CBEPX · Sep 30, 2026 · Sep 30, 2026 · Sep 30, 2026 · Sep 30, 2026 · Sep 30, 2026
diff --git a/AGENTS.md b/AGENTS.md
@@ -18,7 +18,7 @@ common boundary (usually `plugins/codex/scripts/lib/`); never add caller-specifi
 - Pushing a work branch under an active claim is fine; merging, tagging, publishing a release and posting upstream comments each need the user's explicit go.
 - Maintainers claim the work item with the `agent-work` tool before writing and release the claim at the end of the stage (see `docs/agent/process.md`); contributors without it open a draft PR first.
 - README describes behaviour by observable outputs (flags, `status --json` / `result --json` fields, exit codes, decision lines, error text). Function names and `plugins/codex/scripts/...` paths belong in the internals docs under `docs/` (rules: `docs/agent/docs.md`).
-- The `codex@cbepx` plugin is installed from the marketplace cache per Claude config dir; the working tree is not what `/codex:*` runs. After a release: `claude plugin marketplace update cbepx && claude plugin update codex@cbepx` in each config dir, then restart the session.
+- For the maintainer the `cbepx` marketplace is a directory source on this repository: `/codex:*` runs the main checkout's `plugins/codex/` directly, so never edit plugin code on `main` — only in a worktree. After a release still run `claude plugin marketplace update cbepx && claude plugin update codex@cbepx` in each Claude config dir (it refreshes the recorded cache copy), then restart the session.
 
 ## Read on demand
 

diff --git a/docs/superpowers/plans/2026-09-30-codex-plugin-cc-v1.5.0.md b/docs/superpowers/plans/2026-09-30-codex-plugin-cc-v1.5.0.md
diff --git a/docs/superpowers/specs/2026-09-30-codex-plugin-cc-v1.5.0-design.md b/docs/superpowers/specs/2026-09-30-codex-plugin-cc-v1.5.0-design.md
diff --git a/docs/superpowers/triage/2026-10-01-v1.5.x-backlog.md b/docs/superpowers/triage/2026-10-01-v1.5.x-backlog.md
@@ -0,0 +1,41 @@
+# v1.5.x backlog — findings from the v1.5.0 work and the 2026-09-30 usage analysis
+
+Date: 2026-10-01. Sources: the v1.5.0 SDD ledger (task reviews, Codex comparisons with
+`cc-plugin-codex`), and the 24-hour usage analysis of 2026-09-30 (21 plugin job records,
+155 Claude session transcripts; report archived with the v1.5.0 SDD under
+`codex-usage-24h.md`). Each item names the release that owns it. Items marked **v1.5.0**
+are still inside the current release; the rest are inputs to the next brainstorm.
+
+## Product defects (fix)
+
+| # | Finding | Evidence | Owner |
+|---|---|---|---|
+| B1 | After a turn fails with `Selected model is at capacity`, an immediate `task --resume-last` fails with `thread … already has an active writer`: the thread writer is not released on a capacity failure. | 2 of 2 resumes in the window (sessions 06e4b079, eb00b088, `gpt-6.1-sol` xhigh). | v1.5.1 — fix in the thread lease/writer release on a failed turn; fake-codex test: a turn that fails with the capacity error, then `--resume-last` succeeds. |
+| B2 | `--model sol` resolved to `gpt-6-sol` on one cold `--resume-last` but to `gpt-6.1-sol` on fresh runs. | One job in the window; cause unconfirmed (catalogue source on the resume path? cached catalogue?). | v1.5.1 — reproduce with the fake catalogue; log which catalogue source resolved an alias (`codex debug models --bundled` vs `models_cache.json`). |
+| B3 | A fresh `task --await` never finished inside the 540 s cap for xhigh jobs: 11 of 11 exited 3 and needed 1–3 `result --wait` re-runs (jobs ran 741–1744 s). | Usage analysis, rescue path. | v1.5.1 (task flags) — `rescue.md`/`codex-rescue.md`: for `--effort xhigh|max|ultra` recommend `--background` + `result --wait`, or route through the `codex-rescue` agent; keep the 540 s cap (Claude's Bash limit is 600 s). |
+| B4 | Cancel race: `cancel` of an awaited job can answer `Job … already failed; its record is kept` when it lands before the `turn/started` patch (no `turnId` yet → the no-turn path kills the worker, whose own `failed` record is then kept). Pre-existing (parked in the v1.4.2 ledger as the row-1 race). | `tests/runtime-cancel.test.mjs` "cancelling an awaited job…" failed once in a local gate under load on 2026-09-30; never in CI. | v1.5.0 S3b.5 adds diagnostics and a `turnId` wait to the test; the product race itself → v1.5.1 (wait for the turn record or treat a pre-turn cancel as `cancelled`). |
