docs: refine v2.1.8 release plan

Author: lidge-jun

devlog/_plan/260623_v218_release/00_plan.md

@@ -17,7 +17,10 @@ The release must:
 
 - Repository: `/Users/jun/Developer/new/700_projects/opencodex`
 - Current branch at planning time: `dev`
-- `dev` / `origin/dev`: `3a8852cb77037d2f70e5f0c2e3ebe3721140495f`
+- `origin/dev`: `3a8852cb77037d2f70e5f0c2e3ebe3721140495f`
+- Local `dev` includes this release-plan evidence commit after `origin/dev` and should be included in
+  the release branch unless a later audit finds a release-blocking reason to exclude docs-only
+  evidence.
 - `main` / `origin/main`: `241e3277a7c0d7e76729a7ac6794a0851d52f9ea`
 - `package.json` version: `2.1.7`
 - Next release version: `2.1.8`
@@ -50,12 +53,18 @@ Dispatch a read-only plan auditor to verify:
    - `bun run build:gui`
    - `cd docs-site && bun install --frozen-lockfile && bun run build`
    - `git diff --check`
+   - Capture `git rev-parse dev origin/dev main origin/main` so the release log records the exact
+     source and target commits.
 2. Merge `dev` to `main`:
    - Ensure clean tree.
+   - Push local `dev` first if it contains release-plan or result evidence commits that are not yet
+     on `origin/dev`.
    - Checkout `main`.
-   - Fast-forward `main` to `dev` if possible.
+   - Fast-forward `main` to the actual verified local `dev` HEAD.
    - Push `origin/main`.
-3. Wait for `main` Cross-platform CI on commit `3a8852c`.
+3. Wait for `main` Cross-platform CI on the actual pushed `main` HEAD computed after the
+   fast-forward/merge. Do not hardcode `3a8852c`; that commit is only the pre-plan
+   `origin/dev` baseline.
 4. Release:
    - Run `bun scripts/release.ts 2.1.8 --publish` from clean `main`.
    - Let the helper bump `package.json`, commit `release: v2.1.8`, push `main`, wait for CI, dispatch release workflow, and watch the workflow.
@@ -80,14 +89,20 @@ Final checks:
 
 ### D: Done
 
-Record the final result in `devlog/_plan/260623_v218_release/10_result.md`, save memory, and pause the goal only after an independent final objective review returns DONE.
+Record the final result in `devlog/_plan/260623_v218_release/10_result.md` before release if it can be
+completed without speculative evidence; otherwise keep post-release evidence in `cli-jaw goal update`
+and memory so `dev` does not drift ahead of the published `main` release commit. Pause the goal only
+after an independent final objective review returns DONE.
 
 ## Expected File Changes
 
 ### NEW
 
 - `/Users/jun/Developer/new/700_projects/opencodex/devlog/_plan/260623_v218_release/00_plan.md`
 - `/Users/jun/Developer/new/700_projects/opencodex/devlog/_plan/260623_v218_release/10_result.md`
+  - Create before the release only if its content can be factual and non-speculative; otherwise use
+    goal evidence/memory for post-release facts to keep `main` and `dev` synchronized at the release
+    commit.
 
 ### MODIFY
 
@@ -98,7 +113,9 @@ Record the final result in `devlog/_plan/260623_v218_release/10_result.md`, save
 ## Risks
 
 - Release workflow could fail after npm publish. Mitigation: `scripts/release.ts` checks npm, tag, and GitHub Release are unused before publishing.
-- `origin/main` could move while waiting for CI. Mitigation: release helper aborts if remote main no longer equals the release commit.
+- `origin/main` could move while waiting for CI. Mitigation: compute the pushed main HEAD after the
+  merge, wait for CI on that exact SHA, and let the release helper abort if remote main no longer
+  equals the release commit.
 - Docs build is not part of CI. Mitigation: run `docs-site` build locally before main merge/release.
 - GUI build is not in full local test by default. Mitigation: run `bun run build:gui` before release and rely on CI GUI build smoke after push.
 - npm trusted publishing may fail due GitHub/npm configuration. Mitigation: do not use token fallback unless the trusted publishing failure proves it is necessary; report exact failure.