diff --git a/devlog/_plan/260911_lane_dispatch_round/000_plan.md b/devlog/_plan/260911_lane_dispatch_round/000_plan.md
new file mode 100644
index 0000000000..aecb3b0a38
--- /dev/null
+++ b/devlog/_plan/260911_lane_dispatch_round/000_plan.md
@@ -0,0 +1,71 @@
+# Lane dispatch round — 260911
+
+Freeze: `origin/dev` `6d3ad12e3` (package.json 2.51.0). Every lane branch is cut from that SHA.
+
+## Why this round exists
+
+`dev` did not move for 24 hours while 80 pull requests stayed open. The blocking pattern is not
+reviewer capacity alone: three of the most urgent PRs (#4184, #4181, #4203) sat at
+`CHANGES_REQUESTED`, and four more (#4188, #4174, #4171, #4210) were reset to draft by the
+readiness gate after a push. Waiting on those forks does not land anything this round.
+
+## What decides the lane boundaries
+
+File ownership, not topic. `010_lane_partition.md` records the measured collisions across 27 open
+PRs. Two facts fix the shape of this round: `src/server/responses/core.ts` is contended by four
+open PRs and `src/providers/quota.ts` by another four, while twelve PRs touch no file any other
+PR touches. Lanes are cut so that no two lanes own the same file, which is what makes unlimited
+parallel agents useful rather than a rebase generator.
+
+## Decision-free filter
+
+This round dispatches only work whose expected behaviour is already fixed by a filed issue, so no
+lane has to invent a maintainer policy. An item is in when the issue states the expected result and
+no competing design is open; it is out when landing it would decide a policy the maintainer has not
+decided.
+
+Six items inside the round also left a real choice open; audit round 1 caught that and the orchestrator
+ made those calls in writing (`030_audit_round1.md`), so no lane decides policy.
+
+Excluded on purpose, with the decision that blocks each one:
+
+- #4213 — whether unknown native-surface endpoints are forwarded upstream or keep returning 404 is a
+  proxy policy decision, and the issue explicitly asks for it.
+- #4198, #4179 — publishing an official container image changes a documented policy
+  ("opencodex does not publish an official container image").
+- #4173 — the atomic update design competes with #4185 and #4203 already in flight.
+- Contributor feature PRs (#4183, #4100, #4111, #4193, #4033, #4042) — these need review, not
+  reimplementation, and reimplementing them would discard the author's work.
+
+## Roles
+
+The orchestrator thread owns the round: it holds the host goal, tracks every lane, refreshes live PR
+and CI state, and performs merges one at a time. Lane threads own implementation inside their file
+territory and stop at a green PR; they never merge and never touch another lane's files.
+
+## Execution rules carried from earlier rounds
+
+These are not new. They are the rules this repository's earlier parallel rounds ran under, and they
+are repeated inside every packet so a lane thread that never reads this file still obeys them.
+
+1. **No local product suite.** No `bun test`, no `bun run test`, no `bun run typecheck`, no build, no
+   install. Report those checks as `NOT RUN` and bind confidence to hosted CI. Reading source and
+   running read-only `git`/`gh` is not a suite run.
+2. **Push with `--no-verify`**, and prefix every mutating git command with
+   `git -c core.hooksPath=/dev/null` — this repository's hooks can start a GUI install, typecheck,
+   and build, which rule 1 forbids.
+3. **Ordinary dependent PRs.** The first PR of a lane targets `dev`; a child targets its parent's
+   head branch, and is retargeted to `dev` after the parent lands. No native GitHub stacks.
+4. **Attribution.** Carrying, superseding, or reimplementing another author's work requires a
+   `Co-authored-by` trailer naming that author in a branch commit, not prose.
+5. **Final-head CI is the proof.** Green on an older head, a cancelled run, or a skipped job is not
+   passing evidence. The exact pushed SHA must be the one that is green.
+6. **Unlimited `xai/grok-4.6` subagents**, read-only. They verify, reproduce, and audit; they do not
+   write files, and no finding enters a lane's work without a `path:line` anchor.
+
+## Merge policy
+
+Merges are serialized through the orchestrator because `dev` is protected and shared. A lane PR
+merges when its exact head is green on final-head CI; the landing is proven by fetching `origin/dev`
+and checking ancestry, never by the merge command's own output.
+
diff --git a/devlog/_plan/260911_lane_dispatch_round/010_lane_partition.md b/devlog/_plan/260911_lane_dispatch_round/010_lane_partition.md
new file mode 100644
index 0000000000..8c942206ad
--- /dev/null
+++ b/devlog/_plan/260911_lane_dispatch_round/010_lane_partition.md
@@ -0,0 +1,75 @@
+# Lane partition — measured file collisions
+
+Method: `gh pr view <n> --json files` over 27 open PRs on 2026-09-11, `devlog/` paths dropped, then
+grouped by path. Revision 3, after two audit rounds (`030_audit_round1.md`, `040_audit_round2.md`).
+
+Ownership below is stated as an exact path or as one named directory meaning every file under it.
+No two lanes name the same path, and no named directory contains another lane's path.
+
+## Contended files
+
+| Count | Path | Open PRs |
+|---|---|---|
+| 4 | `src/server/responses/core.ts` | #4050, #4118, #4181, #4184 |
+| 4 | `src/providers/quota.ts` | #4090, #4105, #4174, #4210 |
+| 4 | `tests/providers/provider-quota.test.ts` | #4090, #4105, #4174, #4210 |
+| 3 | `gui/src/i18n/{de,en,fr,ja,ko,ru,tr,zh,zh-TW}.ts` | #4111, #4183, #4193 |
+| 3 | `scripts/test-layout/layout.json` | #4119, #4193, #4203 |
+| 3 | `tests/fixtures/test-layout-expected.json` | #4119, #4193, #4203 |
+| 2 | `src/server/claude-messages.ts` | #4050, #4184 |
+| 2 | `src/server/chat-completions.ts` | #4118, #4184 |
+| 2 | `src/types/tools.ts` | #4171, #4181 |
+| 2 | `src/combos/resolve.ts` | #4090, #4105 |
+| 2 | `src/config.ts` | #4100, #4183 |
+| 2 | `src/update/job.ts` | #4185, #4203 |
+
+Collision-free PRs, touching no file any other open PR touches: #4062, #4104, #4119, #4124, #4130,
+#4139, #4159, #4177, #4178, #4187, #4188, #4199.
