lines 20-37), case handling (57, 61, 92-94), dual candidates (75-78), GUI mirror
+   `gui/src/log-conversation-id.ts`, privacy (no raw ID logging, no persistence change), docs/structure
+   contract wording.
+2. Union verification (already run by the explorer; re-run by the reviewer only if it doubts it):
+   `bun test tests/usage/request-log-conversation.test.ts tests/cli/cli-log-view-filter.test.ts` (exit 0, 96 pass;
+   reads the target: both files are named directly), `(cd gui && bun test tests/logs-filter.test.ts
+   tests/logs-filter-bar.test.ts)` (exit 0, 28 pass), `bun run typecheck` (exit 0; covers `src/` only, GUI
+   compile is covered by hosted `gates`), `bun run structure:check` on the union tree for the 600-line budget.
+3. Decision rule: review PASS + union checks pass → original PR READY (no carry; lane cannot rerun another
+   author's CI, and the exact head is unchanged). Review FAIL with a fix → carry to
+   `codex/n5-6734-thread-links` (cherry-pick the six commits, keep authors, add the fix, `Co-authored-by: luvs01`),
+   open a dev PR. Structure budget failure on the union → carry with a one-line structure trim.
+
+## Acceptance
+
+- Reviewer verdict PASS (or FAIL folded via carry and re-reviewed PASS).
+- Union structure:check exit 0 (activation: the 600-line budget is exactly hit; a 601st line would fail).
+- Final report lists #6734 as READY (original) or the carry PR, and nothing to close until merge.
+
+## Cycle revision (wp1 P, origin/dev bb36029ef9)
+
+The facts above were observed at dev `730d898457` and are historical. dev moved one commit (#6820, Codex home
+restore; it touches none of the ten files). This cycle replaces "already run" with fresh checks:
+
+- **W1 union.** In the lane worktree, create the unpublished branch `n5-union-6734` from origin/dev `bb36029ef9` and
+  `git merge --no-ff refs/remotes/pr/6734` (head `ca2391373f`). Record parents, union commit and tree in 011. A conflict
+  switches to the carry path. The branch is never pushed.
+- **W2 review.** The independent gpt-6.1-sol review (reviewer 01a1205e, no builder context) is bound to the PR head and
+  current dev; its verdict, findings and limitations go to `011_pr6734_review.md` on `codex/n5-small`.
+- **W3 checks.** Session source is the lane worktree; C runs `cxc receipt test` with the union branch checked out:
+  the two root test files, the two GUI test files, `bun run typecheck`, `bun run structure:check`. 011 is committed on
+  `codex/n5-small` after switching back, so the doc commit is never confused with the tested tree.
+- **W4 READY.** Original READY additionally requires a fresh read of the PR's exact-head checks, review threads and
+  mergeability at report time; an unchanged head alone does not refresh that evidence.

devlog/_plan/261009_n5_small_sweep/011_pr6734_review.md

@@ -0,0 +1,23 @@
+# 011 — wp1 record: PR #6734 merged
+
+**Reader summary.** #6734 (luvs01) merged into dev unchanged as `37e9294125` on 2026-10-09 (squash, admin). Its head
+`ca2391373f` merged cleanly onto dev `bb36029ef9`, fresh checks on that union passed, and an independent review
+passed with one minor test-coverage note.
+
+## Evidence
+
+- Union: local unpublished branch `n5-union-6734`, commit `a3714f0ebe` (parents `bb36029ef9`, `ca2391373f`), tree
+  `436eff12c5`, identical to the auditor's `git merge-tree` result.
+- Receipt checks on the union (temporary HOME): `bun test tests/usage/request-log-conversation.test.ts
+  tests/cli/cli-log-view-filter.test.ts` 96 pass / 0 fail; `(cd gui && bun test tests/logs-filter.test.ts
+  tests/logs-filter-bar.test.ts)` 28 pass / 0 fail; `bun run typecheck` clean; `bun run structure:check` passed
+  (`structure/dashboard-and-usage.md` exactly at its 600-line budget).
