docs: roadmaps still say mcpx is vendored in dezren39/nix — the vendored copy was deleted 2026-10-19 (nix#468/#469) #396

Problem

This repo's roadmaps still describe mcpx as vendored in dezren39/nix and "being removed", but that removal already landed on 2026-10-19. A reader following the roadmaps would think the single-source work has not happened and that nix still carries a second copy to port fixes into.

Evidence (verified 2026-10-20 on code main 92030f4b)

Stale present-tense claims in this repo:

• ROADMAP.md:38 — theme row: "mcpx is vendored in dezren39/nix and consumed by the OpenCode and OpenChamber forks"
• ROADMAP.md:45 — related-repos row: "dezren39/nix — The macOS flake. Vendors mcpx today and is moving to consume it from here."
• ROADMAP.md:12 — project focus: "Becoming the only copy of the code, and daemon restarts that do not leak sessions"
• planning/roadmaps/mcpx.md:5 — "The macOS flake in dezren39/nix carries a vendored copy that is being removed, and the OpenCode and OpenChamber forks consume the result."
• planning/roadmaps/mcpx.md Now row "One source for mcpx" (in-progress): "The copy in dezren39/nix is removed. This repo ports the useful differences and becomes the only place the code lives." — the removal/porting it describes is done; what remains open under that programme is narrower (see below).
• planning/roadmaps/mcpx.md Done table ends at 2026-10-18 and has no row for the single-source completion.

What is actually true now:

• GET /repos/dezren39/nix/contents/pkgs/mcpx returns 404 on nix main — the vendored copy is gone.
• dezren39/nix flake.nix:155-161,292-304 defines a source-only mcpx-src input pinned to this repo and builds mcpx from inputs.mcpx-src + "/pkgs/mcpx/package.nix", with the comment "the vendored one was deleted in lab-ops-hub container crawler accepts inet_aton IPv4 spellings (127.1, 2130706433, 0x7f.1) — loopback SSRF bypass in validate_crawl_url #468".
• That deletion was mcpx: delete the vendored pkgs/mcpx copy; build from a pinned developing-today/code flake input dezren39/darwin-nix#468, solved by nix PR fix(lab-ops-hub): judge inet_aton IPv4 spellings in the container crawl validator #469 (merged 2026-10-19); the pre-deletion port of the one nix-only test assertion was this repo's mcpx tests: port the spawn-marker assertion into TestEnsureDaemonCancelledWhileWaiting (nix copy has it, this copy doesn't) #361 / PR mcpx tests: assert the spawn happened in TestEnsureDaemonCancelledWhileWaiting #362. Nix's own ROADMAP.md already records it correctly (Done row "mcpx built from the code repo; vendored copy deleted", 2026-10-19, fix(lab-ops-hub): judge inet_aton IPv4 spellings in the container crawl validator #469).

What is still genuinely open (do not mark these closed):

• mcpx: decide how downstream flakes consume mcpx (sub-flake or the root flake) #308 — decide how downstream flakes consume mcpx (sub-flake or root flake)
• mcpx: re-home the open mcpx backlog from dezren39/nix, with this repo as the single source #309 — re-home the open mcpx backlog from dezren39/nix
• mcpx: takeover/upgrade/handoff unsupported on darwin; Linux-only tests break the darwin build #237 / mcpx: aarch64-darwin build verification still owed for the pinned mcpx-src input (from #469/#468) dezren39/darwin-nix#471 — darwin build verification for the pinned build

Acceptance criteria

• No present-tense claim in ROADMAP.md or planning/roadmaps/mcpx.md says mcpx is vendored in dezren39/nix, is being removed, or is "becoming" the only copy.
• The mcpx roadmap's Done table gains a row for the single-source completion (vendored copy deleted in nix, built from the pinned mcpx-src input; refs mcpx tests: port the spawn-marker assertion into TestEnsureDaemonCancelledWhileWaiting (nix copy has it, this copy doesn't) #361/mcpx tests: assert the spawn happened in TestEnsureDaemonCancelledWhileWaiting #362 here and mcpx: delete the vendored pkgs/mcpx copy; build from a pinned developing-today/code flake input dezren39/darwin-nix#468/fix(lab-ops-hub): judge inet_aton IPv4 spellings in the container crawl validator #469).
• The remaining Now work is stated as what is actually left: mcpx: decide how downstream flakes consume mcpx (sub-flake or the root flake) #308 (consumption decision), mcpx: re-home the open mcpx backlog from dezren39/nix, with this repo as the single source #309 (backlog re-homing), and darwin verification (mcpx: takeover/upgrade/handoff unsupported on darwin; Linux-only tests break the darwin build #237).
• Wording in ROADMAP.md:19 ("Make this repo the single source for mcpx…") is narrowed the same way, since this repo already is the single source.

Cross-repo check: opencode and openchamber carry no mcpx-vendored claim (git grep over *.md); dezren39/nix's own ROADMAP already states the deletion correctly. Single-repo docs fix.