fix(memory): observe external Windows retention

Fixes #509\n\n- expose external/arrayBuffers plus observed memory counters\n- make watchdog/doctor use observed memory instead of RSS-only\n- update GUI memory card, docs, SOT, and tests\n\nVerification:\n- bun test tests/memory-watchdog.test.ts tests/doctor.test.ts\n- cd gui && bun test tests/memory-observability-card.test.tsx\n- bun x tsc --noEmit\n- cd gui && bun run lint\n- cd gui && bun run build\n- bun run privacy:scan\n- git diff --check\n- PR #554 CI: Cross-platform CI ubuntu/macos/windows + npm-global matrix, React Doctor, enforce-target, label, CodeRabbit all success

Author: lidge-jun

.codexclaw/goalplans/opencodex-live-unfinished-issues-and-prs-triage/goalplan.json

@@ -0,0 +1,24 @@
+{"ts":"2026-07-27T10:35:02.725Z","slug":"opencodex-live-unfinished-issues-and-prs-triage","event":"created","detail":"init objective=\"OpenCodex live unfinished issues and PRs triage against current GitHub state. Scope: repository lidge-jun/opencodex, dev target only, worktree <local-worktree>. First work-phase is docs-only manifest/devlog: fetch live open PRs and open issues via gh, record current number/title/state/base/head/mergeable/checks/reviews/labels, classify every item into merge now, takeover-fix, comment/request-changes, needs-author-rebase, needs-human/security, later/enhancement, upstream-tracking, or close, and produce a priority table. Later work-phases process exactly one PR or one issue per full PABCD cycle. Allowed: directly fix bugfix/simple safe items on dev, create PRs, wait for CI, squash merge, and close linked issues when live evidence proves safety. Out of scope: main/preview/release branches, automatic merge of security/auth/permission/data-migration/privilege-boundary work, and unapproved GUI/UX decisions except the approved OpenRouter Free separate-provider direction. Terminal outcomes: DONE when all safe live items are processed and manifest evidence is current; NOOP when an item needs no action after live check; NEEDS_HUMAN or UNSAFE for risk-bound/security/UX-decision items; BLOCKED for external author/rebase/CI or upstream dependency; BUDGET_EXHAUSTED only if explicit runtime bounds are hit. Verification: gh live snapshots, code/diff review for candidate PRs, CI/check URLs where actions occur, comments/merge/close URLs for external state changes, and devlog evidence committed locally before completion.\" criteria=0"}
+{"ts":"2026-07-27T10:46:14.884Z","slug":"opencodex-live-unfinished-issues-and-prs-triage","event":"workphase_done","detail":"closed WP0"}
+{"ts":"2026-07-27T10:46:14.884Z","slug":"opencodex-live-unfinished-issues-and-prs-triage","event":"workphase_started","detail":"started WP1"}
+{"ts":"2026-07-27T11:01:22.413Z","slug":"opencodex-live-unfinished-issues-and-prs-triage","event":"workphase_done","detail":"closed WP1"}
+{"ts":"2026-07-27T11:01:22.413Z","slug":"opencodex-live-unfinished-issues-and-prs-triage","event":"workphase_started","detail":"started WP2"}
+{"ts":"2026-07-27T11:11:58.894Z","slug":"opencodex-live-unfinished-issues-and-prs-triage","event":"workphase_done","detail":"closed WP9"}
