create-walle 0.10.2 → 0.10.3

package/template/coding-task-manager/lib/broadcast-serialize.js

@@ -83,6 +83,11 @@ function serializeSessionListEnvelope(payload) {
     type: payload?.type,
     restoring: payload?.restoring,
     sessions: Array.isArray(payload?.sessions) ? payload.sessions : [],
+    // Box-owned sessions WP-5: the hub's "a registered box has not delivered its catalog yet" count
+    // rides the sessions frame (server.js _finishBroadcast adds it only when a machine is enabled).
+    // Carry it when present so the off-main path matches the sliced on-main one byte for byte;
+    // a zero-machine envelope stays the exact three-key object it has always been.
+    ...(payload && payload.machinesPending !== undefined ? { machinesPending: payload.machinesPending } : {}),
   });
 }
 

package/template/coding-task-manager/lib/build-info.js

@@ -80,10 +80,12 @@ function resetBuildInfoCache() {
 // and process-wide memoization make it a poor fit for "resolve once, fail closed to 'unknown'".
 // Wrapped so ANY failure (no git binary, cwd outside a repo, detached HEAD, timeout, ...) yields
 // 'unknown' rather than throwing — this must never block or delay boot.
-function resolveBootBuildSha(repoRoot, execFileSyncImpl) {
+// `full: true` returns the 40-hex commit: fleet status compares the RUNNING commit against a full
+// target sha (lib/fleet-hub.js), so an abbreviation there reads as "never restarted onto it".
+function resolveBootBuildSha(repoRoot, execFileSyncImpl, { full = false } = {}) {
   try {
     const run = typeof execFileSyncImpl === 'function' ? execFileSyncImpl : execFileSync;
-    const out = run('git', ['rev-parse', '--short', 'HEAD'], {
+    const out = run('git', full ? ['rev-parse', 'HEAD'] : ['rev-parse', '--short', 'HEAD'], {
       cwd: repoRoot || path.resolve(__dirname, '..', '..'),
       encoding: 'utf8',
       stdio: ['ignore', 'pipe', 'ignore'],

package/template/coding-task-manager/lib/claude-model-truth.js

@@ -257,20 +257,28 @@ function createClaudeModelTruth({ now = Date.now } = {}) {
 const EMPTY_CLAUDE_TRUTH = Object.freeze({
   selected: null, resolved: null, context1m: false, lastTurn: null, effort: null,
   source: null, observedAtMs: 0, lastTurnAtMs: 0,
+  // WP-1/D-1: the newest REFUSED turn the transcript recorded, as { status, atMs, turnId, requestId },
+  // or null. It is carried for the lead-model switch's failure branch only -- it names no model, so no
+  // consumer of `resolved`/`selected`/`lastTurn`/`effort` may read it as one.
+  lastTurnFailure: null,
 });
 
 /**
- * Assemble the flat truth shape from the two transcript facts a Claude Code JSONL carries
+ * Assemble the flat truth shape from the transcript facts a Claude Code JSONL carries
  * (D-4): the identity record is the verbatim "set to" selection, assistant rows are what
  * actually served. An identity that names no served model ('opusplan') still sets `selected`
  * while `resolved` falls back to the last turn.
+ *
+ * WP-1 adds the third fact: `failure` ({ status, atMs, turnId, requestId } | null) is copied
+ * verbatim and changes nothing else about the shape.
  */
-function truthFromTranscriptFacts(identity, turn) {
+function truthFromTranscriptFacts(identity, turn, failure = null) {
   const truth = {
     ...EMPTY_CLAUDE_TRUTH,
     lastTurn: turn ? turn.model : null,
     lastTurnAtMs: turn ? (turn.observedAtMs || 0) : 0,
     effort: turn ? (turn.effort || null) : null,
+    lastTurnFailure: failure || null,
   };
   const identityNorm = identity ? normalizeClaudeModelId(identity.modelId) : null;
   if (identity) truth.selected = identity.modelId;
@@ -302,6 +310,9 @@ function viewToTruth(view, fallback = EMPTY_CLAUDE_TRUTH) {
     source: resolved ? resolved.source : fallback.source,
     observedAtMs: resolved ? resolved.observedAtMs : fallback.observedAtMs,
     lastTurnAtMs: lastTurn ? lastTurn.observedAtMs : fallback.lastTurnAtMs,
+    // WP-1: the failure provenance is not ledger evidence (the ledger has no slot for it), so it
+    // passes straight through from the transcript facts that produced this view.
+    lastTurnFailure: fallback.lastTurnFailure || null,
   };
 }
 

