diff --git a/devlog/_plan/260927_release_train_4/issue-triage/000_plan.md b/devlog/_plan/260927_release_train_4/issue-triage/000_plan.md
new file mode 100644
index 00000000000..57520056111
--- /dev/null
+++ b/devlog/_plan/260927_release_train_4/issue-triage/000_plan.md
@@ -0,0 +1,52 @@
+# Release train 4 — issue triage roadmap
+
+At the 2026-09-27 inventory, `origin/dev` was `24b2f39b77a29711c5064987de169ecf4a97c58b`. This lane owns 12 open issues and the 21 named large PRs. The source audit finds no issue whose full acceptance is already satisfied on `dev`. Every large PR remains open; the only current-release carry candidate is the isolated Bun `%7E` standalone URL fix from #6079. The main Windows compatibility feature remains under review.
+
+## Loop specification
+
+- Archetype: satisfy-spec, with a docs-only first PABCD cycle and one cycle per dependency-ordered work phase.
+- Trigger: release train 4 `issue-triage` delegation; user authorizes this lane's branch, PR, exact-head merge, and item-specific GitHub comments/closures.
+- Goal: record a sourced disposition for each owned issue and listed PR, give contributors a concrete next step, and land only bounded fixes that satisfy current-`dev` gates.
+- Non-goals: the explicitly assigned bug-hardening, provider-compat, account-pool, gui-ux and clients-proxy items; `main`/`preview`, tags, releases, deployments, contributor-fork pushes, other lanes' branches, and a wholesale carry of a large draft.
+- Verification: `gh issue list --limit 300 --json number` and `gh pr list --limit 300 --json number,headRefOid` establish the full current inventory, checked by ID-set comparison (the defaults return only 30); source and PR head links establish each decision; `bun test tests/lib/standalone.test.ts`, `bun run test:changed`, `bun run typecheck`, `bun run privacy:scan`, `bun run structure:check`, `git diff --cached --check` before commit, `git diff --check origin/dev...HEAD` after commit, and exact-head required PR CI validate the bounded carry and record. A Windows packaged smoke would be needed to claim packaged Windows behavior; the URL regression test only proves helper semantics.
+- Stop condition: all 33 owned items have a documented decision, warranted comments/closures are confirmed by readback, the bounded carry and final devlog record are merged only after exact-head gates, and the dev merge CI is checked. If no candidate clears gates, keep it open and record the reason.
+- Memory artifact: this numbered unit under `devlog/_plan/260927_release_train_4/issue-triage/`, plus GitHub comment/PR URLs in `040_outcome.md`. Security working notes, if any, stay in `.tmp/`.
+- Outcomes: DONE means the criteria above have fresh proof; NOOP means an item has no new action after the source audit; NEEDS_HUMAN means an unresolved product or security policy decision; UNSAFE means a candidate would violate a boundary; BLOCKED means a persistent external gate prevents required work. A pending CI run is pending evidence, not success.
+- Escalation: request a maintainer decision only for product policy or security acceptance that this lane cannot infer. No token or wall-clock limit was specified. Use the existing repository credentials only; write source only in this lane's worktree and GitHub only for owned items.
+
+## Source and method
+
+The remote inventories at `24b2f39b` contain 41 open issues. The following 29 belong to other lanes and are excluded from comments and closure: #6088 #4956 #4761; #4213 #4143 #3506 #3765 #5270 #2511; #6013 #5649 #5616 #5561 #4878 #4961 #4869 #3375 #3376; #4644 #3379 #4189; #5660 #5679 #5982 #5853 #4854 #3494 #1416 #2811. This enumeration is checked against the delegation: #3494 appears in the coordinator's **unassigned examples**, while the same delegation lists it under clients-proxy. The explicit exclusion wins, so this lane records #3494 as excluded and does not touch it. The remaining owned issue count is 12. Recheck new issues before publication and route any newly assigned item by ownership.
+
+Each PR is reviewed against the live head, GitHub mergeability, required-check state, current source ownership and the union with `dev`; an old PR description is a claim, not current proof. For carried code, use a focused new PR with a `Co-authored-by` trailer and link back to the source; retain the source PR if substantial feature work remains. The carrying PR never touches a contributor fork. Security-sensitive PR observations here are release-level blockers only; undisclosed findings are not written to this public unit.
+
+## Work phases and dependency order
+
+| Phase | Owner document | Input | Output and gate |
+|---|---|---|---|
+| wp0: decision architecture | `000_plan.md`, `010_issue_actions.md`, `020_pr_actions.md`, `030_standalone_carry.md`, `040_outcome.md` | live issue/PR list and source at `24b2f39b` | docs-only roadmap with every item and exact action; architect reflection, independent audit, text consistency check |
+| wp1: issue dispositions | `010_issue_actions.md` | locked roadmap | concise evidence comments where status changed; close only fully resolved items; readback receipts |
+| wp2: PR feedback | `020_pr_actions.md` | locked roadmap | item-specific English review comments and readback; hold feature PRs open |
+| wp3: bounded integration and landing | `030_standalone_carry.md`, `040_outcome.md` | issue and PR decisions, fresh `origin/dev` | URL fix, focused PR and full decision record; exact-head CI, merge, dev CI, final receipts |
+
+Work phases are dependency ordered by decision data: inventory and contract first, external dispositions next, then integration and publication. The issue and PR phases can each be independently checked by GitHub readback. If the small carry fails its gate, omit the code merge and record that as a held candidate; do not weaken the gate.
+
+## Architect consultation
+
+Architect handle `01a0e33a-411b-7d42-9f74-00734614db07`, proposal received 2026-09-27. Decisions: A1 (numbered docs-only roadmap) accepted, with the user-mandated `260927_release_train_4/issue-triage/` path replacing the proposed sibling unit; A2 (stable issue and PR IDs, source evidence and careful closure) accepted; A3 (hold large boundary changes until current-head review) accepted, amended to carry only #6079's independent URL bug; A4 (external comment receipts, exact-head CI and final docs PR) accepted. The preliminary proposal counted #3494 as owned; the explicit clients-proxy exclusion corrects that count here. Concrete plan revision: this file plus the four numbered phase documents. The first same-architect reflection found three material ambiguities: a combined versus separate publication path, a missing `src/lib/` source-to-doc mapping, and “cherry-pick” versus “reimplement” wording. The plan now uses separate carry and docs PRs, adds the service doc to the manifest/INDEX mapping, and consistently says reimplement. Recheck the revised plan before independent audit.
+
+## Verifier preflight on the docs-only tree
+
+After `bun install --frozen-lockfile` (exit 0, 104 packages), `bun test tests/lib/standalone.test.ts` passed 3/3 and directly read the future `tests/lib/standalone.test.ts` target; `bun run typecheck` exited 0 and TypeScript's project includes `src/lib/standalone.ts`; `bun run structure:check` exited 0 and reads the `structure/` document map; `bun run privacy:scan` exited 0 and scans tracked `devlog/` text; `git diff --cached --check` exited 0 on the five staged docs. `bun run test:changed` exited 0 but selected 0 tests for these five docs-only files. It is a command-availability preflight, **not** post-change regression evidence; rerun it after the code edit. An initial focused test attempt failed because this fresh worktree lacked `zod/v4`; the frozen install resolved that environment precondition before the successful run. The actual code change still needs red/green and all planned checks.
+
+The same architect re-read the revised plan and returned **ALIGNED**: separate carry/docs publication, `src/lib/` source-map repair, reimplementation wording, 12 owned issues plus 21 PRs, and the verified `luvs01` coauthor trailer are consistent. The reflection applies to the current five-file roadmap, before the independent A audit.