+{"ts":"2026-07-27T11:11:58.894Z","slug":"opencodex-live-unfinished-issues-and-prs-triage","event":"workphase_started","detail":"started WP2"}
+{"ts":"2026-07-27T11:46:27.214Z","slug":"opencodex-live-unfinished-issues-and-prs-triage","event":"workphase_done","detail":"closed WP10"}
+{"ts":"2026-07-27T11:46:27.214Z","slug":"opencodex-live-unfinished-issues-and-prs-triage","event":"workphase_started","detail":"started WP2"}
+{"ts":"2026-07-27T11:47:00.000Z","slug":"opencodex-live-unfinished-issues-and-prs-triage","event":"workphase_started","detail":"started WP11"}
+{"ts":"2026-07-27T12:05:44.000Z","slug":"opencodex-live-unfinished-issues-and-prs-triage","event":"task_done","detail":"WP11-T1 rebased codex/catalog-written-signal onto origin/dev@7c74e0a22ec96dd5849d3d7253758f0ab15d9737"}
+{"ts":"2026-07-27T12:05:44.000Z","slug":"opencodex-live-unfinished-issues-and-prs-triage","event":"task_done","detail":"WP11-T2 verified locally and pushed ce716cc117ab23e4420c8c9fe860959968f66cdc"}
+{"ts":"2026-07-27T12:05:44.000Z","slug":"opencodex-live-unfinished-issues-and-prs-triage","event":"task_done","detail":"WP11-T3 hosted checks passed and PR #526 squash-merged as 9dd3c42dae2e7feda3581c6d477cf5a0d6e646bf"}
+{"ts":"2026-07-27T12:05:44.000Z","slug":"opencodex-live-unfinished-issues-and-prs-triage","event":"criterion_met","detail":"C-WP11-PR526-FINAL evidence in devlog/_plan/260727_wp11-pr526-final-rerun-merge/011_phase1_evidence.md"}
+{"ts":"2026-07-27T12:05:44.000Z","slug":"opencodex-live-unfinished-issues-and-prs-triage","event":"workphase_done","detail":"closed WP11"}
+{"ts":"2026-07-27T12:05:44.000Z","slug":"opencodex-live-unfinished-issues-and-prs-triage","event":"workphase_started","detail":"started WP2"}
+{"ts":"2026-07-27T12:08:50.093Z","slug":"opencodex-live-unfinished-issues-and-prs-triage","event":"workphase_done","detail":"closed WP11"}
+{"ts":"2026-07-27T12:08:50.093Z","slug":"opencodex-live-unfinished-issues-and-prs-triage","event":"workphase_started","detail":"started WP3"}
+{"ts":"2026-07-27T12:09:30.000Z","slug":"opencodex-live-unfinished-issues-and-prs-triage","event":"steering","detail":"corrected next active work-phase from WP3 to WP6 because PR #527 explicitly depends on the PR #526 decision; WP2 and WP3 remain pending"}
+{"ts":"2026-07-27T12:09:30.000Z","slug":"opencodex-live-unfinished-issues-and-prs-triage","event":"workphase_started","detail":"started WP6"}
+{"ts":"2026-07-27T12:16:35.216Z","slug":"opencodex-live-unfinished-issues-and-prs-triage","event":"workphase_done","detail":"closed WP6"}
+{"ts":"2026-07-27T12:16:35.216Z","slug":"opencodex-live-unfinished-issues-and-prs-triage","event":"workphase_started","detail":"started WP7"}
+{"ts":"2026-07-27T12:25:15.900Z","slug":"opencodex-live-unfinished-issues-and-prs-triage","event":"workphase_done","detail":"closed WP7"}
+{"ts":"2026-07-27T12:25:15.900Z","slug":"opencodex-live-unfinished-issues-and-prs-triage","event":"workphase_started","detail":"started WP8"}

.codexclaw/goalplans/opencodex-live-unfinished-issues-and-prs-triage/ledger.jsonl

