docs(coder): consolidate both sessions' handoffs into one

Diff

1 file changed, +290 -107

# Handoff — 2026-08-26, coder autoimprovement + GLM + credits
# Handoff — 2026-08-26

Written under a hard usage stop. Facts verified unless marked ASSUMED.
Consolidated from two sessions writing under usage hard-stops: this one
(coder autoimprovement, GLM catalog, credits, Gym, the deploy) and the peer
session (coder tools, bottom row, lanes). Facts are verified unless marked
GUESS.

## RIGHT NOW — a production deploy is in flight
---

A subagent is deploying `openagents.com` `c67cf39` to production, per
`docs/operations/production-deploy-runbook.md`. Owner approved it.
# 1. IN FLIGHT RIGHT NOW

## A production deploy is running

A subagent is deploying `openagents.com` **`c67cf39`** to production per
`docs/operations/production-deploy-runbook.md`. Owner approved it explicitly.

**The one thing that matters:** `c303a37` migrates
`users.credit_allowance_microusd` — adds nullable, **backfills every existing
row to `100_000_000`**, then `NOT NULL` default `20_000_000`.
**If that backfill did not run, every existing user silently dropped from $100
to $20.** VERIFY IN PRODUCTION. Do not infer it from the migration exiting 0.
Test that proves it both ways: `credit_allowance_backfill_test.exs`.
The test that proves it both directions is `credit_allowance_backfill_test.exs`.

If the fleet is half-rolled, that is the first thing to fix and to say.

Post-deploy checks owed: site serves the new revision; `install.sh` **served
bytes** actually offer three names (it has been serving "installs 'oa' only"
all day); `GET /api/v1/credit` answers; the backfill.
Post-deploy checks owed:
1. Site serves, and the running revision is the deployed SHA.
2. **`https://openagents.com/install.sh` served bytes actually changed** — it
   has been serving *"this installs 'oa' only"* and pointing at the TypeScript
   CLI all day. `c5c3173` fixed it on main this morning. The owner asked for
   this in unusually direct terms.
3. `GET /api/v1/credit` answers for an authenticated account.
4. The backfill.

## Release 0.0.4 — approved, NOT yet cut, gated
## Two peer agents with unpushed work at risk

Owner: single-platform only, macOS aarch64. Seven-platform waits for 0.1.0.
**Integration agent** — landing four commits onto `openagents/main` in order.
All four exist and are good; if the agent died, cherry-pick in this order from
those worktrees (they share the main repo's object store, so every SHA is
reachable):

```
| issue | commit | worktree |
| --- | --- | --- |
| #127 tools | `3150c13a0d` | `~/.claude/jobs/35ca4e13/tmp/wt127` |
| #128 `/logout` | `929959cb21` | `…/wt128` |
| #129 strings | `1a94c8a357` | `…/oa` |
| #130 identity row | `0472ac7468` | `…/wt130` |

**The one real conflict:** `7cbe78af4f` (landed) renders the credit balance
straight into `status_area` at `tui.rs:376-381`. #130 restructured that row —
token counts out, identity in — and reserved columns for exactly that balance.
Both are correct against their own base. Reconcile, drop neither.

**`BALANCE_COLUMNS = 26`, not 24.** #130's commit says 24. Measured against
the strings `credit.rs` actually formats: `credit: 3 unpriced calls` is exactly
24 and `credit: 12 unpriced calls` is 25 — and the real benchmark run had 12
unpriced calls, so 24 truncates the case the field exists to report.

**#131 agent** — lanes, worktree `…/wt131`, based on `0472ac7468`, NOT on main.

---

# 2. Release 0.0.4 — approved, NOT cut, gated

Owner: **single platform only, macOS aarch64.** Seven-platform waits for 0.1.0.

```sh
ops/release-cli.sh --version 0.0.4 --targets "macos-aarch64" --publish --allow-partial
```

**No `--channel stable`.** `stable` stays at 0.0.2 — a single-platform build
behind the channel hands every other platform a bare download failure.

**Blocked on two things:**
1. **#258 GLM catalog** (mine, agent still running, nothing pushed as of writing)
2. **#131 lane rework** (other session's) — the shipped binary defaults to
   `Lane::OxAlpha` which **pins the id `ox-alpha`**
   (`crates/openagents-cli/src/runtime.rs:178` and `:213`). Once the catalog
   drops ox-alpha, every fresh session opens on an id the proxy refuses.
   **Do not cut 0.0.4 until #131 lands.** I had a one-line fix (`#[default]`
   on `Auto`), tested green, and **dropped it uncommitted** — the owner ruled
   `Auto` is removed entirely, so the enum belongs to #131.

Before cutting: verify Flash resolves to a live id against the **deployed**
catalog. That check is ours, not theirs.

## Owner decisions today (all confirmed by the owner directly)

- Catalog: `glm-5.3-flash` **default**, `gemini-3.7-flash` second. **No luna,
  no ox-alpha** in the selectable catalog.
- Luna survives ONLY as the tail of `vercel_gateway_fallback_models`
  (`config/config.exs:224`). Not selectable, still a backstop. Both statements
  are consistent: two different lists.
- ox-alpha is **not deprecated, it graduated** — it was the stealth name for
  GLM 5.3 Flash, which shipped publicly 2026-08-26.
- Vercel primary, OpenRouter fallback. Box lane (`box.ex:456`) uses OpenRouter
  directly and is a deliberate temporary exception.
- Lanes: **Flash (default) and Free only. No Auto, no Pro** — "for first
  versions", so do not reuse those names for something else.
- Credits: **$20 for new accounts, existing accounts stay at $100.**
  One GitHub identity = one credit.

## Model ids — the hyphen differs per gateway. Do not guess.

| Gateway | id |
| --- | --- |
| Vercel AI Gateway | `zai/glm-5.3-flash` |
| OpenRouter | `z-ai/glm-5.3-flash` |
behind the channel hands every other platform a bare download failure, and the
script refuses that without `--allow-partial` for exactly this reason.

**Gated on #131.** The shipped binary defaults to `Lane::OxAlpha`, which
**pins the id `ox-alpha`** (`crates/openagents-cli/src/runtime.rs:178` and
`:213`). The catalog change has now landed, so a fresh session on the current
binary opens on an id the proxy refuses. **Do not cut 0.0.4 until #131 lands.**

I had a one-line fix (`#[default]` on `Auto`), tested green, and **dropped it
uncommitted** — the owner then ruled `Auto` is removed entirely, so the enum
belongs to #131.

