instar 1.3.811 → 1.3.813

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-07-11T02:35:23.065Z",
-  "instarVersion": "1.3.811",
+  "generatedAt": "2026-07-11T03:54:14.492Z",
+  "instarVersion": "1.3.813",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {
@@ -11,7 +11,7 @@
       "domain": "identity",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/session-start.sh",
-      "contentHash": "e2bc1b5eef5aa582ecae8f26c0c82e699a3b01fcc7883b297b57ad8f64230c8c",
+      "contentHash": "c56abb8d920e024e09f5d88beb426798c57ca6d55aa1221912977afa4ffdce18",
       "since": "2025-01-01"
     },
     "hook:dangerous-command-guard": {
@@ -20,7 +20,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/dangerous-command-guard.sh",
-      "contentHash": "e2bc1b5eef5aa582ecae8f26c0c82e699a3b01fcc7883b297b57ad8f64230c8c",
+      "contentHash": "c56abb8d920e024e09f5d88beb426798c57ca6d55aa1221912977afa4ffdce18",
       "since": "2025-01-01"
     },
     "hook:grounding-before-messaging": {
@@ -29,7 +29,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/grounding-before-messaging.sh",
-      "contentHash": "e2bc1b5eef5aa582ecae8f26c0c82e699a3b01fcc7883b297b57ad8f64230c8c",
+      "contentHash": "c56abb8d920e024e09f5d88beb426798c57ca6d55aa1221912977afa4ffdce18",
       "since": "2025-01-01"
     },
     "hook:compaction-recovery": {
@@ -38,7 +38,7 @@
       "domain": "identity",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/compaction-recovery.sh",
-      "contentHash": "e2bc1b5eef5aa582ecae8f26c0c82e699a3b01fcc7883b297b57ad8f64230c8c",
+      "contentHash": "c56abb8d920e024e09f5d88beb426798c57ca6d55aa1221912977afa4ffdce18",
       "since": "2025-01-01"
     },
     "hook:external-operation-gate": {
@@ -47,7 +47,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/external-operation-gate.js",
-      "contentHash": "e2bc1b5eef5aa582ecae8f26c0c82e699a3b01fcc7883b297b57ad8f64230c8c",
+      "contentHash": "c56abb8d920e024e09f5d88beb426798c57ca6d55aa1221912977afa4ffdce18",
       "since": "2025-01-01"
     },
     "hook:deferral-detector": {
@@ -56,7 +56,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/deferral-detector.js",
-      "contentHash": "e2bc1b5eef5aa582ecae8f26c0c82e699a3b01fcc7883b297b57ad8f64230c8c",
+      "contentHash": "c56abb8d920e024e09f5d88beb426798c57ca6d55aa1221912977afa4ffdce18",
       "since": "2025-01-01"
     },
     "hook:self-stop-guard": {
@@ -65,7 +65,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/self-stop-guard.js",
-      "contentHash": "e2bc1b5eef5aa582ecae8f26c0c82e699a3b01fcc7883b297b57ad8f64230c8c",
+      "contentHash": "c56abb8d920e024e09f5d88beb426798c57ca6d55aa1221912977afa4ffdce18",
       "since": "2025-01-01"
     },
     "hook:post-action-reflection": {
@@ -74,7 +74,7 @@
       "domain": "evolution",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/post-action-reflection.js",
-      "contentHash": "e2bc1b5eef5aa582ecae8f26c0c82e699a3b01fcc7883b297b57ad8f64230c8c",
+      "contentHash": "c56abb8d920e024e09f5d88beb426798c57ca6d55aa1221912977afa4ffdce18",
       "since": "2025-01-01"
     },
     "hook:external-communication-guard": {