+
+## Ownership
+
+**L1** `codex/260911-l1-responses-core` — `src/server/responses/core.ts`,
+`src/server/responses/compact.ts`, `src/server/responses/policy-fallback.ts`,
+`src/server/chat-completions.ts`, `src/server/claude-messages.ts`,
+`src/server/request-log-conversation.ts`, `src/server/responses-undeclared-tool-guard.ts`,
+`src/providers/opencode-go-transport.ts`, `src/types/tools.ts`,
+`docs-site/src/content/docs/reference/configuration/providers.md`. Stack: #4172 → #4176.
+
+**L2** `codex/260911-l2-catalog-provider` — `src/providers/quota.ts`,
+`src/providers/quota-types.ts`, `src/providers/quota-wire.ts`,
+`src/providers/quota-routing-cache.ts`, `src/providers/quota-key-accounts.ts`,
+`src/providers/account-quota-disk.ts`, `src/providers/registry.ts`. Stack: #4201.
+
+**L3** `codex/260911-l3-account-pool` — `src/codex/account-usability.ts`,
+`src/codex/account-pause.ts`, `src/codex/account-store.ts`, `src/codex/account-runtime-state.ts`,
+`src/codex/plan.ts`, `src/codex/plan-from-token.ts`, `src/codex/warmup.ts`,
+`src/codex/model-entitlements.ts`, `src/server/responses/codex-auth-error.ts`,
+`src/server/management/oauth-account-routes.ts`, the single key `codexPool.excludedPlans` in
+`src/config.ts`, and `docs-site/src/content/docs/guides/codex-integration.md` and its seven locale copies under
+`docs-site/src/content/docs/{fr,ja,ko,ru,tr,zh-cn,zh-tw}/guides/codex-integration.md`.
+Stack: #4126 → #4212 → #4211.
+
+**L4** `codex/260911-l4-service-cli` — directories `src/update/`, `src/cli/`, `src/client/`; files
+`bin/ocx.mjs`, `src/cli.ts`, `src/service.ts`, `src/config/pending-teardown.ts`,
+`src/lib/bun-runtime.ts`, `src/lib/package-tree-integrity.ts`, `src/lib/process-control.ts`,
+`src/codex/catalog/effort.ts`, `src/codex/cli-install-provenance.ts`,
+`docs-site/src/content/docs/getting-started/installation.md`. Stack: #4202 → #4169 → #4204 → #4207.
+
+**L5** `codex/260911-l5-integrations-io` — directory `src/integrations/`; file
+`src/config/atomic-write.ts`. Stack: #4197 → #4214.
+
+**L6** `codex/260911-l6-streaming-tools` — `src/server/responses/codex-ws-exchange.ts`,
+`src/server/responses/codex-ws-wire.ts`, directory `src/adapters/qoder/`. Stack: #4191 → #4190.
+
+**L7** `codex/260911-l7-docs` — `docs-site/src/content/docs/guides/providers.md`,
+`docs-site/src/content/docs/guides/remote-hub.md`. Stack: #4215 → #4200.
+
+## Custody of shared assets
+
+- `scripts/test-layout/layout.json` and `tests/fixtures/test-layout-expected.json`: every lane
+  registers its own new test files in both, as `AGENTS.md` requires. They are append-only lists, so
+  the conflicts are mechanical and the orchestrator resolves them during the serialized merges.
+- `gui/src/i18n/*`: no lane adds a locale key this round. A lane that needs one stops and reports.
+- `src/config.ts`: only L3, and only `codexPool.excludedPlans`.
+- `docs-site/src/content/docs/guides/providers.md`: L7 only. A lane whose carried PR edits it drops
+  that hunk and reports the wording to the orchestrator.
diff --git a/devlog/_plan/260911_lane_dispatch_round/020_lane_packets.md b/devlog/_plan/260911_lane_dispatch_round/020_lane_packets.md
new file mode 100644
index 0000000000..6c6de9e57a
--- /dev/null
+++ b/devlog/_plan/260911_lane_dispatch_round/020_lane_packets.md
@@ -0,0 +1,215 @@
+# Lane dispatch packets — 260911 (revision 3, after audit rounds 1 and 2)
+
+Seven implementation lanes, one Codex thread each, one worktree each. Ownership is an exact path or
+one named directory; `010_lane_partition.md` is the authoritative list and this file repeats each
+lane's slice of it.
+
+## Shared frame
+
+**Repository.** Your worktree is named in your packet, already checked out on your lane branch, cut
+from `origin/dev` `6d3ad12e3` (2.51.0). Work only there. Do not add, move, or remove a worktree.
+
+**Loop.** Run `$codexclaw:cxc-loop` as HOTL for your lane: one work-phase per issue, in order. Your
+goal ends when your last PR is green and reported, not when the code looks right.
+
+**Subagents.** Unlimited `xai/grok-4.6` subagents, read-only, spawned with `spawn_agent`
+(`model: "xai/grok-4.6"`). Use them to reproduce, to read the call sites you are about to change, to
+find a second caller of a helper you are touching, and to review your staged diff adversarially
+before you push. A finding enters your work only with an exact `path:line` anchor. Subagents never
+write, commit, push, or call a mutating `gh`. Treat a `fail` verdict the way this round did: fold it
+in and re-audit. This packet is at revision 3 because two audit rounds rejected revisions 1 and 2.
+
+**MUST NOT.**
+
+- No local product suite: no `bun test`, no `bun run test`, no `bun run test:changed`, no
+  `bun run typecheck`, no `bun run build:gui`, no `bun install`. Report them as `NOT RUN`.
+- No merge, no release, no force-push to a shared branch, no direct push to `dev`.
+- No path outside your owned list, including paths a carried PR happens to touch. Dropping a hunk
+  from a carried PR is expected; report what you dropped.
+- No locale key in `gui/src/i18n/*`. If you need one, stop and report.