**Before cutting:** verify Flash resolves to a live id against the *deployed*
catalog. That check is ours, not the peer's.

OpenRouter pricing $0.075/$0.25 per 1M is a **50% discount expiring
2026-09-09**; list is $0.15/$0.50. Keep `source: :placeholder` — an operator
declares rates, and those numbers are wrong in two weeks.
---

## Landed today
# 3. Owner decisions today (all confirmed directly)

- **Catalog:** `glm-5.3-flash` **default**, `gemini-3.7-flash` second. No luna,
  no ox-alpha in the selectable catalog.
- **Luna** survives only as the tail of `vercel_gateway_fallback_models`. Not
  selectable, still a backstop. Both owner statements are consistent — two
  different lists.
- **ox-alpha is not deprecated, it graduated.** It was the stealth name for
  GLM 5.3 Flash, which shipped publicly 2026-08-26. OpenRouter now returns
  HTTP 404 for `stealth/ox-alpha` with a pointer to `z-ai/glm-5.3-flash`.
- **Vercel primary, OpenRouter fallback.** The box lane (`box.ex:456`) talks to
  OpenRouter directly and is a deliberate temporary exception.
- **Lanes: Flash (default) and Free only. No Auto, no Pro** — "for first
  versions", so do not reuse those identifiers for anything else.
  - Coder Flash = Vercel gateway, `glm-5.3-flash` primary, Gemini 3.7 Flash
    fallback.
  - Coder Free = OpenRouter, `thinkingmachines/inkling` primary,
    `openrouter/free` fallback.
  - Shift+tab switches; the lane shows **under the input bar**, not at top.
- **Credits: $20 for new accounts, existing accounts stay at $100.** One GitHub
  identity = one credit.
- Release cadence: single-platform now, seven-platform at 0.1.0.

---

# 4. Model ids — the hyphen differs per gateway. Do not guess.

| Gateway | id | Context | Max output |
| --- | --- | --- | --- |
| Vercel AI Gateway | `zai/glm-5.3-flash` | 1,000,000 | 131,000 |
| OpenRouter | `z-ai/glm-5.3-flash` | 1,048,576 | 131,072 |

Both queried live from each gateway's `/models`, not guessed.

**Credit boundary, settled by Vercel's own routing metadata:**
`"resolvedProvider":"zai"`, `"credentialType":"byok"`, `"cost":"0"` — the
Vercel lane spends **BYOK z.ai credentials** held at Vercel, and Vercel charges
nothing to route. Same shape as the Gemini/Vertex entry.

**Balances as of landing — the real constraint:**
- **z.ai via Vercel: $9.66 left** (used $82.80). This is now the default lane
  for every caller who names no model.
- OpenRouter: **~$19.80 left**. This is what the box/OpenCode lane spends.

Pricing is `:placeholder` at **list price** ($0.15/$0.50 per 1M), deliberately
not the 50% offer expiring 2026-09-09 — a cost figure that silently doubles in
two weeks is worse than one that is honestly high.

---

# 5. What landed today

## `openagents` monorepo

| Commit | What |
| --- | --- |
| `4f48460657` | autoimprove plan + runbook + best-practices ledger |
| `f3bad5277b` | DSPy/GEPA analysis (tier boundary: upstream Python offline, native online) |
| `f3bad5277b` | DSPy/GEPA analysis — tier boundary: upstream Python offline, native online |
| `db6beb9781` | Claude Code teardown series + index |
| `846597cd81` | **Corrected P3** (was factually wrong) + added **K1** |
| `7325bb8467` / `a3c8197d4e` | #116 PTY harness, 8 tests, red-then-green proven. **CLOSED** |
| `3a3f31e8af` | #117 TUI inventory, 79 rows |
| `163af256c8` | #126 item 1, dead seed-identity symbols |
| `33f315fdaf` | first proxy baseline, tb2-quick 2/2 |
| `8909d2eb52` | **tb2-cross-section 9/12, 75%, full coverage** |
| `33f315fdaf` | first proxy baseline, `tb2-quick` 2/2 |
| `8909d2eb52` | **`tb2-cross-section` 9/12, 75%, full 12/12 coverage** |
| `cf63540b5a` / `e753d0b60f` | #122 staged text surfaces + `check:coder-surfaces` guard |
| `0c3b7992c8` | #121 review command |
| `c303a37` / `7cbe78af4f` | #259 credits, both halves. **CLOSED** |

`main` (openagents) at `7cbe78af4f` — verified **0 typecheck errors**, no
dangling INVARIANTS paths.

## Open issues

`openagents`: #117 (port half), #118, #119, #120, #123, #124, #125, #126,
#127–#132 (other session's).
`openagents.com`: #258 GLM, #259 closed.

**#125 is now a prerequisite, not hygiene.** A fully-covered 12/12 run at 75%
**cannot exit 0** because cost is unmeasurable on an unpriced lane. GLM lands
`:placeholder`-priced and `acceptPlaceholderRates` is deliberately absent, so
**the new default lane inherits exit-2 on its first run.** Resolve #125 BEFORE
the GLM baseline or it proves nothing. Option 3 (price the model) conflicts
with `acceptPlaceholderRates` by design; options 1 and 2 do not.

## Traps that cost real time today

- **Git credential helper**: `~/.openagents/bin` is FIRST in PATH and the
  0.0.2 release put `coder-lite` there as `openagents`, shadowing the Node CLI
  v0.4.0 that implements `auth git-credential`. The Rust binary **refuses
  `--api-url` and exits 0**, so git reads "no credential" and fails with
  `unable to get password from user`. I repointed both repos' local helpers at
  the Node CLI's absolute path. Root cause is **#132**.
  `~/.openagents/bin/openagents` was deleted in the process — the owner's
  three-name install is currently two names.
| `7cbe78af4f` | #259 credits, CLI half |
| `34bb86f898` | ATIF export named the withdrawn `0.1.0` on every trace; fixed |
| `0e5afb85fe` | this handoff |

`main` verified at `7cbe78af4f`: **0 typecheck errors**, no dangling
`INVARIANTS.md` paths.