@@ -0,0 +1,57 @@
+# 000 — live unfinished triage plan
+
+Snapshot time: 2026-07-27T10:41:30Z.
+Repository: `lidge-jun/opencodex`.
+Working branch: `codex/260727-live-triage`, based on local `dev` after rebase onto
+`origin/dev@7fcaa9119`.
+
+## Loop spec
+
+- Archetype: spec-satisfaction triage and repair loop.
+- Trigger: maintainer requested live re-triage of every unfinished issue and PR, then
+  safe processing one item per PABCD cycle.
+- Goal: produce a current manifest and process safe bugfix/simple items against `dev`.
+- Non-goals: no `main`, `preview`, or release branch changes; no automatic merge of
+  auth/security/permission/data-migration/privilege-boundary changes; no new UX
+  decisions except the already approved `OpenRouter Free` separate-provider direction.
+- Verifier: `gh` live state, PR diff/check/review inspection, and action URLs for any
+  GitHub comments/merges/closes.
+- Stop condition: all live items are either processed or left in a justified
+  terminal bucket.
+- Memory artifact: this numbered devlog folder plus the cxc goalplan ledger.
+- Resource bounds: local filesystem and GitHub via `gh`; no provider/model settings
+  changes; no production release.
+- Escalation condition: security/auth/credential/process-kill/paid-provider routing
+  surfaces stay `needs-human/security` unless a maintainer explicitly narrows the
+  decision.
+
+## Current branch evidence
+
+`git fetch --prune origin` moved `origin/dev` from `c05e88fdc` to `7fcaa9119`.
+Local `dev` had two existing devlog commits and was rebased on top of `origin/dev`.
+
+Current bases:
+
+| ref | sha |
+| --- | --- |
+| `origin/dev` | `7fcaa9119` |
+| local `dev` after rebase | `5bef68f5` |
+| worktree branch | `5bef68f5` |
+
+## Work-phase map
+
+This first work-phase is docs-only. It creates the live manifest and appends concrete
+follow-up work-phases. Later phases must process exactly one PR or one issue each.
+
+Initial next candidates from the live manifest:
+
+| next WP | item | planned bucket | action |
+| --- | --- | --- | --- |
+| WP1 | PR #526 | takeover-fix/rebase+tests | independent review found stale checks and missing direct write-path coverage |
+| WP2 | PR #528 | needs-human/security + request-changes | credential-origin binding blocker in image bridge; do not merge |
+| WP3 | issue #543 | comment/request-changes | answer with existing `ocx debug claude` capture switch and request marker frames |
+| WP4 | issue #547 | comment/request-changes | new Claude Desktop custom-model visibility report; request exact config/log evidence |
+| WP5 | issue #545 | takeover-fix/investigate | continue the 64-token classifier investigation; logging sub-bug already fixed in `7fcaa9119` |
+| WP6 | PR #527 | needs-human/security + needs-author-rebase | wrong base plus process-termination/restart boundary |
+| WP7 | issue #418 | takeover-fix/investigate | investigate V2 custom-parent to custom-child delegation failure |
+| WP8 | issue #509 | takeover-fix/investigate | investigate JS heap watchdog gap |

