Vocllum · Vocllum · Sep 11, 2026 · Sep 11, 2026 · Sep 11, 2026 · Sep 11, 2026
diff --git a/AGENTS.md b/AGENTS.md
@@ -31,7 +31,14 @@ Bun-native TypeScript with no separate server compile step.
 - `go/` — retired Go native-runtime experiment; kept only where the TypeScript
   runtime still references it. New work does not go here.
 - `structure/` — maintainer invariants and architecture notes; read before
-  changing shared subsystems.
+  changing shared subsystems. [`structure/INDEX.md`](./structure/INDEX.md) is the
+  reading order and the source-ownership table, and
+  [`structure/AGENTS.md`](./structure/AGENTS.md) holds the rules for changing
+  anything in there. Ownership is not advisory: changing an owned source area
+  obliges the same change to update its doc, and `bun run structure:check`
+  (wired into the suite by `tests/ci-workflows/structure-ssot.test.ts`) fails on a
+  doc that names a path this tree no longer has, on an invariant whose test is
+  gone, and on a new `src/` area nobody claimed.
 - `scripts/` — release and maintenance tooling; `scripts/release.ts` is the
   release authority.
 - `devlog/` — planning and investigation notes, tracked in this repository. See
@@ -187,6 +194,8 @@ bun run test:changed   # import-graph tests against the resolved `dev` merge bas
 bun run test           # full tests/ suite (PR-ready / explicit ask only)
 bun run lint:gui       # GUI eslint
 bun run privacy:scan   # credential/privacy scan used by CI
+bun run structure:check # structure/ doc-map, ownership, and invariant-binding gate
+bun run structure:index # regenerate structure/INDEX.md from structure/manifest.json
 bun run build:gui      # Vite GUI build
 ```
 

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -5,7 +5,7 @@ Thanks for helping with opencodex.
 - Start with the canonical guide: [Contributing](https://opencodex.me/contributing/)
 - Pull-request quality contract: [Review readiness and author responsibility](https://opencodex.me/contributing/pr-quality/)
 - Public user docs live in [`docs-site/`](./docs-site)
-- Current maintainer invariants live in [`structure/`](./structure)
+- Current maintainer invariants live in [`structure/`](./structure); start at [`structure/INDEX.md`](./structure/INDEX.md)
 - Maintainer roles and merge policy live in [`MAINTAINERS.md`](./MAINTAINERS.md)
 - Attribution for work landed through a maintainer carry lives in [`CREDITS.md`](./CREDITS.md)
 - Historical investigations live in [`docs/`](./docs)

diff --git a/devlog/_fin/260906_release_243/000_plan.md b/devlog/_fin/260906_release_243/000_plan.md
@@ -0,0 +1,15 @@
+# Release 2.43.0
+
+Loop archetype: spec-satisfaction release operation; one PABCD cycle.
+Trigger: owner explicitly requests readiness audit, preview/main merges and release.
+Goal: promote RC af50c6d3451078a7d298b044c08fd2684c9e8eeb into preview/main and publish 2.43.0-preview.20260906 and 2.43.0 with matching registry gitHead, tags and successful exact-SHA release workflows.
+Scope: GitHub release/version PRs, required CI workflows, npm OIDC release, local isolated release worktree. Preserve original checkout and existing dirty devlogs. No unrelated open PR integrations or local service reconfiguration.
+Verifier: gh run view/list (executed, exit 0, reports exact SHA job results); git ls-remote (executed exit 0, observes remote heads); git tree comparison; registry metadata and GitHub release readback after publish. No local full suite: hosted CI is the full gate.
+Stop: both releases and artifacts verified. If a real release blocker emerges, record it and resolve only scoped operational/version defects; broader code repair requires replan. Terminal: DONE, BLOCKED or NEEDS_HUMAN with explicit evidence. No silent gate bypass.
+Memory: this unit plus scratch release evidence; one release operation cycle, not separate implementation units.
+Resources: existing gh credential and OIDC workflow only; no secret reads; repository branch/PR/tag/release writes approved by request. No purchased compute or external messages. Hosted CI bounded to one active release per channel and one evidence-based flaky retry. Wall-clock checkpoint at two hours; do not claim completion at timeout.
