Retire #509 (token-stack release review) with a dated record of its unique facts - #655

Scope

• Retire Token stack release review: upstream integration paths and pin sequencing (decision record) #509 unmerged after this dated record lands, preserving its six unique source-review fact groups and handing four unresolved leads to their existing holders. This is Claude session native-agent-stack-0c's custody decision, not a user decision.
• Base commit: 4ced2923063db6a6dcafa9f25af5ee05a4153c75, main at publication (AGENTS.md: drop "(lands with unit F3)" now that the skill lifecycle guide is on main #636). The branch was rebased onto it from 9b0b8d6d25f9e3fb8f71770500e774170423315e, the main at which the record's citations were read. The one intervening commit changed only an AGENTS.md wording and its manifests/evidence.json hash entry, so every path and line the record cites is unchanged.
• Lane: lane:foundation (the only label).
• Owned paths touched: docs/decisions/2026-10-03-retire-token-stack-release-review.md; manifests/evidence.json registers that record in the last commit. Both prescribed generators left their reports unchanged.
• The custody notice was created at 2026-10-03T08:22:05Z; its two-hour window ended at 10:22:05Z with no objection in the comments read. The final builder read at approximately 10:56 UTC found Token stack release review: upstream integration paths and pin sequencing (decision record) #509 still OPEN at f33dc2c90679e14b282291d63a11c25b73ff943a, zero reviews and the same three comments. The coordinator must re-read the comments and head immediately before merge and stop on an objection, ownership claim or moved head.
• SocratiCode 1.16.0: qualification receipt and dated decision update (the Linux pin stays 1.15.0) #523 and Qualify Codex 0.159.3 and align the SDK pair #580 are merged. Codex 0.159.3 -> 0.160.0 with the Python SDK pair: pins, qualification receipt, tests and checkpoint #626 remains OPEN at 75a2ada1eb4db08568b75c5457d2a0b61a949bbb; Currency wave W1: eight foundation pins to their latest clean upstream releases (mcporter held) #642 remains OPEN at 1b9d09273be764d1cb26993ed9b5138b16bd7ce6. W1 now holds mcporter at 0.14.1 after its 0.14.2 compatibility attempt and selects jcodemunch 1.108.327; headroom and RTK requalification run separately. Token stack winner: one full stack chosen on recorded evidence, provisional until Gate A (decision record) #508, head b7fcc219, has its own outcome.

SOTA sources

• #509's complete record at f33dc2c90679e14b282291d63a11c25b73ff943a, read in full, and its author handoff. The retirement preserves claims as dated source review, not new upstream test or host acceptance.
• Upstream tags read by Token stack release review: upstream integration paths and pin sequencing (decision record) #509 on 2026-09-29: rtk v0.50.0, context-mode v1.0.169, Serena v1.7.0 and c6fbd1c5932df2494ffa0020af5a9fbe80b82143, SocratiCode v1.16.0 (CHANGELOG.md and package scripts), QMD v2.8.3, headroom v0.39.1, and mcporter v0.14.1.
• The one fresh upstream read, 2026-10-03: gh release view v0.39.1 -R headroomlabs-ai/headroom, exit 0. The release notes explicitly say: "proxy: stop the 0.39.0 TPM limiter from refusing large-context requests forever". This corroborates the defect/fix without qualifying a new pin. Re-run in the review round on 2026-10-03, exit 0: the notes list that fix as the release's only entry, under "Bug Fixes".
• Main at 9b0b8d6d25f9e3fb8f71770500e774170423315e, with the record's exact source lines: tests/test_adoption_bootstrap_macos.py:259–266; adoption/pins-linux-x86_64.json and adoption/pins-macos-arm64.json (the five named component entries); evidence/artifacts/new-wsl-clean-install-selection-20261001/selection.json:237,267,318,442; docs/decisions/2026-10-01-definitive-sota-wsl-program.md:281–299; docs/token-efficiency-stack.json:2217,2984,2989; catalogs/foundation/new-wsl-architecture-20261001.json:704; recipes/README.md:109; adoption/templates/claude.settings.template.json:204; docs/decisions/2026-09-26-token-practice-f1-f9.md:60; docs/decisions/2026-09-26-codex-worker-lane.md:29; docs/decisions/2026-09-28-ecosystem-roadmap.md:334; docs/decisions/2026-09-25-workstation-sota-refresh.md:437–453 and :519–550; evidence/receipts/headroom-039-qualification-20260925.json; evidence/artifacts/layer-closure-assessment-20261001/foundation.json:1421.
• #523, merge be91e1f860a6cd4c07c9c56555dabc4309ad47cc; #580, merge 85543efe5abcddb7b7cddb14e8774e83b6758616; #626; and #642 W1 record at 1b9d09273be764d1cb26993ed9b5138b16bd7ce6.
• Record shape follows main's docs/decisions/2026-09-25-retire-vela-velanext.md; registration/generation follows docs/lanes.md:94–142 and scripts/host_receipts.py:710–727. No new implementation or component adoption is introduced.