package/template/coding-task-manager/lib/claude-transcript-terminal-renderer.js

@@ -51,10 +51,13 @@ const {
 const { _jsonlContentText } = require('./jsonl-conversation-parser');
 const {
   COMMAND_ENVELOPE_RE, LOCAL_COMMAND_STDOUT_RE, PEER_RELAY_PREFIX_RE, UNKNOWN_TAG_RE,
-  SYSTEM_REMINDER_RE, PASTED_CONTENT_RE, IDE_SELECTION_RE,
+  SYSTEM_REMINDER_RE, IDE_SELECTION_RE,
   TASK_NOTIFICATION_RE, TASK_NOTIFICATION_SUMMARY_RE,
   BASH_INPUT_RE, BASH_STDOUT_RE, BASH_STDERR_RE,
 } = require('../../shared/conversation-provenance');
+// D-5: the ONE strict paste-wrapper recogniser (line-exact opener/closer pair, 4 lowercase
+// hex ids) lives in public/js/pasted-content.js. Nothing here re-derives it.
+const PastedContent = require('../public/js/pasted-content');
 // WP-1 (rule D-9): wrap/measure/pad through the ONE width authority that matches the xterm.js
 // pane this renders into, not a hand-written East-Asian-Width table -- `wrapToCells`/
 // `stringCellWidth`/`truncateToCells` no longer flow from the codex renderer into this one.
@@ -184,18 +187,19 @@ function _bashStdoutOnly(text) {
   return null;
 }
 
-// Corrected 2026-09-27 (WP-3 live capture, fix round 1): the real screen shows a
-// `<pasted_content>` block VERBATIM, inline with the rest of the message -- never the
-// "[Pasted text #n +N lines]" placeholder this used to invent (a real bracketed paste, sent
-// through the same input path a real keystroke takes and confirmed present in the JSONL, showed
-// as ordinary wrapped prompt lines: "❯ line one" / "  line two" / ... / "  summarize the pasted
-// text in one line", with no collapse marker anywhere). D-8 branch 6: strip the tags, keep the
-// inner text, dropping exactly one leading/trailing blank line the tag wrapping usually
-// introduces (same trim the old placeholder's line count used).
+// Corrected 2026-09-27 (WP-3 live capture, fix round 1): the real screen shows a pasted
+// block VERBATIM, inline with the rest of the message -- never the "[Pasted text #n +N lines]"
+// placeholder this used to invent (a real bracketed paste, sent through the same input path a
+// real keystroke takes and confirmed present in the JSONL, showed as ordinary wrapped prompt
+// lines: "❯ line one" / "  line two" / ... / "  summarize the pasted text in one line", with no
+// collapse marker anywhere). D-8 branch 6: strip the wrapper, keep the inner text.
+//
+// D-5 (WP-2): recognition is NOT re-derived here any more -- the strict rule (a line that is
+// exactly the opener with a 4-lowercase-hex id, matched by the same-id closer line) lives in
+// public/js/pasted-content.js; `PastedContent.unwrap` drops the wrapper and keeps the body
+// verbatim, so the escaped/unknown-tag handling below sees body text only.
 function _replacePastedContent(text) {
-  return String(text || '').replace(PASTED_CONTENT_RE, (whole, inner) => (
-    inner.replace(/^\n+/, '').replace(/\n+$/, '')
-  ));
+  return PastedContent.unwrap(text);
 }
 
 // D-10 (WP-3 live capture): a raw tool_use name is not always what the TUI displays -- see
@@ -557,7 +561,7 @@ function parseClaudeTranscript(records, opts = {}) {
       const bashStdoutOnly = _bashStdoutOnly(text);
       if (bashStdoutOnly) { flushTools(); turns.push({ kind: 'local_stdout', uuid: rec.uuid, ts: rec.timestamp, lines: bashStdoutOnly }); continue; }
 