devlog/_plan/260727_live_unfinished_triage/000_plan.md

@@ -0,0 +1,35 @@
+# 001 — live PR manifest
+
+Snapshot command: `gh pr list --repo lidge-jun/opencodex --state open --limit 200`
+plus per-PR `gh pr view`.
+
+Open PR count: 14.
+
+| # | state | base | head | head sha | merge | review | checks | labels | bucket | rationale |
+| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
+| 533 | ready | dev | fix/gui-update-install-failure-recovery | `9de10c7a` | MERGEABLE/UNSTABLE | CHANGES_REQUESTED | target/label success; CodeRabbit pending | bug | needs-human/security | dependency/npm cache ownership and update/install recovery; do not auto-merge with requested changes |
+| 528 | ready | dev | fix/image-bridge-p2 | `553e9afc` | MERGEABLE/CLEAN | none | 8 CI jobs success + CodeRabbit success | bug | needs-human/security + request-changes | independent review found stale checks and credential-origin binding risk in `src/images/plan.ts` |
+| 527 | ready | codex/catalog-written-signal | codex/app-server-restart | `a64aa585` | MERGEABLE/UNSTABLE | none | enforce-target failure | bug | needs-human/security + needs-author-rebase | wrong base plus stale app-server restart/process-termination boundary |
+| 526 | ready | dev | codex/catalog-written-signal | `1ba588ef` | MERGEABLE/CLEAN | none | 10 CI jobs success + CodeRabbit success | bug | takeover-fix/rebase+tests | independent review found stale checks and missing direct filesystem write-path coverage |
+| 512 | ready | dev | split/426-01-namespace-foundation | `aef5628f` | MERGEABLE/CLEAN | CHANGES_REQUESTED | CI success | enhancement | needs-human/security | account namespace/auth identity model; requested changes still active |
+| 498 | draft | dev | agent/sync-native-subagent-defaults | `c2330797` | CONFLICTING/DIRTY | CHANGES_REQUESTED | label/target success only | enhancement | later/enhancement | draft, 55 files, config/default policy surface |
+| 495 | draft | dev | agent/main-account-last-resort | `7e0351d0` | MERGEABLE/UNSTABLE | CHANGES_REQUESTED | label/target success only | enhancement | needs-human/security | account routing policy for main account; draft and requested changes |
+| 493 | draft | dev | fix/anthropic-per-account-rate-limits | `5e466a79` | CONFLICTING/DIRTY | CHANGES_REQUESTED | mixed/cancelled historical checks | enhancement | needs-human/security | Claude OAuth quota/account policy surface; draft/conflicting |
+| 491 | draft | dev | fix/oauth-login-preserves-api-key | `e0debe22` | CONFLICTING/DIRTY | CHANGES_REQUESTED | target/label success only | bug | needs-human/security | OAuth/API-key preservation touches credential storage |
+| 461 | draft | dev | feat/ocx-opencode | `5ef84f48` | CONFLICTING/DIRTY | none | CI success on old head | enhancement | later/enhancement | new launcher/client support surface; draft and conflicting |
+| 447 | draft | dev | fix/kiro-multiauth | `48adb2b6` | MERGEABLE/CLEAN | CHANGES_REQUESTED | CI success | bug | needs-human/security | browser-based multi-account login touches auth/credential boundary |
+| 429 | draft | dev | fix/cursor-shell-alias-hint | `f408f348` | CONFLICTING/DIRTY | none | CI success on old head | bug | takeover-fix | small Cursor prompt/empty command bug but conflicting and draft |
+| 424 | draft | dev | feat/image-bridge | `a8b769c9` | MERGEABLE/UNSTABLE | CHANGES_REQUESTED | target/label success only | enhancement | needs-human/security | image bridge introduces paid xAI calls/artifact/download security surface |
+| 355 | draft | dev | feat/gemini-inline-image | `d3c876e6` | MERGEABLE/UNSTABLE | CHANGES_REQUESTED | target/label success only | enhancement | later/enhancement | competing image-output route; draft and requested changes |
+
+## Immediate PR read
+
+- `merge now`: none after independent audit.
+- `takeover-fix/rebase+tests`: #526, because checks are stale and direct
+  write-path coverage is missing.
+- `takeover-fix`: #429 only, because it is small and outside auth/security boundaries.
+- `needs-author-rebase` as prerequisite: #527 and conflicting draft PRs #498,
+  #493, #491, #461, #429.
+- `needs-human/security + request-changes`: #528.
+- `needs-human/security`: #533, #527, #512, #495, #493, #491, #447, #424.
+- `later/enhancement`: #498, #461, #355.