+- No security write-up in `devlog/`; scratch space only, per `AGENTS.md`.
+
+**MUST.**
+
+- Prefix every mutating git command with `git -c core.hooksPath=/dev/null`. This repository's hooks
+  can start a GUI install, typecheck, and build, which the no-local-suite rule forbids.
+- Push with `--no-verify`.
+- Write the focused regression test `AGENTS.md` requires for a behaviour change, in the domain
+  directory beside the existing tests for that subsystem, and register it in both
+  `scripts/test-layout/layout.json` `explicit` and `tests/fixtures/test-layout-expected.json`. You
+  will not run it; hosted CI will. Those two maps are append-only and other lanes are adding to them
+  too; the orchestrator resolves the conflicts at merge, so do not skip the entry.
+- Fill every section of `.github/PULL_REQUEST_TEMPLATE.md` and put `Closes #<issue>` in the body. In
+  **Verification**, state that the local suite, typecheck, and build were `NOT RUN` by operator
+  instruction and that hosted CI on the exact pushed head is the proof.
+- When you carry another author's PR, add a `Co-authored-by` trailer in a branch commit. Resolve the
+  address with `gh api users/<login> --jq '.id'` and use `<id>+<login>@users.noreply.github.com`.
+- Keep a devlog unit under `devlog/_plan/260911_l<N>_<slug>/`.
+
+**Stacking.** First PR targets `dev`; the second targets the first PR's head branch, the third the
+second. Retarget a child to `dev` after its parent lands. No native GitHub stacks.
+
+**Decisions already made for you.** Both audit rounds found items where the issue left a real choice
+open. Those calls are recorded in your packet in bold. Implement the recorded decision; if you think
+it is wrong, report the reason and stop.
+
+**Stop conditions.** Stop and report when the fix needs a path you do not own, when it needs a policy
+no issue has fixed, when a locale key is unavoidable, or when hosted CI fails for a reason outside
+your diff.
+
+**Report format.** Per PR: number, exact head SHA, CI run id and conclusion, the issue it closes, the
+co-authors credited, the hunks you dropped from a carried PR, and any decision you made. Say
+`NOT RUN` for local checks.
+
+**Decision boundary.** You do not merge, do not close another author's PR, and do not rank your lane
+against another. When your last PR is green, report and stop.
+
+## L1 — Responses pipeline and tool contract
+
+Worktree `~/.codex/worktrees/260911-l1/opencodex`, branch `codex/260911-l1-responses-core`.
+
+Owned: `src/server/responses/core.ts`, `src/server/responses/compact.ts`,
+`src/server/responses/policy-fallback.ts`, `src/server/chat-completions.ts`,
+`src/server/claude-messages.ts`, `src/server/request-log-conversation.ts`,
+`src/server/responses-undeclared-tool-guard.ts`, `src/providers/opencode-go-transport.ts`,
+`src/types/tools.ts`, and `docs-site/src/content/docs/reference/configuration/providers.md` (the page
+#4184 already edits). You do not own `codex-ws-exchange.ts` or `codex-ws-wire.ts` (L6) or
+`codex-auth-error.ts` (L3).
+
+1. **#4172 — OpenCode Go sessionless requests omit `x-opencode-session`.** Expected behaviour is
+   fixed by the issue: every request to the canonical Go destination carries the header; identity
+   keeps its stable per-conversation value; no identity gets an isolated per-request value rather
+   than none and rather than one shared global id; an explicit header still wins. Carry PR #4184 by
+   `chilung-cgu` (open, not a draft, `CHANGES_REQUESTED`); read the review first. Most urgent item in
+   the round: upstream ended the grace period on 09/06 and now errors without the header.
+2. **#4176 — a routed provider prefixes a bare Codex tool with `default.`.** **Decision: normalize
+   the invented prefix back at the undeclared-tool guard** — the #4181 shape, which is what the issue
+   states. #4181 by `chilung-cgu` is open, not a draft, `CHANGES_REQUESTED`; #4171 by `rrmlima` is an
+   open **draft** at `CHANGES_REQUESTED` and its unified-exec rewrite is out of round scope. Credit
+   `rrmlima` only if you reuse code from #4171.
+
+`core.ts` is contended by four open PRs. Keep the diff minimal; do not reformat around it.
+
+## L2 — provider quota and registry
+
+Worktree `~/.codex/worktrees/260911-l2/opencodex`, branch `codex/260911-l2-catalog-provider`.
+
+Owned: `src/providers/quota.ts`, `quota-types.ts`, `quota-wire.ts`, `quota-routing-cache.ts`,
+`quota-key-accounts.ts`, `account-quota-disk.ts`, `registry.ts` (all under `src/providers/`).
+
+1. **#4201 — BigModel Responses Coding Plan: missing quota probe and GLM-5.3-Flash catalog support**
+   (reporter `bluesmilery`). **Decision: do not build on #4210.** It is an open draft by `Ingwannu`
+   at `REVIEW_REQUIRED` and it also edits `docs-site/src/content/docs/guides/providers.md`, which
+   belongs to L7. Implement #4201 independently; if your diff would overlap #4210's `quota.ts` hunks,
+   report that overlap to the orchestrator instead of merging the two lines of work. If the fix needs
+   documentation, write the wording in your report and let L7 land it.
+
+`quota.ts` is contended by four open PRs; keep the change surgical.
+
+## L3 — Codex account pool
+
+Worktree `~/.codex/worktrees/260911-l3/opencodex`, branch `codex/260911-l3-account-pool`.
+
+Owned: `src/codex/account-usability.ts`, `account-pause.ts`, `account-store.ts`,
+`account-runtime-state.ts`, `plan.ts`, `plan-from-token.ts`, `warmup.ts`, `model-entitlements.ts`
+(all under `src/codex/`), plus `src/server/responses/codex-auth-error.ts`,
+`src/server/management/oauth-account-routes.ts`, the single key `codexPool.excludedPlans` in
+`src/config.ts`, and `docs-site/src/content/docs/guides/codex-integration.md` and its seven locale copies under
+`docs-site/src/content/docs/{fr,ja,ko,ru,tr,zh-cn,zh-tw}/guides/codex-integration.md`.
