[roodboi]

The next.17 section omitted the tmux breaking-change warning that already existed at the page tail. Move it into the release section and put its v4 stop procedure before the v5 trial. The env breaking entry was already correct; keep its scoped single-key/terminal/stdin migration guidance.

Audit all 71 commits from v5.0.0-next.16 (b21c3b1898) through candidate 5002cf87bb50686b17ceae8a4c835f524ee1b3a5 against merged code and PR text. Add missing upgrade-assistant, activity, observe/plan/version, interactive exec, recovery, background-command and host/secret-custody notes. Preserve the complete native env-file behavior table and mark the four new JSON contracts shape may change before 5.0.0, with the planned HACK-2238 envelope migration.

Correct stale native interactive-exec/network/metadata/Ctrl-C claims and the short upgrade assistant wording. Credit the publisher-shutdown fix to #719, already in next.16; keep next.17 lifecycle-command retirement separate. Retake a private stopped-state backup after v4 stops zellij, keeping the first copy too. Keep next.16 warnings scoped to that bundle. Keep original-key backups before older Doctor migrations and distinguish file rollback from runtime/data recovery.

Only eight Markdown files change. Runtime, tests, workflows, generated CLI reference, diagrams, immutable snapshots and the site pin are unchanged. No diagram changed, so a new visual would add nothing. The site re-pin remains a separate release follow-up.

Merge timing: respect the lead's candidate freeze; intended for the batch immediately after next.17 publication and the site re-pin. The moved tmux breaking-change notice is called out for the lead's pre-cut decision. This PR does not merge or publish anything.

Validation at d95cfc554fabc4a0d70e3ba6caeb6746f63a198c:

• Bun 1.4.4, frozen dependencies. Docs prepare/check/typecheck/build and site tests (2 passed, 25 assertions) pass. Production-mode HTTP smoke: 97 docs, 82 SVGs, 217 local links/anchors; task server stopped.
• All 50 Hack commands named anywhere in the notes exist in the current generated CLI reference; 19 option contracts checked. CLI-reference regeneration has no diff.
• All 71 commits have one row below, including the test commit and merge for test(env): update migration consent assertions (HACK-2182) #786. All 70 source evidence paths exist at the fixed candidate. Source release-note local links/anchors pass.
• Privacy and complete reachable-history Gitleaks pass (1,330 commits, no findings). Persistent Claude Opus second-family review is CLEAN at this exact head. Hosted run 43585059152 passed docs site, secret scan and every planned Linux unit shard (4–8), plus the required test fan-in. Typecheck/privacy/quality ran on shard 8. Focus had no selected tests. Compiler, native core, runtime images/models, process-lifetime and Docker execution were out of scope; a green Docker fan-in is not Docker execution evidence. All bot comments were read; CLEAR at d95cfc5, zero unresolved threads/change requests. Codex code/security reviews found no issues.
• No real install, migration, daemon/DNS/trust change, Docker or native VM run was performed for this documentation audit. Native acceptance and the candidate's hosted release qualification remain separate.

Candidate commit coverage

entry present means the behavior already had an entry within the next.17 section (some now have fuller detail). added means missing behavior or migration guidance was added there; #824 moves the existing warning into that section. not user-visible means no shipped CLI/runtime change: documentation, test/CI/repository housekeeping or the internal desktop preview. Source links pin the candidate, rather than a moving branch.