+
+## Independent audit round 1
+
+The first independent reviewer pass saw no staged diff and returned FAIL without content review. After staging all five files, the same reviewer verified the 41/29/12 issue inventory, 21 PR head prefixes, author attribution and source links, then found two plan blockers: default 30-item `gh list` truncation and an unstaged-only whitespace check. Both are folded into this revision: inventory commands use `--limit 300` with ID-set reconciliation, and the whitespace gate checks staged content before commit and the base-to-head diff after commit. These are verification corrections, not a design change. The same reviewer re-audits this revision.
+
+The same independent auditor rechecked the staged corrections and returned **VERDICT: PASS** with no blockers. The full-list commands returned 41 open issues and 61 open PRs at recheck; `git diff --cached --check` passed. The post-commit base-to-head whitespace check remains a C-phase task because the roadmap has not yet been committed.
+
+## wp0 check conclusion and next direction
+
+The docs-only roadmap is committed on `codex/t4-issue-triage-audit`. Its independent plan audit passed after the two verifier corrections. Fresh Check evidence: the live inventory reconciliation returned 41 open issues, 29 explicit exclusions, 12 owned issue rows and all 21 named open PR rows (61 open PRs total at that read); `bun run privacy:scan`, `bun run structure:check`, and `git diff --check origin/dev...HEAD` each exited 0. A fresh reader can find each item from the numbered issue/PR tables without the original chat. No GitHub issue or PR was changed in wp0, and the standalone fix remains unimplemented. The next phase is wp1: recheck each owned issue, post only the five planned status comments, and keep all 12 issues open unless new full-resolution evidence appears.
diff --git a/devlog/_plan/260927_release_train_4/issue-triage/010_issue_actions.md b/devlog/_plan/260927_release_train_4/issue-triage/010_issue_actions.md
new file mode 100644
index 00000000000..3f0890091a9
--- /dev/null
+++ b/devlog/_plan/260927_release_train_4/issue-triage/010_issue_actions.md
@@ -0,0 +1,43 @@
+# 010 — Open issue decisions and actions
+
+Basis: `origin/dev` `24b2f39b77a29711c5064987de169ecf4a97c58b` and GitHub issue state on 2026-09-27. These 12 issues are the open inventory after removing the other lanes' explicit exclusions. This is an issue-decision phase, with no runtime source edit. GitHub comment bodies are drafted from the evidence column; comments go only where a new status or concrete next step helps. No issue is closed on this audit: each has unsatisfied acceptance. Recheck `dev` before any later closure.
+
+| ID | Decision | Current `dev` evidence | Next action and planned external diff |
+|---|---|---|---|
+| [T4-I-5848](https://github.com/lidge-jun/opencodex/issues/5848) | Keep open; warning only | [#6070](https://github.com/lidge-jun/opencodex/pull/6070) added the provider-table/mobile visibility warning in [Codex integration docs](https://github.com/lidge-jun/opencodex/blob/24b2f39b77a29711c5064987de169ecf4a97c58b/docs-site/src/content/docs/guides/codex-integration.md#L1060-L1077). The mobile `thread/list` default provider filter is outside the proxy. | No repeat comment: the [owner's 2026-09-27 update](https://github.com/lidge-jun/opencodex/issues/5848#issuecomment-5854437457) already records the exact remaining upstream action. Close only after the remote app-server/client lists both tags. |
+| [T4-I-5745](https://github.com/lidge-jun/opencodex/issues/5745) | Keep open; shared-state feature | [Single-writer ledger contract](https://github.com/lidge-jun/opencodex/blob/24b2f39b77a29711c5064987de169ecf4a97c58b/src/lib/spend-reservation-ledger.ts#L27-L30) and [process-held lease](https://github.com/lidge-jun/opencodex/blob/24b2f39b77a29711c5064987de169ecf4a97c58b/src/lib/spend-ledger-owner.ts#L176-L195) preclude a shared multi-writer claim. | Comment: design PostgreSQL transaction/fencing and two-pod Ready-before-stop proof; leave open. No database patch in this release lane. |
+| [T4-I-5493](https://github.com/lidge-jun/opencodex/issues/5493) | Keep open; partial implementation | [#5682](https://github.com/lidge-jun/opencodex/pull/5682) added lazy hidden startup and hosted package E2E; [#5742](https://github.com/lidge-jun/opencodex/pull/5742) added hidden-window polling control. [Desktop shell contract](https://github.com/lidge-jun/opencodex/blob/24b2f39b77a29711c5064987de169ecf4a97c58b/structure/desktop-shell.md#L366-L378) records readiness/RSS, not attach timing, background request count or reviewed baseline. | Comment with narrower remaining measurement acceptance. Close after the evidence is recorded; no speculative performance budget in this train. |
+| [T4-I-4579](https://github.com/lidge-jun/opencodex/issues/4579) | Keep open; authority contract | [Undeclared-tool guard](https://github.com/lidge-jun/opencodex/blob/24b2f39b77a29711c5064987de169ecf4a97c58b/src/server/responses-undeclared-tool-guard.ts#L373-L401) protects one path, but does not give job-owned grants across model switches. | No repeat status comment needed until a stable job/grant/revocation contract is proposed. |
+| [T4-I-4434](https://github.com/lidge-jun/opencodex/issues/4434) | Keep open; Fusion feature | [Combo routing identifiers](https://github.com/lidge-jun/opencodex/blob/24b2f39b77a29711c5064987de169ecf4a97c58b/src/combos/identifiers.ts#L4-L42) select a target; they do not implement two-model consultation. #5955 has a different advisor contract. | Keep for a scoped lead/oracle profile, authority and streaming design. No status comment until scope is selected. |
+| [T4-I-4198](https://github.com/lidge-jun/opencodex/issues/4198) | Keep open; publication missing | Source-build [Dockerfile](https://github.com/lidge-jun/opencodex/blob/24b2f39b77a29711c5064987de169ecf4a97c58b/Dockerfile#L1-L35) exists, while the [hub guide](https://github.com/lidge-jun/opencodex/blob/24b2f39b77a29711c5064987de169ecf4a97c58b/docs-site/src/content/docs/guides/remote-hub.md#L547-L554) says no official image is published. #6077's Cloudflare Container does not fulfill registry publication. | Comment with narrowed GHCR workflow, multi-arch/signing and release ownership acceptance. |
+| [T4-I-4173](https://github.com/lidge-jun/opencodex/issues/4173) | Keep open; atomic guarantee incomplete | [`ocx update` exists](https://github.com/lidge-jun/opencodex/blob/24b2f39b77a29711c5064987de169ecf4a97c58b/src/cli/registry.ts#L265-L269), and the [launcher stops the proxy](https://github.com/lidge-jun/opencodex/blob/24b2f39b77a29711c5064987de169ecf4a97c58b/bin/ocx.mjs#L561-L580). No preflight/schema/readiness and client-convergence transaction is established across installers. | Comment with the remaining acceptance per installer/service mode. Do not close merely because a command exists. |
+| [T4-I-3705](https://github.com/lidge-jun/opencodex/issues/3705) | Keep open; Guardrails absent | [#4022](https://github.com/lidge-jun/opencodex/pull/4022) remains a conflicting draft; `dev` has no Guardrails path. | Its PR gets a release-review comment. Keep issue open until a reviewed security contract and transport coverage land. |
+| [T4-I-3459](https://github.com/lidge-jun/opencodex/issues/3459) | Keep open; transform hook absent | [#3463](https://github.com/lidge-jun/opencodex/pull/3463) remains a conflicting draft; current Responses ingress has no `requestTransforms` activation. | Its PR gets a release-review comment. Close issue only after one verified transform contract lands. |