## `openagents.com`

| Commit | What |
| --- | --- |
| `c303a37` | #259 credits, server half. **CLOSED** |
| `c5c3173` | Install as `openagents`, `coder`, and `oa` |
| `e347f25` | Install page corrected |
| `c67cf39` | Device sign-in returns to the approval it came from |
| `815a5b0` | **#258 GLM catalog. CLOSED** |

**GLM landing detail worth keeping:** withdrawal is real, not hidden —
`Models.fetch/1` returns `:error`, so mint refuses and the proxy refuses
`model_unavailable`, with a test asserting it. Verified end-to-end through the
app's own adapter (`VercelGateway.stream/3`): 39 events, 23 reasoning deltas, a
real tool call, usage 188/46/234. Also carried a migration renaming
`account_chat_runs.backend` (history replays only into the backend that wrote
it, so rows left as `ox-alpha` would have silently stopped replaying) and
deleted two dead config keys that mirrored the default model's rates — the
exact hidden coupling that breaks when a default moves. `mix precommit` green,
5097 passed.

---

# 6. Open issues

**`openagents`:** #117 (port half), #118, #119, #120, #123, #124, #125, #126,
#127–#133 (peer's).
**`openagents.com`:** #258 and #259 both **closed**.

## #125 is a prerequisite, not hygiene

A fully-covered 12/12 run at 75% success **cannot exit 0**, because cost is
unmeasurable on an unpriced lane. Gate `unverifiable`, exit 2 — confirmed by a
completed run, not by argument.

**GLM landed `:placeholder`-priced and `acceptPlaceholderRates` is deliberately
absent, so the new default lane inherits exit-2 on its first run.** Resolve
#125 *before* the GLM baseline or it proves nothing about its own cost floor.
Option 3 (price the model) conflicts with `acceptPlaceholderRates` by design;
options 1 and 2 do not.

## Not solved, flagged by the GLM agent

Luna is still spendable **outside** the catalog: five direct readers of
`:openai_model`, plus the whole SCV lane. Catalog-level Vercel→OpenRouter
failover was deliberately not built — the failure semantics are undefined in
the existing code and that is a separate decision. Both catalog models now sit
on one gateway: a single point of failure with no catalog-level backup, stated
plainly in the config rather than papered over.

---

# 7. The constraint on #131

**If Flash cannot resolve its id, it must refuse loudly.** Removing `Auto` did
not remove the problem `Auto` avoided — it moved the whole load onto catalog
resolution. A Flash that silently falls back to a compiled-in id reintroduces
exactly the failure being deleted, and is *harder* to spot than `ox-alpha` was
because the label still looks right. Three cases:

1. primary not served → declared fallback, and **the row names the model that
   actually answered**, not "Flash"
2. neither served / catalog unreachable → **refuse, naming what the deployment
   does serve** (`unadmitted_model/1`, `lib/openagents/inference.ex:552`,
   interpolates `Models.ids()`)
3. never pin a constant

`TIERS` (`runtime.rs:147`) is what caused this: two of its three entries named
ids that left the catalog today.

**Alias decision:** `gemini`, `gemini-flash`, `gemini-3.7-flash`, `luna`,
`gpt-5.6-luna`, `auto`, `pro` all **stop being aliases** and fall through to
`Lane::Named(...)`. Otherwise `--lane gemini-3.7-flash` silently returns GLM.
Make the shift+tab cycle **walk a lane list**, not a hardcoded two-state
toggle, so Pro returns as one entry.

**The peer's four balance states must survive verbatim:** nothing before first
read, `credit: unavailable`, `credit: N unpriced calls`, `credit: $X.YZ left`.
**No caveated figure** — a reader takes the digits and drops the qualifier.

---

# 8. Traps that cost real time today

- **Git credential helper.** `~/.openagents/bin` is FIRST in PATH and the 0.0.2
  release put `coder-lite` there as `openagents`, shadowing the Node CLI v0.4.0
  that implements `auth git-credential`. The Rust binary **refuses `--api-url`
  and exits 0**, so git reads "no credential" and fails with `unable to get
  password from user`. Both repos' local helpers are repointed at the Node
  CLI's absolute path. Root cause is **#132**.
- **`check:fast` aborts at its first failure.** "These N things are red" is a
  snapshot of one guard, never an inventory. Every red list in every issue is
  wrong by the next fix, including the one I wrote into #126. Re-measure.
- **Never grant a blanket `--no-verify` waiver.** Doing so told an agent
  removing enum variants to ignore typecheck — the one signal that catches a
  dangling reference to a removed variant.
- **Disk**: hit 100% and killed every agent. Freed ~500 GB: 25 cargo `target/`
  wrong by the next fix, including the one in #126. Re-measure.
- **Never grant a blanket `--no-verify` waiver.** It told an agent removing enum
  variants to ignore typecheck — the one signal that catches a dangling
  reference to a removed variant.
- **Never `cargo fmt` at crate scope** — this machine's rustfmt reformats ~25
  untouched files.
- **Verify pushes with `git merge-base --is-ancestor <sha> openagents/main`
  after a fresh fetch**, never against push output.
- **Don't `git checkout <file>` to undo a test append** — it reverts every edit
  in that file.
- Tool descriptions and prompts are **staged artifacts** in
  `surfaces/coder/*.v1.json`; regenerate with `pnpm run build:coder-surfaces`.
  Never inline.
- **Disk** hit 100% and killed every agent. Freed ~500 GB: 25 cargo `target/`
  dirs (194 GB) and Docker's 218 GB `Docker.raw`, which was also why Docker
  would not start. **`~/Library/Caches/Mozilla.sccache` is 60 GB and untouched**
  — safe to clear after a release; set `SCCACHE_CACHE_SIZE`.

  reused the one shared list (`packages/atif/src/redaction.ts`) rather than
  writing a third — the #103 lesson.

## The thing I got wrong repeatedly
---

# 9. Machine state — read before debugging anything

- `openagents` → **npm/Node CLI**. `~/.openagents/bin/openagents` was deleted
  to fix git pushes, so the owner's three-name install is currently two.
- `coder` and `oa` → **zsh functions** in `~/.zshrc` pointing at the TypeScript
  CLI. They shadow the symlinks in `~/.openagents/bin`, so restoring the
  symlinks alone will NOT work.