devlog/_plan/260727_live_unfinished_triage/001_live_pr_manifest.md

@@ -0,0 +1,42 @@
+# 002 — live issue manifest
+
+Snapshot command: `gh issue list --repo lidge-jun/opencodex --state open --limit 200`
+plus per-issue `gh issue view` comment tail.
+
+Open issue count: 23. Issue #546 is not listed because it is already closed:
+`closedAt=2026-07-27T10:17:08Z`.
+
+| # | labels | last update | bucket | rationale |
+| --- | --- | --- | --- | --- |
+| 547 | bug | 2026-07-27T10:38:50Z | comment/request-changes | new Windows Claude Desktop custom-model visibility report; needs exact generated config/profile path, `ocx claude desktop` output, and Desktop dev-mode/API-key shape |
+| 545 | bug, needs-info | 2026-07-27T10:22:15Z | takeover-fix/investigate | logging sub-bug fixed in `7fcaa9119`; remaining 64-token classifier behavior needs redacted request/frames or code isolation |
+| 543 | bug, provider-compatibility, needs-info | 2026-07-27T08:34:24Z | comment/request-changes | reporter supplied native control; we can answer with existing `ocx debug claude` capture switch |
+| 540 | enhancement, provider-compatibility, roadmap | 2026-07-27T08:09:26Z | later/enhancement | valid provider request but gated on official Automattic/OpenCodex auth contract |
+| 521 | needs-info | 2026-07-27T01:15:52Z | comment/request-changes | reporter/update pending for web-search 499 reproduction details |
+| 509 | needs-info | 2026-07-27T10:17:48Z | takeover-fix/investigate | JS heap memory warning gap is concrete enough for investigation but not merge/close |
+| 476 | enhancement | 2026-07-27T05:08:51Z | needs-human/security | PR #526 signal half is safe to repair, but #527 restart/process-termination half crosses the process boundary |
+| 462 | upstream-tracking, needs-info | 2026-07-26T21:40:30Z | upstream-tracking | session restore/model removal crash attributed upstream; keep tracking/needs-info |
+| 425 | enhancement | 2026-07-26T02:31:52Z | later/enhancement | PR #512 foundation exists but account namespace policy needs decision |
+| 418 | bug | 2026-07-26T21:44:52Z | takeover-fix/investigate | V2 custom-parent to custom-child delegation remains open with no linked PR |
+| 417 | bug, upstream-tracking | 2026-07-24T18:31:11Z | upstream-tracking | Korean realtime transcript corruption tracked upstream; not an ocx relay fix yet |
+| 415 | enhancement | 2026-07-24T11:29:04Z | later/enhancement | Gemini/search-capable provider sidecar follow-up from #398 |
+| 414 | enhancement | 2026-07-24T11:28:50Z | later/enhancement | Exa/other search provider sidecar follow-up from #398 |
+| 401 | enhancement, upstream-tracking | 2026-07-26T02:28:28Z | upstream-tracking | voice model route depends on realtime/Codex voice transport constraints |
+| 386 | enhancement | 2026-07-24T12:27:26Z | later/enhancement | macOS menu bar companion remains release/packaging roadmap |
+| 294 | enhancement, roadmap | 2026-07-27T00:41:58Z | later/enhancement | Claude account pool requires account-policy design; related PR #493 is draft/conflicting |
+| 241 | bug, upstream-tracking | 2026-07-23T18:54:39Z | upstream-tracking | Desktop model picker limitation remains upstream-facing |
+| 201 | enhancement, roadmap | 2026-07-22T11:40:05Z | later/enhancement | TRAE provider needs official auth/transport contract |
+| 178 | enhancement, roadmap | 2026-07-22T11:40:06Z | later/enhancement | Factory is agent backend, not plain model API; needs product decision |
+| 177 | enhancement, roadmap | 2026-07-22T11:40:08Z | later/enhancement | Warp/Oz agent API is not plain model API; needs product decision |
+| 95 | enhancement, roadmap | 2026-07-22T11:40:11Z | later/enhancement | multi-user proxy/LiteLLM changes deployment model |
+| 92 | bug, upstream-tracking | 2026-07-26T21:44:26Z | upstream-tracking | V2 encrypted_content/NEW_TASK body loss is upstream-facing and still open |
+| 42 | enhancement, roadmap | 2026-07-27T02:40:56Z | later/enhancement | storage page roadmap has landed pieces but remaining restore/auto-policy phases |
+
+## Immediate issue read
+
+- `takeover-fix/investigate`: #545, #509, #418.
+- `needs-human/security`: #476 for the process restart half.
+- `comment/request-changes`: #547, #543, #521.
+- `upstream-tracking`: #462, #417, #401, #241, #92.
+- `later/enhancement`: #540, #425, #415, #414, #386, #294, #201, #178, #177, #95, #42.
+- `close`: none from the current open list.