+| [T4-I-2834](https://github.com/lidge-jun/opencodex/issues/2834) | Keep open; diagnostics partial | [Provider test route](https://github.com/lidge-jun/opencodex/blob/24b2f39b77a29711c5064987de169ecf4a97c58b/src/server/management/provider-routes.ts#L1587) is a connectivity probe; [CLI output](https://github.com/lidge-jun/opencodex/blob/24b2f39b77a29711c5064987de169ecf4a97c58b/src/cli/provider-runtime.ts#L132) reports latency, not per-model identity/TTFT/capability evidence. | Comment with a lightweight no-completion check first; an explicitly user-initiated, bounded fixed-prompt completion test may incur quota/cost. Compare returned model metadata to configuration; missing identity remains unconfirmed, never an identity proof. |
+| [T4-I-2358](https://github.com/lidge-jun/opencodex/issues/2358) | Keep open; RFC partly delivered | [#2439](https://github.com/lidge-jun/opencodex/pull/2439) landed a contract foundation, but [compatibility registry](https://github.com/lidge-jun/opencodex/blob/24b2f39b77a29711c5064987de169ecf4a97c58b/src/compatibility/index.ts#L17) remains narrow and [OAuth store](https://github.com/lidge-jun/opencodex/blob/24b2f39b77a29711c5064987de169ecf4a97c58b/src/oauth/store.ts#L1) has not moved to OS-backed credentials. | Retain as an umbrella RFC; split provider conformance, budgets and credential migration into reviewable criteria. Existing owner update is recent enough. |
+| [T4-I-95](https://github.com/lidge-jun/opencodex/issues/95) | Keep open; tenant isolation absent | [Per-key model scopes](https://github.com/lidge-jun/opencodex/blob/24b2f39b77a29711c5064987de169ecf4a97c58b/src/server/admission-model-scope.ts#L1) are partial; [history filtering](https://github.com/lidge-jun/opencodex/blob/24b2f39b77a29711c5064987de169ecf4a97c58b/src/server/management/request-history-routes.ts#L91) is an operator query, not tenant isolation. | Retain roadmap; define admission-derived tenant identity and cross-tenant negative tests before implementation. |
+| [T4-I-6093](https://github.com/lidge-jun/opencodex/issues/6093) | Keep open until #6094 merges | Filed after the first audit. The backend cap from #5954 is on `dev` ([schema](https://github.com/lidge-jun/opencodex/blob/24b2f39b77a29711c5064987de169ecf4a97c58b/src/config/schema/leaf-validators.ts#L96-L125)); the pacing panel does not expose it. The author's [#6094](https://github.com/lidge-jun/opencodex/pull/6094) implements it. | Reviewed #6094 at `edb17c73` (Sol reviewer NEAR-PASS, no code blocker; local gates exit 0), approved its fork CI run, which passed ([run 36330282971](https://github.com/lidge-jun/opencodex/actions/runs/36330282971)). Posted [review summary](https://github.com/lidge-jun/opencodex/pull/6094#issuecomment-5857585625) and [issue status](https://github.com/lidge-jun/opencodex/issues/6093#issuecomment-5857585783). Merging a contributor PR is outside this lane's merge authority, so it waits for maintainer approval; close #6093 after it lands. |
+| [T4-I-6118](https://github.com/lidge-jun/opencodex/issues/6118) | Keep open; next train | Filed 2026-09-27 17:26 UTC, after the implementation window. `normalizeKiroImages()` in `src/adapters/kiro-images.ts` caps images per message (20) and by bytes, not per request, so 101 history images trigger Kiro's `IMAGE_COUNT_EXCEEDED`. Confirmed gap. | [Deferral comment](https://github.com/lidge-jun/opencodex/issues/6118#issuecomment-5859194643) invites the reporter's tested fix as a PR. Not implemented, per the coordinator's closing instruction. |
+| [T4-I-6122](https://github.com/lidge-jun/opencodex/issues/6122) | Keep open; next train | Filed 2026-09-27 18:17 UTC. Raw `reasoning_text` reaches clients that render it; contributor PR [#6123](https://github.com/lidge-jun/opencodex/pull/6123) proposes `hideRawReasoning`. | [Deferral comment](https://github.com/lidge-jun/opencodex/issues/6122#issuecomment-5859194800): the wire-level config change needs a full review next train. |
+
+## Receiving-thread re-verification (Sol)
+
+The prior decisions above were produced with a different model. A `gpt-6-sol` reviewer re-read all 12 issues and their comments against `dev` `24b2f39b` and agreed with every keep-open decision; none is fully resolved on `dev`, so there is still no close candidate. Three owned issues filed later (#6093, #6118, #6122) are handled in the rows above.
+
+## Execution shape
+
+No source files are changed in wp1. For each planned comment, compare the live remote `dev` SHA to the audited `24b2f39b` SHA and recheck issue state and latest comment immediately before posting. Abort for source re-audit if `dev` moved. Prepare a concise English body in scratch, include source links and an explicit next step, post with `gh issue comment`, then read the exact comment URL/body back. A retry accepts an existing triage marker only if its body exactly matches the approved draft; otherwise reconcile the comment without duplicating it. Closing needs a later proof that the full issue is on `dev`; no candidate meets that gate now. The alternative of closing partially implemented items would erase outstanding acceptance and is rejected.
+
+## wp1 revalidation and architect disposition
+
+The prior D at `bc26397ecc` sent wp1 to the issue ledger. A fresh `origin/dev` fetch still returned `24b2f39b`; all 12 owned issues remained open, and the five planned comment targets had no newer comments. #5682 and #5742 were re-read as merged at `7f8d5380bf` and `dd7cb695a9`. Architect handle `01a0e33a-411b-7d42-9f74-00734614db07` advised posting four drafts unchanged, revising #2834, and closing none. I accepted that correction because #2834 explicitly separates no-completion connectivity from a user-initiated completion that can incur cost, and treats missing model metadata as unconfirmed. The other seven roadmap issues retain their documented no-comment disposition. The same architect checks this amended plan before the independent wp1 audit.
+
+The same architect returned **ALIGNED** after re-reading the revised #2834 plan and draft. Five comments and zero closures remain the wp1 executable scope.
+
+## wp1 independent audit correction
+
+The first wp1 reviewer pass found two execution blockers in the scratch posting script: a live `dev` change could invalidate source evidence while an issue stayed open, and a retry could accept an obsolete marked comment without body comparison. The script and execution plan now check the remote `dev` SHA before each post and compare marked existing bodies exactly; mismatches abort for review. The same reviewer re-audits these changes before posting.
+
+The same independent reviewer returned **VERDICT: PASS** after the posting safeguards were amended. It confirmed the full `dev` SHA checks, exact marked-body comparison, the five latest-comment timestamps and all 12 owned decisions. No issue was closed or commented during audit.
+
+wp1 Build posted the five comments listed in `040_outcome.md` and left all 12 owned issues open. The next phase reviews the 21 large PRs; no issue closure is queued without new full-resolution evidence.
diff --git a/devlog/_plan/260927_release_train_4/issue-triage/020_pr_actions.md b/devlog/_plan/260927_release_train_4/issue-triage/020_pr_actions.md
new file mode 100644
index 00000000000..ebfb597e1d5
--- /dev/null
+++ b/devlog/_plan/260927_release_train_4/issue-triage/020_pr_actions.md
@@ -0,0 +1,55 @@
+# 020 — Large PR release decisions and contributor feedback
+
+Observed against `origin/dev` `24b2f39b77a29711c5064987de169ecf4a97c58b` on 2026-09-27. All 21 PRs target `dev`. `mergeable` denotes text topology only; it is not approval or exact-head CI. This phase changes no runtime file. Its external diff is one specific English review comment per PR with the blocker and next work; retain each feature PR open. The lone code carry is the isolated standalone URL fix from #6079, designed in `030_standalone_carry.md`. Strategies below refer to the **current release**; hold means no full-PR merge now.