- **`coder-rs` → the native binary, 0.0.3.** Verified, SHA-256 checked. This is
  the one that runs Rust.
- `~/.openagents/bin` is **not on PATH**; `coder-rs` is linked into
  `~/.local/bin`.
- `stable` resolves to **0.0.2** while **0.0.3 is published** — the installer
  gives a build behind what is being tested.
- A loopback bridge may still be running: `python3 /tmp/issue118-bridge.py`,
  `0.0.0.0:4001 → 127.0.0.1:4000`. Harmless; needed again for the next Harbor
  run because another session holds port 4000 loopback-only.
- `~/try-tools.sh` and `~/try-coder.sh` exist for manual testing;
  `try-tools.sh` needs the wt127 build.

---

# 10. The thing I got wrong repeatedly

Three of my briefs shipped **unverified premises** and agents had to correct
them: P3's twelve-slot catalog (neither harness has one — the tool is
constant-size, `SEARCH_LIMIT` = 5), a `tui.rs` claim I lifted from a teardown
of the **TypeScript** UI, and a hand-counted column width that was off by one
in the exact case that mattered. **K1 in `best-practices.md` is the entry
about this.** I wrote it this morning and then did it again twice.
them: P3's twelve-slot catalog (neither harness has one — the `capability` tool
is constant-size, `SEARCH_LIMIT` = 5), a `tui.rs` claim I lifted from a
teardown of the **TypeScript** UI, and a hand-counted column width that was off
by one in the exact case that mattered.

**K1 in `docs/coder/best-practices.md` is the entry about this.** I wrote it
this morning and then did it again twice. Every premise in a brief must carry
the file and symbol it was read from.

---

# 11. Not yet written

Every premise in a brief must carry the file and symbol it was read from.
A ledger entry for the shape with four instances: **M2** unknown cost, **stale
identity**, **exit-0 refusal (#132)**, and **blanket gate waivers**. Two
threads: *a value that looks more certain than it is*, and *a waiver deletes
the signal that catches your own worst failure*. Promised to the peer as a
draft after the release lands — do it then, not before. The point is that it
survived landing.

## Not yet written
Also open: the `VERSION` fallback (a non-release build reports `0.1.0`, which
is withdrawn AND numerically ahead of every real release, so `oa update` on a
dev build thinks it is newer than stable — documented as deliberate in
`lib.rs`, worth a decision); seven docs pages still send readers to
`@openagentsinc/cli`; the TypeScript CLI still ships `seed-identity.ts` and
`identity-command.ts` after identity was removed from the Rust side.

A ledger entry for the shape with four instances: M2 unknown cost, stale
identity, **exit-0 refusal (#132)**, and blanket gate waivers. Common thread:
*a value that looks more certain than it is*, and *a waiver deletes the signal
that catches your own worst failure*. I promised the peer a draft after the
release lands. Do it then, not before — the point is that it survived landing.
---

## Peer session
# 12. Peer session

`uds:/tmp/cc-socks/96662.sock` ("Empty dots investigation") owns #127–#132 and
the coder bottom-row layout. Contract: they own the row, we own a
**26-column right-aligned balance slot** (`BALANCE_COLUMNS = 26`). They ping
when the row lands so we pick `tui.rs` back up. They do **not** deploy.
`uds:/tmp/cc-socks/96662.sock` ("Empty dots investigation") owns #127–#133 and
the coder bottom-row layout. Contract: **they own the row, we own a 26-column
right-aligned balance slot.** They ping when the row lands so we pick `tui.rs`
back up. **They do not deploy** — owner ruled "you dont deploy, other will
deploy."

129	275		reused the one shared list (`packages/atif/src/redaction.ts`) rather than
130	276		`writing a third — the #103 lesson.`
131	277
132		-	`## The thing I got wrong repeatedly`
	278	+	`---`
	279	+
	280	+	`# 9. Machine state — read before debugging anything`
	281	+
	282	+	- `openagents` → npm/Node CLI. `~/.openagents/bin/openagents` was deleted
	283	+	`to fix git pushes, so the owner's three-name install is currently two.`
	284	+	- `coder` and `oa` → zsh functions in `~/.zshrc` pointing at the TypeScript
	285	+	CLI. They shadow the symlinks in `~/.openagents/bin`, so restoring the
	286	+	`symlinks alone will NOT work.`
	287	+	- `coder-rs` → the native binary, 0.0.3. Verified, SHA-256 checked. This is
	288	+	`the one that runs Rust.`
	289	+	- `~/.openagents/bin` is not on PATH; `coder-rs` is linked into
	290	+	`~/.local/bin`.
	291	+	- `stable` resolves to 0.0.2 while 0.0.3 is published — the installer
	292	+	`gives a build behind what is being tested.`
	293	+	- A loopback bridge may still be running: `python3 /tmp/issue118-bridge.py`,
	294	+	`0.0.0.0:4001 → 127.0.0.1:4000`. Harmless; needed again for the next Harbor
	295	+	`run because another session holds port 4000 loopback-only.`
	296	+	- `~/try-tools.sh` and `~/try-coder.sh` exist for manual testing;
	297	+	`try-tools.sh` needs the wt127 build.
	298	+
	299	+	`---`
	300	+
	301	+	`# 10. The thing I got wrong repeatedly`
133	302
134	303		`Three of my briefs shipped unverified premises and agents had to correct`
135		-	`them: P3's twelve-slot catalog (neither harness has one — the tool is`
136		-	constant-size, `SEARCH_LIMIT` = 5), a `tui.rs` claim I lifted from a teardown
137		-	`of the TypeScript UI, and a hand-counted column width that was off by one`
138		-	in the exact case that mattered. **K1 in `best-practices.md` is the entry
139		-	`about this.** I wrote it this morning and then did it again twice.`
	304	+	them: P3's twelve-slot catalog (neither harness has one — the `capability` tool
	305	+	is constant-size, `SEARCH_LIMIT` = 5), a `tui.rs` claim I lifted from a
	306	+	`teardown of the TypeScript UI, and a hand-counted column width that was off`
	307	+	`by one in the exact case that mattered.`
	308	+
	309	+	K1 in `docs/coder/best-practices.md` is the entry about this. I wrote it
	310	+	`this morning and then did it again twice. Every premise in a brief must carry`
	311	+	`the file and symbol it was read from.`
	312	+
	313	+	`---`
	314	+
	315	+	`# 11. Not yet written`
140	316
141		-	`Every premise in a brief must carry the file and symbol it was read from.`
	317	+	`A ledger entry for the shape with four instances: M2 unknown cost, **stale`
	318	+	`identity, exit-0 refusal (#132), and blanket gate waivers**. Two`
	319	+	`threads: a value that looks more certain than it is, and *a waiver deletes`
	320	+	`the signal that catches your own worst failure*. Promised to the peer as a`
	321	+	`draft after the release lands — do it then, not before. The point is that it`
	322	+	`survived landing.`
142	323
143		-	`## Not yet written`
	324	+	Also open: the `VERSION` fallback (a non-release build reports `0.1.0`, which
	325	+	is withdrawn AND numerically ahead of every real release, so `oa update` on a
	326	+	`dev build thinks it is newer than stable — documented as deliberate in`
	327	+	`lib.rs`, worth a decision); seven docs pages still send readers to
	328	+	`@openagentsinc/cli`; the TypeScript CLI still ships `seed-identity.ts` and
	329	+	`identity-command.ts` after identity was removed from the Rust side.