@@ -83,7 +83,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/external-communication-guard.js",
-      "contentHash": "e2bc1b5eef5aa582ecae8f26c0c82e699a3b01fcc7883b297b57ad8f64230c8c",
+      "contentHash": "c56abb8d920e024e09f5d88beb426798c57ca6d55aa1221912977afa4ffdce18",
       "since": "2025-01-01"
     },
     "hook:scope-coherence-collector": {
@@ -92,7 +92,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/scope-coherence-collector.js",
-      "contentHash": "e2bc1b5eef5aa582ecae8f26c0c82e699a3b01fcc7883b297b57ad8f64230c8c",
+      "contentHash": "c56abb8d920e024e09f5d88beb426798c57ca6d55aa1221912977afa4ffdce18",
       "since": "2025-01-01"
     },
     "hook:scope-coherence-checkpoint": {
@@ -101,7 +101,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/scope-coherence-checkpoint.js",
-      "contentHash": "e2bc1b5eef5aa582ecae8f26c0c82e699a3b01fcc7883b297b57ad8f64230c8c",
+      "contentHash": "c56abb8d920e024e09f5d88beb426798c57ca6d55aa1221912977afa4ffdce18",
       "since": "2025-01-01"
     },
     "hook:free-text-guard": {
@@ -110,7 +110,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/free-text-guard.sh",
-      "contentHash": "e2bc1b5eef5aa582ecae8f26c0c82e699a3b01fcc7883b297b57ad8f64230c8c",
+      "contentHash": "c56abb8d920e024e09f5d88beb426798c57ca6d55aa1221912977afa4ffdce18",
       "since": "2025-01-01"
     },
     "hook:claim-intercept": {
@@ -119,7 +119,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/claim-intercept.js",
-      "contentHash": "e2bc1b5eef5aa582ecae8f26c0c82e699a3b01fcc7883b297b57ad8f64230c8c",
+      "contentHash": "c56abb8d920e024e09f5d88beb426798c57ca6d55aa1221912977afa4ffdce18",
       "since": "2025-01-01"
     },
     "hook:claim-intercept-response": {
@@ -128,7 +128,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/claim-intercept-response.js",
-      "contentHash": "e2bc1b5eef5aa582ecae8f26c0c82e699a3b01fcc7883b297b57ad8f64230c8c",
+      "contentHash": "c56abb8d920e024e09f5d88beb426798c57ca6d55aa1221912977afa4ffdce18",
       "since": "2025-01-01"
     },
     "hook:stop-gate-router": {
@@ -137,7 +137,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/stop-gate-router.js",
-      "contentHash": "e2bc1b5eef5aa582ecae8f26c0c82e699a3b01fcc7883b297b57ad8f64230c8c",
+      "contentHash": "c56abb8d920e024e09f5d88beb426798c57ca6d55aa1221912977afa4ffdce18",
       "since": "2025-01-01"
     },
     "hook:auto-approve-permissions": {
@@ -146,7 +146,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/auto-approve-permissions.js",
-      "contentHash": "e2bc1b5eef5aa582ecae8f26c0c82e699a3b01fcc7883b297b57ad8f64230c8c",
+      "contentHash": "c56abb8d920e024e09f5d88beb426798c57ca6d55aa1221912977afa4ffdce18",
       "since": "2025-01-01"
     },
     "job:health-check": {
@@ -1562,7 +1562,7 @@
       "type": "subsystem",
       "domain": "updates",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
-      "contentHash": "e2bc1b5eef5aa582ecae8f26c0c82e699a3b01fcc7883b297b57ad8f64230c8c",
+      "contentHash": "c56abb8d920e024e09f5d88beb426798c57ca6d55aa1221912977afa4ffdce18",
       "since": "2025-01-01"
     },
     "subsystem:scheduler": {