+- Gate at merge time: base dev; exact-head checks 23 pass / 8 skipped / 0 failed or pending; MERGEABLE; no review
+  threads; dev unchanged since the union.
+- Independent review (gpt-6.1-sol 01a1205e, no builder context): PASS. Minor: the oversized-input assertions
+  (`tests/usage/request-log-conversation.test.ts:102`, `gui/tests/logs-filter.test.ts:225`) would not catch a raised
+  512-character unwrap limit, and mixed-case IDs are untested. Not merge-blocking; left as a follow-up.
+
+## Outcome
+
+READY → merged. Nothing to close: the PR links no issue.

devlog/_plan/261009_n5_small_sweep/020_pr6813_account_selection_carry.md

@@ -0,0 +1,86 @@
+# 020 — wp2: carry PR #6813, atomic explicit account selection
+
+**Reader summary.** Selecting a Codex account (or pin) through the management API can report success while a
+later whole-config reconcile adopts a newer disk value, so the next request routes and authenticates as a
+different account. #6813 (hulkbig, fork PR) commits the selection through the scoped persisted-config
+transaction first and only then adopts it and resets routing. Fork CI needs approval the lane does not
+have, so the lane carries it onto current dev in a maintainer branch where repository CI runs.
+
+## Facts (origin/dev 730d898457)
+
+- Before: `src/codex/auth-api/routes.ts:269-280` mutates live selection, resets routing, then
+  `saveRuntimeConfig` → whole reconcile (`src/codex/auth-api/runtime-config.ts:24-25`);
+  `src/config/live-reconcile.ts:325-341` adopts disk when live equals baseline.
+- PR head `8441b1bc68`: new `src/codex/auth-api/account-selection.ts` (107 lines) using
+  `mutatePersistedConfig` (`src/config/persisted-mutation.ts:37-90`, SQLite `BEGIN IMMEDIATE` lock
+  `src/config/mutation-lock.ts:104-152`); `routes.ts` -49/+10; `live-reconcile.ts` +17 (selection-only
+  advance); `rebase-provenance.ts` +11; docs in five locales; structure `config.md`,
+  `providers/openai-accounts.md`; new test `tests/codex-integration/codex-account-selection-atomicity.test.ts`
+  registered in both layout files.
+- Merge onto dev is clean (tree `a86859108a`); #6811 (merged `c3bbaaa342`) overlaps only on the layout
+  registries and `structure/config.md` and does not change the transaction API; #6792 has no runtime overlap.
+
+## Change map
+
+| Path | Action | Note |
+|---|---|---|
+| branch `codex/n5-6813-account-selection` from origin/dev | NEW | worktree `opencodex-lanes/261009-N5-small-6813` |
+| commits `91e24b0c30`, `8441b1bc68` | CHERRY-PICK | authorship (hulkbig) preserved; no content change expected |
+| any conflict in layout registries / `structure/config.md` | MODIFY | keep both sides' entries |
+| security-review folds (if any) | MODIFY | separate maintainer commit with `Co-authored-by: hulkbig` |
+
+## Verification
+
+- `bun test tests/codex-integration/codex-account-selection-atomicity.test.ts tests/codex-integration/codex-auth-api.test.ts tests/config/config-user-edits.test.ts tests/codex-integration/codex-pool-rotation.test.ts`
+  (targets named directly).
+- `bun test tests/test-layout.test.ts tests/test-layout-tooling.test.ts` (registration).
+- `bun run typecheck`; `bun run structure:check` (structure docs changed); `bun run privacy:scan`.
+- Activation scenarios to confirm in tests: same-value re-select of main against a newer disk snapshot
+  (the original red case); persistence failure leaves routing untouched; post-publication exception
+  reconciles to durable state.