+Authoritative policies: MAINTAINERS.md, scripts/release.ts, release.yml, dev-version-bump.yml, service-lifecycle.yml from pinned RC.
+Baseline: main 48f8186647d9ffb108d226dcfa91a64225aae2a7 v2.42.0; preview 0748cf50b67103bdc93123acae0d0c545a8cf902 version 2.43.0-preview.20260904 (not yet assumed published). RC push CI 33974061890 success; no exact RC Service lifecycle yet.
+Escalation: release gate failures are blocking. Maintainer administrative PR merge is authorized by owner's merge-and-release instruction; record bypass use in PR description if required by rulesets, never fake approval. An external maintainer decision outside this scope is reported.
+
+Readiness refresh: RC Service lifecycle run 33976119109 passed linux-systemd, macos-launchd and windows-schtasks. Full Windows test matrix remains excluded by ci.yml:643-656; installed/keyring Windows smokes passed. Open draft fixes 3669/3672/3673 document edge-case existing behavior; do not claim these are fixed. PR 3671 has an already-public policy-boundary report and is pending explicit security review; implicated assemble.ts is unchanged between released main and RC (last changed #1681). No new change to that boundary is proposed by this promotion. This audit is release readiness, not a claim that the entire product is defect-free.
diff --git a/devlog/_fin/260906_release_243/002_audit.md b/devlog/_fin/260906_release_243/002_audit.md
@@ -0,0 +1,13 @@
+# Release audit
+
+Two independent auditor dispatches returned no usable result within their bounded waits and were retired. Main reclaimed the packet rather than treating silence as approval. This is a direct audit, not an independent-review claim.
+
+1. Version ordering verified in release.yml and version-line.ts: dev must outrank 2.43.0; use existing bump script to 2.44.0 before publication.
+2. Bootstrap amendment accepted: default main does not register dispatch yet; one-file manual pre-move PR is supported by existing helper and preserves protected branch boundary.
+3. RC push CI 33974061890 and service 33976119109 passed; repeat on each actual promotion SHA as required. Windows full suite deliberately non-gating; no full Windows green claim.
+4. Preview merge-tree conflicts in package.json only. Main contains no divergent commits. Require post-merge RC ancestry and exact file parity excluding version.
+5. Owner admin merge authorization recorded in PRs; no self-approval or failed functional check bypass. Production payload comes only from pinned RC already integrated into dev.
+6. Open bug PRs remain visible; no unrelated draft integration. Public PR 3671 boundary existed in main before RC, and is not modified by promotion. General readiness is not defect-free certification.
+7. Release workflow validates exact branch SHA, push CI, lifecycle, dev readiness, global version order, duplicate metadata and npm audit before OIDC publication. Readback npm gitHead and immutable tags after each channel; never rerun an apparently failed publish until inspecting actual registry metadata.
+
+Main verdict: PASS for proceeding to version/promotion PR preparation. Independent audit unavailable; inherited integrated reviews plus current CI and direct release-mechanics inspection are the evidence. No production-code or credential boundary edits are included.
diff --git a/devlog/_fin/260906_release_243/010_promotion.md b/devlog/_fin/260906_release_243/010_promotion.md
@@ -0,0 +1,11 @@
+# Promotion implementation
+
+1. Pin RC af50c6d3451078a7d298b044c08fd2684c9e8eeb. Audit release-specific risks and open blockers using current GitHub state. Dispatch lifecycle for RC if absent.
+2. Default main still has workflow_call only, so workflow_dispatch is not yet registered. Use the existing scripts/bump-dev-version.ts 2.43.0 package.json locally on a dedicated branch and open a one-file package.json 2.43.0 -> 2.44.0 pre-move PR. Merge only after exact-head checks; this bootstraps the first release of the new pre-move workflow without changing it. Do not promote the new dev version into release payload.