+
+GitHub merge topology at this read: **conflicting** #5912 #5782 #5631 #5374 #4259 #4228 #4222 #4177 #4056 #4022 #3742 #3463 #3025; **text-mergeable** #6079 #6077 #5955 #5947 #5800 #5424 #5253 #4647. Every row below has a separate review, CI, product or security gate regardless of topology.
+
+| PR / head | Strategy | Current value, risk and exact next work |
+|---|---|---|
+| [#6079](https://github.com/lidge-jun/opencodex/pull/6079) `9068502a` | **Reimplement narrow helper; hold feature** | Windows Desktop control now fences usage trials to the native credential generation, but retains an [unverified exhausted-account composer recovery premise](https://github.com/lidge-jun/opencodex/pull/6079). [Windows trust code](https://github.com/lidge-jun/opencodex/blob/d6bd88d7d49c6ea8f2e9edfa4f359f22ab56d3ae/src/codex/desktop-compatibility/windows-certificate-trust.ts) and PAC routing need explicit security review and real installed-client proof. Its independent [standalone URL fix](https://github.com/lidge-jun/opencodex/blob/d6bd88d7d49c6ea8f2e9edfa4f359f22ab56d3ae/src/lib/standalone.ts) can be reimplemented with attribution, focused test and CI. Keep original PR for remaining feature. |
+| [#6077](https://github.com/lidge-jun/opencodex/pull/6077) `f3c7497a` | **Hold** | Cloudflare Containers hub has [R2/lease supervisor](https://github.com/lidge-jun/opencodex/blob/f3c7497aaa35dd23fab19d720865764d39e5a70a/docker/cloudflare-supervisor.ts), but `deploy/**` lacks product CI/typecheck coverage. Add deployment CI, review secrets/auth/snapshot recovery and run current-head provider smoke before a hosting release. |
+| [#5955](https://github.com/lidge-jun/opencodex/pull/5955) `96a8c3b6` | **Hold** | Advisor runtime can send conversation/tool-result context to another provider and reinject advice as `developer` authority. Define consent, disclosure and authority contract, review privacy/security, rebase and obtain full exact-head CI. |
+| [#5947](https://github.com/lidge-jun/opencodex/pull/5947) `eb6953b8` | **Hold** | PAC fallback/CONNECT feature remains unproven in the live stopped-proxy Chromium path. Demonstrate it in ChatGPT Desktop, review CA/proxy trust, refresh `dev` and run required exact-head CI. |
+| [#5800](https://github.com/lidge-jun/opencodex/pull/5800) `1c399592` | **Hold pending owner/security decision** | Current [`claude -p` adapter](https://github.com/lidge-jun/opencodex/blob/24b2f39b77a29711c5064987de169ecf4a97c58b/src/adapters/claude-cli/adapter.ts#L58-L105) is a one-shot constructed turn. The SDK replacement adds dependency and config migration; no safe adapter-only cherry-pick. [Anthropic's current login guidance](https://support.claude.com/en/articles/13189465-log-in-to-your-claude-account) prefers API keys for third-party products and bars third-party traffic routed against subscription limits, while its [June SDK article](https://support.claude.com/en/articles/15036540-use-the-claude-agent-sdk-with-your-claude-plan) says a proposed separate-credit change was paused. This creates a policy question, not a legal ruling. Decide whether to retain any subscription proxy row, review SDK supply chain/migration, clear draft/hygiene gates, and run exact-head CI. |
+| [#5782](https://github.com/lidge-jun/opencodex/pull/5782) `651ff2f8` | **Hold; split** | Windows durable-stop guardian and ChatGPT bridge/replay receipts are independent new subsystems, neither on `dev`. The draft is conflicting and hygiene fails; no portable narrow bug slice was found. Separate feature lines, rebase, review intent-file/credential boundaries, and obtain exact-head Windows and other platform CI. |
+| [#5631](https://github.com/lidge-jun/opencodex/pull/5631) `4f59d573` | **Hold; split/reimplement later** | Source-model scoping usefully narrows current [global compaction override](https://github.com/lidge-jun/opencodex/blob/24b2f39b77a29711c5064987de169ecf4a97c58b/src/server/responses/compaction-routing.ts#L52-L61), but exposing reasoning to a summarizer is separate data disclosure. Rebase, isolate selector from reasoning, settle disclosure, rerun failed change tests and CI. |
+| [#5424](https://github.com/lidge-jun/opencodex/pull/5424) `a98ca96a` | **Conditional next-train candidate; hold now** | Native Mirasim OAuth/dual-wire support is based on current `dev`, but [cross-platform product CI is awaiting approval](https://github.com/lidge-jun/opencodex/actions/runs/36323902406) and broad local tests are not green. Complete owner review of device-ticket/auth and credential destination, resolve baseline failures and execute exact-head required CI. |
+| [#5374](https://github.com/lidge-jun/opencodex/pull/5374) `5e33513b` | **Hold** | Voice routes conflict with current audio/auth surfaces, and package/CORS changes need sponsorship and security review. Separate global test tooling changes, rebase, validate voice flows and obtain exact-head CI. |
+| [#5253](https://github.com/lidge-jun/opencodex/pull/5253) `ccc08f0a` | **Conditional next-train candidate; hold now** | pt-BR catalog is valuable and text-mergeable, but the fork is 115 `dev` commits behind. Ask author to refresh, fill new English keys/placeholders, add GUI screenshot, run locale/GUI/typecheck/structure gates and exact-head CI; then obtain maintainer approval. No push to contributor fork. |
+| [#5912](https://github.com/lidge-jun/opencodex/pull/5912) `8ae20119` | **Hold** | Zed provider conflicts in models/structure. [Stream completion](https://github.com/lidge-jun/opencodex/blob/8ae20119f4ce5281e8af5e9637e6fff8e858e3d9/src/adapters/zed.ts#L108-L126) and credential-key handling need fixes; prove real login/prompt, service terms, security review and exact-head CI before provider publication. |
+| [#4647](https://github.com/lidge-jun/opencodex/pull/4647) `9008be62` | **Hold** | Z.ai Start Plan still has [global fetch call sites](https://github.com/lidge-jun/opencodex/blob/9008be622ad6290747f6479a531ccc90466a8c99/src/adapters/zcode-start-plan.ts#L173-L183) and a worker lifecycle concern under [existing change request](https://github.com/lidge-jun/opencodex/pull/4647#pullrequestreview-5327878370). Land/tests both fixes, remove tracked GUI hook-state artifact, then security/dependency review and CI. |
+| [#4259](https://github.com/lidge-jun/opencodex/pull/4259) `65301084` | **Hold** | ZCode desktop agent is over 1,000 `dev` commits behind with broad conflicts; [documented native tool execution](https://github.com/lidge-jun/opencodex/blob/6530108479e33e880255c852c49d5ca56bcc7453/docs-site/src/content/docs/guides/zcode-agent.md#L152-L175) needs explicit host-access policy. Rebase, settle that default, run native acceptance and CI. |
+| [#4228](https://github.com/lidge-jun/opencodex/pull/4228) `ad59aae4` | **Hold** | Project-context cap is present, but adapter conflict and changes-requested review remain. Rebase `src/adapters/command-code.ts`, review local content disclosure, resolve objections, and run exact-head CI. |
+| [#4222](https://github.com/lidge-jun/opencodex/pull/4222) `fc8460d7` | **Hold** | Desktop side-chat cache proposal conflicts in request logging/layout, and real upstream cache savings are unproven. Rebase, test account/prefix isolation and measure real Desktop acceptance/caching; obtain security review and CI. |
+| [#4177](https://github.com/lidge-jun/opencodex/pull/4177) `ddd144d6` | **Hold** | Cross-provider redirect conflicts in `src/router.ts` and changes the [provider/account preservation contract](https://github.com/lidge-jun/opencodex/blob/24b2f39b77a29711c5064987de169ecf4a97c58b/docs-site/src/content/docs/reference/configuration/routing.md#L37-L46). Choose explicit opt-in or migration semantics, resolve review objection and conflict, then routing regressions and CI. |
+| [#4056](https://github.com/lidge-jun/opencodex/pull/4056) `76d297b8` | **Hold** | Credential-bearing remote voice relay is conflicting and lacks head-bound real voice/Windows proof. Rebase with #5374's audio surface in mind, review local-process trust, run real call setup/sideband/rotation/teardown and CI. |