-      // 6/7/9/10/11: strip <pasted_content> to a placeholder, drop <ide_selection> and
+      // 6/7/9/10/11: strip the paste wrapper, drop <ide_selection> and
       // <system-reminder> entirely, then fall back to a plain prompt; an unmatched leading
       // tag on what's left is recorded (never hidden) via stats.unknownEnvelopes.
       let working = _replacePastedContent(text);

package/template/coding-task-manager/lib/client-diag-handler.js

@@ -44,6 +44,15 @@ function resolveDiagClientId(ws) {
 // while still capping memory if a client rotates clientId to evade this.
 const MAX_DIAG_THROTTLE_KEYS = 512;
 
+// WP-0 (docs/box-session-client-diag-and-reader-jump-2026-11-01.html §5 R-1/R-2): a box-owned
+// "mirror" session has no entry in the hub's local `sessions` Map, so `getSession(id)` is null for
+// it and every client-diag frame from a hub viewer on that session was dropped before recording —
+// even though the hub is the observer that owns the browser and telemetry.db. Mirror ids now get a
+// per-id holder object (throttle state only — nothing but the terminal-authority branch reads local
+// session fields, and mirrors skip that branch) from this bounded map. FIFO eviction keeps a long-
+// lived hub process from pinning one holder per mirror it has ever seen.
+const MAX_MIRROR_DIAG_HOLDERS = 256;
+
 // Cap on the generic (unlisted-event) detail passthrough below. 32 rather than 24 because the
 // history-seam-crossing beacon carries up to 27 non-null keys (joinDup/joinBlk included), and a
 // 24-key cut silently dropped its trailing distPx/exitBy/provider fields.
@@ -68,6 +77,9 @@ function clientDiagHostSnapshot() {
 
 function createClientDiagHandler(deps = {}) {
   const getSession = deps.getSession || (() => null);
+  // WP-0 R-1: (id) => truthy for a box-owned mirror session id, else null. Default keeps every
+  // existing caller byte-identical (a mirror id stays dropped).
+  const getMirrorSession = typeof deps.getMirrorSession === 'function' ? deps.getMirrorSession : () => null;
   const isSubscribed = typeof deps.isSubscribed === 'function' ? deps.isSubscribed : () => false;
   const recordDiagnostic = deps.recordDiagnostic || (() => {});
   const recordAuthority = deps.recordAuthority || (() => {});
@@ -79,14 +91,59 @@ function createClientDiagHandler(deps = {}) {
   // A socket close is page-scoped rather than session-scoped, so it alone may use the bounded
   // global pseudo-session. Terminal/render recovery events must name a real session.
   let globalDiagSession = null;
+  // WP-0 (§6.4, D-8) review fix: a create-ready frame names a PENDING CREATE id, which is not
+  // necessarily a session this machine knows — outcome 'failed'/'expired' never became one, and
+  // on the hub a successfully created session is owned by the box, so getSession(msg.id) is
+  // empty here. It is therefore answered BEFORE the session gate (the client-ws-close-observed
+  // escape is the same idea) and needs its own bounded 1 s window, since the per-session
+  // throttle map below is unreachable for a session-less id.
+  const createReadyAtByKey = new Map();
+  // WP-0 R-1: per-mirror-id throttle holders, newest-last (Map insertion order), FIFO-evicted at
+  // MAX_MIRROR_DIAG_HOLDERS. Scoped per handler instance so one hub process's churn cannot affect
+  // another's (and so a test harness gets a fresh map).
+  const mirrorDiagHolders = new Map();
 