devlog/_plan/260727_live_unfinished_triage/002_live_issue_manifest.md

@@ -0,0 +1,31 @@
+# 003 — priority table
+
+This table is live-state based, not copied from the older owner-decision ledger.
+
+| tier | item | bucket | why now | next PABCD action |
+| --- | --- | --- | --- | --- |
+| P0 | PR #526 | takeover-fix/rebase+tests | clean/green at old head, but independent review found stale checks and shallow direct write-path coverage | rebase/take over or request author update |
+| P0 | PR #528 | needs-human/security + request-changes | credential-origin disclosure risk in image bridge, plus stale checks | request changes; no merge |
+| P0 | issue #543 | comment/request-changes | reporter has already answered the control question; debug switch exists | comment with capture instructions |
+| P0 | issue #547 | comment/request-changes | new Windows Claude Desktop custom-model visibility bug; likely config/profile evidence gap | comment with exact evidence request |
+| P0 | issue #545 | takeover-fix/investigate | user-facing repeated classifier failures; one logging layer fixed but root still open | investigate request token path |
+| P1 | issue #521 | comment/request-changes | still `needs-info`; web-search 499 needs reporter/update evidence before another fix claim | request exact reproduction delta if stale |
+| P1 | issue #476 | needs-human/security | signal half can be handled by #526, but restart/process-termination half is a human/security boundary | split safe signal work from restart policy |
+| P1 | PR #527 | needs-author-rebase | wrong base blocks CI policy and #476 closure | after #526, ask/retarget to `dev` |
+| P1 | issue #418 | takeover-fix/investigate | real V2 delegation bug with no linked PR | inspect delegation path and repro |
+| P1 | issue #509 | takeover-fix/investigate | concrete JS-heap memory growth gap | inspect watchdog heap/RSS logic |
+| P2 | PR #429 | takeover-fix | small Cursor bug but draft/conflicting; user previously deprioritized Cursor-class work | rebase/fix only after P0/P1 |
+| P2 | conflicting drafts #429/#461/#491/#493/#498 | dual bucket | conflicts are a prerequisite blocker; each retains its own primary bucket based on surface risk | rebase only inside that item’s PABCD |
+| P2 | PR #533 | needs-human/security | install/update ownership boundary with requested changes | security review only |
+| P2 | PR #447 | needs-human/security | auth/browser multi-account boundary | security review only |
+| P2 | PR #491 | needs-human/security | OAuth/API-key preservation touches credential store | security review only |
+| P3 | PR #512/#495/#493 | needs-human/security | account identity/quota policy must be unified | product/security design cycle |
+| P3 | PR #424/#355 | later/enhancement / needs-human | competing image-generation routes; UX/backend choice absent | human decision before merge |
+| P3 | PR #498/#461 | later/enhancement | draft/conflicting new policy/surface work | wait/replan |
+| P3 | roadmap issues #42/#95/#177/#178/#201/#294/#386/#414/#415/#425/#540 | later/enhancement | not immediate bug cleanup | scheduled roadmap cycles |
+| P3 | upstream issues #92/#241/#401/#417/#462 | upstream-tracking | external dependency or upstream attribution | keep tracking; do not close without upstream proof |
+
+## Rule for next phases
+
+Each item above gets its own full PABCD cycle before GitHub state changes. The only
+exception is read-only live refresh inside the P phase of that same item.