+| [#4022](https://github.com/lidge-jun/opencodex/pull/4022) `e54048a1` | **Hold; split** | 175-file Guardrails reference draft conflicts across Responses, GUI, CI and lockfile; [hygiene is red](https://github.com/lidge-jun/opencodex/actions/runs/36019127454). Agree on first trust/failure contract, split a reviewable transport slice, obtain security review and current-head CI. |
+| [#3742](https://github.com/lidge-jun/opencodex/pull/3742) `47000590` | **Hold** | Cursor pool kernel conflicts in [credential-namespaced adapter](https://github.com/lidge-jun/opencodex/blob/470005908656f5608e878772bb72f5f659239117/src/adapters/cursor.ts). Rebase without weakening current isolation, pair kernel with bounded activation, review OAuth-token handling and run Cursor tests/CI. |
+| [#3463](https://github.com/lidge-jun/opencodex/pull/3463) `97cf9f96` | **Hold** | Pre-adapter handler runs with proxy permissions and conflicts in Responses/core management. Rebase, settle execution trust and once-per-turn/native-body contract, resolve Windows validation, complete security review and CI. Current `maintainer-sponsored` label exists; stale body text about missing sponsorship should be corrected. |
+| [#3025](https://github.com/lidge-jun/opencodex/pull/3025) `7d392541` | **Hold; split** | Dashboard/testing/launcher bundle is 3,639 `dev` commits behind, conflicts in `Providers.tsx` and management routes, lacks the GUI screenshot and has [hygiene failure](https://github.com/lidge-jun/opencodex/actions/runs/36019143150). Reassess each feature against today's dashboard, split, sponsor restricted surfaces, then GUI/Windows/CI validation. |
+
+## Comment and closure contract
+
+Post one concise English comment per PR, naming the observed head, concrete blocker and exact next action. Compare the live `dev` SHA, full PR head OID, `dev` base, review/draft state and newest issue-comment ID/update timestamp with the audited snapshot immediately before posting; abort for re-audit on change. The posted marker is idempotent only when its body equals the approved draft, including across multiple paginated comment pages. For #6079, post the hold/carry decision now; when the focused carry PR exists, edit that same comment to thank `luvs01` and link the exact carry PR, then read back the edited body. Retain #6079 because its Windows feature remains unmerged. Do not close any other PR for size or age. Read each new comment back and add URL to `040_outcome.md`. The alternative of merging a text-mergeable PR without current product CI is rejected by `MAINTAINERS.md` and the release gate. The alternative of blanket closure would destroy contributor review context without proving supersession.
+
+## wp2 revalidation and architect disposition
+
+The prior D closed wp1 with five exact issue comment readbacks and no closures. Fresh `origin/dev` remained `24b2f39b`; all 21 nominated PR heads still matched this table, 13 had text conflicts and eight were text-mergeable. The architect recommended posting 21 release decisions, merging none as-is, and deferring the #6079 carry link by editing the same original-PR comment when the focused PR exists. I accepted that sequence. Comment preflight records the newest comment timestamp and review/draft state for each head; #4259 has more than 100 comments, so the readback must paginate and flatten all pages. The same architect reflects on this revision before independent A audit.
+
+The #6079 head moved during wp2 planning from `d6bd88d7` to `dc209603`. The [single new commit](https://github.com/lidge-jun/opencodex/commit/dc2096031093d1c0300bf5a911f4b0f711538714) changes native-identity/usage-controller handling and adds tests; comparison shows no change to `src/lib/standalone.ts` or its focused regression. The trial still lacks exhausted-account proof and the trust/PAC review remains, so the hold plus narrow reimplementation decision is unchanged. All other named heads matched the prior snapshot.
+
+The architect reflection identified a stale-head gap: prefix matching could accept a different head and did not check the base, while comment creation time would miss an edit. The scratch posting script and audited snapshots now compare full head OID, `baseRefName == dev`, and the latest comment ID plus `updated_at` before each post. The same architect rechecks this revision.
+
+The same architect re-read the exact-head and latest-comment safeguards and returned **ALIGNED**. It confirmed `dc209603` descends from the prior #6079 head without changing the standalone helper or test; the hold and bounded carry remain valid. All 21 PR drafts are ready for independent A audit, subject to their per-post freshness checks.
+
+The independent wp2 auditor returned **VERDICT: PASS** with no blockers. It matched all 21 drafts to full heads and `dev` bases, checked review and latest-comment snapshots, paginated #4259's 101 comments, and verified the highlighted #5800/#5424/#5253/#4647/#6079 decisions. No PR was changed during audit.
+
+wp2 Build posted the 21 comments listed in `040_outcome.md`, retained every feature PR open, and left the #6079 carry link for an edit to its existing comment once the focused PR exists. No large PR was merged as-is.
+
+#6079 moved once more during wp3 planning to `9068502a`; [the intervening commit](https://github.com/lidge-jun/opencodex/commit/9068502a0aa289968129c15705805f729644c05a) changes only a desktop identity test. Its standalone helper/test patch, unresolved Windows recovery proof, and release hold are unchanged. The posted comment remains a truthful review of its then-current `dc209603` head; the planned carry-link edit will cite the newer head.
+
+## Receiving-thread re-verification (Sol) and #5782 correction
+
+A `gpt-6-sol` reviewer rechecked all 21 decisions against current heads and `dev` `24b2f39b`. It agreed with 20, including the #5800 hold: the SDK transport swap, new dependency and provider-ID migration leave no adapter-only hunk to carry, and the subscription-provider policy question is unchanged. It disagreed with one point in the #5782 row. The PR does contain a narrow, independent bug fix: [`cdf0330b`](https://github.com/lidge-jun/opencodex/commit/cdf0330b3794fce02ff96fdbca5a93e45c1b3a4a) changes only `src/codex/sync.ts` so that a service-home admission refusal is logged instead of silently failing `/readyz`. I confirmed that on `dev` the refusal reaches `runStartupReadinessSync` and `ocx sync` without any reason being printed. The upstream line logs the raw admission message, which can contain private home and service-definition paths.
+
+Decision: hold the rest of #5782 as recorded above, and reimplement the diagnostic slice with a path-free line that points to `POST /api/sync` (which already returns the reason in its 409 body). The result is [#6100](https://github.com/lidge-jun/opencodex/pull/6100), with a red-then-green regression, a `structure/config.md` sentence (a Sol reviewer caught the stale "concrete messages on stderr" claim), and a `Co-authored-by: tcflying` trailer.
diff --git a/devlog/_plan/260927_release_train_4/issue-triage/030_standalone_carry.md b/devlog/_plan/260927_release_train_4/issue-triage/030_standalone_carry.md
new file mode 100644
index 00000000000..66888f98f50
--- /dev/null
+++ b/devlog/_plan/260927_release_train_4/issue-triage/030_standalone_carry.md
@@ -0,0 +1,35 @@
+# 030 — Carry the independent Bun virtual-URL fix from #6079
+
+This is a bounded reimplementation from [#6079](https://github.com/lidge-jun/opencodex/pull/6079), **not** the Windows Desktop compatibility feature. The author is `luvs01`; the carry commit or PR description must include `Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>` (the name/email on the source PR commits). Keep #6079 open and comment with the carry PR URL because its feature remains under review.