Commit / PR	Coverage	Entry or reason	Audited source
70d328ec0d #743	added	Host setup: privileged/NSS safeguards	src/lib/linux-trust-setup.ts
51f15c8de4 #746	not user-visible	Docs-only upgrade checklist and site generation; no installed behavior	scripts/docs/prepare.ts
c14f3f5671 #744	added	Native setup JSON accounting	packages/runtime-core/src/provider/setup.rs
b0c6bcd519 #705	added	Retained background exec/run and cursor tools	src/commands/background-command-start.ts
c89f4fd7cc #745	added	Linux daemon query/home refusals	src/commands/daemon-systemd.ts
cce4b5954a #752	not user-visible	Site pin/snapshots and editorial pages only	scripts/docs/versions.json
56676fc038 #754	added	Setup reuse/offline accounting; pin-watch changes are internal	packages/runtime-core/src/provider/setup.rs
7a496f1750 #755	added	MCP registered selectors and background tool guidance	src/mcp/server.ts
e7a70393e1 #747	entry present	Native follow text shape; added session ends/restart recovery	src/backends/native-log-follow.ts
87a6df560c #758	added	Compose short one-shot startup	src/lib/compose-startup-state.ts
2afb5c4330 #761	added	Native Hack networks and inert generated labels	src/lib/native-hack-compose-conventions.ts
342a585133 #771	not user-visible	Docs-only next.16 trial record	docs/versions/v5/guides/upgrade-from-v4.md
6f0acf1c42 #769	entry present	Migration live-key/alias preservation	src/lib/project-env-config.ts
c96c4441aa #756	added	Child key filtering, fixed diagnostics, legacy ignore/YAML API refusals	src/lib/child-environment.ts
e2c73c6122 #748	not user-visible	Contributor CI selection/coalescing, outside product release notes	scripts/ci-change-scope.ts
ebf794e637 #760	added	Agent/output custody warning; runtime unchanged	src/agents/instruction-source.ts
021b16bcfd #763	added	One-pass background redaction scan; no public benchmark claim	src/lib/background-command/output-scanner.ts
8564ec4863 #765	added	Shared preflight/start admission and detached failure reporting	src/backends/native-project-review.ts
0c0fba2617 #767	entry present	Breaking env exposure/protect/stdin/scope/API guidance	src/commands/env.ts
9435da9b9c #762	added	Local Git/link refusals and no-follow dotenv	src/lib/project-env-config.ts
edf23ae046 #753	added	Daemon stop proves the live Hack home	src/commands/daemon-systemd.ts
573ceec5bb #766	entry present	Doctor layer/integrity error; added store/key write refusals	src/lib/secret-store.ts
a0e97605ce #757	added	Orphan output truncation and final-sync evidence	src/lib/background-command/recovery.ts
10e1958dea #759	added	Private lifecycle logs/FIFO and expiring mux payloads	src/lib/private-file.ts
bd899ee64d #775	not user-visible	Portable test fixtures only	tests/single-file-tar.test.ts
80dae3d0e9 #776	added	Candidate missing-daemon diagnosis is optional/healthy	src/commands/doctor.ts
5b2a2d0d79 #772	added	Bounded attaching-network retry; strict saved reads remain	src/lib/native-compose-ownership.ts
ab29d49130 #777	not user-visible	CI scheduling only	docs/reference/ci-test-selection.md
31339c7b64 #770	entry present	Native inferred readiness, 240 s, HTTP/service_healthy limits	packages/runtime-core/src/project/compose/service.rs
156ee7f102 #773	entry present	Loopback proxy port/Doctor/open checks	src/lib/proxy-loopback.ts
a7ec3c73c3 #768	entry present	Cleanup receipts/partial outcomes and tracked-file wording	src/lib/project-env-config.ts
ceb3e23322 #778	entry present	Native bridge socket readiness	packages/runtime-core/src/provider/bridge.rs
af91049f30 #783	entry present	Pointer reconciliation after partial cleanup	src/commands/doctor.ts
0a0bfdb8d1 #780	not user-visible	Site-only Linux guide publication; no CLI behavior	scripts/docs/versions.json
d0cf767efa #786	not user-visible	Consent test wording only (both commits)	tests/env-migration-tracked-consent.test.ts
7e2e6301ce #786	not user-visible	Consent test wording only (both commits)	tests/env-migration-tracked-consent.test.ts