+3. In isolated /private/tmp/ocx-release-01a07240, build promotion branch from origin/preview, merge pinned RC preserving ancestry, resolve package.json only to 2.43.0-preview.20260906. Any non-version conflict is audited explicitly. Push promotion branch, create templated PR to preview, inspect checks and owner-authorized merge. Prove RC ancestor and tree parity excluding package.json against RC. Wait branch push ci.yml and service-lifecycle.yml exact merged SHA. Publish via release.yml on preview, version and expected-sha pinned, tag preview, dry-run false. Verify GitHub/npm/tag before stable.
+4. Build main promotion from origin/main, merge the same pinned RC, set package.json 2.43.0. Follow same PR/check/ancestry/tree proof and branch push gates. Publish release.yml main tag latest with exact expected-sha.
+5. Verify registry latest and preview versions, gitHead against merged commits, release tags, release workflows and clean dedicated worktrees. Re-check original checkout changes preserved. Record evidence and close FSM.
+
+No production code edits intended. Changes are package versions and merge ancestry only; prepublish assets produced by release workflow. Main and preview independently inherit RC; preview need not be main ancestor. Public devlog omits unreleased security findings; any such analysis stays in ignored scratch.
+
+Execution amendment: the owner reiterated shipping this candidate now and deferring fixes. Preview/main PR preparation is parallel because both consume the same immutable RC; publication stays preview first, stable second. PRs: #3676 pre-move (1a6ebc22c), #3677 preview (5c2d63465), #3678 main (af50c6d34). Local broad pre-push hook deferred to exact-head hosted CI; no gate weakening or workflow edits.
diff --git a/devlog/_fin/260906_release_243/011_promotion_result.md b/devlog/_fin/260906_release_243/011_promotion_result.md
@@ -0,0 +1,11 @@
+# Promotion result
+
+Owner reaffirmed shipping this candidate and deferring fixes.
+
+- #3676 merged as 81871b3fa7034250b8d5ba2cbbfde44e40f0e69c; dev version 2.44.0; all PR checks passed.
+- #3677 merged as 53c784c2a635b061799e4f7542432a921f548bf9; preview version 2.43.0-preview.20260906; functional PR CI passed, dev-only target policy exception recorded; screenshot added from implementation #3670. Gate had marked promotion draft; explicit ready followed by owner-authorized admin merge completed.
+- #3678 merged as 06ec553630fa2ee51a96b5cbf694089021249194; main version 2.43.0; exact candidate push CI 33974061890 and lifecycle 33976119109 success were merge evidence. Duplicate PR macOS test still running at merge, so no claim that PR rollup was all green. CodeQL residual and owner-directed deferral recorded on PR; no alert was dismissed.
+- Both release refs contain RC af50c6d3451078a7d298b044c08fd2684c9e8eeb. Main tree identical to RC; preview differs only in package.json version.
+- Final release gates: preview CI 33976927260 and service 33976927241; main CI 33976953219 and service 33976953226. Docs deployment 33976953239 accompanies main promotion.
+
+Publication remains pending; these merges alone are not completion.
diff --git a/devlog/_fin/260906_release_243/012_registry_recovery.md b/devlog/_fin/260906_release_243/012_registry_recovery.md
@@ -0,0 +1,9 @@
+# Registry processing recovery
+
+Preview Release run 33977377565 passed dispatch guard, dependency audit, source/version/CI/lifecycle gates, changelog, and npm publish. npm signed provenance (transparency log index 2727657111) and returned acceptance for 2.43.0-preview.20260906 at 2026-09-05T16:18:25Z, explicitly saying the package was being processed. The 30-attempt registry smoke ended before processing completed, so workflow conclusion is failure; do not report it as green and do not republish.
+
+Registry metadata subsequently became visible with gitHead 53c784c2a635b061799e4f7542432a921f548bf9. Generated the release notes with the same canonical build-release-changelog.ts (baseline v2.42.0, 15 first-parent commits covered), then completed the skipped GitHub release creation at exactly that commit. Preview flag true, draft false, tag SHA verified. The tarball was delayed further; waited until ordinary canonical download succeeded. npm pack --ignore-scripts fetched all 1033 entries. Package manifest version, CLI bin, src/cli/index.ts, gui/dist/index.html and registry SHA-512 integrity passed.