+
+1. **#4126 — a newly created ChatGPT Free account fails Codex warmup with HTTP 404.** Carry PR #4188
+   by `chilung-cgu` (open **draft**, `REVIEW_REQUIRED`, reset by the readiness gate rather than
+   rejected). It carries `src/codex/warmup.ts`, its test, and eight `codex-integration.md` pages —
+   all of which you own.
+2. **#4212 — an account stuck on a failed credential refresh silently drops its models.** The ask is
+   attribution, not new routing. **Decision: this round covers the refusal string
+   (`codex-auth-error.ts:35`), the account-health surface, and the management route
+   (`oauth-account-routes.ts`). It does not change the L1 refusal call sites at `core.ts:2243` and
+   `compact.ts:296`;** if review asks for those, open a follow-up issue rather than crossing into L1.
+3. **#4211 — keep Free-tier accounts out of pool selection.** **Decision: ship**
+   **`codexPool.excludedPlans` as an array, absent by default,** so an existing install sees no
+   behaviour change. Do not ship `minimumPlan`: ranking plans needs an ordering this repository does
+   not have. **Decision: this round ships selection only.** If the dashboard or CLI display the issue
+   also asks for needs `src/cli/account.ts`, a GUI component, or a locale key, stop and report; write
+   `Refs #4211` rather than `Closes #4211` when the display half is not included.
+
+## L4 — service, update, CLI, and connected client
+
+Worktree `~/.codex/worktrees/260911-l4/opencodex`, branch `codex/260911-l4-service-cli`.
+
+Owned: directories `src/update/`, `src/cli/`, `src/client/`; files `bin/ocx.mjs`, `src/cli.ts`,
+`src/service.ts`, `src/config/pending-teardown.ts`, `src/lib/bun-runtime.ts`,
+`src/lib/package-tree-integrity.ts`, `src/lib/process-control.ts`, `src/codex/catalog/effort.ts`,
+`src/codex/cli-install-provenance.ts`, `docs-site/src/content/docs/getting-started/installation.md`.
+
+1. **#4202 — global pnpm installations cannot self-update.** Carry PR #4203 by `oliver-mee` (open
+   **draft**, `CHANGES_REQUESTED`, 36 files). **Decision: the keep-set is exactly** `bin/ocx.mjs`,
+   `src/cli.ts`, `src/cli/launcher-context.ts`, `src/config/pending-teardown.ts`,
+   `src/lib/bun-runtime.ts`, `src/lib/package-tree-integrity.ts`, `src/service.ts`, every file under
+   `src/update/`, the tests `tests/ci-workflows/install-scripts.test.ts`,
+   `tests/cli/ocx-launcher-runtime.test.ts`, `tests/cli/ocx-launcher-source.test.ts`,
+   `tests/update/update-badge.test.ts`, `tests/update/update-job.test.ts`,
+   `tests/update/update-pnpm.test.ts`, `tests/update/update-stop-first.test.ts`, the two test-layout
+   maps, and `docs-site/src/content/docs/getting-started/installation.md`. **Drop** `README.md`,
+   `structure/01_runtime.md`, `structure/06_docs-and-release.md`,
+   `docs-site/src/content/docs/getting-started/for-agents.md`, and
+   `docs-site/src/content/docs/reference/cli/lifecycle.md`.
+2. **#4169 — every stop refusal is reported as a `CODEX_HOME` ownership mismatch,** hiding
+   `respawnable_service`. Carry PR #4170 by `yeongjunyoo` (open **draft**, `REVIEW_REQUIRED`); it
+   touches `src/cli/index.ts` and `src/lib/process-control.ts`, both yours, plus its two tests
+   `tests/lib/process-control-graceful.test.ts` and `tests/providers/xai/grok-lifecycle.test.ts`,
+   which you keep.
+3. **#4204 — Windows: a stale persisted CLI 0.135.0 strips max/ultra while Desktop runs 0.153.4.**
+   The clamp is `src/codex/catalog/effort.ts:441`. #4178 by `luvs01` is open, not a draft, full CI
+   green, and owns `src/codex/cli-install-provenance.ts`: if it lands first, rebase onto it;
+   otherwise keep out of that file and say so.
+4. **#4207 — the connected catalog reports success while the local Codex CLI rejects unsupported
+   reasoning levels.** Same clamp as #4204, which is why both are here; client side is
+   `src/client/hub-client.ts:145`, `src/client/connect.ts:542`, `src/cli/connect.ts:187`.
+   **Decision: fail closed — block local readiness rather than reporting success** when the
+   projection is not compatible with the local client.
+
+## L5 — file IO and client integrations
+
+Worktree `~/.codex/worktrees/260911-l5/opencodex`, branch `codex/260911-l5-integrations-io`.
+
+Owned: directory `src/integrations/`; file `src/config/atomic-write.ts`. No open PR touches either.
+
+1. **#4197 — the DSH integration's atomic replace changes file ownership and causes `EACCES` across
+   UIDs.** **Decision: refuse the integration write when the target exists and its owner is not the
+   process euid, with an explicit API error. Do not relax the `0600` hardening and do not attempt
+   `fchown`.** A metadata-preserving replace can be proposed later as its own issue.
+2. **#4214 — add Cline as a supported client integration.** Follow the existing registry pattern in
+   `src/integrations/registry.ts`.
+
+## L6 — streaming and vendor tool leakage
+
+Worktree `~/.codex/worktrees/260911-l6/opencodex`, branch `codex/260911-l6-streaming-tools`.
+
+Owned: `src/server/responses/codex-ws-exchange.ts`, `src/server/responses/codex-ws-wire.ts`,
+directory `src/adapters/qoder/`.
+
+1. **#4191 — a long Codex thread fails only through the proxy** (WS 1006 / prelude timeout) while the
+   bypass works immediately. The timeout is `codex-ws-exchange.ts:214`. Reproduce first: establish
+   what length and timing trigger it and where the prelude budget goes. **Decision: the only in-scope
+   fix is to classify and report the timeout honestly, including the close code and the cause.** A
+   configurable budget, an SSE fallback, or a size preflight comes back as a report, not a patch.