-  return function handleClientDiag(ws, msg) {
+  function handleClientDiag(ws, msg) {
     if (!msg || !msg.id) return;
     const event = String(msg.event || '');
+    if (event === 'create-ready') {
+      const at = now();
+      const throttleKey = `${event} ${resolveDiagClientId(ws)} ${msg.id}`;
+      const lastEventAt = Number(createReadyAtByKey.get(throttleKey)) || 0;
+      if (lastEventAt && at - lastEventAt < 1000) return;
+      createReadyAtByKey.delete(throttleKey);
+      createReadyAtByKey.set(throttleKey, at);
+      while (createReadyAtByKey.size > MAX_DIAG_THROTTLE_KEYS) {
+        createReadyAtByKey.delete(createReadyAtByKey.keys().next().value);
+      }
+      // Display only: the numbers come from the client's own clock, so they are coerced
+      // (non-finite → -1) and the strings cut before they reach the log.
+      const d = msg.details && typeof msg.details === 'object' ? msg.details : {};
+      const num = (value) => (Number.isFinite(Number(value)) ? Number(value) : -1);
+      const text = (value, max) => (typeof value === 'string' ? value.slice(0, max) : '');
+      console.log(
+        `[create-client] id=${text(msg.id, 160)} machine=${text(d.machine, 160)} outcome=${text(d.outcome, 40)} ` +
+        `clickToAcceptedMs=${num(d.clickToAcceptedMs)} clickToSettledMs=${num(d.clickToSettledMs)}`
+      );
+      return;
+    }
     let session = getSession(msg.id);
+    // WP-0 R-2: a mirror session skips only terminal-authority (recordAuthority reads LOCAL session
+    // fields and drives local wedge remediation); every other branch records as normal.
+    let isMirror = false;
     if (!session) {
       if (msg.id === 'global' && event === 'client-ws-close-observed') {
         session = globalDiagSession || (globalDiagSession = {});
+      } else if (getMirrorSession(msg.id)) {
+        isMirror = true;
+        session = mirrorDiagHolders.get(msg.id);
+        if (!session) {
+          session = {};
+          mirrorDiagHolders.set(msg.id, session);
+          while (mirrorDiagHolders.size > MAX_MIRROR_DIAG_HOLDERS) {
+            mirrorDiagHolders.delete(mirrorDiagHolders.keys().next().value);
+          }
+        }
       } else {
         return;
       }
@@ -109,6 +166,7 @@ function createClientDiagHandler(deps = {}) {
       session._clientDiagAtByEvent.delete(session._clientDiagAtByEvent.keys().next().value);
     }
     if (event === 'terminal-authority') {
+      if (isMirror) return;
       if (msg.details && typeof msg.details === 'object') {
         recordAuthority(ws, session, msg.id, msg.details);
       }
@@ -211,7 +269,11 @@ function createClientDiagHandler(deps = {}) {
       }
     }
     recordDiagnostic(msg.id, `client-${event}`, details);
-  };
+  }
+
+  // WP-0 AC-0e: test-only probe for the mirror holder bound. Production callers never read it.
+  handleClientDiag._mirrorHolderCount = () => mirrorDiagHolders.size;
+  return handleClientDiag;
 }
 
 module.exports = { createClientDiagHandler };

package/template/coding-task-manager/lib/codex-app-server-client.js

@@ -21,27 +21,25 @@
 // half of this claim so a stray production `require` here is caught.
 
 const { spawn } = require('child_process');
+const { spawnNdjsonTransport } = require('./acp/ndjson-stdio-transport');
 const bridge = require('./codex-approval-bridge');
 
 // A transport is { write(jsonString), onLine(cb), close() }. The default spawns codex;
-// tests inject a fake one to drive the client deterministically.
-function spawnCodexTransport({ cwd, env, spawnFn = spawn, command = 'codex', args = ['app-server'] } = {}) {
-  const child = spawnFn(command, args, { stdio: ['pipe', 'pipe', 'pipe'], cwd, env });
-  let buf = '';
-  let lineCb = null;
-  child.stdout.on('data', (d) => {
-    buf += d.toString();
-    let i;
-    while ((i = buf.indexOf('\n')) >= 0) {
-      const line = buf.slice(0, i); buf = buf.slice(i + 1);
-      if (line.trim() && lineCb) lineCb(line);
-    }
+// tests inject a fake one to drive the client deterministically. The framing itself moved
+// to lib/acp/ndjson-stdio-transport.js (WP-1) so the ACP client shares one implementation.
+function spawnCodexTransport(o = {}) {
+  const t = spawnNdjsonTransport({
+    command: o.command || 'codex',
+    args: o.args || ['app-server'],
+    cwd: o.cwd,
+    env: o.env,
+    spawnFn: o.spawnFn || spawn,
   });
   return {
-    write: (s) => { try { child.stdin.write(s + '\n'); } catch (error) { void error; } },
-    onLine: (cb) => { lineCb = cb; },
-    close: () => { try { child.kill(); } catch (error) { void error; } },
-    _child: child,
+    write: t.write,
+    onLine: t.onLine,
+    close: () => t.kill(),
+    _child: t._child,
   };
 }
 

