wp4: fix four reported bugs with no owning pull request

devlog/_plan/260908_d_group_test_infra_stack/000_plan.md

@@ -0,0 +1,113 @@
+# D-group test-infrastructure delivery as a single-CI manual stack
+
+## Objective
+
+Land the two D-group test-infrastructure items on `dev` as one dependency-ordered
+branch chain whose **tip is the only pull request**, so the cumulative tree is
+verified by exactly one Cross-platform CI run. Merge the tip once that run is
+green, then settle the original pull requests and any linked issues.
+
+| Layer | Source | Content |
+|---|---|---|
+| 1 (bottom) | PR #3924 by @luvs01 | `scripts/test.ts` keeps captured lane output after a timeout; runner regressions; contributing note |
+| 2 (tip) | PR #3930 by @luvs01 | `tests/providers/cursor/cursor-stream-health.test.ts` load-scaled watchdog budgets |
+
+Both source pull requests carry exactly one commit each, authored by `luvs01`
+(`27862058+luvs01@users.noreply.github.com`), so `git cherry-pick -x` preserves
+authorship without needing a reconstructed `Co-authored-by` trailer. The trailer is
+added to the tip pull-request description anyway, because the repository squashes
+and `.github/scripts/pr-carry-attribution.cjs` reads the trailer, not prose.
+
+## Why a stack, and why only one pull request
+
+`.github/workflows/ci.yml` triggers on a bare `pull_request:` with no base-branch
+filter. That is deliberate — the comment in the file records that a
+`branches: [main, dev]` filter once silently excluded stacked child pull requests.
+The consequence for this unit is mechanical: **every open pull request starts a
+Cross-platform CI run**, whatever its base. A two-pull-request stack therefore costs
+two runs, and a child pull request based on the parent's head costs one more.
+
+The only way to get a single run covering both changes is to give the stack exactly
+one pull request, at the tip, based on `dev`. The lower layer is pushed as a branch
+for provenance and review navigation, and never gets a pull request of its own.
+Pushing a branch does not start CI either: `ci.yml`'s `push:` trigger is pinned to
+`branches: [main, preview, dev]`, and this stack pushes neither.
+
+The tip run covers the PR-enabled producers, not every job in the file. `changes`
+sets `ci: true` for `tests/**` and `scripts/**` (`ci.yml:193-194`), which this stack
+touches, so the four Linux shards, `gates`, `storage policy`, `api usage`,
+`platform-macos`, `keyring` and `docker smoke` all execute. Three job families do
+**not** run on a pull request and must never be reported as passing evidence:
+
+| Job | Guard | Status on this PR |
+|---|---|---|
+| `windows <n>/6` | `github.event_name == 'workflow_dispatch' && (inputs.lane == '' \|\| inputs.lane == 'all')` (`ci.yml:742-743`) | SKIPPED BY WORKFLOW |
+| `macos control` | `github.event_name == 'workflow_dispatch'` (`ci.yml:633`) | SKIPPED BY WORKFLOW |
+| `npm-global <os>` | `needs.changes.outputs.packaging == 'true'` (`ci.yml:943`); the packaging allowlist (`ci.yml:215-229`) excludes all four files | SKIPPED BY WORKFLOW |
+
+That exclusion is acceptable for this unit: nothing here ships in the package tree,
+and `scripts/test.ts` is the test runner rather than runtime source. The Windows
+lane is dispatch-only for every ordinary pull request in this repository, so
+requiring it here would be a new policy, not this unit's job.
+
+## Dependency order
+
+Layer 1 is the runner change; layer 2 is a fixture that the runner executes. Ordering
+them the other way would put a test-timing change under an unverified runner. The
+order is a build-order statement, not an effort estimate.
+
+## Work phases
+
+| Phase | Outcome |
+|---|---|
+| wp0 | This roadmap: stack shape, single-trigger proof, merge/close order, attribution |
+| wp1 | Build both layers locally on fresh `origin/dev` with `cherry-pick -x` |
+| wp2 | Push both branches with `--no-verify`; open exactly one pull request (tip → `dev`) |
+| wp3 | Record tip CI, merge the tip, settle #3924/#3930 and linked issues |
+
+Diff-level detail for each phase: `010_phase1_stack_build.md`,
+`020_phase2_publish.md`, `030_phase3_merge_and_settle.md`.
+
+## Constraints in force
+
+The owner set these for this unit, and they override the repository's default
+verification habits:
+
+- **No local suite.** No `bun run test`, `bun test`, `bun run test:changed`,
+  `bun run typecheck`, or build used as a gate. Every such row is recorded
+  `NOT RUN (owner instruction)`, never as a pass.
+- **Push with `--no-verify`.** Local hooks are skipped by instruction.
+- **CI on the tip only.** Never open a pull request for a lower layer.
+- **One green run, then merge.** The tip's exact head SHA is the product gate.
+- **Preserve original authorship** for carried work.
+- **Close linked issues** at the moment the change is on `dev`.
+
+## Verification model
+
+The product evidence is the hosted Cross-platform CI run on the tip's exact head
+SHA — run id, head SHA, per-job conclusions — read as a job matrix, not as the
+aggregate `ci` summary alone. The three dispatch-only or packaging-gated job
+families above are recorded SKIPPED BY WORKFLOW.
+
+Merge additionally requires the current gate checks to be green on that same head:
+`enforce-target` and `hygiene` (`enforce-pr-target.yml:679-692` folds deterministic
+hygiene failures into its verdict; `pr-hygiene.yml:236-238` fails and labels on a
+violation), plus resolution of any actionable automated review finding.
+
+Landing evidence is the squash SHA GitHub returns, proven to be an ancestor of
+fetched `origin/dev`, with its tree compared against the reviewed tip. Local checks
+are `NOT RUN` by instruction and are never reported as passing.
+
+A verifier honesty note, since this unit's plan names commands it will not run:
+`bun run test` would observe `scripts/test.ts` and both test files, and
+`bun run typecheck` would observe `scripts/test.ts`. Both are in scope for the
+change and both are withheld by owner instruction, so their acceptance rows are
+delegated to hosted CI rather than claimed locally.
+
+## Terminal outcomes
+
+- **DONE** — tip CI green on its exact head, tip merged into `dev`, #3924 and #3930
+  settled with authorship preserved, linked issues closed, evidence recorded.
+- **BLOCKED** — a required merge right is missing, or CI fails for a cause outside
+  these four files.
+- **NEEDS_HUMAN** — a policy decision beyond restoring existing behavior.