+
+Stable Release run 33977810259 was dispatched only after exact main push CI 33976953219 and Service lifecycle 33976953226 succeeded at 06ec553630fa2ee51a96b5cbf694089021249194. Stable processing remains pending as of this record; same-registry acceptance plus later readback is the recovery route, not a blind release rerun. Canonical stable notes prebuilt at .tmp/release-01a07240/main-notes.md if its smoke deadline also precedes processing completion.
+
+These operational recoveries preserve all publication gates. A successful package publication and reconciled GitHub metadata are the final evidence, while the timed-out workflow remains honestly recorded as failed.
diff --git a/devlog/_fin/260906_release_243/019_done.md b/devlog/_fin/260906_release_243/019_done.md
@@ -0,0 +1,15 @@
+# DONE — 2.43.0 release train
+
+Both owner-authorized channels are published and downloadable:
+
+- npm latest 2.43.0; main/tag/gitHead 06ec553630fa2ee51a96b5cbf694089021249194; GitHub https://github.com/lidge-jun/opencodex/releases/tag/v2.43.0
+- npm preview 2.43.0-preview.20260906; preview/tag/gitHead 53c784c2a635b061799e4f7542432a921f548bf9; GitHub https://github.com/lidge-jun/opencodex/releases/tag/v2.43.0-preview.20260906
+- dev pre-moved to 2.44.0 at 81871b3fa7034250b8d5ba2cbbfde44e40f0e69c.
+
+Final verifier exited 0: registry dist-tags, both package gitHeads, release draft/prerelease flags, remote tag SHAs, tarball SHA-512 integrity, 1033 packaged files per channel, CLI/source/dashboard entrypoints, and three stable source files byte-matched to the main commit. Required exact push CI and Service lifecycle succeeded for both release SHAs; main docs deployment also succeeded.
+
+Both Release workflows returned failure solely after successful signed npm publication, because registry processing exceeded their five-minute smoke windows. Waited for real registry metadata and downloadable tarballs, rebuilt notes using the unchanged canonical script, and completed the skipped GitHub release creation. No duplicate npm publish and no fake green workflow claim. Stable signed provenance transparency log index 2727757812; preview 2727657111.
+
+Known residuals: pending fixes deferred by owner; CodeQL promotion warnings not dismissed or claimed fixed; full Windows suite remains outside the current shipping gate. Windows install/keyring/service checks passed. Two nonresponsive audit agents were retired; direct release audit recorded honestly.
+
+Original checkout remains dev at ef9c538f36f94f0e95c7f4833642e5b03bd29e2e; pre-existing modified/untracked closeout files untouched. No installed runtime or service configuration was changed. Next work is the separately deferred fixes; no required release work remains.
diff --git a/devlog/_fin/260907_release_246/000_plan.md b/devlog/_fin/260907_release_246/000_plan.md
@@ -0,0 +1,11 @@
+# Release 2.46.0 plan
+
+Single-cycle satisfy-spec release operation, authorized by the owner to inspect readiness, promote main/preview and publish. First produce this roadmap; no product implementation work is planned. Goal: publish the integrated RC in preview and stable with immutable evidence. Source RC: 0d8b0cd1e3d10bc6b85bfefb3d68555f558407b0. Published baseline v2.45.0. Existing checkout is dirty and remains unchanged except this new unit and ignored evidence/state. Dedicated worktree: /private/tmp/ocx-release-246-01a078cd.
+
+Scope: only version metadata and release branch integration through PRs; hosted tests, registry packaging and release metadata. Excludes unrelated open PRs, default login policy changes, installed-service upgrades and account settings. No new field/enum or enforcement layer is introduced. Existing release gates remain authoritative; administrator capability is not CI or review evidence.
+
+Verification: GitHub source/PR/readiness inspection, independent source audit, candidate CI, exact final release-branch push CI and applicable lifecycle, registry gitHead/integrity/provenance, immutable tag/release and package smoke. Existing successful CI 34071673682 observes 44c69fdd, not the RC (44-file delta). Future CI is NOT RUN until receipts exist. User has specified no cost/time budget; use existing shell/GitHub/npm tools and bounded waits. Record credentials only by auth mechanism, never value.