144	330
145		-	`A ledger entry for the shape with four instances: M2 unknown cost, stale`
146		-	`identity, exit-0 refusal (#132), and blanket gate waivers. Common thread:`
147		-	`a value that looks more certain than it is, and *a waiver deletes the signal`
148		-	`that catches your own worst failure*. I promised the peer a draft after the`
149		-	`release lands. Do it then, not before — the point is that it survived landing.`
	331	+	`---`
150	332
151		-	`## Peer session`
	333	+	`# 12. Peer session`
152	334
153		-	`uds:/tmp/cc-socks/96662.sock` ("Empty dots investigation") owns #127–#132 and
154		-	`the coder bottom-row layout. Contract: they own the row, we own a`
155		-	26-column right-aligned balance slot (`BALANCE_COLUMNS = 26`). They ping
156		-	when the row lands so we pick `tui.rs` back up. They do not deploy.
	335	+	`uds:/tmp/cc-socks/96662.sock` ("Empty dots investigation") owns #127–#133 and
	336	+	`the coder bottom-row layout. Contract: **they own the row, we own a 26-column`
	337	+	right-aligned balance slot.** They ping when the row lands so we pick `tui.rs`
	338	+	`back up. They do not deploy — owner ruled "you dont deploy, other will`
	339	+	`deploy."`

Commit

docs(coder): consolidate both sessions' handoffs into one

Deploy story

Changed files

Diff

1		-	`# Handoff — 2026-08-26, coder autoimprovement + GLM + credits`
	1	+	`# Handoff — 2026-08-26`
2	2
3		-	`Written under a hard usage stop. Facts verified unless marked ASSUMED.`
	3	+	`Consolidated from two sessions writing under usage hard-stops: this one`
	4	+	`(coder autoimprovement, GLM catalog, credits, Gym, the deploy) and the peer`
	5	+	`session (coder tools, bottom row, lanes). Facts are verified unless marked`
	6	+	`GUESS.`
4	7
5		-	`## RIGHT NOW — a production deploy is in flight`
	8	+	`---`
6	9
7		-	A subagent is deploying `openagents.com` `c67cf39` to production, per
8		-	`docs/operations/production-deploy-runbook.md`. Owner approved it.
	10	+	`# 1. IN FLIGHT RIGHT NOW`
	11	+
	12	+	`## A production deploy is running`
	13	+
	14	+	A subagent is deploying `openagents.com` `c67cf39` to production per
	15	+	`docs/operations/production-deploy-runbook.md`. Owner approved it explicitly.
9	16
10	17		The one thing that matters: `c303a37` migrates
11	18		`users.credit_allowance_microusd` — adds nullable, **backfills every existing
12	19		row to `100_000_000`**, then `NOT NULL` default `20_000_000`.
13	20		`**If that backfill did not run, every existing user silently dropped from $100`
14	21		`to $20.** VERIFY IN PRODUCTION. Do not infer it from the migration exiting 0.`
15		-	Test that proves it both ways: `credit_allowance_backfill_test.exs`.
	22	+	The test that proves it both directions is `credit_allowance_backfill_test.exs`.
16	23
17	24		`If the fleet is half-rolled, that is the first thing to fix and to say.`
18	25
19		-	Post-deploy checks owed: site serves the new revision; `install.sh` **served
20		-	`bytes** actually offer three names (it has been serving "installs 'oa' only"`
21		-	all day); `GET /api/v1/credit` answers; the backfill.
	26	+	`Post-deploy checks owed:`
	27	+	`1. Site serves, and the running revision is the deployed SHA.`
	28	+	2. `https://openagents.com/install.sh` served bytes actually changed — it
	29	+	`has been serving "this installs 'oa' only" and pointing at the TypeScript`
	30	+	CLI all day. `c5c3173` fixed it on main this morning. The owner asked for
	31	+	`this in unusually direct terms.`
	32	+	3. `GET /api/v1/credit` answers for an authenticated account.
	33	+	`4. The backfill.`
22	34
23		-	`## Release 0.0.4 — approved, NOT yet cut, gated`
	35	+	`## Two peer agents with unpushed work at risk`
24	36
25		-	`Owner: single-platform only, macOS aarch64. Seven-platform waits for 0.1.0.`
	37	+	Integration agent — landing four commits onto `openagents/main` in order.
	38	+	`All four exist and are good; if the agent died, cherry-pick in this order from`
	39	+	`those worktrees (they share the main repo's object store, so every SHA is`
	40	+	`reachable):`
26	41
27		-	```
	42	+	`\| issue \| commit \| worktree \|`
	43	+	`\| --- \| --- \| --- \|`
	44	+	\| #127 tools \| `3150c13a0d` \| `~/.claude/jobs/35ca4e13/tmp/wt127` \|
	45	+	\| #128 `/logout` \| `929959cb21` \| `…/wt128` \|
	46	+	\| #129 strings \| `1a94c8a357` \| `…/oa` \|
	47	+	\| #130 identity row \| `0472ac7468` \| `…/wt130` \|
	48	+
	49	+	The one real conflict: `7cbe78af4f` (landed) renders the credit balance
	50	+	straight into `status_area` at `tui.rs:376-381`. #130 restructured that row —
	51	+	`token counts out, identity in — and reserved columns for exactly that balance.`
	52	+	`Both are correct against their own base. Reconcile, drop neither.`
	53	+
	54	+	`BALANCE_COLUMNS = 26`, not 24. #130's commit says 24. Measured against
	55	+	the strings `credit.rs` actually formats: `credit: 3 unpriced calls` is exactly
	56	+	24 and `credit: 12 unpriced calls` is 25 — and the real benchmark run had 12
	57	+	`unpriced calls, so 24 truncates the case the field exists to report.`
	58	+
	59	+	#131 agent — lanes, worktree `…/wt131`, based on `0472ac7468`, NOT on main.