devlog/_plan/260908_d_group_test_infra_stack/001_audit_record.md

@@ -0,0 +1,53 @@
+# Audit record — roadmap gate
+
+An independent reviewer (a separate context, `gpt-6-astra` at high effort) audited
+the roadmap before any branch was built. Three rounds ran; the first two failed.
+The findings are recorded here because they changed the plan, and because two of
+them would have produced a false completion claim.
+
+## Round 1 — FAIL, four blocking defects
+
+1. **Overstated CI coverage.** The plan promised platform and packaging coverage
+   from the tip pull-request run. In fact `windows <n>/6` and `macos control` are
+   `workflow_dispatch`-only (`ci.yml:633`, `742-743`), and `npm-global` needs
+   `packaging == 'true'`, which the packaging allowlist (`ci.yml:215-229`) does not
+   set for any of the four files. Fixed by adding an explicit RUN vs
+   SKIPPED BY WORKFLOW matrix and forbidding the skipped families from being
+   reported as passes.
+2. **CI success treated as sufficient for merge.** `enforce-target` folds
+   deterministic hygiene failures into its verdict (`enforce-pr-target.yml:679-692`)
+   and `pr-hygiene` fails and labels on a violation (`pr-hygiene.yml:236-238`).
+   `MAINTAINERS.md:61` also requires the integration decision and exact-head
+   verification to be recorded. Fixed by adding those gates and the record step.
+3. **Wrong ancestry object.** The plan checked whether the tip commit was an
+   ancestor of `dev`. A squash merge never makes the tip an ancestor, so that check
+   would have failed on a perfectly good landing — or worse, been waved through.
+   Fixed by recording the squash SHA GitHub returns and testing that.
+4. **Attribution assumed rather than controlled.** The repository sets
+   `squash_merge_commit_message: COMMIT_MESSAGES`, so the pull-request description
+   is not the landed message. A description trailer satisfies the hygiene checker
+   and still leaves the contributor uncredited in the commit. Fixed by supplying the
+   squash body explicitly and verifying the landed trailer before closing anything.
+
+## Round 2 — FAIL, two blocking defects
+
+1. **Missing administrator bypass.** `Protect dev` requires an approving review and
+   code-owner review, so the merge call is refused without `--admin`. The plan named
+   the policy exception without naming the mechanism that exercises it.
+2. **Bot findings mistaken for all findings.** The gate covered automated review
+   findings but not human ones. `MAINTAINERS.md:62-64` requires outstanding
+   maintainer change requests to be resolved or explicitly withdrawn.
+
+## Round 3 — PASS
+
+The reviewer set the phase-1 acceptance bar: freshly fetched base SHA, both
+constructed commit SHAs, evidence that layer 1 follows the base and layer 2 follows
+layer 1, both authors reading `luvs01`, both `-x` provenance lines, per-layer and
+cumulative name/numstat comparisons, blob comparisons against the source pull
+requests, and the roadmap commit accounted for separately so it stays out of the
+four-file implementation delta.
+
+## Standing note
+
+Local suite, typecheck and build are **NOT RUN** for this unit by owner
+instruction. That is a recorded absence of evidence, not a pass.

