chore(triage): batch-land 15 reviewed PRs (lab CL-01..CL-10, adapters, providers, models)

devlog/_plan/260807_compatibility_lab/011_cl10_revocation_v1_anchor_clarification.md

@@ -0,0 +1,17 @@
+# CL-10 V1 revocation anchor clarification
+
+Status: normative clarification to `010_cl10_public_evidence_export.md` section 17.
+
+`PublicEvidenceRevocationV1` uses exactly one already-verified target bundle as its authority anchor. The revocation may contain between 1 and 256 sorted unique targets, but every target must resolve inside that one anchor bundle:
+
+- a `bundle` target must equal the anchor bundle ID;
+- a `record` target must name a record contained by the anchor bundle;
+- mixed bundle/record targets are allowed only when they all resolve inside the same anchor bundle;
+- multiple distinct bundle IDs in one V1 revocation are not supported and must be rejected;
+- targets spread across multiple bundles are not supported even when those bundles use the same publisher key.
+
+The publisher algorithm, key ID and exact public key in the revocation must match the already-verified anchor bundle before the revocation signature is authoritative. V1 therefore has no cross-key, key-rotation or multi-bundle authority bootstrap.
+
+The phrase "one or more bundle/record IDs" in section 17 describes the bounded target list, not multiple independent bundle authority contexts. Where that wording could be read as authorizing a single V1 revocation across multiple bundles, this clarification is authoritative.
+
+Supporting multi-bundle revocation requires a separately reviewed contract/schema revision that defines how all target bundles are supplied, verified, bounded and bound to the signing authority before persistence or application.

devlog/_plan/260815_open_pr_triage/000_plan.md

@@ -0,0 +1,45 @@
+# 000 — 260815_open_pr_triage: Plan
+
+## Objective
+
+Triage every open PR shown in the owner's 2026-08-15 list (22 PRs, #1704-#1732) in lidge-jun/opencodex. Each PR gets exactly one executed disposition: MERGE (squash via gh, or cherry-pick when unmergeable), CLOSE with evidence-led comment, or KEEP-DRAFT with named gaps. Owner directives: suites run only on ssh lidge; pushing to dev is authorized (--no-verify allowed); unlimited subagents; multi-cycle PABCD.
+
+## Loop-spec
+
+- Loop archetype: verifier-defined (gh PR state + lidge suite green on dev).
+- Write scope: GitHub PR state (merge/close/comment), devlog unit docs. Out-of-scope: main/preview branches, npm release, issues, PRs #1703 and older (not in the owner's list).
+- Budget / bounds: wall-clock one session; BLOCKED if lidge or gh auth fails.
+
+## Evidence base
+
+- 5 explorer subagent verdicts (diff-level per-PR review), 2026-08-15.
+- GraphQL reviewThreads (authority for unresolved blocking threads).
+- Exact-head check-run rollup per PR (gh pr view --json statusCheckRollup).
+
+## Work-phase map (one phase = one full PABCD cycle)
+
+| WP | Doc | Slice | Depends on |
+|----|-----|-------|------------|
+| wp1 | 010 | Triage matrix (this unit's docs) | - |
+| wp2 | 020 | Lab CL merges: #1708 #1709 #1710 #1712 #1715 #1717 #1719 #1720, then #1705 -> #1706 stack | wp1 |
+| wp3 | 020 | Adapters: #1714 merge, then #1721 rebase + fixture fix + merge; #1722/#1723 stay draft (Major thread) | wp2 |
+| wp4 | 020 | Contributor #1716 merge; KEEP-DRAFT comments #1718 #1725 #1728; #1704 stays draft | wp2 |
+| wp5 | 020 | Storage/log-guard #1727 #1729 #1732 stay draft (named gaps) | wp1 |
+| wp6 | 030 | Final: lidge full suite on dev, verify all dispositions, report | wp2-wp5 |
+
+## Merge mechanics (B-phase execution)
+
+1. Independent lab fixes first (disjoint files; overlaps #1709/#1717 and #1712/#1720 verified clean by merge-tree): gh pr merge <n> --squash (--admin only if the review-requirement blocks; owner-directed triage).
+2. #1705 merges; GitHub auto-retargets #1706 to dev; merge #1706.
+3. #1714 merges. Then #1721: rebase onto dev, switch mimo-free fixture URL to canonical MIMO_CHAT_URL (semantic conflict with #1714's endpoint guard), push, merge.
+4. #1716 merges (external contributor - use gh merge so it records as merged).
+5. KEEP-DRAFT set: no state change; gaps recorded in 010 matrix; brief maintainer comment on external drafts (#1718 #1725 #1728).
+
+## Accept criteria
+
+- c1: 010 matrix written with per-PR evidence (this unit).
+- c2: every listed PR shows merged/closed/draft disposition via gh pr view.
+- c3: full suite green on lidge against final dev head.
+- c4: no security notes in tracked files (log-guard findings stay in matrix form - all referenced fixes already public in PR diffs).
+- c5: final per-PR outcome report.
+

