jay23606 · Oct 9, 2026 · Oct 9, 2026
diff --git a/DESIGN.md b/DESIGN.md
@@ -657,6 +657,7 @@ Run after phases 1 to 5 and again before every release, as its own change set.
 - **Latest exact-head release preview (2026-10-07, PR head `cb97167`).** Windows/Linux/macOS CI [#37704586926](https://github.com/jay23606/codev/actions/runs/37704586926) passed. Four-target app/CLI preview [#37704586918](https://github.com/jay23606/codev/actions/runs/37704586918) passed for Windows x64, Linux x64, macOS Apple silicon, and macOS Intel. The Windows packaged smoke passed after switching display-preference selection to visible pointer clicks; it also exercised a configured stdio MCP server, persisted an exact Ask-mode Deny without invoking the denied operation, retained Ask mode, then switched to Auto and completed a separate echo call. Linux and both macOS packaged interaction jobs passed. The earlier head `71aac09` failed the Windows preference smoke because `Wide · 960 px` remained at 800; this was the interaction issue the pointer change addressed. Public release publishing skipped because PR #1 remains open. This closes the automated exact-head build and package gate only; clean-machine installation, accessibility, direct native/manual macOS/Linux checks, a complete local Windows native smoke, and the remaining Q3 hardening checks remain open.
 - **Latest exact-head release preview (2026-10-08, feature head `b63afc9`).** Windows/Linux/macOS CI [#37733389074](https://github.com/jay23606/codev/actions/runs/37733389074) passed. Four-target app/CLI preview [#37733389104](https://github.com/jay23606/codev/actions/runs/37733389104) passed for Windows x64, Linux x64, macOS Apple silicon, and macOS Intel. Hosted Windows upgrade/UI/data-survival, Linux Xvfb, and both Mac window-server interactions passed. Public release publishing skipped because PR #1 remains open.
 - **Pinned-conversation reload assertion (2026-10-08, test-only head `51facbb`).** `Sidebar_conversation_sections_toggle_and_persist_expanded_state` now verifies the pinned conversation remains in the pinned collection with its title after the view model reloads. The complete Avalonia headless suite passed 64 tests with 12 opt-in live tests skipped; exact-head Windows/Linux/macOS CI [#37733869391](https://github.com/jay23606/codev/actions/runs/37733869391) and four-RID packaged preview [#37733869488](https://github.com/jay23606/codev/actions/runs/37733869488) passed. The local machine cannot run this .NET 10 project because only .NET 9 SDK is installed.
+- **Release 2 Auto fallback and sidebar-order checks (2026-10-09, merged head `be87c8c`).** PR #38 now explains when a damaged or unwritable saved permission store makes Auto fail closed to Ask; its cross-platform CI [#37889002924](https://github.com/jay23606/codev/actions/runs/37889002924) and four-RID package preview [#37889002909](https://github.com/jay23606/codev/actions/runs/37889002909) passed. PR #39 adds drag-reordering within Pinned and Recents and verifies order restoration after a view-model reload; its portable/Avalonia tests passed on Windows, Linux, and macOS [#37943255278](https://github.com/jay23606/codev/actions/runs/37943255278), and all four package targets passed [#37943255316](https://github.com/jay23606/codev/actions/runs/37943255316). The follow-up docs update brings `docs/release-notes.md` into sync with these merged changes. Post-merge Windows/Linux/macOS CI [#37944018045](https://github.com/jay23606/codev/actions/runs/37944018045) passed. Local .NET 10 validation is unavailable on this checkout.
 - **Local packaged Windows UI rerun (2026-10-08, artifact from feature head `b63afc9`).** Ran the exact preview ZIP with an isolated temporary data root and loopback Ollama/MCP fixtures. Auto file change, screenshot-matched command plus exact Deny, MCP Ask denial, stdio and Streamable HTTP calls, display/font persistence, search, and profile editing passed before the sidebar pin check. In two uninstrumented runs `IsPinned` remained false. A probe showed the screen point resolves to the `☆  Pin` UIA menu item, and `WindowFromPoint` plus the foreground check both resolve to windows owned by the Codev process; one instrumented copy passed once, while added settle/activation delays did not produce a reliable pass. Hosted Windows pin persistence passed in the same preview, and a new headless regression confirms the pin command persists across reload. The ordinary repository smoke script was left unchanged. Keep the local UIA click discrepancy open until a manual interaction or a reliable test explains it; this is not yet evidence of a confirmed product defect.
 - **Targeted MCP transport/configuration review (2026-10-07; initial source head `2fbb8e5`, current-source rerun on this checkout).** Reviewed the current configuration and execution boundaries for HTTP and stdio MCP servers: secret values are environment-backed rather than stored in settings; remote HTTP requires TLS and redirects are disabled to prevent forwarding configured headers; HTTP/SSE bodies and stdio frames have byte limits; stdio child processes use an explicit environment and are terminated as a process tree; MCP outputs enter the model through untrusted-result envelopes. The OAuth callback binds loopback and checks the redirect URI; protocol state validation remains delegated to the MCP SDK. No concrete defect was found in this focused pass. On this checkout, `dotnet test Codev.Tests/Codev.Tests.csproj -c Release --no-restore --filter 'FullyQualifiedName~Mcp'` passed 90 tests with one opt-in live-model test skipped, and `dotnet test Codev.Avalonia.Tests/Codev.Avalonia.Tests.csproj -c Release --no-restore --filter 'FullyQualifiedName~Mcp_'` passed 5 UI approval tests. Core integration coverage exercises legacy SSE fallback/tool invocation, HTTP OAuth success and issuer/state rejection, token refresh, and secret-header redirect handling. The in-memory MCP executor regression also confirms exact saved Deny blocks prompt retrieval as well as tool and resource calls in Auto, before the server prompt handler runs. This is scoped source review plus regression evidence, not the independent full security review; packaged HTTP/SSE UI scenarios, Ask-mode prompt/resource UI denial, hostile external server behavior, and broader external-side-effect review remain open.
 - **Targeted trusted-path and file-change review (2026-10-07, PR source head `c871125`).** Traced the trust registry, bounded project file reads, file proposal apply/restore, and race-resistant filesystem operations. Reads use no-follow handles and reject multi-link files; writes and deletes are relative to verified directory handles; review-time hashes refuse stale replacements. The focused `WorkspaceFileServiceTests` and `ProjectFolderTrustRegistryTests` passed 58/58, and `CodeTaskToolExecutorTests` plus `ConversationFileChangeHistoryServiceTests` passed 50/50 on Windows with .NET 10. These tests include link-swap/race and stale-change cases. No concrete gap was found in this scoped pass. It does not constrain arbitrary shell commands, which retain the user's account permissions, or complete the broader independent security review.