Evidence-class table

The evidence class does not claim a new upstream suite, model run, live provider/GPU run, Mac qualification, installation or winner comparison. Required CI and the independent Opus and cross-family Codex reviews remain coordinator gates on the created PR head.

Local commands run

Commands executed through the RTK pass-through where full native output was retained:

$ gh release view v0.39.1 -R headroomlabs-ai/headroom
exit 0; proxy fix quote retained in the decision record

$ git show origin/main:manifests/evidence.json > manifests/evidence.json
exit 0; sandbox addendum's registry restoration

$ python3 -c 'import sys; from pathlib import Path; sys.path.insert(0, "scripts"); import host_receipts
for p in sys.argv[1:]: host_receipts.register_file(Path("."), p)' docs/decisions/2026-10-03-retire-token-stack-release-review.md
exit 0; no output

$ python3 scripts/component_matrix.py --write
exit 0; {"flip_rule_violations": 0, "rows": 32, "status": "written"}

$ python3 scripts/new_host_grand_list.py --write
exit 0; {"status": "written", "layers": 32, "winners": 66}

$ python3 scripts/validate.py
exit 0; {"components": 69, "hashed_files": 9421, "profiles": 4, "receipts": 187, "status": "passed"}
Integrity and scope checks only; no live provider or GPU execution.

$ python3 -m unittest tests.test_adoption_contract tests.test_adoption_docs_consistency
exit 0; Ran 52 tests in 15.049s; OK (skipped=1)

$ git grep -n retire-token-stack-release-review -- blueprints/convergence-practice catalogs
exit 1; no output, the required no-match result

$ git diff --name-only origin/main...HEAD
exit 0; empty during the builder run because git writes are forbidden

$ git diff origin/main...HEAD -- manifests/evidence.json
exit 0; empty during the builder run because git writes are forbidden

$ git status --short
exit 0; M manifests/evidence.json; ?? docs/decisions/2026-10-03-retire-token-stack-release-review.md

$ git diff origin/main -- manifests/evidence.json
exit 0; exactly one five-line files[] entry, no other changes

$ git diff --check origin/main
exit 0; no output

The one skip is ProfileTableTests.test_the_cell_check_rejects_wrong_and_missing_release_notes. A focused native verbose run (python3 -m unittest -v tests.test_adoption_docs_consistency.ProfileTableTests.test_the_cell_check_rejects_wrong_and_missing_release_notes, exit 0, one skip) reported: "no profile's coverage differs between the pinned release and HEAD". Its full returned output is retained separately.

The committed-history diff commands must be rerun after the coordinator's two commits. Required-check acceptance is exactly eight checks with the unique bucket pass, followed by independent Opus and read-only cross-family Codex review of the actual PR head. These gates were not run by the sandboxed builder, as its addendum requires.

Publication-time reruns on the rebased head ecd0db52b2f9e85f7e32257ecd93c1efad5c541d. Main moved to 4ced2923063db6a6dcafa9f25af5ee05a4153c75 after the builder run, so the hot-file sequence was run again on it. Each exit code was read directly, not through a pipe.