	60	+
	61	+	`---`
	62	+
	63	+	`# 2. Release 0.0.4 — approved, NOT cut, gated`
	64	+
	65	+	`Owner: single platform only, macOS aarch64. Seven-platform waits for 0.1.0.`
	66	+
	67	+	```sh
28	68		`ops/release-cli.sh --version 0.0.4 --targets "macos-aarch64" --publish --allow-partial`
29	69		```
	70	+
30	71		No `--channel stable`. `stable` stays at 0.0.2 — a single-platform build
31		-	`behind the channel hands every other platform a bare download failure.`
32		-
33		-	`Blocked on two things:`
34		-	`1. #258 GLM catalog (mine, agent still running, nothing pushed as of writing)`
35		-	`2. #131 lane rework (other session's) — the shipped binary defaults to`
36		-	`Lane::OxAlpha` which pins the id `ox-alpha`
37		-	(`crates/openagents-cli/src/runtime.rs:178` and `:213`). Once the catalog
38		-	`drops ox-alpha, every fresh session opens on an id the proxy refuses.`
39		-	Do not cut 0.0.4 until #131 lands. I had a one-line fix (`#[default]`
40		-	on `Auto`), tested green, and dropped it uncommitted — the owner ruled
41		-	`Auto` is removed entirely, so the enum belongs to #131.
42		-
43		-	`Before cutting: verify Flash resolves to a live id against the deployed`
44		-	`catalog. That check is ours, not theirs.`
45		-
46		-	`## Owner decisions today (all confirmed by the owner directly)`
47		-
48		-	- Catalog: `glm-5.3-flash` default, `gemini-3.7-flash` second. **No luna,
49		-	`no ox-alpha** in the selectable catalog.`
50		-	- Luna survives ONLY as the tail of `vercel_gateway_fallback_models`
51		-	(`config/config.exs:224`). Not selectable, still a backstop. Both statements
52		-	`are consistent: two different lists.`
53		-	`- ox-alpha is not deprecated, it graduated — it was the stealth name for`
54		-	`GLM 5.3 Flash, which shipped publicly 2026-08-26.`
55		-	- Vercel primary, OpenRouter fallback. Box lane (`box.ex:456`) uses OpenRouter
56		-	`directly and is a deliberate temporary exception.`
57		-	`- Lanes: Flash (default) and Free only. No Auto, no Pro — "for first`
58		-	`versions", so do not reuse those names for something else.`
59		-	`- Credits: $20 for new accounts, existing accounts stay at $100.`
60		-	`One GitHub identity = one credit.`
61		-
62		-	`## Model ids — the hyphen differs per gateway. Do not guess.`
63		-
64		-	`\| Gateway \| id \|`
65		-	`\| --- \| --- \|`
66		-	\| Vercel AI Gateway \| `zai/glm-5.3-flash` \|
67		-	\| OpenRouter \| `z-ai/glm-5.3-flash` \|
	72	+	`behind the channel hands every other platform a bare download failure, and the`
	73	+	script refuses that without `--allow-partial` for exactly this reason.
	74	+
	75	+	Gated on #131. The shipped binary defaults to `Lane::OxAlpha`, which
	76	+	pins the id `ox-alpha` (`crates/openagents-cli/src/runtime.rs:178` and
	77	+	`:213`). The catalog change has now landed, so a fresh session on the current
	78	+	`binary opens on an id the proxy refuses. Do not cut 0.0.4 until #131 lands.`
	79	+
	80	+	I had a one-line fix (`#[default]` on `Auto`), tested green, and **dropped it
	81	+	uncommitted** — the owner then ruled `Auto` is removed entirely, so the enum
	82	+	`belongs to #131.`
	83	+
	84	+	`Before cutting: verify Flash resolves to a live id against the deployed`
	85	+	`catalog. That check is ours, not the peer's.`
68	86
69		-	`OpenRouter pricing $0.075/$0.25 per 1M is a **50% discount expiring`
70		-	2026-09-09**; list is $0.15/$0.50. Keep `source: :placeholder` — an operator
71		-	`declares rates, and those numbers are wrong in two weeks.`
	87	+	`---`
72	88
73		-	`## Landed today`
	89	+	`# 3. Owner decisions today (all confirmed directly)`
	90	+
	91	+	- Catalog: `glm-5.3-flash` default, `gemini-3.7-flash` second. No luna,
	92	+	`no ox-alpha in the selectable catalog.`
	93	+	- Luna survives only as the tail of `vercel_gateway_fallback_models`. Not
	94	+	`selectable, still a backstop. Both owner statements are consistent — two`
	95	+	`different lists.`
	96	+	`- ox-alpha is not deprecated, it graduated. It was the stealth name for`
	97	+	`GLM 5.3 Flash, which shipped publicly 2026-08-26. OpenRouter now returns`
	98	+	HTTP 404 for `stealth/ox-alpha` with a pointer to `z-ai/glm-5.3-flash`.
	99	+	- Vercel primary, OpenRouter fallback. The box lane (`box.ex:456`) talks to
	100	+	`OpenRouter directly and is a deliberate temporary exception.`
	101	+	`- Lanes: Flash (default) and Free only. No Auto, no Pro — "for first`
	102	+	`versions", so do not reuse those identifiers for anything else.`
	103	+	- Coder Flash = Vercel gateway, `glm-5.3-flash` primary, Gemini 3.7 Flash
	104	+	`fallback.`
	105	+	- Coder Free = OpenRouter, `thinkingmachines/inkling` primary,
	106	+	`openrouter/free` fallback.