+| B5 | Broker: `tests/broker-idle-timeout.test.mjs` "a second shutdown trigger does not exit before the first has cleaned up" failed once in a local gate under load; passes alone and in CI. | 2026-09-30 gate run of S3a.3. | v1.5.1 — reproduce under load; the assertion should print the broker log on failure (the connected-client test already does). |
+| B6 | Detected default branch from `origin/HEAD` is returned unchecked: with `origin/HEAD` set and no local branch of that name, `review --scope branch` sends an unresolvable base to Codex and `adversarial-review` fails after the job record (#653 on the detected path). | S3a.2 review probe. | **v1.5.0** task S3a.2b — prefer `origin/<name>` when the local branch is missing, else the candidate loop. |
+
+## Improvements
+
+| # | Finding | Owner |
+|---|---|---|
+| I1 | A background review is a Claude "shell" (Bash `run_in_background`) in 1.4.x; the companion-side detach lands in v1.5.0 (S3b.3, S3b.6). After it, the only "shell" a session should show for the plugin is a `result --wait` poller of a tracked job. | **v1.5.0** |
+| I2 | The two infra sessions run raw `codex exec` as background shells outside the plugin (their project memory `codex-model-quota-preference.md` prescribes it): those runs are invisible to `/codex:status` and one of them used `gpt-6-astra` against the user's model rule. Point that memory at `/codex:rescue` / `task --background`. | User's infra project memory (not this repository); v1.5.2 "commands" may add a `claude --print`-friendly path (#223). |
+| I3 | `--output ""` resolves to the cwd and is refused as "already exists" — safe, odd text. | v1.5.1 — `--output needs a path.` |
+| I4 | `exportReadPayload`: when the `closeSync` inside the `try` fails, the catch closes the same descriptor again (swallowed). | v1.5.1 — a `closed` flag; or leave (harmless in a synchronous CLI). |
+| I5 | `tests/module-boundaries.test.mjs` parser: a comment or string-named binding inside a multi-line import can hide the statement (`[^;'"(]*?`); `inDir` requires a direct child of `lib`. Nothing in the tree is affected. | v1.5.1 — strip comments before matching; loosen `inDir` if `lib/` ever gets a subdirectory. |
+| I6 | `tests/args.test.mjs` `REVIEW_SPLIT_SPEC` is a hand copy of `REVIEW_ARG_SPEC`; nothing fails if the real table gains an option. | v1.5.1 — import the real spec, or a test that compares the two. |
+| I7 | `commands/shared.mjs` bounded active-job hint ignores `leadIn` (one caller today); `result.md` keeps a "complete result payload" bullet above the preview paragraph. | R.1/R.2 of v1.5.0 (whole-branch review triage). |
+| I8 | Structured output: the first `{…}` candidate wins even when it is not the review (a `{}` in a js fence or in prose before the real review); the sister has the same limit. | Documented limit (spec §Limits); revisit if seen in practice — try every fenced block before the brace scan, review-shape-aware. |
+| I9 | Structured output: candidates nested inside a broken outer `{` are not recovered (deviation from the sister, chosen for a linear scan). | Documented limit (spec §Limits rev. 7). |
+| I10 | The sister's review worktree (`review-worktree.mjs`, containment for a reviewer that can write) is not ported: our reviewer runs in Codex's read-only sandbox. | Not planned; revisit if the reviewer ever gets write tools. |
+| I11 | A stray-app-server interrupt ack logs "Requested Codex turn interrupt" and `turnInterrupted: true` (parked minor from v1.4.2/v1.4.3). | v1.5.1 |
+| I12 | Untested guard `interrupt.transport === "broker"` in `handleCancel` (parked minor from v1.4.2). | v1.5.1 |
+
+## Process notes (keep)
+
+- Ledger timestamps written from memory drifted about two hours ahead of the wall clock on 2026-09-30 (14:05–19:50 entries); CI lines carry run id and sha, which are authoritative. Rule since then: timestamps from `date`.