91c311e4d9 #779	entry present	Restore or reversible retire; missing store keys scoped to readers	src/lib/secret-store-retire.ts
6ab1acece7 #785	not user-visible	Docs-only release/upgrade/env notes	docs/guides/v5-release-notes.md
25bd63c19f #764	entry present	Doctor hygiene, local modes, ignored staging and live-input protection	src/lib/secrets-hygiene.ts
d9df57c626 #784	not user-visible	Resolver/proxy and consent test corrections only	tests/project-open-loopback.test.ts
2c1f665157 #791	added	Detached failure names, open DNS hint, init placeholder; prune guidance	src/commands/project.ts
f6fe55f48a #787	not user-visible	Docs-only retirement/hygiene follow-up	docs/guides/v5-release-notes.md
7f9548caca #792	not user-visible	Start-here docs, navigation and contributor rule only	docs/versions/v5/install.md
a0cfc73a9c #793	added	Verified updater publication, backups and reversible candidate removal	src/lib/self-update.ts
292d31279d #782	added	Lock-free native ps and proved failed-start down	src/backends/native-project-observe.ts
b1e123bb7f #796	added	Doctor reader count/worktree grouping in store recovery	src/lib/doctor-secret-integrity.ts
286d00f47f #789	added	Foreground command-before-wrapper retirement	src/lib/project-lifecycle-processes.ts
bb6a7d1771 #788	not user-visible	Linux qualification runbook only	docs/guides/linux-host-qualification.md
a262d42762 #800	not user-visible	Internal desktop design; outside supported CLI release scope	apps/desktop/DESIGN.md
6b161baeac #774	added	Native interactive exec, finite fallback and receipt recovery	src/backends/native-project-exec.ts
1249272109 #799	not user-visible	Portable output-contract CI selection only	scripts/test-shard-plan.ts
fa3f03d3e1 #790	added	Read-only upgrade check, snapshot and rollback	src/commands/upgrade.ts
c3b79bc059 #807	added	Observe-only global status and unknown evidence	src/commands/global-status-observe.ts
29be0434a4 #812	added	Read-only local CA trust diagnosis	src/lib/ca-trust-status.ts
f0102fd440 #814	not user-visible	Prepared-base verifier test fixture only	tests/qualify-provider-pin.test.ts
b4ebfec3a7 #815	added	Compact upgrade plan, snapshot-backed apply/resume	src/lib/upgrade-apply.ts
c44b266d88 #801	not user-visible	Internal optional desktop preview; not shipped CLI behavior	apps/desktop/Cargo.toml
56d1d0fdb9 #804	added	Automatic mux sweep preserves live/retired config inputs	src/lib/live-inputs.ts
1958363322 #805	added	MCP timedOut result and Codex installer timeout	src/mcp/server.ts
e6207e8542 #810	added	Lifecycle activity writes including handler refusals; activity JSON	src/commands/lifecycle-activity.ts
23fe08f00e #825	added	Read-only batch review and permission-only key repair	src/lib/upgrade-review.ts
cab596c80c #781	entry present	Full native env-file behavior table; added support/precedence summary	src/backends/native-compose-environment.ts
1e846849db #798	not user-visible	Rust test process isolation/nextest; internal qualification only	scripts/test-runtime-core.sh
518af29040 #817	not user-visible	Remove accidental empty checkout files; no installed CLI change	.gitignore
07192f76da #824	added	BREAKING warning moved from page tail into next.17; v4 stop procedure retained	src/mux/mux-config.ts
fe09a5b167 #816	added	Read-only install/trust admin plans and exits	src/commands/global.ts
8977676de8 #827	added	Registry-preserving project observe, runtime opt-in	src/commands/projects.ts
5965b234c0 #828	added	Running CLI version identity JSON	src/lib/version-report.ts
29222101e5 #830	added	Upgrade safe/admin/manual action kinds	src/lib/upgrade-action-kind.ts
51b55c0b1e #820	not user-visible	Archive/plan/shared-helper verification fixtures only	tests/python-free-download.test.ts
5002cf87bb #809	added	Retirement read retry, second Ctrl-C and native cancellation cleanup	src/lib/project-lifecycle-processes.ts