	107	+	`- Shift+tab switches; the lane shows under the input bar, not at top.`
	108	+	`- Credits: $20 for new accounts, existing accounts stay at $100. One GitHub`
	109	+	`identity = one credit.`
	110	+	`- Release cadence: single-platform now, seven-platform at 0.1.0.`
	111	+
	112	+	`---`
	113	+
	114	+	`# 4. Model ids — the hyphen differs per gateway. Do not guess.`
	115	+
	116	+	`\| Gateway \| id \| Context \| Max output \|`
	117	+	`\| --- \| --- \| --- \| --- \|`
	118	+	\| Vercel AI Gateway \| `zai/glm-5.3-flash` \| 1,000,000 \| 131,000 \|
	119	+	\| OpenRouter \| `z-ai/glm-5.3-flash` \| 1,048,576 \| 131,072 \|
	120	+
	121	+	Both queried live from each gateway's `/models`, not guessed.
	122	+
	123	+	`Credit boundary, settled by Vercel's own routing metadata:`
	124	+	`"resolvedProvider":"zai"`, `"credentialType":"byok"`, `"cost":"0"` — the
	125	+	`Vercel lane spends BYOK z.ai credentials held at Vercel, and Vercel charges`
	126	+	`nothing to route. Same shape as the Gemini/Vertex entry.`
	127	+
	128	+	`Balances as of landing — the real constraint:`
	129	+	`- z.ai via Vercel: $9.66 left (used $82.80). This is now the default lane`
	130	+	`for every caller who names no model.`
	131	+	`- OpenRouter: ~$19.80 left. This is what the box/OpenCode lane spends.`
	132	+
	133	+	Pricing is `:placeholder` at list price ($0.15/$0.50 per 1M), deliberately
	134	+	`not the 50% offer expiring 2026-09-09 — a cost figure that silently doubles in`
	135	+	`two weeks is worse than one that is honestly high.`
	136	+
	137	+	`---`
	138	+
	139	+	`# 5. What landed today`
	140	+
	141	+	## `openagents` monorepo
74	142
75	143		`\| Commit \| What \|`
76	144		`\| --- \| --- \|`
77	145		\| `4f48460657` \| autoimprove plan + runbook + best-practices ledger \|
78		-	\| `f3bad5277b` \| DSPy/GEPA analysis (tier boundary: upstream Python offline, native online) \|
	146	+	\| `f3bad5277b` \| DSPy/GEPA analysis — tier boundary: upstream Python offline, native online \|
79	147		\| `db6beb9781` \| Claude Code teardown series + index \|
80	148		\| `846597cd81` \| Corrected P3 (was factually wrong) + added K1 \|
81	149		\| `7325bb8467` / `a3c8197d4e` \| #116 PTY harness, 8 tests, red-then-green proven. CLOSED \|
82	150		\| `3a3f31e8af` \| #117 TUI inventory, 79 rows \|
83	151		\| `163af256c8` \| #126 item 1, dead seed-identity symbols \|
84		-	\| `33f315fdaf` \| first proxy baseline, tb2-quick 2/2 \|
85		-	\| `8909d2eb52` \| tb2-cross-section 9/12, 75%, full coverage \|
	152	+	\| `33f315fdaf` \| first proxy baseline, `tb2-quick` 2/2 \|
	153	+	\| `8909d2eb52` \| `tb2-cross-section` 9/12, 75%, full 12/12 coverage \|
86	154		\| `cf63540b5a` / `e753d0b60f` \| #122 staged text surfaces + `check:coder-surfaces` guard \|
87	155		\| `0c3b7992c8` \| #121 review command \|
88		-	\| `c303a37` / `7cbe78af4f` \| #259 credits, both halves. CLOSED \|
89		-
90		-	`main` (openagents) at `7cbe78af4f` — verified 0 typecheck errors, no
91		-	`dangling INVARIANTS paths.`
92		-
93		-	`## Open issues`
94		-
95		-	`openagents`: #117 (port half), #118, #119, #120, #123, #124, #125, #126,
96		-	`#127–#132 (other session's).`
97		-	`openagents.com`: #258 GLM, #259 closed.
98		-
99		-	`#125 is now a prerequisite, not hygiene. A fully-covered 12/12 run at 75%`
100		-	`cannot exit 0 because cost is unmeasurable on an unpriced lane. GLM lands`
101		-	`:placeholder`-priced and `acceptPlaceholderRates` is deliberately absent, so
102		-	`the new default lane inherits exit-2 on its first run. Resolve #125 BEFORE`
103		-	`the GLM baseline or it proves nothing. Option 3 (price the model) conflicts`
104		-	with `acceptPlaceholderRates` by design; options 1 and 2 do not.
105		-
106		-	`## Traps that cost real time today`
107		-
108		-	- Git credential helper: `~/.openagents/bin` is FIRST in PATH and the
109		-	0.0.2 release put `coder-lite` there as `openagents`, shadowing the Node CLI
110		-	v0.4.0 that implements `auth git-credential`. The Rust binary **refuses
111		-	`--api-url` and exits 0**, so git reads "no credential" and fails with
112		-	`unable to get password from user`. I repointed both repos' local helpers at
113		-	`the Node CLI's absolute path. Root cause is #132.`
114		-	`~/.openagents/bin/openagents` was deleted in the process — the owner's
115		-	`three-name install is currently two names.`
	156	+	\| `7cbe78af4f` \| #259 credits, CLI half \|
	157	+	\| `34bb86f898` \| ATIF export named the withdrawn `0.1.0` on every trace; fixed \|
	158	+	\| `0e5afb85fe` \| this handoff \|
	159	+
	160	+	`main` verified at `7cbe78af4f`: 0 typecheck errors, no dangling
	161	+	`INVARIANTS.md` paths.
	162	+
	163	+	## `openagents.com`
	164	+
	165	+	`\| Commit \| What \|`
	166	+	`\| --- \| --- \|`
	167	+	\| `c303a37` \| #259 credits, server half. CLOSED \|
	168	+	\| `c5c3173` \| Install as `openagents`, `coder`, and `oa` \|
	169	+	\| `e347f25` \| Install page corrected \|
	170	+	\| `c67cf39` \| Device sign-in returns to the approval it came from \|
	171	+	\| `815a5b0` \| #258 GLM catalog. CLOSED \|
	172	+
	173	+	`GLM landing detail worth keeping: withdrawal is real, not hidden —`
	174	+	`Models.fetch/1` returns `:error`, so mint refuses and the proxy refuses
	175	+	`model_unavailable`, with a test asserting it. Verified end-to-end through the
	176	+	app's own adapter (`VercelGateway.stream/3`): 39 events, 23 reasoning deltas, a
	177	+	`real tool call, usage 188/46/234. Also carried a migration renaming`
	178	+	`account_chat_runs.backend` (history replays only into the backend that wrote
	179	+	it, so rows left as `ox-alpha` would have silently stopped replaying) and
	180	+	`deleted two dead config keys that mirrored the default model's rates — the`
	181	+	exact hidden coupling that breaks when a default moves. `mix precommit` green,
	182	+	`5097 passed.`
	183	+
	184	+	`---`
	185	+
	186	+	`# 6. Open issues`
	187	+
	188	+	`openagents`: #117 (port half), #118, #119, #120, #123, #124, #125, #126,
	189	+	`#127–#133 (peer's).`
	190	+	`openagents.com`: #258 and #259 both closed.