+2. **#4190 — vendor CLI agent scaffolding leaks into routed output** for `qoder`. **Decision: fix it
+   inside `src/adapters/qoder/` by sanitizing the vendor scaffolding out of routed output, failing
+   closed when the shape is unrecognized.** If the fix needs `src/adapters/coding-agent/protocol.ts`,
+   which no lane owns, stop and report.
+
+## L7 — documentation
+
+Worktree `~/.codex/worktrees/260911-l7/opencodex`, branch `codex/260911-l7-docs`.
+
+Owned: `docs-site/src/content/docs/guides/providers.md`,
+`docs-site/src/content/docs/guides/remote-hub.md`. You are the only lane that may edit
+`providers.md`; L2 will send you wording rather than editing it.
+
+1. **#4215 — state whether each provider login consumes a subscription allowance or bills per
+   token.** Write the rule per authentication mode, then one explicit line per provider supporting
+   both.
+2. **#4200 — the remote hub guide breaks on a fresh config** (nested `ocx config set` fails when the
+   parent object is absent) and has no macOS data-plane TLS example. English source first;
+   translations are a follow-up.
diff --git a/devlog/_plan/260911_lane_dispatch_round/030_audit_round1.md b/devlog/_plan/260911_lane_dispatch_round/030_audit_round1.md
new file mode 100644
index 0000000000..c1eff86742
--- /dev/null
+++ b/devlog/_plan/260911_lane_dispatch_round/030_audit_round1.md
@@ -0,0 +1,84 @@
+# Audit round 1 — reviewer verdict and dispositions
+
+Reviewer: `xai/grok-4.6` explorer subagent, read-only, dispatched against the orch worktree.
+Verdict: **fail**. Seven anchored findings, all accepted. The dispositions below are folded into
+`010_lane_partition.md` and `020_lane_packets.md` before any lane is dispatched.
+
+## F1 — L1 and L6 both need the Responses WebSocket path
+
+Anchor: L1 was given the glob `src/server/responses/*` while L6 was given "streaming/WebSocket
+prelude paths"; the prelude timeout L6 must investigate is
+`src/server/responses/codex-ws-exchange.ts:214` (`failStream("codex websocket response prelude
+timed out")`). The packet even told L6 to stop if the cause landed in L1's territory, which is an
+admission that the boundary was wrong.
+
+Disposition: territories are now explicit file lists, not globs. `codex-ws-exchange.ts` and
+`codex-ws-wire.ts` belong to L6; L1 keeps `core.ts`, `chat-completions.ts`, `claude-messages.ts`,
+`compact.ts`, `policy-fallback.ts`, and the undeclared-tool guard.
+
+## F2 — L3's #4212 needs a Responses file
+
+Anchor: the issue names `src/server/responses/codex-auth-error.ts:35`, which sat inside L1's glob
+while L3 owned only `src/codex/*`.
+
+Disposition: `src/server/responses/codex-auth-error.ts` is assigned to L3. No open PR touches it, so
+the assignment costs L1 nothing.
+
+## F3 — #4207 is client work and collides with #4204
+
+Anchor: #4207 names `src/client/hub-client.ts:145`, `src/client/connect.ts:542`,
+`src/codex/catalog/effort.ts:441`, `src/cli/connect.ts:187`. #4204 is the same max/ultra clamp on
+`effort.ts:441`. They were split across L2 and L4, and `src/client/*` was owned by nobody.
+
+Disposition: #4207 moves to L4, which now owns `src/client/*` and `src/codex/catalog/effort.ts`.
+Two issues that clamp the same line are now one serialized stack. L2 keeps only #4201.
+
+## F4 — carried PRs drag files out of their lane
+
+Anchor: #4188 carries eight `docs-site/**` files, #4210 one, #4203 thirty-six files including
+`scripts/test-layout/layout.json` and `tests/fixtures/test-layout-expected.json`, #4170 touches
+`src/lib/process-control.ts`, and #4190's leak lives in `src/adapters/qoder/adapter.ts`, which no
+lane owned.
+
+Disposition: L7 owns only the two documentation pages it is fixing
+(`docs-site/**/guides/providers.md`, `docs-site/**/guides/remote-hub.md`); any lane may update the
+documentation page that describes its own change. `src/lib/process-control.ts` is added to L4,
+`src/adapters/qoder/*` to L6. The #4203 file count is corrected to 36.
+
+## F5 — two PR states were stated wrong
+
+Anchor: #4171 is a draft at `CHANGES_REQUESTED`, and #4170 is a draft at `REVIEW_REQUIRED`; the
+packet described neither as a draft.
+
+Disposition: corrected in place.
+
+## F6 — the test-layout rule contradicted AGENTS.md
+
+Anchor: the packet said to avoid `layout.json` by naming files conventionally; `AGENTS.md:23` says a
+new test file needs an entry in both `layout.json` `explicit` and
+`tests/fixtures/test-layout-expected.json`, with the regex seeds as a temporary placement only.
+
+Disposition: the avoidance rule is withdrawn. Every lane registers its own test files in both maps
+as AGENTS.md requires, and the orchestrator resolves the resulting append-only conflicts during the
+serialized merges. A rule that tells a lane to skip a repository requirement is worse than a
+conflict that takes a minute to resolve.
+
+## F7 — six items were not actually decision-free
+
+Anchor: #4197 (refuse versus preserve metadata), #4211 (`excludedPlans` versus `minimumPlan`),
+#4176 (prefix normalization versus the unified-exec rewrite), #4191 (four competing mitigations),
+#4207 (compatible projection versus blocking readiness), and #4203 (what "trim" means) each left a
+choice open, which contradicts the round's own decision-free filter.
+
+Disposition: the orchestrator makes those six calls now, in writing, and the lanes implement them.