devlog/_plan/260908_d_group_test_infra_stack/010_phase1_stack_build.md

@@ -0,0 +1,54 @@
+# Phase 1 — Build the stack locally
+
+Base: fetched `origin/dev`. Both source commits live in the `luvs01` remote
+(`https://github.com/luvs01/opencodex.git`), already configured in this checkout.
+
+## Commands
+
+```sh
+git fetch origin dev
+git fetch luvs01 e24163231edeaa09a30a99ca1746e3b573af78ae 141077f7270e2f2a0564fb036d091f0cf793b784
+
+# Layer 1 — PR #3924
+git switch -c codex/260908-d-group-l1-test-runner-output origin/dev
+git cherry-pick -x e24163231edeaa09a30a99ca1746e3b573af78ae
+
+# Layer 2 — PR #3930, tip
+git switch -c codex/260908-d-group-l2-cursor-watchdog
+git cherry-pick -x 141077f7270e2f2a0564fb036d091f0cf793b784
+```
+
+`cherry-pick -x` keeps the original author identity
+(`luvs01 <27862058+luvs01@users.noreply.github.com`>) and appends the
+`(cherry picked from commit ...)` provenance line. No `Co-authored-by` trailer is
+needed on the commits themselves because authorship is not being reassigned. The
+trailer goes in the tip pull-request description for hygiene acceptance; phase 3
+separately supplies and verifies the trailer on the landed squash commit, which is
+the only thing GitHub reads for contributor credit.
+
+## Expected change map
+
+| Layer | File | Change |
+|---|---|---|
+| 1 | `scripts/test.ts` | +81 −8 — incremental capture, retained output on timeout, bounded drain, incomplete-capture exit policy |
+| 1 | `tests/ci-workflows/test-runner.test.ts` | +147 −1 — regressions for timeout/failure/success output, split UTF-8, open pipes, read failure |
+| 1 | `docs-site/src/content/docs/contributing.md` | +6 — documents the timeout and incomplete-capture behavior |
+| 2 | `tests/providers/cursor/cursor-stream-health.test.ts` | +59 −26 — one scaled silence budget S, 2S heartbeat-only, ≥3S observed progress after first received text |
+
+Cumulative tip versus `origin/dev`: exactly those four files.
+
+## Conflict expectation
+
+None. The two file sets are disjoint, and the Cursor test file plus its
+`tests/helpers/ci-watchdog.ts` import carry identical blob SHAs at `dev` and at
+#3924's head (`dc7b572bf1` and `f8adcfe3d9`), so layer 2's preimage is unchanged by
+layer 1.
+
+## Acceptance
+
+- `git log --format='%an <%ae>'` on both new commits reports `luvs01`.
+- `git diff --name-only origin/dev..tip` lists exactly the four files above.
+- `git diff --stat` matches the per-file counts in the table.
+- Each cherry-picked tree is byte-identical to the source PR head's version of its files.
+
+Local suite: NOT RUN (owner instruction).

