docs(devlog): close out the admin-token unit with the preload guard fix

[lidge-jun]

Summary

Closes out the 260905_admin_token_local_ux devlog unit now that the Windows carry-forward it named has landed.

Records PR #3507 (663fdbb0a) against carry-forward item 1 of the baseline triage, and adds 031 for why that fix was worth doing independently of the 161 failures it removed:

Those 161 were the visible consequence. src/lib/windows-elevation.ts and src/service.ts refuse live elevation and machine-global Task Scheduler mutation only while the guard is armed. A worker that lost the guard did not merely fail loudly — it quietly gained the ability to do the things those refusals exist to prevent, and two suites took it. A run that had been slightly luckier with its SID lookup would have shown fewer failures and done the same writes.

031 also records what the plan audit changed. The original plan was arm-then-lock; the reviewer rejected it as incomplete, because arming before the lock while sandboxing after it still leaves a worker armed-but-unsandboxed — writes blocked, reads not. Shipped order is sandbox → arm + assert → lock.

Delivery record gains rows for #3504 and #3507. Items 2 and 3 (the multi-account auth store failures, 22 of the surviving 25, and the keep-native-v1 argv assertion) stay open with their real counts rather than being quietly dropped.

Verification

bun run privacy:scan — passed. Documentation only; nothing in the build, typecheck, or test path reads from devlog/. No pre-disclosure security material: every defect described is already public in a merged diff, which is the AGENTS.md test for what may live here.

Checklist

• Documentation only; no code paths touched
• No credential, token, or request-body values recorded
• Targets dev

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-04T19:43:14.359156Z	cb4b75f	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[coderabbitai]

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/admin-token-unit-closeout

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Ingwannu]

The recorded outcome is useful and the commit references are correct, but the PR currently declares this unit closed while leaving every file under devlog/_plan/260905_admin_token_local_ux/. Current AGENTS.md defines _plan as open units and _fin as closed units moved after a terminal outcome; the security-notes section also says a shipped-fix write-up belongs in _fin. Please move the complete unit directory to devlog/_fin/260905_admin_token_local_ux/ in this PR and update any live references that must follow it. The two remaining Windows observations can stay explicit carry-forward items or become separate open units, but they should not make this closed admin-token unit advertise two contradictory states.

[chatgpt-codex-connector]

💡 Codex Review

opencodex/tests/preload.ts

Line 28 in cb4b75f

const isolated = createIsolatedTestEnvironment();

Register sandbox cleanup before awaiting the lock

When lock acquisition throws—the Windows SID timeout this reorder explicitly targets—the await acquireTestRunLock(...) aborts module evaluation before the exit handler at the bottom is registered, leaving the newly created opencodex-test-* directory behind. Bun may continue executing tests after a preload error, so those tests can also populate the abandoned sandbox; register cleanup immediately after creating isolated, before any operation that can throw.

---

opencodex/devlog/_plan/260905_admin_token_local_ux/031_preload_guard_ordering.md

Lines 3 to 4 in cb4b75f

	Work-phase `wp5`. Closes carry-forward item 1 from `030`. Merged as PR #3507
	(`663fdbb0a`).

Move the closed unit out of _plan

This record says the work is merged, and the commit explicitly closes the unit, but all newly added records remain under devlog/_plan/260905_admin_token_local_ux. That namespace is reserved for open units, while closed units must be moved to _fin; either keep the unit explicitly open while the remaining carry-forward work is unresolved, or move the completed unit, including its existing assets, to _fin.

AGENTS.md reference: AGENTS.md:L83-L86

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".