devlog/_plan/260815_open_pr_triage/010_triage_matrix.md

@@ -0,0 +1,51 @@
+# 010 - Triage matrix (wp1 deliverable)
+
+Evidence gathered 2026-08-15. "checks" = exact-head check-runs; "threads" = fresh unresolved reviewThreads (GraphQL). Verdicts from 5 independent explorer subagents, spot-verified by maintainer agent.
+
+A-audit amendment (GO-WITH-FIXES, 2 blockers folded):
+1. #1706 will be retargeted to dev explicitly ('gh pr edit 1706 --base dev') before merging - the repo does not auto-delete branches, so merge does not auto-retarget stacked children.
+2. #1722/#1723 upgraded KEEP-DRAFT -> MERGE: the Cursor false-pass Major was fixed at head ca0a5124 (force-push 02:13Z, after the 01:56Z CodeRabbit comment); same fixed-in-branch standard the plan already applied to #1706. Residual: stale-thread hygiene only.
+
+## MERGE (15)
+
+| PR | What | Gate state | Notes |
+|----|------|-----------|-------|
+| #1708 | fix(lab) CL-01: negative control asserted its own repair | 35 green, 0 threads | harness integrity |
+| #1709 | fix(lab) CL-02: transactional ledger mutations | 26 green, 0 threads | TOCTOU races closed |
+| #1710 | fix(lab) CL-03: distinct transport failure classes | 35 green, 1 outdated | backward compatible |
+| #1712 | fix(lab) CL-04: 400 on invalid read filters | 35 green, 1 minor | empty-artifactClass follow-up optional |
+| #1715 | fix(lab) CL-05: GUI partial-read failures | 29 green, 0 threads | gui-screenshot-waived label present |
+| #1717 | fix(lab) CL-07: fail-closed outcome validation | 29 green, 0 threads | clean vs #1709 |
+| #1719 | fix(lab) CL-08: rebind runtime ownership on server replace | 32 green, 0 threads | lifecycle defect |
+| #1720 | fix(lab) CL-09: passive read surface alignment | 32 green, 0 threads | clean vs #1712 |
+| #1705 | feat(lab) CL-10 trust core | 31 green (react-doctor cancelled = superseded dup), 2 trivial + 1 minor threads | stack base |
+| #1706 | feat(lab) CL-10 operator/community | 26 green, Major fixed in-branch (7a1e066ae) | explicit retarget to dev before merge; core-lab boundary test green |
+| #1714 | fix(providers) static model discovery | 32 green, 0 threads | land BEFORE adapter stack (endpoint-guard fixture conflict) |
+| #1721 | refactor(adapters) registry authority Part 1 | 26 green, 0 threads | rebase + mimo fixture fix (authority test only) after #1714 |
+| #1722 | test(adapters) conformance Part 2 | 23 green; Major fixed at head ca0a5124 | stack order after #1721; A-audit upgrade |
+| #1723 | test(adapters) buffered freeform Part 3 | 23 green, 0 threads | stack order after #1722; A-audit upgrade |
+| #1716 | feat(models) per-custom-model reasoning effort | 27 green (+1 cancelled react-doctor dup; win shard skip systemic), screenshot present | "Critical duplicate payload" verified false positive; 1 minor trim nit |
+
+## KEEP-DRAFT (7)
+
+| PR | Why not now | Gap to merge |
+|----|-------------|--------------|
+| #1704 | own GUI quota PR: hygiene + enforce-target FAIL (no screenshot, no regression test), 5 fresh threads | screenshot, unit test, address threads |
+| #1718 | external draft, light gates only, no full CI | author checklist + maintainer-triggered CI |
+| #1725 | external draft, no full CI | author readiness + maintainer CI |
+| #1727 | enforce-target (screenshot), hygiene empty_catch, unresolved Major: sqliteHome/databasePath leak in API/CLI/UI | redact path fields, fixed-message errors, screenshot |
+| #1728 | author mid-flight: checklist 0/4, manual verification pending | author completes checklist |
+| #1729 | 5 real macOS test failures in protection/lock core, 10 unresolved threads | fix lock/trigger semantics failures |
+| #1732 | failing reclaim/gates checks, plausible TOCTOU + stopReason Majors, CI still running | post-open path re-validation, stopReason fix, drop duplicate workflow |
+
+## Stacks and order constraints
+
+- #1705 (base dev) -> #1706 (base cl10-public-core): merge #1705, then 'gh pr edit 1706 --base dev', then merge #1706.
+- #1721 -> #1722 -> #1723 stack: merge in order; use --delete-branch on each merge so the next child retargets to dev automatically (or retarget explicitly).
+- #1727 -> #1729 -> #1732 stack: all stay draft.
+- Semantic conflict: #1714's canonical-endpoint guard breaks the mimo-free fixture in #1721's authority test (example.invalid/v1). #1714 lands first; #1721 rebases with MIMO_CHAT_URL fixture before merge. #1722/#1723 fixtures re-verified against the combined tree before their merges.
+
+## Out of scope (open but not in owner's list)
+
+#1703 #1669 #1664 #1660 #1655 #1652 #1645 #1644 #1624 #1584 #1569 #1557 #1552 #1526 #1521 #1498 #1367 #1165 - untouched this round.
+