package/template/coding-task-manager/lib/codex-configuration-history.js

@@ -0,0 +1,55 @@
+'use strict';
+
+// D-7 (docs/codex-upgrades-without-version-approval-2026-10-28.html §configuration-followup): Codex
+// 0.165.0 persists a harness-authored reasoning-configuration control record in the rollout as
+// `response_item` / `configuration_update`. The tagged release source
+// (codex-rs/protocol/src/models/configuration_update.rs -> ConfigurationReasoning { effort },
+// codex-rs/core/src/client.rs:596-599,935-939 @ rust-v0.165.0) enables the update only for native
+// OpenAI targets that advertise it and REMOVES configuration updates from the outgoing request copy
+// for every other target, so the record is source history CTM classifies (and never rewrites) --
+// the selected effort is the source model's own setting and is never adopted as CTM's.
+//
+// This module is the ONE shape definition for that record. It is PURE: no file effects, no runtime
+// version check, no enum/version list. The scanner (lib/history-transition-read-op.js) uses it to
+// classify the record into its own history kind; the planner
+// (lib/harness-history-transition.js) decides where that kind may travel.
+const ENVELOPE_KEYS = new Set(['type', 'payload', 'timestamp', 'ordinal', 'metadata']);
+const PAYLOAD_KEYS = new Set(['type', 'reasoning']);
+const METADATA_KEYS = new Set(['client_authored', 'harness_authored_configuration']);
+
+function isRecord(value) {
+  return !!value && typeof value === 'object' && !Array.isArray(value);
+}
+
+// A record is a native configuration update only when every measured field is exact: the envelope
+// carries no unknown key, `type` is the `response_item` envelope, the payload holds exactly
+// `type`/`reasoning` with a nonblank effort STRING (never an enum or version list), and the payload
+// matches the native harness-authored marker the REQUIRED `harness_authored_configuration: true`
+// names. This is SHAPE validation, not cryptographic authentication: the marker only has to match
+// the value the native harness writes. Any other shape returns false so the caller's existing
+// refusal fires unchanged.
+function isNativeConfigurationUpdate(record) {
+  if (!isRecord(record)) return false;
+  if (Object.keys(record).some((key) => !ENVELOPE_KEYS.has(key))) return false;
+  if (record.type !== 'response_item') return false;
+  if (Object.hasOwn(record, 'timestamp') && typeof record.timestamp !== 'string') return false;
+  if (record.ordinal !== undefined && record.ordinal !== null
+      && (!Number.isSafeInteger(record.ordinal) || record.ordinal < 0)) return false;
+  if (!Object.hasOwn(record, 'metadata') || !isRecord(record.metadata)) return false;
+  const metadata = record.metadata;
+  if (Object.keys(metadata).some((key) => !METADATA_KEYS.has(key))) return false;
+  if (metadata.harness_authored_configuration !== true) return false;
+  if (Object.hasOwn(metadata, 'client_authored') && metadata.client_authored !== false) return false;
+  if (!isRecord(record.payload)) return false;
+  const payload = record.payload;
+  if (Object.keys(payload).length !== PAYLOAD_KEYS.size) return false;
+  if (Object.keys(payload).some((key) => !PAYLOAD_KEYS.has(key))) return false;
+  if (payload.type !== 'configuration_update') return false;
+  if (!isRecord(payload.reasoning)) return false;
+  const reasoningKeys = Object.keys(payload.reasoning);
+  if (reasoningKeys.length !== 1 || reasoningKeys[0] !== 'effort') return false;
+  const effort = payload.reasoning.effort;
+  return typeof effort === 'string' && effort.trim().length > 0;
+}
+
+module.exports = { isNativeConfigurationUpdate };

package/template/coding-task-manager/lib/codex-harness-qualification.js

@@ -1,25 +1,34 @@
 'use strict';
 