+They are recorded in `020_lane_packets.md` per lane:
+
+| Item | Decision |
+|---|---|
+| #4197 | Refuse the integration write when the target exists and its owner is not the process euid, with an explicit API error. Do not relax the `0600` hardening and do not attempt `fchown`. |
+| #4211 | Ship `codexPool.excludedPlans` as an array, absent by default. Do not ship `minimumPlan`: ordering plans requires a rank this repository does not have. |
+| #4176 | Normalize the invented `default.` prefix back at the undeclared-tool guard, which is what the issue states as expected behaviour. The unified-exec rewrite is out of round scope. |
+| #4191 | Reproduce first. The only in-scope fix is to classify and report the prelude timeout honestly, including the close code and the cause. A configurable prelude budget is a report, not a patch. |
+| #4207 | Fail closed: when the projection is not compatible with the local client, block readiness rather than reporting success. |
+| #4203 | Trim to the pnpm self-update path plus the tests and the one documentation page that path requires. |
+
diff --git a/devlog/_plan/260911_lane_dispatch_round/040_audit_round2.md b/devlog/_plan/260911_lane_dispatch_round/040_audit_round2.md
new file mode 100644
index 0000000000..825c37945a
--- /dev/null
+++ b/devlog/_plan/260911_lane_dispatch_round/040_audit_round2.md
@@ -0,0 +1,32 @@
+# Audit round 2 — reviewer verdict and dispositions
+
+Reviewer: a second `xai/grok-4.6` explorer subagent, read-only, fresh context. Verdict: **fail**.
+
+It confirmed that four round-1 findings were actually fixed (the WS split, the #4207 move, the two
+PR states, the test-layout rule) and that three were only *described* as fixed. That distinction is
+the reason this round exists: a disposition table is not a partition.
+
+| # | Finding | Disposition in revision 3 |
+|---|---|---|
+| 1 | #4212 also needs `src/server/management/oauth-account-routes.ts`, and its refusal call sites are `core.ts:2243` and `compact.ts:296`, which L1 owns | `oauth-account-routes.ts` is assigned to L3. **Decision: L3 does not change the L1 call sites this round.** Its #4212 scope is the refusal string, the account-health surface, and the management route; call-site attribution becomes a follow-up issue if review asks for it. |
+| 2 | `docs-site/src/content/docs/guides/providers.md` was reachable by both L2 (carrying #4210) and L7 | The page belongs to **L7 only**. **Decision: L2 drops that hunk** from anything it carries and reports the needed wording to the orchestrator, who hands it to L7. |
+| 3 | The #4203 keep-set was never named, so L4 was told to carry a PR that edits files it must not touch | The keep-set is now enumerated file by file below, and the five files to drop are named too. |
+| 4 | L2 was still deciding maintainer policy on #4210 | **Decision: L2 does not build on #4210.** It implements #4201 independently; if its diff would overlap #4210's `quota.ts` hunks, it reports instead of merging the two lines of work. |
+| 5 | Territories still used globs while claiming to be explicit lists; bare `plan.ts` matched three files; `src/providers/registry.ts` was unnamed | Ownership is now either an exact path or one named directory, and directories do not overlap. `src/codex/plan.ts` is spelled out; `src/providers/registry.ts` is assigned to L2. |
+| 6 | The ledger cited a stale round-PR head and stale lane seed SHAs | The ledger is regenerated from live `git`/`gh` output after every orchestrator commit and carries the capture time. |
+
+## #4203 keep-set for L4
+
+Keep: `bin/ocx.mjs`, `src/cli.ts`, `src/cli/launcher-context.ts`, `src/config/pending-teardown.ts`,
+`src/lib/bun-runtime.ts`, `src/lib/package-tree-integrity.ts`, `src/service.ts`, every file under
+`src/update/`, the tests `tests/ci-workflows/install-scripts.test.ts`,
+`tests/cli/ocx-launcher-runtime.test.ts`, `tests/cli/ocx-launcher-source.test.ts`,
+`tests/update/update-badge.test.ts`, `tests/update/update-job.test.ts`,
+`tests/update/update-pnpm.test.ts`, `tests/update/update-stop-first.test.ts`, the two test-layout
+maps, and exactly one documentation page,
+`docs-site/src/content/docs/getting-started/installation.md`.
+
+Drop: `README.md`, `structure/01_runtime.md`, `structure/06_docs-and-release.md`,
+`docs-site/src/content/docs/getting-started/for-agents.md`,
+`docs-site/src/content/docs/reference/cli/lifecycle.md`.
+
diff --git a/devlog/_plan/260911_lane_dispatch_round/050_audit_round3.md b/devlog/_plan/260911_lane_dispatch_round/050_audit_round3.md
new file mode 100644
index 0000000000..c95a8fe43f
--- /dev/null
+++ b/devlog/_plan/260911_lane_dispatch_round/050_audit_round3.md
@@ -0,0 +1,19 @@
+# Audit round 3 — reviewer verdict and dispositions
+
+Reviewer: a third `xai/grok-4.6` explorer subagent, read-only, fresh context. Verdict: **near-pass**,
+with the instruction "Dispatch." It confirmed that all six round-2 items are fixed in the tree rather
+than narrated, and that the seven seeded packets are byte-equal to the round document.
+
+| # | Finding | Disposition |
+|---|---|---|
+| 1 | #4184 also edits `docs-site/src/content/docs/reference/configuration/providers.md`, which no lane owned | Assigned to L1. It is the page that documents L1's own change, and it is not L7's `guides/providers.md`. |
+| 2 | #4211 asks for dashboard and CLI display too, which the packet left unscoped | **Decision: the round ships selection only.** L3 stops and reports if display needs `src/cli/account.ts`, a GUI component, or a locale key, and writes `Refs #4211` instead of `Closes #4211` when the display half is absent. |
+| 3 | #4190 had no how-decision, unlike #4191 | **Decision: sanitize inside `src/adapters/qoder/` and fail closed on an unrecognized shape.** L6 stops if it needs `src/adapters/coding-agent/protocol.ts`. |
+| 4 | Carrying #4184 conflicts with the issue shape because of its request-scoped ephemeral lane | **Rejected.** #4172 states the opposite: "Requests with no identity should receive an isolated per-request value rather than being sent unheaderised or sharing one value." #4184's request-scoped lane is that shape, not a deviation. Recorded rather than folded, because folding a wrong finding would send L1 in the wrong direction. |
+| 5 | The #4170 keep-set omitted its two tests | Added: `tests/lib/process-control-graceful.test.ts` and `tests/providers/xai/grok-lifecycle.test.ts`. |
+| — | Residual glob `docs-site/**/guides/codex-integration.md` | Expanded to the English page and its seven named locale copies. |
+
+The reviewer also noted that `020` writes a bare `plan.ts` under a "all under `src/codex/`" heading
+while four `plan.ts` files exist in the repository. `010_lane_partition.md` spells
+`src/codex/plan.ts` and is the authoritative list, which the packet header states.