+- Independent gpt-6.1-sol security review (auth selection, races, credential exposure, error projection),
+  then a general correctness review; exact-head hosted CI on the carry PR.
+
+## Terminal
+
+READY = carry PR exact-head CI green, both reviews PASS, MERGEABLE. After merge the coordinator closes #6813
+with credit. Residual risks reported: recovery accepts any valid matching snapshot (observed-state, not
+writer attribution); non-cooperating external writers after the final freshness check.
+
+## Cycle revision (wp2 P, origin/dev 37e9294125)
+
+dev moved to `37e9294125` (#6820 and the #6734 merge). #6820 also edits both layout registries that #6813 touches; the
+union resolves that cleanly and the layout guards stay in C3. `git merge-tree --write-tree
+origin/dev refs/remotes/pr/6813` is clean (tree `3d755f0d31`). #6811 is merged (`c3bbaaa342`) and orthogonal.
+
+- **C1 branch.** In the lane worktree: `git switch -c codex/n5-6813-account-selection origin/dev`, then
+  `git cherry-pick 91e24b0c30 8441b1bc68`. Both commits keep author Hulk <happyhls@gmail.com>. No content edits unless a
+  review finding requires one, in a separate maintainer commit carrying `Co-authored-by: hulkbig <happyhls@gmail.com>`.
+- **C2 reviews.** Independent gpt-6.1-sol security reviewer (01a12063-915d) and correctness reviewer (01a12063-926c),
+  neither given builder context, review #6813's head against current dev in their own /tmp worktrees.
+- **C3 checks (receipt, temporary HOME, carry branch checked out).** `bun test
+  tests/codex-integration/codex-account-selection-atomicity.test.ts tests/codex-integration/codex-auth-api.test.ts
+  tests/config/config-user-edits.test.ts tests/codex-integration/codex-pool-rotation.test.ts`, `bun test
+  tests/test-layout.test.ts tests/test-layout-tooling.test.ts`, `bun run typecheck`, `bun run structure:check`,
+  `bun run privacy:scan`.
+- **C4 publish and merge.** Push the branch, open a dev PR with the full template (Summary, Verification, Checklist),
+  `Carries #6813`, and `Co-authored-by: hulkbig <happyhls@gmail.com>` in the body. After the exact-head CI and both
+  reviews pass and the merge gate holds, `gh pr merge --squash --admin --body` with the trailer, then close #6813 with a
+  credit comment (merged PR, merge commit, author). D closes on the carry branch before any record commit.
+
+### Architect K1–K4 folds
+
+- **K1/K2 tree binding.** Reviews start on the fork head; they count for the carry only if the carry branch tree equals
+  `git merge-tree --write-tree origin/dev refs/remotes/pr/6813` for the dev SHA the branch was cut from (recorded in the
+  PR). Any fold commit invalidates that equivalence and requires both reviewers to re-review the fold diff.
+- **K3 receipt binding.** Receipts run with the carry branch's final SHA checked out (cxc binds commit + clean state); any
+  later edit requires a fresh receipt. Minimal local scope is stated in the PR Verification section; the full suite and
+  Windows/macOS shards are left to hosted CI.
+- **K4 merge.** `gh pr merge <n> --squash --admin --match-head-commit <sha> --body-file <file>` where the file ends with
+  `Co-authored-by: hulkbig <happyhls@gmail.com>`. The PR description carries the maintainer-integration record
+  (MAINTAINERS.md `dev` exception) with exact-head verification. The dev ruleset (20763889) defines no required status
+  checks; the gate requires every triggered check to pass, and the queued-enforce-target exemption applies only because
+  no check is ruleset-required. Close #6813 only after the merge is confirmed.
+- **Audit fold.** The merge gate also requires a fresh review-state read: no outstanding maintainer change request
+  (resolved or withdrawn), recorded with the exact-head CI evidence. The queued enforce-target exemption keeps all three
+  conditions (over one hour, all code CI green, reported). Each reviewer's examined union tree is recorded.