+- Two of three plan writers verified their code on scratch copies; the S3b parts were never executed before implementation. Rule: an implementer treats plan code as a draft to verify against the tests and reports corrections.
+- Codex read-only comparisons with the sister (`gpt-6.1-sol`) found real defects at both the plan and the implementation stage (heredoc delimiter, symlinks, bounded diff read, worker diagnostics, unmeasured bottom-out, receipt size, `__proto__`, the check-then-unlink window). Keep the cadence: after each wave and before the release.
diff --git a/plugins/codex/commands/result.md b/plugins/codex/commands/result.md
@@ -1,21 +1,25 @@
 ---
 description: Show the stored final output for a finished Codex job in this repository
-argument-hint: '[job-id] [--wait] [--timeout-ms <ms>]'
+argument-hint: '[job-id] [--wait] [--timeout-ms <ms>] [--output <new-path>]'
 disable-model-invocation: true
 allowed-tools: Bash(node:*)
 ---
 
-Show the stored final output for a finished Codex job by running the Bash command below, then present the full output.
+Show the stored final output for a finished Codex job by running the Bash command below, then present the output as printed.
 
 ```bash
 node "${CLAUDE_PLUGIN_ROOT}/scripts/codex-companion.mjs" result --args-stdin <<'CODEX_ARGS'
 $ARGUMENTS
 CODEX_ARGS
 ```
 
-Present the full command output to the user. Do not summarize or condense it. Preserve all details including:
+Present the command output to the user as printed. Do not summarize or condense it. Preserve all details including:
 - Job ID and status
 - The complete result payload, including verdict, summary, findings, details, artifacts, and next steps
 - File paths and line numbers exactly as reported
 - Any error messages or parse errors
 - Follow-up commands such as `/codex:status <id>` and `/codex:review`
+
+When the output ends with a `Truncated:` block and a `Full output:` line, it is a preview (the command prints at most 8192 bytes). Present that preview and the `Full output:` line as printed. Do not re-run the command on your own. Only when the user asks for the full text, run `node "${CLAUDE_PLUGIN_ROOT}/scripts/codex-companion.mjs" result <id> --wait` with the job id from that line, and present its output as printed.
+
+If the arguments include `--output`, the command prints a JSON receipt (`outputFile`, `bytes`, `sha256`) instead of the report: show it as printed.
diff --git a/plugins/codex/commands/status.md b/plugins/codex/commands/status.md
@@ -1,6 +1,6 @@
 ---
 description: Show active and recent Codex jobs for this repository, including review-gate status
-argument-hint: '[job-id] [--wait] [--timeout-ms <ms>] [--all]'
+argument-hint: '[job-id] [--wait] [--timeout-ms <ms>] [--all] [--output <new-path>]'
 disable-model-invocation: true
 allowed-tools: Bash(node:*)
 ---
@@ -21,3 +21,7 @@ If the user did not pass a job ID:
 If the user did pass a job ID:
 - Present the full command output to the user.
 - Do not summarize or condense it.
+
+If the output ends with a `Truncated:` line, keep that line and the next-step line after it as printed, below the table or the output. Do not re-run the command on your own.
+
+If the arguments include `--output`, the command prints a JSON receipt (`outputFile`, `bytes`, `sha256`) instead of the report: show it as printed.