+
+Terminal DONE: preview and stable verified and dev ahead; NOOP: already delivered identical candidate; blocked/unsafe: concrete external prerequisite or failed gate without a safe remedy. A failure is repaired or remains a blocker, never weakened. Only new product decisions/out-of-scope changes require owner direction. Plan/evidence artifact is this unit plus .tmp/release-246; stop only after required outputs or genuine prerequisite failure. Source-of-truth: MAINTAINERS.md and release.yml unchanged; record outcome in 090_delivery.md.
+
+One PABCD cycle has dependent operational steps in 010_release.md. These steps are not separate product implementation phases.
diff --git a/devlog/_fin/260907_release_246/010_release.md b/devlog/_fin/260907_release_246/010_release.md
@@ -0,0 +1,9 @@
+# Release operation
+
+1. Verify source RC and previous published tags. Read merged review state and policy. Run candidate CI on dev; inspect exact SHA and jobs. Separate outstanding unrelated PRs from candidate blockers.
+2. MODIFY package.json only on a dev bump branch using scripts/bump-dev-version.ts: 2.46.0 -> 2.47.0. Verify unused tags, version-line tests, typecheck/full tests as appropriate. Push branch, template PR to dev and integrate after checks; retain frozen RC for release.
+3. NEW independent promotion branches based on existing origin/preview and origin/main. Merge frozen RC into each; resolve only channel-version conflicts. MODIFY preview package.json to 2.46.0-preview.20260907; main package.json to 2.46.0. Runtime tree must match the frozen RC, with explicit version-only/channel lineage differences. Publish template promotion PRs and verify head/base/native membership/review/CI before merge. Record owner-authorized promotion decision, never self-approval.
+4. Require each merged SHA's own successful push-event Cross-platform CI and lifecycle. Validate current branch tips, dev 2.47.0, package name/version and unused target tags. Invoke existing release.yml dry-run (build/pack), then actual preview publication, then stable, serialized. expected-sha must equal branch tip.
+5. Inspect npm dist-tags, version gitHead, SHA512 tarball integrity, provenance and GitHub tag/release; run safe published-package version/help smoke in isolated home. No installed service changes. Capture final branch ancestry and preserve initial dirty files.
+
+Activation scenarios: moved branch -> refuse dispatch and repin/revalidate; wrong package/tag mapping -> reject; failed CI -> inspect and repair or rerun substantiated transient failure; post-publish smoke failure -> inspect registry before retry, finish missing GitHub metadata only after publication proof. Existing rollback artifact v2.45.0 remains published; no destructive rollback is planned.
diff --git a/devlog/_fin/260907_release_246/011_audit.md b/devlog/_fin/260907_release_246/011_audit.md
@@ -0,0 +1,3 @@
+# Independent release audit
+
+Averroes: VERDICT: PASS. No verified source/security blocker. Checked 20 delivery PRs: zero unresolved review threads or CHANGES_REQUESTED. The prior successful CI 34074350604 (26 jobs) and lifecycle 34074351720 (3 jobs) tested 9470fdb1 whose tree equals runtime merge 5fdf9bbdd. RC 0d8b0cd1 differs only in closeout documents. New RC workflow 34079952328 is pending. Login-required default is preserved by codexDesktopAuthless === true; #3689 closed unmerged. Promotion repinning must retain frozen source RC. Final branch CI/lifecycle and artifact gates remain mandatory.
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,3 @@
		# Independent release audit

		Averroes: VERDICT: PASS. No verified source/security blocker. Checked 20 delivery PRs: zero unresolved review threads or CHANGES_REQUESTED. The prior successful CI 34074350604 (26 jobs) and lifecycle 34074351720 (3 jobs) tested 9470fdb1 whose tree equals runtime merge 5fdf9bbdd. RC 0d8b0cd1 differs only in closeout documents. New RC workflow 34079952328 is pending. Login-required default is preserved by codexDesktopAuthless === true; #3689 closed unmerged. Promotion repinning must retain frozen source RC. Final branch CI/lifecycle and artifact gates remain mandatory.