devlog/_plan/260815_open_pr_triage/020_merge_execution.md

@@ -0,0 +1,65 @@
+# 020 - Merge execution record (wp2-wp3)
+
+## Plan (written at P, verified: zero head drift on all 15 PRs, 2026-08-15)
+
+Mechanism: local integration branch with --no-ff merges of pull/<n>/head refs,
+so each PR head becomes an ancestor of dev and GitHub auto-marks the PR Merged
+on push (preserves contributor attribution, e.g. external #1716). One dev push,
+one dev CI run, one lidge validation before the push.
+
+### Step 1 - retarget stacked children to dev (gh pr edit --base dev)
+
+- #1706 (was cl10-public-core), #1722 (was refactor/adapter-registry-authority),
+  #1723 (was test/adapter-registry-conformance).
+
+### Step 2 - integration branch
+
+git fetch origin
+git switch -c int/260815-pr-landings origin/dev
+
+Merge order (dependency-safe):
+1. #1708 #1709 #1710 #1712 #1715 #1717 #1719 #1720 (independent lab fixes)
+2. #1705 then #1706 (stack; #1706 branch contains #1705)
+3. #1714 (endpoint guard)
+4. #1721 (authority test fixture fix required: tests/adapter-registry-authority.test.ts
+   mimo-free provider baseUrl example.invalid/v1 -> canonical MIMO_CHAT_URL
+   https://api.xiaomimimo.com/api/free-ai/openai/chat; separate fix commit)
+5. #1722 then #1723 (stack; contains #1721)
+6. #1716 (external feature, disjoint files)
+
+Each: git merge --no-ff FETCH_HEAD -m 'Merge PR #<n>: <title>' using
+git fetch origin pull/<n>/head.
+
+### Step 3 - devlog unit onto int
+
+Cherry-pick 1628d06c2 (triage docs) onto int.
+
+### Step 4 - validate
+
+git push origin int/260815-pr-landings
+ssh lidge: clone/fetch, checkout int branch, bun install, bun run typecheck +
+bun run test (+ privacy:scan). Suite runs ONLY on lidge per owner directive.
+
+### Step 5 - land
+
+git push origin int/260815-pr-landings:dev --no-verify
+(owner-authorized; enforce_admins=false so admin bypass works on protected dev)
+Then verify all 15 PRs auto-marked Merged; stragglers get an evidence comment
+and manual close.
+
+### Step 6 (wp3) - KEEP-DRAFT comments
+
+Brief maintainer comment on #1704 #1718 #1725 #1727 #1728 #1729 #1732 naming
+the recorded gaps (010 matrix).
+
+## A-audit amendments (GO-WITH-FIXES, 3 blockers folded)
+
+1. #1709 -> #1706 semantic conflict in src/lab/ledger/purge.ts: #1706's export-purge steps + deferred-error vars must be re-expressed inside #1709's withLedgerMutation wrapper. Pre-staged resolution; purge tests re-run.
+2. #1715 -> #1714 trivial conflict in gui/.eslint/i18n-allowlist.ts: take #1714's /^HTTP$/i version (superset).