+
+## Diff-level change map
+
+| Path | Operation | Before → after | Reachable proof |
+|---|---|---|---|
+| `src/lib/standalone.ts` | MODIFY | `isStandaloneModuleUrl` uses substring `/$bunfs/` and a literal `~BUN` regex; Windows `file:///B:/%7EBUN/...` is false. Parse a hostless `file:` URL, decode exactly one pathname URL layer, and match only the virtual-root boundary `/$bunfs/` or `/[drive]:/~BUN/`. Invalid URL/percent encoding, non-`file:` protocols and `file://server/...` network-host URLs return false. | Existing helper test calls literal, encoded upper/lower-case and double-encoded marker; malformed, HTTPS and network-host file URLs reject; a source path with `$bunfs` below its root stays source. |
+| `tests/lib/standalone.test.ts` | MODIFY | Existing test covers only literal markers. Add the encoded Windows cases, double-encoding rejection, wrong scheme, network-host file URL, nested source marker and malformed encoding; run red before implementation and green after. | `bun test tests/lib/standalone.test.ts` shows red/green under the same checkout. |
+| `structure/ops/service-and-sidecars.md` | MODIFY | This service document already names `src/lib/standalone.ts`; document one-layer decoding and the hostless `file:` gate, preserving source-process behavior. | `bun run structure:check`, source/doc comparison. |
+| `structure/manifest.json`, generated `structure/INDEX.md` | MODIFY | The source-to-doc map omits `ops/service-and-sidecars.md` under `src/lib/` even though it describes this helper. Add `src/lib/` to that doc's `documents` list and run `bun run structure:index`. Review all currently mapped `src/lib/` docs for a conflicting standalone claim. | `bun run structure:check` and generated index diff. |
+| `devlog/_plan/260927_release_train_4/issue-triage/040_outcome.md` | MODIFY after CI | Planned carry becomes actual PR/head/CI/merge receipts; any unrun Windows package test is named as a limitation. | GH readback at exact head and post-merge `dev` CI. |
+
+No new test file is planned, so test-layout registries do not change. No config or union member changes. Before edit, inspect `tests/fixtures/file-size-baseline.json` for both touched code files and `structure/INDEX.md` for source ownership; do not raise a cap. The helper is public to service/standalone callers, so check the direct callers and avoid accepting non-file schemes or treating a double-encoded marker as compiled. The source edit belongs to `src/lib`, so `src/AGENTS.md` and the owning structure document apply.
+
+## Verification and merge gate
+
+Use a new `codex/t4-issue-triage-*` branch based on the then-current `origin/dev` for the carry PR. Commit the docs-first roadmap on `codex/t4-issue-triage-audit`, then switch this worktree to a separate `codex/t4-issue-triage-standalone` branch from fresh `origin/dev` for the focused code PR. After that PR merges, return to the docs branch, update the outcome, rebase it on fresh `dev`, and publish a docs-only report PR. Run `bun test tests/lib/standalone.test.ts`, `bun run typecheck`, `bun run structure:check`, `bun run privacy:scan` in the source worktree; after committing the carry, create a detached verification worktree at `/private/tmp/t4-issue-triage-verify`, confirm its `git rev-parse HEAD` equals the carry commit, run `bun install --frozen-lockfile` there (ignored `node_modules` is absent in a fresh worktree), then run `bun run test:changed` (and any full suite) there, because cleanup in a `~/.codex` worktree is blocked by protection guards. Do not bypass those guards. No manual proxy start is planned; if one becomes necessary, isolate `HOME`, `CODEX_HOME` and `OPENCODEX_HOME` together and disable client sync when possible. Also run `git diff --cached --check` before commit and `git diff --check origin/dev...HEAD` after commit. The full suite may be omitted for seven-lane resource contention only if the focused and changed tests execute, the PR Verification records exact commands/results and explains the exception, and CI supplies broad validation. Inspect every required CI job for the final head and base, Codex/CodeRabbit findings, current `origin/dev` ancestry, and merged-union checks before merge. A local helper test cannot claim a Windows packaged binary passed; record that risk.
+
+If any test or exact-head required CI is unavailable, keep the carry PR draft/open and record the blocker. Do not merge by treating a skipped, cancelled or older-head check as success. The original #6079 feature is not closed by this partial carry.
+
+## wp3 source revalidation and architect proposal
+
+The prior D closed wp2 with 21 exact-body PR comment readbacks. `origin/dev` remains `24b2f39b`; its helper still uses substring detection. #6079 advanced from the commented `dc209603` head to `9068502a`; the only intervening commit changes `tests/clients/desktop-compatibility-native-identity.test.ts`, so the helper/test patch being carried is unchanged. Architect handle `01a0e33a-411b-7d42-9f74-00734614db07` recommended the planned focused carry and source-map repair, with one correctness amendment: reject a network-host `file://server/$bunfs/...` URL and add that negative test plus a nested source-path marker test. I accept this because direct callers use the boolean for service CLI, package-integrity, GUI assets, runtime selection and CodeBuddy invocation; a false standalone result for source paths matters. The helper proof remains local semantic evidence, not a packaged Windows claim. The same architect reflects on the revised plan before independent audit.
+
+The same architect reflected on the amended hostless-URL tests and separate PR scopes and returned **ALIGNED**. Fresh implementation, red/green output, exact-head CI and post-merge `dev` evidence remain pending execution gates.
+
+The coordinator clarified verification isolation during A: all subagents in this lane have been spawned with explicit `gpt-6-sol`; `test:changed` and any full suite run only from a detached, same-commit `/private/tmp/t4-issue-triage-verify` checkout. This changes the test environment, not the helper design or code ownership.
+
+## wp3 independent audit correction
+
+The first independent reviewer round found one medium verification blocker: the temporary validation checkout would lack ignored `node_modules`, and the earlier fresh-worktree focused preflight had failed on missing `zod/v4`. The plan now requires an exact-HEAD comparison and `bun install --frozen-lockfile` inside `/private/tmp/t4-issue-triage-verify` before `test:changed` or a full run. This changes only the test precondition; the same reviewer re-audits it.
+
+The same independent reviewer rechecked the detached verification checkout, exact-HEAD comparison and frozen install precondition and returned **VERDICT: PASS** with no remaining blockers. No implementation or broad test has yet run.
diff --git a/devlog/_plan/260927_release_train_4/issue-triage/040_outcome.md b/devlog/_plan/260927_release_train_4/issue-triage/040_outcome.md
new file mode 100644
index 00000000000..079f530761f
--- /dev/null
+++ b/devlog/_plan/260927_release_train_4/issue-triage/040_outcome.md
@@ -0,0 +1,89 @@
+# 040 — Publication and outcome plan
+
+This document begins as the executable final phase design. At Done it becomes the receipt for this lane. The report to land on `dev` is `000_plan.md`, `010_issue_actions.md`, `020_pr_actions.md`, `030_standalone_carry.md`, and this document, all within `devlog/_plan/260927_release_train_4/issue-triage/`. No other lane's devlog path changes.
+
+## External write map
+
+- For the five issue status changes named in `010_issue_actions.md`, post English source-linked comments on #5745, #5493, #4198, #4173 and #2834; read back the comment URL and current issue state. The other seven issues remain open with the recorded reason. No close is planned absent later proof.
+- For each of the 21 PRs in `020_pr_actions.md`, post a concrete English release decision to that PR only after confirming its head has not moved. Read back each comment URL. Keep the feature PR open; #6079 remains open after the narrow helper carry.