diff --git a/docs/release-notes.md b/docs/release-notes.md
@@ -26,6 +26,7 @@ On Windows, extract the complete ZIP and run `Codev.Avalonia.exe`. On macOS or L
 - MCP settings are easier to recover when the saved file is malformed, oversized, duplicated, or blocked by a directory at the settings path. MCP tool, prompt, resource, and resource-template activity is grouped into readable, expandable transcript details.
 - Linux accessibility support is improved through Avalonia 12 and an AT-SPI tree. The sidebar search has an associated accessible label, and the Markdown renderer has been updated.
 - Regression coverage now exercises Auto-mode file application and command execution, MCP activity, and scoped profile behavior across hosted Windows, Linux, and macOS checks.
+- Auto falls back to Ask when saved project permission data cannot be read or safely written, and the review explains why. Conversations can be dragged to reorder within Pinned or Recents, with order remembered after restart.
 
 ## Included capabilities
 

diff --git a/docs/release-plan-2026-10.md b/docs/release-plan-2026-10.md
@@ -44,6 +44,8 @@ Target Release 2 for **Tuesday, October 13, 2026** (Day 5 after the October 8 pu
 
 The latest full four-platform candidate validation (`e729b85`, checked October 9) includes the post-Release 1 accessibility, MCP-recovery/activity, and OpenCode V2 scoped-profile changes. Exact-head Windows/Linux/macOS CI [#37885220964](https://github.com/jay23606/codev/actions/runs/37885220964) and all four packaged previews [#37885221048](https://github.com/jay23606/codev/actions/runs/37885221048) passed. PR #35 then removed the duplicate four-platform package preview from regular pushes to `main`; its PR-head CI and four-RID previews passed [#37885851748](https://github.com/jay23606/codev/actions/runs/37885851748) [#37885851767](https://github.com/jay23606/codev/actions/runs/37885851767), and the merge commit `4208ac1` passed Windows CI [#37886270841](https://github.com/jay23606/codev/actions/runs/37886270841). The prior main CI run had one intermittent Linux headless review-test failure; the targeted rerun passed before the test was made layout-synchronous in PR #34. Treat the merged changes as the accumulated Release 2 scope; from this point, focus on stabilization rather than adding more features. [`docs/release-notes.md`](release-notes.md) describes the merged changes and retains the outstanding native accessibility and clean-install limitations. Recheck it against the exact release commit before tagging.
 
+**Post-Release-1 Auto and sidebar fixes (2026-10-09).** PR #38 explains in the command-review UI when unreadable saved permission data forces a fail-closed Ask fallback; its Windows/Linux/macOS CI [#37889002924](https://github.com/jay23606/codev/actions/runs/37889002924) and four-RID package preview [#37889002909](https://github.com/jay23606/codev/actions/runs/37889002909) passed. PR #39 adds persisted drag-reordering within Pinned and Recents; its Windows/Linux/macOS CI [#37943255278](https://github.com/jay23606/codev/actions/runs/37943255278) and four-RID preview [#37943255316](https://github.com/jay23606/codev/actions/runs/37943255316) passed. Both PRs are merged into `main` at `be87c8c`, and post-merge Windows/Linux/macOS CI [#37944018045](https://github.com/jay23606/codev/actions/runs/37944018045) passed. These changes are now included in the Release 2 draft notes. The sidebar change was a user-requested exception to the feature freeze; resume stabilization-only scope after this documentation update.
+
 If testing finds a data-loss, unauthorized-action, startup-crash, or false-success defect, delay Release 2 until it is fixed and verified. If no release-blocking issue appears, publish the tested follow-up tag on schedule and carry remaining non-blocking Q3 limitations forward with clear notes.
 
 ## Release sequence