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
hack-docs	Ready	Preview	Nov 14, 2026 10:23am UTC

[roodboi]

Breaking-change coverage correction: #824's tmux/zellij warning was already at the page tail, but outside the next.17 section. This moves it into that section and puts the retained-v4 stop procedure before switching. No additional undocumented breaking change was identified; #767 and #781's behavior-change guidance were already present and were checked against candidate 5002cf87bb.

Audit head 53fc65d0a1bbb493e618d904a8caee1e12e3b925: all 71 commits are mapped in the description. Local docs/build/HTTP/command/privacy/history checks pass; persistent review is running. Respecting the release freeze: no merge or publish action; lead decides whether the moved breaking notice belongs before the cut.

@codex review

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-14T10:25:39.122543Z	d95cfc5	Manual request
🔒 Security Review	✅ Completed 2026-11-14T10:26:37.049209Z	d95cfc5	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: 53fc65d0a1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: 53fc65d0a1

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[roodboi]

Updated to d95cfc554fabc4a0d70e3ba6caeb6746f63a198c. Persistent review is now CLEAN. Corrected the historical Ctrl-C attribution (#719's publisher shutdown was already in next.16; #789/#809 add lifecycle-command retirement), completed three #781 table details, linked native session recovery to candidate source, and required a fresh stopped-state backup after the v4 zellij stop while retaining the first backup.

Final local docs prepare/check/typecheck/build, command/source-link audit, privacy and 1,330-commit Gitleaks pass. HTTP smoke: 97 docs, 82 SVGs, 217 local links/anchors; server stopped. Site tests remain 2 passed / 25 assertions on unchanged site inputs. The cancelled old-head CI run had a queued replacement; no duplicate rerun was requested. Waiting for this head's hosted/bot checks before Ready for lead. The candidate freeze remains in force.

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Nice work!

Reviewed commit: d95cfc554f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: d95cfc554f

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[roodboi]

Breaking-change coverage correction: #824's tmux/zellij warning existed at the page tail but was outside the next.17 section. It is now in that section, with the retained-v4 stop procedure before switching and a fresh stopped-state backup for rollback. The env breaking entry was already correct. #781's table is now complete, including frozen fallbacks/runtime-bound compounds, managed_env_unreadable and the build-overlap refusal despite ignore rules. No other omitted user-visible behavior was found in the 71-commit audit.

Ready for lead: d95cfc554fabc4a0d70e3ba6caeb6746f63a198c.

All 71 candidate commits are mapped in the description to entry present / added / not user-visible, with PR and candidate-pinned source links. Eight Markdown files only; runtime, tests, workflows, pin, snapshots and diagrams match candidate 5002cf87bb.

Persistent Claude Opus second-family review is CLEAN at this exact head. Codex code and automatic security reviews found no issues; all conversation comments were read. CLEAR at d95cfc554f: zero unresolved bot threads/change requests or overlapping base changes.

Hosted CI 43585059152 passed the docs site (prepare/check/typecheck/site tests/build/HTTP smoke), secret scan, all planned Linux unit shards 4–8 and test fan-in. Typecheck/privacy/quality ran on shard 8. Focus had no selected tests. Mac, compiler/native runtime, process-lifetime, models, images and Docker execution were out of scope; the Docker fan-in success does not imply Docker scenarios ran.

Local validation: Bun 1.4.4 frozen dependencies; docs prepare/check/typecheck/build; site tests 2 passed/25 assertions on unchanged site inputs; all 50 named commands and 19 option contracts checked against the regenerated CLI reference with no drift; source links/anchors; privacy; full-history Gitleaks (1,330 commits, no findings). Production-mode HTTP smoke passed 97 docs, 82 SVGs and 217 local links/anchors. All task servers are stopped. No live install, migration, daemon/DNS/trust change, Docker or VM acceptance is claimed.

The candidate freeze remains in force. This is ready for your post-publication docs/site-repin batch; you own the decision on whether the moved breaking-change notice should land before the cut. No merge or publication was performed.

Separate code follow-up: src/lib/project-lifecycle-controller.ts:334 still suggests zellij when a lifecycle mux is unavailable; #824 removed that backend. This docs-only PR does not change that hint.

[roodboi]

Lead decision on the pre-cut question: the tmux breaking-change warning is already on the release-notes page (at its tail), and the commit itself is marked breaking (feat(sessions)!), so moving it into the next.17 section does not justify moving the candidate head and repeating the hosted run. This PR lands in the first batch after next.17 publishes, together with the site re-pin. Thank you for the commit-by-commit table.

🤖 Generated with Claude Code