+
diff --git a/devlog/_plan/260911_lane_dispatch_round/060_ledger.md b/devlog/_plan/260911_lane_dispatch_round/060_ledger.md
new file mode 100644
index 0000000000..ffa641612c
--- /dev/null
+++ b/devlog/_plan/260911_lane_dispatch_round/060_ledger.md
@@ -0,0 +1,37 @@
+# Round ledger
+
+Captured from live `git` and `gh` at **2026-09-10T15:49:33Z**. Every value below is a command result, not narration.
+
+## Round PR
+
+`#4217` `555321ee5e6da84a73f8ad8eef21fb5e2f7989c6 OPEN`, base `dev`. Non-skipped checks at capture: IN_PROGRESS enforce-target, QUEUED ci, SUCCESS select windows runner, IN_PROGRESS react-doctor, SUCCESS changes, SUCCESS label, SUCCESS hygiene, SUCCESS resolve-pr, PENDING CodeRabbit.
+Product legs are SKIPPED by the `changes` filter because the PR is documentation only. Each further
+orchestrator commit advances this head, so the SHA above is the head at capture time and CI is
+re-evaluated per push; the merge gate uses the final head, not this one.
+
+## Lanes
+
+| Lane | Worktree | Branch | Local head | PR | Head SHA | Final-head CI | State |
+|---|---|---|---|---|---|---|---|
+| L1 | `~/.codex/worktrees/260911-l1/opencodex` | `codex/260911-l1-responses-core` | `d2509a156da24e2f6d459103bffb73f5e6d0047f` | not yet opened | — | — | packet at revision 3, unpushed |
+| L2 | `~/.codex/worktrees/260911-l2/opencodex` | `codex/260911-l2-catalog-provider` | `d72d40ae2bc72c749ec3b61f4605351de14b561e` | not yet opened | — | — | packet at revision 3, unpushed |
+| L3 | `~/.codex/worktrees/260911-l3/opencodex` | `codex/260911-l3-account-pool` | `157119ecb0724feab15d9c38119b85cd8e55af93` | not yet opened | — | — | packet at revision 3, unpushed |
+| L4 | `~/.codex/worktrees/260911-l4/opencodex` | `codex/260911-l4-service-cli` | `72c87ba567dcf74ad2732094b3133583a631e149` | not yet opened | — | — | packet at revision 3, unpushed |
+| L5 | `~/.codex/worktrees/260911-l5/opencodex` | `codex/260911-l5-integrations-io` | `08ce233806727f3a76709bcc810581151e98dc2d` | not yet opened | — | — | packet at revision 3, unpushed |
+| L6 | `~/.codex/worktrees/260911-l6/opencodex` | `codex/260911-l6-streaming-tools` | `9942ff6b24ff09ebd55f54196196db62137d54b7` | not yet opened | — | — | packet at revision 3, unpushed |
+| L7 | `~/.codex/worktrees/260911-l7/opencodex` | `codex/260911-l7-docs` | `d5758f235c87d96164c7d5e85cf62c4cc921741e` | not yet opened | — | — | packet at revision 3, unpushed |
+
+Base freeze for every lane: `6d3ad12e3`. Lane branches are local until their thread pushes.
+
+## Local checks
+
+`bun test`, `bun run test`, `bun run test:changed`, `bun run typecheck`, `bun run build:gui`,
+`bun install`: **NOT RUN** in this round, by operator instruction. Hosted CI on each exact pushed
+head is the only product evidence this round cites.
+
+## Audit history
+
+Round 1 (`030_audit_round1.md`): **fail**, seven findings, all folded in.
+Round 2 (`040_audit_round2.md`): **fail**, six findings, all folded in; it confirmed four round-1
+fixes were real and three were only described as fixed.
+
diff --git a/devlog/_plan/260911_lane_dispatch_round/070_dispatch_handoff.md b/devlog/_plan/260911_lane_dispatch_round/070_dispatch_handoff.md
new file mode 100644
index 0000000000..402c4fb6ce
--- /dev/null
+++ b/devlog/_plan/260911_lane_dispatch_round/070_dispatch_handoff.md
@@ -0,0 +1,148 @@
+# Dispatch handoff
+
+A thread is opened by the operator in the Codex app against the lane's worktree; an agent cannot
+create one. Everything else is ready: the worktree exists on its branch, the packet is committed on
+that branch, and the round is recorded in PR #4217.
+
+Paste the matching block into a new thread whose working directory is the lane worktree.
+
+## L1
+
+```text
+You are lane L1 of the 260911 dispatch round. Your worktree is
+~/.codex/worktrees/260911-l1/opencodex, already on branch codex/260911-l1-responses-core, cut from origin/dev 6d3ad12e3.
+
+Read devlog/_plan/260911_l1_responses_core/000_packet.md first and follow it exactly. It is your contract:
+owned paths, the decisions already made for you, the rules, and the report format.
+
+Run $codexclaw:cxc-loop as HOTL for your stack, in this order: #4172 then #4176.
+
+Non-negotiable: never run the local product suite, typecheck, build, or install - report them as
+NOT RUN. Prefix every mutating git command with `git -c core.hooksPath=/dev/null`. Push with
+--no-verify. Use unlimited read-only xai/grok-4.6 subagents to reproduce, to read call sites, and to
+review your own staged diff before you push; fold their findings in rather than arguing with them.
+Stay inside your owned paths, even when a carried PR touches more. Do not merge - when your last PR
+is green, report and stop.
+```
+
+## L2
+
+```text
+You are lane L2 of the 260911 dispatch round. Your worktree is
+~/.codex/worktrees/260911-l2/opencodex, already on branch codex/260911-l2-catalog-provider, cut from origin/dev 6d3ad12e3.
+
+Read devlog/_plan/260911_l2_catalog_provider/000_packet.md first and follow it exactly. It is your contract:
+owned paths, the decisions already made for you, the rules, and the report format.