+- If the helper carry clears its checks, create a `dev`-targeting PR with Summary, Verification and Checklist; attribute `luvs01`, link #6079, and merge only after exact-head required CI and the fresh-`dev` union check. Read back the merge SHA and `dev` CI run. If no helper carry is safe, explain why it stayed open.
+- Publish the decision report by a `dev` PR after comments and carry outcome have been recorded. The docs PR needs `git diff --cached --check` before commit and `git diff --check origin/dev...HEAD` after commit, `bun run privacy:scan`, a complete PR template, exact-head required CI and post-merge `dev` confirmation.
+
+## Evidence slots to fill from readback
+
+The filled receipts are under **Final outcome** at the end of this document. The original instruction was to add a table of exact issue comment URLs, PR comment URLs, any closed issues/PRs and their evidence, carry PR/head/merge SHA, docs PR/head/merge SHA, exact-head CI run URLs and conclusions, post-merge `dev` CI, and the remaining risks. Never mark an unrun suite passed. If an item head changes, refresh its decision and comment before finalizing.
+
+## Final reconciliation checks
+
+1. Compare `gh issue list --limit 300 --json number` with the exclusion set in `000_plan.md`; every owned open issue must appear in `010_issue_actions.md` or be newly appended with a decision.
+2. Compare `gh pr list --limit 300 --json number,headRefOid` with the 21 requested PR IDs, then check `020_pr_actions.md` and the posted comment receipts; all must be present exactly once.
+3. Confirm no `gui/` asset or screenshot entered the branch, no version/tag changed, no other lane worktree or excluded item was modified, and the carry PR contains only the isolated standalone helper, regression and owning structure files, while the separate final docs PR has no non-devlog delta.
+4. Run privacy and structure gates on the final report, then confirm required CI on the actual head after push and on `dev` after merge.
+
+## wp1 issue comment receipts
+
+All five comments were posted once from the reviewed English drafts while remote `dev` was `24b2f39b77a2`, with open-state and latest-comment checks before the write and exact body readback afterward. No owned issue was closed; all 12 retain unmet acceptance.
+
+| Issue | Comment |
+|---|---|
+| #5745 | [status and next step](https://github.com/lidge-jun/opencodex/issues/5745#issuecomment-5856932574) |
+| #5493 | [status and next step](https://github.com/lidge-jun/opencodex/issues/5493#issuecomment-5856933033) |
+| #4198 | [status and next step](https://github.com/lidge-jun/opencodex/issues/4198#issuecomment-5856933529) |
+| #4173 | [status and next step](https://github.com/lidge-jun/opencodex/issues/4173#issuecomment-5856934021) |
+| #2834 | [status and next step](https://github.com/lidge-jun/opencodex/issues/2834#issuecomment-5856934492) |
+
+## wp2 PR comment receipts
+
+At posting, remote `dev` remained `24b2f39b`; each of the 21 PRs retained its audited full head and `dev` base. The poster checked review/draft state and latest comment ID/update time, posted the English item-specific decision once, and read its body and URL back. No original PR was closed. #6079 will receive the focused carry PR URL by editing its same comment in wp3.
+
+| PR | Decision comment |
+|---|---|
+| #6079 | [release train 4 decision](https://github.com/lidge-jun/opencodex/pull/6079#issuecomment-5857047467) |
+| #6077 | [release train 4 decision](https://github.com/lidge-jun/opencodex/pull/6077#issuecomment-5857048095) |
+| #5955 | [release train 4 decision](https://github.com/lidge-jun/opencodex/pull/5955#issuecomment-5857048648) |
+| #5947 | [release train 4 decision](https://github.com/lidge-jun/opencodex/pull/5947#issuecomment-5857049158) |
+| #5800 | [release train 4 decision](https://github.com/lidge-jun/opencodex/pull/5800#issuecomment-5857049686) |
+| #5782 | [release train 4 decision](https://github.com/lidge-jun/opencodex/pull/5782#issuecomment-5857050257) |
+| #5631 | [release train 4 decision](https://github.com/lidge-jun/opencodex/pull/5631#issuecomment-5857050737) |
+| #5424 | [release train 4 decision](https://github.com/lidge-jun/opencodex/pull/5424#issuecomment-5857051217) |
+| #5374 | [release train 4 decision](https://github.com/lidge-jun/opencodex/pull/5374#issuecomment-5857051718) |
+| #5253 | [release train 4 decision](https://github.com/lidge-jun/opencodex/pull/5253#issuecomment-5857052212) |
+| #5912 | [release train 4 decision](https://github.com/lidge-jun/opencodex/pull/5912#issuecomment-5857052786) |
+| #4647 | [release train 4 decision](https://github.com/lidge-jun/opencodex/pull/4647#issuecomment-5857053337) |
+| #4259 | [release train 4 decision](https://github.com/lidge-jun/opencodex/pull/4259#issuecomment-5857053915) |
+| #4228 | [release train 4 decision](https://github.com/lidge-jun/opencodex/pull/4228#issuecomment-5857054492) |
+| #4222 | [release train 4 decision](https://github.com/lidge-jun/opencodex/pull/4222#issuecomment-5857054992) |
+| #4177 | [release train 4 decision](https://github.com/lidge-jun/opencodex/pull/4177#issuecomment-5857055544) |
+| #4056 | [release train 4 decision](https://github.com/lidge-jun/opencodex/pull/4056#issuecomment-5857056048) |
+| #4022 | [release train 4 decision](https://github.com/lidge-jun/opencodex/pull/4022#issuecomment-5857056608) |
+| #3742 | [release train 4 decision](https://github.com/lidge-jun/opencodex/pull/3742#issuecomment-5857057185) |
+| #3463 | [release train 4 decision](https://github.com/lidge-jun/opencodex/pull/3463#issuecomment-5857057686) |
+| #3025 | [release train 4 decision](https://github.com/lidge-jun/opencodex/pull/3025#issuecomment-5857058233) |
+
+## wp3 resume plan (receiving thread, 2026-09-28 KST)
+
+The previous thread stopped in wp3 Build with the carry commit `08271bdf` unpushed and `test:changed` interrupted. This thread resumes from that state. Fresh `origin/dev` is still `24b2f39b`, so no carry rebase is needed yet, and #6079 is still at `9068502a`.
+
+Inventory recheck found one owned issue created after the audit: [#6093](https://github.com/lidge-jun/opencodex/issues/6093) asks the provider pacing panel to expose `requestPacing.maxConcurrentRequests`, whose backend landed in #5954. Its author opened [#6094](https://github.com/lidge-jun/opencodex/pull/6094) with the GUI change. Decision: review #6094 on its merits for this release; if it is correct and the exact-head product CI can be run, land it and close #6093 after the change is on `dev`; otherwise leave a specific English review on #6094 and a status comment on #6093.
+
+Ordered steps:
+
+1. Carry PR. Confirm the verify checkout HEAD equals `08271bdf`, rerun `bun run test:changed` there, push `codex/t4-issue-triage-standalone`, open a `dev` PR with the full template and the `luvs01` co-author trailer, and dispatch `ci.yml` with `lane=all` on the branch because the nine Windows shards run only on `workflow_dispatch`; record that run's head and result separately from the PR-event checks. Merge only on exact-head success with reviewer findings resolved. Then edit the existing #6079 decision comment with the carry PR link and thanks, keeping #6079 open. A compiled macOS probe already showed `import.meta.url` = `file:///$bunfs/root/probe` and the new helper returning true; Windows compiled proof stays with CI and the contributor.
+2. #6094 review by a Sol reviewer in `/private/tmp/t4-issue-triage-6094` (diff against backend contract, locale completeness, file-size ratchet, test layout, screenshot, gates). Act on the verdict as above; pushing to a contributor fork is not allowed, so a small blocker is fixed only by a maintainer carry PR with a co-author trailer.