$ git checkout origin/main -- manifests/evidence.json
exit 0; main's registry restored before re-registering the record

$ python3 -c 'import sys; from pathlib import Path; sys.path.insert(0, "scripts"); import host_receipts
for p in sys.argv[1:]: host_receipts.register_file(Path("."), p)' docs/decisions/2026-10-03-retire-token-stack-release-review.md
exit 0; no output

$ python3 scripts/component_matrix.py --write
exit 0; {"flip_rule_violations": 0, "rows": 32, "status": "written"}

$ python3 scripts/new_host_grand_list.py --write
exit 0; {"status": "written", "layers": 32, "winners": 66}

$ python3 scripts/validate.py
exit 0; {"components": 69, "hashed_files": 9421, "profiles": 4, "receipts": 187, "status": "passed"}

$ python3 -B -m unittest tests.test_adoption_contract tests.test_adoption_docs_consistency
exit 0; Ran 52 tests; OK (skipped=1)

$ python3 -B -m unittest tests.test_osv_lockfile_coverage.LockfileInventoryTests.test_every_tracked_lockfile_and_manifest_is_listed tests.test_blind_checkout.RepositoryClassificationTests.test_every_blueprint_value_under_a_label_key_is_classified tests.test_workflow_security_coverage.NewWorkflowSecurityCoverageTests.test_all_published_workflows_are_listed_and_covered
exit 0; Ran 3 tests; OK (the three registry tests the pre-push hook runs)

$ git diff --name-only origin/main...HEAD
exit 0; docs/decisions/2026-10-03-retire-token-stack-release-review.md and manifests/evidence.json

$ git diff origin/main...HEAD -- manifests/evidence.json
exit 0; exactly one five-line files[] insertion, for the record

Both generators left their reports unchanged. Required-check output and the two reviews were still to come on that head; the Review round below covers the current head.

Review round

One independent Opus review of ecd0db52b2f9e85f7e32257ecd93c1efad5c541d returned "repair": one should-fix and seven minor findings. This round applied them in two new commits, in hot-file order:

• c047a5be8 changes only the record.
• 86c4d1b70e15888b638e618a3b59f57c88884f47 changes only manifests/evidence.json.

The push ecd0db52b..86c4d1b70 was a fast-forward, with no amend and no force-push. Main is still 4ced2923063db6a6dcafa9f25af5ee05a4153c75, so no rebase was needed.

Residuals for the coordinator:

• Required checks. On 86c4d1b7, rerun the contract's gh pr checks 655 --required command and require 8 required checks, buckets: pass. Treat a validate failure as a defect.
• Before merging. Immediately before the merge, re-read Token stack release review: upstream integration paths and pin sequencing (decision record) #509's comments and head. Stop on an objection, an ownership claim or a moved head.
• Cross-family review. Run and record the read-only cross-family codex exec review of 86c4d1b7.
• Currency wave W1: eight foundation pins to their latest clean upstream releases (mcporter held) #642 changes. If Currency wave W1: eight foundation pins to their latest clean upstream releases (mcporter held) #642 changes before this merges, re-cite its final state.
• Main moves. If main moves, rerun the hot-file sequence.

Review-round commands. Exit codes were read directly, never through a pipe. Every Python run had TMPDIR set to the session's test directory.

$ gh release view v0.39.1 -R headroomlabs-ai/headroom
exit 0; one "Bug Fixes" entry: "**proxy:** stop the 0.39.0 TPM limiter from refusing large-context requests forever" (#3806, 7968122)

$ git fetch origin
exit 0; origin/main still 4ced2923063db6a6dcafa9f25af5ee05a4153c75

$ git checkout origin/main -- manifests/evidence.json
exit 0

$ python3 -c 'import sys; from pathlib import Path; sys.path.insert(0, "scripts"); import host_receipts
for p in sys.argv[1:]: host_receipts.register_file(Path("."), p)' docs/decisions/2026-10-03-retire-token-stack-release-review.md
exit 0; no output