package/src/scaffold/templates.ts

@@ -863,6 +863,7 @@ I declare owner/blockedOn at commitment creation; a later state change goes thro
 - **Quota across ALL my machines** (pool-scope read) — \`GET /subscription-pool?scope=pool\` fans out to every ONLINE peer's plain pool, tags each account with the machine holding it (\`machineId\`/\`machineNickname\`/\`remote:true\`), and merges into ONE dark-peer-tolerant object \`{ enabled, accounts:[...], pool:{ selfMachineId, peersQueried, peersOk, failed }, scope:'pool' }\`. A down/slow/unauth peer is a classified \`pool.failed\` row (normalized reason — never a peer URL or token), never a silent omission and never a 500. Per-machine seat is meaningful, so the SAME account on two machines stays individually visible (never coalesced). Single-machine → the plain self-only view tagged \`scope:'pool'\`. Use this when the operator asks "how much quota is left across ALL my machines?".
 - **Continuity guarantee** — a long session that hits its account's quota resumes on another eligible account (conversation preserved via \`--resume\`), never dies. Manual lever: \`POST /subscription-pool/swap\` \`{"sessionName":"...","exhaustedAccountId":"..."}\`. Auto-swap on rate-limit ships OFF (opt-in via \`subscriptionPool.autoSwapOnRateLimit\` — it moves a live session, real authority).
 - **Codex quota is first-class in the pool:** Codex accounts read the real 5-hour + weekly windows from their latest rollout instead of appearing permanently empty. Placement and every reactive/proactive swap are framework-safe: a Codex session can use only Codex accounts, and a Claude session only Claude accounts.
+- **Solo Codex load shedding is fail-safe:** the global quota brake also consumes those rollout windows when no subscription pool is present. A walled account stops new jobs/sessions, a healthy account runs normally, and a missing, stale, unreadable, or incomplete Codex reading sheds rather than repeatedly spawning into an unknown wall. Claude keeps its existing OAuth-authoritative / JSONL-degraded behavior.
 - **Pre-limit (proactive) swap** — beyond the reactive swap above, I can move a session OFF an account BEFORE it walls, at a lag-aware measured threshold (default 80% — the polled reading trails real usage, so the swap completes with margin). It also covers the UNTAGGED interactive session (resolves its account from the default login), so the session you talk to doesn't wedge at the wall. Opt-in via \`subscriptionPool.proactiveSwap.enabled\` (same authority as auto-swap, earlier trigger). Status: \`GET /subscription-pool/proactive-swap\`; run a pass now: \`POST /subscription-pool/proactive-swap/check\`.
 - **Anti-thrash brakes + in-flight work protection on swaps** — the proactive swap carries brakes so it can never ping-pong sessions between hot accounts (the 2026-07-02 thrash day): when EVERY account is hot it STAYS PUT (\`all-hot\` refusal — one reactive rescue beats N pointless kills), a just-swapped session dwells ~45 min before it can be moved again (restart-safe via \`state/swap-ledger.jsonl\`), and a swap only executes onto a target that is MATERIALLY cooler on a fresh quota reading (never onto an unmeasured/stale account). A session mid-turn or carrying live subagents is never killed by an optimization — the swap DEFERS until the work lands (a forced/reactive kill carries a mitigation note enumerating interrupted subagents + re-injecting the last unanswered message). Brakes ship dry-run first (\`subscriptionPool.proactiveSwap.antiThrash.dryRun\`); the work gate's \`subscriptionPool.swapContinuity.enabled\` is restart-required (§7.1). "Why didn't my session swap?" → \`GET /subscription-pool/proactive-swap\` \`brakes\`/\`deferrals\` blocks name the refusal; "why did my refresh get a session-busy error?" → the work gate refused to kill in-flight work — wait, or re-issue with \`force:true\`.
 - **Enroll a new account from your phone** — \`POST /subscription-pool/enroll\` \`{"id","label","provider","framework","configHome"}\` starts a login and returns a public code/URL (never a token); \`GET /subscription-pool/pending-logins\` is the surface; expired codes are auto-reissued. Mark done with \`POST /subscription-pool/enroll/:id/complete\`.

package/upgrades/1.3.812.md

@@ -0,0 +1,23 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Internal Codex calls now recover automatically when OpenAI retires their selected model from the ChatGPT-account Codex surface.
+
+## What to Tell Your User
+
+A Codex model retirement no longer silently breaks classifications, gates, tone checks, and commitment checks fleet-wide. Instar retries that exact failure once on a known-good safe model while leaving every other error unchanged.
+
+## Summary of New Capabilities
+
+- Exact unsupported-model classification for the ChatGPT-account retirement response.
+- One bounded retry on the live-verified `gpt-5.4-mini` floor.
+- No fallback for rate limits, authentication failures, unrelated 400s, timeouts, or network failures.
+- Equivalent recovery in structured and legacy Codex execution modes.
+
+## Evidence
+
+Boundary unit tests cover retirement recovery, non-retry error classes, and bounded fallback failure. Structured exec-path coverage proves the real spawn path retries with the safe model and succeeds. Full lint, build, and three-tier tests gate release.