+3. Sol re-verification of the prior 12 issue and 21 PR decisions, which another model produced. Any DISAGREE is reconciled here with a recorded reason before the docs PR; #5782 and #5800 are rechecked for a narrow, low-risk bug slice.
+4. Docs PR. Rebase this audit branch on the post-merge `dev`, fill the evidence table (carry PR/head/merge SHA/CI, #6079 comment edit, #6093/#6094 outcome, re-verification result), run `privacy:scan`, `structure:check` and diff checks, then open, CI-verify and merge a devlog-only PR and confirm `dev` CI after merge.
+
+## Final outcome (2026-09-28 KST)
+
+The lane is done. Two focused bug fixes landed on `dev` with contributor credit; no issue met the full-resolution bar for closing; every large feature PR stays open with a posted decision.
+
+| Item | Result | Evidence |
+|---|---|---|
+| [#6098](https://github.com/lidge-jun/opencodex/pull/6098) standalone URL carry from #6079 | Merged, squash `ef4e9940`, `Co-authored-by: luvs01` | Head `c72b88ca`. PR-event product CI passed on every pushed head; Windows shards (`lane=all` dispatch) passed on the same diff at `9366801b` ([run 36333848482](https://github.com/lidge-jun/opencodex/actions/runs/36333848482)). The first dispatch had one Windows temp-dir `EPERM` cleanup flake in `server-management-auth.test.ts`. Local union tree with `dev` `3401e1ee`: focused 5 pass, typecheck, layout/ratchet 27 pass, structure, privacy exit 0. `test:changed` at `08271bdf`: 26181 pass / 20 fail; 16 of those pass in isolation, the other 4 fail identically on unchanged `dev` (machine-load timeouts). Compiled macOS probe: `file:///$bunfs/root/probe` → standalone. CodeRabbit and Codex: no findings. |
+| [#6100](https://github.com/lidge-jun/opencodex/pull/6100) service-home refusal log from #5782 | Merged, squash `7b83dede`, `Co-authored-by: tcflying` | Head `75f863c6`. Red-then-green regression; path-free log line (raw admission message can contain private paths). Sol review NEAR-PASS; its stale `structure/config.md` finding was fixed (file at its 600-line budget). Local union tree with `dev` `3401e1ee`: focused 30 pass, typecheck, layout/ratchet 27 pass, structure, privacy exit 0. `test:changed` not completed: stopped externally while waiting on another lane's test lock. Codex review: no findings. |
+| #6079 / #5782 originals | Kept open | Existing decision comments edited with carry links and thanks: [#6079](https://github.com/lidge-jun/opencodex/pull/6079#issuecomment-5857047467), [#5782](https://github.com/lidge-jun/opencodex/pull/5782#issuecomment-5857050257). |
+| [#6094](https://github.com/lidge-jun/opencodex/pull/6094) for #6093 | Reviewed, awaiting maintainer merge | Fork CI approved and passed at `edb17c73`; [review comment](https://github.com/lidge-jun/opencodex/pull/6094#issuecomment-5857585625). Contributor-PR merges are outside this lane's authority. |
+| 15 owned open issues | 0 closed | 12 audited plus #6093, #6118, #6122; all have unmet acceptance. Sol re-verification agreed with all 12 original decisions. |
+| 21 large PRs | 0 merged as-is, 0 closed | Sol re-verification agreed with 20; the #5782 disagreement produced #6100. |
+
+Per the coordinator's closing rule, per-PR Cross-platform CI was not awaited after the last rebase; the coordinator runs it once on the final `dev`. Remaining risks: no compiled Windows binary was run, so the Windows `%7EBUN` URL shape is proven only by unit cases and CI shards; `structure/config.md` sits exactly at its 600-line budget, so the next edit there must move text out.
diff --git a/devlog/_plan/260927_release_train_4/issue-triage/_handoff.md b/devlog/_plan/260927_release_train_4/issue-triage/_handoff.md
new file mode 100644
index 00000000000..e52cce3a6c5
--- /dev/null
+++ b/devlog/_plan/260927_release_train_4/issue-triage/_handoff.md
@@ -0,0 +1,24 @@
+# Issue-triage lane handoff — 2026-09-28 KST
+
+Stopped on coordinator request. All work is local unless the GitHub comment URLs in `040_outcome.md` say otherwise. Do not infer that a PR or CI completed.
+
+## Current state
+
+- Dedicated worktree `/Users/jun/.codex/worktrees/t4-issue-triage/opencodex` is checked out on `codex/t4-issue-triage-audit` at `31a2d91d2c3c35766629e779842042c1126f19da` before this handoff commit. It contains the 12 issue and 21 large-PR decisions, five issue comment receipts and 21 PR comment receipts under this directory. No issue or original PR was closed. The last observed `origin/dev` was `24b2f39b77a29711c5064987de169ecf4a97c58b`.
+- Local code branch `codex/t4-issue-triage-standalone` is at `08271bdf1cdf2c9f941559b468a5569dfc740e8f`, one commit above that `dev`. It reimplements only #6079's Bun encoded virtual-URL helper fix plus network-host/source-path negatives, focused test, and structure owner map. The commit includes `Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>`. No branch was pushed and this lane created no PR. #6079 itself was last observed open at `9068502a0aa289968129c15705805f729644c05a`; its full Windows feature stays deferred.
+- The same-commit detached verification checkout `/private/tmp/t4-issue-triage-verify` is at `08271bdf` with frozen dependencies installed. `bun run test:changed` was stopped on coordinator instruction (exit 143); its partial output reported 1297/1820 selected test files. It is **not a passing check**. No full suite or packaged Windows run was completed.
+- The host goal is active and the Codexclaw FSM is in wp3 Build (`B`). The roadmap and issue/PR comment phases (wp0–wp2) are Done; the final integration/report phase remains open. The two Sol subagents were closed.
+
+## Verified before stop
+
+- Focused helper test: red before implementation (encoded Windows URL and network-host cases failed), then `bun test tests/lib/standalone.test.ts` **5 pass / 0 fail**.
+- `bun run typecheck`, `bun run structure:check`, `bun run privacy:scan`, and whitespace diff check exited 0 on code commit `08271bdf`. Independent Sol implementation review returned PASS, with the explicit limit that helper tests do not prove a packaged Windows app.
+- No manual `ocx start` or proxy QA was run in this lane; no user-home client configuration was intentionally changed.
+
+## Next work for the receiving thread
+
+1. Recheck `origin/dev`, the code branch, and #6079's latest head. Continue from the code branch without mixing the report docs into its PR. Re-run `test:changed` in `/private/tmp/t4-issue-triage-verify` only after confirming the checkout HEAD equals the code branch commit; retain the seven-lane full-suite resource exception only with truthful PR Verification and exact-head CI.
+2. Push the focused code branch, open a `dev` PR using the repository template and the verified coauthor trailer, inspect all required exact-head CI and review findings, rebase/revalidate if `dev` advances, then merge only if every required gate succeeds. Confirm the resulting `dev` CI. Edit the existing [#6079 release decision comment](https://github.com/lidge-jun/opencodex/pull/6079#issuecomment-5857047467) with the carry PR link and thanks; keep #6079 open for its remaining feature.
+3. Return to `codex/t4-issue-triage-audit`, update `040_outcome.md` with carry PR/head/merge/CI evidence and comment edit, rebase on fresh `dev`, verify the 12/21 inventories and privacy/diff gates, then push/open/merge a **docs-only** `dev` PR under exact-head CI. This lane has not performed any of these publication steps.
+
+Potential shared-file collisions for the code PR: `structure/manifest.json` and generated `structure/INDEX.md`. Preserve other lanes' concurrent additions when rebasing. Do not touch the 29 explicitly excluded issues, other lane branches, `main`/`preview`, releases or user-home proxy settings.