devlog: work-phase records for the backlog disposition program

[lidge-jun]

Summary

Adds the work-phase records for the backlog disposition program opened in #2369. Docs only.

011 — work-phase 1. Four green PRs merged (#2309, #2339, #2335, #2313). #2359 held on a reproduced test failure rather than merged: excluding opencode-free/deepseek-v4-flash-free breaks tests/provider-live-models.test.ts:163, and a live probe shows the gateway still advertises the model. Evidence posted to that PR.

It also carries two corrections that were cheaper to write down than to leave implied:

• 001 was wrong about dev being unprotected. GET /branches/dev/protection returns 404, but that endpoint only reports classic branch protection. Four active rulesets exist; dev carries deletion, non_fast_forward, and pull_request rules. Every phase since lands through a PR with admin merge, which is better practice anyway since it closes PRs and credits authors.
• An incident. A git reset --hard origin/dev on the shared checkout dropped an unpushed devlog commit. Detected with git merge-base --is-ancestor, recovered by cherry-pick, nothing lost. Recorded rather than quietly fixed.

090 — work-phase 9, the four PRs that arrived while work-phase 0 was still running. #2361 merged; #2362, #2363, #2364 left open with blockers restated.

Two of those verdicts rest on falsification rather than reading the diff:

• feat(catalog): apply configured auto_review_model override during sync #2363: deleting the real call site in writeRetainedCatalogSync leaves its tests passing (2 pass, 0 fail). CI would stay green while catalog sync emits null again.
• feat(providers): add model-specific provider routing for Vercel AI Gateway #2364: the second commit deleted the management validation and safeConfigDTO wiring the first commit added — verified live, POST accepts a schema-invalid body and the DTO hides a valid setting.

It also records a CodeRabbit finding that was dismissed as wrong: moving Vercel's payload under providerOptions.gateway contradicts Vercel's documented top-level provider shorthand.

Verification

bun test tests/repo-hygiene.test.ts    11 pass / 0 fail
bun run privacy:scan                   Privacy scan passed

Full suite on the remote host at ae05672e3: 14290 pass / 16 skip / 0 fail across 898 files.

Checklist

• Docs-only; no runtime behavior affected
• privacy:scan green
• No security triage in devlog/ — public-diff-grounded PR analysis only
• Numbered lexicographic filenames

Summary by CodeRabbit

• Documentation
  • Added a disposition log covering several pending pull requests.
  • Recorded review evidence, merge or leave-open decisions, blockers, superseded work, and missing validation, documentation, or configuration updates.
  • Clarified why certain proposed changes remain open for further contributor action.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: d2a4ae85-0b6f-4acb-b57d-1235c5103a1a

📥 Commits

Reviewing files that changed from the base of the PR and between 99b8de7 and 556192a.

📒 Files selected for processing (1)

• devlog/_plan/260822_backlog_disposition_program/090_wp9_new_pr_disposition.md

---

📝 Walkthrough

Walkthrough

Adds a WP9 disposition log for PRs #2361–#2364. The log records one approval, three leave-open decisions, review evidence, blockers, superseded PRs, and missing validation, documentation, or configuration wiring.

Changes

WP9 PR disposition log

Layer / File(s)	Summary
Verdict overview and approved PR devlog/_plan/260822_backlog_disposition_program/090_wp9_new_pr_disposition.md	Lines 1–16 define the review scope and verdict table. Lines 17–37 record approval of #2361, verified behavior, accepted non-blocking findings, and supersession of #2357.
Rejected PR implementation findings devlog/_plan/260822_backlog_disposition_program/090_wp9_new_pr_disposition.md	Lines 38–88 record blockers for #2363 and #2364, including bypassed write-path tests, missing validation or documentation, and API/configuration corruption.
Configuration review and contributor follow-up devlog/_plan/260822_backlog_disposition_program/090_wp9_new_pr_disposition.md	Lines 89–122 record #2362 configuration gaps and explain why the three rejected PRs remain open.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: ingwannu

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/wp9-records

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}