[Gaubee]

Summary

Lands B1 of the 15.0.0 line — the update --dry-run --json preview projection that
target-openspec-cli-15-line (PR #312, merged and released as 15.0.0) explicitly deferred as "a new
cross-layer projection (out of scope)". Change: openspec/changes/update-dry-run-plan-preview/.

Context: PR #315 was a duplicate full v15 line developed against a stale local main ref; after
discovering the merged/released 15.0.0 line, everything it already covers (window, registry,
fixtures, docs, standalone scope) was dropped and only the genuinely missing pieces were
re-based onto origin/main. PR #315 will be closed as superseded.

What this adds

• updateDryRun capability in deriveOpenSpecCliCapabilities (target-series gated).
• Typed UpdatePlan contract + gated updatePlan executor method: changes/notes/failures
  always present arrays; closed add|update|delete action and two-code note enums; no rename
  action (moves plan as delete+add pairs); per-tool failures are plan data beside exit 0; the
  failed-command envelope (empty plan keys + status[] code: 'update_error', exit 1) decodes
  through the same schema while exit/success carry the failure truth.
• agentIntegrations.updatePlanPreview read transport (through runPlanningRootRead +
  the gated executor; unavailable pre-argv on non-admitted sessions). The real
  updateStream/repairStream mutations are unchanged and never gated by the preview.
• Config Agents Update/Repair dialog preview: action chips, wrapped mono paths, notes by code,
  amber would-fail rows, failed-command alert; muted unavailability that never disables the real
  run; generation guard on the preview fetch.
• Real-binary positive fixture (official-cli-v15-update-plan-fixtures.test.ts): init →
  corrupt/delete managed files → plan shows update/add rows sorted, disk unwritten → settle →
  empty re-plan. UpdatePlan first-party source anchors in upstream-contract-regression.test.ts.
• Repairs in passing: the stale v9-era check-openspec-reference.mjs fake green gate → asserts
  the v1.15 line; the stale tsconfig.workflow-contract-tests.json lane entries (v14 names for
  files renamed in the 15.0.0 line) → actual v15 names, and the new fixture joins the lane.
• Changeset: minor ×4 (feature on top of 15.0.0). AGENTS.md gains the dated decision line landing B1.

Verification (this worktree)

Gate	Result
pnpm format:check	✅
typecheck (core, server, web, cli)	✅
core full suite	✅ 864 passed, 13 skipped
compat / workflow-contract lanes	✅ 10 + 78 (incl. 6 UpdatePlan contract tests, real-binary fixture in lane)
preview router lane	✅ 4/4 (argv/force, exit-0-with-failures, envelope, pre-argv refusal)
dialog browser lane	✅ 4/4; config-agents/cli-runner unit lanes ✅ 15/15
node scripts/check-openspec-reference.mjs	✅ OK: v1.15.0

CI will run via workflow_dispatch (the pull_request event currently does not fire on this repo —
observed on PR #315 and documented there).

[Gaubee]

CI round 1 triage: Fast Gate failed at src/opsx-kernel.test.ts > refreshes status for question-mark glob artifacts (waitFor 75s timeout) — a file this PR does not touch (git diff origin/main...HEAD contains no opsx-kernel paths). Local rerun of the full file passes 12/12. Same shape as the recorded tool-subscription-router flake (d445831, passed on zero-change rerun). Zero-change rerun dispatched (run 40880020086).