package/upgrades/1.3.813.md

@@ -0,0 +1,23 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Solo Codex agents now feed real rollout quota windows into the global job/session load-shed brake.
+
+## What to Tell Your User
+
+A solo Codex agent stops starting work when its five-hour or weekly account window is exhausted. Missing, stale, unreadable, or incomplete Codex quota data now pauses new work conservatively instead of failing open into an unknown wall.
+
+## Summary of New Capabilities
+
+- Authoritative `codex-rollout` quota state for the global brake.
+- Healthy Codex windows allow work; exhausted windows shed it.
+- Missing or invalid Codex readings persist explicit uncertainty and fail safe.
+- Existing Claude OAuth-authoritative and JSONL-degraded behavior remains unchanged.
+
+## Evidence
+
+Scoped unit coverage exercises both sides of the gate and every uncertainty boundary. Collector-to-manager integration proves persisted wall shedding and replacement of prior healthy headroom when the reader disappears. Full lint, build, and CI matrix gate release.

package/upgrades/eli16/codex-model-retirement-fallback.md

@@ -0,0 +1,21 @@
+# ELI16 — Codex model retirements self-heal
+
+## What Changed
+
+OpenAI can remove a model from the ChatGPT-account Codex surface without changing Instar. Previously, every small internal Codex judgment call using that model would begin failing until a person found the incident and manually changed the tier map. Instar now recognizes Codex's specific model-retirement response and retries that one call once with a live-verified safe model.
+
+## What to Tell Your User
+
+A retired Codex model should no longer take down classifications, gates, tone checks, or commitment checks across the fleet. The recovery is intentionally narrow: it does not swap models for rate limits, login problems, network failures, or unrelated bad requests, so those real problems remain visible instead of being hidden behind a retry.
+
+## Summary of New Capabilities
+
+- Classify Codex's exact ChatGPT-account “model not supported” response as an unsupported-model signal rather than generic authentication failure.
+- Retry once on `gpt-5.4-mini`, the designated live-verified safe floor and a member of Instar's known Codex model registry.
+- Preserve the original failure behavior for 429s, authentication errors, unrelated 400s, timeouts, and network failures.
+- Stop after the fallback attempt and surface its error if it also fails; there is no recursive or unbounded retry path.
+- Apply the same recovery to both the default structured exec path and the legacy plain-output kill-switch path.
+
+## Evidence
+
+Unit coverage proves both sides of the classification boundary, the exact two-model attempt sequence, fallback failure surfacing, and non-retry behavior for neighboring errors. Exec-path coverage drives the real structured spawn helper through retirement and recovery. Existing provider, event-normalizer, lint, build, and three-tier suites remain the release gates.

package/upgrades/eli16/codex-quota-load-shed.md

@@ -0,0 +1,21 @@
+# ELI16 — Solo Codex agents stop spawning into a quota wall
+
+## What Changed
+
+Instar’s global quota brake already protected Claude and Gemini work, and the subscription pool already understood Codex quota. But a Codex agent with only one account had no producer feeding those real Codex windows into the global brake. When that account was exhausted—or when its quota reading disappeared—the agent could keep starting work that could not succeed.
+
+## What to Tell Your User
+
+Solo Codex agents now read the same authoritative five-hour and weekly rollout windows already used by the subscription pool. Healthy headroom allows work normally. A full window stops new jobs and sessions. If the Codex reading is missing, stale, unreadable, or incomplete, the Codex brake fails safe and pauses new work instead of repeatedly spending attempts against an unknown wall.
+
+## Summary of New Capabilities
+
+- Start the existing quota collector for Codex agents instead of skipping every non-Claude framework.
+- Convert the existing rollout reader’s primary and secondary windows into the shared quota-state shape with `codex-rollout` provenance.
+- Treat Codex rollout data as authoritative at the same load-shed decision layer as provider-native capacity signals.
+- Persist explicit uncertainty when a previously healthy reading disappears, preventing stale headroom from silently keeping the gate open.
+- Preserve Claude semantics: OAuth remains authoritative, JSONL remains bounded-degraded, and missing Claude data retains its existing behavior.
+
+## Evidence
+
+Focused unit tests cover healthy, exhausted, missing, unreadable, and first-boot Codex states plus explicit Claude regression boundaries. Integration coverage drives collector through QuotaManager into the persisted quota file and proves both wall shedding and healthy-to-unknown fail-safe replacement.