$ python3 scripts/component_matrix.py --write
exit 0; {"flip_rule_violations": 0, "rows": 32, "status": "written"}

$ python3 scripts/new_host_grand_list.py --write
exit 0; {"status": "written", "layers": 32, "winners": 66}

$ python3 scripts/validate.py
exit 0; {"components": 69, "hashed_files": 9421, "profiles": 4, "receipts": 187, "status": "passed"}
Integrity and scope checks only; no live provider or GPU execution.
(the same output before and after the registry commit)

$ python3 scripts/validate_convergence.py --all-recorded --root . --json
exit 0; top-level "valid": true over 26 records

$ git diff --check origin/main...HEAD
exit 0; no output

$ python3 -B -m unittest -v tests.test_osv_lockfile_coverage.LockfileInventoryTests.test_every_tracked_lockfile_and_manifest_is_listed tests.test_blind_checkout.RepositoryClassificationTests.test_every_blueprint_value_under_a_label_key_is_classified tests.test_workflow_security_coverage.NewWorkflowSecurityCoverageTests.test_all_published_workflows_are_listed_and_covered
exit 0; Ran 3 tests in 0.200s; OK

$ python3 -m unittest tests.test_adoption_contract tests.test_adoption_docs_consistency
exit 0; Ran 52 tests in 12.669s; OK (skipped=1)

$ git grep -n retire-token-stack-release-review -- blueprints/convergence-practice catalogs
exit 1; no output, the required no-match result

$ git status --short
exit 0; no output (clean after the registry commit)

$ git diff --name-only origin/main...HEAD
exit 0; docs/decisions/2026-10-03-retire-token-stack-release-review.md, manifests/evidence.json

$ git diff origin/main...HEAD -- manifests/evidence.json
exit 0; exactly one five-line files[] insertion: sha256 0be1428ff335868f64f2e46b823135d7a9ec3cdb7d9ade1e5c6ef9e7a123e596, 23109 bytes (equal to the committed blob)

$ git push origin HEAD:claude/retire-pr509-token-stack-release-review-20261003
exit 0; ecd0db52b..86c4d1b70, a fast-forward; the pre-push hook ran the three registry tests on 86c4d1b70: Ran 3 tests, OK

$ gh pr checks 655 --required --json name,bucket --jq '"\(length) required checks, buckets: \(map(.bucket) | unique | join(","))"'
exit 0 at 2026-10-03T12:33:59Z; 8 required checks, buckets: pass,pending

Neither generator changed its report.

Decision record

docs/decisions/2026-10-03-retire-token-stack-release-review.md records the evidence, alternatives, comparison that would overturn the custody decision, and four existing holders: the next workstation qualification/currency wave (Serena), separate headroom requalification (#642 W1), which must meet main's omission-count overturn condition (docs/decisions/2026-09-25-workstation-sota-refresh.md:549–550), the session on the other host (Mac QMD registration), and RTK requalification (#642 W1).

Host evidence

Not applicable: this PR adds or changes no evidence/hosts/ file and makes no platform_status change.

• python3 scripts/host_receipts.py validate passes for every new/changed receipt. (Not applicable.)
• Independent review is recorded (scripts/host_receipts.py review) or explicitly requested in this PR. (No host receipt; the contract's two PR reviews are requested separately.)
• No platform_status change is made from a host receipt alone; a platform status flip still needs the matrix rule in docs/component-evidence-matrix.md. (Not applicable.)

Checklist

• New/changed GitHub Actions are pinned to a full commit SHA with a version comment (no floating tags). No Actions changed.
• New/changed workflows declare top-level permissions: contents: read (or a narrower, explicitly justified addition). No workflows changed.
• No secrets are printed, logged or committed; no new required secret was added without a documented owner.
• No new paid hosting, subscription or billing surface was introduced.
• Peer-owned untracked files and worktrees were preserved (not deleted, moved or overwritten).

🤖 Generated with Claude Code