-// WP-0 of docs/codex-harness-version-qualification-2026-10-19.html (§5 D-1/D-4/D-5, §6).
+// HISTORICAL DIAGNOSTIC EVIDENCE, NOT ADMISSION (docs/codex-upgrades-without-version-approval-2026-10-28.html
+// §5 D-5). Originally WP-0 of docs/codex-harness-version-qualification-2026-10-19.html (§5 D-1/D-4/D-5, §6).
 //
-// The ONE table of Codex CLI versions a human qualified for CTM's Codex adapters. Every
-// runtime gate and every test fixture reads this module; `bin/codex-version-literal-lint.js`
-// fails any other `coding-task-manager/lib/**` file carrying a Codex version literal, so this
-// file is the only place a version string may be written by hand.
+// This table records what a human once MEASURED on a Codex CLI version. It has NO runtime
+// authority: nothing in CTM's launch, upgrade, planner, fork or history paths may read it to admit
+// or refuse a version, and a new Codex release does NOT need a row here before the user can install
+// it, switch to it or run it. `bin/codex-version-literal-lint.js` fails any other
+// `coding-task-manager/lib/**` file that pins a Codex version literal or references these
+// identifiers, so an approval gate cannot quietly grow back.
 //
-// Two contracts share this table, and they are NOT the same contract:
-//  - the catalog contract (what Codex reads from the catalog CTM writes) is measured per
-//    launch by the profile probe (WP-1) and is not gated by this table;
-//  - the history/native-fork contract (app-server shapes and rollout record shapes) cannot be
-//    probed per launch, so it is gated by exact membership here (D-4: an allowlist that is
-//    also a floor — nothing below the first row is ever qualified).
+// Two contracts this evidence used to stand in for are now checked where they actually operate:
+//  - the catalog contract (what Codex reads from the catalog CTM writes) is measured per launch by
+//    the profile probe and fails on the concrete mismatch;
+//  - the history/native-fork contract (app-server shapes and rollout record shapes) is checked by
+//    the record scanner against the records themselves, which is the failure the 2026-10-20
+//    incident showed membership could not predict.
+//
+// The rows are retained for `bin/qualify-codex.js` (optional evidence) and for its regression
+// tests. Membership semantics are frozen history: rows are never edited, and no release is required
+// to add one.
 
-// Leaf import on purpose: agent-version-service reads this table for its status row (WP-2), so
-// requiring it here would be a two-file cycle; both read the compare from lib/semver-compare.js.
+// Leaf import on purpose: the diagnostic (bin/qualify-codex.js) and the lib modules that carry the
+// adapter/schema identity constants require this module, so an import back into any of them would be
+// a cycle; the version compare lives in the leaf lib/semver-compare.js that both read.
 const { compareSemver } = require('./semver-compare');
 