package/upgrades/side-effects/codex-model-retirement-fallback.md

@@ -0,0 +1,77 @@
+# Side-Effects Review — Codex model-retirement fallback
+
+**Version / slug:** `codex-model-retirement-fallback`
+**Date:** 2026-07-10
+**Author:** Instar-codey
+**Second-pass reviewer:** not required
+
+## Summary of the change
+
+`eventNormalizer.ts` now emits the existing `unsupported` error kind for Codex's exact ChatGPT-account model-retirement response. `CodexCliIntelligenceProvider` consumes that classified signal and retries once using the explicit `gpt-5.4-mini` safe-floor constant, after verifying it remains in `KNOWN_CODEX_MODEL_IDS`. Both structured and legacy exec modes use the same bounded authority.
+
+## Decision-point inventory
+
+- Codex upstream-error classification — modify — distinguish the model-retirement response from generic authentication errors.
+- Internal Codex retry authority — add — permit one safe-floor retry only for the classified retirement signal.
+
+## 1. Over-block
+
+No legitimate request is blocked. A successful first attempt is unchanged. Failures outside the exact retirement signature continue surfacing exactly as before. A caller already using the fallback floor is never retried, preventing a same-model duplicate call.
+
+## 2. Under-block
+
+If OpenAI changes the retirement wording, the new response will surface rather than trigger recovery; this is deliberately fail-loud. The fallback model can itself be retired, in which case its error surfaces after the single retry. API-key-only model availability is not inferred from generic errors.
+
+## 3. Level-of-abstraction fit
+
+The event normalizer owns provider-native error classification. The intelligence provider owns bounded execution recovery and already controls both spawn modes. The retry consumes the shared classified signal rather than creating a second raw-stderr policy. The known-model registry remains the authority for acceptable Codex model identities.
+
+## 4. Signal vs authority compliance
+
+Required reference: [docs/signal-vs-authority.md](../../docs/signal-vs-authority.md)
+
+- [x] No — the brittle provider-signature detector produces the structured `unsupported` signal; the provider's narrowly enumerated recovery policy consumes it.
+
+This is also a constrained protocol invariant, not conversational judgment. The detector cannot retry anything itself. The authority requires the exact classified condition, a different requested model, and a known registry member before acting.
+
+## 5. Interactions
+
+- **Shadowing:** retirement classification runs before generic auth classification so the recoverable condition is no longer swallowed by the broader category.
+- **Double-fire:** `evaluate()` owns the only retry. The mode-specific execution methods do not recurse and do not contain fallback logic.
+- **Races:** there is no shared mutable retry state; the attempt bound is lexical to one evaluation.
+- **Feedback loops:** the fallback invocation bypasses the outer catch, so a second retirement response surfaces instead of feeding back into another retry.
+- **Observability:** `onModel` receives the original model and then the fallback model. Existing usage callbacks still reflect any structured usage that Codex emitted per attempt.
+
+## 6. External surfaces
+
+Codex-backed agents gain automatic continuity for internal judgment calls during a model retirement. No endpoint, configuration, database, credential, user notice, external network integration, generated URL, or operator action is added. Other error types remain externally visible as failures.
+
+## 6b. Operator-surface quality
+
+No operator surface — not applicable.
+
+## 7. Multi-machine posture
+
+**Replicated by code rollout.** The fallback policy has no mutable state; every updated machine applies the same constant, classifier, registry check, and attempt bound independently. It emits no user-facing notice, holds no durable state, does not interact with topic transfer, and generates no URLs.
+
+## 8. Rollback cost
+
+Pure code rollback and patch release. No state migration or agent repair is required. During rollback propagation, a newly retired model would again fail loudly rather than corrupt state or silently choose arbitrary models.
+
+## Conclusion
+
+The recovery is intentionally smaller than a generic retry policy: one exact classified provider response, one registry-checked safe floor, one additional attempt. Boundary tests preserve visibility for neighboring errors and prove the fallback cannot loop. Clear to ship after full gates and CI.
+
+## Second-pass review
+
+Not required by the instar-dev high-risk list: this changes an internal provider error-recovery path, not messaging, session lifecycle, dispatch, compaction, trust, coherence, or a sentinel/guard/gate/watchdog.
+
+## Evidence pointers
+
+- `tests/unit/CodexCliIntelligenceProvider.test.ts`
+- `tests/unit/codex-cli-provider-execjson.test.ts`
+- `tests/unit/providers/adapters/openai-codex/observability/eventNormalizer.test.ts`
+
+## Class-Closure Declaration
+
+No agent-authored-artifact defect and no self-triggered controller — not applicable.