+
+Run $codexclaw:cxc-loop as HOTL for your stack, in this order: #4201.
+
+Non-negotiable: never run the local product suite, typecheck, build, or install - report them as
+NOT RUN. Prefix every mutating git command with `git -c core.hooksPath=/dev/null`. Push with
+--no-verify. Use unlimited read-only xai/grok-4.6 subagents to reproduce, to read call sites, and to
+review your own staged diff before you push; fold their findings in rather than arguing with them.
+Stay inside your owned paths, even when a carried PR touches more. Do not merge - when your last PR
+is green, report and stop.
+```
+
+## L3
+
+```text
+You are lane L3 of the 260911 dispatch round. Your worktree is
+~/.codex/worktrees/260911-l3/opencodex, already on branch codex/260911-l3-account-pool, cut from origin/dev 6d3ad12e3.
+
+Read devlog/_plan/260911_l3_account_pool/000_packet.md first and follow it exactly. It is your contract:
+owned paths, the decisions already made for you, the rules, and the report format.
+
+Run $codexclaw:cxc-loop as HOTL for your stack, in this order: #4126 then #4212 then #4211.
+
+Non-negotiable: never run the local product suite, typecheck, build, or install - report them as
+NOT RUN. Prefix every mutating git command with `git -c core.hooksPath=/dev/null`. Push with
+--no-verify. Use unlimited read-only xai/grok-4.6 subagents to reproduce, to read call sites, and to
+review your own staged diff before you push; fold their findings in rather than arguing with them.
+Stay inside your owned paths, even when a carried PR touches more. Do not merge - when your last PR
+is green, report and stop.
+```
+
+## L4
+
+```text
+You are lane L4 of the 260911 dispatch round. Your worktree is
+~/.codex/worktrees/260911-l4/opencodex, already on branch codex/260911-l4-service-cli, cut from origin/dev 6d3ad12e3.
+
+Read devlog/_plan/260911_l4_service_cli/000_packet.md first and follow it exactly. It is your contract:
+owned paths, the decisions already made for you, the rules, and the report format.
+
+Run $codexclaw:cxc-loop as HOTL for your stack, in this order: #4202 then #4169 then #4204 then #4207.
+
+Non-negotiable: never run the local product suite, typecheck, build, or install - report them as
+NOT RUN. Prefix every mutating git command with `git -c core.hooksPath=/dev/null`. Push with
+--no-verify. Use unlimited read-only xai/grok-4.6 subagents to reproduce, to read call sites, and to
+review your own staged diff before you push; fold their findings in rather than arguing with them.
+Stay inside your owned paths, even when a carried PR touches more. Do not merge - when your last PR
+is green, report and stop.
+```
+
+## L5
+
+```text
+You are lane L5 of the 260911 dispatch round. Your worktree is
+~/.codex/worktrees/260911-l5/opencodex, already on branch codex/260911-l5-integrations-io, cut from origin/dev 6d3ad12e3.
+
+Read devlog/_plan/260911_l5_integrations_io/000_packet.md first and follow it exactly. It is your contract:
+owned paths, the decisions already made for you, the rules, and the report format.
+
+Run $codexclaw:cxc-loop as HOTL for your stack, in this order: #4197 then #4214.
+
+Non-negotiable: never run the local product suite, typecheck, build, or install - report them as
+NOT RUN. Prefix every mutating git command with `git -c core.hooksPath=/dev/null`. Push with
+--no-verify. Use unlimited read-only xai/grok-4.6 subagents to reproduce, to read call sites, and to
+review your own staged diff before you push; fold their findings in rather than arguing with them.
+Stay inside your owned paths, even when a carried PR touches more. Do not merge - when your last PR
+is green, report and stop.
+```
+
+## L6
+
+```text
+You are lane L6 of the 260911 dispatch round. Your worktree is
+~/.codex/worktrees/260911-l6/opencodex, already on branch codex/260911-l6-streaming-tools, cut from origin/dev 6d3ad12e3.
+
+Read devlog/_plan/260911_l6_streaming_tools/000_packet.md first and follow it exactly. It is your contract:
+owned paths, the decisions already made for you, the rules, and the report format.
+
+Run $codexclaw:cxc-loop as HOTL for your stack, in this order: #4191 then #4190.
+
+Non-negotiable: never run the local product suite, typecheck, build, or install - report them as
+NOT RUN. Prefix every mutating git command with `git -c core.hooksPath=/dev/null`. Push with
+--no-verify. Use unlimited read-only xai/grok-4.6 subagents to reproduce, to read call sites, and to
+review your own staged diff before you push; fold their findings in rather than arguing with them.
+Stay inside your owned paths, even when a carried PR touches more. Do not merge - when your last PR
+is green, report and stop.
+```
+
+## L7
+
+```text
+You are lane L7 of the 260911 dispatch round. Your worktree is
+~/.codex/worktrees/260911-l7/opencodex, already on branch codex/260911-l7-docs, cut from origin/dev 6d3ad12e3.
+
+Read devlog/_plan/260911_l7_docs/000_packet.md first and follow it exactly. It is your contract:
+owned paths, the decisions already made for you, the rules, and the report format.
+
+Run $codexclaw:cxc-loop as HOTL for your stack, in this order: #4215 then #4200.
+
+Non-negotiable: never run the local product suite, typecheck, build, or install - report them as
+NOT RUN. Prefix every mutating git command with `git -c core.hooksPath=/dev/null`. Push with
+--no-verify. Use unlimited read-only xai/grok-4.6 subagents to reproduce, to read call sites, and to
+review your own staged diff before you push; fold their findings in rather than arguing with them.
+Stay inside your owned paths, even when a carried PR touches more. Do not merge - when your last PR
+is green, report and stop.
+```
+
+## What the orchestrator does with the returns
+
+Nothing lands on a lane's authority. The orchestrator refreshes each lane's PR head, run id, and
+review state from `gh`, resolves the append-only conflicts in the two test-layout maps, and merges
+one lane at a time, each only when hosted CI is green on that exact head, with fetched `origin/dev`
+ancestry as the landing proof.
+