devlog/_plan/260908_d_group_test_infra_stack/020_phase2_publish.md

@@ -0,0 +1,92 @@
+# Phase 2 — Publish the stack, one pull request only
+
+## Push
+
+```sh
+git push --no-verify origin codex/260908-d-group-l1-test-runner-output
+git push --no-verify origin codex/260908-d-group-l2-cursor-watchdog
+```
+
+`--no-verify` is the owner's instruction for this unit. Neither push starts
+Cross-platform CI: `ci.yml`'s `push:` trigger is limited to
+`branches: [main, preview, dev]` (`ci.yml:26-27`).
+
+## Open exactly one pull request
+
+Tip only, targeting `dev`:
+
+```sh
+gh pr create --repo lidge-jun/opencodex --base dev \
+  --head codex/260908-d-group-l2-cursor-watchdog \
+  --title "fix(test): preserve lane output after timeouts and stabilize the Cursor stream-health watchdog" \
+  --body-file <path>
+```
+
+The lower layer gets **no** pull request. `ci.yml` triggers on a bare
+`pull_request:` with no base filter (`ci.yml:7`), so a second pull request would
+start a second Cross-platform CI run; draft status does not suppress it either —
+no job in `ci.yml` reads a draft condition.
+
+A stacked child pull request based on the layer-1 branch is also unavailable here:
+`enforce-target` grants the wrong-base exemption only when the parent branch has
+its own **open** pull request (`enforce-pr-target.yml:536-537`), which is exactly
+what this design avoids. The tip therefore targets `dev` directly.
+
+## Description requirements
+
+`.github/PULL_REQUEST_TEMPLATE.md` requires Summary, Verification, and Checklist;
+`enforce-target` rejects thin or malformed descriptions. The description must also:
+
+- name both source pull requests (#3924, #3930) and describe the stack layering;
+- carry `Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>`. The
+  hygiene checker reads that trailer from the description or a commit message
+  (`pr-carry-attribution.cjs:190`), and the carry verbs in the description are what
+  make it demand one at all. The description trailer satisfies the gate; it does
+  **not** by itself put the trailer in the landed commit — see phase 3, where the
+  squash body carries it explicitly;
+- state honestly that local suite, typecheck and build were **NOT RUN** by owner
+  instruction, and that hosted CI on this exact head is the verification gate,
+  naming which job families are skipped by the workflow;
+- be substantive: `pr-quality.cjs` strips template boilerplate and requires real
+  content (two substantial sections, or 120+ characters across two blocks), so
+  placeholder bullets fail the gate.
+
+As a maintainer-authored pull request this needs no readiness checklist and no
+`review-ready` label (`enforce-pr-target.yml:766-768`, `1096-1103`). Do not tick a
+local-CI attestation box that was not earned — the owner forbade the local suite.
+
+No GUI files change, so the screenshot rule does not apply.
+
+## Other workflows that will fire
+
+Expected and unavoidable for any pull request: `enforce-target`, `pr-hygiene`,
+`pr-labeler`, `react-doctor`, plus CodeRabbit. `service-lifecycle` does **not**
+fire — none of the four paths is in its allowlist. These are gate/lint signals, not
+the product suite; only Cross-platform CI is the product gate.
+
+## Outcome
+
+Executed 2026-09-08 against base `942c02873`.
+
+| Ref | SHA | Pull request |
+|---|---|---|
+| `codex/260908-d-group-l1-test-runner-output` | `ab06523e6` | none, by design |
+| `codex/260908-d-group-l2-cursor-watchdog` (tip) | `8b81676ac` | [#3940](https://github.com/lidge-jun/opencodex/pull/3940), base `dev` |
+
+Both pushes used `--no-verify`. Neither started Cross-platform CI, as predicted by
+the `push` branch filter. Opening #3940 started exactly one run on `8b81676ac`; the
+first check-runs to appear were `changes`, `select windows runner`, `hygiene`,
+`label`, `resolve-pr` and `react-doctor`, which matches the expected set.
+
+The layer-1 branch has zero pull requests in any state, which is the property that
+keeps the stack to a single CI run.
+
+## Acceptance
+
+- Both branches exist on `origin` at the expected SHAs.
+- `gh pr list --head codex/260908-d-group-l1-test-runner-output` returns empty.
+- Exactly one open pull request has head `codex/260908-d-group-l2-cursor-watchdog`
+  and base `dev`.
+- Exactly one Cross-platform CI run exists for the tip head SHA. "Exactly one" is
+  scoped to the pre-merge candidate: landing on `dev` starts a separate push run,
+  and a base refresh replaces the candidate with a new head and a new run.