package/upgrades/side-effects/codex-quota-load-shed.md

@@ -0,0 +1,91 @@
+# Side-Effects Review — Codex quota load-shed parity
+
+**Version / slug:** `codex-quota-load-shed`
+**Date:** 2026-07-10
+**Author:** Instar-codey
+**Second-pass reviewer:** framework_guard_review
+
+## Summary of the change
+
+Boot now constructs `QuotaCollector` for `codex-cli`, using the existing rollout reader. The collector maps complete primary/secondary windows to shared `QuotaState`, persists explicit `quotaUnknown` when collection is missing or broken, and attributes both as `codex-rollout`. `QuotaTracker` treats complete Codex readings as authoritative and Codex uncertainty as fail-safe denial while preserving Claude semantics.
+
+## Decision-point inventory
+
+- Framework collector construction — modify — Codex gains a real quota producer; Claude construction is unchanged.
+- Codex rollout mapping — add — provider windows become shared quota state.
+- Solo-agent quota authority — modify — complete Codex state gates normally; Codex uncertainty sheds.
+- Existing-agent awareness migration — add — all framework templates learn the new safety posture.
+
+## 1. Over-block
+
+A Codex agent with no readable complete rollout pauses new jobs/sessions, including first boot before its first quota-bearing turn. This is intentional fail-safe behavior requested for a framework where unknown capacity may already be a hard wall. Existing live sessions are not killed. Claude missing data remains fail-open. Gemini's provider-native capacity signal is now explicitly authoritative; at the normal 100% wall behavior is unchanged, while an implausible >100% provider value now sheds all priorities instead of entering bounded-degraded mode—the safe direction for a native capacity signal.
+
+## 2. Under-block
+
+The newest persisted rollout can lag actual provider consumption until Codex emits another rate-limit-bearing event. Thresholds therefore remain the existing brake thresholds, not a prediction system. If quota tracking is disabled entirely, this subsystem remains intentionally absent. A complete but old snapshot is rejected by the tracker’s existing staleness bound and then follows Codex fail-safe denial.
+
+## 3. Level-of-abstraction fit
+
+The existing Codex rollout reader owns provider-log parsing. `QuotaCollector` owns normalization and persistence into the shared state shape. `QuotaTracker` remains the single job/session spawn authority. No second parser or parallel spawn gate is introduced.
+
+## 4. Signal vs authority compliance
+
+Required reference: [docs/signal-vs-authority.md](../../docs/signal-vs-authority.md)
+
+- [x] No — the rollout reader and collector produce structured provider signals consumed by the existing quota authority.
+
+Quota exhaustion and missing-data posture are constrained operational invariants, not conversational judgments. The tracker already owns this deterministic authority; the change supplies the missing Codex provenance and framework-specific uncertainty rule.
+
+## 5. Interactions
+
+- **Shadowing:** the Codex collector replaces the previous explicit “no framework usage meter” skip only for `codex-cli`.
+- **Double-fire:** a solo Codex agent has one `QuotaManager` and one collector. Subscription-pool polling writes account metadata, not this global quota file.
+- **Races:** `QuotaTracker.updateState` retains its atomic temp-write/rename. Failed collection writes explicit uncertainty so a prior cached healthy state cannot survive invisibly.
+- **Feedback loops:** shedding prevents new spawns; it does not start retries, migrations, or swaps. The next successful scheduled collection overwrites uncertainty and reopens the gate from real headroom.