	191	+
	192	+	`## #125 is a prerequisite, not hygiene`
	193	+
	194	+	`A fully-covered 12/12 run at 75% success cannot exit 0, because cost is`
	195	+	unmeasurable on an unpriced lane. Gate `unverifiable`, exit 2 — confirmed by a
	196	+	`completed run, not by argument.`
	197	+
	198	+	**GLM landed `:placeholder`-priced and `acceptPlaceholderRates` is deliberately
	199	+	`absent, so the new default lane inherits exit-2 on its first run.** Resolve`
	200	+	`#125 before the GLM baseline or it proves nothing about its own cost floor.`
	201	+	Option 3 (price the model) conflicts with `acceptPlaceholderRates` by design;
	202	+	`options 1 and 2 do not.`
	203	+
	204	+	`## Not solved, flagged by the GLM agent`
	205	+
	206	+	`Luna is still spendable outside the catalog: five direct readers of`
	207	+	`:openai_model`, plus the whole SCV lane. Catalog-level Vercel→OpenRouter
	208	+	`failover was deliberately not built — the failure semantics are undefined in`
	209	+	`the existing code and that is a separate decision. Both catalog models now sit`
	210	+	`on one gateway: a single point of failure with no catalog-level backup, stated`
	211	+	`plainly in the config rather than papered over.`
	212	+
	213	+	`---`
	214	+
	215	+	`# 7. The constraint on #131`
	216	+
	217	+	If Flash cannot resolve its id, it must refuse loudly. Removing `Auto` did
	218	+	not remove the problem `Auto` avoided — it moved the whole load onto catalog
	219	+	`resolution. A Flash that silently falls back to a compiled-in id reintroduces`
	220	+	exactly the failure being deleted, and is harder to spot than `ox-alpha` was
	221	+	`because the label still looks right. Three cases:`
	222	+
	223	+	`1. primary not served → declared fallback, and **the row names the model that`
	224	+	`actually answered**, not "Flash"`
	225	+	`2. neither served / catalog unreachable → **refuse, naming what the deployment`
	226	+	does serve** (`unadmitted_model/1`, `lib/openagents/inference.ex:552`,
	227	+	interpolates `Models.ids()`)
	228	+	`3. never pin a constant`
	229	+
	230	+	`TIERS` (`runtime.rs:147`) is what caused this: two of its three entries named
	231	+	`ids that left the catalog today.`
	232	+
	233	+	Alias decision: `gemini`, `gemini-flash`, `gemini-3.7-flash`, `luna`,
	234	+	`gpt-5.6-luna`, `auto`, `pro` all stop being aliases and fall through to
	235	+	`Lane::Named(...)`. Otherwise `--lane gemini-3.7-flash` silently returns GLM.
	236	+	`Make the shift+tab cycle walk a lane list, not a hardcoded two-state`
	237	+	`toggle, so Pro returns as one entry.`
	238	+
	239	+	`The peer's four balance states must survive verbatim: nothing before first`
	240	+	read, `credit: unavailable`, `credit: N unpriced calls`, `credit: $X.YZ left`.
	241	+	`No caveated figure — a reader takes the digits and drops the qualifier.`
	242	+
	243	+	`---`
	244	+
	245	+	`# 8. Traps that cost real time today`
	246	+
	247	+	- Git credential helper. `~/.openagents/bin` is FIRST in PATH and the 0.0.2
	248	+	release put `coder-lite` there as `openagents`, shadowing the Node CLI v0.4.0
	249	+	that implements `auth git-credential`. The Rust binary **refuses `--api-url`
	250	+	and exits 0**, so git reads "no credential" and fails with `unable to get
	251	+	password from user`. Both repos' local helpers are repointed at the Node
	252	+	`CLI's absolute path. Root cause is #132.`
116	253		- `check:fast` aborts at its first failure. "These N things are red" is a
117	254		`snapshot of one guard, never an inventory. Every red list in every issue is`
118		-	`wrong by the next fix, including the one I wrote into #126. Re-measure.`
119		-	- Never grant a blanket `--no-verify` waiver. Doing so told an agent
120		-	`removing enum variants to ignore typecheck — the one signal that catches a`
121		-	`dangling reference to a removed variant.`
122		-	- Disk: hit 100% and killed every agent. Freed ~500 GB: 25 cargo `target/`
	255	+	`wrong by the next fix, including the one in #126. Re-measure.`
	256	+	- Never grant a blanket `--no-verify` waiver. It told an agent removing enum
	257	+	`variants to ignore typecheck — the one signal that catches a dangling`
	258	+	`reference to a removed variant.`
	259	+	- Never `cargo fmt` at crate scope — this machine's rustfmt reformats ~25
	260	+	`untouched files.`
	261	+	- **Verify pushes with `git merge-base --is-ancestor <sha> openagents/main`
	262	+	`after a fresh fetch**, never against push output.`
	263	+	- Don't `git checkout <file>` to undo a test append — it reverts every edit
	264	+	`in that file.`
	265	+	`- Tool descriptions and prompts are staged artifacts in`
	266	+	`surfaces/coder/*.v1.json`; regenerate with `pnpm run build:coder-surfaces`.
	267	+	`Never inline.`
	268	+	- Disk hit 100% and killed every agent. Freed ~500 GB: 25 cargo `target/`
123	269		dirs (194 GB) and Docker's 218 GB `Docker.raw`, which was also why Docker
124	270		would not start. `~/Library/Caches/Mozilla.sccache` is 60 GB and untouched
125	271		— safe to clear after a release; set `SCCACHE_CACHE_SIZE`.