-// One row per Codex CLI version a human qualified with bin/qualify-codex.js output.
-// Keys are exact `codex --version` strings. Never edit a row's evidence by hand.
+// One row per Codex CLI version a human once measured with bin/qualify-codex.js output.
+// Keys are exact `codex --version` strings. Never edit a row's evidence by hand, and never treat
+// the absence of a row as a reason to refuse a version.
 const CODEX_QUALIFIED_VERSIONS = Object.freeze({
   '0.162.1': Object.freeze({
     qualifiedOn: '2026-10-14',
@@ -31,14 +40,26 @@ const CODEX_QUALIFIED_VERSIONS = Object.freeze({
     by: 'docs/codex-harness-version-qualification-2026-10-19.html §1c-§1d',
     evidence: 'catalog probe identical to 0.162.1 (38 keys, 1625 B); models-manager diff empty; app-server-protocol/v2 diff turn.rs +3; 21 rollouts, record types ⊆ 0.162.1 set, 0 encrypted_content on non-reasoning items',
   }),
+  '0.164.0': Object.freeze({
+    qualifiedOn: '2026-10-27',
+    by: 'docs/codex-0164-historical-tools-safe-handoff-2026-10-27.html §8 WP-3 (AC-3a/AC-3b)',
+    evidence: 'AC-3a brokered real Codex slow file 18/18: WP-4B authenticated CTM proxy target path /v1/responses, source declaration id absent upstream, inherited source prompt present, current top-level tools 10; AC-3b qualifier exit 0: catalog probe 37 entry keys/6 checked, 64 version-matched rollouts all complete with no schema failures, tagged rust-v0.163.0..rust-v0.164.0 diff resolved',
+  }),
 });
-// The highest qualified version, never a hardcoded literal (a new row moves it, D-1).
+// The newest measured row, derived rather than hardcoded. Diagnostic use only (see the header):
+// it is the comparison baseline bin/qualify-codex.js reports against, not an admission ceiling.
 const LATEST_QUALIFIED_CODEX_VERSION = Object.keys(CODEX_QUALIFIED_VERSIONS)
   .sort((a, b) => compareSemver(b, a))[0];
-// The floor is the FIRST row and is never lowered (D-4/P-3): versions below it are not qualified.
+// The FIRST row, never lowered: the oldest version a measurement exists for.
 const CODEX_QUALIFIED_FLOOR = '0.162.1';
 // Identity ids name CTM's own adapter behaviour, not the installed Codex (D-5); `q1` bumps only
 // when what CTM sends/reads changes. They carry no version, so a Codex upgrade cannot stale them.
+// The version floor for the native sub-agent deny prefix (codex-native-subagent-pick-enforcement
+// 2026-10-28 D-2b): `features.multi_agent_v2.disable_native_tools` exists from rust-v0.163.0
+// (codex-rs/features/src/feature_configs.rs) and not at rust-v0.162.1; an older Codex exits 1 at
+// config load (`data did not match any variant of untagged enum FeatureToml`). Below the qualified
+// floor is impossible, but 0.162.1 is qualified AND below this key, so the deny has its own floor.
+const CODEX_NATIVE_SUBAGENT_DENY_MIN_VERSION = '0.163.0';
 const CODEX_CONTROL_ADAPTER = 'codex-app-server-q1';
 const CODEX_COMPACTION_SCHEMA_RECEIPT = 'codex-model-info-comp-hash-nullable-q1';
 const CODEX_PRE_TURN_COMPACTION_SCHEMA = 'codex-pre-turn-compaction-q1';
@@ -54,13 +75,14 @@ function isNonElevatedCyberAccessProgram(value) {
   return NON_ELEVATED_CYBER_ACCESS_PROGRAMS.includes(value);
 }
 
-// Exact membership (D-4). Never a prefix/range match: '0.162.10' is not '0.162.1'.
+// Exact membership against the measured rows. Never a prefix/range match: '0.162.10' is not
+// '0.162.1'. A false result means "no measurement here", never "this version may not run".
 function isQualifiedCodexVersion(version) {
   return typeof version === 'string' && Object.hasOwn(CODEX_QUALIFIED_VERSIONS, version);
 }
 
-// The status-row shape (D-6): why a version may be missing from the table, and whether it is
-// ahead of the newest measured row (the updater defers exactly that case).
+// Diagnostic status shape: whether a version appears among the measured rows, and whether it is
+// newer than the newest one. No runtime path reads this to admit or defer a version.
 function codexQualification(version) {
   if (!version) return { state: 'unknown', latestQualified: LATEST_QUALIFIED_CODEX_VERSION };
   return {
@@ -71,6 +93,7 @@ function codexQualification(version) {
 }
 
 module.exports = {
+  CODEX_NATIVE_SUBAGENT_DENY_MIN_VERSION,
   CODEX_QUALIFIED_VERSIONS,
   LATEST_QUALIFIED_CODEX_VERSION,
   CODEX_QUALIFIED_FLOOR,