+3. Fixture fix covers THREE files (mimo-free canonical /chat under #1714's guard): tests/adapter-registry-authority.test.ts (#1721), tests/adapter-tool-conformance.test.ts (#1722), tests/adapter-buffered-tool-conformance.test.ts (#1723). Separate commits, never amend PR heads (auto-merge detection is exact-SHA).
+4. Advisory: retargets before push; re-verify all 15 head SHAs at push time.
+
+## Execution log
+
+(pending)
+

devlog/_plan/260815_open_pr_triage/030_final_verification.md

@@ -0,0 +1,4 @@
+# 030 - Final verification (wp6)
+
+(pending: lidge suite output on final dev head, gh disposition verification, per-PR outcome report)
+

docs-site/src/content/docs/guides/pi.md

@@ -103,9 +103,26 @@ small-context model is never given more output than context. It is not a claim a
 model's true maximum.
 
 Two fields are deliberately absent. `cost` requires all four price fields and opencodex has no
-price data for routed models — emitting zeros would assert that every model is free. `reasoning` is
-a boolean in Pi while the catalog carries an effort ladder, and mapping one onto the other would be
-a guess.
+price data for routed models — emitting zeros would assert that every model is free.
+
+`reasoning` is the one field that used to be absent and now is not: Pi stores a boolean while the
+catalog carries an effort ladder, and mapping one onto the other used to be a guess. Since the
+catalog's ladder is the proxy's own statement about whether a model accepts reasoning parameters
+(adapters honor `reasoning_effort`), an export row with a **non-empty** ladder now emits
+`"reasoning": true`, and a row without one (or with an explicitly empty ladder) stays
+reasoning-free. Pi then offers its effort control for exactly the models opencodex will accept it
+on. The export also emits a `thinkingLevelMap` that hides every pi level with no declared target
+(`null`), so pi never offers — and never sends — an effort the ladder does not contain. One
+fallback keeps the model usable: when `ultra` is declared without `max`, pi's `max` level maps
+to `ultra` (still a ladder member).
+If you need a different mapping, hand-edit `thinkingLevelMap` afterward as documented by Pi.
+
+Treat `reasoning` as Pi-UI metadata: it is derived from the catalog ladder, not proof that the
+upstream natively supports a reasoning parameter. What the proxy actually sends for a given
+`reasoning_effort` value depends on the provider's adapter and model — it may pass the value
+through, translate it (wire aliases), clamp it to the configured ladder, emulate it, or omit it
+entirely (e.g. `noReasoningModels`). The boolean only controls whether Pi offers the control at
+all.
 
 ## Schema status