+- **Gemini scope:** `gemini-cli-capacity` joins the explicit authoritative-source set. A regression test locks its real-wall and over-wall behavior so this additive safety choice is deliberate rather than a silent ride-along.
+
+## 6. External surfaces
+
+Codex agents may pause new background jobs and session spawns when capacity is exhausted or unknown. The existing quota-state file gains additive `codex-rollout` and `quotaUnknown` values. No endpoint, credential, network call, URL, or operator action is added; rollout reads are local and read-only.
+
+## 6b. Operator-surface quality
+
+No operator surface — not applicable.
+
+## 7. Multi-machine posture
+
+**Machine-local by design.** A rollout describes the Codex account/config home available on that machine, and the global spawn brake controls that machine’s work. Subscription-pool quota continues its separate replicated metadata path. This feature emits no direct user notice, holds only the existing per-machine quota-state file, does not strand topic state, and generates no URLs.
+
+## 8. Rollback cost
+
+Pure code and additive-state rollback. Older readers ignore the extra fields/source at runtime only after code rollback; deleting the optional quota-state file is not required because the collector will replace it. No database migration or credential repair exists.
+
+## Conclusion
+
+The change closes the last solo-Codex fail-open path at the existing choke point. The design deliberately persists uncertainty rather than letting yesterday’s healthy headroom survive a broken reader. Claude authority/degradation behavior is explicitly regression-tested. Clear to ship after scoped gates and authoritative CI.
+
+## Second-pass review
+
+**Reviewer:** framework_guard_review
+
+**First independent read: concern.** A corrupt quota-state file could return previously healthy cached Codex state, and a complete rollout without a valid capture timestamp was being stamped fresh. Both would let uncertainty masquerade as headroom.
+
+**Resolution:** Codex now clears cached state on corrupt/stale file reads while Claude preserves last-known-good behavior. Collector authority additionally requires a finite capture timestamp no older than the configured freshness window and no more than five minutes in the future; otherwise it persists `quotaUnknown`. Adversarial unit tests cover cached-healthy → corrupt and missing-timestamp → deny. Revised concurrence recorded below.
+
+**Final independent read: concur.** Fail-safe cache and timestamp handling are correct, Claude behavior is preserved, boot wiring is sound, and the reviewer’s focused suite passed 75/75.
+
+**CI follow-up:** The intentional framework-specific corrupt-file catch is classified inline with the repository's narrow `@silent-fallback-ok` annotation. This changes no runtime behavior; it makes the already-reviewed fail-safe fallback explicit to the no-silent-fallbacks enforcement test.
+
+**E2E clock follow-up:** The live Codex pool fixture now injects a fixed clock matching its recorded rollout. Its five-hour reset timestamp had crossed during CI, so the real poller correctly zeroed that expired window while the assertion still expected the pre-reset value. Freezing the fixture clock removes the wall-clock time bomb without changing production expiry behavior.
+
+## Evidence pointers
+
+- `tests/unit/codex-quota-load-shed.test.ts`
+- `tests/unit/quota-tracker.test.ts`
+- `tests/unit/quota-tracker-pool-aware.test.ts`
+- `tests/unit/quota-collector.test.ts`
+- `tests/integration/codex-quota-load-shed.integration.test.ts`
+
+## Class-Closure Declaration
+
+No agent-authored-artifact defect and no self-triggered controller — not applicable.